Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 03:22
General
-
Target
2024-12-27_20de294bc562ce9b884ed98bd9172835_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
20de294bc562ce9b884ed98bd9172835
-
SHA1
780775b89ab987a5ecc297e4322acf1487d1052f
-
SHA256
5cff8b8f68b2e64bbdb396668d32229629b9b690cef166d6acca6ac0c1bc0705
-
SHA512
b52bfc43cd45d5f3d92a0883019278c7d81edcb94da1a702cbb3732ff5325f14a82864ea6de62e82f5e3f5b64f1f91f9e5cd9b90194bff84ea3ab99814dd5679
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibj56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_20de294bc562ce9b884ed98bd9172835_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_20de294bc562ce9b884ed98bd9172835_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jxTewaU.exeC:\Windows\System\jxTewaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TpNzOIo.exeC:\Windows\System\TpNzOIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtjNJbV.exeC:\Windows\System\YtjNJbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhNSaUJ.exeC:\Windows\System\NhNSaUJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RoFlXhm.exeC:\Windows\System\RoFlXhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHbxQWy.exeC:\Windows\System\xHbxQWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yurPgGh.exeC:\Windows\System\yurPgGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdLuCOt.exeC:\Windows\System\IdLuCOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DKRXIks.exeC:\Windows\System\DKRXIks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rSCxxZK.exeC:\Windows\System\rSCxxZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\diZiWMp.exeC:\Windows\System\diZiWMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PeTySRF.exeC:\Windows\System\PeTySRF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NSkgfwP.exeC:\Windows\System\NSkgfwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URwPTDP.exeC:\Windows\System\URwPTDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtxAaqA.exeC:\Windows\System\vtxAaqA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTypHut.exeC:\Windows\System\tTypHut.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kHsMFVv.exeC:\Windows\System\kHsMFVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyMinrY.exeC:\Windows\System\MyMinrY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnEjmLS.exeC:\Windows\System\KnEjmLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ODWyvTr.exeC:\Windows\System\ODWyvTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EJifzea.exeC:\Windows\System\EJifzea.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e4c28e4b8a371e71bc8e7d3583f1016a
SHA10d06e1fd63e4d561b585c7a39131f0c00356c87b
SHA256c40ee27f27db991c2fc0b64ba5737f23cb869a4c7dc05fc4e34bbacb59507f0e
SHA51200a36c3029dadebe89280fd0452c9457142dfca20eb466d3d942599d4b9e25eb9e4d0c8631395623ae9e2b3802b39d8105b9037c1e3df8515ce282ddc39ab433
-
Filesize
5.2MB
MD55bebaf1838d6a9deea6c6b89b32b67d3
SHA1f8f95b46ac8bc51ac4c2bbac9dff4fb3babc6378
SHA2569adb479bcaceee154c622f237bc5a2f819cd6b9f0ecba7b69232e26d0e119f9c
SHA512e19b8b57c3e0416d1f520d2c443d33660513a0b1898b66c29c674611c2f0cc051a3e2b3956176d55ad9e34a3845b91c8c28f09f622a61210dbfe2d910210a1d3
-
Filesize
5.2MB
MD54c19d608c2f957c67ee62705ee8a4cb4
SHA1e608f45dd09eb9c1578a1f9476b0e576e0584b64
SHA25638f03f4db6ee2a2fd2e49cec21a13ab8dcc3858ba53a6062298a3b9df202323f
SHA5128037386db5cacb077b75b77642e6c452e3ec3802324a5d7fe2e6187fbafe31ed09a95a6fcf81ff2a1134799ad075bcfeb003bd500cdd023dbb5706f4517023d5
-
Filesize
5.2MB
MD5fa3462f9ad2f67984eefeb0b475cc0a4
SHA10da82ce75bd52f9f14eee0b2f825cb542cece297
SHA256eb987836f1cb74b535405498757136c833ed664510623f503cd15eb000125565
SHA512389c54eccf5ff4dc1ec72eee7ef5182926fcc0ef2f11f3b24f598e2de507cc31edcb165e2748daaa44c114bae158379a3e27401f5c60b723274faf827c194320
-
Filesize
5.2MB
MD5a09a0efcf515cc07ee83ea3060ee77eb
SHA1df890600dec5a7fc3598ced264eb829c6dfd4367
SHA256d3661de173fa4ff74069159110d60e5181d98ebf895ff5f89619a1104f325bbd
SHA512ed45fab18a5128d20938181a143edaed3fb116dc604a2c27e85d302d0f3bb16b6cac1aa25becd7b55c05bd5bf9b6416b02ec1693d55480db86dd9413a43ce043
-
Filesize
5.2MB
MD524f48c5ca862f8c8ff054d587170fbe5
SHA1e5ed80fa901fcc3fea8c623e72c58cd25f60a128
SHA2560e6a464b1f5559fbbd75c09385967e100eff55e3ebeb34d4cd6d6d0e7b0e536a
SHA51277f37062eb24d79de369c7fd791de3e6a8abb06101b55c4ccb04e79a8eebec49734e33b528d3a88793173cc60b80a237be9b813ab7feb08e8967117fd9b260b7
-
Filesize
5.2MB
MD56df621d5527f92584a4d37875a81a7c0
SHA10fe3a06ba12644f6bf03c20195dc0c1d7de9d59b
SHA256374369e94a121df6b739ae160971dff694d6a8ff3546af8104e3e08d22c5348d
SHA51292212f46222c9ed58ffb120d9a4d6fe23e293cc3a0482e373efe601069664a26ba502d402e3e3401bc869d7d4c1ba4fe7455f132193c53c95df4275ac670fcb4
-
Filesize
5.2MB
MD56e5b8b1574b3d38bf888caec4fbbb5d6
SHA1f034fc2f7d34522c2e189d40773c14f8af28844c
SHA256925a8b3202eea6f6771266c5d6dd4b68f201b7f2771d2cb3cb91fd28e7343bd0
SHA5121a940563f72742c86ac8267217b5a4ab4eaa8e4af31d6debd6878beec2f86a92e769681a57f648311cf80000b33ae75e379581316f83ad746e75f644dbf3df0f
-
Filesize
5.2MB
MD534d2d543558c70ff0a559e45f30156fd
SHA12acf3897f5c4f73fbdc32e187a67ca5a21cb0463
SHA25663b8efb778cf454f6196b18444489849c80e18f2359d7f250094a010c229cd80
SHA512eefc7ff5fea024fe9cfbc45cecfa2652277fefc96aeb52c6eacd64476c265a38f20383e09acb4ff038e292757cf38d7c0d8898451b30202232928c9d910e5a35
-
Filesize
5.2MB
MD524cc996fe206268c038bd324de7f8265
SHA1f370f4e95a6d56667a29810540f7fe1012382609
SHA2569aaf661dd84334ecabfca8cd4d3c3ecfb8a3e6a304cfdbe02544624b784c482f
SHA512b29770490308b0c39461bac312595c2833374ed91490b9bd29c513a7cdba6f4aaa268b2ad0133852e185e98f93dc47a2a5c5cfe7d8fa3e819b024bff4581d5ad
-
Filesize
5.2MB
MD5d4b2264701ba9ae043bd473fd4d22c3b
SHA1512c5cda8df5b73d770e30e213c574691eb2dbcf
SHA2562174e78a2501fd63c78442eb57639cb4ddc9b490bb362bbc93d332420966090d
SHA512966c765db4eff65d06794c36068b39a7cb0ef128c7cf69be8085c934a0bc8d2bea10935203096bf7c07320226f0dc2780340e8f9fb8c8b71ada1b2ff86059224
-
Filesize
5.2MB
MD558bfcf88ac145c803da476d0fa540204
SHA14deaa9fc9e02593daee67a039412b62ac5e4764f
SHA256931477609cb582840a1f72bbbe2d56a7cd80dceec8e52471ca35a0eca3b8cbe3
SHA5123d0bd6853ebe26a5caa92c0bb914b0ccd6430c10840bf146e18fed6b7e429324084367a64385d3635daf207ecd5993f6cd8b97778f8897acd69bd2b33414a05e
-
Filesize
5.2MB
MD54309f1d252e5754221e366895d7baf87
SHA1c4c1405970a225ba4d85221dbab77fc6a0dfcc1b
SHA2563d6473be66e7d01c5be4a7a8995c48a0ac97c4fe74331169bd1305a6ee5be5a1
SHA5123ffba00ced36e07d74e61c828029701c7251fe94fe93c72f139af43f567d7f8851003ad234e4ea645e422b9e57c9a7e3d65373c6cce69efa3fefee73ca68f592
-
Filesize
5.2MB
MD5939f367192ce154e12800175a5c56059
SHA1046b9c0c721534ddf26429ba9e8a076143806a53
SHA2561a65007dc5bb95c21f1bf26e13e2d58a3e2a272e2955758bb5a99ee0f9bf7e85
SHA512e33feeb3634c1de51c5895301147243753b87195a25c7390a06b75649d2a48676ed7f3ba55de5bc619b54cb518fe84d907c7a547504ffcc9424f86d0bccb72a8
-
Filesize
5.2MB
MD534de77e86d77bdb323ea2742d4f97633
SHA1498aa722ef297f5ec2bba5cf5611ae4c3269dd09
SHA256fca613df0d9a2fc35d96530fa1b81b5b32440c4f158d9754b0e189a45df8f1ec
SHA512c34150f6e89557c9ad1fac0c56842597d862102612c61b515599504b91b7f8471eb8974d7c4dfe05bad39bd8daa5eb43e4e4cc40dca2187020b24b6bd396ef8d
-
Filesize
5.2MB
MD58435428141f7cf069e8e2d03e4a25d17
SHA1ca01081ddf607f68c39ede65c7c38469a1ff2264
SHA256c156102124e67386a0df8a7fcd53211de627319fb50a8168d170776b64f3871f
SHA51261b57c7af9915a3b6c46a26d105addc5b8588d21999ff72af53ea1bcdb1217dc48bb5f56903a68b6d15e91758b0c9719a3bb987d9f3839016ddc8f2c6e37b5c0
-
Filesize
5.2MB
MD5903967a81e0b501caaf7e74319f8f4d8
SHA1d7f668e5fb6d091b57625363a008e965758620d1
SHA256a2758f52b3ed334853f5c9af51fb69b81f01df9a5c8feb73d8a7621f55503a44
SHA512706e442b2f627c118cac46e3a803fb77ab69ac1577895d98b787f07f2f708cb93bfb8f0863de172a03b4a2faf35778fd7519cd88f6e11684245fa389434a2b66
-
Filesize
5.2MB
MD59e2a0e1168754e1f55d8780ba1a29b29
SHA17e6f80d92d50365282880486509b76ed0f4e4cb4
SHA25614ebb9449e351820cfd8665c6eee41d3838b6328dedc91160b54b166a2202353
SHA5122c5f8cdba8a21b61c1a0c7ff37110fc71975ed49d1d8dbe51bd39c0b2d08a020f4f178b5ad7703b49fa3c5931d198c93b96f71ce74ae20746cd2d66de3f0d67b
-
Filesize
5.2MB
MD51290103c236f6308e5264c0dcef4090d
SHA1b5ab192bdab6b0c74f8d11fd28728a36d7efddb6
SHA25675bd2aaa24ff6cb9e92f49f33c54583a11dffda8c7db5d56c523b78d40bcfe12
SHA512aec87b3326f345bc24ced2ec38753077aa31f48a0f89b3ff8ecbaa6ddc337b81f299244ae7cb986b516a3887b3c4262a3950b8f05226b3c2f85125b45023a1e1
-
Filesize
5.2MB
MD50501bb4b4dc706e19cd75004c6a5a42a
SHA16d93d939d598a9f2bd6200a6e6b13aec50e26de2
SHA2564ff0891d54385789d044c427d8ae0657e5bcb0e0773f3bbda79f14804449e412
SHA512998ed93d47067d07dda2f83f12a8dbc675cf2fa796db0d6e704bdcb6b8806aa8ca6be75021f50c1f3b31c4759613fed32bf7e535d5939f6df655d8cad4bfe038
-
Filesize
5.2MB
MD52c42d0377cc22f673e8ac360135c658d
SHA1c3ac4de05396f6a0435954bf21e7d1a553737db8
SHA256b0ef327de578013047a7d739b7d903ce0498e23b425853b694bbd3bef4e9b0a2
SHA5122f60651f4336668a483f50a7236553717482338087f11e6f6b0971fbbf04b181c396d36e3fae0f2d2ee772ff736a82e47b137b53ce4d9fb733781b90508bbb59
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB