Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 05:27
General
-
Target
2024-12-22_a6fe0a4316b283b5d3b449f59cd130d4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a6fe0a4316b283b5d3b449f59cd130d4
-
SHA1
c1c2aad25819d63f3d03d29b7ddf9b74895f31df
-
SHA256
6a8dce4d3a22006b99d9d52b36efb9b9e3c0d60db18629de2eb3be7b01df4d6d
-
SHA512
05cae500945d2c7bf3ea1abcd2e3f5ff38636fe052607311a675ce1e5be5902d9003d2f3adf24185de868bc2c208236b1b3993df803120103416b035a8aaa960
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBib+56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_a6fe0a4316b283b5d3b449f59cd130d4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_a6fe0a4316b283b5d3b449f59cd130d4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KEdpORa.exeC:\Windows\System\KEdpORa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DmFCXJl.exeC:\Windows\System\DmFCXJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCZFOCG.exeC:\Windows\System\VCZFOCG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JBSpWxI.exeC:\Windows\System\JBSpWxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HxjOACG.exeC:\Windows\System\HxjOACG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LsEAKGl.exeC:\Windows\System\LsEAKGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aeNCVxW.exeC:\Windows\System\aeNCVxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpWhaWQ.exeC:\Windows\System\YpWhaWQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\stHrdus.exeC:\Windows\System\stHrdus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xxiZDFw.exeC:\Windows\System\xxiZDFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CeHkqen.exeC:\Windows\System\CeHkqen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmgzUux.exeC:\Windows\System\zmgzUux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkutskw.exeC:\Windows\System\nkutskw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUEeAhK.exeC:\Windows\System\RUEeAhK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNseRhm.exeC:\Windows\System\DNseRhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmhynMg.exeC:\Windows\System\zmhynMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KgEoMfW.exeC:\Windows\System\KgEoMfW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGHXVOJ.exeC:\Windows\System\FGHXVOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXYtQNZ.exeC:\Windows\System\BXYtQNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\McvqyEd.exeC:\Windows\System\McvqyEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyNQaXo.exeC:\Windows\System\fyNQaXo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c66f00cb1778b1826195166032a6b500
SHA12f67343b0e1fb071180360a6eaf95c866fe235c2
SHA256c702563d9f9a6012359918f864aa096211083f20a01b5ef660d5440d7740f94d
SHA512429bd2260d5af9f2d00d94bd61fcc8aa1329262ac76673e62506c6d49c087c2773ebff7079777144c3ef7914789e33cd8bacf79b238f2560a73a7f7c22810acc
-
Filesize
5.2MB
MD500aa87b65412e1561b52ad7d18a0e148
SHA13cef1aec10bb8c64d3562ccf5f7b68c3d489b9be
SHA25624cbff424b697b3748a7321778caef8f2d36bd144b36a7fd6e14f5eedcc364db
SHA5122c03b06e8aa9275ea0f5186af6d66e41a59a71db2665e704811ede121b09a78437cffb41999fde851032b840642a853441dc7fd1bb58a6bec0c1435b611dd69e
-
Filesize
5.2MB
MD5372b124dee3c128f5ccae480733f4b20
SHA1aee01d3a98450c9d523c1cf95bc559569d308a8b
SHA25697c39af57322824e74a0fd8fe28ecfaa2099fa271e3b4c3b30fb7d18042fea47
SHA51287ed92b33b5bf26cd0ada1844d3619ffe7fa0d032a3d2a1bcbddcf944d2e256e51685abf835019f007d40b558fe6124de117a11e28aad93626e122c845d3047b
-
Filesize
5.2MB
MD541c593f53e0318ce242a095f74f952d7
SHA1a30c0ba4207887285c9761f31a413e6cb40ee090
SHA256889a6584548046fd2de1a1c88d3d17836261e73c877b2dc5638d2c8622774d50
SHA51262a47910667082c20546d52f28b99ac4f1a4290461939f3c9207622cc2abd98659bf76d5b153b77ed9a35c973f7214d7fb1dbcc3959d2ceae4506a1199c7c820
-
Filesize
5.2MB
MD5866ca4afb2b23a15473183c0858f39e5
SHA168c7aa2adbbafb79804c8a3bcbf8ef571336c02a
SHA25609b9d59211ddaca45204e73a1700274aa08b23ddfa3af4aaf5968bb2be481fac
SHA5126cdb918bd689617e54d04070ddeeb167209eee168e78fa59af1a2a82acb125db029ec5b011aae849126304d31ab6e1af69770808d0ad20adf1eb8a64bd00b614
-
Filesize
5.2MB
MD52b7a9892f5b64c34c31c54da7df33bb3
SHA113af056b640de031b3eefed9c679264dc047249c
SHA25645676fc62175490eefb91b246bd4d34f24e25235bdbdcd7bf1a7feb88d18292d
SHA5124bb6d9e5b9644f9ab5eb6e25b811173891dc853e55a6a6c3591df48354b2286d3661787f70d8aaf8ab23d0e2aacb7ee0984a7e16e74275d727f609a68c574ef2
-
Filesize
5.2MB
MD56bfa9fbe107044eea42f71da17bf57fc
SHA1ae1c3df1639bc5427f42fa3b685acc70e75a9a93
SHA2569a2c3774504eaea05a1261f88c5627f99e9b16ed85d1824af4247006b80ff904
SHA5122498dc09c1b256ff5184ab3280fd05ce6fe39fca7a6a4ff8e92b9ff59b90e77a62bd3a5c780487603797d68cff81983fe846ca77b21efa0a634056c730c34947
-
Filesize
5.2MB
MD5be3dc8711576b203895b3dc31415e00a
SHA140b92355195aa5ed250d77a08790d6199ed99f11
SHA256275cd7ab86e37c36f051ee90cacd7f34e556b6c5042cd6fb45509d49b93fdf11
SHA51297339f2711b638b1c2f27e755b29bab547a67d83d41b4ad8e4a3e1174100ecf3390feafa3ef505bded3fed6928819895dd1eba3a480395a6b22b7b298c119d0a
-
Filesize
5.2MB
MD5ad99ec1d7139fca79ec34f848e859712
SHA18de393fce10d1bdc24bf1d6b36735ac45e17124a
SHA256c9a3f2a3f385d4790229f31dfcff125077741dcf94c364ab21acfc17eea9c2c1
SHA512d638ddd3b40013e7be243bdb82e74d344c42264e12f5d785c8828b9ace52e08e27c02632495bad929f2c0902327deb7ff204496f3f3a97bbc3365cf83e243be5
-
Filesize
5.2MB
MD5f1fd6a3b3ee2ea6781b7452390939b83
SHA196a0710759698105c3e0c0b03288ff9423227268
SHA25692e41cead40b4eebdd8bf78f7d6c1a4113d9476a9b7916e1b04d5993f0d506fb
SHA512a3e5080aed215ace711d6bec6a6c367fcb7eaf7a8227a1bf5043806931ae65da7fae98f0b3b4485ba71101f3754d5319253b980f39e674454ae58b6656fbdd6c
-
Filesize
5.2MB
MD5225ac20ef5318b368ac5c81a35db8519
SHA192d19eccdb6f8a9ecd6c2a35e21290c864e7de16
SHA256c1b4b478051e08a3a2faa895d847e7c6e886e50a1e0f49ca8372f746dc6743b6
SHA51203c965b1ecc3ea660ff9e2318656f6b66ac218c4a8a19c682aff86d6addf5cb12c9e5195dcf18acea07f5fcc988d5cde975d402be4b2fa5a29b415311fb3d103
-
Filesize
5.2MB
MD57394b71cc62db3417487cba01dd122e1
SHA1ef0a0fddc046f318f809f7600dc5fe26397f04aa
SHA2566eb822807da3dcdefb769001a362d5ab393cbc874404227daae12ff788952a93
SHA512dc7049dbf08a8741c49ce1d43d6b27aadce7f6106aac08ccc22460688c3f42f3cda5a9e8a03e8c00b08f47eea7f848e9a50c17d712d86d48b07ad87e81a22305
-
Filesize
5.2MB
MD55fdc9eb48a5d205cdc4bc14137d74032
SHA10bc6721e120abc06249f1f32576ab76e013fdade
SHA256baaf4f08beba5884a83fc908f8fb71f3e58d90a5af79e41466f9d0bf0c9df4b6
SHA512b072cba02e8af77ebc5ceb2981d88436a8c6ea3f33dbd6c7fb3a9b06c917b8453474d5b3be96f2ae97669d9263fb0763332e592e212f446b8e77e942507b0b83
-
Filesize
5.2MB
MD5a35d1658cc481b773c7716ef220eedda
SHA158bdbb681b43de60b28c5125778f201a17c535dc
SHA2568bd6df32b315936a1ebfed6ee39966c434c06a939856576756c0fbadbdc2f5fc
SHA5121eef01e6dce49d2745b9b99f36bef3072252c11aef85b3e356cb0bab368db70e500cb27e88a315260c25c925af397703c59c06f09aa62d49fe3973f632272ea7
-
Filesize
5.2MB
MD50d1bf5aa30b12c1edd08322bc029c1f4
SHA14446e9e628318d1ebbc6df7abccf46b09fc3f8b4
SHA256c91937d09c6d19815e23c86e4ee25b9daf5dbf89b6643fe70898633d744aea94
SHA512311b75276110c845cee21238b4fb4ba81410c37553c7e20b24b83a696181b2db6de39a69ad5ac58e65c21f08c71809bdc91f4955c7ba24c44303847f53f9cea9
-
Filesize
5.2MB
MD5d174c7dfba5efe1fe269ba1a6e0cbc6c
SHA125e2fc076b86974b72755c542a58fa6ae2bcb39a
SHA256ac96331ac18907bdf00759064c0ec3350fc993946856de7730dea8da92111ca1
SHA512b5b027d521134c2db80dd8d70cf8024b3e0d820a51b187367878cfef94706f592523e840d44b7047c74650e2547095a8a439568037e0eaf9b743afc87ea326af
-
Filesize
5.2MB
MD5e3653e78c6a9a34b812f2937dda94068
SHA185b94ee33311544ff77db91c3ad1277c11e74c73
SHA25602aa0523ab1d8ae3b2ca6ec9c2a45e2390a79dd0bd78d0bd8e578e5db0b1fd55
SHA512077e81b4be35004439196ba744ff902daa104d4e57414c06952954fb2ffde14a1013cbd49a4f9769b88f6ca9b3158a3c32aed7a8cecb990d9324d6885b0866b5
-
Filesize
5.2MB
MD571cf22eef4422d8a19c28183a87d1cdf
SHA170ae4c328741894ceb0969ecdfe7f87d0ac60cd4
SHA25653db89bb757f42ed9f112dc598bfe9970e2a187e2f18546e03162fa2c1c453df
SHA51204b536bdfe7976513537ecb3ac5a9ec1b741ff6274c62736311d6aca8dc370eecda2b099449d50681f59bb8634f7257b1656d7e431d018d1163058416ec96da4
-
Filesize
5.2MB
MD51e7de5903a32a5c13b4aba1323a4a419
SHA1ab3986008a0d9405eda0e6b044c246a4293f6cb1
SHA256599108b58cafcf8a2f2f777365fcd3f76399d02261c04e7247799fca5c3ef6a9
SHA512c907cd797e3c56a8a1e4826f99aa87e5852ecec66421b0a661e0c8f9653c3dc2aab4e3c24fe8c1d3c93acfb9ce476d4cf8070e3e9be523589314843c6426b8e8
-
Filesize
5.2MB
MD5c26a0ee0e5e323eefc19287584130124
SHA100dc699e83c2250a3a314a289a7f33b52ce2d18b
SHA25604a9edc664613deeb21ed2edbfb97bd84712da3fc4a151ce99810aaf3dc4d1f6
SHA512ec861aec0d90d3bc88dbd1d861ccca802a0ad196c81a74d82b1f0fd50b4980bdef38ca06fc19cd47d915bf03098724539af35d5612db6bfea0ef3de924ef4550
-
Filesize
5.2MB
MD531e40b146dccbb6637eb672b1af89200
SHA1ea3f5f4a737aea1f60dc544237535e9a71b51eee
SHA256e4444a38b2f7270fad98b385ac29e6a36f3aacd3feac3d9960023e368d620266
SHA512d39da6616a787ecd471fe10f9ad70602f40ae286f931ef1e936db86551d796462fa506966bc2d236534d894662fb34eb2cdd2f44d6eed8f6c62b0a06dfbc629e
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB