Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 03:52
General
-
Target
2024-12-19_172e32e4add15b5aaeda4b2ed772cb88_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
172e32e4add15b5aaeda4b2ed772cb88
-
SHA1
5f28c6dbab72f8c41991c5dd262c4d9bfa580bb7
-
SHA256
4cf2be4d6cca5d69cf45ef41db66bc8f4d9fe5e4ceca9cf43ef62fe33567d43a
-
SHA512
a30b32a1e61c2bd046e8e116d213f416813d0bf632e3c0791cf93082f52c10dbcfa5166321b542b5aad93a0185a15383aed885e655ebb54e1bf5180a0cd3dec9
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibd56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_172e32e4add15b5aaeda4b2ed772cb88_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_172e32e4add15b5aaeda4b2ed772cb88_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yONJKqm.exeC:\Windows\System\yONJKqm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYAyFMq.exeC:\Windows\System\VYAyFMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HfWpjFB.exeC:\Windows\System\HfWpjFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAUhpGI.exeC:\Windows\System\MAUhpGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUFXGgH.exeC:\Windows\System\tUFXGgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dGezVpx.exeC:\Windows\System\dGezVpx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XNlUMvf.exeC:\Windows\System\XNlUMvf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvlGbvz.exeC:\Windows\System\YvlGbvz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfspeKd.exeC:\Windows\System\kfspeKd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHqGfcg.exeC:\Windows\System\zHqGfcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmcSwTg.exeC:\Windows\System\RmcSwTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vBttENB.exeC:\Windows\System\vBttENB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTjSnnR.exeC:\Windows\System\uTjSnnR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfxeSGK.exeC:\Windows\System\TfxeSGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKbkoWG.exeC:\Windows\System\cKbkoWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IeNJiSl.exeC:\Windows\System\IeNJiSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdLQytr.exeC:\Windows\System\KdLQytr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADgtVGO.exeC:\Windows\System\ADgtVGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imSVldM.exeC:\Windows\System\imSVldM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ttXsrwq.exeC:\Windows\System\ttXsrwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhcNcOW.exeC:\Windows\System\qhcNcOW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59e0c3106ae36cc8be731072f6254d187
SHA182d004bcc2e7a520c5a121c3751ba30ccaa7c691
SHA25626a486154dc53224bec3f2705780408e8b5c6c24eb50288cd284da46fde56496
SHA512439d9ec59db49343d09d3c8ada0a07507789b33e03df66142d1087378c4d18d782330ecf842cf18839139d2658dffd1124e38a962acd8c2b9522449e81db90ac
-
Filesize
5.2MB
MD5110d9c87d7331c835760ca154b1ff6af
SHA16ddaeb6c99bde51062a5f84e04eca738ecdfb57a
SHA25607fea44c81988894cc7859f0c8e65a4afdb02a403610d05c850b714ef054b2ed
SHA512cb5c5c30abfa376dd532ba61702a354383e883c6454d27090942228918543f575af9b2aa9b9ec6cb18297bcb7af5c5c92c87a9fe54180750a15a04bc6d493ca1
-
Filesize
5.2MB
MD54e6e1185c4630037c56463ed76aff1b8
SHA1acf65fcd9da541859a69c68ae647139bdc0c871f
SHA25611124c00b55754fdf7f0e12dea29881ae82116d3cb43c7d64d81685a635b6d14
SHA51224536da2f00c12191fbb54c62748ab383807a2fa3909fb07aee4ea99da1c00ed01b2f50551669c8e62960d799789691d01e5017210b208a273942b78f381c8b6
-
Filesize
5.2MB
MD5ec40c1f401945d7061fd6c6b082f09ad
SHA1294445961c4f341c0dcfe4a6f7b2e499195827a8
SHA2568169f4bc208b9414d4dcb07965529c0ec42ca313e0ba1fd31bfa6d45d56813e8
SHA51226c6c2470e2f4b7474e894592f3dbf3e8c17039c29054522078e941cb6e26189cd05e22273dee0a0524aa19cb8c08f7ece7f5d3625babd0adf96c0e05fe23a20
-
Filesize
5.2MB
MD59177541e6def26a79e262a3a701d5dec
SHA1b6e3acc891137deeebd360acdd6bb67167af5a28
SHA25654e26eb30210b5868b5e4b6630a1656fd334cee1d767eafc0102ebf49e1dd0ff
SHA51239b464a1693b55a33fcf456918580c9ec0c07ca0ec550eb9d4e3a7936d2d5846a1501ef10d07f1d5ab247ed4bd69e7e00549bf7a2466bb9bf686a5031c46d01c
-
Filesize
5.2MB
MD5fbaec4a10e332335583e882cec5faa0d
SHA17685b4f35524e58501eb190bf68ca9461e1406aa
SHA25675efaae4b0c97e2892f4376996e075ab1a70004b3d615ce33dc9a420fa0f8af1
SHA512127331fdea7a6fb0c79cb16ac0c54cf6805f3e3ec2608eda086161597d3d82a174e23eb5b966ad51712942431b02c380b181e39dd3b8a928daeb2606448be49b
-
Filesize
5.2MB
MD5222005af1e81db0febaba1ab7a586bf8
SHA182451beecf42d34058067c21f535669109131da3
SHA25651b9c7d27f009ab01ad80000649ea5e97ffd34b075db8f9c716d138d3c430c21
SHA5129e59d3993f799a3c15ceb3b80389a065cfb8e0d35dc963e0f0ccf94936bd6e5a253ad5c940e66f524710225c1fd96697e0db878ebfc872736ce008d3ad4c9383
-
Filesize
5.2MB
MD53ce4420e2443f45be59e0221b0cb8de3
SHA1f901e4e71fe4d5842ce3736f14d57f4a063831a5
SHA25676dd4d69db3373829bb8adb1e6d4f55bf9da14c75354e7971a8a6cffdae960b4
SHA512bdbac89a916f887288ea26d7428cd8a2ca9bbad6047fca2d88a45a57b57ff120b043661bba61b92a8a117210d8246f91b11a9818c80fdf0b375be5a54762bdf9
-
Filesize
5.2MB
MD5ea1dd003bef9bde69b083765e1817c8e
SHA110c44605d626ca652f825978b43b05099eabc2bc
SHA256e7fafed0cda7dd117d2b97966459cf3724e0554a6b68e377cf1169d5b93ee4f7
SHA512d0cb4763b70f426f94170ee0c78c9a76d61e0da421abf182b594da361e9d8f9c60ccd7700ff164752c37dc0eb40011cb897f24064b806a813d51c81176e79913
-
Filesize
5.2MB
MD59cf9831a3b2e9981c4c224a6dc28ce8c
SHA16ec7eea739fd43893cdc4f1c1bbf062a7d5ca95d
SHA25656827db60bec5cb2e1779facdc631f6effce44ac03663a21514c7978b21e3c71
SHA5129ad9dc205874e5887a4892fc0fb42d1b9542f31e67dfd370b21db4991cdafb77a0325d0698f5a3c86f84c6f9220ac21beecba4393fe526c5311eea74ce3c2e17
-
Filesize
5.2MB
MD5f5f2f46f2b9ce7d956d48a5b2a0cec09
SHA1d9ea3626f17c2eb5a9e5704effe1710c264cafe2
SHA25650c55aa055881bddd650514ada1c6dc59b35317ccd98017b9a439b94af0aaffd
SHA5126683e636c3a83b594ac8e9bbd99b1374fccaceedd820fac3126ae25a26a37e5d362112e33676b08f86bdd0c2b6c4f9ea056f71013084bd923130a7e691781314
-
Filesize
5.2MB
MD54039c1485e60dd32f5b9311349aeca5d
SHA1bde1e0c16776bd971631d5bf161889e92763634d
SHA256203a3b71f6b8a02738a989d4a34c53784ee41566ea6cc3d659a0a2a1607a8f28
SHA5127ce49cdb7965d76e8de88ab19d1edf768ae65eff8b70bbc75793f6448befe24d6ffa8235d03b6be2b13b95d1340ab8257eba23a9753b6ff0ef6283a09ab2409c
-
Filesize
5.2MB
MD596c6ddc172b865c2b19e753437c15d58
SHA1e7160a58541ff96dfb5af2778c0c00de0bf1351b
SHA256578c4ceabea8a462eb36a5826164a28cf7194651d4e402c5882b79a0ec6cf913
SHA5121b4b8d3e42588908b031545a18ae36a5994bafb1bf7107d254496a9c594791fec0049175c81eb946775d3dbc3e65c3933f8399772199a83ab452214aa5796a8e
-
Filesize
5.2MB
MD5d235436f4f174deac5d4682d5e7e3254
SHA199788024586ec036fca3a5f9fdd61c0cb3e152fa
SHA256d58fae4c8f7c9b9b0b63170eb15c2c34acaa1b8ec2cb53571c844d7fec28ff66
SHA512ecb71b5337d606d22f8a66dc8d8cefa2b04c76440ad642fc97ef180c04a4ae0b51b72319b7a7956b9cd27506058b6c228e42bf266dd177045f17ec03fda3ca67
-
Filesize
5.2MB
MD52a189065f2ee8d19f5b7419ef4eb19df
SHA15932ef9ad37b956e1892a84134c0d08e9ad55978
SHA2562963c331bd86ce893ef395f44bc76018054183405dabfd178d6b537ae09fe70f
SHA5122186b2687f2e52ddc3362c57d24b092ba6565ddcee7ba060134062520b8678062abfca90ac3fe23fc45f5705820da9701927a39a8c9ef1aea378e1156b180c6c
-
Filesize
5.2MB
MD5b50de2b1efdf26929998e2c1413d2f09
SHA1fd26b357310235bc85630287217a0f74007c64dd
SHA2567274c75575b6c43388c22b6c91ba6f67dd854c845da86c5dda695dc94eff6f82
SHA512579dd2c8d01c7527cd0fb47529a97db31c735c1717af72f3206f075c3b4558905adadd0740c3d9bdf7065955c7b188e5ddc247666e430b2be2526c1a97a8a5bf
-
Filesize
5.2MB
MD55a2106ba8283d4e4b4610c6a53b15f96
SHA1255ad8ebfdd60b40acfb222ec00f257835ce97df
SHA256bd988e6b3cc2fd7e87f15524c693bf568eb8781293910b317ef6f669620b2cfb
SHA51253bf63b2871312bf83f9ab9c7e3dc4bb94971656ab73c050473dd503bc1b9f2269a93aaae4440510a919de757549a86725a4b7a6ebbee54f51d4244acf1d42a3
-
Filesize
5.2MB
MD5f263677927e4f36571d8a6c3f9ce123a
SHA131ab39b63c12f5497eb7a9302cce1322f2a37fd4
SHA2568151f67e07240bf7920635e5af4a28d41401d8b034488303e5bcbd713fb93e1b
SHA512d44dbab5b440c0fa6a989c25406e1c6d04a3a3a5928888d494e7972878576cfbf30049e387e5826f567566b96baf4089c6870b101a8aca18dde8bcc665c15e37
-
Filesize
5.2MB
MD592a61a1d8a513b4d7bbeb08271b9a8ef
SHA14fa25f29ef6860d71022466cfcea4440e55952d7
SHA25673b79639ad4b45bd0a1ecd43fcda4cbace0d5dba7d2669cd0faa29c3d182dd5c
SHA5120de0d2f5509200de0f4f484a58341921ec50329442041976d01305b85a2b376d20bc9b995e3e5beba7549e57209ad20f7d5b373f7951ee13790ae39aa51c5e36
-
Filesize
5.2MB
MD56600a8d98029fdba21965719683526c2
SHA12a07a0ef60dffda667e0232ef4d71c009e33e52e
SHA2564e3930126b5c9bd038b055515919f5eeb65d32d1f5fe27fa9a37395b546f2a44
SHA512b2119b93d742288ff8a87a0a94246d6231d5e37ebb62c691c1bc44c0444257767bfd1a9b9f141e40c25e77135c3c5f46ecf1bdab7ab34ac026154ea04c30179c
-
Filesize
5.2MB
MD586e8337ad340922e0e459a0bc406af15
SHA180d6e3153d3c4649c0b6efebab123d7506a8c2d6
SHA256151d64f9d84f27097f85f9971e5f460192f5e1cc4691ceee5ea190b43e881752
SHA5122fc941e7ca70e78cdcacd8f2b204a53fdfe3b5470e7233faa5eba2047ba9871bab9a9b26d5b911f9dfd99f7dbdae9402092bc48fd32005d0b316d569b5860ba4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB