Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 03:27
General
-
Target
2024-12-14_f1da04412b209f601ffab62349cbc506_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f1da04412b209f601ffab62349cbc506
-
SHA1
1f220fee8ad03e515388ff072738d917ff5fc92a
-
SHA256
e11c5182a5edb8ab859977c3e53b7e283ab147b333dde76303a07829dc5a0795
-
SHA512
470da31e145b3354f20f1bf6613533242f317e0927276f56b4bc304ff2148766b93283f52a28deca73973c2c38b3ea1e249d80a2d92153c1ef841de280602e0b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibd56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_f1da04412b209f601ffab62349cbc506_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_f1da04412b209f601ffab62349cbc506_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yaRwWUw.exeC:\Windows\System\yaRwWUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNYBYWH.exeC:\Windows\System\JNYBYWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKfDyaR.exeC:\Windows\System\mKfDyaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kiAzfOR.exeC:\Windows\System\kiAzfOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XLZJncd.exeC:\Windows\System\XLZJncd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GruLwZO.exeC:\Windows\System\GruLwZO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixKoKJw.exeC:\Windows\System\ixKoKJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHwZtHs.exeC:\Windows\System\zHwZtHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqZTWOE.exeC:\Windows\System\AqZTWOE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZCAitNG.exeC:\Windows\System\ZCAitNG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Tcqzssq.exeC:\Windows\System\Tcqzssq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sojtpuf.exeC:\Windows\System\sojtpuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpnfXxp.exeC:\Windows\System\gpnfXxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CunTFiF.exeC:\Windows\System\CunTFiF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QCnSGmt.exeC:\Windows\System\QCnSGmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjhJosY.exeC:\Windows\System\XjhJosY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUVSKFC.exeC:\Windows\System\wUVSKFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjpCURy.exeC:\Windows\System\yjpCURy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpEggcJ.exeC:\Windows\System\LpEggcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fynjOCN.exeC:\Windows\System\fynjOCN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UCeAMdW.exeC:\Windows\System\UCeAMdW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51031da7bd4a2cba48472bcc92f38b354
SHA10818cb1852b6fe161d1ef6e5c1710346c7cae76d
SHA256cc095fc4b323232595fea72c68b47c8fabce73a9506b1f73f43a3940e361903e
SHA512dc306b86272d3f29a5b2b2351d902ae9e457b2496cd8e787d4bce43f87b92d03438b2620897a37fe5f0edde3b5230bb06450ffce9e25306d8735f93d2fe77e6c
-
Filesize
5.2MB
MD596437b6486f67d2dd178eb2a072f44cd
SHA115f819723faae217cca055325b602c9c92f6ac23
SHA2560b66f5506f143437df64cc0274bef8c4129b485d1f9739d352d2f79456e290b9
SHA512315445cfb9f6507a42f95bc0476325af11d5c22f79946cd72a37e9d1725a745699ac035283fab8b9f6f8440cccd477178505ee019a9491a027a29179f2cce815
-
Filesize
5.2MB
MD556d394520f88d9bb64ca456ee8999452
SHA13a0204e9252c3e71cb3e1757a537bef6572b2488
SHA256bb14156d5b472228cb1cb5e2387fe0a87b46ed84a1bff127168bf57e6487636c
SHA512c02087374f6b93d04eda59822b82017aa0d83888038ca03b1c4488392a1534ae798b741ded453e2c052d63336fcbfc9f0c4d0b2abe367b27acffd9fc0a3f9988
-
Filesize
5.2MB
MD5daf6f3d8461c14cab65acdec815ad27e
SHA171aef0044e11aa04a4ed2a2f070c731265713fa2
SHA25688096c15e6ea3f73894526fd6f9b44891499923e41e34dae245f52fbf8ba8af3
SHA512df9a26ceb9a48d0882cf2e46c99aa665b95d9afe10ddb7b187c317e1aafaa0b597471b52e1c5fa416547ec37eb87aa4b979aa8c30dc9c0cfe19238f6b6b0474e
-
Filesize
5.2MB
MD5737bbacd4b93c98c8613ea9ba32b17f1
SHA1c1f439bc1942f084096a14adb74a2f27dff5c384
SHA25627067586eda6ca2bcf3eb7370f41feda9a2530c650470cc55367410c03ea1ec4
SHA5125c9d7c2447ec1e95be9c44508488f1ed1fb82905adbda255320da251605fa34e5c122c0580c2773ae44fbd972430ffba1ee04dee9d7f8430a6dc8780843adc48
-
Filesize
5.2MB
MD55a18cca90163a69582d70926b99a57a3
SHA106052bd8676c9d1896d4c26081045d12e45a88d5
SHA256123fc850964a68e56eb94165db363b0a2530d36362682d4a4364e715923032e2
SHA512f58796763adde642b48d7a2f2fadf79531fa2e123c2d46cb9aef09bee809d57ee02dbbd4da9ba53bcf152cc61dc374ef541e8b85d56be0a7bc6fb5d870ebcb81
-
Filesize
5.2MB
MD5973d891bf095d7e87877466f43b5aa0f
SHA1da130cd106cab7ed7a2c8850972f4b5e2844c5e3
SHA2565ea0e802634a2e2060a5fa20bf6effe9b112b7d0aa6417b31e472a330bcbd55d
SHA51234c1ee2a7180b3a856ea7e81880a783e9a2fab1ba67ce8ba71efbdcc9f4289f2ee3e63ac79e8e8ed05ca9f95d5659fb80f448480a1b7816b3ac632af251e90b3
-
Filesize
5.2MB
MD5a34e841bf8b34e9e29f9d4371b559b34
SHA193edd100da2370edb69221b43b25b90ce5bed26d
SHA2561422a8aa352e62935b69c40ca9d824b4db21f7c0b2182b5cd548913003e82a7c
SHA512d139c6563dbbec7d8ad9bfb3e73b115c70791f7581f0bafaf5322c2041537e0c490745844e4151b203fae390923ecab41e0368a9d1f91482d2f1f27587ab515d
-
Filesize
5.2MB
MD5ba373b2f14909b1e652855abec06c328
SHA1c3d57bb4802f74924394d05f56651fd00b280bbb
SHA256c602f0e712f5ce2b14c9ffcae99acda66e44259ed7c9fcd4274b9f4a092b6615
SHA5126e53394a636687fe0340cf9eb862306cf046bdca18efd734248b98520fccc71c58bdb8851791c9cb95b07b25e3e3598738d89e5a5620c63881b6a08f4e7ccd34
-
Filesize
5.2MB
MD571e36a5272b6939f8540f51155b09a38
SHA1f282c5310ad668171afb0044a0bddbfa381564c3
SHA256d4ec0c1edcac603320369b6b34499a429032845d22d79eb68fac471df29a791a
SHA5127a14fc05267e55128711b4c4a7abc2d30fd00fb9519988ea4396f88daed1ccb7e5ec6ef60a3bcf7a01cbffc098934e53d4a18d636cd09165d1660e3a4875f998
-
Filesize
5.2MB
MD5eb2c577649793f3f51ce73bd3535e419
SHA10fb850da3e97cf5a61c793cccca9848f7eab410f
SHA25658963df40ab13c89bba6c61d510802a9e1213d4ecd381bc278468db5225c3253
SHA51271f8a0d84ded0c7b31376b97d753ba2b1e224e7230de4bcb3cb7a8a9d12de5b530064a26617ec16a3391c63f67df3ef9a60077a3cf7b943f2c274f8334b36116
-
Filesize
5.2MB
MD578f1689ee5d4aff51346f1bad63c6e5d
SHA1c3d6ddd19fcd536727fa0d6d93db97833cbc3164
SHA2567b46305b40ffd29168c648a1bdae04ea4c9ffa8996529bf274dfd606e1373779
SHA5120677da79a4d619ab9d8c0f4d071b834b52d4428314fdbdba98eda13fe3eedfe4f871ede36123901dfa3f37a74d371916fbe5557e138ea2c2d4785edfe49b6248
-
Filesize
5.2MB
MD525a7fdbfb77f70e555c5010b2d4540d4
SHA1f7136d1e014e283df41e2638d82809d37d05e16b
SHA25623abe497ef927e3a83be19f19205df9eefb5678551943e9d263a0eade8a0c499
SHA51245006b40507e463a3c23ed201e20921ea45d828746da0837ce23aec7e251ce7a30941af90c85d85bec4af5e583454050c50d0751e6601a000b50b6d3eca62af2
-
Filesize
5.2MB
MD504aee94796006b51f204f4f140eebaaf
SHA1055cbb6487b1c4d48d8a3b0ba0c8a2d56fcb000f
SHA256aa6751fd39ada16d7cf0d46fb52d3421a595a6b1aa18304517488d6f5fdbda37
SHA5129c32112fb5989ab3564e42dff091d12006106128fb945ed85b04e04f0cbd23a1ed3baa66c97c38bb1442557c37ebbe02420aa507cc0929e08017f2dd21c8ff4e
-
Filesize
5.2MB
MD5178f2ebec7ef435bdc75c105b2b58445
SHA179656b49f352c665f748a4204a1e11471bc275bf
SHA2568987f6f9d3fc3255b38bb0456b0dd1e6238727939c8fa080ed9263756dd50143
SHA512dab54dbfb259b2bb990c048a117ba08c2e1cc7322d9b7e5dd5556073f98695ba68db09bd515d25f7b613c3485900476ac167eed2d7b30db3aa4dabaefedd9075
-
Filesize
5.2MB
MD51f24966eb29331c183406f5373850cd4
SHA17126e334c0bc8302dc43684d9a62c2bb19c4bade
SHA25637a3c8b25101ffc76b40afad6acc0c739db2ba476232ddd3cd2f527f80ebc867
SHA512c85e431ff539989e5cc164793a5960eeacb20b68f6fde23512407168d61d11dd1304458837430beeb1c51d7d108214bbd0348113896c8bbb58d528aa53829388
-
Filesize
5.2MB
MD5644131d1d231b828f531fea00cbfd995
SHA1b1fabc160eaa1f6fc646fea3e50020f8faddb69f
SHA256451cc62765487463badd4f3a64b29cc0a76435e51c68475979a10e526203d008
SHA512054896dc3776799532058c38abc2c720e13359f59fd7e3916323449d0eb978141dc2fd868047cd4efb1712fecbca4cdab1f423d620962b929ea6a9f67d79b8a7
-
Filesize
5.2MB
MD502da44f67122b6794089143375426453
SHA1eff5ae667fd4abe7adb25ccffe4275c98ca7e4c9
SHA2562d8920c4ec41e46e24989b6330fddf84f939ec370561896cf4a96c76b8e68647
SHA512b8aee5bb07648cec21640de2ec4a2e14a4b25e86f56a535099a2c84c10544f054e324c5db52e670d233bdcc36c0565b85bc466c1b42fca2c11fac69b1080ff96
-
Filesize
5.2MB
MD540986a3467233bde3e9df07efb2cf4c2
SHA1253cc0caea63306b46e7238c1c8361245f305b65
SHA25631c0bb43941c9588267656539a0c8fd65610aa7860850629529bac0d871eda40
SHA512eaaf1ec51c34f039bf61905f298d527404f53d20c0e773572f69cf4af5d9ff750319db0e7c3f75db9f2a2586d0e374a304561605fb15bfacad9597b077b12fe9
-
Filesize
5.2MB
MD5d4676491ac9f2eece816cf706e90aaaa
SHA19cef10dd28b7852520d2d0e5faf090bf83818c12
SHA256d7a966ed7d24adbed1fdc21e6b830b43fc045154361a487205ec4058a83ea15d
SHA512798d7814bf778f2e8b05a29e856f5b1d34cf29a643940820c65fe37827df3e933e13ff0b34f9f856df209186a8b3207f27ab46d40fb0f51cf5cf4256ff986cce
-
Filesize
5.2MB
MD5838c120f6b7835107fb87098eee436e7
SHA1212766879aeb2d440e213cb114ff848d0f3a7eb0
SHA256eca624c9b72d31cef0a7204966ff73dd64e7883b372a38fef7dad4e8bb1b1e24
SHA5128c46af751a234a917e42b8eabaa4043025e0366e0b338e16a81920ab3649515a832904b9f354bc08ac01a4023167927fb89cb07b6a8e7f961157944315eaeab3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB