Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 02:51
General
-
Target
2024-12-14_68bdf67bf7dea2b983150fa6b0c83495_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
68bdf67bf7dea2b983150fa6b0c83495
-
SHA1
fa8f8ec1f70753ce9431f18b5e0bac7999e149f5
-
SHA256
b2cb7fc5a3539d6a5ce36d7f371e224fafa236534b01b999a74310a9ff9dfb25
-
SHA512
ec5b52c6e88e9d7a38ccd5d7a16d177ecf9e60cbac513a13bf45c0d6d2c85dfa71657bf6c747af6b13d57f06f4ef32f34101b95d6978861d5adeef1b1963d909
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibd56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_68bdf67bf7dea2b983150fa6b0c83495_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_68bdf67bf7dea2b983150fa6b0c83495_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ulBbPRK.exeC:\Windows\System\ulBbPRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsshMIa.exeC:\Windows\System\RsshMIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rouCAmL.exeC:\Windows\System\rouCAmL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lVfDlTC.exeC:\Windows\System\lVfDlTC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMuDjiv.exeC:\Windows\System\wMuDjiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRMXILO.exeC:\Windows\System\sRMXILO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eCkWhLj.exeC:\Windows\System\eCkWhLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ILkzWMr.exeC:\Windows\System\ILkzWMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RYctAWe.exeC:\Windows\System\RYctAWe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSGRMwf.exeC:\Windows\System\GSGRMwf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvCkRHl.exeC:\Windows\System\PvCkRHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AoKIXLq.exeC:\Windows\System\AoKIXLq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdWPAhb.exeC:\Windows\System\jdWPAhb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvSlNhK.exeC:\Windows\System\RvSlNhK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYNKkNl.exeC:\Windows\System\vYNKkNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xfyVovC.exeC:\Windows\System\xfyVovC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QPDcAsp.exeC:\Windows\System\QPDcAsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBRtvOV.exeC:\Windows\System\RBRtvOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdmamXy.exeC:\Windows\System\AdmamXy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAnHVfB.exeC:\Windows\System\GAnHVfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mJHHsil.exeC:\Windows\System\mJHHsil.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5265bcf0b0a54ff66c7e2cdfa875eb209
SHA1020ef3fe985d3aa219a56797a75a02028402c82b
SHA2560c47d360969a31cf2be7cb1d1f6be7419b7f35aad2526fff336cf4499655adfd
SHA51233d58ceca9f67807ae6caadc7126927b16c8a9547ee808e272ac76c34223108fd71fbb4706088029ee0dcd730667603cc2cbe7608dafe1b78357b186f779b3fc
-
Filesize
5.2MB
MD5209e89a5e223b18f83580ce9e91d68c5
SHA1036b3c2157fef76a51b337c5c1f75fa705f7dc77
SHA256c601924ab63fee647d80b176d580593cce8f2c44afe2430ca770951dc6aedf0f
SHA5129f2daecb9d7a423640e876099e993b6b3ffcd24d0842a4ffb72bb551c7aa19e20293efa297e01988b58c0bb7e8431f73363ae5e76e0aea846d58d9169a8fd908
-
Filesize
5.2MB
MD545486b4c0220be17b68ffa7d72fe65d6
SHA1474a750b957e8bbad383992826017ad663343b50
SHA256e6516c00ced5cf94d55a5f17744094da53a772147c6781214da1e373a5b3890b
SHA512f3453cf2605139929eed5f5e0053e8f3fc3c48ca0b9f6af7c6f1ea7952a446661f9bfcb5dfee8e7192dc8a69ebe02c8ec21b638123b8e37b8b8d7709cf42265d
-
Filesize
5.2MB
MD5eb92b3685f2e15b57d564123b8e1041a
SHA15fb99adec0ea7c3e1d470f46f4b72c8a0748c7a1
SHA256676a9da13c8d218e3015bbf4972e0b3e57ce4e5ba08384dd82fe4f1d8e36ccb7
SHA5128e85fc01e8988f14a919e3ef3536fb53f9c31c189c1c401698baead2c7d658a9201a24bc1e5710b2f6cda448b8986bb1eb487c77589612a87291e2d69a582d2d
-
Filesize
5.2MB
MD56850909285d2531c85d7cdce02bda9ba
SHA15a585507545e673ba24ca9de1453b47c13723206
SHA2561a04a66b1983441c5f8e0cc1b4dd9075ab683a36b0832107a58bb26b7ba69db7
SHA5121294376b83dd64bcae84643f6ebd706088b7787b261d1565b620e8fcb7ab3f39df1c2ae3f0216e0bf4930a9e2f3b6ee3a498924ac6214f2bbd8c353f7f763d5b
-
Filesize
5.2MB
MD5bd0a0f97ac8b4bcd6d6f0944c94a6b7b
SHA1c2981bed9b0134c4b98516a5fbe4f89b42863b64
SHA256914d4ba59fae4cf23b282dd55737636c710ec406195cecc0dea5d45363bf427b
SHA51270ec1ca85a7585fd6fea6ac8985471ae4ab916a577578c3a7edc009f60c128b5b56223fc8da2f4ff414bb7bf6a410662c2315a3610d12f7e31bd7dc0825b6567
-
Filesize
5.2MB
MD5832ebe647a17ea4fc945d1a1ad1b492c
SHA10a0ccfab2eb97139b36fa4983e901dbe1fec02ca
SHA256a52d80a8989d88c62352c0f59a988861d08368dc9852ffc228d47394ce51b244
SHA51272d84fb181bed3bf73d0eab22cfa9411df793b6056a5af4878361849092dce69004c9e258e108a21eed8fa9f0d7e866f6ef4722fe45a39699ad1b7b63fd45e61
-
Filesize
5.2MB
MD5c27a2584c45ebc8cc9b216dc3228d2f5
SHA164affdb5739ee59ede85d04c9d688c20de4d68c5
SHA2560aef053897d3473f7e0f2bb857b547f56128741a807bb591467a8879b44d1bb2
SHA51238edd08d0cb846cc715374a87e0be7c99af355a44d19a3a16f46ddc68cae54160890f5f076d3ffc6f0eb5fab8bc84a6515f8a55eaabdc3c1eb868ff3b4a4371b
-
Filesize
5.2MB
MD5074f9124a5a9d7577b3f119faa489391
SHA100d0a51fd82400bb7548bf5b3c71f088e7aabd25
SHA2569036b193223ee616accd1f53720596ac5560505a458df96a855b6a89331440e3
SHA512c3694f7b4d87fa9d6230d7e27a7e900d9c1550f2dfd936ff2e4d9ab2e692cc49e21a2317cf6b7c0f74e46703f3ed72ead839ba7a80a9850c8add2ba37cf8eecd
-
Filesize
5.2MB
MD57426c1ecfcb08ddc992b7cba83f7fef0
SHA1997c6641179a60c361d9c108749300d27d684b2e
SHA256a74ac6e0f5aa705d1f91099daa677b4c8f88ee7bb056d762eabd37d65bb115ea
SHA512bb2eddaa1a58d387c7468aaaaff9e992bc651e41616e9f619435b2a8c39345f3c141bd25468e72b9f531edef2c9a40bbeb69d38fddb91b521ee66515c27f7a36
-
Filesize
5.2MB
MD579cb1897c62b2019a7791a998b88720f
SHA13e8afa2fafecaea45b758e1ffc7825d27d79589e
SHA2568281c00220e185a772e9ca3395ea878a9493b7868b306f2390a4929dbacb7d6f
SHA5120a86e5b8820ddc33ceceb72e83d1bf23b84a2475be4a617e954fd46a204f9cf6b2f60221e3edff3d58c0117b326f2178af797e5ecc066ead2a9b20e71b1d00d1
-
Filesize
5.2MB
MD5b71faefc366e71efae175e821958df2a
SHA1e743f3a04af950a5e8e61c60c0ff5ccbaad88237
SHA25662edabe4d02245dba5ffa159acffe67d19eefc841b762ab165fe215810371847
SHA51208d2ed035ed5918e756c123292d8380427ae7d8e198492a64ca028a0325bc04d2780542947784c7e1230ed0d8a68b9cb83a2e9d1fa63ba2b5157882123286181
-
Filesize
5.2MB
MD527ec67fbc985342ee3b0cc021120a2f3
SHA19cfd358d45345722fe0c3fd9c671efe197322e24
SHA256edc6dd0c62da80f6ff4f57b4ce722c3f14269f1086be35d72940677856277af9
SHA512b35a705e811e726cba45b4fa90075e2a7555e1eeb79e3652cffc60e688c084c1b34a4c94a822d33b7d042e22d23ede7fc9f94015bea06327fdfcc9e3e0d06c1c
-
Filesize
5.2MB
MD54ee891ca83a3e34d88366bfb06f22585
SHA1aae5e45562219e8cc42b9edb428c5bc68da6a3f7
SHA256c5619eeb6b16cafd1a216516db2bb4e033662175e944acace34751cf4801864f
SHA5121c76ffbb1853629d6ae71139578a9a261979f893c5d6963f0478a5e792e227f305d87b20dc1a5fc6adf436e4bfa3f909278176848bf1f9f2186085aeecab9659
-
Filesize
5.2MB
MD52e2f84efd9546f2b55c1dfe4d3c3520c
SHA1ec5de860c1f322c07915890183516627007b28f3
SHA256914c8dbf3bf7489fc152ff5fc8b77c1b63b200530682c6c4b9df5700fa030296
SHA5126a33f39155263b3c8a8605d221a1d37b330cd2bbce2fbdeb6790d704d40b7b858ae5ef28e30958c158afb1e0bb5efba9e3398046ee24bec208fc5b64b38b90c9
-
Filesize
5.2MB
MD5458fe7e2f5df95eff206e88248fb9558
SHA189e3d29496c58c4935e1059ac12dbbfff761e1fd
SHA2560797dc57ede0ed4c0e8cbf4de7c033e98d2d63e6d57c4dd91c62cb471f18c73c
SHA51221831a8b1b0dacae2dbb706ac7b0d792cd5ddadd47b4ad4b6920f4fb89961c254fc972f4deb6afda5df75991efc422020fcb9d0b2b58bff548a10d7372870128
-
Filesize
5.2MB
MD511a579accfa26e145e2c8cf46e1b2cee
SHA1b2a92cd7d9f7fa67313e91fabb5f2860a48168cd
SHA256b0cd63c77446ddcb6f3e77603ad06062a8ddd1c5764402a78a646e9541b265b9
SHA51281c7d486fb91514d9ac6897fccb51edae5704c1c152fd1254254a65ae7c6edc0cff03083157fd346f526cafa02ae6de84b837496bcdf257e7fa65e1a62894354
-
Filesize
5.2MB
MD58edd168bc2a958756ba1fc90ed68875e
SHA195cd3dd4c9b79916efa6cbc5faf456b49ba0a81a
SHA25660461bb1ecfe5ad2279ae74647c97a9535762d1f41a16c27d81afb07cc7f52a2
SHA5127808033cb5f866c14adfbd4934ade8899f9239b494dbda2dc86aec4b03616793f7905d25390b56faf4aa0388438264dc8f5cf19bf16648e9b90a9c8a372857b9
-
Filesize
5.2MB
MD5167bb6dd3d12481c0b20ffbc0e2e5c33
SHA175b85a2e662ac673f0223b5b451672214a08a6e0
SHA256adec86b4bbe21cf4795b14e48e4e6953b1d90d4e5279b0dc07f2ef8afa9b4b0e
SHA512f2d50dfba4fbb06def92caa7fc5ab0666b5cf98c9c70410c1806b08b27436ff756726cc130ab6ead1911f9896c511ea62a98a492e0ad069c7e2090447292c915
-
Filesize
5.2MB
MD518f97441feba1e2e0fcbb5c01d421c4c
SHA1b01a7caf5804f3d56c820c586026efb2eb1ef777
SHA256dbbb718a3b7a970591f7046ce30cf4e00bfee1c8eacf5d5730c0a0cf306d9c4a
SHA512b9e6db477e45dbf9bda80ed705d6b40ac3052e985f5af028e68e0abd6e8df12e68f616920bf51be3836d208b12678bc7d29377e75713fb2a435a2767ce40f1c2
-
Filesize
5.2MB
MD51bc9be18cf0e6312464563c0521d0903
SHA1a06d303e9fea4c70c53a2d775cc73456ce8deab8
SHA25604cc9b3122896c45f8a99548d85667772e6389122a8415be42c54c91cdf69a18
SHA5129c7769c25ff3422f1cabdcc60ffb3c831b82d488073fb8f8a7d5f9ffa6f92b9d928983c43881d3fd216cafd6d88801cbacc03f45b0ec6a19a9bba48fbd1eb600
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB