Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 12:46
General
-
Target
2024-12-17_5bc094c13b7c1efce25cd8c1b7aad886_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5bc094c13b7c1efce25cd8c1b7aad886
-
SHA1
87c6109dd98611a20fdab3fcfb5a2e1cea6d6fa4
-
SHA256
96f84bd161b23a5f89147e3d49763d5c2368094d9f686509774b25181126b05e
-
SHA512
96b137509f8c0169c5bfa91527fd0a044f3a6595f9beb35267c0e4d1b4f5ce8be5208448db1d7311a32f9b6f3a9d80785f5cd9d7a0aaad7e478a645c4a9d558c
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBib+56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_5bc094c13b7c1efce25cd8c1b7aad886_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_5bc094c13b7c1efce25cd8c1b7aad886_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HufBdez.exeC:\Windows\System\HufBdez.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\adnSfkP.exeC:\Windows\System\adnSfkP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUTBYpK.exeC:\Windows\System\hUTBYpK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIYJMki.exeC:\Windows\System\IIYJMki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxJAMEE.exeC:\Windows\System\PxJAMEE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NofmtWb.exeC:\Windows\System\NofmtWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PTjRoFk.exeC:\Windows\System\PTjRoFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqJWSxS.exeC:\Windows\System\wqJWSxS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqEYYVn.exeC:\Windows\System\RqEYYVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKeWFyf.exeC:\Windows\System\yKeWFyf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DxciWyk.exeC:\Windows\System\DxciWyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyJKJyY.exeC:\Windows\System\wyJKJyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcumfmH.exeC:\Windows\System\KcumfmH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvHsclO.exeC:\Windows\System\wvHsclO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdKcIng.exeC:\Windows\System\AdKcIng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLWrglm.exeC:\Windows\System\aLWrglm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dvISOkq.exeC:\Windows\System\dvISOkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hLsgZSh.exeC:\Windows\System\hLsgZSh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ybtnfxp.exeC:\Windows\System\ybtnfxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FfTxwEf.exeC:\Windows\System\FfTxwEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwuSblC.exeC:\Windows\System\lwuSblC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51491b0916e4f77abfc4a12dc0e4f8556
SHA105e5f8d6264b9567346572b6d2a84700c1aa6a70
SHA256cd56288312b98624be3ae5a8bd670d92ef01293ffe72ed7ab53360e252026c39
SHA5127955b4a70545ed5d48730c728e0796f9e8bc33a30f405b01ca25f15259b39e35a22549519c3079dc2d8b37e81aaaa8b738a4dcb9a0602835700f7f6e32ab64eb
-
Filesize
5.2MB
MD5f8779fa2457535e36e2a71a444a6d0e6
SHA14589ffdce82cb112717694c27a4e359791ecf329
SHA25617d2df93eec86570fb9498a9c63daa164cee5c7709b0b9e0df2ace7039015c90
SHA512991b48609e9cd0adbac97c7c1b770436c19514086e71af09f13da53732c6604ab57148bcd1ed345138f544cfcf25b66f3094b67f1f752e00566d0bddc86f50a9
-
Filesize
5.2MB
MD57ba48fbf821a4df9c36d0a35ecf86961
SHA142a8825745f4b51e6464c91304b7407e6b3c4922
SHA2565a2b8c673e7138f627edda6c7972048c37b1f734e169e9a6cfefc271680d7a40
SHA5128237af693fa2f65188ca00b4fa0e625b1fafcbc762816d8f91e4b700042133562d8063032fe149bb2e1b3dcdd4bddc1cf9bbc3b40d9179a80fab7c6d1f0705e5
-
Filesize
5.2MB
MD5e458019b9f0ca6e98f51990e16e6de4d
SHA199c8f93dabc12de95299d769fc656d65ade5549e
SHA2568f65f27712000e9cfc751ad430541503d35ec4ba5cc984792fea6c1d1ea36795
SHA51281c118ce1f877e9681f6755ef4264069e285f7f99cec45b667d66ccac4a13ea80725822de86798a617f80d358a1e3fc19dea0e7f56b4901d139f58959dd2fa10
-
Filesize
5.2MB
MD5e2f7e6cbc90df02ae8bf8fd562552161
SHA1cd1f0557cc960ffa1eb7c947b5657b5bec0cc9d8
SHA256e7bc969a3331cdad1dedf7f97fd218084c195abace7ac6a3b9364577dd9d5d1e
SHA512cc395bfbd61514f4c11579726827fff502be3afcac72d5b7bdedcd424e5809673fdf9dfae944c31b0367082e17ddec791a3b18462ff44c522cdae59e8aea0891
-
Filesize
5.2MB
MD5b98baa7c52902db317c90e9d5d6f4c85
SHA1c6e778bdbf8ab5b0c2c1d342e9a3425821a3313d
SHA256c86f2302eddf5fcf48ed7a2b9ba74275b94f77bf41be07587a177137804622b9
SHA512204ff9fffe500abce3e220a8024ad6ab9076ed8255d9b944add1063e5156c29c5d7b1060cb3ca3725ae7c94b7bb70015fc6794d0d6ae620ba8589c8aa39db5a9
-
Filesize
5.2MB
MD55ef4e8160a11fa4c55ac5e895e98aaeb
SHA10b7edc447640bc99456b40c73b0b97e3da31941b
SHA256d6ce57bf809bd3bba9307d8ceb1906cc2987e3c4a6a44a354d40eb3c937cfee7
SHA51276c4ac823584d3cef02e1727bef87ee695dc46dda90e27c3543092d30a6f667fc6cb4f38028cba5de248bd45d7551bd4c0c444aeccf11a66eb701807f2f4c7f7
-
Filesize
5.2MB
MD56b7fb66644ca5c106def5dcbdc7e4be6
SHA17d4113e00a670d70776e11f52648fae2f56780f0
SHA2561446759f2647332484116ef01807e9bffd7fc9bcabf5c770ca07e6e4f9ec1fec
SHA512e3bed7b337794a6e80fea438dbbced60aabb586deb70fea522c58e7c8df0a1b0d610c897931d3888e6e9383947025de443f4d8d920cdc1a452f8b3110b5377e2
-
Filesize
5.2MB
MD52f31472843baa3a6bb4df555ae0c4b54
SHA1c6b732179033506f4f6ce72c05ff05c4a7d707bb
SHA256994f885d4048f012d5037a43742288cac0e04fbd55cf69a06d5513f16d242f26
SHA5122fc338221e163a96b97cee969dcf8decd369b19d4109f0a4b5910c8255eb2d74b689a3dd146711dbc5cb98e22972a740ac4dc4ff9b8f3b363afda035df9520d9
-
Filesize
5.2MB
MD55ae4247cfa8660dd7335baaf7a19b774
SHA19e4596967b1aec47fe55327133e85b6d36fd6da0
SHA2567ef86538e375f6c1a07e2a75e9d45095ae947fac10a90f23a863c3a33ebaf253
SHA512612ecce0ab2e1ac2559e80235430164e2c1b8024c3e12a8b8fabf218ffa3fe7b73e311c0125c198ab6c063c7c0fb1f732c65421ab6516b9db95d97a25e2852ec
-
Filesize
5.2MB
MD5ef90c738e06779d6ed3ec9bb99dcb039
SHA14f83493dab71d7c8acd1803a23ac2e8c1459ed68
SHA256ad8217f383c27e99c8eab9069be79add4994433ff95a0e772d46c1f02b6ed217
SHA512cd04f8e88201029643ba5bb55c1451ee4d20bddb6f8596e9fe30c1152bf05734e355e50f5f1650e9ba55e5fa41a69dbae1e4eafd65472a1c8400b015a4f68dce
-
Filesize
5.2MB
MD5fc94bb15117f8961d52efb9cdf3a6cd2
SHA137f00bc0ed8c58d7af42de2ba164d986a6e7a171
SHA256f841d496910b17897da1453be1cb43e16673f3d05cb5b09fca12376298fcfc1f
SHA51261422aa79a45596d4fcc7dea6cc93e8bac7b6872a0b67604b489088ed8fac1f66bc6f6cb6893b2c3100bd8986a29648750d7ef742904d6eda9283c2ee91e9485
-
Filesize
5.2MB
MD55c72df67afccf940c4ee4945313232ee
SHA1eb733c48d6683fb65f86f7c1541104616eba481e
SHA256a7540a582dc47967423884f4ae048cf0838f48d7ce3ea6f4850dc6986f096de7
SHA512b8488b5f68c30adf4ea9a5939b56ce1b6dd6ec9c2221d3b2d826fe2a3ea1ac55026208dcdc3e02003c66324c804d428dd6caf79269c1258deb7f487668601646
-
Filesize
5.2MB
MD58781501b9ff4fddf959a8849b56c94f1
SHA1244f60179f41d31d26ab4b48cd1bb6b0933cf1b6
SHA256318b81988011fb38c59b4ea87a432e9a60a93349c61a75aed4bd107b06a978fb
SHA512c03d68e3eb5efaf183da8e6a1cce31008f24087aa6be6b102894728e0a536d423968e0ecf71a59af14e63bbf9f7322c19923d02a5bb9ba5ecd321fc614a8719e
-
Filesize
5.2MB
MD5dff5e19b07fa3a3dde95c33211cbe5c1
SHA1f4eb77c4454eca72edfb4e6f064e2afa6c23a336
SHA256be31d7d3c33753e615e3fa02dc7a60bbbfd95cd9a397330bca9a56ef62b085d3
SHA5125070e1d31e57cf7a8d393e46e80db9a5456435f55a60880370d548d6adde65ceb59f67e201b74aa3e4438b13795b8e7e3aa14cdb1c09cd1bf17502951f7feb33
-
Filesize
5.2MB
MD5cb79b5165407f9d2470e4f92b9c970bc
SHA1e451272013b7f05ad63f1ca7cf97f4d6bc6505b8
SHA256495b2271054011a7fb6fe9c9e4e9dcae052bf459a49e9fda44ac10e4a1995e5f
SHA512a25b73062668336bceb84798d182f6bba2875cd285beecc71dbdd99e795fa32897d45e6bb07fcdfdb219a97b60162dd1122c8c7f2abad252985771a68541710d
-
Filesize
5.2MB
MD587a058153dcd5b468a728a5809be0f8f
SHA1bd76855a9bc0fea8434d2f270266cb74fc999701
SHA256e1522696cf544ba957b38bbb22952005f6eceb44f46601d42506ab8f18308b08
SHA512b61137472190d5c3f76d28bca3ae400df8d594c1bcfc5eec62affae2f76287bebf92018def1e93c33eca30668ab42ce254d04a22dfc981647bae53db4c55aa19
-
Filesize
5.2MB
MD5b43f9980cb31fd8a0708a049668916de
SHA1159fbeb677b83bf955c89483429f51f007ece646
SHA256b7c2d6f5a52fc635ab9b3848c69f2f681f6e42c9a4c10d32f3e3926727b1f27d
SHA512429a633e8b61eef71c48f76a12064fcf9901b216eadf11f1bc4fbf9fda3859d996b4780da0aaf26347e57e04067569329d08ae6e947786c3a084dad05648869d
-
Filesize
5.2MB
MD54d302d7d1daebde35f6fb159bc32371b
SHA14ff53d55a5c1beeebfcd7b23dfd88c7a6da9fddd
SHA256a46367578e87ef042141d214648c1dd3ad531151efcfe3d263576d0794a1af2a
SHA51285c7c2b2120eccb7ebe0e0bff856e3722a1205d38ca37c36a00eab39ea845bb470a15ed280c25c22f560bfa748c551db4724e0253e5842330f64284c611e598a
-
Filesize
5.2MB
MD52f35a7a7510ddb149fca78005b904e4a
SHA1d4f9ec8bc491c2e567956f1c0485558a4080dc82
SHA25697bbeefbb88fab40a4ac74948cb5b32dcbfd79b816da130e8d68ed3bafc65c49
SHA512d63d77295755ba478c86093005f7e6d6020fd52e0faa6aa6eb0a1eaa0a49a9a747607c5a968632d0e16d600c7b6478009de2a4804d23e14d9139eea77a9d224a
-
Filesize
5.2MB
MD58e46fc4b757779684fbf9763b0f82435
SHA1ef1c699b400148c5fad4045b9c2474f6ce64034c
SHA2568262001cd01234e6fae0eaa34117d7d57f90b5c78f633e21f44db1a2006f1886
SHA51287ea0262dd4526064f3bea488f07cfc30dded20aa36ee1e47050a20f9bb6e57fa5672e0862ee162785de67ee9be34212b41318857078569bfb089e383abbb0a5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB