Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 02:53
General
-
Target
2024-12-14_82fa350c690590840584042057e81c1d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
82fa350c690590840584042057e81c1d
-
SHA1
9cfb41bebed8af62d09763a09f0c94beb793e1f9
-
SHA256
2b211c1a61c5eaebddfde3cd16537ff85876c8ea517b00d07c96ef6648286a26
-
SHA512
158a55f4e063b98febf3c25d5d018a2d61c3e34eb25fb533d11a6171a7a12267704be41b14e585690d914a08500d6b5172ea33b9c78ef9ed4f745359e39be5d2
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibd56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_82fa350c690590840584042057e81c1d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_82fa350c690590840584042057e81c1d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GFSDeOl.exeC:\Windows\System\GFSDeOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZbhgAri.exeC:\Windows\System\ZbhgAri.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BPGPsAx.exeC:\Windows\System\BPGPsAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Xrunsfl.exeC:\Windows\System\Xrunsfl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVWRSXT.exeC:\Windows\System\AVWRSXT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lKRYfJR.exeC:\Windows\System\lKRYfJR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\loGpChf.exeC:\Windows\System\loGpChf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpYwonZ.exeC:\Windows\System\HpYwonZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpjHAYn.exeC:\Windows\System\YpjHAYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzlVEUS.exeC:\Windows\System\QzlVEUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YSsinBz.exeC:\Windows\System\YSsinBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLZlAZk.exeC:\Windows\System\zLZlAZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgTcHKu.exeC:\Windows\System\UgTcHKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruVLvra.exeC:\Windows\System\ruVLvra.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OtMzBPp.exeC:\Windows\System\OtMzBPp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdLwBWy.exeC:\Windows\System\HdLwBWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzijZBB.exeC:\Windows\System\tzijZBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPZiQhO.exeC:\Windows\System\KPZiQhO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bItORSL.exeC:\Windows\System\bItORSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Qgstcsr.exeC:\Windows\System\Qgstcsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLhZUDN.exeC:\Windows\System\BLhZUDN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5550feb173eb29d2fec67818be2fdc096
SHA15ade17224a541cba92139d8766723101ec21e31c
SHA256e315092373d5fed63712b2262442fab051f12a046cf3aeb2fbf5ee5b011999c4
SHA512a3008a0f31a467b4cc7796217707abb8b3ba8b6e814ed3af90280bfdf85e63ad6af3367fc52fe05cbba7a1edc27c3e2fedabaa16f862b956028a0e730bf039d5
-
Filesize
5.2MB
MD58bbc568e27cbc0dc202f80f7232e1966
SHA181e19ae723b35ab96da4bb977d691184beb23997
SHA256a16fe5983016da984c4856547da7420350a63b6d4ceb2e72dc704ec03dccbbed
SHA5125fd4dca2fdd572f177a5372a34f5f4e99323d6aa278d7bf1e348a42e3d25f64151e3f2d9afb98172ef5a30bd8759e7ad93b18bf14e8b211125c4789d4a495f28
-
Filesize
5.2MB
MD5376976d692a1dad7d1f736a7812470a4
SHA1a9179cb1c045ad433325300d0bc17c7ff9242572
SHA256e8d74526997778c2fe41739dd66196e4af838fd2261d171a5b841108c7ed2f91
SHA5128d0910115684ad69bce6ff64278edf41f4e0f0f74f6ed228283e428d7426c7e83d2c0c1c32672906c961c10ceddf3ff32436410947fa973635f96a09a9467cb0
-
Filesize
5.2MB
MD5653043197738af6fdb5fb86821db1227
SHA1815ad86282e7641d5a5cd278a15705907eda60b0
SHA256a15dbae8bf6d7084089e79ca374223684788e1a02e8d97aecc97e7e0726e7d6a
SHA512977e2ad79e82debca4203f8a5dffc2f7c260b06a38631f734e9be44926692009d3c335beb690a3f8c40193d88f4314175abee2d5b0db7407581505c8f6d0f856
-
Filesize
5.2MB
MD5100b68aa4600e89021f4be252b8eaf21
SHA139e0fb454894f916e40af00d3bf062461316beb1
SHA2562e9971e07bde125df35e108a9cf54c9987ed431b45c1285dd646c5242a32dc42
SHA512c0686e900852c47f1604d98fd8031b9d719431187d5b8a02a6c52663864e12833d61185bebc25e97e68d36f801ba73be057e907d87a288edc62589d6195b6e26
-
Filesize
5.2MB
MD519e2e226d11e656d3db7e037135a63ef
SHA1d0b06c9e87692a394448d9c887a2ccf67c9651e1
SHA256e06238f2ec7a4b836213c8644b7ba55ffb0229acf4955533a09df7497f4b41f5
SHA5124a939bdf73a49cba796b4d7b6d57da993bf710cddf68e8c4fad3f780623699f9a37c834cea525ab489d1f851ff685c542acc5ce3627eea882bdc344c44cd1b22
-
Filesize
5.2MB
MD542a36179bab9b13a4e9f9d360a0e6712
SHA1afff1c0cf85b743aecdd03861db5dd456799f561
SHA25649163953a7cff2a22596e459ae95c3848e4656a3a83c61ebd96946c7a8e7fb19
SHA5127e21b6ad9adcd57566560e21b9ab3bfb20689a82f306e5b7b70a0b52cee59932c235389a5ead77fdb948432a6fa6d1a162f3dde1671d5109709824632a066f6e
-
Filesize
5.2MB
MD5191bc15e14824fcef0127a36783a7f5f
SHA1c05da69a94e2b1eb31577ac79d31f63e2bf20cfc
SHA2569b52a2fd6e0a69df063bce5dae4624cce5ce657f91b1d53e4a1ed4de1b1ece76
SHA51238fb6eec98f6369a16ded51b00abf8aa003186cf79d02aa41f7d35449e9b6c9cd40b46101f1be8720b27629f2235c4ea9f1308b29178a727c679b063afe4861a
-
Filesize
5.2MB
MD5bb7ae10c9a56b02a2d876a86d32d1d71
SHA16ef1dd96477f4a84e875acdb2323ea972f9453f1
SHA256f7449965551ce992727a7c569672ee79789c4199b6c186c112918dd8a7c32273
SHA512a28465f760f55f95a3a01f3c178b12d029b285961d5e9c66f7e027bb62be6f89469ae10aca04eaabcd66d278a74047e00e9a3554aab8cfc53faad92b7533c3b9
-
Filesize
5.2MB
MD5cbf0e85ca94281d4e9b8ef8e24cb720f
SHA1efe20ee1a6ec19f5400874fd75709b018dc71f15
SHA25697468742b4ee3707b4352f9792d6fd6e2af68e60df29e0b6b619b5673f6ff1ea
SHA51297791fb59b432f657f4a1a2af161e1a1f0933d5b8002301ef1b13a252c8c0275ee9dfc446628e9759708c99818783b9e23f792ad79295ba69eb513bd806ec45a
-
Filesize
5.2MB
MD5f3e1988c92d1dd95499929a784b205d0
SHA1e7635c2d2ec5129bb6e30f4eda1e8391f3813dea
SHA256ce6c0de4cc51857cb7b3e6fdc71a612ba625660b87de22582915d5f77d1b7eb8
SHA512cabad770faf0d64e0bc0e1d18cc50dbbb133dba8b80fdf5450c260ca7472d07890bedeeeee6eb2f7adddc5ece29dbbf0a3f0e4cf89254d872ff89d61ebfbb4eb
-
Filesize
5.2MB
MD5023401e0643ec3463981cf3c3981911e
SHA1480104250029f8d4d1632e9c262107ef66cdea63
SHA25656cf7e4565547341c10a3a14ebc1ba9b1a0cb3f8cf9d023edfcb58768ff88133
SHA512cd97f993c3538aa6839a3a895ed2d51be1d4acd6253ea1524613a539a3fa854828a856d52b5453462dbf1c41e107af221fc38561c811ae04c3cee92b42fd4207
-
Filesize
5.2MB
MD557faf31ec9b243a0e8e771d5117edf9c
SHA178d069c30e57f8850f1e083e8609eb839453e76a
SHA256aec81374ffcea3e1ca1e123b751d32153a2c1c9d92c8fe8049344cea8214119d
SHA5122b0e6335281eabc7f7bed427bc2e91f174851552243260439c39552267d67f86aa9532564e79e5ab94a8ec338b890c974df10ee7e9dbc8f0faeed147fdf51a92
-
Filesize
5.2MB
MD579b416f3f548937811072cb14b120c29
SHA1c6ef1d34b45e9015291ee755328a68d5a6919681
SHA2560c9e2299714c0b90daeee117e24793c3bd304712b1f3f020bfce8393e9e5e709
SHA51255b05ebacc2a7d4687f498c7257931a5ebc4b9e44f91ec0885ae066de0627cc2e21d1c3e38d1e7990028df187ee3a4201ba7a9434d493c7f2fc435f5d913a4d3
-
Filesize
5.2MB
MD55d170579e126dacad7e014d3341e5e9b
SHA1be63c97a4851e70dded6df2d201efe9d441b8d4e
SHA25665657c30a8b6fb113585488ea24f734dd11550d03457bc4ea186dc3e58e9f403
SHA512611040c818e93283b86f9e70690bcbae58d61239a6cd01fd2e213d33deb791f6e3aaf11fa45faea55470529e8aa52f73111bfaa23c3da0487de7ff75d075b8cc
-
Filesize
5.2MB
MD505688d01b7723419d859ecd657387b5f
SHA10aef4ba8d10356d091597c96ad8de0ce7beda10c
SHA2564875d626851127ebc8d9a910f0bc4a12b6f221a72c9ddb771b217e994d0e28bc
SHA5129b98fca0484e370ce4b76f097b6096de77bae198fe0bd719c4a84c1bcd6af2379e717c09fd0ef468522cbe1724b5e95889579048cfa0e01f27983e384cc456a5
-
Filesize
5.2MB
MD5c6672d13d8aeb35d8e155dbac971d2df
SHA1369e5d375a6f93997981ea871698a2730b8aa259
SHA256270002256d7e6163427565492eb76738652448fdbfa03bb402e0f5e66e3b7cb4
SHA512e85951216b10fed6db98b293df2132921730a4d232880a88f1d5e9f4ff19763697b332c77a359e13ca88efe675efadf4181c910b23c10fbc720568913532288b
-
Filesize
5.2MB
MD55d98221825e30da37abfd34ec1cd0f84
SHA1fa07b5ebad80300468ce6dafd3d2f9b6cc85f0c7
SHA256f5aa8148bde5ffc39bd67c3826f9fb1ff496800280ba2d00e42cdcaf7f925558
SHA5123069cdeac65493ed5f9ce51ab8fe77d4776df340b997c44baef5a678eb0716a4060b89c2fb903676375eb6deb6ae3fc4ab2c764828e5537bab7de4237bece7e2
-
Filesize
5.2MB
MD510fde0e956eff1db1e3b72e53915f706
SHA1ac93d024d247e76a11fbda3afe59e6fb31a6e2ca
SHA2563fdfd083f5e11d97205cc7fa167d2a7f4259be5d0502fb0075bcde2b0e7ffde3
SHA5124bb1d57a8a0cde2de91d649521828e98ba317a7da425c31655768e64e7fb3b23f6b6a6cb739cba9bc95a7da6bc7e1f70f15d4db37bcc69f8a7f38a1c6f6a38b5
-
Filesize
5.2MB
MD553107c8f264dd3cf703e0080c98388ba
SHA16b38ee51c6c92b65f35ee275597d76b4b4c8eeb4
SHA2565607265075dae5b49d495cf798bdaa6b0d17b7f1ecaad4fc92495372633655df
SHA512e65252a8ff061b1a2cd475f2ed0e19fdcf358a8cb14dd698427b9c9bc4fa08587ee232bdf84adf058a2f40d9f1bc508af48b1d7df3d06dbbc7c3f3273ae759cd
-
Filesize
5.2MB
MD52864a2e41df9a81a72b6056f37e3e9d3
SHA1bf91425fc7d6dd72710ad7c353f72dc5a65b1ded
SHA2568450114c01c613226e68a7e4bc1fcaf07bea31f78886bcb6e13d3a0520cddcea
SHA5122b148f0434330518b7d2894d2148d650bab26848e4c2e18df4be5b81e3924e616288ec053a7fb2b1ffbfee545cebf295e4301b3ae579046e4129cf2404f16f7c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB