Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 04:29
General
-
Target
2024-12-19_ff6ab9b02c8a911a03a75fabba29743c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ff6ab9b02c8a911a03a75fabba29743c
-
SHA1
0d197c331842486829cc4a18a241032820895c63
-
SHA256
0d1a54f8cc2c1e3acebf4d15124ba0883d218f2eca2168993c6a90234f399dd8
-
SHA512
12f3bd2ae25b4e7bdb5f5141de527759ef5908f116baea5cd09c0861f9ced167bbe5091cfc1ea077ccdf45fe67eadafa248eed7868d5c2c360f24c07e3ef58df
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibd56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_ff6ab9b02c8a911a03a75fabba29743c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_ff6ab9b02c8a911a03a75fabba29743c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hKiSoFV.exeC:\Windows\System\hKiSoFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jelECZt.exeC:\Windows\System\jelECZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UDqwvos.exeC:\Windows\System\UDqwvos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmxlzYk.exeC:\Windows\System\TmxlzYk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqBcqNt.exeC:\Windows\System\eqBcqNt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVulrky.exeC:\Windows\System\EVulrky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSKGITu.exeC:\Windows\System\fSKGITu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hxYQBzC.exeC:\Windows\System\hxYQBzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtLFuPD.exeC:\Windows\System\vtLFuPD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bagAHna.exeC:\Windows\System\bagAHna.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\chuMifA.exeC:\Windows\System\chuMifA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAaRcuB.exeC:\Windows\System\IAaRcuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YsJJjLE.exeC:\Windows\System\YsJJjLE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qchnpnC.exeC:\Windows\System\qchnpnC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\neTCDdX.exeC:\Windows\System\neTCDdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYhBABw.exeC:\Windows\System\hYhBABw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnxLnAv.exeC:\Windows\System\QnxLnAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjaOKNk.exeC:\Windows\System\OjaOKNk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxIGnUs.exeC:\Windows\System\uxIGnUs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmkhlEs.exeC:\Windows\System\kmkhlEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnZEfbS.exeC:\Windows\System\MnZEfbS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a8549ec82d61a6e4129a59c584d7e1ff
SHA147360eba296c86129f3b04e9b4ad39f03760feda
SHA2569343c71e5b22355adfc8438d69364f266c4917ce1da55e23ef1f4b82ba39d82a
SHA512d1f6eb5d69df9f30cb04baa3577a7a6d469755a3933fe2bbdfe6d27cf52b004acfd4b62d411eb4486dd961feb405041604c032710fbaae5b68c7a8cfc6e4e343
-
Filesize
5.2MB
MD58a5fab9bd79892aaa6eab6b84cdefe14
SHA1e9f6c8f35dc1ae149f053d9c775ee31340cbee0d
SHA2565f74da19461d7a0ad29c19ddb4b3946c64936439f4b19cc5ad5f0259ec663317
SHA512f54d3bce3bea0785685da7586656aeed6b06de97f405bb61a53ed3cf1f86d338a85199d2bd2675c7b6b8a4e8ee0be0d0816e00d1b7e06accd1b6ce1d797f7c8e
-
Filesize
5.2MB
MD58fbb6770889bf89ef8cbaf0ec765d714
SHA1af5c60ecdcc97be9170a10bb33c2de387e3e5bf8
SHA2567c85d39e5564d09ee2e5bc6c1d489d4709b8bb157781f60f25d5f8b786baa06e
SHA512dcab31aed1b00f0cfb9475c013328a991485fbd8443a7ed08e66564904cf3b0a2ddf61287afba9dff43b9ed910520c0ff1edc8a0b1ff10f468457c1762dd8a45
-
Filesize
5.2MB
MD57c91a52606558f432357fd4e4ea7256a
SHA14469f5b29dacc49f05686fdd549097427c394907
SHA256904308683ee7dcda82055f3b6d42b2b1fce4c6f61bb5f38a77d3ed3829c3756c
SHA5123e2d7b5afaf30cab2e273c7d4371f06bb5983d828ca883e3f84105f6f5de783b66f8a05b6aa3f1171cb60940187043d422aafcf1a707477f73f9e82dfdfe52ad
-
Filesize
5.2MB
MD5a03ec544512cf679ea340044d56035a3
SHA12e051f8224de4900907cf6c286770ab4aa62b813
SHA256964b682f8100844706f27cc59d90b946642a8d65a4afe9d918ec5e918d0b2d12
SHA512f5d9f0622a6c9f66665bf6303c6445a39a1fcdcf3de2ef6f6aed0ed0e1ed9446364148ac18740e116958a8a9f4171e64a967df4d66778ad0eaa9b68f20b3966f
-
Filesize
5.2MB
MD5a7ef92a4c15e1c13a5a50fe340964571
SHA196f492b316eff7bad304e9fe3eb6c85ba3946ca0
SHA256ffed5880b1a5f4946d0151d22539b2e50ba361f03332868fdf55d3e7ec40acda
SHA5123849e128d7239225b15af76de451729a103bb47d60b47113a83aadb67202a1fe60b077399e6438c95f7e50fff864afd75c3ce7d4a3f827d3e61295bd477fd2b0
-
Filesize
5.2MB
MD5dd1373cdfa6b21fa2a3eefbff7c7dfa9
SHA1b18cc2dca155c0fabcfc4f5607ba1194f8167d5d
SHA256b939ee97fa25c84a038b3d860e84bd368c5b5fc2a85714c3bd1a5e4355ba234a
SHA51297bd3d373b3e37e9e0d8a3e9470fee7afe286a9719bbd74efba328da25cea16496f61c454ebdb469041470b77dbde589768c6195b926ff21c9f763445cfec8a1
-
Filesize
5.2MB
MD5cadadf3c6c074ba6f8762af6442e96ad
SHA1f1c7db350d18208e74bde1e299793099b732e1c5
SHA2564cc1d032afd9d7dc6dbe3b3fe76b964b1c1aa5e862d19fd10f77731f5e3f20f1
SHA512417b33b51d8f1c60e68b3e0f14b2e0618ac195f5c82773be3c4b8d800acb40d1a283a38e3addb051317c4f4e7e9190f9470448b2fb028ba19fe5c33fcee0a14c
-
Filesize
5.2MB
MD588316965792b49b1a0fae3242772817e
SHA1a8f34ef800c3fa90e962dea6eacf368daaadd24c
SHA256a3d5fcb9c96dcacdac4ae52a667a6521fae6064ed7f284accfaa919a0ee2ebf2
SHA512da252370f97cb4b10f1905b95f1d2e603ea8eb09c560a1c2db4d2c2e17e8b827e5b29b129b36eb8df0420c2b240220671cf3be696e619a473b784282885e4e7b
-
Filesize
5.2MB
MD52412d88079abc01c452a3f4bf0dda31e
SHA1b21ed7305bde543a0dea09abf779e954af964e91
SHA256f5be58591625676f12bca36ff61cbf1f72abb9dcdea973d674eba9f5e21dbd1d
SHA512c4b1aa85ddcd57cd0e2a2ea7c76aa98358e1b4ce64b0ed8112aa202d24911c00ce646e93bbc32f601b02c10b8b80e25072a36bfb1c25e00a4efa2dea58fad11e
-
Filesize
5.2MB
MD5bbd8499084f8f8558465ba02d5b136fd
SHA1ab1cd476396f854a9d633032ded16966076a0838
SHA2561c799cebb2138188e0792a39b74f97f5e49ae924786c2b2b05373e6a75543cb4
SHA51205d103c2095abbcf020ff66176197f42686e5755ff6d8d8ce152939ea476402752b57d1e4673e0dd062148426b5a61facfe5e0b75cb64964c7ae993b2d436322
-
Filesize
5.2MB
MD5cd5b02b149e3476ed60ad7d58f6c8d59
SHA13a34bd821d0929e9b1bc64abddec4abeca5eb650
SHA256b9fa3477d3260003deb5f4f2819d67261cc61994883a6000c18e905fee189af8
SHA512faf87d6b2166764645e429339667ff953e38508d7758968fa0e961b75a3ff5399dee169831808967c9e4337b901c9dcb41204ced8c9dbdf2643effabcd8938bd
-
Filesize
5.2MB
MD58c1a6b4aaf0e160a8ed0b62c42ec7dc6
SHA11e09afce7e744bfa09a1aa0c8fdd5ff95e994136
SHA25626aa5158fbb2dc0ed2b6fda10711070f8f33f9a8b885724db468c03bf1785c10
SHA5125413029c7382382335393e95239b2b296f2116b087f65131a1bfab765c7682cf11c060556cc2a70d820b41106c51e87e3934660e2799121eb632b01d7e61e109
-
Filesize
5.2MB
MD532bf246b51bb16a1be40542ab7dfd162
SHA10a26645797ee742f4639dcda3c71c20d27a405e6
SHA25680ad2933f034648002ca275789974bd218c13c9be1c832571759fd882f076fea
SHA512b9c719d3b5b531bc8791577c126f78042518197eb2699565595302c69f50882975e45300241472f1ef69bab3789bccbfd1a36f88c08d25e62d20347dca859350
-
Filesize
5.2MB
MD5931db4c08520a09d09565e798cd64bf9
SHA1912f266c695ccc4575e180030b4810b085866830
SHA2563dbad89ef480b1b6935d3d933aa2516d20092faf24fbee9c3ca65f5c31df6cb5
SHA512589a002d2e4e67b93e7e5c3700e0b20a1de65b3291f267c507b0ca685416fb6cd876da6da72b9bafdaad2836933013a7280613f320929c958e0c1906de778fe7
-
Filesize
5.2MB
MD5df49fbe4fb1646485323920cf4eb2160
SHA10f79f9de094ccc6e858cc4a314184ef7f2bbbd54
SHA25621121dc662426aafc59b32b4e01fbbcb06f1a00ddd5c878b47085345edc72551
SHA512eb532f64f8d21fa30712a0875eaa7a7854906366a23b298136aebe0dec10294055a5c97987e26ccf8164f24e68994315ca9ffcbe24ae15a109638b9a1a6c38a5
-
Filesize
5.2MB
MD5dac2bed1e9888c3c14d179e2667e9dd7
SHA187fba1bc24e2038dd5dca0d4d9f037611411ec58
SHA2561658b8b924c765da75f669608eb9687cb0b21d05e2a2568e2033448558514a49
SHA51265c58129afdba788dfb27da94f9cbd15ffa40097b361b10fc9bd38261e7260febcea29487d180bbe123c3056f16da5e07cc09c80d1e1fb62643d427bd90c8d66
-
Filesize
5.2MB
MD522650721a2c418abc66bfdf350a74d41
SHA1ea0c0bb37f47c956326d34bfc22e580751a45026
SHA256efc46a8282626a90b685315d289295b5f694915677d546a2407a0b736b0ede0b
SHA5123513b1312e44cb0a288c215d7dfac7d491c96fb20e710572d4343fe7dc31c350bbb1ed46682847bc86e4ecab0d095f881d6d9580155a8c32d13726c6dc8bf007
-
Filesize
5.2MB
MD50ff08ba033409860ef1eea2f407cc529
SHA19a57c5e73666a0ddff5be0808154e1df043f5560
SHA2561a7e4af7e6ac80b5192b4bd4fbe40d5e1d92fe9b1cad9d670d69173bff1d4a29
SHA512590f0ed568366a808762bfc6bc2e151ee70b4f06056ed3c1ea03dde0437ae14ad6cf153ccbc3b747db15076c15b5e57c264c886357a0bd4907ff18e20919f33b
-
Filesize
5.2MB
MD54f0c616eced4daf83cc63cdf181d7f77
SHA1a95608e994db34f0525650b03b880b5cc473c717
SHA25626ebf45d9e80939db9e00f3fa81de3ae68d6bbaff9505c73af10c8f69bff43c2
SHA5123c75cd324e2390e8bdc01f14fb60fd123ac2ded664129b043f20649aaef9a21caff0e6e189c5f70fd1052b913a3e29cf1fba7f2e7d0906f6d3ba7a3cc56f02a6
-
Filesize
5.2MB
MD5bf8fcaa0ae98c470dec00c928bb4fae3
SHA182c8d3f2c5d8285f38287283491150f031d44df3
SHA256ed2cc3f9066541ce9344db3ff252a2b5366ba806221c3fc89987553379958491
SHA512c243993c3740e3aab1c2b752110524c9a52982e9badd9b2156598a5f219ee4e01bd0f55456c472309a2e10f633c8ccac5ed5a3c72be47d1775db9a45c9c8a1d8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB