Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 02:22
General
-
Target
2024-12-22_2bcd0bb42dda88160e4dcfe1f1550a01_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2bcd0bb42dda88160e4dcfe1f1550a01
-
SHA1
6ecbf2711a10a801779cab160730c8f34eed796a
-
SHA256
28e326c14bb04323f229b845acfe225be043a8ab535b5469afdfb3c65e1eac54
-
SHA512
d89c0ff2591f1ac7b9f91cc187d09ed09beb4c9d614dea794083a281e9638189a138fff2cd8fb63736c4bf266fe5e42368b6c4b72760b0e0bf1c3e5bfc24e281
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_2bcd0bb42dda88160e4dcfe1f1550a01_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_2bcd0bb42dda88160e4dcfe1f1550a01_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VzfrZAk.exeC:\Windows\System\VzfrZAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjQLjAI.exeC:\Windows\System\jjQLjAI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdYXdiM.exeC:\Windows\System\KdYXdiM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PGgZVFe.exeC:\Windows\System\PGgZVFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GNqIwak.exeC:\Windows\System\GNqIwak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MplYZGj.exeC:\Windows\System\MplYZGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FPyiHDR.exeC:\Windows\System\FPyiHDR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WSKnNYk.exeC:\Windows\System\WSKnNYk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjDgFgE.exeC:\Windows\System\ZjDgFgE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eMbaMrS.exeC:\Windows\System\eMbaMrS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tYOVxVT.exeC:\Windows\System\tYOVxVT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIesTmC.exeC:\Windows\System\pIesTmC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAxWmvB.exeC:\Windows\System\eAxWmvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZxTvIS.exeC:\Windows\System\rZxTvIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mccdlNa.exeC:\Windows\System\mccdlNa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uGxtJYH.exeC:\Windows\System\uGxtJYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QkgRWmX.exeC:\Windows\System\QkgRWmX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctQRPaY.exeC:\Windows\System\ctQRPaY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vyARXMt.exeC:\Windows\System\vyARXMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rssXGNS.exeC:\Windows\System\rssXGNS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtswfxC.exeC:\Windows\System\ZtswfxC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f644139c86063937a57a7cada0f85621
SHA10f9d1f63d1126d88163ec1c88d93e8aab1ba2916
SHA2563d57240096b7e0c3f180309db365b2f3a9ae829cf674e33055c2941020dfb680
SHA512370762367106b18ec51033cccfc76184eb59a35ca81ebd7ffb2045c2a8e3450f90a287ebfc6a581432c5756560100dc8d48a9f3476a99833c2c790c59f6ded1d
-
Filesize
5.2MB
MD588b7d23617e4890247d2395bd0c13af1
SHA18bd5f4729ebc4762b7e292fcb45ad0918eff52c7
SHA256437c328de24a74253cea7207fb1055dd5157f09e09c7d9b859d79d8c4bd6fbc7
SHA5125e4a5746f06981ab9002474d530227100532e222d23a8eda390863650cc1c27e10e8c75d0587386fc81380814768059060c550b1455630d909f322680386ef10
-
Filesize
5.2MB
MD5351625a603dcb56bcaf2996da0191d93
SHA1ff3239d5a7f3f426e53404b31d604b1e3e14f2ad
SHA2566c1de40e3a1295da9cb8d5899fa6b7a48a53cd55de6d0266dcd28cc04ea6b680
SHA5120449204232aeaeb8e494dc9463e24ac56fa66bf5bd4aeff8f5a4fb67af160d2941e7340cc5dd63eba21c5ac6095242d6db39ae9e1f53c7163444b67625a2bf77
-
Filesize
5.2MB
MD5d96256e535f16c9c2cf0fc8809897da0
SHA14d7dcfd86fb71ddda1992a734394acbb8151cdca
SHA2568416e5f1c5f0a8fe40f0a1c2357fcd418f5a6cc2f1f116f26f89a266016d3173
SHA5127c9ee77cf72606efd39f5701c3b33938cd63ff13a1aad9d476d070d863961d40eaa14e0b034e77ddf684e84c25f01637893afe3c2fb038e64b6522bebe2c028e
-
Filesize
5.2MB
MD595f2bd16c412bb9d0d5f03cb4f4d008b
SHA1f49db7e314bcf3f0fdbca6a13bc234a047379811
SHA25699aa7ec6f9a69199f902f798383385a62d6d6d4e369a4ee14934549988fbccef
SHA5124a269197cbf9a6b09f6d59b58feb40faebacfd786815c318d63026790efe4d289a6da0f3fb77e8a89378c0ade754e6e4d4a3bd8598455ce5e800d26700f0cdb8
-
Filesize
5.2MB
MD520e5ebc8411585fb98230dd1a498847a
SHA1e91d8eded359ec79a5c1b94a43de09cb4b999a9c
SHA256f7c73b2025ca81cdbbf7dbdc7994d2f59f3f453b8e1535c6f306aad4d2cfe70c
SHA51259d905a181715fa78a90680158af71def1676f3a63887a2d1deb8a9e2e3d85ae27d39aa31620b9336119bc13d51c1116ef72a034ea1c642a4f1b283d16dee57e
-
Filesize
5.2MB
MD53a0b058948aa3ee5c4cd0b20f1113ba7
SHA1b0ea296f1a07b4a2ea0d708a98920b7ee93bb1a8
SHA256e15a472d2a79fc61e1275f590732cfe532c3f4a5a25830872a276b29a9ee0451
SHA512d25d6e5fed97238a7cff5c304dcb15eaaa4d94ff096f48aa1a4800b0b76a16c0ef75806f411e7091815223b9216c516e37cc0e08377628908dc427a0afffe167
-
Filesize
5.2MB
MD5ced2a6b819502067fe1d2b9dba4e5dd2
SHA1e472ad305b98e0aaa46fc25e3afd171544117cdb
SHA25620e4bbb727df2116c2d089c6de1d751db2e75dbe6f15e6a4de1de84cfefed6d9
SHA5125574a53b1089195de16bb1d27a840b9b817a5a48d55908c87bed323cf72006d06bc9bd686d2ae3281c10ee3554e926e32cb8f016092ae8357203dac4c776af4c
-
Filesize
5.2MB
MD5bad374201f71fe655d377cd159a490b8
SHA1f0022bdacaaf9bf9f5e54e6abcaab9b3bce186e0
SHA25693b0e37c8fb765ef021c346754d7095ca021815c46f2c5669b6d3c91a18f9609
SHA51285384978c56bfdda2c047edd96688131fee2f56b2fed0440cd678e927d651f45c31cdade97d7a3cf8fdb8b17cb04c61a643644a85d9373592e5c688e427d01af
-
Filesize
5.2MB
MD511cf46c17e75460b5a82bebc7168e184
SHA19bebab059f3efdab92a2e8a6f3644884b7c9bc42
SHA256c9be2ba76543218ac32543ae5293314128256a765dafb6a560f33c330f6f2a03
SHA512d502cfaa4fe99e56e9b2eaacb33fe678d9381ecfb9b92b46955fca1ea09da7077bbe53c06b1eee575f0b9ea1643fbc5527eb5b80b0d16ca9d89be3a61f904249
-
Filesize
5.2MB
MD51d81d15cef7982dd492022fca5996815
SHA166c248db212a504b741b07734801d96e7dee47bf
SHA256e9cecdabc76c44e0fe14076db07ecfe94596651348adc54a3b4fc3c0e827cd97
SHA512d18faebb05b211d5dd09226bb08d2e953d44ba429672bb6a0f53d831d0ea8ef1ddf221a6b148ec6f7a26f09376b56ca13c013af14d4581292aea9d12bab3af41
-
Filesize
5.2MB
MD58e549c88240167ee9d9506121f5f1181
SHA1adaeca7c121cc0782145f57b24ef0d199638c869
SHA25675a113dc1ec8beaa8dd854720e42bea6375c16787753a18df00ec3f58623c0f5
SHA512c5c12bbfd256c5cb7f3450386942dfb66966882459994f16409b4325a99cae87751d08fdf4761722ae5e63f7bc3e86ca8e85ff0fc387424e5657aedad65692c6
-
Filesize
5.2MB
MD549a94e7382fce61f3f7599141a4fcbb9
SHA14abcc852983ffa54efc55e5326cf49984005a6e5
SHA2560814ef781ed263fc04bdc52a766b3118340a5fddb068a3e0a98177d083ef1a92
SHA5121c5eaaa5c5e66165dedb0583f87ae5b9675d7ade95fcff15a8c8681fea0a409f300d98bc5be5671b07c2f133212238f4db98386bb905eb607478bfbef18e4688
-
Filesize
5.2MB
MD58ef27f38350ae41870f1a4b265bfd791
SHA177dfbb011465c9f762dcb2ec5bed4e5845e476fd
SHA256962785a796235f14bb44dae4d3ec5f5fd613f90dfc221a8792f5ada9acc080f5
SHA512cb9a95472333c2c976db1afe75306ac698bc6dacd5b9103dcd237c977ebab491c526d74310a2930b1428f1b4f56c8722cd0b238767b50c033863b8e9a1554f3f
-
Filesize
5.2MB
MD5c9520775b0d561c09b46286fb62ce006
SHA15c320f34654eee15acfc2b5c453f98927260cc1f
SHA2564a0c325216dddd4bcb429d4d7eeafe9a71d857997594aa7d955531a9e3307322
SHA512bba81135b7c82ee5b7db46bbac378a33a6005237f0d5ce32ab80cb3af06f3d4adc80cce0bc3330a7b7eb2f18fa3db5b51fe244ff615ca0185e555b3873c38a67
-
Filesize
5.2MB
MD5f8e1e0058b23f379ca2b2bae0f5fded6
SHA18082977e4c76ffaa392c576e75a86551e75b6914
SHA2562d3113f74fafb20f19396ac4647651694e54d90bf54f90d4c4d26f1b1dd95d46
SHA512cdee8ce2e6f497367bea3517ec0b5e3e929e393cc7f0b254c47d9ac1c33486a984974a02136412d11a9c16f986c9e5c15094998838b6d26654c52ab63a723951
-
Filesize
5.2MB
MD51df0121affda9050745313c752861404
SHA1aae60b63d2cfff42eb41f847a818c836f98b635d
SHA256be97e13f7715eb78ed35c6d600b32d93715bab40bfde1f164cd4354bbcfaa29b
SHA5122283e127f1892eff12ad88505b5278f8cd5371ed90cb38b26e2546502efbb5fcbfe8a4cb15c6801bbc939675aee35eb13ffc3e0ec53756456b897b97eb2cc100
-
Filesize
5.2MB
MD530c63afc1ac09ae65c04a928eaee9ad4
SHA1312a70dd094f2f8253c695d4f4ca0f9202b6363e
SHA25686462b404fdacf4d4055a432903974beddc256ba7f377f927614e8031b028f6e
SHA512147c2a47a476a4e24db664df28303041ae9eb1a650b212bd3cbb591ad62606cab99e059f28779dfca8220ca3c1cc07913aed78dddba61fb8ed58403a65b67cbb
-
Filesize
5.2MB
MD524ba49f13ec242efcd2bfbead70a1717
SHA18f1492e7a40b784433fce2fb74b5f741190057c8
SHA256284f556cb1714e6997766ead026f4e9f95ee31c0e1dfa718d087a908dd5e45b7
SHA5129247cf1bf96ce8922c4c62cd7117dd7f5d8bcb4bc0da3ad6154d2e74e2de5ebefaafa5325e10f23fd8563ff9d55a92080ea4344524af69b54e685d5a74c7c7d9
-
Filesize
5.2MB
MD574233a3961535b90da4e1d230bc966cd
SHA1d6353fe3bd0938aa2bf7443d5d9f80a927810138
SHA2568ef160a2f8fbef25ac7e2ddb7ead75ac12d567c56ea1cda767e8147d832ffd4b
SHA512650e7404cd032c14b2095f01df4106a88a88b9c29b31232f67c7fcb68aaf3ecf1357bfc0e882806758de9b6cd787987785afe0e7d11b4de0813f50064b8d81ae
-
Filesize
5.2MB
MD598f0ca11aba4ff7801b0de929bba27d5
SHA11d31eed251d41166969997bc44d0c470dddf5bfa
SHA2568e602b0db02644fa50578099c36789fcee6b3ea5047900a595ad1fbe44571f05
SHA5121199089cbbd5293191db659a2f25ffa2e69e02a0a13169e8d2481877b5c387a6f91a6de8bf133ceff2ef056a5bc017d6092ac6c2d6eb4872db903ee5b3b4ee95
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB