Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 11:53
General
-
Target
2024-12-12_a5db4d1bd216e28713ed8a7bda8ce7b8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a5db4d1bd216e28713ed8a7bda8ce7b8
-
SHA1
21b91cf4daa744ca59984ab971fba39eb2a2a6d2
-
SHA256
261e08362e4a8aa8f2a0566cca0f243c04aaf3da528f8992ed6d60ee2d4ed68f
-
SHA512
0f62be2412faf1a6dda7dee8ed08b35ddca5573dd5eeb2d5dd1a891347502e6d427e650f284c4072b493c3b9b683872b0402818c273766e9e8fdac33dae45a18
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibd56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_a5db4d1bd216e28713ed8a7bda8ce7b8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_a5db4d1bd216e28713ed8a7bda8ce7b8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RRBJXxN.exeC:\Windows\System\RRBJXxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhBpoeN.exeC:\Windows\System\uhBpoeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejgnoVH.exeC:\Windows\System\ejgnoVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNyzvMR.exeC:\Windows\System\tNyzvMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ScQBrtU.exeC:\Windows\System\ScQBrtU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEaxrRG.exeC:\Windows\System\TEaxrRG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNFRjxy.exeC:\Windows\System\yNFRjxy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebDHZxa.exeC:\Windows\System\ebDHZxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzMBbNY.exeC:\Windows\System\gzMBbNY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NzvJRAY.exeC:\Windows\System\NzvJRAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQlpbZX.exeC:\Windows\System\KQlpbZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVGgVMr.exeC:\Windows\System\iVGgVMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvoREeh.exeC:\Windows\System\MvoREeh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErskifR.exeC:\Windows\System\ErskifR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSarKJs.exeC:\Windows\System\cSarKJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vfMqSfm.exeC:\Windows\System\vfMqSfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrSFtwT.exeC:\Windows\System\mrSFtwT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omYTkhq.exeC:\Windows\System\omYTkhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuTCeCX.exeC:\Windows\System\kuTCeCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdFQhIk.exeC:\Windows\System\MdFQhIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpUwLfK.exeC:\Windows\System\mpUwLfK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56d4b2fcd5e238477894bd9189b04da85
SHA1a43a76ab24513ead8103615e200ee07efe412a7f
SHA25644b88e5c5a2ba40d0c015c3591925f04ef1aa3de683aa1f2bd2049e48927b7b5
SHA51230f78df59d36b093739473ce8931230e889f7f85f5e95ba7835cf2a4c1a497fa9e5446dd708dd3ac7112873580380189a6aadbe0195d0bd77271c1b22c1b6d26
-
Filesize
5.2MB
MD5b267b804c186288b5842175a00755c1e
SHA17378664f61a54c8122183311f251ec49cae36728
SHA256b2d1fbf2b72935b6763ede784cfdaca4998bbabd8e11562a1f6b5cadcae1407e
SHA5127b3e589ae18d46cc99e51be1d996ccc3acc6ed97d4b62ca318b36668179b95ec41a67f10bb6750b59c33aea7a44d144404421fce1097a786800f95349cb2dc53
-
Filesize
5.2MB
MD5e1853982b5eee7fdf368fbb09ed2c095
SHA16e131b1de28243fb639aaa90fc82aa2cf33b6745
SHA256467b09623f5657fa5d621106689d2d3d98367200028b40b21c9a56a7c58859ce
SHA51221c46b3ba177fa9657834e33745c1796ae19b78110b2a5e4d46b0a05d16138bfae679d611e620c621bb6e6e35ab7904646c013189125ce4cc75052e934454be8
-
Filesize
5.2MB
MD57402f40a4fb714c91c3cd9f7d3e09f00
SHA1dc129418672592367f4d9028dae8df850183f8a9
SHA2566baa731fdfc9db08b2c3aabcc7afc0ed785f6d8e2f9579fb5c27ba5106ffef48
SHA5123df5809b042d5bac39e2c76c152c64cffa640a67130233f5ccc2c0e8e4285628d2970f3704f4dca861f70be9be9f21c4a711e6dad0a9b654db2cb6058fcf05cd
-
Filesize
5.2MB
MD52ff1eb5f93a343d2baf7d11b13fcc6d7
SHA11db3a7e1da67a2b2242e12d0efc4498909fe1ef9
SHA256a8053ceefa172de7a55b8aca49a56fad67efb4639442ffccc3465fae50332f69
SHA512fe6bc9c1ad36f23820d12e2866c90c271070821e9ae54fa885f1323a81481ba2a0c11e57fd6e48887f57583233630906be80d1335b7704940eeabaf2cda5d04d
-
Filesize
5.2MB
MD5575032e13223b253d43f5904843b333b
SHA1618e436913b867c776ce9d81ebe9ad7c5407fa7f
SHA25637e9f7b20b49bb6cbfe113f6b17d2da8dbf6346f53e69063b8fb4eb70f9f7662
SHA51250270ea69ff0967076466010749177c51357c19cf36797e3b72332d12c4967b744bcd9bff7b5f2056481be8c7b3108cd387f1a7afd4c0a5de67954a1e13c90c8
-
Filesize
5.2MB
MD542b50ddd795efedfffc338064891ef67
SHA1f81be01869d3f4357e2d801cf4f21050b6584b8c
SHA256ab01bc2cf49990853f2ec145c62987592339c06f9894bfdf294208cccfa81584
SHA512c2e03d1679cd67afde32c9acba92afd59cc14ed6cebb2568811badc0861fd5d32e27bfc98030283f05e6af053523a8f1d776d3e8417b77ddc3b50623c5005f3c
-
Filesize
5.2MB
MD5168e07052ef0640eddee06f7de70e5b8
SHA1a9eadabab40d3e9dd046f52f4d46bbf76701c419
SHA256b0084c4d8bba81720a26d177ae5fc451b0908751da1caef67e4312202b6bca06
SHA5129650bdcd093eccbde9971c278d7e8ac89ad54ff6bac92edb4d8297defc0003fb5faa57e47bb73a1aaf9f5dd49ea6c5e058f4ada389dd1a8c75511ece8f0467ce
-
Filesize
5.2MB
MD576036c165532a2a608cdb619fe5f0df7
SHA10d5f1fea98d35ee68d266061aa0808a3d700e5ae
SHA25690806064a8414f4aa04f65d6761cd3f91b816ae731fe90053047ff75832252d9
SHA51268c45dc8f9aad149c15dde5e2460cfa2129d271ecb513e5a5bd6aefb952776ba4e04ab7e7a67655fdf3b9a50ef6b70715d29cee5a55b4399f0bc2d6127c025f1
-
Filesize
5.2MB
MD5ec893dcc248f703d117b90b6eaa4fafb
SHA147f534ce3559e7aa3857f69fb9dbd83967fee467
SHA2566de19b31f9a5b5e20dc533cf4a1d0f593c176bec10e3f8807610067942842f71
SHA512f07e669df431f6aa018041d2d096fb73cfe4d108387eb78529bef15068ca1a22ca602f87949c06ffb2452fbaae741051786c1aa7960d154a8186a9143af8df3e
-
Filesize
5.2MB
MD504c115051486b67d229261e39122e830
SHA17d85c581601c43027d7d2e1cb025ce77d9c5dd81
SHA25654393171089e2ab2a652d887743fa4ae0af9837d5e5699f2d8960c7f7064d68f
SHA51212277fbd9db0c388dd5bbb1bf5a5985c6682ef8bb18612e47f54e0ba3cf6fb90371ffd85fa5a3c56359ef95684e6967dbbe6a48e52ba25cb0be4cad8689dec83
-
Filesize
5.2MB
MD5fbfbe26bf1df490d1cd90895a363e8f8
SHA1ca8c7dba15b84e5d0353ebfef9b0070b1adac6bc
SHA25622f428ae0601204ce089e151ed4c59726959a1898af968ab3f950417869ab78c
SHA5124f828b28cfbe3cc177725d33bb0d4fe4c7b48ad9f7928b056aecd9449af7572387d9204e438aff6d0f728ef56818643d14c70f1245fb79c78281841a0946b07f
-
Filesize
5.2MB
MD5c85efc584e8f4bde2ad07c29e7b0a7c6
SHA16e7c71c0a7c3f42367979c7394a1c31720aee74d
SHA256118b487ab28cf808fc4c76770c10bfba344025aad375e274558b54ad730572a9
SHA512afc7fba74e135b81ca0de629a4e6bae445598822af0f614c32d38d79a4968dcfcf97778000a68152e049771273db33a49a02227abaf8f1ff378ac8f60c15cd92
-
Filesize
5.2MB
MD542d5b586bc615f1c37665a63578460b2
SHA14ce01b0e8a0d42e19ff6d384b5ab7714e8e7aa11
SHA256727ba24ca0a418357d239bed3fe9ea9629bfef7df5d4a468fa629824b2e1ad0a
SHA51222432966741a8d9341787c10d6085337cf099fabba0bf0f949f6ef2e83e63b8070a3779c5a65b1e4bf38c4e699544940809f5f0709ccbe22ec0663c7bdeea1a5
-
Filesize
5.2MB
MD52e2d4fa974b45784b4257785104a850d
SHA142e5a0db5690ecdad8f11564f29cb6fbdb0ebbaf
SHA25652925cff4b1de1a74d76667a9e886b118d0b5bc7ff38f09f1b2e75608f888122
SHA5127d073e31bd7519c3014a914ed7e2177384d14076e885b7912aad9f85c6b39829b79bad0f11f2232e45867dd13f9301620ad34d8c037072c4f4ac44ddcd7a9874
-
Filesize
5.2MB
MD5f85fcab02fe141ac230ad97b4175e23c
SHA1b2b9e069cd5ce9275aaa3ba0282b7065459b1b7b
SHA256d5540bff1d660806770a9832a1d0db6def023f2659c0c8bd985d4220cb735cc6
SHA512517593471b0ee3e497f80aab4b357e5c866f29195e8ca8d8bd86e553a3b0bf46c3603d2364765a24d4e06bb3f4b9525fd372721b242e53e33cd4cc64ae23225a
-
Filesize
5.2MB
MD51c7864ec109e10dc52fba0d2bac5c3d3
SHA158289414398acf2167dbf8900bdbd0d2f2e86930
SHA256748898607549b14b4ab658d9ee19d1eda9576b87d012d96b74432ecc0ad8db0e
SHA51261df2b8c306f8780685bdc789e94d852bb6d745ce7a96b0aa7bddfdfb566cb07e6f4fb28ded5cba4dcadead9ee0c31223f0df81dc2d249fa08c613e7be572020
-
Filesize
5.2MB
MD57e8f6dde39477dfbf3938f2bef01280c
SHA1f00679375f52d984c33902a1967f689ca3ce25bc
SHA2564cd86c33769bc1dfc955a90b66f0ec8add3d1e417c81ab30a70b8e7f10dc45ea
SHA512ea74b20a2eb119fadc5d3d3a3d471bae70a2e7356959f47d9394d983672deb0ef5607ba3b199741266ffa6e301907e04537af4bbdd04b3abd4c9b5f691c35681
-
Filesize
5.2MB
MD51fc6ec7a18bbeb7203325d3bc98943e9
SHA1ee7e92d5c4086d032bbd464f34182daa52b4449a
SHA256cfaec6dfe209a4d01dee8efa426bf8fcb3b91daab3b8a33b08f2bbf3e848d94b
SHA512487fb5548a278c1b1bc156f96ab2a2e70da22f4bb3e2e0856e52aec71bb13736df94908b7e489e5603a686d0fe35b3ffef07db80cacf1f1a3f6d65d026c4aec5
-
Filesize
5.2MB
MD53f0d63f71f191eb580f351c7877a3aba
SHA1840eab11103d801f2f67d6b1546d0f1ff4778291
SHA256535198869fd23e12d8266604cc47403402b0805466f800da81013d3033645a3b
SHA512bcf9b568e593479a514698bece89598cd711e2a518ccdc11723ea8a164a40502faff116b911076a1fbf4a7d6fe734897a9e27b29264937817aeeb4726a03e46b
-
Filesize
5.2MB
MD58adafe68b0bbc1c0718df6e52950d234
SHA13ec09bf0d8b4dbde9a73bc7fe2c5379b738e4f30
SHA2569ec752d134f465caa0fd30957b7f6aeae812a19922a33855e124cde4d2a81573
SHA5129384967aef549b905d81542938fbe9126eb6d3663cb382fad0612b4d049a729a0ff84911dcc00f1362e3e3d8fed398ed6be753580bf08b18aed36e3e403aa368
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB