Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 03:46
General
-
Target
2024-12-14_63aca0f86e1e0ba50843f68f1421b223_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
63aca0f86e1e0ba50843f68f1421b223
-
SHA1
5fa3daf44d87ad19861341c4ccff8d857f488d6e
-
SHA256
da57c78e16e538c54d1060d07b21200ee3f67996073fabf35b23ca9b0e58bab1
-
SHA512
8fecbdecfaecf83250496d1c4803f261be51f0372a556a57a84df370f7d0ea8c03d2492ba0e26a9950221209fc92ec325d25e2ea70056330d5afb649728f1715
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_63aca0f86e1e0ba50843f68f1421b223_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_63aca0f86e1e0ba50843f68f1421b223_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HxSoIpS.exeC:\Windows\System\HxSoIpS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zkmqDSI.exeC:\Windows\System\zkmqDSI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXgvkRo.exeC:\Windows\System\wXgvkRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDclKwI.exeC:\Windows\System\HDclKwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFnMRkC.exeC:\Windows\System\jFnMRkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gbPzlFW.exeC:\Windows\System\gbPzlFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QFqBCAH.exeC:\Windows\System\QFqBCAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PvqaYqw.exeC:\Windows\System\PvqaYqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vUVPBra.exeC:\Windows\System\vUVPBra.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIuIoDQ.exeC:\Windows\System\VIuIoDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcjQApR.exeC:\Windows\System\VcjQApR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sptBOyQ.exeC:\Windows\System\sptBOyQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fqYwVUI.exeC:\Windows\System\fqYwVUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jBlmNHq.exeC:\Windows\System\jBlmNHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpdWfCT.exeC:\Windows\System\rpdWfCT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UAvYmeg.exeC:\Windows\System\UAvYmeg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUtCSQV.exeC:\Windows\System\TUtCSQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCjqwgw.exeC:\Windows\System\KCjqwgw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDXJTXX.exeC:\Windows\System\LDXJTXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\snfDJXJ.exeC:\Windows\System\snfDJXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omskZvI.exeC:\Windows\System\omskZvI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5489baf6b69d2cec01d0734850776afb0
SHA178314a01a4879d3931e68f49e54d16cc80a92e81
SHA256918c1594cf851fdf9f8d8c20fe26ea3b5b04ee5710e043f4b0cb0034cf935ffa
SHA512afabaa9ac8700f5f8a9d1beba87d57f90a79a6b15de39dab63560957af92d7b5c414c488391b83ed8afd7f245a05196a995821120fb00ef036229d23269e77c7
-
Filesize
5.2MB
MD539fbd3eb0011f216172bb157c74d352a
SHA1c6a74d4b83e96481b62e52c9a5390e4e730914c4
SHA25679239db8973d7d2b680596888483dcbdfdbbaa710c23de62c964397db229ceca
SHA5124dc28f0fbb49ce7ca1c0c83c47072e0aae99ff9cb547e91bf097124ccbd83f7526702a69c69b4e8940c0d2633407744f39bcc516689e169128cf913317532b27
-
Filesize
5.2MB
MD593bf6fe65a3c9661ea7ccabfdbb4383c
SHA16f31c96419deb26ab446a93d9b0145060789b80a
SHA2562adf43031f87eae5cc3e10febaed7d01282ae32d875ee10351e29f08d52a8b76
SHA5123614de4abb4e5657099eff54f752e7b50759794c13c9317f2beef2037a86f46d2e0f6a9b070781d27fcc91b686afd1ea66259c0ed621b0f245550e02a1eb4762
-
Filesize
5.2MB
MD5245d063c90205b5ab51983f32a7f4ffa
SHA182d9a26ef93178a8c81463efc894af63703fe817
SHA2564abee899859b7a551584a6e7f01e09b46b14d569a1d5831d4f4d0d373840668f
SHA51246170d55f7a38b8ef7a2c478c6c9e069567943db542ff28f1ad324e56cf3d37763f8833a9abbd4cef9ead434bc2be86ae1a2a7fa62f38611162ff33450ed89a1
-
Filesize
5.2MB
MD5d90a4f756f64b315e26ea3260be2f58f
SHA17de543e61fe7e8a5a146efaf290ec8c2892f4046
SHA25686fb5b6adb4b2b44ede997caabd52dc2eac0a14a1a42e2ec1f13a0db4bf1ebd7
SHA512d7e2f6109d437c78da0e68416265d194f7b28bae1947c1af3285fd08f2fe151595fe1876c4f7f56a49a2276fa40226be44b1d223018dadcac644bb3769207858
-
Filesize
5.2MB
MD5f9c105d10b305a9f854b1d6c22000633
SHA144a9b1a8f424b7805c0ba10bc76996ccecc2071b
SHA25665a52fe81e9090a085d4c2fe8a0df1b87107c516048ed3364c870fc49ecde7d1
SHA51217fc36227b18ab3d74f75b06189d6f1ab9a2be478a58ca8e168d52fe5d33e09169f8a47b8b4f9a7b8d575eae171d99055784010ad5bec96be5d15e3d2eab04b3
-
Filesize
5.2MB
MD56c0e4a51dc408a6ee4a7e3cf14e26565
SHA1fcc71aad30bfa10fb09608f40129a7dcf2f4b0fb
SHA256a7e7d25b6f79b827d8ab86d1a5401b77bdbccdb1948846d52687ceb692bc697b
SHA512d6aca700ffe138a1db6cb228413e78b1a1044a1d09148462056ec2c7b313fea5c51e957218b573d5cc187342c4723132b64cb70f196d697f461df6498464a5e1
-
Filesize
5.2MB
MD5dd99b8bcf03e461664c49ab9e7d9f8ef
SHA1d6e0a6cfd3f48e8236dc27d2c9cbe6bad235ff03
SHA256c84298b59fd7ee5015af001660303febdd46727535b21db44be0b95fbaeabf16
SHA512d71f65d85bf4541dd49ed4c00909193cdb9664836f360f3422fb37a30dc50d9d9ab3f4702aa0a385581e4da9fc2c633993458e57130e07ef87ba5f7cc930910c
-
Filesize
5.2MB
MD54a66e50c4b918e1e50d9be03656b0285
SHA1fa52cb3d44431dec1b73d22b9620e6ea58b363fb
SHA2561d7803d232f0040d8b8537dd06da303f23f48e5ce1d25eb55d3ed43974034ff5
SHA512a5a204fd06123293e875970192071aacfe19a72d917b779cc2c3dc0e691a311c55d5dddbe2b876cec81a9df28d1365376208a2ae49cfef6b4ae879d6e53106ec
-
Filesize
5.2MB
MD5dac94a49e4a47f5e0cad30e21f097a37
SHA1e243e2844363df1e2ccc39671d223888225391ef
SHA256a3a70b71dcc2f30d0f02ead1caff52bcd4c63c01319428822a26e9e72819fca5
SHA5120649d6592dca62b53775330e3348b4539e63a91448acd6175e986facc6e22112db5edb9c2ebe87f41e66791fa321260a4639abff3d108cf712438fa57b369d60
-
Filesize
5.2MB
MD52d1e5a01a186146442790ab24dabee0d
SHA16c530657213b2848247bfdc3fb5a862f30ada8c7
SHA256612e25c614503f04abaf287e8db12a016db529849b22d2db139c5f2122dae49a
SHA512ddfece9010e80f73a2cc56d4d8724d2559783e8b0ddda3f543e77223b32b1e5072d041e88a472b2e6af63f54da58ac6e37d82887cea1ee464116a3e7ffb6a85f
-
Filesize
5.2MB
MD531d2fa1526042b9dad5cdb4cb8b1d4d4
SHA13a17cb4c374c29c060b64e178bd014aa6fdecfef
SHA2565776c3af3185227d53c695bb69d52c0bdd1669485f4b7bd196b45e8a35ac2f4c
SHA512f27e448a770a45c744a1de3f44f2bd5a42287d0d0d2b8bdc7ee0df3aaefe0cc07bd058a88c7d7accdcaabb82e3074ecc878db01280eef5408d72c24fdb159df2
-
Filesize
5.2MB
MD53f630a9e602e79e7caf23315e8d70a86
SHA14ed7555d813d48f18a16da8afefa46e55d745372
SHA25653628fde5007638eeb976bb003a11ddab23b1ddc28e441b1861e67c2c3364f93
SHA5127d3d7ec74ec0c8c3fb3f75dd2769470512df4967a2bee914955cd2025967307b285aacab4c9adc50fdb2b87a96f036b87d9a4253f9ba25c3024d7bf77084ae27
-
Filesize
5.2MB
MD5e5056527fabef0dc915d1c66a5f9e1ae
SHA10a79dbb792023da50177a5cf6842b63fd7e490d6
SHA256a214b42ee858bc76ce24807e7e17f857febd4a284acf5cacf52762aa679665d4
SHA5128e1a95373f77e41575fa3de4222dc8a21be3f8636f88aef0b205b4374ff8df757f87d8f56e478e934fe7594ebee28502640c8ea4ab51214e94f7ea123be309cd
-
Filesize
5.2MB
MD5d8b8ea4062766e58610e74d0c20f3dee
SHA1cb5e1c5388cb55f9432bd9500c1d753b9d2c4f13
SHA256aa67079ebaceb7a85caa82156dca1ef1ed92d98e1fcd424d73396400474fadba
SHA512e144802b7912d009c18114a2e2b399d9272fd4e221ed4bdac43ef6c21700637e3c61759e4d3e3e496beb3a90dc20898667bc12e574951de6437d5d8c9fbb3efe
-
Filesize
5.2MB
MD5f05d31d4729c90f3e8322f19485a976c
SHA175356b0583e10520ebf27c307cde06dc9827b9bb
SHA2560fc86422aaca11c91def9412e79ab3f169da238c2274b78982c27c75b86795ca
SHA512139f2eced3dd44d9dfd4630fa211c9fc08c031db8d9d11808756ef98e4c054aac0f459d2bc7d0b99d23435681e908148a29fe7a7bfba2cd606187cd687be8ed6
-
Filesize
5.2MB
MD5d98d261f37d372a3d958a4fa4842d961
SHA12348f7902d958efeddb00f08a5c1a3b222b3dd68
SHA256aade91d02ddf6ba9cb87cef7a573fc3d7cda73078913ecdd541d08c204f6f4f5
SHA512e0df30f025edf2a2d6e67f03853c8a6b1fcd906b40824b10c7d90bed1bbd0b86ee8553feff375096834e94cba721c28f7e46bb6167a0f5ffd8c3dcdcf52302f8
-
Filesize
5.2MB
MD58f363ce32548cd839e497107de8e63e3
SHA1c3f0ff94fb0b7d550737c15a489f44ce2fdab93d
SHA256c591ed12352f5ca9558c4e11cc8cc651b26a4df896d3377b09ddbbe41f5ece15
SHA5120fe4546138f4c060152ce6b6259044e89fa80cbc892e4fd95bc11eab611315f125e67eddb42d31314c2991ac949285baccd1455cbe761c38d72b06fce917c71e
-
Filesize
5.2MB
MD5182302d8986c16f32b2b21b0fded84eb
SHA131d96782155ae2926c6856dd6ce58e0201a54ae5
SHA2562202382a36d5b4c41e7226d59ed070e0c8f43348c32c7a62e9692aae930a2cce
SHA512e10db9e7aceb0aa9545dc475647233e817c6b17654f30def15ebee3fe4a93d67a49493fba895fce71c1c4334245abaa20a76a926a056d60e120ccd31c807c9d7
-
Filesize
5.2MB
MD5e86676296c9d434d1884cc4b3be350e8
SHA1ba550ece0f30082a4f8426c38b510b94d37fd443
SHA256f160d9114ac5144a2e12e244ff7662e559e19a37f85582da6a8cb943ab434a91
SHA512150d105ae2b0184add895d8caf605fb6a98821700968125e19e6a8804e812b69db78a95c9877f6e9831faa83074620f3f45727a1826583ef0d5a48ae13cf4483
-
Filesize
5.2MB
MD57b55fa75f832cc982ec6038ccfff8687
SHA16fff231303e61fa6a7e8adacad1eaeddca2fa2d9
SHA25666fcce7cfdfa519904de9a8626a30c80ee28df1ea7ee6bb41117c1e6870f4b71
SHA51207f67cf0680add92d9e779aee5da50acde382d284772f59ca943239f3b977bc908983fa35223c905b62ccbf76c341dc4c57570db8f5c592ea71124497d7f9661
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB