Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 15:48
General
-
Target
2024-12-08_a7f11c3995cb30b7d24dcb9d4c6d47fb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a7f11c3995cb30b7d24dcb9d4c6d47fb
-
SHA1
a2d092207d27623541b4c0adc8df821cc1a47b6a
-
SHA256
7575b669140f2ded4a48aba683bd19b02f797625a9c31f6a20877aaa2a359d95
-
SHA512
f85a36da422d827f98b19e4096d93249e9129c7e8f25a3235789a8c9739eed8c2f67c866571c61bc26515f720ead8f411a2ded829be5535275a9782e97192aef
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBib+56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-08_a7f11c3995cb30b7d24dcb9d4c6d47fb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-08_a7f11c3995cb30b7d24dcb9d4c6d47fb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IXRPIIs.exeC:\Windows\System\IXRPIIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BFQorhy.exeC:\Windows\System\BFQorhy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Kgjtlcw.exeC:\Windows\System\Kgjtlcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YdAxYXy.exeC:\Windows\System\YdAxYXy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qMfhtid.exeC:\Windows\System\qMfhtid.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cRVBEMN.exeC:\Windows\System\cRVBEMN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\opVVNEY.exeC:\Windows\System\opVVNEY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpStJIY.exeC:\Windows\System\BpStJIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nokZOxv.exeC:\Windows\System\nokZOxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUVqeta.exeC:\Windows\System\tUVqeta.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lyEnslX.exeC:\Windows\System\lyEnslX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVKOyXu.exeC:\Windows\System\hVKOyXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTHPfSA.exeC:\Windows\System\pTHPfSA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCmKVad.exeC:\Windows\System\PCmKVad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mojJpwb.exeC:\Windows\System\mojJpwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNycQnT.exeC:\Windows\System\dNycQnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddqMlgh.exeC:\Windows\System\ddqMlgh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBxFKpm.exeC:\Windows\System\qBxFKpm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjEOved.exeC:\Windows\System\DjEOved.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNUVJWL.exeC:\Windows\System\sNUVJWL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RSfrNAl.exeC:\Windows\System\RSfrNAl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e6f905db2c690d8d33038902710c638b
SHA13d8e6728b9b47d9a69a6f80e27fb95521b3da4b0
SHA2565431e83be2e2bf8f13404b65408b12b5c65500e480746f641df6049724bbc4d9
SHA5123973640c81c71057170f4419c2f8bf6afcbb6a2753290f1e1ba6b74750f1848afa84faa6aed458bf57f23d561f53bc3be801ecdff941f088764f0b81e25bb783
-
Filesize
5.2MB
MD5828e284ef47b33a35574da2b99237202
SHA1fa2ccc449db3384afe5bca640119e39683c384ec
SHA256dcd2f514704e43610a1c1f498b39fedf7ce627dee3bf67c10f61a4e847563027
SHA512b1e5f66041b830b8d8215b8790fa502be0830817a22a38655807635f8b44b5618e2bac8fe308fef5bbe0d7659e61c88d5645a67fb85f03669d9bd173500aaf68
-
Filesize
5.2MB
MD5c312cfda0a271ea7e06c31370a6675a2
SHA1436dfee1600e243ae2543a7eb881c67811f8559c
SHA2566626e0b65309291e0fcb5659504fb32f0fe74250f0f6dbf9904dab6175f0b8c8
SHA51209f626bb51b97b595e0942ffaec8cbd98025b2ef55495550b72a35fa32157884b7272beab3a8981e71b30ef52113d3b249ac5ceda55ce03f52b8e6c2a113d960
-
Filesize
5.2MB
MD5e07886a91e17bb98575f4688a87f306f
SHA1cfe808162abc62e0e4753ed574af52347584d5a9
SHA2567564f06541138346ff4b69c4c63ee9e573f86e974da19c36ec90d3b7d89c56e4
SHA5128b3f7e5ec6ec7a604fb760b4c6c7393dedb34c2958bd52186d5ba4cac63ff69c5d9dcb486cb010c17197a7f4c9e482488cb224e5ef69c1b36e95bd1c052379fb
-
Filesize
5.2MB
MD5906d50536c8e81361e0efdf036b5a5e0
SHA15d35d50d90eb5272a013a026f50abdd6fb650177
SHA256266a2e1def34d2857c577429676fb93246b94cb93479e7ef26c8fde9a19b4567
SHA512951f25113e4e63e731fe6568a9ff1adba49c3994c2d2d62d049f36b124f770a19181fc30389bea1a5c0b04cc1f18eab0532dc348360459e90d57cf5c5364e88b
-
Filesize
5.2MB
MD50a2a068ad4cb6ff7eec6835cca3f85d8
SHA14a022a2f36c4b85b98b3260ea0f92cf3b543e0ac
SHA25609e348f19af4494c0a9f71fa3cb144da6b20286826321e37d57ec336d2e3c273
SHA512cdf10107da5c67e29d14ed39f17d20b716e5379312f4835abcb4adc829cde001462b67b9f4e290c524452d9098137f305c5c17341fc7789dca7d22dffed9f2c9
-
Filesize
5.2MB
MD538f8fc6c3d073ed423411853570c1730
SHA15f41d3e5d5ae67c6bd20fd8aa81a6c06efd521cb
SHA25682396abc762afd2cc00ea8b65aa631551df4ac418ad780760f626b6bb44a55cc
SHA5120f513bf9eef00ad5e1293b6ca39fbb370d659f130ef3833373fc8681c0d17e31ae103f5f2b47214cb0e329b30ffc9d93933e0d2b70db338402f90724eb740139
-
Filesize
5.2MB
MD546561f5ef25dc97f4d0495e18cf2408c
SHA1f52436bb03d939bd5c1a7bb0d47197871d5d2142
SHA256b3a61335e76ff9b3bcd134fd4d1e1c9b449316934d00cf63ba3d6a5ca7ea7161
SHA5127aeebf32852f6724b59563ad7032fbc1a3df8764eda7d3a258bae33e8f32098a97ba9033ab6439ad23f5e0cab6e21b9af13e3a37c93b09f01dc569c16de71f40
-
Filesize
5.2MB
MD515ee15927d4c1b8b8e6c10e87e8d20a4
SHA11fb69a98ad852ae45ff45b1df6040ede6917faeb
SHA256ad0909bff15276788f25b41178abd641a06fb09d01d1a18806d620ae4077cd5e
SHA512c58ca7f244054b7c83bf70fc86a751a1a9f5b0df2cc718c0755cb606bbdffdc1e1d06c05ee79e714ed3e08c75ca070e40bdb6571b45d0a51f79a3062a9e9822c
-
Filesize
5.2MB
MD52025213afb78693c8693cb5db31dddb6
SHA19698d2d7b00cfcc810c3e658885b75e4502949f4
SHA25612ff84709e510c9f8d1a74720df30cbf785d47b620c2e8dce183758cc8072549
SHA5128740ea6feee4271dcb039d56ded1460be4ec0832dc5d368f71ff946484cb993a709f051939325e55562ef7fe72d1d6462781cc61cf58577eff96861af61e21eb
-
Filesize
5.2MB
MD54c99e2c393f525cf27089fc0ba9be7ae
SHA167feb5bcc4e611b36012705f784dea2701344c75
SHA25648cfbf0e9e8cefbcdbc33135885e633a67b356186fa895b20d25f3327fbd414f
SHA512e81dba5bb4c812339e5d33200044fd5653186d7b2db07aee14ebcbdaf94e7ff36cee100ed99dc37f79feb86d1016d0916a1fa139071a9da1be416b4e762a52e2
-
Filesize
5.2MB
MD50d4e596303c08a493d333ed2a4fd13e0
SHA17562e7617b57910ce4dd20bb86181de8a99f7d5f
SHA256016a305d192a6734c834528e961254ec33ea163ea410a6a84f8df4c31008bdff
SHA512f58f952c07c1acf094355a9b960f412f45479c0f4081ebb56e7db95583f71f84a66a7172cc0641dd50868dabe823c455722251fb71278f673750274bde79da31
-
Filesize
5.2MB
MD57660cb2b8bdca5fae2f1a1513ecd7aeb
SHA1aeee0d1f1f2cf4bbd3f79ab215bf3c2fccf89186
SHA256095e6d5a3270a96d77f986286c5836a09a439a619bc542ec030a5de653c638af
SHA5129c0b570d37d2b0ee82e7eadeb301bb277d72fcc569c4becad7ef80d9ed9e463c1c922bad1cea354305af32c9c81f3f88be415174ff13cf9e058fa33a54ca7564
-
Filesize
5.2MB
MD51fa8b72d266dd9f8058657f6f868d631
SHA126e2df2061832e11bbd9ea3173704277cc6f2cb7
SHA256422a1fc3bdd99b2df47ed4d360f59049ca56f027986d9c7fcb21c9063c0fc5c1
SHA512395ceeb92aef18c8bbb6c599634362b4a37bd42aa2834a53175ca96f1386fb6950148e1ff2be71b7a7494a63bc73f3cbc549e5bfbc3bb43f0b29747d704a9a2b
-
Filesize
5.2MB
MD557f28e57f89e081119f142224e3e7a60
SHA193b6bd94bf7b4bc1bacb64c40dda5eea997740c2
SHA2560fb555a71feabab12e0fb997dc17167f09f853ce39a273edef4f320fee7dae61
SHA512321332f8a26ec402a16bb83b249dbc0ea5a14b342841158d866f4eaa1782e7f6ea3e122237691cda7f80dc5e1de01c99e92515ce16ede3bba05ee0dc160fdd74
-
Filesize
5.2MB
MD5a3ed7afd4b96c7238c0934d7d0bd8bb1
SHA1115afb64491ca20f7cff8083564b6db46beada1a
SHA256e0e3d1c5ed0659b391c7129b618c6ef4ea6ce66c3fb0fe014eb8137363a09ed4
SHA512acf57eb71461a29392efa2da6c14bd8c2a082f93dc43e9019500ba42f563914e42dba76c48626845b4a4929f84950ca87bac93ec5161fd4b39916ccfd56abc2e
-
Filesize
5.2MB
MD552e7f00e45497bbb549332ad6cce8da1
SHA14c3e8d8cff677706f592cdbfeb77bb93c5ea19ef
SHA256c43091c5cc9fe5ab0efb4e8e7a17e05d41fbcd335967015c206145a92551b3d6
SHA512b6863425e6dbe79dc93ccc07b940a904c2c5b8e6fc4bcf22ba74397a1d19912b7883dd71015e7493f5abb1e2665b5cc31054bdd6b096e767b524f475279a6077
-
Filesize
5.2MB
MD53672912884781521063853a975cd9c2d
SHA1bffe3fa7822b459cc07bbd6522e3dc4ccf5d307b
SHA2560a6c059f1227a1d353ad99f071e1743824fd9bda5c3eafd98de2d0fccda18e89
SHA512ad9ab58aa6c275449f89d9ccaf13cd3b650d546b75d2a4c9ee6a41da316c63e735d62c2443e20435621c49f31708df930cb761cd1cf62710d7fe418c680572d4
-
Filesize
5.2MB
MD5e1fe7cd8a7b650eda9fc3372e377d70f
SHA1b599615f55d03a9a299fec5f41faf9943775191d
SHA2563b7b2b755f1b94951e4154ba3424e8d3fadc0bd5af75b4339637a803c58767f7
SHA512e7e184eef9718b6cdd8359a4140ca9878cdcdcd839af5189fc473af097b281cfd035558d691e2de83c00f9c9aa8a433a9ba9ef0e5769b62fbd80ac4d44f359ae
-
Filesize
5.2MB
MD572071cf229e2d1f8d07c6d4530cd88f0
SHA197d6f581603dddca66fd7d31e24089ad0fbc48ea
SHA256b692eb4fc19ccd0766cf8d35e60a59acd6e4fdb57e394f5e96273f11ecec9893
SHA512409cc9b42f0888654b62922f9cbd1846dba7e2f5b105b02a04b6180d6b8780498b7be92c99ce6fe7408a2333c45e4ce4551d9fde7529056c4621675db176efbb
-
Filesize
5.2MB
MD5a0dcc2c9cce77331141cc73b200b30ad
SHA11138ef6cfa1d24179ef51bca998fff3d47019b9b
SHA2568c12d5355710434f6a92489090f6045b03c68943bb54fc899ff2ea16b445d570
SHA512e73889630c514cf5d9141968686082e400fb0615bbb639bcd3dbda865575e02d0c6099df88aea118ef386222eccf5bf4939987c7f647b9eca76b62b8e75fbe47
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB