Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 15:49
General
-
Target
2024-12-08_dd47318a1e6598df84bfd3fca5b6d7fa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
dd47318a1e6598df84bfd3fca5b6d7fa
-
SHA1
019e473700cb7b1b9996f52129d9af018556c77c
-
SHA256
39dff7f4ba5e7f8eab4fe78649b7496b0af2859f8dc982fa728ff5001c0fb049
-
SHA512
4b82dd4af676f6af051776375e952b5363d34ab8ed3b1ff3acdf0017d0c53dec168183eacbd5305bce77f633525f951113b24e1b38d8bd7ea89e502c0d16cc81
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBib+56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-08_dd47318a1e6598df84bfd3fca5b6d7fa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-08_dd47318a1e6598df84bfd3fca5b6d7fa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WMCoOyb.exeC:\Windows\System\WMCoOyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oXtKIdW.exeC:\Windows\System\oXtKIdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\afWBZPA.exeC:\Windows\System\afWBZPA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qnIwgDG.exeC:\Windows\System\qnIwgDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IoMxghs.exeC:\Windows\System\IoMxghs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnrzMow.exeC:\Windows\System\VnrzMow.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CvjYktw.exeC:\Windows\System\CvjYktw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WuPjLqG.exeC:\Windows\System\WuPjLqG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NapanPC.exeC:\Windows\System\NapanPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSrbgLw.exeC:\Windows\System\fSrbgLw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UoeQAJM.exeC:\Windows\System\UoeQAJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KAnEtVf.exeC:\Windows\System\KAnEtVf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrXjAxk.exeC:\Windows\System\GrXjAxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIJvVNi.exeC:\Windows\System\RIJvVNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hppnrRk.exeC:\Windows\System\hppnrRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bZxChNS.exeC:\Windows\System\bZxChNS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOZavPP.exeC:\Windows\System\fOZavPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSlLdgu.exeC:\Windows\System\lSlLdgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KukiqSB.exeC:\Windows\System\KukiqSB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUTwjYd.exeC:\Windows\System\mUTwjYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUZmZXB.exeC:\Windows\System\zUZmZXB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56f974dab0ffcfd5f0ee4d740ac62a327
SHA197636a4f6ba52953ec928f19c1189f694649e7d2
SHA25656e28cd8dc652014e59916c4761e2deca5ae430e8c0dd14cac01f177c9123a79
SHA512722fc4fdb2ddad626ed5fa2c8139e999dc288c3b22b5cae2a0a01a864c9ed6159af6c0cc7135438d0b48d724b9b41c72142b76edf049e30126f8531e717e87ff
-
Filesize
5.2MB
MD59ec1d20888d5a69c02262b192e5f32fe
SHA1920b65070684c0f075e4b00d1a17fd12874a1c84
SHA256ec4c942c42b93172f31a9e00e482d65b568ab965ba30f89f9a91f4cc63d11003
SHA51223b221ec5ec02e4cfcbe66625905f46c8fd1705b6fbdb82162cbb21dfc3fdc4faab361e64b7d0857ef41770942ad2f4781fd4ea3ee72fe033f6a956d817fe136
-
Filesize
5.2MB
MD5743c27a16c05a51a58932e34a81e23f5
SHA1e1edfec637f2e8c8661e4bf4084510f8171ab078
SHA256b870bdfad2a82dd928d5cfed86a901d3a3e6d69a322661f090bafec696b718e8
SHA51225fadace880ebcfc6c0694abbf9a8f985e3d1f7246ff59f5fe48fe872202ffd0752397022a25f40c3878381f3c1e1fa1ca65ec6c9ad500966879609d8df79168
-
Filesize
5.2MB
MD59e495968081a0b7b02c909d4072e77f2
SHA1d61ea6d1fb323f4b904437510c0ff1c93bc59eb0
SHA2565337ca6d2ea1de2cfb41493efbb550b2575f6dd51131d15a11925635a2f4edab
SHA512ad68f7920769813eddcf1f2787eb12bec3dbf5fb85e6ea2823ef59d33932ac27def17ddf165f92641e03f65f4daa38bf96bcb635a6f92464bf1b8c10ef497c0e
-
Filesize
5.2MB
MD58b757019c7b7adf89a51724bfdbc4bad
SHA1dba5e4a06eea9f2857563b5ed049f4621d31abd3
SHA2567820a0b305610baae5c2b9ccefa6af8ad4f944c76366607cad49ab4e4515f9cc
SHA512fb09c744df906499d1e742a1bc4f1e644e81a9e6245c6e204c704b4c01bafdc07df5a1c97530ff99493f1bf882b8a825b0054f218803c9ca94060d7345d4d602
-
Filesize
5.2MB
MD5777dd3353fd4def90c8bddac30268495
SHA1b4535e064e4139c75c4a9aa8b999660c1277f3d9
SHA256461db3f829f98b239c005ca65599d7ffa06602d8a713abec68f9ce11e74402f1
SHA5128dbfeedb698f72ff2694ef9c302ee354f6c1f2a71fde50c8182a1f51f647a44b208800a19c490b7720dde441b51aa08cab8d5ef73ae15f5652d13187bacdbbb4
-
Filesize
5.2MB
MD533aa908bbda9129f96e01530d1c12968
SHA1febecb5589e764afe9b5440f5937b48fb11cf618
SHA2561e364582f87335ae00513c2d823b0f0795a092a2505baacae0056922beb77754
SHA512a51012f1fcdb8d6da652bfbba749f920d06a7e5b3c44d3425d2a3a5599317ed1d523b344f1267d0033e15711c0aa1315ca16751e1fb404cc2a0c908cd2997600
-
Filesize
5.2MB
MD5c4bdad204c6074b61361429436482216
SHA1383ad90a0b5dcaac0a50dbe74f86ab00d6166cd6
SHA25632bc4b4201b10a3ab634f0098ee2b95300b625919dd365425f329b000ec3a891
SHA512dd07ee6a16c263c717d91bf6f02e9a6bb0360bb9a8b80a81376d99ed4047f1d3e8460e72097c476e11ab70f333b4c196e40005e0b6727367c09e320cd1a1e650
-
Filesize
5.2MB
MD5f8d2e44491b56fd8a656113bc5f548d2
SHA1dcdc6b4affa5a47b3c87a81340a2a924442059d0
SHA256f89ace55f86e0e75d4c15251fa6e7b0339ee131832fb8836fb3f59b410550520
SHA512419947e7b461d96d3ad74d3ebcea76653c9b96c2c90cd9cab838cd4a1b142f1e85c195ecb133b11ff40af162f700612128bd4a3cef49e691e8d8a2d66d35146c
-
Filesize
5.2MB
MD5d83ac186fbfb063a11d3f81740e125fa
SHA1595b888675ca377c9702b4dadd8a2475979344bb
SHA256367fd49f132293ad5fe557dc6dd99ba6f6d4f33ae3ab362656dcfc31685cb186
SHA51252f03d9fecaa6dd8a9f44507419e142228a8b28daf110106c45cddef511c3094087dc30c774f0facc6b9ace68d1ef2b4939f4b7410e027fd9f2d495c4289cb70
-
Filesize
5.2MB
MD515a7297f5168505308cc22462c5eacd8
SHA14251280c878ab0e6502e94d91aa444d092f1765c
SHA256b45e2b7201e1712356b0069e740bd81f3bc30d30f748cd4e8c677ec868c37763
SHA5127117986433cb83ac4e2d1ad941fb9c8ecda8cc0ef8c8d46f18c17edb3651069dedd72f36e38fa698c7516c197675b807dfda246aa21660d29d3afbe254ca7eea
-
Filesize
5.2MB
MD56fab3e9d7935dd146d290c471b20c4a5
SHA1f5511c30425fbad8e29ae823d92983861936ae91
SHA25642e6a3c232723e09315e8ccbb289776dcfc44ad0189bd43a786a3ccaecbc7bb0
SHA51265e9976f6756a58d93654eb7d94c8134b857eb3f3d4c23c6c5347ebc756d8abc512db88c7844cf8197508ee41cd563316ec9673a9f030f8876ac64068c2f81e4
-
Filesize
5.2MB
MD59a4adedb837871898177b150c4feddc8
SHA1d8f070fb4995da7cb25f37eb993e36abaf4b9793
SHA256b410f19171c84d938ac243f2541033d1f4d57ec8b5006f0f67a4253ae43f4f00
SHA512e3b9556ca4358c0cd9bf888569e314ea4fd9001e3a9dd29a8e89870103295a93fa692fd9c49edcedc609cd2ad9e0563467d5554ef8a5e89033952f0536120cfa
-
Filesize
5.2MB
MD5b29cb0c15fab0d96e9a39518547a0322
SHA1b03d5bd0b84d5d01cdb08379c95486a1ee45a9da
SHA25688eae6ebadcb6249810d123c38fa1a0040caece7984da69c0c85f3ca65df521f
SHA512f9508d378e5e13df697b720f337f365e0d6ece55bae57ae503e76e48d1b0e044b5ac894edd3bbb15ac1f3288d20b7a94ba70846d2eb52d0c1e94166c0b0aed53
-
Filesize
5.2MB
MD5995fca4a131750871bd08061f0fa0542
SHA1739811bf4ddd99a0ef81642462e4e0260be440d2
SHA256f316ad40bde91cc36ebc10c18851872d04056dff83e5365fef4d05d1760f6435
SHA512cbfd6bb5b3b108dbca97aec60b3949256113a7dbd5d1f98a34c60817ca7f0ea5515f35e7d9805fff6bc0fb045479104c02fbae1a2cc48230f710741f2da69a4e
-
Filesize
5.2MB
MD5b1f45ed5273bd3c8c6c4dd1d5d6fb89d
SHA117a0bd0abef648b26e574ed839aee3cea2b0c8e3
SHA25664898757fce5d92472a8a4392fc019336750ce74a2a0dffe327b769dcf648381
SHA5122a985407d937c74285bed6f733b5758dd425d6c1b8fc619b1e75e87b5a74f962b2ca3f3bb427c9406c01aa2f930d2bc8a420230abee2faef5ba78af20e4f94be
-
Filesize
5.2MB
MD5900039a8ac3707b83a72a4260a8113de
SHA172491b41e95c73f920ca1d29203df181376b6b78
SHA25666e38f75b7605220f5dd79dd8cef8a26bad678ffff1c9c2c4aa34cb9387b2aa2
SHA5122b294ba19e04747917e796cc738d0a6f4ed7edc8083210adfb046a3b0071c189f6f2125b2d46d78a516e673e4c93d9605dde04b995fb611d253d7942f9ed56c2
-
Filesize
5.2MB
MD5a243d6824496cb4603516adb7dcd52e2
SHA12145807b3dc0b4d49e63e3ef9c048892202e0735
SHA256fc56ed1d7bb074176df6d7905ec784981e9fb13f25cb8098a8b64f7144d1361b
SHA51208c78429bac35f6e4242700ae1302c0294b9241dd274aaed9982d39060f3bea7f5817afb366a1e8184c1fa6e6cad233fbe6382e20f1a2322d6bcea9da1df6284
-
Filesize
5.2MB
MD5dc09f255ae2318f34ecec202bd928bd7
SHA194df8fa3273c3bbdbb2b5a238c9bd529c003d950
SHA256b1b9cd5a36c7ac2c06bedde60bd58cae57125c1e3679aa445c9f19a822cda8c5
SHA512485b775ea01a385cdccaeecf20d02847ede8b58d19042a145aa8ed519498c641fbafc5042aeb7db66ea2011ed8a5fcf17b041998feb02759c136cbf55b5c8459
-
Filesize
5.2MB
MD598c838bbf1cd370fcb7e11b92e58c17e
SHA126884ea77c49414bcaef6211f7c54aa3958e40f8
SHA256e7e4afe5f2e58b657e8470e6a270f6e6eec2c0ee953dff26867297640a3cf445
SHA51296d85ed8abafbcf6c00791ba21a22daf879f8ce9965931273dfb120c675539c1b1dac46a83b959a92dba7a914bbed199f1b6a06b521dad677ecfbc7858d9f70b
-
Filesize
5.2MB
MD5b62d5755ba28db0fd66513bf07a2c8d9
SHA169389f92f1c97da0df8808277fa05c3884113e07
SHA256aa26b79d85b174dd3ad5f804aef4fcf983f86237ba9afcc50b8d2bcb47991ad8
SHA51227fe322657c12db3c037b6135bfc8fd45c2b21e6dba346b96229a7e40b323d6eef1e1b4db9310f719d20a1171621c5b42fc235b9119efe68c64d8b7a1f16f5d4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB