Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26/01/2025, 01:45
General
-
Target
2025-01-26_2b32203c6e1f941d1cc6d70c19d6f4b3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.7MB
-
MD5
2b32203c6e1f941d1cc6d70c19d6f4b3
-
SHA1
29556ae029d28568f2b83ee1f5967d4ebdd0c60e
-
SHA256
19f6760ed9af5112993809d4eaeb1e103528add55b1f84a6fc721742732f0da4
-
SHA512
f5da93bc11ca6176005e547f2f21b61c0541f99ffc99d744d8f900af85fa830c90fbbb7a824e522f66568a454355b822374d302802009862227f2c98249a5304
-
SSDEEP
98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUz:j+R56utgpPF8u/7z
Score
10/10
Malware Config
Signatures
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-26_2b32203c6e1f941d1cc6d70c19d6f4b3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-26_2b32203c6e1f941d1cc6d70c19d6f4b3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
64KB