Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 03:59
General
-
Target
2024-12-19_522c94ab509bbf04ecb03696a11b33a2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
522c94ab509bbf04ecb03696a11b33a2
-
SHA1
36e92c74d4c174f0cb2b2b53c8cdb011b0e26945
-
SHA256
e48b40f21510f5d5e67c9b5dd3911b000d68fdba433c0b7074ffb2ec1771e48d
-
SHA512
cd64dbe484b5db2a47e3f6ef4a57381517d4f99e4c32321f8d4169ae6fefe3d4517679624086c5969162d6a7ebfb373ad87fa0b0daf16925ebc275c84beeb61f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibd56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_522c94ab509bbf04ecb03696a11b33a2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_522c94ab509bbf04ecb03696a11b33a2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uMFcohV.exeC:\Windows\System\uMFcohV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilHxOmP.exeC:\Windows\System\ilHxOmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnmHevv.exeC:\Windows\System\XnmHevv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dCciVPN.exeC:\Windows\System\dCciVPN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIpuKTv.exeC:\Windows\System\kIpuKTv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKRRKBS.exeC:\Windows\System\IKRRKBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMPcpKR.exeC:\Windows\System\mMPcpKR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uqFiZvu.exeC:\Windows\System\uqFiZvu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsPWDCx.exeC:\Windows\System\qsPWDCx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhjFICm.exeC:\Windows\System\VhjFICm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCMtZHi.exeC:\Windows\System\nCMtZHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yfgyvEe.exeC:\Windows\System\yfgyvEe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTtUWyl.exeC:\Windows\System\cTtUWyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsBNNfl.exeC:\Windows\System\DsBNNfl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\desaPuy.exeC:\Windows\System\desaPuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMMJbzS.exeC:\Windows\System\XMMJbzS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yTSgnKB.exeC:\Windows\System\yTSgnKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHmSpDJ.exeC:\Windows\System\XHmSpDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdqggbO.exeC:\Windows\System\GdqggbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ChOhSeJ.exeC:\Windows\System\ChOhSeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YeKYifv.exeC:\Windows\System\YeKYifv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f7524e98f83bbdc069892188fafdac89
SHA1a0dd2e1162a3fa285f2967f1301ffe3493e0dca0
SHA2569a06f95739b43c186dae5a78ec0b12fc7dc3604ab534b257c7bed2c9d71110a5
SHA512545277db635a26ab48e2f80e0cd42b34a4ca7d486c0864bc3e8afb3422d32f0045a10f270dd086f2007e5898fecdfb3cf313caa9f8a81e53d6cf062d193cccec
-
Filesize
5.2MB
MD5d053c7656afb14e540c553f0f9e3d616
SHA1b5cb2592a4c6cf9c3d7f60222f8aff099a29e255
SHA256e4f6b7c08394fe6161eba35ca65a1d980de4f55d8aee90ccecc6c66491a61cf8
SHA512d32cbc368f4b982d21c28b96b224caeec0c2477dfeff77a4a7b801fde2653682bf3dbddac475223572f6097a9aa41c285b94adbacd26c568c94c74e080268361
-
Filesize
5.2MB
MD56e64cf5d967fe8300cd9bf19137951b0
SHA17bdb0097d8aebc05dcbbc9fe2ca40fd0b6f96f26
SHA256cba3758b9321ab60800f113703b32882b285946204a07063d963e66f4baf1374
SHA512f619f909c54122e90530735ae105befbb3caab75840e9ed1a18c3ace88e1faee3f16c5a9b8e1ff7162665c65e60ca9052203063abcd8c6ba3dabb6128d2da38c
-
Filesize
5.2MB
MD55b5565780733c42200c328a3bb77be9b
SHA1acbdb503b696c4fcb506d707045230d6fed24967
SHA256f611677cf5e484c60dd74f2c3ed3bcdbfe85436bd20d24d023675bc8426a1a32
SHA51287ab4fd09c64ac083b2364a4d91b56c68a5b638d83b6a7a1fd597de7dc62515d4b30aaf319ecb5c9088cf88eb7be588e2f1d45e8660213b530072b44b2197daf
-
Filesize
5.2MB
MD5c8bd2560a496b630bc336ff68d6eaab4
SHA19f84c2a4dbf0529adad9c7cf629f2aef9185115e
SHA256593b6ffab9f055e2a27439c147df90d5700a49ddcade9a3aa20b442c0b6c71f6
SHA51253f17879fee081d847fe261035e3bc50d664993d944ef5dd7708fff0ff3a0cdf6d231d7ec4835efe5e592acd91e9ea0aeb15f770e254093b0fc502bd64a7849e
-
Filesize
5.2MB
MD50a1efd60c11f06e6636b6f7b23ae338f
SHA1f65c35385de758d054fb118428acf29c973c9416
SHA256cf56ba4b5a3884c90187464936605e4fac3f7dd9d9c510ae3483b468149bb996
SHA512d54a8b054ede46001476dafce26a598b66b6d19e16f19e21ef55b83ed1b7fc64b92fe12715a6b6b67f81c6e037eb73561517ef296da435e43a45fe8ec80acfe7
-
Filesize
5.2MB
MD5cde62bebb805b1495848a5d855c59015
SHA19f8045999066aee4ca153beacc25871f27f9ed3b
SHA25604285d3750dbed9f763fb021684fc012b6cff6664fc75a2f45c6216ccea9a45a
SHA51279e38f2498193be50687a3de1a577af66ccd162560b9ba2c588fe5e2a27880ec6c4ba62034d46223060442750e716fc7c3f5c5304a0e054439c031d600c1ccfd
-
Filesize
5.2MB
MD53c7674d062593dd59528bfadec08e8c2
SHA10cd1ba9c8fe60375b4ca891f71dec3ce75b4d2d3
SHA256be840f36dbafbcf2f39597276d0507277a8b38289e0b494241c8a42e0330f85f
SHA512eb02d01c823a01dd63b715413d9f74c77649868d46ed6a1d84d1cb18a2f19eedc62e5a05d5c62b948aa393ec371b4e06d672be3b74cc6e5a2f13d356a5cee2bf
-
Filesize
5.2MB
MD50647654fe1354e52f03c2434352ae1df
SHA12777985bc41beef7ce235078c47ae85be04388f7
SHA2565b365ab7768311b3d4fd34011c31f9546452daeccbf997434ce2192a19183866
SHA512535be09e109d278509fdafe407ee77e5a46b6142eabcd90bc5f02ec2717c79c54c66c516f3c9d38d31708cc589274a74b84cf00cbb6207cd182e7400b1ad3f61
-
Filesize
5.2MB
MD59400158cced5aae14465f4df50169f05
SHA1244c2508fb6f7723e2cadd8d79fc679be011c376
SHA256a99b57aa0b751af7d166af8c2a80ea627a1dcf362d9d3fd57413b0d33c1378a5
SHA5124b11a5c9520aea1496c1785c7ed8972d333322fb9e0d7c32ccad2c6631b751a5c8d1f75cc696af41677f08a46f9584345e02f3bb5a5af68b5b19fa106e2275b1
-
Filesize
5.2MB
MD51a927a587a79794aaa89450462bca574
SHA10ffce73783be00464e7bd6e976032cf12d2c43b1
SHA256b93d6897178aac557985b05c2f5eb24b0b0f790126ea8b34cacc0af4d2987843
SHA5120a49f2946ec17a5bd796038951db276c971f72a8f9a8c544a15014df22cfca34ab26a536d71a7e462192dfc69564c911e8e47ae3096302da9fb811d1559a9a3f
-
Filesize
5.2MB
MD54f217c1d12d80c9f2d73da9c5669240d
SHA194a8aab41b20f8d0a90434fb6ee2e5707f5dacdf
SHA256bfaa469956b918a21f80e3269a788ba01b24f4dc157d397d1b2ef34ddfa5a484
SHA512fa60e89b816ee98b648288563438aeb58e05050a15b2004e03a8bdd1f491ec19ec5556efabef2f6f92ae9da55b224a8c63412e11d5edf00a44d43ce6a48d7b82
-
Filesize
5.2MB
MD5d0664c4490922bfb2982ff294d42c7e6
SHA1d73b8c60f3871c743e7ceabad1878d1cdd607ca3
SHA256c34e85287923a821a48f48358d8b3abf6a9e1aea409b9daa98da96dabef1377d
SHA512ea9cc6aeef4b18557276e3bc14d5f27b882c60b11477ab6712bcbe51613726183bc318f87ce97293f44114e1bcae7d73f33f796b4452b375a4545ef89953a25e
-
Filesize
5.2MB
MD539b83c2d59941f6c7a221786913f66a9
SHA1baeb45deb103a9f7b24febc82e6d3f61a21f2c04
SHA256f2dd808c0109e79641830dd9b6432fe5a312ecd31c891114641bff90eb8cf865
SHA5125eb595f1bf7e536ab6380ea572eec4022557142ab68b9de8282b5ca5b2f2333ccacc00dd132fdc6d52160206e2d90fbdf9de20abeb379131fd1067784caf2164
-
Filesize
5.2MB
MD50b52ed6f3bf7f1674448932da2b91f96
SHA1205744808540746937ca857e14668cef971fe8fe
SHA256d32b4a79007c1d14fcb7abcbf63b93097f60aa7351e3b1b8b778fa0fb28b9150
SHA512d0b4bbf0c4d302a67ecf7a87bd59bf6cef9d2f60b1c42693ca7c2887a28a8a390378c841413b2fdecab3877c83a7c7e447044d149733633ea87e6be2633467dc
-
Filesize
5.2MB
MD564bf0844a2a0c6701a6b83ec99667987
SHA117fd02644609edf6b913cd3f902257500e571d6c
SHA256f47f49e3e9c3f2771c89a125b9dbe17eb6a64fa577698536e5c6a3558bc5ac7a
SHA51248ebacd27e5d7149f894a20cc56076dca03f9822cd478b4ed43ae9ee557dd302b6ea448b2e5f2b6363694d31c89ac7180e9f969820e52b6587bb7082f22eec38
-
Filesize
5.2MB
MD5932e55927311125c32faee9a9910e390
SHA180b9d1cb75650927691cc0d7be30ac4a57720642
SHA256b51376b9da2a0ab959c6f04256bd73d52259fa046a6eb899d3d0473107b6bdb7
SHA5121aed09596e9818cc7edb94328e5c30c3105700a77c97c5880eb8397960d149385b11a558238b238482f35ab02c0e3d17052a12c3c77882e6798cab8b3e89361e
-
Filesize
5.2MB
MD5930333dc485915c2a0d44b0fc7217dac
SHA148c6103daff27de6cf91b8843ab224b78b895540
SHA25629809a1fd955f6ae6a8b75ba8fd419b1ca72ff90f82bfac17c63d331f8f0aea5
SHA512b9b5f1e554bd69571bae8cd9de165d97a6b88b901d64d666e31eba011869a059afda81731294759db84d4ab2fa64ae471edcd97b79892df3b793896c9ef440c9
-
Filesize
5.2MB
MD564d90a4d6fc955afb6a534c9f448bcf2
SHA1810390a257560093a9cab55e27464f00c95723f6
SHA256ccd80f88d0b2c646ebc4353abaee915b833a393b863bce6df0ff0760f96c994a
SHA5129c75e46dc14224f2980a4ff239327eae6772ff270e9a3ccfee3af99594ac423c931de8abd574dbffea7315fe92b727e4efb2dd869255298c07466dce5be80c12
-
Filesize
5.2MB
MD537ca8f59187d45ef00cc87e14fa74f67
SHA164f31074dc358153b0410a57e35e68657b656ce8
SHA256f3a9646b7455a82b034695d23828835f029266f033360abae8bc7c419ee76daa
SHA512573b2d2707ce8567101f05616269a91908138c98dcc034f061d6bd74b89fa0bdd4e274e591506ca3733a5dbf52c9e1d07c512ed6383182870f56390a41dc175b
-
Filesize
5.2MB
MD5829af8d9c6b33becd32f07627b7c03f8
SHA166a4e3f1e7b2dbdc034c0386991fa8620e5a3d76
SHA256f4e024d9c9e468e3a7b683fcb6788d58b6cf1974592031f8b1df009312b19bba
SHA5121b63c1e401c6ec027b7fd8a4471fae4f47ab01eb901fb1d16d71db05253478edd5a8a411b5e36bb71347a6176904c10572a590660f2ea6c52ecc61269f6ce60e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB