xmrig | 97d4c206a943b78487510c8ce95f398770874e593cb17991dd8dffa6c12141e7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-02-2025 12:07

Target

2025-02-01_88e10890fad55c1ad949c93d40631fca_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

88e10890fad55c1ad949c93d40631fca
SHA1

e8dfeb4ce0ca35601083977fccab28d57e63fbff
SHA256

97d4c206a943b78487510c8ce95f398770874e593cb17991dd8dffa6c12141e7
SHA512

c5f47c1f2d83f98864f305ad5e07ca4aea094562a9684c25c9381ec16b31acdb8987d32dd91111b92234514032b43e9408646b2ecb11231801c958d893f66230
SSDEEP

98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUy:w+156utgpPF8u/7y

Score

10^/10

xmrig miner

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2512-0-0x000000013FEF0000-0x000000014023D000-memory.dmp	xmrig

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1076	2512	2025-02-01_88e10890fad55c1ad949c93d40631fca_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2512 wrote to memory of 1076	2512	2025-02-01_88e10890fad55c1ad949c93d40631fca_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2512 wrote to memory of 1076	2512	2025-02-01_88e10890fad55c1ad949c93d40631fca_cobalt-strike_cobaltstrike_poet-rat.exe	31

C:\Users\Admin\AppData\Local\Temp\2025-02-01_88e10890fad55c1ad949c93d40631fca_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-01_88e10890fad55c1ad949c93d40631fca_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 72
  2⤵
  PID:1076

memory/2512-0-0x000000013FEF0000-0x000000014023D000-memory.dmp

Filesize
3.3MB

Download