Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-12-2024 14:03
General
-
Target
2024-12-17_d755320ef3a26e6f9ae2196200853cbf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d755320ef3a26e6f9ae2196200853cbf
-
SHA1
98e79e851ad677db044288eae60ab1f05b648794
-
SHA256
b2627ff0abeafbb759708aade992e9b6d6ddde130700214382244a982f3c314a
-
SHA512
30e7bf669f9a1cb785b51f17075c025e9152edac246e60917b6337c337ac0c7794de3d010c967d240320f0fd33a9ff9edd396e9b56dfdf3bd0b451c88287f32d
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBib+56utgpPFotBER/mQ32lUa
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_d755320ef3a26e6f9ae2196200853cbf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_d755320ef3a26e6f9ae2196200853cbf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kFevWqj.exeC:\Windows\System\kFevWqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhyVEum.exeC:\Windows\System\RhyVEum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjVkfVl.exeC:\Windows\System\gjVkfVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnvJvfU.exeC:\Windows\System\AnvJvfU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGXSGIJ.exeC:\Windows\System\hGXSGIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDJDPLn.exeC:\Windows\System\ZDJDPLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kQEJSOa.exeC:\Windows\System\kQEJSOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qPPfknF.exeC:\Windows\System\qPPfknF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naxaDRE.exeC:\Windows\System\naxaDRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LdxWkkG.exeC:\Windows\System\LdxWkkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZLucQPf.exeC:\Windows\System\ZLucQPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DStiZiQ.exeC:\Windows\System\DStiZiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfbhubI.exeC:\Windows\System\RfbhubI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ioNrwQz.exeC:\Windows\System\ioNrwQz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xoBvEmT.exeC:\Windows\System\xoBvEmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGfmUtG.exeC:\Windows\System\qGfmUtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KsEIKHS.exeC:\Windows\System\KsEIKHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DmpMYzR.exeC:\Windows\System\DmpMYzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plgyQRE.exeC:\Windows\System\plgyQRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyFMigJ.exeC:\Windows\System\GyFMigJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRPTBgX.exeC:\Windows\System\jRPTBgX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD584cd25cb1f181f5f5d4df7be222376c5
SHA1817387eb4f8e2aab3789c42369c2e3573494133b
SHA256989a8956dc1b5f8a5c2a2e2e0096dc771bfef5e7a7ede8e21ae35d3c483774fc
SHA5128709cbea6da1622da4fe8b48e981b00b95c043220ac1fd1d846303be536f93c9bfc31f5eb9e67eceb3b7dc3b7b2bfd05578ec85591d4a6d79535d37a0fea967a
-
Filesize
5.2MB
MD50185bd841e6a7a0b7a2e67994f691371
SHA1226d4ee7c578b4b81d5fbfbe524b0e0fdbeaf645
SHA256d647eb80a7cd2552955573a93ae0a3d8b6350bf09212423551a06a439c857b80
SHA512cb789f2c4b13e68ea8fcbb3d50bcb5d0945b5df9cb6e7f8615e796f9cf57d2a5413a69658ca78609e6510f34dd4d1b932648a4a0d4e713ff46ef87d55ed63a29
-
Filesize
5.2MB
MD50ab551858fe6cc28253a4eb86b1e488b
SHA1ce9c73c5eee85be730a66ca5bcb9757c13fe8e9a
SHA2569354afd4fc8a083f445fd969d304a3b5f587474d85af5343f041dfff9f36b7b3
SHA512b063b4d119302d9646766197b4499030f31ed94cccc429bc50734166c5ef443f320f0c2f1d75e4c98fc418dc1ef5c0431f8680d54982d0c02f0f12b6236346f2
-
Filesize
5.2MB
MD5d8ca940260c9d23e6ac80855f204e626
SHA18bc65474e348315d549c6b61afcf6d6c8e652183
SHA256ba8376c7ea1d440ee22c6d8f646a8542e9e2c7fa60e7fa4a0fcf57851d148700
SHA5121e7fccc5d82c583b97801701f0b04a2736b996f00faaa24b4b49f233ad19911fb258e4acf4ca6717983a22ffb6d7dfb46a2bc4422b75bee07c61f1c2bb7e3030
-
Filesize
5.2MB
MD53674f70655244764f299eebde2411dc1
SHA16d4a232b86d7e3d631bf69ea931afca749cf65e4
SHA2560a101118a1b5ec840ef990a4aeb4c7e95e27027a5051a46268406320e0d11b03
SHA51229f1e6843615ca142f84b5241bf7aeaa7c9876506c4850974a4002cecf987c74c56e88ad15853cdb233c9593c286366c24495a0c93ffff2ddba3cf20e800bd59
-
Filesize
5.2MB
MD563bdb0b44771e481dbd3de810e54de5b
SHA19fa54ad099bc3c1811bf3cd54a19132137f756f3
SHA256a1110069029579416180882486c3ffc75d63580af08d49776567bcf15fa4991b
SHA51296ee83a0b7a2e00fb1bc7d5ad7e41eab24bd51a375742af71f64cfc3af22a02682a211143ad72b26926636da20626258f3ecde3e42cf115eee33bc3cc3fa33fc
-
Filesize
5.2MB
MD5423217984ff52dcf7c13f2afcbc66a70
SHA18ba4089b33d4e245ade90ea5294491d9c89140e2
SHA25617275f6ba8bd78e5d22166be0314e71559419d6875efb8f5227db7f373a9df2e
SHA5125fc7df491165062887ef8121cbb725fa256b067ad48858d732921debd7ce6a33c8cba7b7266e4b8b2cd60909a7ada1b0e1ccdfd0e6cdbce51a19701a33401b1e
-
Filesize
5.2MB
MD5b9b0158110ed394da393e62631705959
SHA197b0f0b9656cac5b6082bf100f2ac5a5fc21a85d
SHA2568b0b2700e489ada3cc6f7ed56ef6b3e371e9e442a0e8ec2e0f2a40cba68bc63f
SHA512ccbfb204664f8d69302d4d6b8a614e639f788d7993db447a0ffbae86b721f051e0a0f756639a7ba0a6e630923da211da4b640910f0a8d9f88406634f03a33842
-
Filesize
5.2MB
MD589b0d7aced277a318c47333506e92660
SHA1bb73e5f520f76cd67742f9c3996cbc466d78dcb0
SHA25619130edb99fb01519491b099216dea2dfc125af11ace22e09ca2c313cf6bd95f
SHA512b238205d514cfdf1870e7127a539457794564212a5383a2c5f498ab67025091f5b850f8e0dfe2e8853f6e62bf89aeafc4b7466337c745148aa801c70fb802720
-
Filesize
5.2MB
MD58ab7f66d2c808085c474aa882edfafc4
SHA163d83afde797dfdafb208ecb5495f9f192b1e294
SHA25658cd891068ef9945bd2885da877ffebf99f028000e2ccbe27bd2b628fc0ca172
SHA51270a9eb2cdd5916fa309d6035c8adc98491c82e4b050d35b36f7b8ce1496bebe60178991ba5840e6983650e390b3f814de57e555d0148c0cbbe9c1d0d2ef44029
-
Filesize
5.2MB
MD584c1ed6ba435e6ac39aa3f951d4fdd80
SHA1761653759fd58a092007f89f8a96c46295fde555
SHA256cb28cfc38485f0a284a7a8a9ff91636ebc39dec09a3816924f0bdd569cc549c7
SHA5124d088816a4b5a955e4d089a2d34ca9a5c969817455ffd27ef653b8485208a092b467e4c9eccc1e6af5dc0d437d7585bab733f919033aae7a53c872e1db4281b9
-
Filesize
5.2MB
MD59d616b75a0ab1a7c0543b2dbb03b7b24
SHA132e04e077626fe5a88ce9a3fc923580d183ca024
SHA2567e827f88493732b883c7e6fe8dcc82c15c44ffd65f697677dcabc16fd900e882
SHA5120f392d6ba0b12003d1eb01db6ff59149018db24345e131eb4fbe5f7241fb6d15ef090b25b404ee74a00cd3b261d35812c0d0b4f68b08b9ad1a38d40e9a9ea697
-
Filesize
5.2MB
MD5341f9e10e3a5cdb3a4c08755dd5f1904
SHA190159e4000526d85a740a17f4a72edbcc3f63710
SHA256b72b9c3751764be8eb11a3705bc2ff041dd85b4e34347801b569ef4fcd0940d6
SHA512deeaccacaa272ceaa568f8f613ec687f3cf9748910684ea8ebfdcbb8a3923801ca834813708d6d780e0cb90b95e2c819f50018a4089f4fdc1c96c81c473d1b10
-
Filesize
5.2MB
MD53a1ac3ba2ba7b668bdf7d41cfff94574
SHA18020d104fffb29ac51c0580eac35a1429e7b6ffd
SHA25672caf9f4605765d3a8ded6e255d013bad01b9071ad7fb28076360642dc54f2fe
SHA51214d021bb03b787e1cfbb8cb0854802d6fdff74f282c26a488ecffffb3468ca081e508cb4e437981553ac7e1e5c75265d2c4a0c3bf9cdce03d38d35df46650bd9
-
Filesize
5.2MB
MD5f6bff3ecd27d1bbafd3207641746b301
SHA1d4cbee7cce9b655780662e883ada87f7f74823ea
SHA2567f9836315a1c06323bf3da3f13e9d0ecea210ff39c90a316e3a339f0d1fd2a98
SHA512e69a1489ab405bbeafac6dc558f55da05d95962f5d4a44d3de14fe0ac366f197d86a8fe9bd5fd60b1fb3e7bbeb1b28f36ee579e79123ec38c57cd2aa05d3ae92
-
Filesize
5.2MB
MD569ec5355dc44988d82a71c8b593fdf32
SHA17cc17b420578a0156cd30d73960a16a2db29b9eb
SHA2568ae87151fc4672a825852c93536716d32724b167309af4efda56d47b037cdb35
SHA51291bb00d7149bc09aa576fac696176d6eed5dd99d4bacc0cc85ed023b3563a5fc96c4bc101938d2d4ba89733a8fd8eff26aabb21bf2e2e0d46ccd1efa7c88ea08
-
Filesize
5.2MB
MD5206fc9f4856bf9b145662eda25dae745
SHA10ea53791a599ac712cdcfdf22f75b2b1bddbfcb0
SHA25675c4718283f0f4cdbedf121d0910581621758f935d96382c56102fba37338d66
SHA512a724c64a921ec97e6320215e2713656b10a4e56dab7aaa9224a8d21bf95b2b01c00b394fb668a99094a6e7e147eb180bb57e19bf2a44d7d705cb2c9c2aedaad3
-
Filesize
5.2MB
MD5ceac302edd6f052c99144bf1247bdaa8
SHA18cfd62998c068654ed4ae171895bdb4975b1e666
SHA2563e7f18f627bf5fb623bd6a755e62b2bfa1f79ae66bc7d091cf37c4f189431421
SHA512362c4e28834a06f520b1981dd3907456551f830bdd1d0e704059d105fef8dc7812990e97aa9cd174da1dec7790dcb957c25227c89133f92360a14d97bc56c429
-
Filesize
5.2MB
MD55fa3f4c1a5c1ede58a2f10ca5005db58
SHA1f3987d6d680b755c428fd10747fe81734ef84e79
SHA25668ac6abe1624f9d18998a803a56dc8019e93a8b826df02f7bf195021978d366b
SHA512125cba674b9a121bbb130fb2f1f3d4a36be14160f8f64502dcb4f1d2ee5b9b52ca57b467a8d1791bf049ddfd3186393464eece13850cb2ab7fe44ae2a8e8d5b3
-
Filesize
5.2MB
MD57792ff9a19aea9045e38bd5de1e54dfa
SHA1906f780794e1cd5daf5ee302c98a984bcfdd7efe
SHA256bdc4d722e0ba3d474b5578a4be2ea134b63512c3ec86d4e1aa167ab2b03f6a0d
SHA512bba3291f9acd1725c6d1ae7577c977ac773b44b31b59cdef6f04450ae30b45d193345b9a41de135b930e94cd192c7e5be7692ae14b64af4314f2aefd67dfcbd7
-
Filesize
5.2MB
MD5ceadc6ada9307c93c38dfea4931074dd
SHA1d0e579f562c95153be9fb717aae3e74d87ed0636
SHA2565f38408e9c12fc5582261b3b85e0769dbff4cd1af659c6e1fa6c8bac99d4c3ef
SHA51253d8cba21b2f60aea706e920a9001cbdb2eb5e79de59554f78f551ff7ac2a6be4d83b69380b560f17281ade672603e0e30b121e40f87d2e2ded8b341d889beca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB