Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 03:02
General
-
Target
2024-12-14_83fbc72a6abd04afaf0579e43b09659f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
83fbc72a6abd04afaf0579e43b09659f
-
SHA1
e3cf2c79b63e00e923241505a2b599ec87b19a59
-
SHA256
8bf609e81ca1b1518d5613c6243c7f1696800b1ec836201b0ef024a69895334f
-
SHA512
20b6f948d9188c9e629f32b8cd344b9dc7c2520891428dc3c8db94eea83c5e4a66c1de39bed44e28d59f74e045e7426c39f66a99e234eec731a5f950ec39d6ea
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibd56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 49 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_83fbc72a6abd04afaf0579e43b09659f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_83fbc72a6abd04afaf0579e43b09659f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZyHAXLj.exeC:\Windows\System\ZyHAXLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlKZmGf.exeC:\Windows\System\YlKZmGf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bYsTuKQ.exeC:\Windows\System\bYsTuKQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAkNNdP.exeC:\Windows\System\GAkNNdP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgGDdto.exeC:\Windows\System\NgGDdto.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hyKcsKd.exeC:\Windows\System\hyKcsKd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXopqTs.exeC:\Windows\System\WXopqTs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brtTnfE.exeC:\Windows\System\brtTnfE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sexSsAV.exeC:\Windows\System\sexSsAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pfmLIlh.exeC:\Windows\System\pfmLIlh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjCymXX.exeC:\Windows\System\jjCymXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQFxzZT.exeC:\Windows\System\TQFxzZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oWKXKXe.exeC:\Windows\System\oWKXKXe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPBfrdz.exeC:\Windows\System\DPBfrdz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCUxZKY.exeC:\Windows\System\qCUxZKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMXWltg.exeC:\Windows\System\UMXWltg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSWBkgZ.exeC:\Windows\System\zSWBkgZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GfEYUMB.exeC:\Windows\System\GfEYUMB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sZuvfSb.exeC:\Windows\System\sZuvfSb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTPyQoB.exeC:\Windows\System\uTPyQoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzSSoCS.exeC:\Windows\System\rzSSoCS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5154cef6e0ba63bec3a7ba9dddfef2ebe
SHA123c22fbcd629cb5585821988fefce606127d4d2f
SHA256efef78d78819fcd855ea26feb101dfb17601792f736424cead6329cbda270c6c
SHA5120394f71f7852b45f5ffa9e9c23acdee620a2890a115c801473338ae033434d9338aa93d64aecf1b93f3901a3a978e0fbd12cb935213763669f6ff6a84cf64996
-
Filesize
5.2MB
MD5184a989d8f2a3f2f2f2c3267ee4cbd3d
SHA116ca5e50d61775c2ae00e10ce2ce6c0714955f29
SHA256428155378284f09d8e13bdc2d0bd41a08ba95e68dcdb944a3b1f4adaa08143ff
SHA5127e72eab502427e3d3a91392c0ff2e14684da339d129993b711784471e7ee1675a79c58aba54bd809fdca01f35bc7a5558728f727a93811d1443d5b733ec341ad
-
Filesize
5.2MB
MD5e157a572f0325f35e72550069315cdd4
SHA1848687f421377139fbf1e7b52ed91b4173dc2e5d
SHA256dc06d8b91710ad6a431cef52ef7b21c924f839d9e36ea65ce8252bb279927fd8
SHA5121a73343c37b603e660d864ddb8b238ee53c743299391807fd79e8c6082b82e0af39ea68450208711f2bdcbd4e7eac94d101b429788eccd10bfbf0573678ab169
-
Filesize
5.2MB
MD59ad0b1134ce3b949d09e9a9fbefb60a9
SHA1e3a93b1b8b9da946f360fb035060fc0815ae6d7f
SHA256f27b0f3f5249ab4993cd9b52623a32e631df8370253e118a2847593e98c114c1
SHA512d608833eef12c5438a65ed4dde4a7e5394afd798d194ff49593ff20053b9b85e3012d2e7d03bad7c574712c660947edf87a7b4793b9453ae180f42485731bd93
-
Filesize
5.2MB
MD5fecbaa8f4377f02ca78202165b3d8d9f
SHA161b243ce05f5a8ae58a48ae47781e7c27cfb6189
SHA25636d36416eed4501881d146a0c7931592d7cdd4868a444167a87b34e0960443e9
SHA5120971782887fe22727d86bfacefc3ea76ab4979f3074fa659df99a2f54d24f302d3301aedc5df8fa1d842a3766a51039d30fe623862b75bd9dada3f5c503e6499
-
Filesize
5.2MB
MD5f49315ac0f454940584d7073270aa5b9
SHA13a57666d4a46ffb70666f0c94db440c9771ae30a
SHA2563416a519167a76cbc0ce2c424e772fef1711f9a75badb9978858f2d35e0f8142
SHA512aba4793d93437464b89ff2b3a7967ceb37afe1e7a91ea37bace9f7b5b208da17d3ca92351d59b57ada366f0de8b8ec151311302086496828e271779d067b3ea5
-
Filesize
5.2MB
MD5268f57356cdea1b89e8193e9b957d82d
SHA127ae1d468140bbd4603be89c8a7b34a578bab8c0
SHA2567d90c0d4bd40dd70888d9b826992baa81e8709ef716ba5629bb810a91b998ab8
SHA512b46512340d3bd69b9a8f7a966669eeb91c5844f7fe7ad83f0f0ec34ea2b7ee48ec5417357ad584219a30b1a186bd78501f50a68f823e00f6f2c2fa492e80153d
-
Filesize
5.2MB
MD523a047de228fc3ba22f537c3ca2a3544
SHA1dbf9d9072aae4767cacfa28f3b623fde4e85bd95
SHA25641c3bfac1eb73280dc0ccb703598e05574262d655944d961ab0fe397fa309ba4
SHA512354de1d46e03fa72894bb33eae525e77b741dc2dbf23b3af441832f6e8711bd94f5e021ad74a62458dd131108f1c621bb99a07283f42cf184d71d74417d4d219
-
Filesize
5.2MB
MD54601b24d8ba4ef31a06b1b4e8ae5064b
SHA138d927ab1570eea7e064c136ec4b12d8b97da43a
SHA256637ef386d1835e1eb58ca3ad7ecce770afe69410ddf38c6b3c5a498e0420d9f9
SHA5121d231bbd99e848ba4516bab4414536aef48da74bba00da571d3e2c564686a163833f9a4465c93ad6cbfec7362c86ee40221889128c2dcec5eb56ce4bcd7dc2e5
-
Filesize
5.2MB
MD5e2544d9768fbf7633f492ff3befa189f
SHA140fdce7c8bbca005438f3524014b9b48b584e05e
SHA2568c53a89c6ba9c0684478e646dc11bda7f855fc4eebbbf2e4580a2ce8787b5f82
SHA51232ba3b2c00a7fe0a6c362843955e0aba360df49744904db391be9526ba3aeb60718889f2c37f48e9cbd69eb80e07dc61100f8eb20013aedf751ff4b6c01d5755
-
Filesize
5.2MB
MD59c891fc2055237cf2136a39f946d1309
SHA1c68844ac0664e83f0cbfcd2857d173037c916bff
SHA2564baf1e9a7aa758a5b4edb9568bb6d00db23a48472cc4e51ffda745efc9ad27d4
SHA5125d05a72a1c49eae84ad079c19692a5eaf201d75161163c1a22adbc5002693921d1a1b7ae70fe6e4f570e484c48c543b62370597ece325a4552a665dec05ff4cc
-
Filesize
5.2MB
MD5a7a081c88c831c731756951a09ab32fc
SHA1b826fa3157228b2e0c1586e316e48cbc639d58d4
SHA25603f66db2e32e87a4096e24e36fec0d37dbb82ec116bbdf1d64772ffdb538321d
SHA5124163d83f1cd8bff98b3a620b9489f58f4fd792386499e6dd50f6b5e9be41e7f830c67ddd73ea735d9a535441d14063be824ac68b51941a1fa265fc9bd75d829d
-
Filesize
5.2MB
MD567abccd1a530b1fa59fc59fb543051ef
SHA1e3b36c2a816be1c0340c582caac35f09fa4af7ef
SHA256a4eef136b2e56e7c570dd610fdfeb6fcd1cc8bbc3df84096fd98c0c28be0e10c
SHA5126ddb2c905fdd5a36a677e149be0e8d7be86aa619ccd9c713412ca4850720a0f6b8d349b7fbddfca8788dca0be1d8c172b5b85c20139959fd5fa5eb30d4e3cb70
-
Filesize
5.2MB
MD55b520a8a854904b5b5446e2601314283
SHA1ca82b768bf313a9d5a5497ee4c934ae3fd28d70b
SHA25697ace0cdb093a511c6d97ddaae7b4717ffed1c81a207753a08595326ec949c59
SHA512b913d5d746ca90416ba0e31608c1d0c3bc50cee336bf6e7fdb8a5b5455e8e5416716e5e6f751296e1445bc144b1b7c06fd4ee5e51e9aa770d4a0ca1b4b398bed
-
Filesize
5.2MB
MD5466f1d3186f01d2ed0308173201fd534
SHA1c7e37da2394f23988e33a5cfd1b99ab542159ab3
SHA256febe6a097e9add56fe1acb750c6909b20eeb75fa1f08d777886344b807125d93
SHA512e9720824d915742bc9ceb366572618f0503ba58af846f7eba5eee871d1576d2ebed71d840629ffd6560e9f160f2f1c45b0aef91191ce57bcc4db26c7b7f9080a
-
Filesize
5.2MB
MD53702724efd7efd66c54d403be8116c7a
SHA175354c4cd35df7f601bc43468ba266ea6590a322
SHA256181abf6e560a19bd75cc700de7a031c98f4cda5ead399140f81ce4369b11deb0
SHA512928d58f700bf325c5f34279a655ac1965991b709821506b1d73d6dd3b3e663f65d8ddc2b7ec8ef894dd261c46c6fcec012203690dd18c02fbe1ab1b1fa9fdc3f
-
Filesize
5.2MB
MD5d98562947ae83b5ecf5a48e9780a1e2a
SHA19e59f74a0509c56ede9d9107e115cc396b918bcb
SHA256f94d2747468d5550f32d9aa396a83b5840344194d57459743f873e2a2d3ef4df
SHA512e025a4de71dbf88de1ea6f53a4b6a07d982885e34757572400f6b1a17b90e42014611202e62207e5b92f65955b107167bb7591eaf753f308a511c41a02101162
-
Filesize
5.2MB
MD5d45e354ce74b2d0d365a22e00c2467da
SHA1ff6e00e88e88a07fb161cf0c03822cdf5f35d771
SHA2561823d7f03f2b2ac823f4d1f1945f7fa4ea975124d97e4db6730bf82c1c208a89
SHA512f118ee315aeb84e2953f5440b7bb093c158ba57b01e9e9b6a402fea3817ce14d03ed0d71a5d6ae5467281ef2d4ec830fc82af3d2025ce37ba21b23be934c1260
-
Filesize
5.2MB
MD5da09e563c78fdb853f59a10be474ae79
SHA123990edb3128a5ebad647b47bc5f65f47dfa7fbf
SHA256f1b3f6e3143cb9e06cb04b941bff6f9a359f49571f24b59bd3cb60e7b534d48e
SHA512d7ace056e4a6f1b15da91b640af64dea8e565a1932aa0957b6eadf3778efb8e66d45e96ab3b79e0d225d1726dfdb1c730eda4f880adbc226c5664f42e3b31196
-
Filesize
5.2MB
MD5c3d080ba92df2d5f1b64b61f6e828ec3
SHA1ce94ed521f653f82fae26c163223bd22bf8fdea2
SHA256ac5c855319bdb39adea542b3c13c3b943b5db90cea12f42735462203628cdde9
SHA5126e97966ed4852f001cbfd4f9cca262af52bd74757146ed19dd5bdf9ec875370b5698d904ad32c94a66876ec238aa73c5fb87b2dd22a9ba69598d6ca10932fd54
-
Filesize
5.2MB
MD5659123db3ec1576e83d5fc84e097c252
SHA1b2d8cfe593f814ac68c32036c3e5d63de11c5f83
SHA2569ebdda068239cabbccd29da128a2dc2dd5ecc51a038ed0d0b42446aeccc03a72
SHA5127a5c5b85c12ddf4c6dcf6916f36953d66bbc26584b49381caeac822020af2929ba8bfd80aa1edd6727eaa48f548be6d5eb783d481fc08c49e93aab9a3629ea87
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB