Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 12:52
General
-
Target
2024-12-17_fa6eedf895a737ee0f34c4ec5533308c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fa6eedf895a737ee0f34c4ec5533308c
-
SHA1
af5cda5f0346c151a0b9c11fd53518285b8e9552
-
SHA256
0f3b200e55738526ad7b9fd157f70646e688febc023d62f2e75f15fe94bffce4
-
SHA512
07a5dd73a6fd735847cf0792670cc1402af7a458b652fe48dae19a4afc7ee43f7a4189b59c3fcab1372ef039c5be3ac0b79137d30058fb2fdbae9e1be8664237
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBib+56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_fa6eedf895a737ee0f34c4ec5533308c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_fa6eedf895a737ee0f34c4ec5533308c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SejvFKF.exeC:\Windows\System\SejvFKF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQzwilM.exeC:\Windows\System\wQzwilM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fLvqYur.exeC:\Windows\System\fLvqYur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NWEgZkX.exeC:\Windows\System\NWEgZkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXVNJRe.exeC:\Windows\System\gXVNJRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfsFfqg.exeC:\Windows\System\IfsFfqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPmqfiT.exeC:\Windows\System\aPmqfiT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFgiqVL.exeC:\Windows\System\KFgiqVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEszSFF.exeC:\Windows\System\hEszSFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLXtVro.exeC:\Windows\System\HLXtVro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTUblhu.exeC:\Windows\System\tTUblhu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdvZGyi.exeC:\Windows\System\VdvZGyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXzGFXM.exeC:\Windows\System\pXzGFXM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QtswNHz.exeC:\Windows\System\QtswNHz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuJyZdI.exeC:\Windows\System\RuJyZdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUxHWnZ.exeC:\Windows\System\OUxHWnZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EpHanPy.exeC:\Windows\System\EpHanPy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DDiXZSO.exeC:\Windows\System\DDiXZSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CdjVUTb.exeC:\Windows\System\CdjVUTb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrjzFwt.exeC:\Windows\System\zrjzFwt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gbcefgf.exeC:\Windows\System\gbcefgf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51e359f7c7500a2f642251fbe0af3f02d
SHA1281afd2d7334a7c0ef0c4ec2ec4c2424e716012e
SHA256ebb966640301dd621258a1089c10be667871ab54051d27de94ec6207eee1fb54
SHA512a79f4f472d93fec12ab7324aec6cb32f4520fcbad9907cb52ca256cc9c8a2d61f0632c2655b51d0530427560e8979c85573cb3258cbf1571e04007fd26ab8e17
-
Filesize
5.2MB
MD5ded43272864703267b3b91089db09865
SHA17410bffee72b487efd9e3b1c38793a28216b740d
SHA25618cc239bb7a8c1a99de061310b0460a851ee7d9088c66476bda1717b123602bc
SHA512d4e20df5daaa3e07b6efcf33f1e943a7139637c8b6b99e53c439abe428a60cc5fbce72a1488c000535e5b6f8e142e829df5d1285a41017a8db2c7fd9504e2ffa
-
Filesize
5.2MB
MD580ae1176b6f6ee6acb38210578a32943
SHA1111d24c652f31f1e23e76be47c39f528a353d68b
SHA25658d2477c9f891cf617023eb94d29de1656f59645afa0f2f14cfbcd22cee3c56c
SHA51275e7bfa23436911f86b488d98ae0c556266191fd54e9823d5e9271a4da5553a9331fd53d4bded84a812087b7e2f20e59340adefd32a3ff66aec6f48433ee1bcc
-
Filesize
5.2MB
MD55baaf4dda0cb32440c2d15d151e87ccb
SHA12103dc9c22787a555a8a822f470b9ad80b3f1f5f
SHA25612cd623de865875d33c54eefc2e5b34ae8b6d8073b39a3468b46ac48aef58209
SHA512d5fc82bbfc581a6394ee68936d7b49d402abd55004c63fa13995c23869faa87ed89c0dfdcf0065a449ad24832847c9970d28681d9da82280b7efddc810e63872
-
Filesize
5.2MB
MD5eee82ec7b9ce09e46c7fc4420a76ce87
SHA1f7561b011b17e91cd393c65ca1f408301f6a22a4
SHA2568666b56d5f0c36e02c02c898a85e2d25fe5d1cc80dfc1ea3383be36d54d5d0cb
SHA5122a4fb6b0d8d8deef4cfc6d7e22406ef6cd3ad095981caa37128af3238dcd8eb36327d41d7f8d99a38e951a592ad6cbc5df48c9bfc9d34f8add6e8180d2e84a01
-
Filesize
5.2MB
MD56fb6769205081b36c69d0f7b409e37f2
SHA139bb8219f7efb59e1e82be3a35001e04a9ba187f
SHA2565ce9c443087d35f1f2bde15a6aad2700dbf687bc6ff1e1031cd420df9b4a03fb
SHA51241a2855fd0258bce608a84ab9b95074b6755d4446e3634fc1c15ed791b12468edf63a22c449a74660be1c3ac36acf4f40b808b2e741599ac4b4a0079f380c56b
-
Filesize
5.2MB
MD54ad6b014a132ce84c7dc764a5daecb9e
SHA14fd6218e3aad2edc8d589e7b023fbbd7fcd1caf8
SHA256b9410192147878fbe3761fd85b92e1a256b1ffb26b0446db625cf947bfdb9959
SHA5129db67d0aca708b3846921956dadde09cbd9e5335ca2c50e3832871c9714c330217d8ecec531eec8ebc7adc2f96358cd40e3fa0d5b973064b6015a3deb70c1c35
-
Filesize
5.2MB
MD58056f9b968e441fa8ab4ef7d72f66406
SHA1fdf7dea512d471d4f6a95adea0d624cb0dd7262d
SHA256c453e4a3ddb4a90d2c1a8eae314b255140ffd3e279c0dc275bc72af4399e6ef5
SHA51209d54593a24d4c4f07eddf772dc3855352954f0d726c1ee595bfd3245d0d93077b508e4cb174d8b0d2c32c41becba2c0276fc2e10f75c5ad642c51512268440a
-
Filesize
5.2MB
MD5eff5e512bc0bd81c69c3da2f57181873
SHA1c2770c3a4957c30e408f64151326282b48c52a37
SHA256fdb92a9a496a21020ab8251e09bb8590054dab342fc9883fcdea70ec4b0094a1
SHA512078c09352e2398dbfefb3d3059c0fd1bd6a16478e5580320a49e28bf0ec51ce8bdca776ca40bb4458fa1102aa26aab6bfe356cb02977e7230b38abb931aaecf1
-
Filesize
5.2MB
MD5c3ae9fd2c223ab17b693a35a1709991e
SHA11b0bd456141892ed6529d40fbe35aae7537817b4
SHA2568392950aeda710550c6e50bbbc9c506dc83f02d13ab240bc9e2d16d112cc28ec
SHA512fd253b53271aaf6d31c6f21cb5f2a1592cdb4cf9f7112413449df234750f02ec454ab21608c4d208d51d39d6bfe8a8392fc3260b4a7c63c6abf528881ef3d692
-
Filesize
5.2MB
MD57b87529f23f644252fa5772e6d85c752
SHA10654fa213ae5510deb3f361673f0fc61f2c81a2b
SHA256d8a1c0b168929ae2b5b331978f67fd1f9047881e9ede278a2fc1117314fc63ae
SHA5121decaa4e696c31112d08dd0a1896d84e9b6de3f5fb3c0798adfd6c48515f791cabb27c85e73cd48e0cd1e4e7f89626ad6f26d69fa3f5875b18683e729ee30d86
-
Filesize
5.2MB
MD58ba487040a5f6c0c4bc78386767523d0
SHA1d4170652d651d32d4fa9744bbc2faba951058023
SHA25693dbc7badc3c8ff1db8c1a25da5f0f85bda7017b0b9b722fee2a92087bf10579
SHA512358b8121e039cdc53bdbb0cca9a1de64aee8dae807ad50ccd8c2322be98b8ed488141ec66eba1ea3c28c0e4d784a8d0839f9e265a9dfd26ce2873ee6de0cd883
-
Filesize
5.2MB
MD54fda8387d24976d9dfe1b8484756df84
SHA12d0c39c9bf7993aaa5abe3096495aa5e8f8b220f
SHA256c485d3ad0ca57da837a4ca49681b70a6933bfde59ad01865c7602017f66755a3
SHA512b21c3a275fe8953b652b9954e0249d9d6bc7ebd47a86a9e027e6c1049129a33fcde1532569778c5790b255a175a37924ea1425ae8034c8c5b75d696b537fae1f
-
Filesize
5.2MB
MD5b2661c5a07b4697874738712a0dba364
SHA1240b366ffc412d90e0aa985acecb0d29da3d7acf
SHA256615f301226519ec9d9b8b7a7c2a876bbd192ec07912c279e22822455c4fdd1f5
SHA512bb914e08361ba3d012b70dbb2637ad110c491c3a4f87a00c17aa146eb7ce612b9ccb424fb5cbd0bba1bad7b033e16b7a74bc65540f35cf413a6eeaf5a0d68c91
-
Filesize
5.2MB
MD51ce86c4ca22c25a899e1863e1351fe44
SHA1b459fd45b57b4ca27611c44d93cee5a8413cf042
SHA256f3d65a17c8e317b7674ee9e97e36348cf1135cc4a05af8a105eddc4c6f44b583
SHA5129f0911e57d8439b8d537a569984e7e93441430c2fa445a20cea49cbb1b6206fe059871f140d5f6a8832245dfa810fbe3ddbb3977b968249c41f1729d22279e84
-
Filesize
5.2MB
MD556141332c325d60cbbaf3fbe72870fff
SHA195207340a314af99f48a31ca3d55d85e5a959d0e
SHA256ae1f48e3e9bf7c871ed5fa1b5522d07f6736c76b2fb30565425608974ffd7ba1
SHA512fc2e95519994cb0d0a45342d68440120ee8189f65fabf02c79e8b06ee767e1cc70ce454e548c65a7f40d20bf8258e07125f8ff7d862d7ba001e6ab5069acb02d
-
Filesize
5.2MB
MD5e175393f3eef96027364f857a5ffdf37
SHA144c2301c41e6584a88d723ddd53f98fb662d6191
SHA256848c95c2a9c9d13257ba787854213c47fca65e461662ddcd6426fc0881b380d6
SHA512746f84bdb7cb43641f5c82ae7ee5515280c2eded3675282c2af3b86145212a8e6be8b5389fdfb996f7b8241b0fefde685af8d81b106e012147afe33ab95f040a
-
Filesize
5.2MB
MD5d29d3b994547466024e4eb0ed01fa127
SHA145c95594afd09be3b54dce4c4fe00df969adb909
SHA256919b64dc07e6a871f1145d0a10357d1bcf7b2f08cf76ff43561f35ee146ac1b0
SHA512d897c65ef36fbdb406bcf4753b7c0956e7e204e3d149b1660c12a7a5fa6040ff544215a18ff27f098d719be2f737aff77f66944a2b1a96b130d4d2967a78bbcd
-
Filesize
5.2MB
MD550a614943ead857c8a70f3f3d4404bf3
SHA1850e538b5ce9264ee5942020890d9e5f02fbd589
SHA2564029ff2d4ce19fb1b98131346bc5fa540bac904b030bd6f80cd5ccf53515aaf1
SHA5122799ee989963abb5e0ffeba50f1e94b655ffcc80dffbea58ca299a3c1af30a2fd5d69a232ba0b221c0ccfc909bcd19edcd26ff6d58b18b5683875acd9f680a1c
-
Filesize
5.2MB
MD5f9b4d60d847b87bb228dbcb8051bad5d
SHA11812fa4e0b969def379534b1a8f3fad4a7dd79e5
SHA256fe0120f6904e5494a1f35906d53aee8bc7747cdedbf62c147941bc637eeef73c
SHA5121ca500d59bb66527ada1f5abef3161f8cfe35695a81384761c294123a6df13fad39bed2944545b1046516630af59a549d59565a7f06edc1774691a0b79a0ed07
-
Filesize
5.2MB
MD53a45e3c4f8446b221dac5cf43daab3ed
SHA16b35d8b7a205adc49f05c4e12b0680f400d40a5d
SHA256d7c9b49c4b0f6f28d4fb484d62125f042e118a8c7d5c02a54233d304d71389b5
SHA5122c405033c229b9b9d5c5daffe76a875ab04e9c5cde808b0687b40c65ff076ecf168a5ec763e3cd682c3ddfebdc9b27fc0a499c6b720ff34e589f75e9a81dd0da
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB