Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 13:54
General
-
Target
2024-12-17_64d4c8424fd3174ff82f2819fa22969d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
64d4c8424fd3174ff82f2819fa22969d
-
SHA1
0b5164721ed863025d6da85d905ad483646f05be
-
SHA256
ba3e61205af7c4a2ba429e82dc8fc592ceceb64f39d68db31962c87295f0211b
-
SHA512
56e1298775d445963cc2dcbad9375d9b19667f9ad1a94ae01dc06020475df117f142fcb4751094c36d911e86ca572cd1e93a75fbede0a7c3c1240035027c4973
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBib+56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_64d4c8424fd3174ff82f2819fa22969d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_64d4c8424fd3174ff82f2819fa22969d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CZsutTy.exeC:\Windows\System\CZsutTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MACHqfg.exeC:\Windows\System\MACHqfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DfKRleR.exeC:\Windows\System\DfKRleR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIdUwhU.exeC:\Windows\System\YIdUwhU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUydWDO.exeC:\Windows\System\FUydWDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDgcYAG.exeC:\Windows\System\TDgcYAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbjTffe.exeC:\Windows\System\wbjTffe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jUEfTHi.exeC:\Windows\System\jUEfTHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZpTyRLU.exeC:\Windows\System\ZpTyRLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuHmMNp.exeC:\Windows\System\BuHmMNp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJZlCKL.exeC:\Windows\System\QJZlCKL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYaxmWW.exeC:\Windows\System\aYaxmWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ANeTkeG.exeC:\Windows\System\ANeTkeG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFGoXBY.exeC:\Windows\System\FFGoXBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgKzTYb.exeC:\Windows\System\tgKzTYb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMYdrXe.exeC:\Windows\System\hMYdrXe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwHsMTq.exeC:\Windows\System\XwHsMTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sxNkNJU.exeC:\Windows\System\sxNkNJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plQApWt.exeC:\Windows\System\plQApWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VbyPsFl.exeC:\Windows\System\VbyPsFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKEeiab.exeC:\Windows\System\OKEeiab.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5373346b75aaee61541a9de87a57a2ec0
SHA1476fbfcbf162d05f871529e9a53c33e2320cdb43
SHA25658f0c7d13e0256870e2f05cc456dd3f6774b5fbff0c94cc19ddac6e1c67f5f63
SHA512835ca16afa7e294ad8ccfe949f4715b710657b965496f33e4be864ae41110bf7e3a8efd9e80c81edc12601fe9dea3b8b727eec5c7b25bfc71381f602a79473c8
-
Filesize
5.2MB
MD53da81eab4b7ce30ea282495b35dbc259
SHA15b517f914e2ff6276153b573c9940ae52e253712
SHA25656884df122495d5794c0df2338a0df8257c7be1771c755011477c4f633e72698
SHA5128be6d2fa171102aca64a03802a4e9994f3ddf5aac3855a66e22b7d60ea844af63be43c5f13ee0b349679a94f7bccf866e26ff4455cabb2ef4e0005eda9d50b58
-
Filesize
5.2MB
MD59860ba8a5befd35598667c9bee2d61e6
SHA1a3675503ac0ae8f3bdc6efc12b1caaea3ec5ac72
SHA256efd49b73a741fd755e42c668edb0d0287672c06fc1108c6b054bfbbe1e9cfe10
SHA512ae35ee1029bae1cb2cdaed90c26635e6764a9894d47389bcc00fd4e415d0b61b6b9c3e36d3c817c389c7bc9a2a869f7ebc1f27ae7939d5ad692c63773471c3b0
-
Filesize
5.2MB
MD533123b8ef9596a1a4f39183ba3207488
SHA1106d5d80334abe65d5ad2dc1d318021c845f0127
SHA256ebbf715d60a872d3842fd8c2bdfd45ffcd6e0f99fdb7ed4e1bb365933246b8a6
SHA512a86b1e65e94956eca3f1c154c82b2fe3f45d178d1bae62844166b1bfe6ce769e6449fc0226447bc8385f59c41845a9b9e5dacc1cfba3197a5937524972cdc855
-
Filesize
5.2MB
MD5999fadff74e9494a6e5d902a5ee024b1
SHA1677f6568c042584e752c83273f69c374a9d7a81d
SHA256c60d91d780501b578c3f66e4bef53456de23bd449f95b4daa1ef1d3743e90fff
SHA5128d57378b618f93b9cd78396e0b1fa65128d84aedb2bfbcc1b446aba8df9086225660f9e68e32bed80f1da6b6cbb7754618787744ba2cb99697b93d86a83cf644
-
Filesize
5.2MB
MD5621604e501e3eb5ad6668816bcd69bac
SHA129c16d8a9cec4a20444f8c22c1b8348d594756a2
SHA256ae0ff49f0d6e07a0b56994f632d418d21442f226a79bfadae0c99c3ddc304712
SHA5122cad08329e0020fa2c79359d9a7707fa13e714500af9f3104c52b423f7b25e3567190234071026fe786bdf324816c021786b4f552c77c0831c844f0eb89545dd
-
Filesize
5.2MB
MD54146d1214f2c248923923593891dc495
SHA1f684980d8905933623ced78702d925f4ff0bbbe0
SHA25684d44c5c67629c01b91563abd04641cee2df283cb541e26cb34ae1b82c4ae9a6
SHA512884a2e218abc6ba45feddba891d48dd5305b756f38c0453c0ac7871e3ab5e0e171e40edb26641964d705355a39e64c24807ca2048f228aacb208e8e18bb41f15
-
Filesize
5.2MB
MD56010786be04c3dc3e97d4300780f5e34
SHA153758296c1774471faca559874ea8b61ec229fec
SHA256281b79e78861194cb821127623d904ca00d2b682106533aafead4a1d3c5a6fab
SHA5120aeac3299ad958175273e39a72d9a084ebf2f668707970b9136501aa2c8c78191ecfb83604b6b99fc9539c7e900e83dfc875156a53a354866d999255eadfbc9b
-
Filesize
5.2MB
MD555d9ecf6003ed50cf22fb3bd8977fc98
SHA181208a40dc28c4c24b914a6db9102def75694f65
SHA256b8210ca6d1ceeee28f75b05a8d444c3407bd2346630b965ad6922733040fd9e7
SHA51232d679aed417b231b4c72f83f089a7e2d17e0c444b8924a129b26bcd040ad601f55883fdf52bc726ba7c9c805ffc0596fdeb7ae25bf7ef8b8ec9f7e96e3ce448
-
Filesize
5.2MB
MD5a1c1ce00aeaad1b93bf17e46fba35461
SHA17107e4ccc50bf61a47bfac5b51051905c6adca36
SHA256c1e293859ca91acb6b6223e53ebdfe327616f720ee6fdc44d98c2a0459423de3
SHA51209f37e330f003e3772d585e5753baee3d65f4f1ef7793aad9b9105750e633134db289c8e0c2039a9a2e59a255574cf3a7d6ddc83217f674179232b3284fc8d49
-
Filesize
5.2MB
MD5d3299f16541623d370ca3da8b33bea8e
SHA11abf5648efe85e151583b69295d4c59ed23dd11a
SHA25611427a3b42751a81cfd9726f5a7840b4e33b85320c24f1eacb1b011109c5546c
SHA512d2a4ce5cb9b998ef85266a1300d524c030497966563ee282abb738f74f7baebb9fd0af8ab68b00842e0b0eca0ca89f8000ecc5a7b38f151322dfaf572733f9d5
-
Filesize
5.2MB
MD54a4979ab82c58fc3e31d2aba391bf936
SHA1d5fa2fc8a6c3957af3f5cb76c8dce6440f4cdbee
SHA2562944254126b9f1e62e7f19d3aeb99cf175cf99e7a91aa93af26713da91deb292
SHA51206fbbd57993e78c73b416712cb1795c42e7a5858d49834bef6fc057939e0526036a3912c16772510e4bf3668c0c16bb66261b498a3e73ed1e2c1b358ada3df97
-
Filesize
5.2MB
MD5e9bd1309e394364a8cdf669c4f04543f
SHA159146fc902cc7326f5e81ae7e68b8ba3663dc4b9
SHA256c969dc871080a60b9d703a642f6c4bff313c9c638c22aa7e1cd6ad1b98b94665
SHA512917ba22e5aa16581656f34cb7ae872225a9c86e873a2375d5a2abf99db04ce3ef3888bef23605d18c3a0aacaef0aa3215acdfe4f62890297614ec0c3bdb95fc7
-
Filesize
5.2MB
MD504c9193cd49838d26e7476a8a5f071f7
SHA1e95c3efd9578cdc0317d7e10ad183fa70ea7769c
SHA256082a11821495eb4a5cf8a20a1e8ecad2c2bcf8d35578089c870621430cf34189
SHA512be1e67e5ff42d2fbe0e6138d934353ba6fd0bb41a2308bd9916384fb9ef41ea8cab83434996d030027aa6ea17c433bc3f8476d2b964714ef79f79abc32f600dd
-
Filesize
5.2MB
MD5eb3bd4d64e209cf8f8f3eef35b403dc3
SHA138da27e3ff6e0fec6ab5da02c31cf093b40d44ad
SHA25694682cf77d1a265419c1655f08d112d1f250433b251c00756773522a55b0bce0
SHA5127d86a23f31a6aacba5b880d5bb257054a1c3bf7e92b2842cb95a838a6b653a3b659ed09a6f3510c0ca004ae9ea40b960cfda6bc104e8c5eee7b655b07fb8bfa9
-
Filesize
5.2MB
MD5604ac2302596d67b5e2a54852337e4a1
SHA112c0919ae45205f668fe78dab7643779ef8c0c1a
SHA256b9a751dec87df26c4a2030a97d9caad0d07ca6c5312dcac07147cff54e0e193f
SHA512fbd36376cb65189161338aa9d9caefdc7e0b60d3a958133e8c9fcab614538b7614028af7d4852ffcc15edee9c3c98731e5b5e8537914097b1a2e56e0c3f97c94
-
Filesize
5.2MB
MD5d2a4b5873d59f25815b4f236260d804e
SHA1d7a8947b064d9269294a961ae6415f5be0919c6f
SHA2560b02f515a9473b4351b7db3b8ed91435737931976709799cb71cdb7eec4a94b5
SHA5127a04bc339e3b0ff116fdfb01e51ff0fa5a223c5f56b9c196d486de2c523ca70cfed87d5454eddd13b21842ad1c4f6a5f0ef45e1803829d1c13e9ff0cc88ad501
-
Filesize
5.2MB
MD57773583b70705932eb49abc6fd5f0ae8
SHA104bbd5d7a1bc55ea56e74ee2bea51041366fa963
SHA256ec48b472502006d467197560d65fa54075a03b7dddd4ac0662291a75f760d69d
SHA51290175ae862c69f1c4831e22709f09b6c9398de736f710d7377a00e0acb8de3505063d9fd53ce40908c2782d09f3755cd64653f383a4fc1372f4d8fb6ac5979d1
-
Filesize
5.2MB
MD5251ff96e7648c335d00874561ca95734
SHA16c6c1ed158af5baefff05db6b3437c1c985aff99
SHA2562f0291f7e356b1a0f1defabf278cd0241035f7437e44d41617021dc13857efc0
SHA5128cfd4c50dc53cfd01cd6003bf334e4327b11a5b6d9e56f4653147bd248bbad6ec42909ba551c9688b64b78ca13cee5817fd9fb13625b1784ceed808abe653ccf
-
Filesize
5.2MB
MD57a3a0b0a70be65ff4157cda241a7ba32
SHA1cbc6e13e1b4776c82a62357b4a42e67f10206ec3
SHA256414ef8fa2f9b837ecdd2b56c2b932bafd67ec6d267609650a35955ef0e134094
SHA51262ec35b167c8b0cfccf05d97ac6a2d70edef3e412935a141163897a4ff7f97ea205b058ea6c16c30bcda46b961b120bfb4d2a25af2ea87957f6c7f2c8fc76681
-
Filesize
5.2MB
MD57ec6fb63e5cd2891980987aa1eb20794
SHA19280d32d511f2975c3b8dd93d28a106eb59bb63e
SHA2567e20198551bc28089fbe27751ed7e3c63066c624125a0fa7f0576e4a47dcb25a
SHA5124aa2519e8001f3740d808404275cbbdbd8ee24a7f93980f8eba2c8ebad8630751a5e27af3db86e040b0bc0f4f728c567b56995a0301ed04f08d98647e139be2e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB