Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 02:46
General
-
Target
2024-12-14_34d47fe107f9544a6c2d43e088de84ed_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
34d47fe107f9544a6c2d43e088de84ed
-
SHA1
0cce49c90cbfdaf996a2f0a8bfa1064c82e305c7
-
SHA256
4797fa56992164a0d962468c27f7b66a54ef5af6ad52f34602ec28851d79eaaf
-
SHA512
90bbe8c052f40b6c6c21f1a723179587ff48560dcbf4a1a50fb84de3411c8732a8c18ade0adfd32303a09026dd2b48929b9b421c79440d2234447a4a28c273fe
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_34d47fe107f9544a6c2d43e088de84ed_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_34d47fe107f9544a6c2d43e088de84ed_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jQMulhY.exeC:\Windows\System\jQMulhY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQgrALR.exeC:\Windows\System\XQgrALR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOyxaKt.exeC:\Windows\System\rOyxaKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBfgnLe.exeC:\Windows\System\dBfgnLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFOFQak.exeC:\Windows\System\sFOFQak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OpMQSsE.exeC:\Windows\System\OpMQSsE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OOYQDVw.exeC:\Windows\System\OOYQDVw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vDJGbjZ.exeC:\Windows\System\vDJGbjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JeqYaJN.exeC:\Windows\System\JeqYaJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHFGPaQ.exeC:\Windows\System\rHFGPaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvLcatz.exeC:\Windows\System\qvLcatz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnJzOAB.exeC:\Windows\System\KnJzOAB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpDrPpC.exeC:\Windows\System\fpDrPpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISZwdZH.exeC:\Windows\System\ISZwdZH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpyVHQH.exeC:\Windows\System\hpyVHQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GoHrOIT.exeC:\Windows\System\GoHrOIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fFoGAVl.exeC:\Windows\System\fFoGAVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iTUglPH.exeC:\Windows\System\iTUglPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxafNMH.exeC:\Windows\System\yxafNMH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WmAPVhx.exeC:\Windows\System\WmAPVhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwmuLby.exeC:\Windows\System\CwmuLby.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ad38f62258cc08f88182c333d313c4fe
SHA12570b2f8874f432489a60db66fbed0a4028a2de5
SHA2565a6d591d36515ca699af72fbf814c0350f90b6483c800cdccf8721b2e5f2dd2d
SHA512a32f8bf5f15bcb817bcfbab785e683cc54da5e2e3e3e25d2af355387b0482f25492c4531456b9eb459db1cdde0b96c778b066b2e3a9f18e814afaf69051fbf9e
-
Filesize
5.2MB
MD5393d7d57fcffffcdde71dba6257b2eaf
SHA145458b352c212fbdfa9a550a87a48924cf041d88
SHA256e2a3b9b04508fd268e1f16ada813861a5aea5205c255781a9dc24988d5ba6655
SHA512b505a481807ecc74657328cdcdd8b0a5ae3811f6810aab8c69aa170308d9217f74ec880b8f5c07dc0288e8795737ce41a1c6bd1ace85e0a306b9c1312359c573
-
Filesize
5.2MB
MD5825f513021e2608575ef761b2a9bca74
SHA1003b777542609d0544213c7c413f6db64655abe4
SHA256e818a45a41cdcc580bc45d80d8a2f57716ebc17b46f1f70470fc82ce09b9d9ff
SHA51286de95212af5dd3854c0ae08e2469088455bc4cd8fb926cfa4ab0c22cd81e05102307aa63e9951568549b7df5b9f39a89f3eb3ea85b399d297654f7a2441dda9
-
Filesize
5.2MB
MD569b8fedc88aaffc1618c21122c2c382d
SHA155540e7f1f758a39e9f1ee8ce9d1add66b88e74c
SHA256cbffcf178a9ea50186ee9b7d35d064cc77c46e74aa8cd5e2643878f2355ebfb2
SHA51214d2711ea35d0ac01c7dbf97cbaa0c213cae4d25b4e16e52be591af6279adc9d911279f25a38aed5334b05c50b5d8323860f4e07ad65d6217abe9efafaac0a4d
-
Filesize
5.2MB
MD55d55786e6b17ebfad37bfa7cbcdc4422
SHA1a8525be5ea4b962a77573589ab69328168e07b3b
SHA2567f77c769883033f8415c2d99584d7847ecda2dc65435c76fd58b2787232f01c4
SHA51298e8783ff1aacc58e823c56cd7bae16045b62a1332363638593cc3a272eadb749e889b502cb6af36f0ba7bf0b5cfa8411dcc32366189005f46b25becae1425c8
-
Filesize
5.2MB
MD53187f04e2d17dffe08b2742e1276ec9b
SHA1410b7e90e91ae01a259b16acf607bc28a129dd77
SHA2560befbf768b448a9ce9f6fcb30e92369dbb3aeebf965677e4dab00256c531ddae
SHA512ae5e65c3710066209697778a39d0fd69f87402717631b7a45efeb2751bab208cb3df8953aa2616cdc7e238ee83b3a7f14318c365c475c1e4660609e37312ef58
-
Filesize
5.2MB
MD5500060a830b4b7aedba68680b5eb9deb
SHA144a750e3497ba9efddeaff113c5bb7fc3e40180e
SHA2565a8339d455fe1de9911031bc072f38b80f32a785ac43796b84f081041f026c6f
SHA512f5d1ee726d1a2494062618b23401642eca2fbc659c79f524fb706d00068b399c07998b07736607e85b49bb1c9ff55fbb11673b76b0fb72d04ef5238974209442
-
Filesize
5.2MB
MD5260d7432b45670a6255fc6c828e3a76b
SHA14de045ac467c5bc9306d1a5f61404ef2b49e43f9
SHA256a95425e9337d7ec1ed54db3cb077ae65ad9202a8965023defb39c7011525e749
SHA512065e593ad60335d1be4fc63af2f6ffa9000f7db9269edee4de7bb3d0d0037ac4058b113a984c5db0d6c5596965de662acc31df74317c55b03555269ee92281b9
-
Filesize
5.2MB
MD5a9429e199b8a9b852b2f710b63df38ce
SHA1f2ff7e0ec9ec1875907ee42eff61fd89ae1af9cf
SHA2566cfdc96055676c344a094019341e8262446e31fabe297d424b56fef77d3d4c6b
SHA512004e17379e844a1ce94dda1d553caf58f1ab36c0a8d582fbfd6a248234d2a8e81f6942864c87393bb752bcd5294aa4cc889fb859ba00d9ac92c7bbc32809f64f
-
Filesize
5.2MB
MD5366c98c378e187ff7bec3b949820e3f2
SHA196f246c60ef8838c8730dbb0e044e962f74578cb
SHA2569d9ce8606de8b2a30a7a88a24cae5fe074c2f091419094e936c5884bc127fcde
SHA5126f8f17878908998e3e2df0733e9f26d48457b01c80c3c190c0a1574aa7d68cb9adfc51b69945b286b837c288b07973f73d3c30738dab32779e3ed45c858958d7
-
Filesize
5.2MB
MD5060a3c831d7af9f20db63a62e1d7720f
SHA18d7d8dacb6316b04973bf0c174133a14e4b52829
SHA256413bcd57bd1cd425a873753d6653ae94437572c0ba81a26318badf94c0e65651
SHA512cbd03ac3dd64453f847e092334c7b8a9641af15a058ffa81dcdff8a7e2af2e053d0266203ed22fb834ad34249875a5bccb2f5eeb7e5d9f42d660b429b11417a1
-
Filesize
5.2MB
MD57c8e4916c17e9dea0133f984319fd565
SHA1eaa3912f1603eb243986a37439fa5f3c3ca1cd13
SHA25607a1f0eb998fb99eca0410158bd11a92f41d8c4ad26b14c0814f93d9b7e2dcf0
SHA5121077669a5ab1a2805c89b52069233b96117a8a622ee3b0406f1daa5f41ef011ff4c2a40cb1242ac4720245b33f8473e259dc2d6f8c870a11c36fe0876247493c
-
Filesize
5.2MB
MD5861932ad5cfece62052f06589ea94711
SHA142bd6730a4e722a0cc0c95495ca0d6738dd32a06
SHA256cbe41d3c348fc9ac7c39280e9add69180f30a4b41c21d8b02b8320d2057c7f94
SHA51268dfb41145fbb34b8dcb84d29e693810574137bd46b21755bcb1f2edcaf424d9a0a759895f0cca2e786be2d2b172ee57ba32b4b3849b4e69746edb5be993a214
-
Filesize
5.2MB
MD5395a815db6ba9e6fac28c5f9bf03ec87
SHA173bc71fdf5f559b44dce641fd5325577eee2c090
SHA2567ca6c2a0e582f0a5a6a6a149fe3b49ecd61365ca12b895e4dac51b6fe3721f4b
SHA512a78c18347ca6620899bc6ee9e9eef3952a4308827c91e4b275b4a40f7c46bd26f5a2058bcfeb4e078ba3c1ab95c4a634b9d997d068ca43104cba70b894203967
-
Filesize
5.2MB
MD519c36e82aec31adf70e26ad65782fc25
SHA105f9f902c4a4198e1afe22eb6234f5a283b4e749
SHA256239915b7b6c4fe58be38ac3e4840cd3aec417cbd2fb980a35c7aaad8ddcc6849
SHA5128843a13e3e2e7e9a5e015393432020b3b2c37473ee0d8ed132bd36cb8bef378bb5928597de98ac2dbce3877c555c388b1bf06a6ca31aec64da26508cef099063
-
Filesize
5.2MB
MD5e03868a709af5f9f35a5e4d88b4eaa4b
SHA194e964fe27a162bb7615966b9136a4f03e3c59eb
SHA25611d487573493c26febb6b02cd3b2412555b0184213580433194b2791e6a79738
SHA5128a776c7c741e1edf511c4cd3d76d65cd0689611634230eec9b155f1ddfa87d2280f1dc41562a041663249216fdb9449874446dad415249dcd5cac40f23879d45
-
Filesize
5.2MB
MD51b533078ac08c6aa96aff5c5fa1d7382
SHA15dbfdcebc71a0329b2089734779929a59382e4b3
SHA2567216d20069c1526e43cc4deb5b723f7e7ab1b8d88b764aaed8a92fd1cc42dd94
SHA512710594c1470828201914fbcc9e7e5b1416a9a8990316719cbd7eb8b86b0d8c880ba66c93958ad7a2a892aad7cb7e70cb139e37ea8056eadfbbfd0804e45d829d
-
Filesize
5.2MB
MD53ed932f5b92db39583be0019f4129cf8
SHA150d8f599249c71c979f90d6c12b26e3ce0b44fe1
SHA256696ba1828927cc043b0d5ca2203501422007f8ac3c1b03ae8db9ab5e58d93a89
SHA512defc4b88cf9d5599dc9ddc5599e59941613dee6dde3b57b683fe2ffa6b1a280473833dfb0811c8c1117bd10a026966ad93dc4c2c99bf97f7e4585caf78f436c4
-
Filesize
5.2MB
MD5992189fb5f1e288ae6b97342349e9df8
SHA1d61c3d2caae4031716f81963616b53f227939605
SHA256a259c3551a1b938eb9e0d745022d0596f871f0784dccc1dcfc62fab61cc92ce8
SHA512fc84a16cabab19cfc1fb7451c75a73205c51f1ed5b10c0d82c739e6d0b8814e6efad8a92e4ae90dee65774b807917de09cc061402e23c1f77c4e618fb5cc21fb
-
Filesize
5.2MB
MD5e8310c51c36441282006cf886d12b88d
SHA1ab31968eda28a889c36087393da96113c7555151
SHA256fb072d709fb7cffa8340c66777a5aa66a203c6d28cbf626ff4aaa28077ecc7fd
SHA5123317912bdcdb53581b2b5d458feab5e6d393679b7e8c05efef07c15c47f89732364a5b22b79e8af4527af1c5cba6f80936d826e3ecff86cbc0295d3b36db874c
-
Filesize
5.2MB
MD54c347fbc13dc39fb6dbd6a374f9f489c
SHA1bb7891f35402eee10bf6ad8a76c8beefbd6ddd0d
SHA256941755e86f24f2ff5612c1d2013429b6ebb37aa79d662e02b37f35e8e1479ab1
SHA512a221f233e88e7b91d9acb6ca63e9e5f235f60eb916252bb87f8985a628f4e3e04093c0e1f934a082d2f214cd3cdd885d56d7504b90cec1257e95112f75d16849
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB