Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-01-2025 11:23
General
-
Target
2025-01-29_045672e26712551ec8e1a82e9f45169d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
7.8MB
-
MD5
045672e26712551ec8e1a82e9f45169d
-
SHA1
2d96e00ccb99d7d4d70feec0999191db8faf8d50
-
SHA256
facbd1463fe98e01ead3f22d9a9ceb194ee55bac5376be9fccbe86082e2f8d64
-
SHA512
bd2b7fd001a9c213d32e9c7339e320a4287720dc6ac01ac84b99a57a01a35be32782599f31c465082ea501ba30b088c44cc45eb70efad18c1b813c7da4bb01c3
-
SSDEEP
98304:bGUjSb/X0Z3y/t2uDN8nsk/39999999999eEN3JjAUtw6MT4nR8CZqXebhnp3aJm:bGUGb/X0Zi/t2uDN8qurYmd08uDU
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 15 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Modifies Internet Explorer start page 1 TTPs 8 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-29_045672e26712551ec8e1a82e9f45169d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-29_045672e26712551ec8e1a82e9f45169d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD54d5ccb3daf88fa1e6db1f0da9a3a3d4b
SHA16be8d3d33512b70872a8c50613fd862951bdc4a8
SHA25601f23c51133e5c9767320d48f6f14aa5071f3a1be14cb02c50a2702b4046c7cc
SHA51216dd7ea59941e0d40d3cb03c8e19be53e0cfe4c68257649a95a6422d4b47d3e9546a5153558bebd2c9364b65b50631e1b28ea0959600224c6b152266c98d5332
-
Filesize
342B
MD556676f22cb5fa52bf5f8afa522b464ae
SHA18b96918aaf45bac0e040d75fbf0957c5cfa8b5fe
SHA25645097b25ecf38c693e8665e6241caf88623abe550e5dc536c541485e887ae37b
SHA512baddccfafde9d071a91817b9f8d21ea3dbb2efc6b0c4a219e6645c1b14480ac3ef8a2295b7bdc81d897cb0e285c7f73552ccb5a680ae5746cb2a976b71316c80
-
Filesize
342B
MD596bf5332cf22316f1286b633a4f5534b
SHA1a9d6939b6502e3e9dfe9571ea8b3db4deb7fda5f
SHA2562bed4f2d0ce7beeb20887cd0069408785682567d7f2c6da84b0c367a2bddadbb
SHA512ac74bf77258de1b3c17cd208173dede2355bdddc7793f79b515ace4e4519193a779de0f26a7bbecc368d119b65dd55a2d34a59177919bc857a8a31c448f2cb7f
-
Filesize
342B
MD5705ef7173ba51006d84915b7fd942255
SHA12ef850c5b5bd6b684daefae7a1ed46b472357b18
SHA256fbc4ad8d89239ce46ff0d5b272c4f3b3ff17a0b1d760a873b14ff62e5aa765b2
SHA512a0686ece6b9fcc36dce93952295816f0a9abefca58583bd680ea66b6755313af28bd66d81b053b975fa63cd4b4a3399f8134e61be477f9d2774355c6df0ed7b3
-
Filesize
342B
MD55029332d53234da5a441ace93860b2f2
SHA1af90a267e6733e98aa47b97385ba261294b4407e
SHA25610aaafa7deaffa1686db85185861915a3ac9f655b4757423aae51e69c4ff5519
SHA5125d6fe095e7b9dc87757085be40e31f84f6498f85a0d6af9cd7d74b0fe348645de2548ac4223cd270089a8a2ac5e9c78610adf217156a36797a1bbc569be78d46
-
Filesize
342B
MD50be7fc219dedbf0d11661dd0a1d2f888
SHA110d6de3c8950c93f6ef76a18d2ce7be5765962cc
SHA25610a19aa8f8d380df43d2be590f18c36c8242b5afc867d9cfb664f0ac5f5d2c1a
SHA512ad04c1383f3358e8ba7d45e8ed91b5c0f648f35aed1cbf3333db5fdcfe92e00263186663f0e8336cd1427dd54cd2c841adb9d297d073dc18ed27b186510d29b6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
26B
MD51935cdab3da6383f98941575f1e8008d
SHA1fa28e3d3a3c72ebf691233fc8fe9f236b08fe8a3
SHA256f1070351b8c0a4c68c56112ccbb8fcad6d3730e2b24df38167f43284372bc438
SHA512a7f03a4e04a8d479c92f96884791b6b3462119c1e2e8a8f99f9d94dacdc3d39853d62755210dbd9f8a416506a08a5e949d5f998c9e02df0b15e3b9d04e7f1e02
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
64KB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
9.7MB