Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 11:50
General
-
Target
2024-12-12_6f5113af0bc35129b506aa5ceadd60b6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6f5113af0bc35129b506aa5ceadd60b6
-
SHA1
9175f070060b23b338b45082acbdad44ddaf8533
-
SHA256
86d715e487d4ea971f57d5edb2674a549afe3322a43257a1985998545ecb5762
-
SHA512
18c83a12f0d20780cbed260bc90423e1c0a0f92d1e5c7e52246729df9d2d017791922f58419e625ceb93ebd3678111492ae871fdde352acf59ccbca3c97b333f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibd56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_6f5113af0bc35129b506aa5ceadd60b6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_6f5113af0bc35129b506aa5ceadd60b6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cbQjQor.exeC:\Windows\System\cbQjQor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObRfxCM.exeC:\Windows\System\ObRfxCM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rfoXpZO.exeC:\Windows\System\rfoXpZO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CymAtMT.exeC:\Windows\System\CymAtMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkjZTpE.exeC:\Windows\System\vkjZTpE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gslheiu.exeC:\Windows\System\gslheiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgRZVAs.exeC:\Windows\System\VgRZVAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNgUhLB.exeC:\Windows\System\QNgUhLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NeDTNBO.exeC:\Windows\System\NeDTNBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aZwCmUz.exeC:\Windows\System\aZwCmUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfaYPtf.exeC:\Windows\System\cfaYPtf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZJvuNdN.exeC:\Windows\System\ZJvuNdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGzGCvi.exeC:\Windows\System\DGzGCvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XmiWoCV.exeC:\Windows\System\XmiWoCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZfGRTS.exeC:\Windows\System\YZfGRTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vcgkMtt.exeC:\Windows\System\vcgkMtt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtneouR.exeC:\Windows\System\gtneouR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvefnVA.exeC:\Windows\System\ZvefnVA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrxQAku.exeC:\Windows\System\UrxQAku.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MEWdFQQ.exeC:\Windows\System\MEWdFQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WleEKkS.exeC:\Windows\System\WleEKkS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50eed3f4ada59d908f47eae44e7fe23b3
SHA12f47e90adef87700d3336e44513a839eaa0502b1
SHA25670fe86e5b2fefeedb7d1b4147f6f0eaea4dc90c19b0184fdced21cd449d2a7b4
SHA5128ff8a062dbc6a17efc363b8a80f0169412538b06c21eb5da9dd7222b92cf8a4f75dc01375a0c7b102401717b29a0734d21529816df91e8d7c96536048f3a14fe
-
Filesize
5.2MB
MD5bd335a85852317ff37692a43c1e1b184
SHA1957d9f93de494e1b3a3a2709d0e523ff1538733c
SHA256e53f0fe6ece4c2ef1ddeb954be01e2b8561eb34801822be4374cfc33745c8d2a
SHA512ba25d6fba09fd83d1c9c12e49f8247bd65d0f0eb9c428aab94ead3c110f7dac1c208ce2e447e9e4ba0b948a4912d62c64e9d1f1235cac1323a5a91b3e2ead6ca
-
Filesize
5.2MB
MD5d60d4d3ad628164e62d7c81b666c7561
SHA1c4a1214c994a388c3b6bbf1c0091af8e2b4f5c52
SHA256678f3999f12359fe116d96d0ca53e5f521b672224aef1735973aba0af67a534c
SHA512cf14026e6367d5b73e8a25896ea2ab1c943250753e6199bdf8791bdbbcde8f8c964010f9a926704443ceb223469eda6e8720fdead62a3fbcdec5bfa05edf8e65
-
Filesize
5.2MB
MD51a80407fcdcf4ce0c578fca3a2db3172
SHA152917eef84c1c969ecf2f9eb9cdd009a65120013
SHA25634faf3eae648971a0d2912455b0721b6dd7f25d97b018983140c49c9779bd131
SHA512f818b94d01fba3ecaba5fd0931251e05318f7f4197c29a87ec77e03f383583451d57bfac32df34f87a5dc7ec9321d747aaa774ba318102e26b87576a5a536d5f
-
Filesize
5.2MB
MD585948951ea616164edf080d20aab6583
SHA186c42627b52584900db0296b63786fb62938ab86
SHA256fb539bc5dd4aa0f65938b0fba5a446cc67c1c7356acf9589af9c4cfc8f8a8e9e
SHA51260172bc19c6255f3f6bea4fe911a12d01066a38a0cf1dfd9bb536d7a9d4a4ee68935dd1b89cf0801b5a14dccb36b7ae3841ed98575309467c2cf339b6bc2a130
-
Filesize
5.2MB
MD55cc6e8c3726e52d88927a32d3e7cbb6d
SHA10f7df33f1ac8f2e6a789ae4bc3f19f5c2bdd0f4a
SHA256ffa309c0271b60abb2e5a4b2c36bbf041e8948424b4b0cf1338795391593cc26
SHA5122993f7db2dac06527a4cc9762af6065e6631ccf07dec99932287241428ab4ae9d7c1ac43df006accb656bb73e6dde120154508ce34381f50b7c7943e5187b664
-
Filesize
5.2MB
MD59be7380ab9a7cbb8b03dd0744d76fbfb
SHA188988041042b8e7835b6a57b15b3453f678df2d9
SHA25680ca03e9fd0dc57d60674c6c27da6fcefe77baa1b8ed0a913ec72141f5f63942
SHA512e897ee703de5fc5f53f960ac65cddb7f137967abb4465b6619e4dcf490b1b1eae99cafae36100f5d8faa48a7ad26380a9a8ed0662ea7475444ad60aa8d0ae218
-
Filesize
5.2MB
MD52cc96dd1a8f2bf008d0faafde37cc1e4
SHA1c2d66963c581696af1346cbc0004fcb96dbf3478
SHA25622c8c07e130991533df0be3a7ca695c01dda97029b9bd7114a15b394c2c4d15d
SHA51258ba9952b440d802d0de0ec2ad7546a2afaf46e22d564a98c2c70fedfce018018fbb17968ad080ee4b0a0e3cf08e4409a1594b260b465af100b430d560d283ef
-
Filesize
5.2MB
MD54cf140666b8bdd8331f0d37c2cef24af
SHA1f603ddd85f04e122784b9447af62f09b10472a9d
SHA25611513f774ea668f8771fb6cc747aba5e62648b7308d224169cc9cd2c042c329f
SHA5126b81a25025c02b9e647ef430c0ef64f6c99cf4b9270dc8c705fdfa358f586407862caa780e1f6a3bd576c8c0081d95d0fc1aef364a6874d46040eebddae37718
-
Filesize
5.2MB
MD504a45fb06fb19ee257186949be098b0b
SHA18a4653928e61918d67080a78b510d6dbb2a979b4
SHA2564ac1295538341b7c68cd524475646baf6e44857015cfea72fa09888159b1af77
SHA5127cc2b9914e7b0b2e9bb053215136ae39e9149f0ab9b8dbe79b8b4321f182d3e3e598029f76d9f1f02f37d83486531adb2538bc32770f923e2b0d5ba860ddeb4d
-
Filesize
5.2MB
MD570429f7daab522e585685d5e30bd97a6
SHA19a11b1b96b1ddee498e88e31b68029d07b8a7b2f
SHA256e7650965bb2d21e6e9377ea3c0394d05e2849b672789efe1e10dee1cf56ada7e
SHA512807b05c449f40a967b95566ac0232bb7c4fe94fd0f3d2c37649273dc4e6e4b6a0609112df6734c25f7990f61d336a46bf289383e7c6a1012451aec496d349a45
-
Filesize
5.2MB
MD5539b0fddb4da1bec64db3ce66cabe296
SHA1994a516ba186f35c8ca5c31ab286ca731de0d1ae
SHA256d35aae3223ed84a122ef907a47e45404c556120078c4fb077efe934cf1ffea63
SHA51228e1c47576b2b70f8ea4b0d92f7ae6838128ac737bec9fa1a1e5426e6aa3a0665f8798c05f11c776007628e65223b940a8c68272daecc8454ac05f9268b80b51
-
Filesize
5.2MB
MD511793f070815d70a065444207ad720c4
SHA1fd43479b7ef011bfe90604e771f7c2b17257590f
SHA2560a8e7ac4c9263e3f296dc7010c715a032de26bc8684ba6062c091db5a0f23e2c
SHA5123bd794e6ba8a1fa52045b7d967c86e739b1385a85b6b2a9adaa933e85320ad4f2fe187c83b2101b077dde5fae917cee6b30ea1db710fcce72dd38839998bed53
-
Filesize
5.2MB
MD5774a0c55213d3cb2fd3466f9cc783795
SHA185212cfd859003ce67167c9c09a43f4a73df5b32
SHA256af6ac9619ba7b291299a7bdab4f90336d7eb5ef2430ae1f609baffa4d8d8318b
SHA512eafb5924daa60a880df2d50e39c21a109f7b2ae618f87ab821783e1b4db5e7f7256b0c7548d0c976c85bc7b4fa66f191d8bab3fb8758866492219607084f1b65
-
Filesize
5.2MB
MD5e328d813d699a8669d0c5b2389b5408d
SHA1be189b085f61b61c08a507f7cc5fcce180ed6b58
SHA25665dc2b9e70376a3c7ed9970ed6ed83e94e549870bd82d29a52e77a233f2387a6
SHA512b88b787b8ddf3a88229b7aa75ae4c2bab6e4fe1612e2065930ffcb3e292db45dc4e1681c9c99f8a51afa6cc524ed2b4946efc451abcccf6e7425cc3b47529fc4
-
Filesize
5.2MB
MD50ac2a4b89a1ab9374b1e6eb7920fc898
SHA17fc8cf119f52a8e070a1644c6641a0b8021d9278
SHA2560fd285ec4362b7362a4ea7a0ede63629f6ff7c28c25aa74df2d96652d821ced6
SHA512511f5547420355c1b7e3a9bdaa2c8e55ebafb1e90fb0ab8fbcb407ac116c68e642b9f1cb6e9c57f855be858b52e6d37eb714d6ff7f4af1d893c4d36236fa5122
-
Filesize
5.2MB
MD59c7ff4ff8b9b0d668878a08d8e12cd0a
SHA1d86394c0783cbbeda88a23e746ff20a5d7b32c9d
SHA256e9226ded876e1253651d9fb58cce93cde3c715ba18bc5c166e8db954205c9023
SHA5121085b9cc0ea986361ae732f8c1dda27e619479aad2bcbcfd9200bbc91f4b4469c53191010f69ae6650433c9de5b9f5ac1d9fdbeac69df7819cca8ed66c2fd3e4
-
Filesize
5.2MB
MD5dc6c5d8695f1274f56971c9814f9ccb6
SHA16d89676cb317060dda04fdaf1dd5456b3155a8cc
SHA25675a98401c430cf49d3ba8d0f6277946b901177f517c6281aa07a988850c3606e
SHA51218dc3371292c726a0d4a25f38dbfbd439b9cd1f9874bba6b4f6e43599ef43a211b349cc36352c8458f0bfeab724c398ad716e255ecfe7f9858a27c2234e368de
-
Filesize
5.2MB
MD52548070cef63ac71c5f19e1a7d0f8cac
SHA1d9d107d8dfa85d5a2d31b52f019fbf6131d40c5b
SHA25690f9235ed5f4d223d454f20de809ba5562bd83ea366215f71a76d7c967be246a
SHA512e0f42042ce73720e00c7e7084b38dd78040ab704df55dc2f75fae3fba0575cf676eea38a26b5d1ea218c945e83bed1cef76637cb46b87bac6d9ddd8cbb62bac4
-
Filesize
5.2MB
MD5537295127b004e2f9cb02f49e9840554
SHA13d67b07f2d3cd1cccd0bcd0b335f846984d47a7d
SHA25662ad537f8c61c164740ec41e601ce289524278ce4e05ea83dd619400f77219a0
SHA512364694fe93cba333632eaf277ba943e0c705bb873e1750c4cfe7c1ae3ca4f53017989b33ec0986574f2a563fa2c894e3577409b12c9121f49809899e251e2735
-
Filesize
5.2MB
MD5a176732501eb645e03652a64e8395cf5
SHA1014c42a5d523417f86ea74751cc46bd872dc0821
SHA25670bece33745ac0e214f91e78c847317502b8f5132d70ef81235bf7bddadac48a
SHA5124af53f62e676a7c94bd5e6d18e8a68a81ce124220ca443fb843d63851b6851ecf560d4511a0ebbef3d5efcf2ad2824c20e26852d4c1bce33c558417a37ddc497
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB