Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 04:15
General
-
Target
2024-12-19_b400d0004ef0cdd62a59e7807f96e930_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b400d0004ef0cdd62a59e7807f96e930
-
SHA1
69183c44032bebb8d70fe6a11397d7a7b8d38e3d
-
SHA256
41e43fa5fabeb1553dac99f0f43f5ea21c2098844b6f4d4a098fe027f7695cb1
-
SHA512
a54e5a3dcb04471c84719e50467015d6267279b3a099d0e7fd80e62960a2cdcfec39a4d1182237e14c78436a12a4594a3cb9b50ee6a37e20a6c2161770330867
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibd56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_b400d0004ef0cdd62a59e7807f96e930_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_b400d0004ef0cdd62a59e7807f96e930_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NeGZWxn.exeC:\Windows\System\NeGZWxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XqcpTDa.exeC:\Windows\System\XqcpTDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfXIsFK.exeC:\Windows\System\wfXIsFK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EXNcjFi.exeC:\Windows\System\EXNcjFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wpxGuLz.exeC:\Windows\System\wpxGuLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kbTcqES.exeC:\Windows\System\kbTcqES.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfRVGJa.exeC:\Windows\System\EfRVGJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vCocUxx.exeC:\Windows\System\vCocUxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JnsUIEJ.exeC:\Windows\System\JnsUIEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kdmMyyl.exeC:\Windows\System\kdmMyyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmlKoDD.exeC:\Windows\System\qmlKoDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpEFglP.exeC:\Windows\System\GpEFglP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sZSlWdi.exeC:\Windows\System\sZSlWdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jghuSUz.exeC:\Windows\System\jghuSUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoKUQcI.exeC:\Windows\System\qoKUQcI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPEfMek.exeC:\Windows\System\IPEfMek.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdkwRSN.exeC:\Windows\System\RdkwRSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oYuhWwp.exeC:\Windows\System\oYuhWwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTIlgBp.exeC:\Windows\System\oTIlgBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FsCEWFj.exeC:\Windows\System\FsCEWFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJlAWyj.exeC:\Windows\System\BJlAWyj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50ee7d180249835befe707cc1c3ac8c29
SHA16944f29f8755844bcbdee83752da8c9e81ae2990
SHA256518d941d23e5356dae6e09b1b363eac75f7bb71e20402ebc09cfb2945686339a
SHA5120c54bb09d7e284c6469883f754572c6c5413838bd96c65ab885c0818a5f50eb987b2a4178efdca745afa4b766b4e9ce8b7486b9a2556d957c7117466990ca29a
-
Filesize
5.2MB
MD5f7da7e7e47f547d97a18b845bc07e291
SHA19eb3ed1e9beb2149bfadbb55fc86cb2b3e2c693f
SHA256cb5fcdb1e4daf875be4eda4ea3602a5bcf1bcbbfa0d9898ab0c16055461be9e6
SHA512e28079483630529531c1813d46bfcdb72893f8dca19976246f51d1bb35395b68051f1ec700004126377f695a943cabefbaf408ee3b454c4657da36c4aba8ffa2
-
Filesize
5.2MB
MD58f5754cce5bfc40166759f917caa859f
SHA164c1564ca3bf217ce219e03e56aa7001ff3ae776
SHA2561101f3b2625228d447b9f707308144460ff959500229e61198ef75a14a9f4c3e
SHA512dd915dee47a9cead394af393fa5b345e9ea58d0f143872a9424bd5fe4b3a5c08a348c93a44c179a667c07081ae845e6694a974d771616e2c90569029583f3fce
-
Filesize
5.2MB
MD5b36902bd4aefda38d0d32fe6986541b0
SHA1d4526ddf64410e0133c4e8c19818c7f4e834ddac
SHA2569c539d329b098c4277887ece3513a1783f084ba0a4b374ec055aa50ab53cb04f
SHA512a9555e99c8bb5891513d039e1a9287633223c2b739a161cdb18913bbb42325f0f2eb99c0b4f7b4eff2b209c61a0e7e9f198ed7eecc4bb5a6cd146c1d5aa24ae3
-
Filesize
5.2MB
MD5437200047cf5ecbea2600f56dd974b92
SHA1e10496ec2360e1914693b97b88cf14f523704f1b
SHA256bd0e157cc0a9b83f1da1fc3203268a457897cd8074b1de21006c8ad0a881c124
SHA51228eff89e8b079b3dec9974e1167819a7924aed3912ef80a9b56ad395eed81bed0310b28c25d73406f2713e12d474db08d46172c3fc2bb16363f313d32a2c31ad
-
Filesize
5.2MB
MD501ed98c8f4c684da40811dd06c249967
SHA1d777b6eb0d22f59c5ac85a7d49796308879ab48b
SHA2564df2e1c7355e63b4958136cd3238f39277b121d350d449adcd79fe7cd9df07c7
SHA512ec5a8a1bd12648167d7e12c5681c9481eff1f299fad5ea4fbc483f047d5fa0e9453fa37a77465da9fe29fafc8ad8f3323f0ac8a793066482676c762bb10e13b8
-
Filesize
5.2MB
MD5781f70c405b009f466f9bf5538a3d824
SHA1e2bb4951827e5be143634bc4d7a3e26a7d2ef57e
SHA256f6c9c61b3f6a0a5fae08fa69abf54fbdfabd636ea1b420df65894d2af6f9b0b3
SHA5126c147b059250f6674cec09759cd04050d9f9a28770fff54465f9a1ba62ba44fb702bc71e0593b0f738927c179c8e2439e49ccf3240fc9644c3b59434243b31f4
-
Filesize
5.2MB
MD5fd3e5625689a019c3a2e8094863c185d
SHA19cf8f49d2ff2edbf3d057b7c828b5e309103b6c6
SHA256fef8eafc8888fc04438b714f8057ea4f811a38fa52a3574897a1eb9c451830c6
SHA512f74beaa7c274bfa173aaa2e184c829721f031739fc68db47458b40076e910e011257f899e4792d2c06008797f8a9a6b83dcfc9687c48c2e323af921a9475f682
-
Filesize
5.2MB
MD5c3ed8c4f00392550e76b32d8afb1f824
SHA1ff665959a52683e25e41b53aa9c56abc8110afcb
SHA2563d52adeb18773240c5c04b093d8629d095ccf84775cc13301fca53739fdc0bcd
SHA51260f54ddef754c3c88a6b6ffe176ceafb2392f62fa65b83420ce0bc2c4f136055e7cc7ce302684ba7c8d23b0c005720533517752b78c1c5c2ec061434426cfa6d
-
Filesize
5.2MB
MD5c758d373f358386b727fe3ec255d556e
SHA11b4fe06053062d89e6e5cbac658d80fd3acb86e5
SHA2568604f3bec396ebcb34f1487e45c69fcf98947fdd06a9e5a7f898031020a42bfd
SHA512e5ba7583a7a89e31296d6542325a9aaef62dd8dab5f86678d9a438d7230f9b16748e419995fca5a29a3ee2d1fd85cd3fbd4a6cf744f960076024afdcf8075958
-
Filesize
5.2MB
MD5c5b4880fb6541e67f51c310987d04774
SHA1867a26926d48e26dc08521558ea90ab2e13cbb7b
SHA256dfd16308397279a6e934d0fd7c8cf17f52f4d9cc71a0f3767abac0f982562704
SHA5123924e2593758555ec478558aaaab9be0213637d7a64759e29131181d38a707971426e007678808ec5dbbaef88e674b2e99b8fb403c08186c42c80370c856fcd5
-
Filesize
5.2MB
MD52206716a5d5355aa09bfc288f83425d6
SHA1a80fd2aff64f19ef7d61848ba34692fe6b21948f
SHA256c08652e6a10460e156951f997945a7d43a9d7efe4c02a40c33bbd532c534f940
SHA512d0088ac54a54cb2829aa64ad95ba144588e0d31262e2fdf698cf2195b32444e72a0e5442a25d597a661ab9761858a9a0dc4cbe19a4d5ffef605d2943bb3dd6b2
-
Filesize
5.2MB
MD5e7d6bbc022a0a3dab427c6ef3190106a
SHA1495c499f0f2b5350e9aabcb93780fa2ebba3b1cb
SHA2564ecbad69bff7b0cc2c98ce6e834a3d99538311eb22b6d5a4480476e9d56c12fd
SHA5124684a4b360bc655a1e21ab65066cbdab57edd4f9d9e4966575bde51f3afee1d74ffb1f66732a6b7f1d1347102b677513e11ae3fe6c02be3d46767de694d3a6aa
-
Filesize
5.2MB
MD5b093c57711c474f441b1aae4ff911718
SHA16c3f8bf6236b8c0aa95f1121f9937df9d2a65b90
SHA256f3dd883c2deba07402d70a56645bcd4cc1447e92838782e485ba47e1a0adb34c
SHA512042a15ce1e0d9471f10becc480894c295ad6a5d79ebb41574c0930026e2999d0e547ed0dfbb4a8fdf957147797af8a5f7846374357f082d6d230cb6ed9a28f97
-
Filesize
5.2MB
MD57d7af58e4931f7b6babb7a1012d9783b
SHA1e309d4fb9f7a347c07eb3ae3a95ad2fb8dc6111e
SHA256279668b554b2b3a5c17db566c79f95a9ad5d70153fd46050b6dbb35fd24d05b8
SHA512588266eccbaa7b690a57f850cb977391e4d31e8df04c57846929fa523001fe5b11c4a50e710454d106f6f25d0fca66b817add9014e68bce677dff56173d4263c
-
Filesize
5.2MB
MD56eb1fa7975bc37d7d458c0aaee080948
SHA167656ac5415565de1f28786f67ea2fc329e893e9
SHA2567cd4c53cc8040d6345c5b482ae825578a9f22fc36af83a0cd228d78a1b046f4a
SHA5123f81b282f723c12d0a0d7b517e59d1a74d22ea5ac77e658acff22d0768e3e99ef0b74c1fc8996b5e8a4f00b94b140a7ad032cb185058ca695af573af837327c3
-
Filesize
5.2MB
MD5aafe7052467ffa9077c5ee1df6406ace
SHA17e25f1052426985c3b8a96922fb0910842fda194
SHA25644a0c17123766d8795bbea02012fac30877a93c8c3b06ba49f89c651dde90d14
SHA5120a9f15a4173c09bdcbb0977958e1efe90497a782a7e080650a98050b6b3f7ef25c9e4cb698ee009e6e8b8b1c1c856d353bc57585c40ed48caff49d7ffc82abb8
-
Filesize
5.2MB
MD59e44d3a37706095589f88e0c753c478d
SHA100f5ee01107645985ebed5f0bf780e78a3d50a63
SHA2563f7a1175e11b5268a9cc49df438bd0f956a28123ee2fe76f88f54624a9e43ed6
SHA5122d37c774d9f780562f041a72bd7fd3f6e6f34f4d44c085847f9eae61a55d630e3ea841c7679f9640527b7e2040ab1aeb37124b218c7a16ec85cf77076803db9b
-
Filesize
5.2MB
MD5a4b66680536c36d161c3452b15554d7b
SHA1b7a024e6265a5a6acfbed89205fa47e3ef8431f9
SHA2568dadfe01f1095040d44a598e8ea664fe69550294fab5637585bb302bdb451724
SHA512506426cf447ef3152f1b26a0d4e2cbddd21bc7616a6a81be05da435c6360d79bfaacb594898a97620a043286b443c9975f534b6745f409b33885b7e38e9b8b3f
-
Filesize
5.2MB
MD5f3ebd296f6784e7a2a95e3873502395d
SHA171f63f4c8c36c3745291d6205593948190a58c6c
SHA256468d01fc5122052d37daa2d45e2e2f8669610afb3671b23238b74c6e7784224f
SHA512eb24d2954fd5a3c13dca5d700cf4b19dda2932c3b3fc4788154c716c78b540547aad72f509c3e7909d3da7f4866015f998cf12b1d59d3b9d0ad5d6baa7ba1d29
-
Filesize
5.2MB
MD5a4eb7e48ac3d3985370e8f86708076eb
SHA1babdd0d5f53133ecac9f5ff77f5a16235f0c58bf
SHA2569b28895d4fbe4c1494401c6f8c46960f0c9deb6fcbb966e528b8eae8be565421
SHA51284712d5d2a38af72b8f2d138a36b01823abd7881d0f61a8d00fff39f4de6ead7a70758660d38c12c9bdaf2f2f21c18bf4aad6b2d65b7112aa005f9e54b2ddbd6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB