Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 02:25
General
-
Target
2024-12-22_3fea0dddf6745de4fd49e91754345bf8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3fea0dddf6745de4fd49e91754345bf8
-
SHA1
574788e037072fb5f36ec0cb632b6c4462ec6c19
-
SHA256
80a40177f56f98c9afb5c2a5bc0c8211c455be62649065f5c3a12eeee939e72c
-
SHA512
c5cecdcae033ebca1ae6af0c0e08eb76969d8643ef6e10218ed129499cc5e7a3c10357c1150c34664e2275bf7973d991200bf192ac4460aa0ac32aa8da7d7e38
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_3fea0dddf6745de4fd49e91754345bf8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_3fea0dddf6745de4fd49e91754345bf8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ueajFwF.exeC:\Windows\System\ueajFwF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrefxIs.exeC:\Windows\System\lrefxIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzabvJD.exeC:\Windows\System\xzabvJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LyePBoy.exeC:\Windows\System\LyePBoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JXaoiQo.exeC:\Windows\System\JXaoiQo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVoPMhn.exeC:\Windows\System\OVoPMhn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xNKGbZu.exeC:\Windows\System\xNKGbZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qaDAqdh.exeC:\Windows\System\qaDAqdh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZEZERmO.exeC:\Windows\System\ZEZERmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNfIGIX.exeC:\Windows\System\NNfIGIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\elUOvKp.exeC:\Windows\System\elUOvKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBzUolR.exeC:\Windows\System\FBzUolR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GXdintB.exeC:\Windows\System\GXdintB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgewAYW.exeC:\Windows\System\GgewAYW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXaMMUE.exeC:\Windows\System\rXaMMUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rthHAXD.exeC:\Windows\System\rthHAXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CoGgNcJ.exeC:\Windows\System\CoGgNcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqrkaoU.exeC:\Windows\System\nqrkaoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VWUSYbb.exeC:\Windows\System\VWUSYbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYHHjSR.exeC:\Windows\System\rYHHjSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMknqPL.exeC:\Windows\System\PMknqPL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD516ee8510ed2056bfbd53ae92a6c12b14
SHA1aed1cf5e662da09bfbdf2d0a9d36a69472df7d32
SHA256eb576d3f687f77b4b4263528ec2cbeb04173d6e4d9a6b91885037e81c3075381
SHA512e32f88749b4448b625892fc225c0a1e4e36e6152c1a0936f3b260a10617a6ddbf38393c729c850ed3a0f5835f4b327343fd1595a67eef77d66b99b5384f383d8
-
Filesize
5.2MB
MD545aeca456e3520fd8ef504ba44529918
SHA1edc45d22cae2e4e10f7a89a6bd3178226e6c78c4
SHA256db0a2febf6160e328dcfe89605c2336df81064b8737291d15428772979451b59
SHA51296b160094ca3b171ff17e59eca5e53cd04895fece31745fdbac24fea4dde096caa0f51bfc559c2471405b53ccc33fa8153d45fd776ac08b088ed5609237bec87
-
Filesize
5.2MB
MD510c8428af4f2aa6ae3c9490bd3236f99
SHA1dc8cc12db5b180f033591b12ab3a5791c8d7c88e
SHA256ac3782af44da8de854384b87374cde9053cb9258b0590baf340e1024c6e4c2b3
SHA512ba23489232f97faee5fa9cd334cc13ca5db867308db22636f1004528002bb22d334b12903089825a9491a0b2400c1268e23e9a24bb03ee58528856a7d3c68186
-
Filesize
5.2MB
MD56ca651647feaf46de5752a1b624deb08
SHA1eea9f879ddbee03ed72b0491a0ecdf5c0737f6f7
SHA25689d7f52b0ca9f561be594fca4cf4f9f944ca516c3a3dbf1dc4e6fb63ba93327a
SHA5120d72f8d68f6f4fcc2fd5f0edbc9e53155f45c57359dd8158dd80f92954f3ddb50f97e503229050effa529ae50bd60360f119dbbe23b2f39bcc5ce3a89978d7f2
-
Filesize
5.2MB
MD50fab7a00ccb227238a984440cc6aa195
SHA127e5377493b0257981b995f068cb3fecc2a26cf7
SHA2562d9160bf093af5daaa5b31a40ec3fa7d6f2ac8c53cc35c6759d91a04519a078f
SHA5123f08300e445f2f2adf87ada42533fac6b904e1572c209dbabf01bb6595c6ab7799126180f84de288bbd20cd746db1f468e4bec8eb2b6ebc39c8f9b78680d1f74
-
Filesize
5.2MB
MD544f3c3965dbb837431d3f64fccaf4793
SHA1c8948dedb9ea108b6da83a2268f9967fbf740e16
SHA256c5250178487f7e615cb6a64133f6f0a5fda875983786a00705a58df55206a5ca
SHA512bc39634ccef0bf5df3a950989d329d5479bb44d1c35c70ac07f25f493c72ad7492bba8cffaf37901095bca73907ff2c2bc1a58af55aad1a4ef50c6e66662d557
-
Filesize
5.2MB
MD5d81beee16ebf70128fb9e20aa15aeaf8
SHA11d83c9ece9629738b39c36aca5d2568ad56484cb
SHA256d66c5cdcdccbc1f5389612137547b0c3d36523cdf624e83c7787ad2a130f47b9
SHA5126b86f12469334ea68874320a5c6227c72e80db3341a744b4b56d5b5c7863d20b3c92546d29a9d41c6999aca0fdbc14b537c3f2e6b7b2d9e805b3c2241cd87b0e
-
Filesize
5.2MB
MD5cf41047a3dd7bd2232ba0edfa32e1d1a
SHA1560089a941600554e6d454b259ec20824cf4c428
SHA25602071f317325611aa7a2ae4c46d3a4d31c983aa514a6fea7b26cd74a184fadd2
SHA5129cc94e5319a9d9a56de2c43746b5192afe70439df729e94f6a490de758da57b1ba08c52faaefc3847dc56d91762b15774487e806afd0d13692eee96f1e4d4048
-
Filesize
5.2MB
MD5cb07f8c499715c14c7fed22f22bb8e97
SHA1eb8956c90459de9130486bcd1081799fd7e1b417
SHA2562584e1478cf7985b82ad42604f42fb7705f40530d8ea62d9e33a4ec7c4a2caa5
SHA512a2b57920bad0b05638d92ea77b48a0b25065682c49e9478ad5a4f1b99ac5ee510c9b9c3ca6ad733ad168edd53cf040e3544a5cfe0f6c0a11b0a87e473ac8f63f
-
Filesize
5.2MB
MD5787c1557b4e918c8c75c6407adb6a4ff
SHA1bce79a428ae45ea6da2f8b6095ed1691b75b5c50
SHA2564e4b913082447d0b1e963ad24e255051453fda0d8c0115cc0d1f769fa9deb56c
SHA5129e0724e79d995a77c890b4101c3a365a2385e0541aec7a2560c1052b925f27bdc0f5fa32d4d715830102ede49e6d53036c29519ec7c232f870698ec9adf4b885
-
Filesize
5.2MB
MD5b2e0d75714ece5fc5d8e6eb062cc431a
SHA1f88e837223a252cb153c2260c69c77c3f734cce3
SHA2569ea52d76e0edd2eea18a48f3f60b658ea1f3cd0d59bc6f2734ed6aa32fdcb302
SHA5124614bc58b5c82026c399e632168d30b48dce5bb36d7f7160d62a043e623737824c7f2abc82aec93d4344cd344ba55ddfe8749ec89d1c571cea5c45a6ebcc02db
-
Filesize
5.2MB
MD5a92db4c79abe9183fce0bc8019eb1457
SHA1f792c5dfffae30bc65a5f112c0dd66f5c6921d4f
SHA25684e209957c07de488db0a2451cd36e6cb5abb43579dd3409587f12254d515370
SHA512283618a8f34581e9d4cbcfbe8f6ccc3c954df1cee9164a591ed48f82420ccfbdb4fbddffe59a159af4ee43a305fe27b88e7f73b039190774a02a2a59b9b19388
-
Filesize
5.2MB
MD567eaae72a37428c516b0ef2e93f5ab87
SHA169d0d3297d9936d24d19e650143ec97e3ce12596
SHA2562cfb3ae33f180c2413f2e3d4c42792cbbd2bb2d8e87840c82eee644920695211
SHA5122534c8d44fcc44944a080600840d55f2c90b5771b3efeada20376f9239a01bec77e85d84d8768b588bace6a69c8bd2ea8e83a5c739e1d5e57685691b3ed0d9b8
-
Filesize
5.2MB
MD57df44c60326a17b1778f02b773d0e6a4
SHA17edd823afc54a8e914862cdd6aec069ccff29d4a
SHA256f55ee354ecece373129d8c076dfbc9b8da7252f02fafd81c9574df23b971c510
SHA512d0b1f9c65142f531ae78a015458aad18b0e9192bf1be921404d20925f33235fe4fb9117e393a26db71e179fdd8796f04cf77acc215cd902a15ab28c7d1554b99
-
Filesize
5.2MB
MD576be6c347be3eb9ce3324dbdf805a8b6
SHA1cd95da7980a278bbb6195fa4aaa6661cbc2fab4b
SHA2564565166206289de1c0ce7a8b9c0ee28aaa96760f02553e5102b699c0f15a4357
SHA512241ccb74de41ef5d6d687589076015b601f4b00cafb88df69d91441d6793aae3c5b7db824838a9746177bbc1f8580d851317206e3fa879e71976af5bd945386b
-
Filesize
5.2MB
MD5e756b6a7275af6e71693ba3e57d5e951
SHA1abfcc1f3938374d9c81e43484f45acec35d3a374
SHA25673a61150f01c625555abc78da80bc40edf87fe7901c399dee8c9697019d1a169
SHA5124c2a6f668ca6f16accda25acf5979f05df31c3130e09bc4cfc45fc85990ea3c725b2adc32e70a5da4393bd70497a5828523c4ec184cd623d07ac64700a2b94e9
-
Filesize
5.2MB
MD5a203fa718b26ccf023ed9bfa10073686
SHA159f0c30da24c154122357cbaab771ce9ff7c57e9
SHA2561ca57f226ae04ba189c80168956b3d16252f5c84265c10d2fadf256536792a61
SHA512b4e290b01a7a5f36e2680eabf3c26cef21b5e581a27318fbb84fd25ccee2fd073bc586ea1672b0f4abf99b4ef6602f146916b01892e85f5801307c79d0620c34
-
Filesize
5.2MB
MD5368e7a6dc07c9b8696cf24a5ee667b45
SHA1f41e19b34fe8889d9de93a12960e249365f97200
SHA256b7e5692ca3cd888c5a5fab563ee13fc1006910ccd3c84ef262a606c39828bbdd
SHA512f81345ceda7bf58cc8e18a282cc2555127d6009511d769fac18e1ad871202d011df59d51d907bbdef9aad422d52e3c607e0c5daf9893512ef9edbbfe11692008
-
Filesize
5.2MB
MD5f2130626605db5d70e6ffb51e1a54ece
SHA1f42c6bcc379285aea8321792ef156d30a908c862
SHA25619528d63beea45bd6cb6ec31dcd774556af4ea2096631d12c1072957a3f26192
SHA512dc100b1a455be4ad929b45e1362463ba5594b61b6428386faceaa0fb691cdd97cbde3d53a82a33c62231e982a0538c88b5b41c3d433bcbcea63da2e581c698e4
-
Filesize
5.2MB
MD56aa73cf530875b544a5df34ac1a21cd2
SHA111d7a339e152003cb1f4cf36a76810f38ee56478
SHA256b8a4e1fd83ee52990333ba94dd9acb811f2bf0e5e230cfb4c61b187e70ea37f9
SHA512152bd106d36d8433da2112c9c031449f8132b69d4821e3db5ef618ce6323a6bf0a932a30b853e624be9ddb25071c58b105f90c6f63c4d4fd97821202ceae251f
-
Filesize
5.2MB
MD511350b647a00f37e3af3c6589d1befa1
SHA14f2475f15a7fe5aae18d59b0e3f997eb78f0c3fa
SHA256488d4dee6ee19dd5e892dffa37d6c198634afa8f55a5c6c4a45f5b31696b49e1
SHA512d4ef70c6027f7a899570758ddb5d95a22eb283d255f3e4a24ce6a3973f7b370c079ecc9012dc817738bfc02421fe3d650a88262001b5d1b9f90a2aa76b32611f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB