Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 13:46
General
-
Target
2025-01-22_a36246becc80febc6540454073e05a89_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.7MB
-
MD5
a36246becc80febc6540454073e05a89
-
SHA1
5db8ca7ad70bc26b09d392f86e6b6bb908eb9565
-
SHA256
9bb21b556b7c7822f0a78e0298fdab0d81e0e0e5275714bd52b9860948a7526b
-
SHA512
3b7ff2dad4140cdb498adae6532b662b559f9d844af65a15ff1a3f31f2526d1847c62bf99387692fe562b8ed44dfc214674d97d2763563516277b3f9619ac4ba
-
SSDEEP
98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUi:j+R56utgpPF8u/7i
Score
10/10
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_a36246becc80febc6540454073e05a89_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_a36246becc80febc6540454073e05a89_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
3.3MB