Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-12-2024 02:46
General
-
Target
2024-12-10_8546c1ad5f416a817e69a0ae6cfb0f0e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8546c1ad5f416a817e69a0ae6cfb0f0e
-
SHA1
7352327f0cdc858eac5cd965e11f9086ffadc7f7
-
SHA256
64aeea6446689c574d67693cfc3fc12d5e8daf08e09f9986cf2ba0aa6423b6c8
-
SHA512
423728ded30ce690b8a8c874ef865f2af0e42f266ec6762ce40d18e673ccec53a076364df35fa29703276a137a15db333a45329bb1d7505706d75b1eac1b094d
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibd56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-10_8546c1ad5f416a817e69a0ae6cfb0f0e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-10_8546c1ad5f416a817e69a0ae6cfb0f0e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TfFEbMw.exeC:\Windows\System\TfFEbMw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AFwDQcq.exeC:\Windows\System\AFwDQcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjlacnM.exeC:\Windows\System\DjlacnM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XgduDSM.exeC:\Windows\System\XgduDSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkSzcJy.exeC:\Windows\System\JkSzcJy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEBsdRg.exeC:\Windows\System\vEBsdRg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TWjrjBp.exeC:\Windows\System\TWjrjBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bizpSQL.exeC:\Windows\System\bizpSQL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJfSNzg.exeC:\Windows\System\hJfSNzg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VBwdnWP.exeC:\Windows\System\VBwdnWP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UxBEhuq.exeC:\Windows\System\UxBEhuq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUiJmRV.exeC:\Windows\System\pUiJmRV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkdHeBJ.exeC:\Windows\System\KkdHeBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SsCZZsw.exeC:\Windows\System\SsCZZsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsPQiYQ.exeC:\Windows\System\IsPQiYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HsJIZhu.exeC:\Windows\System\HsJIZhu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnMgvAM.exeC:\Windows\System\lnMgvAM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pftIPNo.exeC:\Windows\System\pftIPNo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SArtgEN.exeC:\Windows\System\SArtgEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QeWFHVC.exeC:\Windows\System\QeWFHVC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XtcKTQw.exeC:\Windows\System\XtcKTQw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51ed7846b4c188063d5a16270871217fd
SHA174c998220e8eadbd6af85e2ebe05066cbeda5d88
SHA256ea349885d829618ae966cad2c06a0459b6e019c2f591a156abf1fc0a9c9709bf
SHA512bc9fa543568de1a35bf75cefb05aea54e40f7774d5fe0a7b4ba64a9f17b47204e088979c75ef72bc86d18c4a99b291c26d348ec314504b84f51d6158e3839b76
-
Filesize
5.2MB
MD5448037946fda539c476c0629ee73ded9
SHA195761c76ba74738ec6017fdee3cae93f69d9217d
SHA256dafd0756d567eb0f3a6d72c6a1ce7a3fcc170b682da3a4ae15ad1fc20fdc854a
SHA5123d289f8761645440d3b239294f40a9de8f812b13bdbb2c9e4cb27e8d1466bcdde061fc916e6598d69a83e596fb8a9375b0da9c9a8580562674a27f22866b1b13
-
Filesize
5.2MB
MD5890b930928fb50dee6e797aa8be2038b
SHA1d661b2f87ce9151797c82a0aa40c60ddf90479ef
SHA2567b9e472a3191e29523695042998ccaca4877d8bba111d431582ee6145caf4a03
SHA5127435c8db4e741172f49c5a2aa7bc6427078429321b120249557229ebb862467a6e022db9fb7c64c674ee9ff803b8d1fa4d82e1e8c1d076ea4ddeb4683466949b
-
Filesize
5.2MB
MD5d1b9d8823c9808d8344cb61a4abd1097
SHA1407f2b3eb9a664abf704e1406c7903c460f74ad0
SHA256f856772496b0d6c35018209bb60dba0252a4ee1c6b0d66f0ccf2e4879fe6f871
SHA512cba144b564b46d917c8bef48886275d9d265ce29124fdd5b7c536039930ec1e756905a02b33c158f5165451e935ce45d5b8826df6663ca425220f187fedb59bc
-
Filesize
5.2MB
MD5a6e23363f2a868401ab3522acb844955
SHA12acba9e35ba69af52ed229b150ddf55cc28b98fd
SHA2560617539d1c15e64562f6dab5df0833d6d829ee91d7ad0d9941eaf44bc4d2914e
SHA512065361ed9fcfa49e4e6789f455a0c0dd95d1f04cf59861a5dcbbdb4bca29d404ce59371c04307816eaa0b4e29438ac729a80feeaa9d59e8541bf097c2968434b
-
Filesize
5.2MB
MD581848e43aabb181f7a7181eb4d504129
SHA1f6be91f7371eb14ba32dbca826febbca8ec26098
SHA256a8baa951c30d4203b350c1af60e1dccff6f8316db6db723b2ecd43cf67e488a8
SHA51275a83996511ee618631e0400c5595457d20a19f12ddab40806637deb6d0044363e833ec76fdbb8e994bc39c7058fb78df342a20dae899be520f6a11f53bced29
-
Filesize
5.2MB
MD5611800a083c55a8b2ac9bc47fdc19941
SHA175a1da257609d9ab868f8a6fda61ac0ec249c083
SHA256f38e673b334b980d10fd2fd8c69ebba2b86879e6fa6859abbc7691a433926eb1
SHA512fab9e86111cd5c8a05c672899cf92a55ac7246b87f4455a52c0b9b632b335a57631d30df454269554856eed51bc6503b1102bbda43832a67a245fb2898e7e6c2
-
Filesize
5.2MB
MD599092113105245891e611e4b29be9bba
SHA1f3b794accbb110ebadecc096f763a0bf5609e617
SHA256e5bf2fbc8d6e1d8d58f0337292f2ae0c9c351d6b24f132b3eeecd6b42a7306fc
SHA512b59c2ad5770bdd6298a5be485201009fa78b91cf72aad5f5e81e24ccd55b19db2006b70baec965012b965b3b3b36c818b7a3daf6af4dd1700ceb1de7ba21095b
-
Filesize
5.2MB
MD5f84f34633fc662a7e0d5a155cf52c540
SHA11a49eafe83688e980a5164d9ca09cfa32d6c9e59
SHA256b348e64592188ee98420652ea10eda4839c5c913b8e4b59947aa50df7add981c
SHA512bd8900f3728c78bacbd2f605ec908b9cd59dde4ce7fa31b4e2aaadacd4c0a93704e6eb2a2c2254a8dbc4ed11a39ee7f3aa40776d691d2a64061f475ff776e22a
-
Filesize
5.2MB
MD527b747c98d8859f6523d00d512cd37a7
SHA1c3561b168bba7ffc3fb6b4ea9bc2d15a23a7c5b9
SHA256af7a2cf8e14628346527f0f47526e053320fb487441b2a31023c7da81cb7a451
SHA512ebf853f7711a26caa4d8613859581711b6bb2f5b652b8893b164ec149a5339442ad94c848a3788af87bd2024032c75e38d7ec5fa8d81c8e7c1362bdb40b3ccc2
-
Filesize
5.2MB
MD5ae24e32c3f262535e50a6caf1b289886
SHA1db9f1ce4d5f525c0723ec98cb76afdc05ef8233f
SHA25675917d74989a688c28f394e2e07358117647bd3a9b706e4da79d8e5f217fdc99
SHA512f9b9fd4ebf3f6331dc2e7e80c8c2fee2b91ab109057b4cf35e8fb348361ba50cae0e30732620cada71778313b98cbf1c58dc2d6973a9ebb5a8df9ccf4158987e
-
Filesize
5.2MB
MD57c9926074372e209363e7d25527ed9a8
SHA1484bb7c4053ed9767ace3cd86c7d5e1a4f857bd0
SHA25615864b6901a323ac3fbf536705ce7fde67f17d7ccdae0c5de15d7989ac238595
SHA51295bc7bf24a1c108258bc7a56c2d230bc6c4f56bb5d155e63dd5047420667e9e141b5c7a3d7c8dadeb5f05165dcf518a7cef99c43b0ea60e7be4bb1d9687ba4ee
-
Filesize
5.2MB
MD56c3443351227bf1e3e6c46c269ac64c4
SHA10b8098d91a0befc164cb36ccfd87ffb45be843f0
SHA2569339162e6313d69fe1bad1a9fc89f408293a38bbad323e5fb227efc79cfa2169
SHA5122deb55193c5d0bf03c8d57709c0e366face4713d1fc212de6d538113e36ee9f069bcb15177cb9d9e8f77cd1513993f3bf9212d64fd5daae617fa28b22a9d79e6
-
Filesize
5.2MB
MD56febdbfadb2842d8d3b7a4eab7892f63
SHA1f46beaeaf07a06ba34a3ffbdc307212a6248b00e
SHA256abe7b843e5a316a66c357d90e164df5735ca69d5c899cf39fcc32253e54939bd
SHA512a276c0efcad3d7e9c7440a19fc81f6f270c23ba15976ea7c03ae77391588546a126189b1014336e8b875bf519ebdfde5c0235081e0aa9cd73112d0257a73e53a
-
Filesize
5.2MB
MD57be018f838ca7f82be7ce737a994a6ee
SHA16596b12b82140adfc1cf40bda247f54e28677f06
SHA256de808107aa03e0b81862d461873851c7b56c3bfe144ed13b54e5629862b1fd50
SHA5123db01831e3ff1c809844c3da159f6aadc7a375e190d4e2f765db3623c35424c6bbcec9fc95fb26295a187b2c1921a1b4a7ad4cf7d4e21a8656803b79e46dbf2b
-
Filesize
5.2MB
MD544d6f7eb0caa4fd00114ff0a9a1a404d
SHA13e05faedf72b46cba6353c728d239e20ccf82ab2
SHA256e01acf8ea68198ab49bd8ed80886973ebfaf4c66976e5dd94292701b5ee0db52
SHA51231403e9dcf1fe7e4c2e414da64a15dbc5c19fe516ab40400094a97297c700fd2c888e6186be23dbc98104242cd06d816d7f536c71d32e3e00109d1bc5d160adf
-
Filesize
5.2MB
MD560abec0f4ea81945e3a8246730c4a377
SHA1be53f826253d219cd4166a5100eaee348f44c69f
SHA256bfb573bf26bfd5dd90e42d9b3d4c5a6408c3912138ebae796d7be2f0164ad1b7
SHA512d7b26555b90d2b4bc41bd547ec3389a082a60fd7a861086d60ed7e074c13b21afe819e24e96f0feb994444e9912206dfb25595bc0be9efa2d8737540ddb79b0f
-
Filesize
5.2MB
MD5e32fa9a5067cb3fdfc9da14b1abbbd8a
SHA1bd28d73a408288d029aedcbded84ce97cf38956a
SHA2561cf9b70523527ce0dee4afbd98c6d43614c6d78c5be195220c0560a81b96e630
SHA512779623d15f30962a94efd9c63ea428e46c39b3273e0b7e90b3f037033b2d6603b4ae73d008b9ae3122a5a1968acd5c35fbefef26b136dbf3466efa7ac8e9d1dc
-
Filesize
5.2MB
MD53c23ada8add8e48cdfa0ef6fad0f67c2
SHA105cd4853f0b92f0ed37b31d7eb9e88d5a6cf58db
SHA2566562d3d3311a46c405c0d3b7c731672330da267394ae14071cdae696e8b7dfc6
SHA5126fe46d147edde8d511a176a0759563305a262249a3f342e2922f5d27d51f67a286224aedf3157582da892f20ccf8f95bef546004cdb08a730d97b049cb613425
-
Filesize
5.2MB
MD5b2fac716b70aac1112c924e398ae3dde
SHA10ced1264fd4c9fd7154fdae0a74350d568a347e8
SHA25651dd56d319c0ea60c20fd9e44168a67a89e64f05315adae10d788351a8e9093c
SHA512c1aef88095f14aae1651b324ab48886b3dc5b83bf6c4c746bde440162ce5d1c6b3573c40f607d02bc8f85cb8927e8b0e416ba2770003397b10c4b2d88d3c79ba
-
Filesize
5.2MB
MD5c9c2cd5d2fa8b8573c3940fe8d1df1ed
SHA1c950cc66205e1fe81d0a6d91845d323b3e17f8ec
SHA25628ba79db9d619bb3c562d458bb4b8bfc00a30aeb8f309bf912f62df3e655213d
SHA5121e2678981c808d32b97417151abcb28358326106722d436bfeb11addfa8ecfbde30d699ecbf51160cc641c0efceeb4e92f0b4c40ff700996a4fd797189bf1df2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB