Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 11:51
General
-
Target
2024-12-12_873fe2aa4976c6f077b7831b76dddd74_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
873fe2aa4976c6f077b7831b76dddd74
-
SHA1
0926501ffdd509d6d03fd9cc0b53d327806fda28
-
SHA256
f0434f1a58dd1d4d6202f0358a0710d373a4408bf56837e0815c332967c99543
-
SHA512
a2fa302f891de7de317c6149fc919ffbc1c60b56327a26d73e6b677e947b9b88d03df7ae84e14a51c9a95f200b0be5bb73e9321c3a3458e68ff2d8e45a79c6fe
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibd56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_873fe2aa4976c6f077b7831b76dddd74_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_873fe2aa4976c6f077b7831b76dddd74_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tXszmAm.exeC:\Windows\System\tXszmAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pooxHdF.exeC:\Windows\System\pooxHdF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hdhuUHs.exeC:\Windows\System\hdhuUHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\suMKlTl.exeC:\Windows\System\suMKlTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHsHobd.exeC:\Windows\System\zHsHobd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\seOgwus.exeC:\Windows\System\seOgwus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\feToxSU.exeC:\Windows\System\feToxSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgCYSyn.exeC:\Windows\System\GgCYSyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qNKHuJO.exeC:\Windows\System\qNKHuJO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KvUCXNs.exeC:\Windows\System\KvUCXNs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLZJyYn.exeC:\Windows\System\GLZJyYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsvhTyD.exeC:\Windows\System\dsvhTyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BARhpgr.exeC:\Windows\System\BARhpgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VjLBwbW.exeC:\Windows\System\VjLBwbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VoHYCoB.exeC:\Windows\System\VoHYCoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HfCBAPr.exeC:\Windows\System\HfCBAPr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yWMUvzi.exeC:\Windows\System\yWMUvzi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKiOFfo.exeC:\Windows\System\wKiOFfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxHjmtl.exeC:\Windows\System\PxHjmtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAgrkJx.exeC:\Windows\System\nAgrkJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igmdCFE.exeC:\Windows\System\igmdCFE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f3b251916729bf2749bb6888385f08a1
SHA1264c657f6f8aa7c4f48aa6422c43e9a10652187b
SHA2565ef39fffabbc9ab09f45d20411caaef309d20997482b9161159c2d78b67c67f5
SHA5126dcc89ab4bdf61079b1aaa16dd1f5ef686fd5dae360bc48505ba215809b2ccbe9c2ac93f05a6669066f0d29a90864dc10dfee293cdff4b7b57820c137915266e
-
Filesize
5.2MB
MD56a0c9860c641bcbccf0df0be467474bf
SHA1080b52dc623972e6b0de5b28400dd1819459d422
SHA256113dac5bb9a3329366a0850d65be62c75b9a541bae2d83a6f4d24bfc7b9cc782
SHA51276f250b5bfb68aa9d8434cbc759ba4e6402637c4723e629f2c95510de0d667885d277181cbb9d27072b66a8af34db04bcd40d5b90310b14e0e631e5370cc93a6
-
Filesize
5.2MB
MD5d23c32a06eac98a17007647acaa380cf
SHA1c2362361cd7d20ad0d043a75073874fa43c1a9a6
SHA25612f8c4ba8eb5083f4238ce5123f0dd4ffa7ba361f7831740a2d636cd795e9f86
SHA5126233f9f6c35b255a6bab5875a3ca9bfeefc8e735ba0ea5b4c4e1bd110cd2d7c81ace755668c5483cdc6a246973fb683c9e87b19e6a2f3c53c68a21973debe7f5
-
Filesize
5.2MB
MD580616ee1085ed7fb6d17e8ced370206d
SHA1ee80bfb86f02437dcacdbf0aa0b1dd1523a6a1b5
SHA2568033ff272b1dffcb7fd03fd0a57fb4d56d988ba3afa0d71e15cc9e92f52888b1
SHA5125cb2a9a0c2a10533cf2ee7707ddefc23746a619072378bcb7ef78a1c9d922b7ea208a06aea6c1ea738de25704e939d9067ed9db788e4f8c4061a2a4087a516bf
-
Filesize
5.2MB
MD5ac41c7114e5e9b17a5b969c09f4afb6c
SHA194d4985d72491af905981afee0167b01a3537287
SHA256a9e32675d392eb2c4aa13858d1030f29dcc992b4fd6515e3a9dcbebbeef1eb81
SHA512d3cb78506f44bb186c873262e1f800d706f432154fa32a50a0fd68cbf81279f1c4c23bfdfc2d9d394eeeb8800115beef91eaabab86829547091f5e2092ce3be7
-
Filesize
5.2MB
MD52593fd2fd3e55581c9900539b88cd8fc
SHA19fe6ec3bf2665ca9e63b0ca7be0d2a3cf4eb0675
SHA256cba8e9ac66696b83cb5e6436e216747f2b92394799e07805b99f003ce0c9a848
SHA512f1fb056a3e6c17e9d75595f121c4a18601a0e31f1f68704f4491878c317c01e9594dbb815bd9b645c73e79e4cc75be4a69ee39759f244b6d45cd3625e359f63f
-
Filesize
5.2MB
MD546a5fa1b9262059789238a4cc651cf81
SHA1b9646b6df5179a76afea6c064a3f4fc608ea8f2f
SHA256cac12fc9cdc2a95c4b670c30343ccb849d209189a7246f8737f8760d2697eb94
SHA51273579ad035135cb1060d56b29fab71ae60ab514af7500ebb888f1f514833ba344fb4c4ac96deb703a7f9464e5814a0d77040fed6fde4ce0ec8bf44c380bc1cfc
-
Filesize
5.2MB
MD574cf277c6255b44ce2f68dc3ddbcc187
SHA16aaf08c8f4d8e0b061b9f6b79a5928e198308cb6
SHA2561d8a06073e1b5b93bf649290eb9e3a19f635fb501be5647566be953af4cb9d42
SHA51201e0589122c019a0f9724ed8743d194f09ec4544fd05c0260c9dec74efceb767b0095d111d2ff4b118789fd643b76861a9140eb055eaba460504c82feeb42e72
-
Filesize
5.2MB
MD5f77ec113568752552140bc7bdc21302d
SHA1b6907d2dc3b42f0b221b942a600837bd23105e00
SHA256868ffb25ed9c243fd25632c43ef14e3d1197da5afa13eb90d36e1d5c4d492996
SHA51208e68afdd2a5dfd4520b22bd22ee5c5ec39ac762221dce5383c814b2766d3ec77b4966b46fe235ba16d22239d2f87ce59eeae1005451c116dbd65c08c7f655f7
-
Filesize
5.2MB
MD5749e728c609b194f81f7d2dd7bb0444e
SHA1c6721344a51cf4300ffa335e8fe94ae451a79a92
SHA2569cc3e47051994106d92b74cbb14412553084a8ca279c7d4f9febdc28ae7f032a
SHA512bcd70ec9053bd736b7ffd070bffef16ca66d5ee07080e0ab9266abee873f4757006da9ec8836ca04c1ffbd84664b786c4a1a3a6b1b92e3e44bac909d22d70843
-
Filesize
5.2MB
MD545ce10e6e0b53a56ed27636cea60fb46
SHA1e452f58037670b8a7c7b2f9a6ed94c68d51932d8
SHA2563f67fd6717f1f4a8923d66223a6528557b491bb1bf9ecb7777195bb9cd1b92d6
SHA512f71683704e02318041ad569cbeb86075f37c8504a23b676174a838dfa8e5b36ffab59d37762f19b0b0a24d8ed980323c092c01b8c13c27dc54f7ec2eef66d878
-
Filesize
5.2MB
MD56f12840b128690fa25c1a8048b906e97
SHA18b7205e5d121633eb29aed2c8be83bee740aa7c6
SHA25609f9ceb5430d059dc0e131d1b8c918d32bba47cc207d86085152c719abe8ee76
SHA512e9e4c047418a43feed68fbdec99e0fa0cd967f0a7244cbc4f2f5da15839b7f6c5d56d6ade267d6b3936226ce550c8c89e160acc3365bfb2bd70a35a19b39d6bb
-
Filesize
5.2MB
MD57be338a2c04af7a11f62af8f4652606e
SHA16323fd35b186f12d82f6dd90cca639321aeec65b
SHA2561187acbf747e8cc02601d86ce1b0c9efb2a79818c787d53e555e967b76dd00e9
SHA512ed0bb5e5e249cee9f71b257e11e9563a34787d0442130aacd9d14ce51c29f108d7f7b4103ceedc42835336a51c355796ac052471c7339814224df733a76c954a
-
Filesize
5.2MB
MD5336816ce3947bb52878acd64fadffde1
SHA1787c4c27be93245c9b9fe91056d61584efb6dfb2
SHA256095707662f2ef090b58b284d6bf215d1084c9f6df83fa3afb6cb3e2740a4ffe5
SHA51237f16b32e6a48b2884542c8c978c696f9af0dc170c6d3b70cf10234d119a473fd07ba2f1610bf22f81d43e032536b9d4b93a30249678c43ba5ed2c7f52d00c25
-
Filesize
5.2MB
MD50f1ed6495e528ef11c34b999031f652b
SHA120ac5a38716685641423246d1277d6787a4bd59a
SHA256509038819cba48033f8a8da3b1643223c5460f26096be92feb8364f73e26f301
SHA512818e73e8f422324c32eb83a74bb7110e6c1193571d5a065baf8d2c0997dd84312ac8e89595dab104a164ccf976bcb35abfad077e24d36735467645ba7f836af5
-
Filesize
5.2MB
MD53c02fd6c51b620848967d1802749b93b
SHA191303b498ae49d50fb92adabb294a3971ffda92d
SHA2569e0fb34f058b352eb26fdba8a4c41daedec4fc0019dc89cef732046edd1c0ea7
SHA512766fd43abffe3334b26f95da99f489f2ffc909f939c900f87933395eb2f0fd63031beefb49879e339680789457db94fcf0994b14a925d8d610971cf9ad84a3f5
-
Filesize
5.2MB
MD593fdffc19fa3d7a2c2c141c6116757ac
SHA134da0abe7cbfe06e4d7d148deb18b00f4a8725fc
SHA2565c47c384c7dce27c2499883034c50693bb35df4322f30bac0f317a98fb5ff5b6
SHA5129e59ee884cf5e1b8fb0593c52f5255fdff9a6ad7376a12da7f02bf8d08ef4cd6c27c008c7fd877255c0a4aa6124c4dfdd94bf3701c21e2fb58df7a575bcd24e6
-
Filesize
5.2MB
MD53eb14e738936d935da92bd333fbd0124
SHA115d0508982cc3d2781b9963bdcf49d6e9d965230
SHA256aac046025914d0725a51ab7b9990bf8f31b8b164f7a11bc56c2325a5bda460fc
SHA512cc04d8fa04fac37a21a66d2d568521bd5b807a2dad824a9c749fe999135b460556ebf88433d74c5296612573b9803ad348dc9d9466e8a59629ba405954906de1
-
Filesize
5.2MB
MD5b2237baf13dbc18a4eaa84bea7f20a7b
SHA149eeea895af3c3ebf4710bbaf88b957dc94741d5
SHA25621e27d721812a9320927d1d7bca28eedeb2af150b07164038de4abf140731873
SHA5128772603555bdbae53c687fbe5330a4e0caf727ee23f9a44dcd877d73de7c0369bbac8de2fca7281c75c257f8f3d5f17160513f24c8076223d73813966758a4cc
-
Filesize
5.2MB
MD58c271876412e9d874dfda7767f9ffd52
SHA1fcbe92981cebb160a45fe0b4bfdcb40dfaacf8fd
SHA256d1466848d537f3d5970bb82955236abec77314a803797240f87b5e2a37a61772
SHA512f261cbef8151d5d13c7a3b4aa1d962317f047533fcd8df8e4491a27e76810c56324364821ad1cf37dcfd5a3aab8e1f628d0dddc30cd77adc96d5ee833fbc75f3
-
Filesize
5.2MB
MD5128cf4e0c19f1436f6893b13eea3d99e
SHA18dcca606b7b9659ed76d33226a5d7aec26aeed8b
SHA2563e9c08fc5228165afedc13dc0770411d38d9e5119ae483cfbca55ebb74d1180a
SHA512527fea970c70f4587c0107432ac0ab51bced12d0a027d785c324257364c80610aad4809f30dca16aafe73e4bc7e37ebe19147ed0c23564b6b90f140acd61b57d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB