Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 02:32
General
-
Target
2024-12-22_6fabe8fa37373ceea870dbb7b8f07447_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6fabe8fa37373ceea870dbb7b8f07447
-
SHA1
5d9705daa2851b80d172875e55c7713a379ad242
-
SHA256
68247b8c9c7d210489c91382f131c4c4fac64d9d72dc2f83ff08ac5669fa4bfe
-
SHA512
28714b392b88bb2afe882783465dcb53bc740114014476b504446466a092a7880973d45487b75493fed7ca9c5d599505a684d2a47ad948914aae023f5978fe7c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_6fabe8fa37373ceea870dbb7b8f07447_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_6fabe8fa37373ceea870dbb7b8f07447_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BCyATry.exeC:\Windows\System\BCyATry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzVnEzp.exeC:\Windows\System\tzVnEzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVaGmDU.exeC:\Windows\System\BVaGmDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KoxGjAr.exeC:\Windows\System\KoxGjAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PgaDYrM.exeC:\Windows\System\PgaDYrM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssnFrpi.exeC:\Windows\System\ssnFrpi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxDRxiy.exeC:\Windows\System\LxDRxiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSXgewP.exeC:\Windows\System\JSXgewP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnMlKvt.exeC:\Windows\System\DnMlKvt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vzOqALZ.exeC:\Windows\System\vzOqALZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etqlZvJ.exeC:\Windows\System\etqlZvJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MPEnZoK.exeC:\Windows\System\MPEnZoK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hIZxNgx.exeC:\Windows\System\hIZxNgx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXrAqbO.exeC:\Windows\System\sXrAqbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zDFYgsU.exeC:\Windows\System\zDFYgsU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AhZICHl.exeC:\Windows\System\AhZICHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFTMRzZ.exeC:\Windows\System\jFTMRzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQrlwwk.exeC:\Windows\System\nQrlwwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUDXZxe.exeC:\Windows\System\RUDXZxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yfsCEAz.exeC:\Windows\System\yfsCEAz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naLdgXZ.exeC:\Windows\System\naLdgXZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52bcf5a9d479ed2fd5398d3b29bdb85c3
SHA161a610f963dd80f39f316462193131040f08953d
SHA2562f9db6ea9c3197a924a16f21a1087ffd0552ccafd413027b2f2c9b641196429f
SHA5129ffdbc0c4bb201180fb4a40c23a17ec335dbff8ea044b0822c528a0565d0e5049c6152283569fb965274a6fdafe3a81634b374aa7c7f3b91bfdca3eaac873d71
-
Filesize
5.2MB
MD5bfbc05ff1e38ac408b5d169f184e494b
SHA153b86ef2c51b79f705f72401876358b368262396
SHA256cb622517ec2c13a36523228116e3db43391747a45ce6637523ac7f2cf8d3d124
SHA5121172669d60b0a7a48feca06da7c1d1d91c61eb3d5c940c71ef0237331816168b7908f0622bea19c9c86ae25e2cdcb06a4d220a4f4025db576eac2475adf261ce
-
Filesize
5.2MB
MD5a782596ed89b82789aa634a65fc19cd2
SHA1810b3e489df271b96ef6ad6f86d4dccabcbd096f
SHA25609aa878abb0232b2e89a4cdeb3505e2bfd82b52fb9273ffeaebac6387db14809
SHA5123568e0a39a9534fe7063bb67daccf9fdf22afccaa16af1ebe13d38646d878211a5011e6a971f544887f599334a4229112419063eda0c755ec996ad75f85559ef
-
Filesize
5.2MB
MD505d26b0a5b6ecb5e7f1f7939e8bf9761
SHA1fe9c2923049e167b50bd89ac06b4df41117fb9ed
SHA2563fbb2aff5a72dbca7e89269a794d1ee5d3d6e92a94b4b9728dd040407528384d
SHA512291e6a7f4c3a6d2aec9f66e632741c84ea9710cf2b09ed108797a699c72c788237fea00f38126123c1c74795d17b39ff1b4ce24d5ebeac96913aa0ebeb568ddb
-
Filesize
5.2MB
MD5676a9c41aaf7f95592fa7f8479faf73d
SHA1c8fc2dc81f5ea4d50d88244bc7fae3bb5be81baf
SHA25644ebd5c0d9ed50af5a0a5c298f50d4e3fa31627891db7374e8179751f6dd307a
SHA512b30fffdedc327003c7deed106087e820a66bdaf95e4c983f5207cbc590f5d0d310017c776fb80e3c06ff47328285e51a22c07ab718ed4596b5ecac2a8b9017ac
-
Filesize
5.2MB
MD5ce8eccc91a27d52cc5787715c1ef5b9a
SHA137d5529144b5bdc25bbc49d278d8f62ca4f999ea
SHA256fe3d8002585a4ab645e3c20d3602d74bcab86e58174e327889f59e317c4759bd
SHA5124e03f028c07532e6839a5d07398aa5a7c09d02abf2d35aa27bd6b0064bcdf8d9552807da5100bef2b1f296441b8a18737bda747b0a0b09b418051b00f640b535
-
Filesize
5.2MB
MD5a09dd15ee7833c627d40e1f105961ace
SHA1d4584ee9c8c13aa7ca0297a9146da85a61109117
SHA2566c478b9c86c0182d9efbd13a6f751ab27076af6627d5c81b60edc9e6f907bb96
SHA512aba4fa1b166b19b4d5b8ea02608281e9aaf24925feff92304d7bb87ed945894a93a3ba7ae3375e5fec25421eb43b3b1a958a3412bfdbfa28a2de892e48829ac4
-
Filesize
5.2MB
MD535e8a6a601131647c4931c985cf919df
SHA1b9f461accfb61bead4e80ac06a7ad4eb6542f29a
SHA256d090cf6f9ec289a3418262b2cf0aafa7bc9bf0f2ca97ae967f2124eed66ece9c
SHA5123fb8bdf43ce5b9c429994409c2009072ce8fbcda0f0b25fee981933a3689a6ae6e3b417ca756b1d49f214cf0c3c42841ab9a4fd945ee6aac5dfefa4981a2ae94
-
Filesize
5.2MB
MD5b6d2292536ae32a1e7e1d548bfb266a1
SHA11a1b8e14724be96928dacf3979d3b66071b522af
SHA256102233f040c766d8036319c520bb4582bdd11a5d4f9fc82c13a1c365434496b4
SHA51263f03653cb39be1cfa71b1b2d42b206efc8b7de57401aa74c6133b124c7105b9d403a9d39111e7f6003b4fc011b790c805558a92fd77d09e0669940f931d32c6
-
Filesize
5.2MB
MD5c0f164bfceccc662f3362bf05178b9f4
SHA1832a49669a8984593392ecf6a1b30d761f9a3cd8
SHA2566223edb28ac65be64d064581a7eca34dd72ace4da540ce9a729da6207210dba6
SHA512ea4b4e12c704ecae7384482f21d931a23772f2e967d64c140233e0f3bed1e2f6067d0bdc0fa22b038d4255c4d567c251683f934661c6c470ea6dca108fa7ce12
-
Filesize
5.2MB
MD579a7bb63b884a6747e18ec68caf91499
SHA1862246abe7ef58e766eb07dfa8b9279e31a592a4
SHA2567ab138eff4713b96a23ca69249305126806049079a65ce0544b968f9843679bd
SHA512c4a0bc0e8295e1d3a7b6d2a41863630119d7c26cb7abe40f48b0d7d7d0c73cb3f94ad81438d15f022cf6445059acac48b86a6c10fc9113054a7f9864dee9fc5a
-
Filesize
5.2MB
MD5179cf27706984dc6246585f6e4431a85
SHA14dcdd566689cc57b2252efa0e7cce8ba2cbd174f
SHA256c01a61b02e7cc47310c9459adca7c357177bbe652fb932467677e94a66db7829
SHA512af86edef662e1e77f96f76ad9ebeafe256c5aa278a3661c12f7f97d3f90d9c5531ec698ea786f22082ed848898bce5648c3fc959a94564833dee406331f91e01
-
Filesize
5.2MB
MD5bf38edd98c8786aecb443368c6af8eba
SHA1de0c82633f689ec84d5fd7299aead64c7749057f
SHA2568d8d9826a22bb8ae6fc2013c84c6893ac28b6380e38c2c258acdba07f104c1b5
SHA5126691017fcee5d3bd741b3cebefc56e0690479e3a5b0faf036443824087c9ea912e2107f8081ae7eb8f3b4a01938436deb468e870c94abde9af8bede9b5a31516
-
Filesize
5.2MB
MD508eb7a79b1d145114a8516d8dfaeefb6
SHA1836f6f1b06301c889257a6221c2e37ed1c428f9d
SHA2569323172349b775264d5fde30289f0d3af3fc440c015b03366aa61505f5d21a51
SHA51233825b5bad17ff4b4ce93070c842e2f6181423c508fc6fd9011b058f9d91fce07175f41d5083c64c1915effa1f87ae7beb1c2d8c4539f1e4c2a23a67b9b651a4
-
Filesize
5.2MB
MD56b4ac45aeef2228765dcf07ef19e235e
SHA18ddfcf845d0bbb284e9192b42b2e31bb0ca03331
SHA2569fdeb84905372ea5aa890a35051d8bdfbd5e7e69e1d9d7ab6ec87dc067a924b8
SHA512ffa21fddc0f8d49a40ad88a1643c6b8695dfd64be034dd3ebef7b77accd5d0dde1df0b6e6081b5d8917021cbaf13c414c0615d9a3ce2981f8e230ad53b9b5485
-
Filesize
5.2MB
MD554325396a4b44025333da3fc373101b1
SHA1887152c059dcef9c2e12c0e7769e4afd22232a22
SHA256c3f3900afc6fbec478ed879b231bfea3d3287eeb023abe29156bf73a7410229a
SHA5126f0a7c00c64a5f2b5d330a3cc8728b324db7aa20f9966bf0368af12c661a54ffc57bae78bd4c4a0c34c2a1db46875f4de043c0e37b0de5687e91061c296cb595
-
Filesize
5.2MB
MD567ee4220ffb61c4d3865685b9d60e8f9
SHA14b2df902d3c8e09da4f2c4b7c0ed172ca10d9b99
SHA25690019cddd048d2eb06d94ce7ec11f341497caabde00a6df6ce8b71d4dc7320df
SHA51254a2acce89614f349c866057376742867f2037a6fdd9c63be74aa092bc04da6f382d97a4f626acbf5cd4b2dfdc41431299d4f6657d629dd7323fd6112719fd0a
-
Filesize
5.2MB
MD5caa47165fbcea2dd5e8450838208ee05
SHA199628ca7b19e2932d550033275934d54ea4d45f1
SHA256823e4a104ebcfc83fddb7a54ad8c0be98dc3cd68c69a8af4e6a24e38572025ac
SHA51216147001ff6f542ef2ec02abc0bd8ae78cf9b7badb95a36a4cf5fb469a11b2707e0bc777e5e085905499d0fc84785d5efba3de84ed91765b7a69beee8327a53c
-
Filesize
5.2MB
MD595217ddcb93e5d5f96f440598167b24f
SHA1d674032e3e0528c2c67ca58f0107494a02681d24
SHA256a6b1c6e14b5539322d6e460b175fd85e2373088f46f21b7f9cdde7640f970598
SHA51288b2b1ade8d83b67d46e97280258a6b7eb590f639df682736e5433bac0509b36a0239da6cfa74f28a98667298b49eb8c7efaa9941c6247784526ead9c1689046
-
Filesize
5.2MB
MD5ec0786980bc3a3933edf345d6101bf3e
SHA12d8efc94009bb8342a99f5da399bc80297ef9614
SHA25650c519ea1bd039e580538f583e090464cb2f21f8c5817824db06769d84c56326
SHA512267647165e2060bdfbf92ebf445ba188287ae7a7ddc020b572bd23c556288046bd10b39d99036072fad8c7cc36c39265c7def387847813c56f025bc17188f48a
-
Filesize
5.2MB
MD5f7567d463b849ab92a141617ba27a6d0
SHA15ad3e77388ffb826645bacb328eda966a032755f
SHA256615d7b9b80dcf81ad67154420a8030a19e2c047cb9aba52bd6179effce59e827
SHA51274e5bab365cf21b4d88375bc0d19b3214f4e6700967f9af66e4596eec9acae46f9d3ef2be0fe57a7017c0b59648f7243aa3681ed7aa5404d17a39beecc137e51
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB