Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 12:43
General
-
Target
2024-12-17_0cb672eaa35f77f9841998cdb3d16b23_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0cb672eaa35f77f9841998cdb3d16b23
-
SHA1
9f316a9b75072a6eff4e13a45efbb6058c2fdcc7
-
SHA256
966bf2153454ac38d964b05edbcf92bcdfeaf3795093405986fcbb9554c4389e
-
SHA512
9fb52256028956cab1c01ddd3cb965519e0ccd858c73aa679c8e42b556ec062f4486e8b8041b4c05a21d167b2634a90e3a5347557f2077fedad3fbc0aca1f3f0
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBib+56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_0cb672eaa35f77f9841998cdb3d16b23_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_0cb672eaa35f77f9841998cdb3d16b23_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hsrbOIv.exeC:\Windows\System\hsrbOIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qMLOAyF.exeC:\Windows\System\qMLOAyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RXZUmdj.exeC:\Windows\System\RXZUmdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INogMBB.exeC:\Windows\System\INogMBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXgjQyv.exeC:\Windows\System\BXgjQyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUOEVAq.exeC:\Windows\System\IUOEVAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEKrVMR.exeC:\Windows\System\OEKrVMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fCgGVpB.exeC:\Windows\System\fCgGVpB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aEhXMFa.exeC:\Windows\System\aEhXMFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XsIONfp.exeC:\Windows\System\XsIONfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbbvQBv.exeC:\Windows\System\WbbvQBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnHMaBS.exeC:\Windows\System\SnHMaBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSQVQdD.exeC:\Windows\System\HSQVQdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjgvjTl.exeC:\Windows\System\fjgvjTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RpbtXte.exeC:\Windows\System\RpbtXte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IOlYuCq.exeC:\Windows\System\IOlYuCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrhMeyn.exeC:\Windows\System\zrhMeyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVTgEMf.exeC:\Windows\System\iVTgEMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TKyxEIB.exeC:\Windows\System\TKyxEIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RpQZibT.exeC:\Windows\System\RpQZibT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjPikKH.exeC:\Windows\System\LjPikKH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD567c5aa507ca439227e51542826d3d3cf
SHA18d6429aef0945a61760e20f782fb28653893938f
SHA2568ad237d251851896761526fabb401dcb590126d7488e75a51687e13331e9a33e
SHA512b71f33ca4d0c45012e1414d054a40e566a1a7d1090fe679cdb1fda6c1efc2c9feea07248365f047d1397df982a4aed2ecf08daade7b0fdb3ba44a626cecac077
-
Filesize
5.2MB
MD514ff25e12d44db3e5b2126f2d2e6acb9
SHA1f4d62b7de193591a0103c9f0074049baecd37ffd
SHA2563148dac424ece42a8bdb0673e4aa707a87749c3a27fc56e18bd7cb051fb0acb1
SHA5126606b8e621c32bc4e6eb1d524fb0da121929d42020e2eb22ab77c209cb131fb51e4aecb6af0c2b7e82e61579dd40519a5494038f3b1264475898b79fad6bd5ff
-
Filesize
5.2MB
MD5407e26b270ab8b340458f05e9c11f23d
SHA1fca2c9ad5c901312cfd8124709582d3af0702757
SHA2563933c1ff665480a281c19722e46d9c159e0bc299c7390efc6fc38cf4d603f699
SHA512fd2827e52c30b723f110745fe2a89fcd335963dcc82be1ef46976eaa052abc8e6d017bee88b1208e027b4dbfd27e6a0bdb7936d6c237d70557e8829ade8442c9
-
Filesize
5.2MB
MD53a7bc6b87cd648a9a83a3a7cd0dda0fe
SHA193a1909c44a7d48faff3418cab582358b61deb46
SHA256fff680f37db852c6191442c4f4d21ae1684e8ef9003fb74df284cff33dd3129b
SHA512e2b9f08fa2bb9d0bc3565cfd599dd517b145e39e7529776ca569ebb91ffe3a5e3de00b25f57db40637f88d882b276846eabaec087a2cd69a69ef1774fd64035a
-
Filesize
5.2MB
MD5a31a8b9605d787ca619e3a5bb6afd824
SHA1b0681fbb9b67e36b10317bf237421ff402d58c84
SHA256e3f769902ec03bf3164e029a6fb0b0dab5e6f4c42e6593a942804a42de9c04b1
SHA512434c83e62e0b4a7d6d2ac2c8fcf3fb4df12c0e9db9882694a1545968b2e87b746b96b0a8278400f353de051c8c9ecb34df3f449f5255e2bfa2a2a7d6b423aacc
-
Filesize
5.2MB
MD5d8d295b7fa51289001799107decec673
SHA14e3aefe019db729f5aedd0319bdf05e8e6d1aa6b
SHA25624c19089c0a4cc9310a6bd547bee22dadd267273428c8b2432836ffa634dc8c1
SHA5125edabde1026e1c6fc768ae408522cb112612c3737221ad1f758aad9ed287c219c7e414ce7ac704a8fff2aa739f6fe0752c3169baaa64fa81cfcb2919834aa6ca
-
Filesize
5.2MB
MD56bb43e329ac26b72a9c5512f30193db0
SHA1d048ff0ce1de4c0b49e94111396ab263a7ed4bab
SHA2563693731c89588802a8726c83f016a700645a6d7de3c7b34baa8b2611cd30567d
SHA5120327073631fdd99dc07b6805f968e783a952ccb3ccec8e1183bb3a047eade0e1cd25137803886547d6a47ffd1cc92b0b3f4df4bf6634e1d5be28e8fd96d62b2c
-
Filesize
5.2MB
MD57f2b8a8f33c35a212f1b93285ab2cbd9
SHA1c4a3615a60a1fc1b58664b8778fd4d3d32d21bb0
SHA2566326ca143650dc7700410d95ea4dd50adc617f1e21b2af3077a8c11c1d3c5af0
SHA512a25c0607cbe34380e378d35cdc51668279b47e266bfdb8caa048b4b54bdab366912345ece6d3cbf14c5da23afaa4c3f9c56aec836739d697e01a3b3b3989176b
-
Filesize
5.2MB
MD5c0fdc134b182c027a3f8511f67c83aad
SHA135e45721e029cbb1d63796cbaea41bcfe16968d4
SHA256faf61a5f002633c1d91f122ba45965e516ff191825942dba3c70bb6b619fcef7
SHA51203d79684953804a086a48d79aebdbe312e8900fca2d37aef7910800863a5b94ef486eb1972a0ed7ddc79c4f211447d7f28d524b0d0889c419169aca7b86509b6
-
Filesize
5.2MB
MD5cad89ac98f7cbbaa84c1d6220e29dbfd
SHA1a2ad3042ff3187a272e3df392bcba9a30081be1b
SHA2568061aacb423326970f21389bf285bd6aae115a1b852e75d3a1c496b6c03df4d3
SHA512e8b5b415ce3ac6c938d0bb375464241a40a3d13fc7649e703182cd6d6dec0ef596cc98adc30a19b09dbdcab9af732b7cbe789145518fc77e0ffc115dfe7feefa
-
Filesize
5.2MB
MD59683507a5625ace5dcda221d27dde2d2
SHA1f68cb43d62a9a6e88cf31ce3b43b2f6bc9b00892
SHA2569cccc61aadd46c352b47a0ff6cd936901ef01a7d8a7a63fdd2050073bb9e7d93
SHA51244e5afa83bf663e93fab49cdd1f78d4c3c9d3f90f8c200641c703d1b6dd71b776a2b78391bc89a7d11229fcca66e2bf198842a3cf022ad317f283fc26267a899
-
Filesize
5.2MB
MD585c85f88bffcd7ad794ef510565262fd
SHA163d5a87bcfeeff2e89ba35efab07aff310247314
SHA256ad2f292a28fc86a7af9fb2da38ef64a42f27382d8fae7cc799c8c8e86bfb1bd7
SHA512ca6d3d9bf1220f8966a6b4566659e9abcaf09fcdbb014cbc4708776eaf304bf298a1d14b083c1d945b026301dcd883d128a8bf5deab1709c53670d9955895262
-
Filesize
5.2MB
MD5fa3db3247026bfcf3d93da2dc4dc8245
SHA10eb8d9ab7e07d1e2b4b1fba56d3a0b32915506bf
SHA2563d5c55e69572a7c5f98dfd7a817fa93259160a2fec448b01a86bb79160b82ee3
SHA5123d726e9ea3487e92f692bdb8f92ec7e7696b63ab0ee2583999194902180cf14c3db7725749406a971f283d2a4eae2cba5dbb4c771a12c49a3422f59f739faa2b
-
Filesize
5.2MB
MD5232ddc76c2d77fd55e9e4b1951945e20
SHA1d109356613d616a2120556351abe1c6d5323086f
SHA2561813e6add1138d22df4998634b27a4ffe971bc64930d6e38cc46ec455e23aa31
SHA5126edcf7c55a0af4ce50ab5961783e976417f0061c271d70a5cb73b5556f62b6e7911d8174a603f944310653d2b41c891236f848d35d33144579f9b482b7f96009
-
Filesize
5.2MB
MD5c2d2134fd830be81a6f153e357f2e6b4
SHA156966f990a6039754bb03848ffbeeac69f98fceb
SHA25697acc669f04ddcaa03ea5562ff975ceecd659ef6c2f005d1b53b74d899b0d1a2
SHA512db4d301d50535c9b7afa5f619cf248cf88a3d473bfd87e14c17275bcce47db65a6a8056f9dfd4716e8bba5084a656bcd65d6428da031d1225beaee66a29c3f4a
-
Filesize
5.2MB
MD512eb2fbf1dcd87d7f061060af08648cc
SHA155edb4712c991bad09bd8eff8b088cb843b52872
SHA256168c5dfc8fcdfa1149fd0f478440f6829f6a9a8c109877ce03724bd79d856f0e
SHA51278669fd983afe555e6fa196e501e3a91f468dea6f9c2138c95f170d52fa74afad71b8fe31c4d6eda669ae37119620fcf25fbe845ef7485ec7a95a98606081246
-
Filesize
5.2MB
MD51c9a632a81a098f852addcbd4193646c
SHA194b3e652b837c18bc8383715fedf12eac7899868
SHA256cb12a0d1b5eb66e9979e49a4bc82b69f101704e8ffd38065a8a3951ab4095899
SHA51295e398b211b3a29f6b9defbc30476a23d3a12299a6c404411c44eac3725d15e6a04489399348f17c151b4fa4dec90a83546c115af003b20ec22a517030b47ecf
-
Filesize
5.2MB
MD571a5226cac4420709c57555ea5984f5c
SHA131e96b2eb34fcd8aac9ad4bad35f939575f0efde
SHA2561afea29453ecfdf52b2cc880f77837efcac8e5675824c4522ec721ffe7154af6
SHA512e974918e9133c37fc29141110ae97b3f4a41548baab359364a8d2919addd70a918279bafe105415738abbf365269f8945bce6597ad27e95d019bdeef00d7df0f
-
Filesize
5.2MB
MD5ffc1c59c1dcdb17f896d401c525cd977
SHA11bcd887a91e809cf0c5becad65d2995355416a6b
SHA2567003ab7a7375a6771e0b391fb88174eddd14fb68488fea28326bd2dc1be8a1b5
SHA512215e5563aa04984e0d5a782e8f6750a4102ff705dc3f3d8e5c73ec686d049fda13f9edd8ef30948de895482a28ec264ea84e94fdbfb4808fd783619a3dd99dd3
-
Filesize
5.2MB
MD524420c3fe4116dd1047f135c5607d75c
SHA139819d1fabd1d8b99bbd2d43e29d1310e45a983a
SHA25603ae18024518249f12a93b9f33b1670ad78f0bc352ed74e3b488f5c962f6e087
SHA5123eabf9295ffdeb8f809822d700a68f29085eb3670b7b5330da4513d50b40a31e1e98170c16fe6d621f00593cbfbc7ce675d4b7177724c48c48e8c174063050d4
-
Filesize
5.2MB
MD588bafcd4f34e85c30b1a2476823264f9
SHA1c27b1c91302c14dc8a7099b665e0d8ca36dacb10
SHA2565cd09fc0a518274703986b5a38943f661eeb8260d8fa53319e04409726c21555
SHA51255dbb34861e017a97be224d56810a08f8cca1fe12419ca22bd950766a73596a90c165ad9a378068e9e57b225470338c4ee77db8ae8a100152824ca0e9fcb82bf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB