Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 02:26
General
-
Target
2024-12-22_41a476b64a37f603908fb34b355ea90a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
41a476b64a37f603908fb34b355ea90a
-
SHA1
009bef4ea9312b73212d3f929b818e6abdd46643
-
SHA256
496a4733531c551caa1e3659e5c3ee88d78053305c2cc545612cacd68a7fcb44
-
SHA512
a66ec728fc288b122cd1c50c800c231c434446436e635dd8e7e4d426b1ebac3bf7f3e80217e176da767b2054cf28838f5aa1e8462f738dcfe9f7232c5ad3cf9b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_41a476b64a37f603908fb34b355ea90a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_41a476b64a37f603908fb34b355ea90a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FFGppHX.exeC:\Windows\System\FFGppHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XmXpvYQ.exeC:\Windows\System\XmXpvYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dWKoAWT.exeC:\Windows\System\dWKoAWT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tlpwDkm.exeC:\Windows\System\tlpwDkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsqYVvX.exeC:\Windows\System\gsqYVvX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NoIvCdO.exeC:\Windows\System\NoIvCdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyZBULM.exeC:\Windows\System\wyZBULM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXDNfwV.exeC:\Windows\System\vXDNfwV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xapFeDR.exeC:\Windows\System\xapFeDR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZaUqYtS.exeC:\Windows\System\ZaUqYtS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ImOCwIz.exeC:\Windows\System\ImOCwIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlIijqh.exeC:\Windows\System\JlIijqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIPneUd.exeC:\Windows\System\rIPneUd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKoSvvm.exeC:\Windows\System\AKoSvvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xjgiyUc.exeC:\Windows\System\xjgiyUc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lsaQJaw.exeC:\Windows\System\lsaQJaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPMwbrQ.exeC:\Windows\System\nPMwbrQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMlLcAx.exeC:\Windows\System\QMlLcAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVeLezc.exeC:\Windows\System\tVeLezc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\orBNdSo.exeC:\Windows\System\orBNdSo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVkSaOz.exeC:\Windows\System\EVkSaOz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e71772ef2683db141fe1dd0c40deaee5
SHA1fcdb8a3c20d8f35aef82808cf33309aa1468e352
SHA2561813ef07b2fcc8ccfd755cde534f8fc1e950229391d8fd6384d9da75f780d2d5
SHA51219f52bf1c98e77f8565a3716a953a8e84222c44e91866a076754a9eb7ab12c6693042d869f00d99bcb72f491d6407a0123ab9b05b9142531313c3b84e33e71d5
-
Filesize
5.2MB
MD526a741efaed3971f4c607dcaf5eccdb6
SHA1be7e5a2765a321a3be8c61f02b2b079ad308394d
SHA256b7996e8f0180ec2bc75f7185bbdff3feff240fbf2cb633e2236f9355b0e9860c
SHA512a8cce340f4e8d430a26e2ec10a084bcdd3fc40c8879298c2bb54d19fbd6a12d464900b13b2e6e762c93d3f20c50ae76676093817eaf0c71efe0a3e3169b5bf8f
-
Filesize
5.2MB
MD5957ac4973abc5391b1d270f4e1d0ac8d
SHA1a05d33a40a5d26ef35a8621c08a123c91cb8f543
SHA2566a19b7bf903d37b906ffb5057934c305fcf6db69351d8e8f46ed8e99daf0944b
SHA512895469c8758cb5d4642a87d5d192ef659f0f1b6b5c12231ab89dfa6089cb42076adadefc8f2ba3a85b82a6ce512813b17af9c95fb9f0600d7aba8a89e5253212
-
Filesize
5.2MB
MD5ecaff6d0df37185cdb44e6cb6a01d7f0
SHA19492425a16e09c6be598520769e3c23188741b45
SHA2569b9e2b5066ec5f805861cff8ceecac38340254d0db1a573744c4d2f7b273bb7e
SHA5127aefca4cdd1d5b8c292f815438902064bdbe20cb80765e0861eba545cfb4cec65130978be1092c9ff01ec96e8fbf95592abbd15a790040e01c774a07331167a2
-
Filesize
5.2MB
MD55cf54d49c84d59a7247fd5cb6fcfe2e5
SHA141f149f7ba4f4ee1920ade024b59d88cf99ab61f
SHA2568920536e6d84674e099c812bcced23a912241ad3ec4e1a30c913cb452556f5a8
SHA512eaffe716f63d755ec0a34ec7b825c24287306b2a8cdf1d0dc6021f091d8fa59e389886c46258c82bb4cd69de2fa4a351551e5ab638a246e4ba831329d4e0f03b
-
Filesize
5.2MB
MD561bad10ae8c8c68b6e5f5355d9b2bdb4
SHA1d3bd79937af0f686de9897852a5fcb336e790e67
SHA256f0ecdbe67d6fec3ef776cf5e128acfb230fb0bb23553c5057cd626fffd498235
SHA512e4611066683c7980cb114cba1528ea9bf91a652d759c9c0994cdd60bfd92436e40faec1f223d0d0b04830cea3c28941bee3d15b0c8d4b5efaf307a8bdb14f872
-
Filesize
5.2MB
MD57ac751bb95b9ecc7986838ce1af0c74b
SHA186fc9db4ea97e7067ff4f57092010e84d4dac980
SHA256d3e569f87fbea06e8914b86f31430c77e3b1f8931053c055f2330266422d9a46
SHA5122355bffd3a027402207c9af12c311538a3b8c091ae2e19fdfb90ba17a564b4ac8a649d23aabc7a400acba30c4e2f980fbe6617b5f79e6830ef7d04798ff460cc
-
Filesize
5.2MB
MD572cde996e203a75cef2cd7b28eb08835
SHA1b76224341be66348c404d7b8978aad9b3dde00ba
SHA2566b6375cf0e545070dabb16b56ad4b6fa65b1ee6e0a49f7864c19049df0ea1ba8
SHA5124fba183b3f8f1967bf9db56675464449181920a619d9f53199dc2ca160665cab4957f57335d471eda01220401a3aa17de681d0f1cb8173e79e7d4e15c87c92fb
-
Filesize
5.2MB
MD5bbf40715920b3d528ad950d610672aa1
SHA1d7f6ca62ed4e046e9e34c69d81588d3afb1715bd
SHA256de592bd1953943bed0eec545849fdb334d7fbffa25dda0641f289ea14b15f6a0
SHA512d01c7376f46d035048993e6112c078f7383c1030f60d5ba950d058c66f6398fd9529b9c57d359f9f2183aa54c261df2d11356e4cc54fda6e21aa163570b32480
-
Filesize
5.2MB
MD56f2982f5698db1af6d0bc9ba5048d2b4
SHA167027a30f892f9208402668e9ca6fef370cf43d2
SHA25697445faa05390d4996f5fb787b0884e2e214bf1582211dd0499d34356206ced4
SHA5125617474e90a2871d2a0e1e08f09be9f45b7534d985327cb3c732b4b812be7ba4bb3fc1463db6393b74ee8615474dcc0eb0d6f52fc8f38423d45fbff620afa300
-
Filesize
5.2MB
MD59db5365b615ac97f3c96fb0d6e9e7fc3
SHA1a80f0c8bd99e64de30ebb9198f167857e46eccc2
SHA2565ce6a6d169cd316e51f9b7e1384b5a611db496c8bbb8b81f235295dbd71ea85f
SHA51250579a16a70743f3688381c6de77ca3bc74068ab2a4dc9339be2b18e45d034f2c32a79c7ce86b40122bd9702a41b65aa5c987e85632f4b2795ad6e2aa213115f
-
Filesize
5.2MB
MD58a22b5044cb7a2576a44aca7cd9ff500
SHA1c8951cafe0a4440832deb3a3a1f9cfce75c73a64
SHA256f114e215c0719e846df7e86fca8bb76a01197476ca91288b082a7fa3af43861c
SHA5127f6e2e98b32ee8ae3b799193b45f0d352da07cadc10200df4dfafc61d2a59dae035a40f3ad3bf9131f04025daac80f59f8258cee05579e9fc36044464ecbdc10
-
Filesize
5.2MB
MD58404449d9266a29678ca44f681979db3
SHA116da120b85eb2aa608c4c0a54d12cf6c5dd3edfc
SHA256f7719d89e56d87c3d28c47c2c083d1eb490308ca7afb9de3221c4217af84119f
SHA512956e2c5df667ccf5a6efd315d2650f2c1296aac9fe86b8323bf99901c45ee28c5e5ae431228d3575194b2b94ed5de358db806b6a8f6c681cf684fa914b7b949f
-
Filesize
5.2MB
MD5dddb57fa2f0bc00b4aa9c15289efefc0
SHA1653c9b5ff72efa7d543cdbc8950861ffc59e298e
SHA256af4884192cbd53d01ca296136bbde9b2266d8855a96df19a1d9896261aeef33b
SHA512a6a103add09d44e64a77d5936fbd02a728bc2ddcb24912583afc2e9ddb8e75445fc1da340d8c85d4c53a8d773c4018bb0c60880e4b566f4be11d4b9531055e56
-
Filesize
5.2MB
MD50117b9e141f91bc2de458e51711ea59f
SHA1e5cdb5d6e976ce066c99dfd2eb37e3aff73d191e
SHA256200a099645574333831e4e97db27f698720cf7d06fa156c2896c73f41ae9dce2
SHA512a7e972ba6714fa4fc40aab202eef00f97273e48189e2ab3e036921ce31d30706d7d3591b1f2002ad421ca075d720b393785c9c94a08226c88d88b799cf7c4fcf
-
Filesize
5.2MB
MD5edb2a159ba39d1203062479c53b7b8f0
SHA1d66b39c0a107bef1ca9bd18cf10f889bf8b0709d
SHA25612052e3568bff9c955f03293b17d4f48b8d53f380f07bdb732060c53c30b18a2
SHA51214f9a9d8f0447e49381b60f0a84ec70b74a2a6d0e44066f7eb3ff9ef2fa7b494f7a79302767e9181a42357e0421b8b9b6c8b6f6ac68b04aa843ca64be2bdc9ac
-
Filesize
5.2MB
MD545a10a239d3f5799efaf546af1507fa7
SHA1bebb3110e68e6749479431afe3deb7d45700dd7d
SHA256b1448c0f9da8105bdbe8b22a450fe81eecfdbac08607893bf85ddfbb3f015dce
SHA512aca101a6e5f7b23defd2eedfcb742736f6f453cb8d9b69a402ce49932cf2237c3038fd206acc36fce43d640b568bd682b7d8b585ed55ee97d0dac5e33c00d3aa
-
Filesize
5.2MB
MD58f355afb9c8d262d7ec8496825225594
SHA1716d7e7f69938e71df60419b9f3315c83d75d570
SHA2566eb5a37751d337619682f0102f95e1784832915d7db97743dd2dc0fe11ee6e9a
SHA5124a67bfce11d426bc922e781c06be227eccbab03920df748bd050d7fd9a25d60d5444420d01538d71450d94cb1dde0d9e64419fc0fa6d15eb22b3a80042a3559d
-
Filesize
5.2MB
MD5e1ea7511f634efcec26c782375641c70
SHA1172dfccb7ac501246eec778912188373fea6396d
SHA256950fb980e7f1ea9cacef09e02a338f046e1d09aec961b7a24e88512cb4e08b3c
SHA512bdf7872204de0c1e226b7b13f35c6e0009efab10e235a74e6e81ad7a116aba6c0570ecc202d7062e8cbbb3e247872fff14e12084f30cb6228a02267c127d6259
-
Filesize
5.2MB
MD5804c439de22debb6934b683b54c77bcd
SHA1a1fdc683de0ff149c36d2ec3d85306260ee475be
SHA2566558ed7e6ff745249663588bc1191a48d95edffaf505aafa56095d63f86e6dd0
SHA512bd3140ba132cf5bd90ac1610cbb22451bdb996d839625929ff63302edc447cc40207d190c952f465867e4a3bc4d02d5d96ee1c2d7cc103d77769faad16cf0a22
-
Filesize
5.2MB
MD510758a87b26d93659da19065c4847791
SHA11111f5f081556c9b8048114c71a1b76ddfe7b047
SHA256409a0226dda228c1468fb0db10edfb32dfe93c0aece78398acbe2e49caead2b1
SHA512f8d1fb59395620c456968ed24244077aacc1212a995fbe9c2fd900a05389dd630a7e7093d5be932aa824392ca2e5f0bf50d9e8156722038a931193eb7e3030b5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB