Analysis
-
max time kernel
132s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-01-2025 19:44
General
-
Target
2025-01-22_016b962db585d76401cfd84850d3fba4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.7MB
-
MD5
016b962db585d76401cfd84850d3fba4
-
SHA1
c0363813f6921228410e60f35bd940979c80ce00
-
SHA256
e6672d5f34c0fb28fa1d6d22bbca25a7fe5bc607259e5c87854f4307976bedcc
-
SHA512
17066207559a460d1b6cad8ad4bd1a73185bbc487344b21c42fde17e16cc14ac2873e378b09d158da1df08424d02d74194d88ef2642019a8f06a9f2f7f69be4d
-
SSDEEP
98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU1:j+R56utgpPF8u/71
Score
10/10
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-22_016b962db585d76401cfd84850d3fba4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-22_016b962db585d76401cfd84850d3fba4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
3.3MB