Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 04:22
General
-
Target
2024-12-19_d6b6b2a7f86d0672fae650dbf4589082_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d6b6b2a7f86d0672fae650dbf4589082
-
SHA1
f1f3d52548b22736a36fafe50d49a40905390153
-
SHA256
08b1559f4c4337885ee8a1547aeb313137a721fd9f27cb1a5e31cead3728e3a1
-
SHA512
1b3b29d96ec3c9ad34cda8f15d25e3a97ac19fe190c28f5b0a45c616ba6a43b24cfd71569b7c9f2d825ce799aed3e2a391d98e166617140ee1bcdfd0839ac937
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibd56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-19_d6b6b2a7f86d0672fae650dbf4589082_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-19_d6b6b2a7f86d0672fae650dbf4589082_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DlJiMWa.exeC:\Windows\System\DlJiMWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPrhPqa.exeC:\Windows\System\wPrhPqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qqagSqL.exeC:\Windows\System\qqagSqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNnLZjn.exeC:\Windows\System\VNnLZjn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aELDhqh.exeC:\Windows\System\aELDhqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vfNcuID.exeC:\Windows\System\vfNcuID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dCRPPas.exeC:\Windows\System\dCRPPas.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZCeNQpN.exeC:\Windows\System\ZCeNQpN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFENnLf.exeC:\Windows\System\lFENnLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWuvAXq.exeC:\Windows\System\uWuvAXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfDdPdx.exeC:\Windows\System\jfDdPdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vkdcxpb.exeC:\Windows\System\Vkdcxpb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUVlrop.exeC:\Windows\System\mUVlrop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shSJdXz.exeC:\Windows\System\shSJdXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MoNAlnQ.exeC:\Windows\System\MoNAlnQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YaSDOCT.exeC:\Windows\System\YaSDOCT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SaElHXV.exeC:\Windows\System\SaElHXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIEbwAU.exeC:\Windows\System\uIEbwAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOyfDaC.exeC:\Windows\System\rOyfDaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTaOIFB.exeC:\Windows\System\oTaOIFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bvZvhUI.exeC:\Windows\System\bvZvhUI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58067c034fbf171075664aeb8f1d25176
SHA1dde2e705e82b9917707a4f710e224ca2d37df094
SHA256184ec5a66521a38e18c09485c1fdf6d52d0e8467f09beaf25041eaf28cb8b43b
SHA51226eb28a20c7d11ae26bff8d56af245e8e62a16339c9df43aeb823e16969e8c7dfd828b34d35234245a760fdefde8efee122e4ce5085fcac4e168c5968e0cb3a3
-
Filesize
5.2MB
MD551d8a1c3b9384110ddb8921bcc34216f
SHA11488de242e1382104891d28543e508a7c80d3161
SHA25680f10d72bbaa36354210dbb594ec3709d4d98a0eaf6551205d05f518544a95c6
SHA512274699f750e420b49dd952527ddfd9b02c1da826dfd8272ee564d529a0f0cabc2c9047618b7d4e2f27d78c58fe393b7fd862c6f7f5bf4c22b8fcd0ef2afb36d5
-
Filesize
5.2MB
MD5b8ae1df5d6ad8880fc3dc73c6150385f
SHA17d8378437de074ad7d452e14ad95b505f514f442
SHA2566bed4d3a1959677f4d8469979d776d0b88a5192730f816d36f4f02cfd1e44a4e
SHA512e200ba31681182ae67da5c800ebf5baa636a7fef7b3af026de354eeebbc4a3b8d5a37f304a07da34bec8845200c259ca9d827ffc02e8d8929961240c07beae09
-
Filesize
5.2MB
MD56533668c3530d60b33d65d4a2f63fe07
SHA1f64ce6f31bddda4fbbcfaa516261b0df44f92f5b
SHA25675938978b5c6f299900149215b7b9368e4aa45430f1fef0157141e6bdddf8f43
SHA512b916961293af1bcaebd080caa972b4e269a243db2e028e5911c82bf4883fbd37be6d5b680f4d2ce212d23ef2db4b82f9e643cb49afc95c9b321d832c63750a5b
-
Filesize
5.2MB
MD567a29e8c305ab0478d283f6a29feb8ea
SHA1888f9c97e113d80d48f1ac9443e7537edc667370
SHA256e9ef1ea79e4965de91be17e93ac1c0008c74b255bf2176e183f8329084a0ebcf
SHA51220e308b4d70f63b41e20819444789ec8a2de759c8812158eadc12820f56bd26ccf85d86df0a9c83a5eef9587cd914c631f84779a204302dfc051f29cd3c56745
-
Filesize
5.2MB
MD51bacfe3b55555189e598edd7b62c5de7
SHA1ddf272c9cd10a3fc7ba05577bdfe83ff5a10d270
SHA2564c1cd824753a438589e1b6fba9af11a4fb2f0d7bde9a48e797f7d2b9346aaba4
SHA512f7af4a2addc92814f7a02808723c689a320e421506a6c53d883e8176b73af2ec4f6f92478a794deaaf5f193168f3c6acf2a240e7d356e6af8fce22729129088a
-
Filesize
5.2MB
MD5694f335752f8a60f161448457a975dfe
SHA16ba213f9f34cbd601544f3d27963f96c2fe9176c
SHA256bc3cbd8205d4b8b4918748c96898dd597de9697bbcf6667fb770c8e0aea1dd38
SHA51256ffe2aa11d6f575452a9a98711aa231810bd77c842a094c3e4cbcd4df9812b75c133e223ca410c8a2e2c56f306a9bc2d6ab3486cab527b2c1ac91e612151702
-
Filesize
5.2MB
MD54bcc7f1ddae92c8101a236f12b4ca8a5
SHA1bfe6e03ac4c2cb898b3c769e231dc7a57f37d747
SHA256ef0254b902fbf86e7fdc4dca74132f7c266a61cc24ca3c98938dc87bc0ae9064
SHA512f351919218edf68d798d2281d135ffe1c7a65ca5451d30ebeee4a2bdc357364397f69732f6e8a4b31276c1d005adab810dc4cfd3b5f570cc1816ad319d7d5942
-
Filesize
5.2MB
MD5f4173a2f52f9951ef9da1c97ff5328ff
SHA1ea2c1d61f634e494da06f54990a71b7eee1c4b71
SHA2563918ef4aee5e675f307f50d254c3e0482a52347311af2b63ee7b9a0d88cb8a2e
SHA512609e0816900d7457699c8980ce13b44a48911836b28b323e0b14e2ae0d16913dc6a6815e73db26a4c07c6004435d5441f45594c8172bb016bb1457c802a82147
-
Filesize
5.2MB
MD586e33ee61cae8f62a645cccf30c6db07
SHA1be53043a86e8107fab383d3b37ff0ca24e3a6070
SHA2563405c2da551395f4771dbd921909b6f96538db498ab90028ebfa2374cfc69226
SHA5126c3456a17bba888cd09414cb917f5d159e8e157af6ab26fe089df69d29e54af859bf7135e4f4ac9c19a8fe81681781ac27d3c2e80b5ef22cfcd3fdf30a25427d
-
Filesize
5.2MB
MD533dd46c092b4602296444cc7bd298699
SHA123d6339fae9e76615d9b41c328f88b565434efdd
SHA25615e62a06d970816e5e0aa09dfe79b3d097a6aa4ab8dbedea2233e5eaf0d4a445
SHA512ccdf2f63c8926d73d38196c3fb646b6cee2ab25aecd3f39a117e0e020b3b179074f6ce0e6774156b5fe7d6cd9f52b8177d04873a93044a247ca4ca5e8cd3a8e4
-
Filesize
5.2MB
MD57a3556c1a1107f94c67122821bd0b4e3
SHA13cd737c365442b924c99284dd96f69f5551f1c77
SHA256e344a097b7b135f4332031a43d59ad5f473ba57e248a05bc6f58aef392577fa2
SHA512d69111dfaf5c293284686a429d72b70830cdd0b5124874cf19a7a1d9479a6bf74a3d5ffd09daf73fe792b0ddce0166172134de931f01f368710367f0960767fc
-
Filesize
5.2MB
MD58cde4211141b6940425b6fc13fbab18c
SHA1f66570702487d44dfd7e463953bd8b300ac449c7
SHA25666f34b98806ea44e0239a5bd548eef3bcf97214e4d7e1133d0cb083a672340d8
SHA51232ce84c688cf533d0832fbef56768414e73858ff157adfb5061cff74e850abf12a7e0f285b51f2c9c5882da58818ba5baaf1db3dfe3ad6a31134af5759ca3310
-
Filesize
5.2MB
MD5b45cd21c1fc031b84a65bb693a9bcdeb
SHA1512c7414af562e68790900f0889d2d7579895afa
SHA256933f6696941630b590db3579b5d3380be8380cfbfb8aaaad82668db77c5f4297
SHA51200799f97e45589712ad937d0e3eb4cee96a7e8f7569b1e2b4a8276a0efcfac7cfa5a6ec42d2675c35e75e19aeadd1448449d260572a86c5c5221357a26eb9407
-
Filesize
5.2MB
MD59ba8df909900c7f75d8495922183c512
SHA100f6e20f51035c446b43b73cbe58d072f5cdc5b7
SHA2563a3e0cecc49e6832becf45b5496c89d1c6f54e793b6f04e9bfcd3e1fd0da22c5
SHA512d47e5ed5509d945de31985f3bf81cbabf8f4cac9d21db77f70ee93a788e2ece4bb3a5d9fa96835da65ffd5f22a78df729fc54afff21d9d92a9b7c6b575b09c8d
-
Filesize
5.2MB
MD5a115c32b9e6e6e94e363f61082be7101
SHA1ad91e60d820ccbbf9001eee4a8d78385f7143de2
SHA256bef7f5fbe817183f4ddbe7bcd93653f071ebe1ad54e3d75af4fad82e94b72fbd
SHA512762bdc5ec7395b12972a30428a61b5c27e6a78a0ef065db908e8764375f4f315d62fe8a0f01e90a286dce6250e278d3678c0f2f5781e71c2850ef69bf44b35de
-
Filesize
5.2MB
MD56ead04dfcfbc5fa1cb7e31d6e25199c5
SHA15300a8b5c3dfb975751706e6a23a0090d9ec8408
SHA2560bf232a249fc231697eae8ffa56ebb6aeae180081a46d7721003d0bc2aefcd35
SHA512e9d11f97d1cc691374bcf0e8d2ea19406f965b274dc4e7f2396d1fd4056b64e9bbcdb308381e30e8b26dd5a4bcf9485639f007a51779d3c0ccf61b7e40619118
-
Filesize
5.2MB
MD53cf822f252b0ea5c933e165b39bd9e40
SHA1290f40922d2a26c81cccf0adb9690debd07eb7b6
SHA256cc0570751446cf6423cd2ac91a05a072e7dd047355dece44dc004ed7fc7a57bd
SHA512cfb57c09bb0a3c53cb0efe42e101aa53d24090694b3a5536ad12840b4591aaa7d19d9163795c155dc0969f8fa3d81077a7c29ae7c2de2f7e6dfac98ee4390aa8
-
Filesize
5.2MB
MD5810e3749903db361daee174278dab605
SHA12f7b35111ff1a933ec72f08efd4ca5733ec29d3f
SHA256c07582e3570b415d3cb6d05ea7ea54ae8a36b75ac04495d52d3024b84ada3a22
SHA51281216caea9aff2f6b530f6762da9c7c7d6ffa235c496a7502673fd613f67b2a973601de0c1bb0f437708f800edad28e85b4adf81c8c7dce9bd3fcdc2751cd6c1
-
Filesize
5.2MB
MD5a2f0cfcb0b044bd4cacf09e682134d8c
SHA13a8040063e509dbd60bc650f91310de5ce92ac46
SHA256de3139942d1754c811b7c8742da6ec4f06dc0b1e520ecdcf8edd9126ccd7139f
SHA51298a978f6fd5b4c8de629c10a1c8063baf2aaed266705b8a5889478639776fe8559f1f4f3173f6d83e4b038257895f879258edaec5bf34368943be500232ac593
-
Filesize
5.2MB
MD5d0a1fb67221f7d73fdf9a3403a12c9b5
SHA10273d3b9a48eeed8b84e2feef6641adabebbc8ef
SHA256ce81cf964bd18277e45506af729805d8a6cfea882113815612622f2457ebb9a1
SHA512341aa9a7c43623d6c7dd3c46e9bc98de752936203f6ed97a59629aaaf7eaced8fb03a2eba615477b01d5676f7e1c88b412b5ce951776b8a43e1d4e5a698a9525
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB