xmrig | 8de82b6be9678fdb39da1377f49793006e399d91681ce1f5247dccbec1c28aa0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 01:50

Target

2025-01-28_4e055c4d6251ea27665e3ecae800adc8_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

4e055c4d6251ea27665e3ecae800adc8
SHA1

ed22e424ce9d59a14bff197a7d9f38d83925e3b0
SHA256

8de82b6be9678fdb39da1377f49793006e399d91681ce1f5247dccbec1c28aa0
SHA512

0ed4eae1bed383e636541b02d5377917f94e7f85c3664fc5a30325b3ac92303500d9c56431b92268480365c9136ce90025f8f5ec6d13eaec601dac86315e7672
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUS:w+156utgpPF8u/7S

Score

10^/10

xmrig miner

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2364-0-0x000000013FFF0000-0x000000014033D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2788	2364	2025-01-28_4e055c4d6251ea27665e3ecae800adc8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2364 wrote to memory of 2788	2364	2025-01-28_4e055c4d6251ea27665e3ecae800adc8_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2364 wrote to memory of 2788	2364	2025-01-28_4e055c4d6251ea27665e3ecae800adc8_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-01-28_4e055c4d6251ea27665e3ecae800adc8_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-28_4e055c4d6251ea27665e3ecae800adc8_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 72
  2⤵
  PID:2788

memory/2364-0-0x000000013FFF0000-0x000000014033D000-memory.dmp

Filesize
3.3MB

Download