Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 04:05
General
-
Target
2024-12-19_714a5c92b117a7d4ef7bb250a759fe5b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
714a5c92b117a7d4ef7bb250a759fe5b
-
SHA1
834ecc8000d9928c6357eff7f4211949678f8da6
-
SHA256
aea94fe149b68f4f3f80957fe06945ded169db114a3a917d434381d3630bae2d
-
SHA512
a27bf26df3648bbd0c9fa9a013b37a11ec03d05d1d803c6feef1642261da07a203bcfc819b7f433fe69a5066a56bdd5def061c4ba2d30423c62095a5b68e2117
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_714a5c92b117a7d4ef7bb250a759fe5b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_714a5c92b117a7d4ef7bb250a759fe5b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uXvGgwO.exeC:\Windows\System\uXvGgwO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wWyIqtx.exeC:\Windows\System\wWyIqtx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gOOcIKk.exeC:\Windows\System\gOOcIKk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbrCIPn.exeC:\Windows\System\XbrCIPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VLiFNcY.exeC:\Windows\System\VLiFNcY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fgFLYBL.exeC:\Windows\System\fgFLYBL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhruxUR.exeC:\Windows\System\ZhruxUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huXekBr.exeC:\Windows\System\huXekBr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pcTuvxT.exeC:\Windows\System\pcTuvxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqCAMJb.exeC:\Windows\System\ZqCAMJb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PzbJANQ.exeC:\Windows\System\PzbJANQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SFoemxT.exeC:\Windows\System\SFoemxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNpucPc.exeC:\Windows\System\pNpucPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpJDEcA.exeC:\Windows\System\DpJDEcA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UwJgFoc.exeC:\Windows\System\UwJgFoc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOJbMuF.exeC:\Windows\System\zOJbMuF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKDnont.exeC:\Windows\System\MKDnont.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NxXGUPj.exeC:\Windows\System\NxXGUPj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhkRRqf.exeC:\Windows\System\VhkRRqf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIKqaGP.exeC:\Windows\System\JIKqaGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLvyPEo.exeC:\Windows\System\zLvyPEo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fb4c9c299fd6fe4bc4b474cafdd1582f
SHA101d60de19b5582923755e38eec09ffdbdd596e48
SHA256f9c4a06fcd48a01f6fefd59340b1c762c82b24cf7c2ecc8bc2c652e683fb1eee
SHA51241bea747052ae877c66e5fd5d753ea1e580deef72ab98819c94bba4612cbdb294c39ce7d7f7b9ebfb5c221ad49d73da46e680a9423e97d14aaeb95b703afd7a6
-
Filesize
5.2MB
MD5ef66d4737b39168c28004b1019040d4c
SHA1f0a54a53b15c5c4ff2cddb4128e3455200152b32
SHA25686059777edf4f31db72b2d844058beb0352cdb9aa416abb9919990f0e5dc7b1b
SHA512c20f1c463edd60e12560050b4641b3268b58d57b68928eb1495745801e1e928c98cda1d2c962abb8b49ef77547b84c27130cdb6a83137bbfb482534579ae0f37
-
Filesize
5.2MB
MD5d57020017ccefce24d04d010f18b927d
SHA1d214507a5034d4b446257ce732716b3901518831
SHA256696d5fe1c8de39f27cb21360b29a9fdeb9f712be7503fd6cbd1fcad803760489
SHA512307aef3f4b8816194305509bf963f46bf40464663be2ef874e3660ab80073bee405343708a5e7700b825df3ce83cd3bd218d19c45729de41c73c3d698bc91bdb
-
Filesize
5.2MB
MD5361ac028c74b5932fb0f089ea4c343a4
SHA1b0e1b8a33f27dfc8f7829e32b97f37d9062b1fb0
SHA256e7ff1d8a6248db355ccb4fc0c2208446ca8192a89f4de667e0c1d9f991ae8311
SHA512fa3a8aaf0968784972b9b18bf1d042f1762d4e16213997aee67b6ec74ff8d5d18b984d8834cea6867dd93df47724b8d44302cea24eb4c7a5f11587e50b0c1596
-
Filesize
5.2MB
MD515203a323f7e83696174e0abccd637bd
SHA174763cc0d852cae76d9cce53a5b6e06361f62e67
SHA2568f52190486102144b8aab4675c1d9bab0a24488c9f19968de2479b9aa9838a83
SHA5121f663374ad9c4f57b15ce49d0b4ca675e6e7b041e7ec4aba3f0f4014e5239aca051f898d370681f42b4dcbcfa9606a3fc97485bcb67f0420c5a646ef084105c5
-
Filesize
5.2MB
MD598f3ee9d72c21c51b525ced60bf052fa
SHA113b99b637da3f110c69f4fe8e94e0279d0c4c17a
SHA2569f8e4af876cf5deac186e462e073ef8cd80233649c6a659b58e32edb4db9a137
SHA512295946daa32a71dbe9508cf9a6e2c65e0ca1e7965981c8e4f0269cfa19035d73c9e2e3d63970da458f2f46748ea1d35d600a4def3957d64fab199b78274ea2f3
-
Filesize
5.2MB
MD5f4d052c70115f6fd7de614bd657741c3
SHA18364bd8a51af055d6848053eb2afb4b2354d85d3
SHA2568826336a5c06975be6a01b20ebe4532db3f6e8c53ae2376cb5d9f65ce51c9b41
SHA512e47df1acab1a39dbfb35f40c4e1ee9766b05b84a61d64fdcd53a791ba8326d5dba45b0a8aeaa03e4c148e0a0ea2580c125e26a6267fcb373a45124714582b277
-
Filesize
5.2MB
MD55166ddc220fbcb9d99904086557ac557
SHA1f6058d432ea7b6e0a17e3842dd2b2ba8b3c8569a
SHA256e1b2e7bd74b4aeb8ff477ed187534543d771f8f79c598a9e3260edadd609b2fb
SHA5126216fbe844cf68d537a69cd19bac174e29a143d30570785c2fee22d4fe27fb2dcd7788c5fb6fcc1c069a4fa4012f41afdfdf721ca2240a2edc692b0df822c18e
-
Filesize
5.2MB
MD5364b48aabd826b3e5c6c6113b2fc260a
SHA14d68c63b6190d1deb2cfda3e2f24bfd2161944d9
SHA256bbc1f57cb71f9dcf7b61f52474155e5dd8a2fb1ccad1852189a6854e5bb2f76c
SHA51212ad4af7914934006bd8441b4369b5d7191171270fd9d9697fd71def93820ac7ecd577abef2af74907a43fc5756ef7960733a3d7fa412ea727f13f2ba109245f
-
Filesize
5.2MB
MD5c7f38300650c3fdde2dc60b7566fbdb3
SHA1e42dbdc35b4041e4bddb139082316621697c0b55
SHA256915a07b116098c4df19797bb830b23b0cb92de815c0ac9964d0739c9b3bb695f
SHA512a86079c81fd8a16959491004a88fb193d740cb96a4c317b487a00a2493c75a51eb6cf03dcb2932441176642a6aa308df4a4c6a73fee2448d6a2e540815062571
-
Filesize
5.2MB
MD5a02ee018cc83a32accba7da1f3a3a2d0
SHA1cddfdbde13dbc4de57fca187a02253319da58324
SHA2564225da52b66a10eaa7f37db453559eb1b09101e747cd1f9f8aad97f7c20cb1da
SHA5126ef91139c5c5c80283721ce4efb7443180a1413e757405c46ab280737e8744b971987f5854643bedfdb1eb682d1a73b510b5e24598fda14498835bffaac66762
-
Filesize
5.2MB
MD5ea06ea502333e3d9aa5b2c1dc8d73ad0
SHA17c999f060de9de40d6b614c9b759b64c565bb90c
SHA256b42c7bca2450386982631ab7bfeae024419c434f29e02b5d1293d58fb3ce4604
SHA512714ecb7ac96a473f25202f0c822329a8f4865f039d6653b20b478ae8e76b1f20d72598af4c4e708eada2744e7f98160503c9d760d5defa8bd4798d63a5c914c9
-
Filesize
5.2MB
MD59ace4d0140e5abcc0edf45406a86fc8e
SHA153725c7e182e122634666ce1d3328b05b9a2afcb
SHA256647124816106554874cc7cca124c563c1c2483586bde0feeaa45d93c56f9d82c
SHA512bed40e741218a32f2eb3c4fc36fd6abf2c3e6f7aceba745a3aa0fd3f69ec75f9a5f78a0ed26ac783b95d91b3bff9166b29cb634fe26dd88fd916e6f7ed26323a
-
Filesize
5.2MB
MD5210f15d54af8e9a390e517169f39a440
SHA1862bd7b2df334ee8896ac0a1b3df16e8818067b0
SHA256926c24d5370e3033a8a9a5e388d27d28aa514f75afe3cb6ac4bad02d1b0ae819
SHA512660beb6804fb70483fb2a8f956f18c88c307145566e900ac0f30a53555a04e1405622ff13fdceed33c6546183e9b8fbaa3feed78bb8a739d724cf3ea9e9e113d
-
Filesize
5.2MB
MD5bceab4c034c6cdec954403fc88f0c3ea
SHA1120c1bc92f88bf18a5129cb9343e0c99f6766d72
SHA256d20b9a037191bd05eb34d6b60296721dd2e1ddac8d59708141ebfb3d41f13538
SHA512df910d3ab1936e4f9bd3b64f12a5cdd6dcd2c501d43ef7155fe3d781edb2bb604bf637c08e663fc2d1759515fb9bdad551cff378aebc46b6c611221dec928004
-
Filesize
5.2MB
MD55a304e367bd9bda18dac990c88066080
SHA1a17b86fac811e39cde97af4e9843adc866778748
SHA256950af3e2aa5d16f04971375c24660df0242d1829e81229ceec606c6dbbf3f48e
SHA51207bce1c93d8017bf8ac09f2d892e0a8f55cb04101975027e6eb6800dabd620aa009831734cd1b32f9730572955279aab99feae912c4490ac0c6392ca5707ca4f
-
Filesize
5.2MB
MD5ffa9aadd5c34f41db3c18e581a549ec2
SHA133997c410a587c9dc90c171cf88cc9f0105c4397
SHA2563709d1d7079b181df1eb6a01209b430cd622b99962d0aae670c5c055591fef58
SHA51224b56fc1c84e174842d81e68eed05f104bca97e1771fbd22e37d614310d8f81d75ed4f0b8b1c416c942856bb1e5c5fb62a29d4b887a65be6094b6606c6493bf7
-
Filesize
5.2MB
MD522880e9ae964243da6c1e6362c19b5f3
SHA1f944d82de02d5c8c727150a27740700c74cf35b6
SHA256bcc641cecaf0ddaaefa56a997e5d3442d8f839067654b0bf3d23bb7c2e5012fa
SHA512f210459d7343ae487b9b3b67510d7a282fbbca9d9c8ab491454bd4e049a6fc69e1d3812c5b2f1ba19e1a162ad6144d5349864d3e76b82879ffaf2cdb7ec47e69
-
Filesize
5.2MB
MD5a06383e203ae1fa990776b6b7bb78f35
SHA1d863ca547cee6027174d9e956ac2f19dd0995c3e
SHA2565588985986bd00f8bd360b5031c4abb92b474bb5040c677b44bf2c49b62e7b85
SHA512ab749e8bafb93719801b59f7c98c9189c652d11c30627004ba17865adbf22080383c7415bc3d4413f990fa1feb3182a8f250d055a483213f346bbe95e4259dbb
-
Filesize
5.2MB
MD5f1cda4b29619bee0850c185e7a71e49e
SHA18065de393441baa3e37d9a441031bd8b570a911b
SHA25629abe180dc4451d05094fdb36db9dab53184fd0eddbf6fcaa9868f1f6d801529
SHA512a3d42e6c914bded0b103373db17acc55c5ed9b939c6749a9b1e08001db0f2a7b724d1c3cf132d26f532209af7b84006108dcd4b9059f838f6604af4ea7ae09fc
-
Filesize
5.2MB
MD56c7aaa715cf2bc6d5f2758a77b7853a8
SHA1a9d29d04d14ccbcc36b62e693ce3add17d412464
SHA25673be8da2c811354d08234b054d7b4f44af0b3b7d4bd5b58442aaef9237b1ce35
SHA5124ecc496fbb59021b200958abff5077d06f48c2a0eac4d63fb8938fd5a4255aa759e47a81bab88d4072d01e198955946c3de309b64897e0d812e5cbb361175875
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB