Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 13:50
General
-
Target
2024-12-17_3c6d0ac862aba1f42aa7ff2ec684a44a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3c6d0ac862aba1f42aa7ff2ec684a44a
-
SHA1
e85bb023dd2526b2e8f5e5e2384e49dfad82bcbb
-
SHA256
909d072db72e4bcc9706045ed104d92bcdf3e132eb73ca31e368cf6cea308882
-
SHA512
903f36ecd511a8a333afc9ca464c87137d23eb1a7247cadb53340eb53f3c66e8464a1601c6e6d9985fd0ef3a4030eb6d4d7763e5c86296b210af269af24b4a1e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBib+56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_3c6d0ac862aba1f42aa7ff2ec684a44a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_3c6d0ac862aba1f42aa7ff2ec684a44a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yYrjrQS.exeC:\Windows\System\yYrjrQS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZgnrLR.exeC:\Windows\System\PZgnrLR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMrKYTF.exeC:\Windows\System\BMrKYTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqdcYKh.exeC:\Windows\System\ZqdcYKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgFFqnV.exeC:\Windows\System\vgFFqnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VOAtHuP.exeC:\Windows\System\VOAtHuP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SgrEoHF.exeC:\Windows\System\SgrEoHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znwjhsH.exeC:\Windows\System\znwjhsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNvALRM.exeC:\Windows\System\gNvALRM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rftoFAz.exeC:\Windows\System\rftoFAz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLwHsdQ.exeC:\Windows\System\iLwHsdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCCGEBt.exeC:\Windows\System\FCCGEBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znvAYHs.exeC:\Windows\System\znvAYHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYabTWh.exeC:\Windows\System\CYabTWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDYCtTu.exeC:\Windows\System\rDYCtTu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eeKKMyp.exeC:\Windows\System\eeKKMyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWIKXhK.exeC:\Windows\System\IWIKXhK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DfvVHED.exeC:\Windows\System\DfvVHED.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJkAPFq.exeC:\Windows\System\XJkAPFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqujZJx.exeC:\Windows\System\JqujZJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pDOjGUN.exeC:\Windows\System\pDOjGUN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e554d70d01d3a1cc0b9fe28f86630c2c
SHA18fc07825dfa9c4a49c991ae2f9125d1ef1952bf8
SHA2560695b011b4998a34a22f7440100330df7bfdf8cfe11529c69f50c865e329d2ab
SHA5126a0132e5ee2ee27b4ebb54e7d57c5231fb5a8d4a14d39ea92e69ef653169167029ca96aabf3c074d25f2d888c5869297810dc30932848b6bcbe2070044c537c4
-
Filesize
5.2MB
MD5bad96307f6cae437eab812d2f03a5669
SHA1051d20817cff8a047412e397e4af2e4c2ec5c043
SHA256297b41327fd6c77fc71132b456c9dc2a5dd069b55f14709227560606a0ce1873
SHA512eaff58923a879da135b9519b1d89393026a49f5d33096ef131149c47bf32e676ef89ec5575e35bbb0f185906613b9c2c391e315f7b4bec2fbab5cad76131bb7c
-
Filesize
5.2MB
MD5d37dd6d6196eb550250085d4bec0dad2
SHA1779dde926b0e31f77bde0644ebdbe2c4514bbc57
SHA256d27c0d6be6175e667f10e0eb5cac57b4ba4ad0b07c5cd6c25a2477faab543fe5
SHA512ac07e20cea62c7aa1a8fe9591b0dfe4144a6c312ce7b71597c6636fd4344b0fb76afdb3697196f10cfcc1cbd57f4d3120e214b969f5f5a55182b1860ee553968
-
Filesize
5.2MB
MD59d691986e28907ac58456338eda024e7
SHA1a44aa026bb571a810aa29aeae0e410d1bc3ba082
SHA256ef808fe61e664dcd94b4aef5d968151d6df560470403c33388a95210f716c2ef
SHA512119462e2fa3db6ba5b0a401125738f981a67972820fad60c0d82ad2b7a152469903727405b3018522df1ce4f8b01515357b691ade6e52aa491e661817cbe8db7
-
Filesize
5.2MB
MD5b13285860dd946c1dc7366902299487a
SHA18202ecd5768948167e2e04de3749ab54812c2bb2
SHA2565c222e38e03162ab1628973a1fe5ebc78032252b5fb53d637f86f30617f1abf1
SHA5124a89b3c40c7178d5ac2b7dec07c2a64daf5cd3e7cb5ab5cd65b2551cb5e70847eb77c08c33bc650cc94f74e64686135476427556f1420627a6800be7b13befc0
-
Filesize
5.2MB
MD5885e1ab9453a3c1d2878cbe141187a17
SHA128e64d2d032f330e5a680e2ac60770626be2f667
SHA2567a61e6c40682c5f03014371c9770d51cb17b85d4c15e8cf78a9846b5a6735a1c
SHA51218f3c7a45347223c2ae7e80ca181577552b5447cdad286976901a75c70ea3a76dbdbb112fedc9ed1eb29d45c8bcefda97aa105ec3f3c774a161e8a1128a0e03c
-
Filesize
5.2MB
MD5b356fd3f6bc5d9e7086440386b9e537b
SHA19c7047288a925963ab8b12f78f55923611ec419c
SHA25642fb0a5dae3b12d06b61b82b8f451ffaa2c9a456a773e4bd0dc2f30ee9746e36
SHA512718991564f51c2df7ba096c6213706fee5e4d839951674e07badd7a3cc1332ee1a27dbe298959ea9a34683babf1e045f190c8b76e338e325a8ae58ddcd368a56
-
Filesize
5.2MB
MD56586c6bf0b0b6907024526103ff6eec0
SHA12a759d2e938ffdff9e5b5e611f42dea7b1a10456
SHA256b93473bcc65b92581b869f76d444ab0b0f7e348878cd170a9ae17b27bb6963a9
SHA51210d7f1a67bc8497db495430913fedade9ce50f0f91f01e368845cda0de57c734b0d33b9a7ef7dc8408d77376445a0a0eb9c34a0e67f56bde2c6e82d24924e9ae
-
Filesize
5.2MB
MD554239710a8c24a9d6eda15a718d8e59a
SHA1da1083d3a7bb70e9660ad0f4862511ff36a1eb69
SHA25657e92526d7994b290cd50f8c98264d1f3ffd9b5282c44fa40e18c322d407a8ec
SHA51244244f074478ef2b340da0f265aa84f9878664e3e4e0b4af4d8e5c1af2a1584990bdfbd74b5de52a275311228592b8df05996f93d408432763864ec5755ca173
-
Filesize
5.2MB
MD5dc6120f59ea7710d98f67d007326ee2f
SHA1fd39c28599c2a69c4e62158bf5da0e595c941803
SHA256359a705d360f0d2b6eb3ecfee6bd137f28625b7e1c47a28fad1e6a9ff4dd5ce6
SHA512d30aa6ee4954e607a6cd89f1ffc8848f78f021d1afaf3483f1b7070f5379b2c2d9ac14925fe42ad3517f4df3007ee8190b9b31815c3c47ef8883fc5da73dfa82
-
Filesize
5.2MB
MD5b15d218757e75e40d74a39d229aec163
SHA1748db469ca836a8b6463c26d524e3fe894ad9784
SHA2562bc1bd5161c22ffa5137cf2c7643ddacf766a8faddd1ba87c55845079b733639
SHA5128769950c06ad1ab32d2e726566005ada711b775083f02c4a6ab03067fd930079b28915f5b32d69ba87f7f3193d6b88ab2129442af5c185773345322a751a8996
-
Filesize
5.2MB
MD54a63ff4eb75d7158f0e643027fbca123
SHA1a64c82a6a8141a3fb3120bca68cfe9974ebc716b
SHA25681290349351764de322394c0e9f971bc191a2212a9c937a833732f440ffa7e91
SHA51224284d6f967c219ae87938cecf79b354172694acb1084b84491cb027b8fa1d1db70a94028e078524a177015871edb115564974cf187213a13ac35acca88ec742
-
Filesize
5.2MB
MD5a09b6c1ad1c9fe52c1e64583ffe6f08b
SHA1255b1486bf33afba16929b7494bc11249e3fef66
SHA256397b0eb3b73ea2e915925c4434ebf7d379881a8b7dd346a5fc9d84d261ff55b9
SHA5122b552536395eb8c4066f55440de5b56ce71dc15adfea66c259d038926a1c14d6fe54b76a2d4f58e655f445c4923e261aff06853dd404435c0a97e39a4549904a
-
Filesize
5.2MB
MD5b5ef9a9d9e04107fef40f4b4f6994ebe
SHA1c4103d57f58f139924a15c90d1c253ec9d9ddbf8
SHA256f2404c8961479acb533b5431b5ed409b82cf50be5c5e67c865b4ed9c014d7f8b
SHA512a3e6c963d49bc2fbde905ece2d928253c68e1d1286e33d7384b30b081e9556c3e7329608b7411afce4f4eb61a49bd5be169eed94a3cee163821a1168dce6fc1e
-
Filesize
5.2MB
MD5bfe093ae2f7dca1a29e15360c4275440
SHA1afb3a1cad25982d57d185b2cad9fcd3c43c0b3e2
SHA256837c8cb1e93691be716e2c33daf1641203e0c697e1a34a47ec7ff021cc37bf95
SHA512efba90938de50e462eb7b3e8373e092cde0446eb2e1e9eaa85be1496931c7ad9c90ab96200ff894074002003f859e85b9f00ab0e715cab251c4b35702767717d
-
Filesize
5.2MB
MD544271bd2fcf31c8cc06b1409a5fcbc41
SHA1a125adf7d69cfae773f1757f082df280ab33bf1d
SHA2565861af8c37bfa6702ac3a2d76ffe9cf12f1433b65f181fa005d77ef71c4f343f
SHA51297b3cb172ebfdaa4842905b15f30a91b28dad1a5e1e3683ce9bf816d6ac7e08a3a8d2ffacaccdfb91118f4d4cf3c4c6707df9b6cbf70d1fde944ea936950c4e8
-
Filesize
5.2MB
MD53b2e2da0fdc858097fb46cb0079ee825
SHA1de580c393078f01eed4e47b4169568274dfd8640
SHA2565a75529fdcad28870bef7506088d1ee96694e416491cabc69efd8dc738460afa
SHA5126fb6f8042741b8298f2c5b8af5d3a0120f4179a3d7cead644e0461217351560f7f8260c2ac2c4f6d2a6160f509c5205954236742393fa8ac358c98684a360d55
-
Filesize
5.2MB
MD54da2a5fa0493b44a0dc30fc947052f4e
SHA1694fa15e5b86878bb5ca609073258bf8a11c899d
SHA256b1186d894924651b2ced7c0c4ee9133cb12bab3ca1d462a459cc9fa2283806c7
SHA512c94b179ce5e510e49a3249600c45e72736539eb708e87bc88d8a10b5654a2ce60bad71682176b57a11f13cdcf91f61393709294090aa6c42e02f2a75e7b8d96c
-
Filesize
5.2MB
MD54f278b88af815d6a7a8dd527b9aa820d
SHA1e60fa973f8ae11196b61404aa34eb81006e974cc
SHA2567ec91fb6afe251205b6b8906c429b0f043cb3a2d67379c494fb48cebddc1f316
SHA5125ea9540e815e53c39d659207f97d7b9b80eb2e5baafc39a1ea3aa04779b087b9c269d7b4387035229402d1338e4e938678c45f13d59d98d3dfc95aeeb3709d07
-
Filesize
5.2MB
MD5360826f9cabed2b6f00e0a0bd47a32f3
SHA192429b4a0fb209e15e3c92e58e121ca82f4bbd70
SHA2567a72b756f14aa2171540f635a55ea08b693f252a6dc69ea63b1172cd15bffca6
SHA5129dbee1659d7e01f9930805e15136d7491730616c8f263a1549ec5c0a5565e40f8f32ee72385beb1c22375dff8d06a0f7ab4a1bc8c79764d4af28ad23da4eed37
-
Filesize
5.2MB
MD5f0d90bd2cae501edb7cc78a4d08a3465
SHA1cda5193de2999dd961024c190315083a4fa31b30
SHA256a3f9b9914ddf6ef04137d9f77d54cf647ebc32f7a1cdf331dbe1462e80cf26b1
SHA5129d4447d5f37efdfd1c1489cecbd21fae7b1890f83dbf56ae34e1f6751ca1e9b8d9802be0918aadb931000418aebf8f96d8007248c468fb36cf2760c7493e946b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB