Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 02:31
General
-
Target
2024-12-10_b0c258d05c152a721d67e8c37e8962bf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b0c258d05c152a721d67e8c37e8962bf
-
SHA1
d271a9f0b19c206b2f1d1d69f26780b11355fdee
-
SHA256
9b45bab72bece536271556f53fc381f25ae2beee9cba2fe05a1e1a4523c3f6e7
-
SHA512
34345143176824efd4aeccaf8398b936dc20d81977f07279f1204b97ce766bcd531f0ba998b1d356484bb35d519e5e5eed4eef6022090338550c22e41fadfb57
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibd56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_b0c258d05c152a721d67e8c37e8962bf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_b0c258d05c152a721d67e8c37e8962bf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PBpgznO.exeC:\Windows\System\PBpgznO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GREikzD.exeC:\Windows\System\GREikzD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uivhKQK.exeC:\Windows\System\uivhKQK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVJswQz.exeC:\Windows\System\FVJswQz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HeqTdRK.exeC:\Windows\System\HeqTdRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQUgGrX.exeC:\Windows\System\LQUgGrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJvBqrE.exeC:\Windows\System\PJvBqrE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vbNrZox.exeC:\Windows\System\vbNrZox.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gJIUoQZ.exeC:\Windows\System\gJIUoQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKPByAo.exeC:\Windows\System\sKPByAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BDuQiOK.exeC:\Windows\System\BDuQiOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CqoAviN.exeC:\Windows\System\CqoAviN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJcSsuw.exeC:\Windows\System\LJcSsuw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vKtVMyu.exeC:\Windows\System\vKtVMyu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rrDJiMX.exeC:\Windows\System\rrDJiMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIINFcj.exeC:\Windows\System\VIINFcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VOfecah.exeC:\Windows\System\VOfecah.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWZruDI.exeC:\Windows\System\LWZruDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVFITaK.exeC:\Windows\System\rVFITaK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZiBWwD.exeC:\Windows\System\HZiBWwD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQEdrLY.exeC:\Windows\System\dQEdrLY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a471415ef65f060055d91b8db3bff941
SHA1e2aaccb5786c19b698c1fb4c649cb03840301765
SHA256c4db17cc2c48b9677531e7e3a58d7712782fcdff6452d6b0dab9d221505630f6
SHA5126dcfbd28054dedf3399c6bfb0bc5ea79d3557f362238335e6a02f873b38d763a4f5e801b18f9483a54289c8f0f252f1e38eacd1d316455dbce0a4a18154831fd
-
Filesize
5.2MB
MD58c3edc6dc80abc5f70a9b97988c0edc8
SHA1b68b4ec406778691be732ed7b19fc632481b5367
SHA2565da0d4438ab07d56dc5b8b8413ab3700dfbb5653b6369dc8bdda00045ad45331
SHA512be58c76feeaa6aaef134307287b53a5b8ac5776f3a2916adeb67eb8133e870c12da8955ea4b20b9bd078795328830f420ea8b2d59d77ce5289487ec3f19c0fcd
-
Filesize
5.2MB
MD5afb697fd8c48fa6bbe1c7e2927bcd8d4
SHA16ef13a2681f9f7a9a1f153e8fa00f3f29efea774
SHA2566ef0abe76c6879843b8bcd7208d4ca9284e0ac689793691fcdfb8b03c36a1576
SHA51273912ebdd30cec04b9d4573d5ed97e271abe46885e0500711c935ea05c07bec406e7d321a680b9b68f5de15b950c4c8207410437c882aabcdaa738a0325ffe14
-
Filesize
5.2MB
MD5b98baba350913d4519568dd543b1b338
SHA1bc07424d8e6a15c6a9784aa3bfffe2841ea44017
SHA2566048498676bc3170d168efead14f8346213f2b3a1e109caea622b4a7b57f1c08
SHA512e397ec8971d63fb0fc50a794852b694323154f3cd9993e9a4a2ee5b06c6905ab63e84589350f4330ff6105b27207c0eded8bff3b18b031ed22599a1ee81ffe38
-
Filesize
5.2MB
MD54998cb2d9b0094015c8be0a1ec7d7d55
SHA13e3d9b0b7309b1d0788c86dae54a3663b19ab80c
SHA256ac0c31616ec89c8edf6c025d601bdfc9296284eb40cc24a34304eb38c07e11ba
SHA512a783c2f9a9f93f0307ba891e36cdae1b756dbf84cad27e2a58a158181a61974bd075d186c5c5bfed2bc26a319d8a7d899108b7b7a04952a8cc6de10f1713c1aa
-
Filesize
5.2MB
MD51228f4d0c0ec120b7b33439dec22901c
SHA1f77381b5fe8433b6ad38dc722c03cb60bab6b135
SHA2564d9700c2f3cdc6971ffd32ac0c7f1243014e932a85a6736a55dbc563313ab2d4
SHA51258d4ef4b335069d7e3cc1cf70ade8b94127541ef2939138feb1ddd43eb79929dddd5e1e0a0e7aa0262143cb7d6f9f18751cb8f5ade4a83d43190f126f7b3e4c4
-
Filesize
5.2MB
MD5c38ab89f2c095d8e32c79bab48c44763
SHA1ea16a4641a5d3ba3f34d111906edd618b80dfb64
SHA2565bace7ddc351c48aa6e862f0a38bbee0225b528386bfb863859ca287800928d1
SHA512078af442298e1d07c2d4283deaa61d6f1ba889e0046f91e553b3b03fae41bd8d478aa2c1890c5dd635b3578a25ad6ccd130967c067d96c89e6e76cc44a857406
-
Filesize
5.2MB
MD58fd330852c495f772349f5ff47d1bb40
SHA1d00d6f23d80fb1cd0688681c751d93e39d8d5a1f
SHA2563a3b89c4c022e44fc7ae908cf2a0e276cd4af4988990b3e9bb06ea08d99be0c5
SHA51263f4d6217067109a28c5a2853259addf387c7265c1719bc98ca3b14e7617939ae57b34a1221bac59455c319f90311c0894a9d351042a9d2ffd28718325074c01
-
Filesize
5.2MB
MD5d1107c12358755a6e231f9007737c916
SHA1e6966121287d3f94383ec85aaac012401a363316
SHA25665cedb968c66cc753f90cb2e3a04bfed4cc13ea390423464955f0891f247f6f8
SHA5122dfc6c5bf685aa35d73f17e7afce8645cb463aeee3daa1cc40562bfbf0622e4d592eb69760264f218b498833362eb02e7f5d61eb5318a1134c9c0cd923b30fa7
-
Filesize
5.2MB
MD521c13f4cb673ec8c00a674868c518c48
SHA14771252b3ee64f5a52b69fd0989c102e8474a738
SHA256d60e35d8f8404efd2a859c2848071a063e9d674b5d95126c973144144a7e3474
SHA512f2ea9b7d95e03f11298c901a132980f051d204350a97a2d8177acad7a86623413fcc3f8e6c70361796b013b1f81c15515b26340fea388228a3f45a9bcbcdd5bc
-
Filesize
5.2MB
MD5678dea1f1043f42723f7c46a9065f4cb
SHA187b8a3c1e52fdda34be9e651755b823ed8fd86d7
SHA256f8da951a9ee7dc8b39ac63fece082bed382442421614e8fa1ba9438bdf2130c8
SHA512a95229b67ff4728169d0f1d9622b3e8438854d9adeece6cc37cfa0efa688b95ef04a974a6aeaed2a3f088ed998532e73c3f4be1bbabbecf1743b2b34ee46b615
-
Filesize
5.2MB
MD5c6412c216bd24630914fef0a58a61145
SHA180ceffe7451c2661997655381c36323982f16040
SHA2568872e3d0a4667bd63c948b1e5598bf9e0e53f5b958f1e98a88d7a017dc906775
SHA5121c2e12a159a2ea9f686f8c66051ee3bbd31a4cd1d3982b504a3b60c5fff5e428e9201b9e9bb5aa9391090e8add5fc74cf5f720e681804998ddd416772ad8ba92
-
Filesize
5.2MB
MD500bdc7b8a2d58a1ea618f3c9829c4a07
SHA16c83005f04a8eea27040f5ed5ff204a6dee5df1c
SHA2568fc781935ed88d806ed9b4bf76dfd349670246a12d48912f5855cd70565d8660
SHA5122294d4f1c6864cb4104b853f24945296c725c45f6017ad98be13600ae55153b978309eafa461bfa3d1698b47739fc1f2d7433958509461217ab16f8b58edeb5e
-
Filesize
5.2MB
MD5b4b1949379e48611819f91edac728f29
SHA1a812bf5d19ab06feeeae11e9378d7102fe7c9d7c
SHA25681dd78e87d921cf777018d69e53ef3ea792c3e7f3a4dd24837530863009c21f9
SHA5125645752f1c53915c38e6841db4464b1c3ef4f6bcd92443d92d522be763e23fe9d1ff49cee06ded104b625e232d9073fb93632448dbff9ad476ab985b6b7821a7
-
Filesize
5.2MB
MD53e156980a5ddb7f9203c63cdbe1725ab
SHA1d377292d33d684e76ffdf316d885f1d07d831d43
SHA256becbdd9674a7d223a948a16a0ff8d5fcb96d31fcc0fcca5f6b7afa8e51062ecb
SHA51226dbda8d297ce26c88b863dec02c6c1fcb62b5a44f52eb54da22040fe2627c868cf8913af12d611d6c4cb526e30e68ca6a5c9a04be301e86f977b7cfb78c03ae
-
Filesize
5.2MB
MD57bc6f14eab7eb628fed7904186c5b096
SHA11604694863bc96aeeb349a47ec4df0ddc572f391
SHA256ea1a8515684eceb1030f015cdd40142873a53c4eeca03273d5b918f2a7791db4
SHA512d6177f49f5743da67ad919a2e958204f24953d5f135bdb27724cf63ced62440df3f18b92ee56dfe408fbd40cd376097930490144544035aeebbb3ef86a0981d6
-
Filesize
5.2MB
MD5fd59f1f607908fa107e54d991df6d00a
SHA1bf3eaf43683109f258db03644d7dc91532c4fc8f
SHA256922f199f8b52abc0603872bf5301adf242414bde0411dcc4f39050b82180c1bc
SHA5128183a5b8b995571e8534b99a6b5d1cf54463fa9199d9f9361b413e3c3a0b648ac8c51db53f8580aa2eacdcf1d8e916c6d57b61b57e5fb3b254e2375d24038865
-
Filesize
5.2MB
MD5b0a7efe55f1852a349ebd4b299faff0a
SHA142abce72405d5362e7885a2ba0693d25617b8234
SHA2562ab22a5187bb60e084cee2507e3afbfebe36ac055056fb0268929fbbb34bf69b
SHA5128a7b66722e1ddfd6f778042d1190b44a439d552bf167a58efacb159e1dc51263a3eb424650c6b4b0dcc0ed302c88832fab1cf9f37c1b4aae2535e9496965a425
-
Filesize
5.2MB
MD5aa6839c191327fa2ae485789044bd5c9
SHA136ed22842d1c9b05847fde298340d6ace8662a66
SHA256dfc09a0a25e56397b64731c0966c5492de684b625f22d8a027727c07f2eff1d6
SHA5128c7b58322d0f7ff478d545deffaca92f4789bb4537af72a04779675167480d13486ecd8bb3ec2ee5d51e65ea31af52900d2ca69e7e42d20dd3f67f3aa030167d
-
Filesize
5.2MB
MD53a2c42119f23d626bd0e4547aa9ba6ac
SHA19ac47423daf3ddbc0c534e2c79290cfd5e6c6de2
SHA256a2263829665c15892200242ed9b5bee7ca9f8b111f76912952d5347b73e8fa97
SHA512f5f9299e6d61a5bc0835742dfac8b9a2d23c70c4601908baa55e51c8548d7f9aaa202a229fbda5d675596d2795b8b6155b3c00a71921f25d5e54c8414d3bd3f6
-
Filesize
5.2MB
MD5bbe76924492e25f545c00dc7efc1d3a2
SHA112d6bb43de3a83ac172e044fdeb217028c159824
SHA2568f24bd17fe87921d9c3c10f30d867d27fd5eee03b25ee134d8c8051b1f5d5231
SHA51222d904201d542e61c60df6c65e5a93d93bb8c09e84ba5ccefdbb0272cf9cb0cb49f0638cb58f956d23e3ab7b3b2d0a7cdf226c2c340dbc0921e8a3023ffc41ee
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB