Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 05:04
General
-
Target
2024-12-22_c35f772778347c519ee30bee5df7b598_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c35f772778347c519ee30bee5df7b598
-
SHA1
0b39f5d0d3c68d0ee05a0754c0a77dabad804f48
-
SHA256
a0c9469b5cc607662e11ae3cce0f52bac719459ce53fdbddc9348faaf10f2650
-
SHA512
f8c95a1c718184ff7549f17f3637eaf2601922e81bcd076d9e557e5780e647e7b807826b59af478eee2abb342cdcef4683b183b3645cd94a1e4a0d90917de83e
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBib+56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_c35f772778347c519ee30bee5df7b598_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_c35f772778347c519ee30bee5df7b598_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cQSyIRu.exeC:\Windows\System\cQSyIRu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNZjfiv.exeC:\Windows\System\SNZjfiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lQQsETl.exeC:\Windows\System\lQQsETl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xBSUUYS.exeC:\Windows\System\xBSUUYS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRFXJGl.exeC:\Windows\System\RRFXJGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBIEqzj.exeC:\Windows\System\rBIEqzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YexbsEs.exeC:\Windows\System\YexbsEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naruaeE.exeC:\Windows\System\naruaeE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVIYaLP.exeC:\Windows\System\XVIYaLP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GNmRPiU.exeC:\Windows\System\GNmRPiU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HRPAEHJ.exeC:\Windows\System\HRPAEHJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjfXfdo.exeC:\Windows\System\XjfXfdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mCwnSFS.exeC:\Windows\System\mCwnSFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAgBRux.exeC:\Windows\System\HAgBRux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEyFhBy.exeC:\Windows\System\yEyFhBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKzhTZd.exeC:\Windows\System\uKzhTZd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GMRiUjJ.exeC:\Windows\System\GMRiUjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJYFExL.exeC:\Windows\System\FJYFExL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\baTATjb.exeC:\Windows\System\baTATjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAqJMTa.exeC:\Windows\System\mAqJMTa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PKeTpdE.exeC:\Windows\System\PKeTpdE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59c3a18bd2e1b7dfc1771d50271b3f4b2
SHA1f3068bb021a3b63750c98497769ad7e7c3565136
SHA25621f5043708d04c2ce2093b8068c5afd107b1f26e052a1da28e5a95faa9f8c30a
SHA5124b137514ea3ee7641a49e9f7b1103bfb3a3900f68c838ce113cd1248e2788ddca093a673dc5ac49f811f2de3903cdfa3be2287741dc8fc4d65bd027f41c2f67b
-
Filesize
5.2MB
MD591d7c9db404fddfb5ecabffa4570b416
SHA1e1cc7662ee3ff50031ccc1d8ab11968af1a43601
SHA2568a0ca393f9075f44f9f72b9843a9265a00985a62f9d9aad3ea4e8d974a190202
SHA5126ed6a1ee2831d628e8966caae3d134e7fc5e9f3e024e2d7697d2083f5a4710afb64f79667b815c82bcc791e2e80f1ce597fb79b7c09b370673bc4907043ca729
-
Filesize
5.2MB
MD54e36b0c13f67ccb32857041342676a06
SHA1642b671fad0d31ff698538876eabb000c52297e8
SHA2562272b1f18bd82ba57983875d5712441fa39193ce76c48d3eecdae3b1099952e1
SHA512396ae257866ee30301888470d9d0c838b9c30b82a74ba36683e198528b284d25afd000ec08d1c13ffbe4c3db569f1b2baf6960d67cd447aab190cb633125ec84
-
Filesize
5.2MB
MD52a46e5d94c401eb5f07d49254146ef07
SHA1bc7ae1392d401346ec49be53ab1515b037286a16
SHA256e414d715b54136835ac0f30e1c8482ecb50a4d0b16bc83dd4a1cc5451ecdf07c
SHA512442fecd103ae0a72321babbb8e22cbd10de4c3731a8429b10fecb8007128e10caa2157798cf37c0b014ca53a32661df6fad1f4c72bbf74780b6beec76ba541ee
-
Filesize
5.2MB
MD5ade94aeea91817245aa99151d58b9b44
SHA1e25f074efff8937e5679667d878972e42e74c69a
SHA25613d0388ce47f6d174a06ba35322f0d64df9dbbcf0adfd2c1184c3ee4c9bb687e
SHA512de8940819271578c9dc3e5e0fac932b6a179e7a4edbf18d46a84684c2367e1a35fe30328e56e87366413a82fff2ddde5029ecb6f50e64ffd36908022b07d86f0
-
Filesize
5.2MB
MD575488d8c5cd2f61b232a37a652bf5f4b
SHA1c6d33b1043661b93a2f9e550cd30971aca597eb2
SHA256cd5594019a9de25f5fcac9a05b845e2567b44ed21da480232c9f5fe6a594b427
SHA512ae615c0c9ee8786e091a1c13775023d0e6d9e4359514aee80c9d832f53c12f66ab9ea05ea8233fdffd3709c5fc12cedd453caa09c3519f748be693a9d44db666
-
Filesize
5.2MB
MD5b7d69788280779063dc3ee6a411be7e7
SHA1277a3798131758c74abbd488be7248c5d0f14691
SHA25687453d3bb75ce5aea3e5ea147a8ebf592203477e2e19d0c852874494178d2ceb
SHA512a934dd63203de9d053037df00f5aa7f711680d5d0730b076975dd800a70ce7f537e7a1873c556ddcd3af8054ff2263d510eb6164454945e8ad28dae151c97b1b
-
Filesize
5.2MB
MD5e5ddb973293b06d3691b6c22de5b6a80
SHA15bf70c4703952fbd3a3d702aa918c67d2cf253fe
SHA2569092cb3df5be599e7a02fe0aac954a9e458c9a3cf7fcf4f69ecbd9e6867062e4
SHA512f3c9e6167a4569682fdf5ab66f331f8ac5bdca7281988ae74a0494a6c3a54834350cb89b7f53f2d3400be2a51f9db7c3301450f11243a6909f10e7f1c046a6fe
-
Filesize
5.2MB
MD5a403bf98e7cf1d2fc0f8434782f4f289
SHA185af53ed07dc3c300d0b95fa9fe0c9e7e3cbd587
SHA2564a699c6cb51ab4f048d9b1f81b9b882f0fdd9f492c82dafdc55e71272f130253
SHA5124ba73d01d57da1c2068b255995763dafdd2bb215f1f6a41e035db41fa510769c619915a6539de1e922b0de7cd410832bfeb0940728a67daa96fd7837357103de
-
Filesize
5.2MB
MD583a0d755352352eab9ff93e7cd61022c
SHA156305ee64c14411a4b4b6989a3a05d184e6459b1
SHA256ec31fb82fb9b36dbd8dc13633d8958d120e96d0760a8bf3b45f98734fddd9a89
SHA512637193e270cb3ee52cdb24cfbf81a9be4c6de93270f9c534f99933e9fa9c9b79cb028b8c307732254f2d5f0bd67046b7be06969f2bac6bef963f7bd3d804e68f
-
Filesize
5.2MB
MD5a361d986a6db1eea87c0766dac064a98
SHA1104eef2976188622e61a395d8c3855688da4e9c6
SHA2564507a18797f223f151765e129fee0abf370a1d9f827c243889794c067408ffd9
SHA512c4520dbd38eb831985f1e31ed2c7e303424b6019e26ca984a27ca3cd7185d473c12079293ede11e62b41e69ad19682dde5ed9604519eb6e92d8b7bdc8d0fbe41
-
Filesize
5.2MB
MD5e1056d9353c5237b374bc256bd287523
SHA14545e242d3693cec2eab2e50f0aac450e8b93bc0
SHA256f17135f1f9ecc6eac0d843350161040dbb966b24683d194d773763ee63341c5b
SHA512edb645165bc7bb32435269b8e252364c3c1ddaf54532efcfce964bcc47a069e23296f20c1ba54166c67deab109d8e251598b2e25859c6500133ca07181ab7dd3
-
Filesize
5.2MB
MD58bf5eebc4ec65d8076b908f77d78110d
SHA1aa6ac248c77da96a8a603e9614b19ef1b9db91cb
SHA256e85375467801a24a6574d5e917ef98b8e4a17b5c243388e65a315c6655e1b6ed
SHA512bbb4d3d6c30fc613ab3d4e38186d5c038d329f3ad26e9b2a9706a13a9fef00da604601a05bf7fc742f949108d07b0610a12d584d0aa0bd59f543b2338a6c4b70
-
Filesize
5.2MB
MD5f7ea7c66098fbd13472b71a5972536eb
SHA1644b650cc866487a3ab25b329fd0d0fb5e4c60ba
SHA25666b09d49a3e71ae9ada53f4b30a5a2d6b345b7e5c0f40679fe8a9f8c984df5cb
SHA512ef7c9735bc4e0309f5c5cae2d7ef7736feca4392e16b728a9ab7dd130ef982bd6ac562e8056403b7d426b535c16b0fc138584daa237492f238b88a4dcb6004c5
-
Filesize
5.2MB
MD58e8cba49d0674eb12b2315b942d60ce7
SHA14e1435a8f109674f8b17042cde09222bd7b2ff5f
SHA256718aed50ca0517d0f264c855cacd9087942a2d5cdc23c89cc34610cdea3c50ee
SHA51293a0e6dc8e8a197c75bf31372db7ae39d78d14c53b24b97b29f357aa2e8b032a3466f6fe5aef1aebf3462964253b0f488ef41ce043847fb6a79fc34159c44eae
-
Filesize
5.2MB
MD53c373b41ce818e73885c49f758c4b5f3
SHA15388e712ced523ef7f31df8e7a90eee223cd3ac4
SHA25684fbbd2d839c60097e73e0cbf434aa73770a80066a7596e38f4e1563bfce2cc0
SHA51204025c481ccf1e0ccb8c33da6d68ab83357678fac17cc2325cf436252c646ce71bd053185395110a2235f63b8ce13ec29aba0aaf06a0a0c215c3474632ff1266
-
Filesize
5.2MB
MD57f4529f5252bcc79612418f4ed81a34d
SHA19b86f58372ec011518dd35ba988e017b25e9a95a
SHA2560e580ee63fe5dfc27790ee094b4f8d20d85f1899afd67497664cbf3df5f74b2e
SHA5123b0d1296341c09b8e637c00715a866c214df3ebbba0caf40028f07ff8eadc8a29beacbc7a6abe2adb44c77f8845fe71b8b7e5dc3acf53db4656f660e989de454
-
Filesize
5.2MB
MD5852ffdd941c468add6439188f3d06abc
SHA153fb196508c26004a0d5c00f65619ac4b0851e81
SHA256fecd879984132e5ae6cb8cf1dfb6a866167e49e79cb8b62da9e88668003e6de5
SHA512551c449c6dc43767f070b0873ff71734cecddd343cc7397e9657542c1248826a7820eefd2e1e1d57d5b9fd8caa8e8c78255ae50f571f5656fe54a42408558832
-
Filesize
5.2MB
MD571ec3c9d1487cd298ca0d01fd17ed25a
SHA144d7fcf3591247aadf8fa6bed17b5ee640a8f31f
SHA256506892700d54c7da3bacd81afd006b32d2ca86459fbe5f82e7419cf2c14e8106
SHA5123ea661b34033983f9aef1c7bff6e0ee878c1251f2c04e80d30ba4d4d1152407ae40f65687ef2a4d7e2911c276ffcd60dc615df85e2f80f677603b28b90a0e0ca
-
Filesize
5.2MB
MD5873be4f7643265434d15ec9a40ca5894
SHA11eca1a5715d352e7469ea51fefcc0bb6e80d33b0
SHA256426419b38a678a617fe2cd7f3b0e0d6636a0412a9d91c8f2da14079cced4d352
SHA512e206163ab2cf6038779a1b99dec08f037d1b18ab7537e3b228b5f67f2fee77692e4cb73e59a04c2c74b75a27665e6166f3d72665a5efdb6f88e7eed04e6d4367
-
Filesize
5.2MB
MD52172e7e2f1dde50894811bff46df516e
SHA13b011dad748e464fa97da6cc02c4b95533c674aa
SHA2561644bbc5ea61f614e504cf3bf64debeec7e87818c09be779e195f6e8ead98dc6
SHA5124ce5241489333a75a51689bb8ac7d49e0e80f5d0e00bb691b5b44045685a51c446591c73f46be6482cbf6ba54c7130ccb818faff67867a19b18ca8d7c24080c2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB