Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:05
General
-
Target
2024-12-31_cfaa22902717bc2e7a0d155cf64d9a32_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cfaa22902717bc2e7a0d155cf64d9a32
-
SHA1
9878ac058f9f2e958954910d8629163f558bf530
-
SHA256
f287fd50e5adc896f4800db853b98e412c7039717c540cba3b5341484f200c99
-
SHA512
126e3f3ab47969cacd54fcf339790b0f92a0ebb9bc2804fe6881628522b1cee778fb7414347575f25afdf27b26c25e407ab69dcb5239beb088cd053b844010ce
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_cfaa22902717bc2e7a0d155cf64d9a32_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_cfaa22902717bc2e7a0d155cf64d9a32_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eCBKCfY.exeC:\Windows\System\eCBKCfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLQujIm.exeC:\Windows\System\HLQujIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hauUzob.exeC:\Windows\System\hauUzob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tkDgNow.exeC:\Windows\System\tkDgNow.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OiMKBqC.exeC:\Windows\System\OiMKBqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptvQbzQ.exeC:\Windows\System\ptvQbzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvUWreI.exeC:\Windows\System\hvUWreI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWLFdsy.exeC:\Windows\System\uWLFdsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMbEycI.exeC:\Windows\System\CMbEycI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwrjbLm.exeC:\Windows\System\rwrjbLm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PmIYrMM.exeC:\Windows\System\PmIYrMM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQhyMIo.exeC:\Windows\System\tQhyMIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBdOTpQ.exeC:\Windows\System\mBdOTpQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVLrQYj.exeC:\Windows\System\TVLrQYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKVtRqM.exeC:\Windows\System\VKVtRqM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMGiObd.exeC:\Windows\System\TMGiObd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSJxEzF.exeC:\Windows\System\gSJxEzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWdxOOb.exeC:\Windows\System\qWdxOOb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPBiBRd.exeC:\Windows\System\KPBiBRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xNpXfMV.exeC:\Windows\System\xNpXfMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GMKBOmg.exeC:\Windows\System\GMKBOmg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b04a3d686fb88649d3de9497db70ca63
SHA1511797923f7209579f07b84fd841f8c0ad24598e
SHA25674de66d6473543b005c4f25f8706928ba2e34d53b106e6a8e899765c09b55b31
SHA512c44a9ce62493ce7ba66ee4a1e2a26be6e14058da849bac9bd9b76981cc614e43faa44a5bf9ef97eef88a6b2da769abc0f4bf51a53bfe7156e36875ae5784b8b3
-
Filesize
5.2MB
MD59a9e5afc90983b14a52b107d19d717e3
SHA154b4ac80ab59e895ed1437ac0e1304d7949207ac
SHA25666aee8d1698c859f7e97a309d780dbc0397c6c7b8ee0d2945e37cd1a4ad7ef75
SHA5122840fe6f420fcdc944d05074b571fbb7ab22d5a4272c6bdb25f54493c904de3dc9b460b33fcceaf8f14ec41f9c055b9191e68cb08957d3482b6596e15e931a4f
-
Filesize
5.2MB
MD53de3273df694750153d72e98395e6da9
SHA1cc4f8e212c26f94378dc03480ee31d73031602a3
SHA2568b81544584ec6e499d85765419b40c3a4a5c5b95d0b7d7f767857c43e38129c2
SHA51232c13a3d6693392f1cf0c9f9a3423870c76206a94ef612546fe063f78caace25b4e6050b53fb4a2a1d797988a51f627e7196e01ee519ccf462db3f842393506e
-
Filesize
5.2MB
MD5e557d1093c419450ce82749d55bfd472
SHA1bce7aa3aef393f52acd5efb4b30ac3d557a1c083
SHA256432c49d9fe2acde6f23f3413a3d423414e789090b76a81aae225a133f4d549a7
SHA51294f140637ae8e6b534541e7d1e3e9f27ac9295232abcce8209ef35eca78a115a50de95fd36dcb97d0edff0ac601c4737979c9b30c544b0ac1c7c284002b7324a
-
Filesize
5.2MB
MD52a367c62985720c7a721faa8ffcca555
SHA1e922f3ecf2aac472ef1f455fd5fb8079991f1a1b
SHA2564af424f5c34ca227cd8e3901242c562c56475c22da547d8855023fde015d13e3
SHA512ae3565e90b56a07e3c9aff3566f3661ffd8b1c70c2bc2f6818035ef8b529609cda8aa5e0ff5bd45768b7c8532979c6b730c87de2fb34277317aced712b263ac2
-
Filesize
5.2MB
MD5d41e358a5b16ef57a26e40bfd16b497f
SHA117b1ad9a3dc931cc03968a23f18535101cb22ef1
SHA256e9a53a87333d803b7c48a33e79f79e726ae84bdc84f8267dbe8beda01ca13702
SHA512de9044509031086335ed22648e9fb344b75a7d100d5f7d7a4f9013a25dda3d5cce7bc1b1037f2eaf1094a0e57ce76df1ecadfb9d4773b217f668a512ab5c7307
-
Filesize
5.2MB
MD50c4965c59790e1a94128b65020719bc9
SHA1ba0228e0ad25b9713f0af9fbddc12cd77249a529
SHA256f77d065a9ca9f510411fa186724dd0e0a6b2a846cf038dcb9c8df5d30f34fc25
SHA5124df2b866d7ac18310434c67850458cec7c7674beba391ded01bc46632eaf7011cfe4d4466b7b60d68fb50fee05bc58ca280cb4e771c8ab87a7554933291b2383
-
Filesize
5.2MB
MD5d6b64506a602bc1c340767e09139d3d0
SHA16db195f16115132bf77d7390787cde2cb3e4773b
SHA256e470a953c4ce5e6a4bb560a0ae947169be43e4d43cacb27c908162b684165676
SHA51276b9dca7cf2e26c480c63921cb15f7f9aea32dc354a0467389e6e62cf773b1a15f5614db2578e59361100e50fced06546b0ab2b553b52eca817678ba0f1b1a55
-
Filesize
5.2MB
MD5f0f44ee00d3bef989f70d8d4188f10cf
SHA19ef04fcb8537a8831c9bfb9fde10f5cb6be2606a
SHA256d03a07597858b008f1a01ac76fc01c943ae164fe0c1cb3129e5363015f57c63c
SHA512f1537071ee16521ef5d2ad37c650929b94687bbbc0cf5178ca4a0fd37403bb7591d8dd75b77bb368e1e7af7e53ab7e0c7bdce39a25fa9e149e4bc39db98b8ae2
-
Filesize
5.2MB
MD5acc5ab74d2f869868319afae58dc0722
SHA1f901662974c3727c3a851602ede5c3016501f8b9
SHA256c2875feafe14eeb4440864a39f81f7d4d6c46a713825c38503e759aa95e19818
SHA5120c0f115d513da60c7d8a08cef1d76a2449d3af8b8623ae8cedac7f4051d9bb869258c23954ca12b65d2d2f3eb33d64a1fc0b2e5697ce23e458f961dd8eae52ef
-
Filesize
5.2MB
MD51fb6e52f1d4bcd8dc8ae9cb9b68ed89b
SHA1251057e910e7dddb8499b8558d28212ed77d4c5c
SHA2567d8bec72dcb33e979a249898a25af8a096152adaf3b47ca46215a109e8665afa
SHA51262d64d1de2fab4c9f8767add1eef659c7f1c47d16db2933117c7e88cb9862e65bcb9b9aa2c3cba00a8ab141e6f9a4111ead9805844049ff893fd1f456d0d651b
-
Filesize
5.2MB
MD52dccd9eb835910688e7600153d26075c
SHA190eeec429ab8ba6222261f323312b1ccf25f968d
SHA25693db9cb10e5141305e78438dcf2b2b08c7d868f6753859b46e1cbdcf21a0f138
SHA5121ddfb0943103b5eb0ed721dace2e7f3dc7368af6f3c580cb851130ced4763a668bc99eaba60c14c129a74f0472fcf2c0506723d2b383de82fe6bb7df7a3180fc
-
Filesize
5.2MB
MD51d59a56bde5e2a47c142fa6cd062b8cf
SHA12ae0fc9f13144a81a8eff8dea2b833fdf3a8cae0
SHA2567b8e91c9c03d4f6c5115192c8766af1f42ec7cd93962698568016ce45fcf6163
SHA5123f3ac401f9c50749aa363e5ae1b8efa27e11931f1ee9be33ddc49d2dc136e1b065c39d2602b12369eda863eab3f039f8b6e7b048c329d4607fac80314ddf58d4
-
Filesize
5.2MB
MD5ac2a2bf9886334b1baa6b0722a9fd844
SHA12119e720c894fffef1a38ade4494431fc232622b
SHA256206389f53d9a4eb47e2ced511c8fbdc6ab4d3db1b1943ddf6bf62a0749bc3c3e
SHA5126b550965dee5eb60ee2970e3a9fc348b8797bc678cac0c9af3046b1912466d9adca452ee2d8c84307976224e15494f1c219cf26d11c3e92ce6c84a3e2c4419e7
-
Filesize
5.2MB
MD59e2f3587d53b561b1f2fa1540863e2d8
SHA1d60adfadb383c35f99dc24c2c80cc1eb1b7dbd31
SHA256d9127a54778539f067404fd13bc2160bbb600d982f85ea43edec7543cad84277
SHA512907797b663f28a470027ce322ea7b6e1cf74c462aa1eaac37bdd52c909a4109a3dfbf282f0d4457e1e2329801edb080aa3d278309fff9545c1eed476c3e3a1e4
-
Filesize
5.2MB
MD545e045e340ab23dae2bf73d08ddf9b16
SHA1d8f8fc71e2ed7e848aeea5f3efbca4c7a0a1960f
SHA256ff00f82c5a2edc7ee2594b920c52b55bfb1d1549b0888c0dd4edcb743e4e7d56
SHA512bcc48fc5b16eeec5d5107185f6060ffb4691615c1d8377a7a8ea0737b07ac9fbe6a6a3aabba067058d9112099d2e30587c8171e4332890cd6ed160538b10e85b
-
Filesize
5.2MB
MD5fd49f47f4034e67cf33fd08d3db7773b
SHA1ee9c41dd8666cd9d36f9c54b4a149375613063f3
SHA256e43559e372499f07e86c243ccc280ab4aaea5935d9d7084eabef007069c25f2b
SHA512ea6ca53569329b862e2237350b755d64d6165205b2a277789ec6f29ccdeef5bf92ac69b2ee63113fd2c2c24262b8b7802d0e3dddb8bc8a2b72a350e4792fdcb0
-
Filesize
5.2MB
MD5771b2afe3beb61c88457a1f7837468c2
SHA1d5ae01b41941280bdbe51d61087adbb1f41ab416
SHA256df7228a516c66f82dd6705610750d6d057c7887dde2572717c0cdbba400c7fc8
SHA51248daccd9debc55f59365085e733cf8e9e61223fc35963370669f84901c65ecaa3c214621306b4a9b2fe9df41a10c40ed02a523dccda86e833780bf5ab1e6516e
-
Filesize
5.2MB
MD50d47ecc9ad61622c2838d836bef1a695
SHA1ad67bebb8188940d0a1644102f212616a115cfda
SHA256fcd7f84c95a95b26eec1ab0d78224a46725965fd77e1232e4c961f1d89a46702
SHA512dd744094fbbfa14a306c7994eb0b53816605eb9d4b7044925b83dae0e857238668fc82b9b2b7bc8f2952400a806313828969683b1690b41e4399e7029436dce2
-
Filesize
5.2MB
MD5532eb89efcf15e21f19863acb334e33c
SHA168fe9e602390a7f145716f21e0c0ed514b6571d4
SHA25682876be339f1278f5c9c45010138d5c27f03e09940c335b50522dc4ba75c6e2d
SHA512a3b65bd8714e6deff55fbcc00013bf088a9ed606ff32562cb3fd9df361ac2d1416a549ba021c8b3ed301ac5931e778311b0a84be49a0fd32c2d1efc9eaf47ca3
-
Filesize
5.2MB
MD5ba70c52bde5ab11cb85ee1a11ddfe717
SHA1468bcc3957c5f5e174ae644b4ad96da04865079c
SHA2563cb79ee7d947dfac55bac739b7a7ffc4de3c087dfb97c4c96c6391371527d5fd
SHA5128fbbced2aee3c45fbef787379fbf0b66c0197c670741553a29b411531c5f1554d3cc29472abaf9427bbf644abd8218c63bf0b6dfba30fb62fdb320ab7da761d7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB