Overview

overview

10

Static

static

10

2025-01-25...at.exe

windows7-x64

10

2025-01-25...at.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2025 03:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-25_3205e42431e72bf63c24d57d67f149a8_cobalt-strike_cobaltstrike_poet-rat.exe

  • Size

    5.7MB

  • MD5

    3205e42431e72bf63c24d57d67f149a8

  • SHA1

    fafff89f268bdd01e06e74513acbb9ba13cb3a05

  • SHA256

    8f09779878d98d8b45f1ce4ff8cb999557414dee2cc763f9b63e02535b9cc6e7

  • SHA512

    219131edf496f9b2c49f2c4329ab4d503074bad3c12107d62191f42ecbb84b2eb6a2bfc7d9104aad60ddb4aa9be6d583aec4fc95368c1f9edad4b5bcd8c87ba8

  • SSDEEP

    98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUX:j+R56utgpPF8u/7X

Score
10/10
xmrigminer

Malware Config

Signatures

  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-25_3205e42431e72bf63c24d57d67f149a8_cobalt-strike_cobaltstrike_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-25_3205e42431e72bf63c24d57d67f149a8_cobalt-strike_cobaltstrike_poet-rat.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4816-1-0x000001CA734C0000-0x000001CA734D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4816-0-0x00007FF736BC0000-0x00007FF736F0D000-memory.dmp

    Filesize

    3.3MB

    Download