Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 03:42
General
-
Target
2024-12-27_5171d77b159692751aa378efffd04300_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5171d77b159692751aa378efffd04300
-
SHA1
82694ebbda806f338666680d3bb5b50955d58ac2
-
SHA256
84ee254ccbc06d27bcefa12a6ca6042db211fccc443b7db497d3a2207fd36e18
-
SHA512
98c94c5fe9ad880e9b56c4d1a1cbd5244ee8073c12a8be9d5d25278d2b62e515724b3cbc895f7dc59a6940c32fface6f3a440ee5692309cd41c232f1b95189a0
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibj56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_5171d77b159692751aa378efffd04300_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_5171d77b159692751aa378efffd04300_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iIpFoJQ.exeC:\Windows\System\iIpFoJQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vawIMay.exeC:\Windows\System\vawIMay.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gKBUCqL.exeC:\Windows\System\gKBUCqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKJaPxZ.exeC:\Windows\System\yKJaPxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlEighp.exeC:\Windows\System\JlEighp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iErEzJM.exeC:\Windows\System\iErEzJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raOTeSX.exeC:\Windows\System\raOTeSX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtyeEhe.exeC:\Windows\System\RtyeEhe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JhzmaHO.exeC:\Windows\System\JhzmaHO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bkZQRhS.exeC:\Windows\System\bkZQRhS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjKyecS.exeC:\Windows\System\qjKyecS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNBMLHJ.exeC:\Windows\System\hNBMLHJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KehqADa.exeC:\Windows\System\KehqADa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHOoTPB.exeC:\Windows\System\BHOoTPB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNTiYJZ.exeC:\Windows\System\eNTiYJZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwVzANs.exeC:\Windows\System\RwVzANs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PfMQkOZ.exeC:\Windows\System\PfMQkOZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\roCdXmz.exeC:\Windows\System\roCdXmz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zooJuIV.exeC:\Windows\System\zooJuIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjPziEl.exeC:\Windows\System\JjPziEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfrWzzA.exeC:\Windows\System\TfrWzzA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5007bcc45454954a867d95ba089ea6b6e
SHA14080854b7b05960e61f0b95f4f1b611ac43e25fb
SHA25690b2d67e6f287af4329138ecfe61e074e706266af240e31fbda31266cdd5f016
SHA512b9adb918e599fb1c8bca7dcf9ef821919e70a2cbff4fb6e8dbb2b87dd62ec49405272535a4fc617fb6671b3b1dc0b036194cdd87178fbeee5ae9c6a07365eb33
-
Filesize
5.2MB
MD5cd4aac0af85eae503fe4f9da1403f472
SHA1d6a75c17d3ee0c073b80220946c9e2ec81947d50
SHA256b3dc939e60d7c4cff858a12565f4464cc6860acf810315b6e48ed99fb4c9557b
SHA5120219377dbe3ac18a3634ed4a6f5b8abb14e901109d8842de740261936e8d7ea21af2d0c16b312542640dbfd85aef4c7ae8c7b5bf0e9014ab66bf6f32d5a31709
-
Filesize
5.2MB
MD5fcc1d9ca8381a4569d103fcbe8bac65f
SHA14b7b3a6e2573509669a9866247bcc26425df1695
SHA256ade6e18fb3f80247546d82d38e1a6c60f1274693321cac1c61beb44033ffac59
SHA5129fa1e1daba9d4456e30bf7d5be213e2847aa628686f642e668ebf497d1dc883b243da3e42d1953d0880c5a9e65099012cf6281306fe45d0aa91cfb4dd452dccf
-
Filesize
5.2MB
MD59ef05dad06c6d11b1da18bbebd0cdd94
SHA1fcc3b04cc5e2bac80c1c1633ef4741f86704972b
SHA2561f092146e565e8d1ebf214c83b3d7274cfee1e2ec1de65c022dcfd510cd2a93b
SHA5120e1c604ef45df426b9a15c04470c54b8b3b8161f3fc197ad2ce636cd6016c4df6733c9fd8eba50252c1f86799f83862ebff0591a707ab5aab9c03d85ff794525
-
Filesize
5.2MB
MD5a2c74c2aa753d3c06a1adbbe3a5cae33
SHA174be0f9b95890c9e85b925c728b4b19e1e56c206
SHA256779fe3d82db86a6b29525999dcc3ab80653ab20fc04bdb9ba67aca87d9cabdf3
SHA51213dcc35b12d805760f05ca8e34673d63799d26c6a6d5a0061fc8ae5718963b2193aa83961b9c087c871b57a2bea1dc1731dd1098a3b1762f4d8a9f6651382b94
-
Filesize
5.2MB
MD5779721268ed4e2f1b599b7e85f32f5fc
SHA145ed44b75987e7fda65109c337e6c47aea1543eb
SHA2565be64517c752e736aa3587c7629526338e01d92acb33143fe411d74af177ad26
SHA51282d5de81ad2d38f11a64638c1cfbf8a85bb92914a0dc5b209b03785b2fadb00271aaf8eadba6cd9a8b40c048b3c66e998635ce0d5f488218e5fb381e5b27ea9c
-
Filesize
5.2MB
MD531e8584d093ffdcc7cbbe65c67741029
SHA1d4dd55190d4f6d58eade8dee76d0a3cb011ba035
SHA256c3ff6e8d5f0b213d31041d83a0232e3056c39fa6f5d4f63e684a33f0d86751a7
SHA5129be9575bc6d5a1c03a3d3e99463a7ed75ad93fcba6045ad820dd1703bc9b3c8784022d838e7037304813c2405f3308e95cedca4085cadd60c5bd40d3e9754894
-
Filesize
5.2MB
MD59ada83e23d8730fb6d2cc728ede5334c
SHA14c38f8d24ce25f31bef7fc5d1b672533c185a2d7
SHA2565c9a4db1f0f93b3d09e6f9285c246a912b62453d0e80cd82a873308f9016ca29
SHA51235d87f210a8a013f541c5ff936e096ce9cf3842f20a0331d2099332bada5f7ea8d50c1a27b442a2bf34d9366a91c50fe3a9e496155d3d581454e686d4bced462
-
Filesize
5.2MB
MD534162448b3247281432d88a9010c901d
SHA14cf51cab4e91e8ccd456883bba672b0413adcd6f
SHA2565bd70ff00a9192613e7a6c093e146eecf80d834d146e43040d582322c673c443
SHA512eec44704ffe332eec1e6232ee487b7b2632a1d19037fcce67e94f2a3c1f93c701f099044ffa2c214eded18d7b27cee9eb3e87e1936cd123ed9d19af6747c0ab0
-
Filesize
5.2MB
MD5717a4030de5f2026388f498d2bead176
SHA1f39e7ede93d95543e3577016750c7ebdc5f7f2d9
SHA256e1dd321f001a00b31aee5fb83f0fba5b963fc9fa82852704b62cae8c8951927f
SHA51210b5c2097b83e3665dcdb899f9d29ffce33c24505f0e4afa24e623d4204294e5f3675cdd75d7b73236e77e320f82da7435d2e266fb3f0d745a4b93bfbfe0e032
-
Filesize
5.2MB
MD5efeb85961d2a27eaa8d44c67060dc0d5
SHA139dfab72d6bfc84dc0afcfdd241478afd05662b4
SHA2568a296240d99275db479f3b4219de991409249eea5f398e69e627a55d81d1bf6b
SHA512eceef7e882acf41e1e3a40db6a96a5624c114c6a8e67016a368c0fc2477d1568fa59952260f716e116071d1b721e08127278ff463827ea96c1e1c232119dd8c4
-
Filesize
5.2MB
MD5edf4d338f9d82937e592d3f95a8e6bba
SHA13f8ccd4a61c9c36761f05ad56e904764e6c0af2e
SHA2561bfca0908c6dc3563ad4e2ed2adf989e4a5f29565cadd8a54ebfaa5c6426cc6b
SHA5121b35585f36b7f0dc0610e636d1db1eb134e6ec78689e817fe1e0eebe558e5df2dba435e6bbe33b9c67a34694431283cff9be31eabd033aa00a972c1f1606e62f
-
Filesize
5.2MB
MD52cd05f883e3f5a7036d4a73ad6dc8095
SHA152187878d4b0c73a1ea3889bcd0c5e1385bc7e0f
SHA25628945e4f1090920a08e489c994bf1345301c8b0817cba6121554e0f65cddd27c
SHA51213535b5408fabaeacb227b32563019a0a1d990651d0dc10956463801ddb238f86291e03016f3d2f3ac44fca51b363cf33e20ec2abfdb22718e92fa7212669846
-
Filesize
5.2MB
MD5d513dadb4112c466d63b54bfba255b5f
SHA1526825e3ab7c9377a10d74d2255c6f24ee7daba1
SHA256446ebed73b86035c9bd912b83c2e46528548b80682cad1d723a699b8050e5e6c
SHA512661e7a6ca8d920e9ada54e7784ad867898c6c631d76b6a1ce8739f139e0d8e5c88a0544e3a817e2db3d6c4c8bc62e0aaa66676372aa693bc24d128beb2e3738b
-
Filesize
5.2MB
MD55d4cf6f4d53836ac9a0d163ee904d0cb
SHA1928c02f52ea1ba7854eefa568da2dd4faa038231
SHA2565c0d76348a5677193d72c70c3557e3fdcd67e77d54f59b8f203b33bef0dcb954
SHA5120827e5ee02cfd87871044a8c3cf7690426c509841764b0e1e295e4c15110df8520edc30cef599cee04ee300cafa393f163fcae4201577d72038366e4c4bcce63
-
Filesize
5.2MB
MD594fe0a778fcaffd731750ccec55fd908
SHA16f51d19ea5505603578a906a005855090706b182
SHA2565183cf1f8cb0ab4447b1f996eb8705c6111c38aa68eaed574eb22d538e1bb3a4
SHA5125d46d6a4bb1f177b0e1bba9fe9d0ea2b1f967fa94a291b3407eabc31c9a6a5a3f4bc9ac4859ee9c27a943007beee86d2eba4ecc542c0027917d9352ab2ac2072
-
Filesize
5.2MB
MD596c8aa7e775805dd4a9fa0b1dc5669c5
SHA12b130e489e8f7e1d965f0088ac293991e7b857b3
SHA2565b64e61e86044993cee211506788a7d5e0955be025db4eb4bed84f6434632ed9
SHA512f756f6aa0816f591d44344a32491673deef60f3fc9c4ac26414171518762895a1cda85f5b8d2a50ab0ef80b457b23584fafec91610d8c02c6d21b8b39674a482
-
Filesize
5.2MB
MD50cfd5411c53da22f53b22dad1a0ea33b
SHA1f28165a1f6f25e854197cd9a2df932f74f77e76f
SHA256d5ecd05bfb5e6c203da6bc22836e1d943da4eb9446fa42832e5b98b429981625
SHA51232cc9c803d59428222590cd3111b24a03bcc80fb4a762625e2682d73a8ff69d10588bb4b4e6f75c9d15a9e4a339e24c290b77ccc7d14c3c988ba8a705122c04c
-
Filesize
5.2MB
MD5066213cbad8c3748efe8f64312303bf5
SHA1c124c481878585be4bcd119cc5741cf7721b67d6
SHA256c405416c3a3a4b2a495b6b626312a35716c627ff46cc4543487f00e6a77dc3ca
SHA5128d3edf939c9371d099294dd42a3def070912e0c047987b461f6f36be944c6b3c752b2979ef7c99178706ef897fa2d40edffc9d932cea4a7bd01e4a33d8ca0d96
-
Filesize
5.2MB
MD5ea6406ec3087e7279136ac00f8bc0428
SHA17b8c064254f05b9011e8c872d38a60b8bf450f2b
SHA2566ca3711e589a25521290c01cc352c62b9bd3c6544d47875888afa1cd4fd09eea
SHA51201f91df9be9bd27b845a4c507c097ebbda859c9fb96e2278cb168a85a0148ef7ec417dc11d4d470ac0965d80ddedb9494b915fd24391da43acb6c77a2a074318
-
Filesize
5.2MB
MD5813e6d6c11bec947d724b0795509401b
SHA15e1011249986a2c7bca40a0bed85e495678059b5
SHA2563148550d604c336dcd0f3647b6a7f7127c893052587e1fa6e1fb7ebabb7cf329
SHA5125b8e37a1cef67d619aeb1d8658c2bec3b6e694fa87efa19add0a7698f92b03b9dabbf29cbae5f0bf04315e8c83d8be71eace8a2aafb71c075a1d85d0b6450172
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB