Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-12-2024 11:48
General
-
Target
2024-12-12_4e31a219500575b3eb13cd199f5bd857_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4e31a219500575b3eb13cd199f5bd857
-
SHA1
45c578aaeb4ffeef21bc01228676ea32c08bec6c
-
SHA256
6b50805582da8255bf717a4b80f8925ae632376ea9d407cc072d3c2309e8daf7
-
SHA512
4d172f0e2b1a42aa8bf5e9a5b80381f5cd435b52e8950cb0724127569162960bbe30562f85ffdbeed6323d7b207b27cc658df5fe7f2c421027d8ee5427f793fb
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibd56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_4e31a219500575b3eb13cd199f5bd857_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_4e31a219500575b3eb13cd199f5bd857_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MXXUjXY.exeC:\Windows\System\MXXUjXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJagHkG.exeC:\Windows\System\lJagHkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zMAfpBR.exeC:\Windows\System\zMAfpBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdBFJYq.exeC:\Windows\System\qdBFJYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TrKPYbd.exeC:\Windows\System\TrKPYbd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kiBktKe.exeC:\Windows\System\kiBktKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRydHxm.exeC:\Windows\System\NRydHxm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcHbLix.exeC:\Windows\System\GcHbLix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EcFqhhE.exeC:\Windows\System\EcFqhhE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xRApmAj.exeC:\Windows\System\xRApmAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnNJyFf.exeC:\Windows\System\xnNJyFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMdaFgl.exeC:\Windows\System\aMdaFgl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvlhcEd.exeC:\Windows\System\LvlhcEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UiSSAFi.exeC:\Windows\System\UiSSAFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yXvbFCm.exeC:\Windows\System\yXvbFCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGXErbB.exeC:\Windows\System\UGXErbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lACflPZ.exeC:\Windows\System\lACflPZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilrrKdu.exeC:\Windows\System\ilrrKdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ImyHWWR.exeC:\Windows\System\ImyHWWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fojVByd.exeC:\Windows\System\fojVByd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wpwPiDa.exeC:\Windows\System\wpwPiDa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD510ab61d179a84e295e8a9169665e51e4
SHA13ea65e7fd8ab1a01c9fb85905b3445b63f085e93
SHA256abfea6b08d89c56f8c9fde75ef8cfaf982bdfc808db3b843ef4525ca4de02e31
SHA512855ff92b35b0648664264ac108ed0da7b6092cda2e46868041063d54f616c4a23282b186d6b031fa49a3222dd95445fcf210d20e1db2405ba4e86bae4ea25552
-
Filesize
5.2MB
MD5b10249bbc0f99c4a0b398bf5bd69501b
SHA16000af92aec30c25cc7c21053f690fa8db850835
SHA25614854f47e1ca78dbba6435644085f60ae87cadcd916142774a2384761c308feb
SHA512f0428b1f91fd8ac5cb32bb1f398afd4bba8a53ed8d8c5a15712e9f6abdd9ab80908850325935502bc0fb4439ccc25056e659ee991ba885e018672bbe9ac06340
-
Filesize
5.2MB
MD528273bca6f16f1cb4601d66049ab19b2
SHA1ea7ddb52d36d07f9433d0efd49658bd3d19f2488
SHA256f3d7cc41d3b1df73dd05e0a3b21da66128e83fb17921e3c23f017c598559bb0e
SHA5128230d975225a531e2e83b9f78cb7f914c4081d7dacf7f4c8bab17f2014458daa9adc3efb91b86af5a37897dfe635c1728a4ca48337277a4b12a9c1a77c43c340
-
Filesize
5.2MB
MD54d48be03aadaaeb0f9486fe81cc8c706
SHA17f16d3020bdd86c20e54d90a3155db64d3d7c690
SHA256e77602925b612f0302989212ce7f6d54de1a3a084b111868570907cf0412c6ef
SHA51285682ac50571d1db7ed9974772c83952121e083db51377c0b36a32474e40af30430b2b5cf302a90b4b3f59f95ff438b4227cda789654bb1a385641402e4e50f3
-
Filesize
5.2MB
MD5086a8b69b697ef7960d15e3eb74e4868
SHA1d5efcd2b0422065754419a70bbab4de0c1765a13
SHA2562c90dfa6b19a7f8563cf93a796bcda492f83bda4281b1d618cb15b91100eeaeb
SHA5120ef7347cfde3266fc26f5a0ce8341131bbf4079443589edf142e6aeeb20c65399db33dad0cbf802e48048ceef1cbe4f71ca4ebc76beb3632eb2e1f7229f8d369
-
Filesize
5.2MB
MD5b23981535d98e7f1bfdfd2e432dcdfbd
SHA147c8085534b14e0929ee5b5e700de6356ddb5719
SHA256963f8191e1b8f70f7c512c267432db2c81496d0335d03788e29775268952e5a7
SHA51252c05bb32f0a7e66045c443ecfbce4648a93a3da5d6b336cc490164f6d4937032e78baa4574e0b2efaa6faf2f3c81a1e79d878e487c8795e71b114ecf99e6761
-
Filesize
5.2MB
MD5fd1edbfe4c7abe08db3ea754a4e7faaa
SHA1dff8cee23a6743e908482fe1e2a94635b190ec4d
SHA256d53233c3d81ce42e1f57349e9bbdcacb8ad6552729f2753402f33933262115c1
SHA512c8748301a1b17348e973f626574a2f0e00ad6fc44b5b53cd405a49a07661d9e24f6ebaaf41b6dd31f482d6b2239d4573fee5f205998fd4a45103d0eb5ae7f147
-
Filesize
5.2MB
MD5a1023ec438edac0286d22a141bf132d0
SHA1bea570ec09fcce9d176ff5dd539a67005887c2b2
SHA256cc59a5c4b53cc7e135944cd4a201804149a9853f60324eedc5873041150ac705
SHA5123a96df587f05eed9eb7ae67fab6bb9a556d3c906089a66349e72b80912794065e9e7ceef3dc5438952618bd2b44b2d8dd7bedca624b432b67d2798f5a3225641
-
Filesize
5.2MB
MD5a00d0552c58cbfa84cb062fe3f2d8ede
SHA1daed121f45bc06f75fc6bad5d3d2f1119d3b95d4
SHA2569c5df1260ad8ba7dbb75fbec6bc2d2e4e82732cf0fb36d9ce0935075ebd7f85a
SHA51244f70327adcf625eb5f7cbb840e5a03394acae52bf0c7138fb42f0f852e8a049a9bb4abcb5abba84918c6c13de561c6005746cef1c0ebd38f124cebcab2a2cf6
-
Filesize
5.2MB
MD59de75a223992a19acbf14646d1922ded
SHA17c837ec536e8f9afd7d113a9e5239f56c877415a
SHA256d2af12e0c5fbdf54c797f160d02a5a95efe78a3df1bf41c79de9f00ee6514240
SHA512a4d3681d3ad239129c6b0409c3a726e782cccaa2ded421083d35aee87b7cf9fbdd5bc08f04bfbb9b5a76adb3008111d75284dab54aed88429c5e6670008c34b3
-
Filesize
5.2MB
MD58b206e913f626a51b770f8d530eed2f0
SHA128dda9aa6a4873f385445fc476249092443b862f
SHA2566cffabfed83c3e66404d6b1c0d9954c824b0fe0f0fb5634c038d08fc8daeb543
SHA5121b1ab9358bb0b7243a97dd291ae9fb2d933ba466ab07c6c41d7078bbfa0d1c6b4dc82cebebf12a098fabc6f9f5f1e20b72e148c5e6dd5d929e115886e2e92ea1
-
Filesize
5.2MB
MD52321f6fb9409f505156a359040361914
SHA1b84ef5bd07c09e9ab8de75aa0cff9c05bf69ffc9
SHA256ce518f37c705374b6427ef0bc7e1b430c02066f152c391d6d36bfb9dad25aa1c
SHA512bf25831a0ff6644e248b817db07c9ac08e6e95f111f663d3d7f0a11384c6169dee324f3d223a34cf20281e4888b4b69de695b0141fdfd597f6a65df039cea07b
-
Filesize
5.2MB
MD5dc0acdc1544482b8865e55b5f213c088
SHA174e07019cf34814fe7d60acee24c4ce362b8b66e
SHA25627ff4d0b95ed57084f94b8c36147593511ed1d79c98e9501ff7cc4e17111e193
SHA512dfabc38448376587cebe04639519f196104ca313541697d8b3dc6c3afb09480f44127ae096d003f33e59924bb540da9adc961946bae312bde18fdc8494c4207a
-
Filesize
5.2MB
MD50965d314ad95a8e8465d56c4238c360e
SHA1d5a7d1682506d6242b2207cd17a184a5d58bbf55
SHA2562d0e4613b1bab2a4c196b603ab9ee3de53267648dcbc6d40ff6f2aac59e3b273
SHA51264c6ce41846e51430ff35095e37ed970a91f230f3b0380cbf257da6514c5e295c25fb703e61b29a2e2da48d31405d9d9fa9235a2b63815e4b01a97520754df4a
-
Filesize
5.2MB
MD5f9f7364a040a858cff09d3867a589d48
SHA14dd691b39dbd97ce7c953b9338c27745ff9759de
SHA256b8fcdaf189334bbe93dc4e9bf4cea5f1312ac5de136cd763b61c537d9cc20657
SHA512eb850f6715e5ad82605b3e3e1e3039b9ccf85c3d648908d85b71731e214407bc895232177bde630397d3d7fb6bda80fad6c4fb32674c2c24ee816ce96dd5fd03
-
Filesize
5.2MB
MD5e676c70039c1dd9f2f1bb78eb70c17b5
SHA104788167b3718f69df4af5b1a1569503b3c31ad1
SHA256f92b9e4fbff1b6d3d584b1a757e98d71b1befebcd421d1adab7f37cd23fe34df
SHA5128ddef816bd9d705c1f55f49e372b44136df3f5cb24b4ed7a0af30a19db453c150b70708fc8bc8e42cc447404953e3bdaa5a1f1569b152f66509081c57dfeefed
-
Filesize
5.2MB
MD552b44056bff8b523ed87f70d2d18e65a
SHA1f56862828a325ab94e98bebf55f19754a7e73fbb
SHA2560f1be77e7c4580e0fd36f9ef5c9804e6efad3f5e47d87703758a5f9f6255cb03
SHA512b29c44d3f1cbf8f383da6ea67573c497a2f8c2de87e43d2b66ccf4e4f66868b0553a8f893b2dfdcab0335b85b7dfa7c4ca50259c534d65c52568f5e1a87df978
-
Filesize
5.2MB
MD5509d6da175db4cf73a0e0a94838aa666
SHA141c613551a280533628ebfdebb71b5dd24534499
SHA256f2ed1967a19103d3b8e78310d04e083a78952cbc7fdb876df543f88b35788833
SHA5121f02f6216037a872885407655560c71f9216f7c602de73895c5e1e50c5b00953e0957a5cfcd4fd0a79dfe7fba03361be09766f091dbe0c4088ae55e22906fdb0
-
Filesize
5.2MB
MD526d36a8095a96bd83a5e1ba327d8e531
SHA18eaf56ad05f8c5ddbda57b22ddbf657df2c91bb3
SHA2567027eacdb2667e1c94c338d78ff022bed4480c1510184cd0ecdf9631dad0a9cb
SHA5126b1bcfa48b59c1db59536e2b0632099b26609be64f2a6332706a92934ff6d14f622eefa443104f6b31c91f0beddf795c1afa6181420c92e5a0a0a6a0e34daa3f
-
Filesize
5.2MB
MD5c68926fae85990af030761478b3136ce
SHA1b9a565fb26bbebbe26c326dd5f1e54f22aafd5a9
SHA256db6c185795c301eee4ff9ba49b7c4122f9314330cbbbfb478fce66756fb060c9
SHA5122bb4421ace9e4341a6ddcc3e2fe76a4e2ca04c6e34c0db5194a377c159bda714f9438ecca6a9e72223fae1de40a5eb8593dd9d57f5631c138493e2b46acedc3a
-
Filesize
5.2MB
MD52096236226122a638d2e1d61b3317843
SHA167c34b9f1a345ec392e832fde6eb0119dd9394d8
SHA2560f7d2a5d093fb3702457522d90a13468da9241b617b22aae548412251baa45e3
SHA512c655385d6bc3f1128591915e616ed2f511b66625d7351c4a3951837563521bb8ce70cc263d79a13ce9e1275d5d8f5111961de55d9d7b707cd6c70d286ce99bcd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB