xmrig | 5f3af466553c582f1bbf2d5db0ccde2d984264f05ddfa5eb6427c404cf2524c0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 01:22

Target

2025-01-28_b57db32a3f4dd734a4aba7a653e62e57_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

b57db32a3f4dd734a4aba7a653e62e57
SHA1

8c3ba206852180a58cc86d7ace4f88a63dcd5aec
SHA256

5f3af466553c582f1bbf2d5db0ccde2d984264f05ddfa5eb6427c404cf2524c0
SHA512

aefdeb538f1492ad353a7abcf322ce8567c36552c1b5b5324a49ee8b801f49f453496d39dc0f469fbc20ae145b5c34c1883b78415568af7d3555ef472f70ee4e
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUc:w+156utgpPF8u/7c

Score

10^/10

xmrig miner

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2736-0-0x000000013FFA0000-0x00000001402ED000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2228	2736	2025-01-28_b57db32a3f4dd734a4aba7a653e62e57_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2736 wrote to memory of 2228	2736	2025-01-28_b57db32a3f4dd734a4aba7a653e62e57_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2736 wrote to memory of 2228	2736	2025-01-28_b57db32a3f4dd734a4aba7a653e62e57_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-01-28_b57db32a3f4dd734a4aba7a653e62e57_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-28_b57db32a3f4dd734a4aba7a653e62e57_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 72
  2⤵
  PID:2228

memory/2736-0-0x000000013FFA0000-0x00000001402ED000-memory.dmp

Filesize
3.3MB

Download