Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/12/2024, 16:58
General
-
Target
2024-12-22_463ef1711d91099378a9c029ce5537e8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
463ef1711d91099378a9c029ce5537e8
-
SHA1
d41a392935c4fbc9c2a02d7329cb23e1c044e738
-
SHA256
f2deccebf844499cea837e8006950a480af60e5b2cfb98eedfb5178759cee737
-
SHA512
b96f7cb716dae61eb448d178382f2c1d5d76c30430b87e8a2dc28fc8e45feaeac18944c6c46966f11dae714e6826d6a0969424b8814cd11cbf4adef45866e1cb
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibd56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_463ef1711d91099378a9c029ce5537e8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_463ef1711d91099378a9c029ce5537e8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EouhEMG.exeC:\Windows\System\EouhEMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCpywQF.exeC:\Windows\System\XCpywQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMRcoxS.exeC:\Windows\System\iMRcoxS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rUvMbqq.exeC:\Windows\System\rUvMbqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TocTzlO.exeC:\Windows\System\TocTzlO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfMinJy.exeC:\Windows\System\JfMinJy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LNwpkJg.exeC:\Windows\System\LNwpkJg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnqMNWA.exeC:\Windows\System\fnqMNWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rmjbcMv.exeC:\Windows\System\rmjbcMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdlbtgs.exeC:\Windows\System\zdlbtgs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LBdBDSG.exeC:\Windows\System\LBdBDSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCfdNWX.exeC:\Windows\System\tCfdNWX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DaFdTAC.exeC:\Windows\System\DaFdTAC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\joxlHnQ.exeC:\Windows\System\joxlHnQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMTmtJR.exeC:\Windows\System\mMTmtJR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DuuLiCb.exeC:\Windows\System\DuuLiCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IFjQzCA.exeC:\Windows\System\IFjQzCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zBLplrM.exeC:\Windows\System\zBLplrM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRMwBwg.exeC:\Windows\System\WRMwBwg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Cszfwpm.exeC:\Windows\System\Cszfwpm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDIoJSv.exeC:\Windows\System\kDIoJSv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e3ad88eaad24bb50f87b0e003b578947
SHA1a3823009036049b63b150b3093187654794c4adb
SHA256f8dce65d4f077f0ddc700fee42ba1567a2695e8d13e67f97d4472c1b1fe94cae
SHA51292eaf28b3860ba1ffe62558604a02a415da46409b0b0339aa4c8cede2d834fb6dab09dbaa4c0aa6cedcb9867e8e1d794749bdca52c8a56a1b6cd494c459dedd7
-
Filesize
5.2MB
MD558fca6b4590c199e709d41d3fbec3009
SHA110f8a974f91959ffe07f62908b7a9305b376c02f
SHA25655eb2bbfefec7b54b3ad0223487e7a9f6d3e15ac5e5d95c8957abb6b0e12f4f0
SHA5126c649b21010a3cd871843107c23f63ed12dacf7495e5200dc682c0cc985247bc073f7026dd353782b50863bc500ae316cfb690b0cd67aae09acb82e741049344
-
Filesize
5.2MB
MD555f7dc6d2fddc2be15641a6e031be184
SHA1b6101ff40c22042e1ec74eb585ec792e9007f788
SHA256392de498032ba62078647a5620d93351687ff550db3e2d6b170b952ec0a8e965
SHA5122d7bd831cdc98e182e1a6815b952e304ea492b746a739e5ac88cdccec9028ba619bfc6e600154cc7d53e25132d5c9abdb10caa10a0bbbf45f47d065453c93749
-
Filesize
5.2MB
MD5716bbbba94591059f126a24403917c23
SHA103f3dad43f8420da2e91143831947fa38372f8dc
SHA256929971e380b5ccb0f1439c05de6e897b5649563ff26fd1a98ef640a380ca3946
SHA512e186d057c2e58089b6e0c87ed3f46608f43d0702fdaca85f222e907e427cec1fd9dc355e5a50e4f40ff8af0d1a362c2ad0889addb3d4a725f80e0a59a9d61d12
-
Filesize
5.2MB
MD50e14ba4c65dba7a70354c1bdfda8b83b
SHA1d340745c0b1363c6a5be14cd8d50287d5c970493
SHA256ce0b7b31b775d5e5950b592bfac428da127e7dd62402af29212f34393f1cecb0
SHA51203609cfc433e23f882594a12463b58f03f5c8c20e218019938e2a66dfc97aef18edbbae24678dd564770c31cc82de87bb775e4269b2d9a52f1ed653c4eb97f22
-
Filesize
5.2MB
MD526c81e0f499202066e6fb672b39285e9
SHA1c613d39cfa405ac351e1502eee3a2ca5964982d7
SHA256bf34c1df7d82f1e739c6f0e30ab82dbe4fd11c995b48c5bdc44b5d2fa747c9d6
SHA512d8d4ae907191d16b614b968d6391cab6c784c3568ea2c9ec699830bb68e696dc60b1bfc961b3927e756218a09bf039030bea3bcc736e63cfa3258749062b6955
-
Filesize
5.2MB
MD50fdf37d43a768a7db1c7a2b9503e1665
SHA1930dae2681d6ed97f93822882053f2726357297b
SHA256bf2e015a899921c6571d52fb7ad5120e2aaff7f20622dcf89af381a5435c4b93
SHA512286505ed72c6d87cce9e11e38e35cb351ecbe1c8d3019f118371071dd8ac2fbbc278b11dec9feee925b81109ed5b7c91ffe17f75f0b955fbd858f6216e484e60
-
Filesize
5.2MB
MD5b65f39620ffffdc5091261fa6a0bf6bb
SHA12a8bdb026b755349f48372f50f0f168c9bac6984
SHA2564323dd0722086de04626505e056feda9f8a2382b7c383ef6cf8c37f8f6405976
SHA512b00544ec8d9f8b5aee6dd41f80df72ae40aacefb000f2558d1116eb0a38b35e458bf7500443abb96f806a18304d43f92a4d6143eb38bf6798f93f4896aa223cf
-
Filesize
5.2MB
MD56f1161dd5cd1080d581ebdcd58d726cb
SHA1313cc6000eea5404f96fe187fd0a12269b846663
SHA256ee0c738ce7fde362bf5ce7637efbfa2fb2905c99d1a0a9dfb72d6990c2d32df2
SHA5120f9ec8119d074f087843304add12678f90e06a53484683dde7b3a5bb76fa8f0a8d626ec8a3d56dca13056e72a6ef227d94f0c14835eb4f0d225a3c43e7fba642
-
Filesize
5.2MB
MD5ebb0b327064178d1161bed25cd4a7874
SHA1f9dc6d01d24bb958721267ba17ee673e3361710a
SHA25673d1d6938eb7e8926ef7dbcd1024e7ada54e456dd704b5f2416ce6f9e28c714e
SHA512097ad6c5678e93934775b11a7870779606e2fc1bb4146a734f67d96841ef4c3717a50730891b9a0c11b4f54ac12858decf3cc95dc80cd4a7b1c4f7ce2f338bf1
-
Filesize
5.2MB
MD5a066da33a6f168777c4f4739175b3a3c
SHA152702c93201e95cd85a20c0eb5fa9d75b702ab98
SHA25605d7f9a4fd098cf670310a4585d75ce7a8e8dab67137a6ef3e846932e80e390c
SHA512353b0e1987257b9d9728331205d00fb105e28babac6e0c38256a8224ff6d39caff7e04acfcf0877e5af1fd5973e1d306d1b3f2f729dfa5b6156be09719e6c5f5
-
Filesize
5.2MB
MD5b58f6c6ddb70623bd3cdd92d880cc1da
SHA15b4ed6c62c152f009e09a6fe767d7036aa65bc8d
SHA2566693a5eb06ca8c2693dd4441172438d9bc3cfe0fdec2e0a01c54bd5cee1535d4
SHA512da886308719f78d6027cb5b0076ed1b127e53e0c2600667bc18d7c99f43852949f0109e0e8d750a30b404a8d3d4e5184a23856bdb57962824122c84af9d5d2c1
-
Filesize
5.2MB
MD5aea3ff2da241a5681559cc661d04cc4a
SHA16939f9b42f30787f8a4d9dc9f8d86332609b059d
SHA256871c908f7766775a97626038ed72b5662e5e1fbabe4bde88d19f5f65b57aae89
SHA512dcd82e5082056648afd5f7e2d2ae6059b43e921747b1a05d15562e6e4808c87dff45f817b58b6fcf5f13d6631c5cd33ac5695820da7d5c5bbd4cc2f99c1682b4
-
Filesize
5.2MB
MD5af3df19d1aadb6863143e5d27c0593e0
SHA10fbb36bbb1401897c6e89b09b6affa15a2b0de6c
SHA2567133ccb2c7ad6c0341122df033d1e5e68b70cd1096e389f1ff06fd1406ca8578
SHA512a810e7e010f75e1a1c6e0b6a72aa7ae939c5fc1bd515053df0412c0f6aeb1ed64ed74029f22b4c9818a3fba384be0ab041f5ae78e24d99e966f6d370230eb3cf
-
Filesize
5.2MB
MD5e95729c2b30a5b621b36e15a82d41951
SHA1dae09897082b0faff6e18cdac59bc06eb1c9b2e7
SHA256ee542cbe83050b8de209f88055437fcf5da01a8022661bac87259cf967a8c6fb
SHA512442a0ca2c96256346bd991bf27ffaa73569e4533572d8b7ba855edebdf5db5fe19c1d3588b71ac39c6bddc7796cddd5a4fdaf8adebc6bcc21f26f3e9ac83ca1c
-
Filesize
5.2MB
MD507b89c9bdfa9023191fcd050ec3817a3
SHA1f8cbf25e31edecf30c36c7413d5645fac46e4ad4
SHA2564bd2c233ba086f61e24ad1c3c0b3725339113d18c5927dc571f8fdb7053db7e3
SHA5125b11945baefa025c999fe6c59127ea9dee01c3ec7648e51ffdad7823e16531a3e60d75fdc7630f487ef268e00a68201661b8826491b12cf7fea0b1d6dd92514f
-
Filesize
5.2MB
MD572abc622f60662f17bab4aad78f4f8f9
SHA103439ea01e2bb69eabd12f4a6f7182d89f0d9946
SHA2563342b2b6aabe906caaeb04bfa9287aaa01f80a6aabaedc8dcffb4ea1f3d22817
SHA5122a2456aeb41ffefb7358d7390cb2d3168e863e9aa07844ef4029e0beab046ee86303317ac8492248bb8c8fb4527a891e0c1e02b84651f7b2742c9bfbc29ee338
-
Filesize
5.2MB
MD547c7da3c107a169b15f8ed6de107ca7c
SHA16a2f9c8d3917edcc1a806e4815d0a90b52521fa2
SHA25615fced2cd7e87dab3323216f05d3676cf1cd2cbd101e6b92146a18f991fe6fd8
SHA51297339b098b360c51c4cd1f184689c7ea1ae595a043be71ab1a91d278c9cc69f87da65a93fe6e94f2b39b93ae40de0d11d8c25801ebf7b6dc3630d5c8c9dc1449
-
Filesize
5.2MB
MD51794e1f32d6ef8988c60e6b067fe2362
SHA1d34b884238b355ee82bee95be2a913c319869260
SHA25621183c9ff7db119d8dd8b044b087a5b2fc2d1890a64f22a9a58b3616186b4b8e
SHA512956272496857736c87a5c399c96e8ca1d80fdf16538bec34e993cabed8b820e502e01decf74a10e39eaef1d96c0120d4147ed24d190f423d564bcb6cd4fc0ce2
-
Filesize
5.2MB
MD599f076e591a0035083392cd8df9f09ec
SHA1d532ed75f34398f06a8858e853fc0289794b1cbc
SHA2561c2032d64c5a2068be1bba8fa501cc5b9a97614b6a470e6350dd8a578601796d
SHA512dabfa2c15c7f9f4cc57a9ac2a9350d78611944da5e610823c961ddd0e7cb85859d24a38a325f36a48ccbedb1e7e7cb5b1cd92d0356249460046e8c2929fe14cd
-
Filesize
5.2MB
MD5cee8bbe89f404a89a46a629ac0ba5e69
SHA1ce92f28eb38c7466d69ea58d4a36d9282f2a3bed
SHA25659240f99c59f46f604d83be33b1e3bcb50e48440553d29659c4574b66b9feedb
SHA51236e3ab24ac4def8bb924a1ed0e3170583c73690648db5431bf25a2e21510233d37f4dd298d0ff8b01c5a9adee9e47095d1b219033ac796350cb987770d01983e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB