Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 05:30
General
-
Target
2024-12-22_d13dc3f757198a67d306a5ac93483a0c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d13dc3f757198a67d306a5ac93483a0c
-
SHA1
722a5df16d7af113fdff42d9e4c12d9dad20990d
-
SHA256
d3d90b17c7f422b7978ee194ab8ceb68d3ce6bcb853e02ea61ab0cddbc029ebf
-
SHA512
0619250d308b4b6cc683c1fecf95490b35dd07616f39849ef899905f29e71d1887697e7481c81cf65b5bf220211f758958effd44ede8b782bdb4599fe81db307
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBib+56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_d13dc3f757198a67d306a5ac93483a0c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_d13dc3f757198a67d306a5ac93483a0c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kyYctAJ.exeC:\Windows\System\kyYctAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vcekmke.exeC:\Windows\System\Vcekmke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wLtyUSp.exeC:\Windows\System\wLtyUSp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HuBZmGj.exeC:\Windows\System\HuBZmGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPMerXn.exeC:\Windows\System\PPMerXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oAKmlek.exeC:\Windows\System\oAKmlek.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sGOxtFu.exeC:\Windows\System\sGOxtFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qJDARcy.exeC:\Windows\System\qJDARcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JbIAybI.exeC:\Windows\System\JbIAybI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdzuWYb.exeC:\Windows\System\FdzuWYb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOOioTT.exeC:\Windows\System\lOOioTT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKwDDSP.exeC:\Windows\System\rKwDDSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxdlesc.exeC:\Windows\System\yxdlesc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDeSRYw.exeC:\Windows\System\hDeSRYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJFQxLC.exeC:\Windows\System\XJFQxLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LeKOCHY.exeC:\Windows\System\LeKOCHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKiZWXM.exeC:\Windows\System\rKiZWXM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OaDhLXi.exeC:\Windows\System\OaDhLXi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isgPjsG.exeC:\Windows\System\isgPjsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OReuPRb.exeC:\Windows\System\OReuPRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsddbUi.exeC:\Windows\System\JsddbUi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f39876e00072eacc2cbc5b923ec016a6
SHA197f4a6a4a8f7180d442177e2a46c65a4eec6da68
SHA256a24b50023e88274da10110f6f308684a8caaf7dddd439b0850c5cafca3849e47
SHA5121a38f7b4a890cf82b3ac7b8ca81d711632c3a0c4dfd820b0be3a520f9c548b194af752bb9f55a6643ddfd12c125e63ba7aa97bb5a71818a41a3c26dec0b5b159
-
Filesize
5.2MB
MD55be488ddcd354f22a07d30274d36ab54
SHA19432f3bf9ab357eba61ab7bcde412929dc604d71
SHA256406fbef12c53168c543d93fc17bcf38da53c3aae3e6eeec54832e987bfaab536
SHA512a6361de2014e69e55b4f0b3265b59e3897e37e61398a030d18dfd83fd45c17dff42991420ddbd381295e8ab5668cf51b24d2da30802529a7d9664a01c5e2c8a2
-
Filesize
5.2MB
MD5759cae26a78460ebf14e30c9cea72da5
SHA1f7a34c92d80d6b5ccaeb0f0d38bb0ebd8124b86e
SHA256e778fdc60066e6de306b207af4de35961370de671f510211c5c6cc7009a9659c
SHA512ebfd66a759ac7ba87124c41728d31288231bf6c2a0b9a25a8b37ef9214713156e775427a38946b76918b96cdcac05383719a5670b02dc9efb4c96e1939515173
-
Filesize
5.2MB
MD50e1581716e6066dbb8863b18a3d73b7b
SHA18ca46be2e2bac4dbc080ab50b0fdccea6c54b3a7
SHA25642c65c3c93eb38fd0c17039b20cf956d0e68f4934b914cd3cdb45d720317f905
SHA51282cd7421318a53f10c3c42338559f1583f6d3ce2f2dc2ffeb81837bf2da4c0db368bc0d04bccb96345c10021326f86d65b87198d5719c79e9f99ab1456a5532e
-
Filesize
5.2MB
MD57a7af5450dcde76ce25f842184318f20
SHA18febb5eeeaa694266885990e412bcf254ffb59ec
SHA256952fdc17d461641adb1b2a42e1e7e55e793de61907737710a43fb17b042996a8
SHA512d2d0812574e81266f5d48f40e06f5b2961006f32261be44dbc1f6f71b6b09424dbefbaae28134128a6c21a9a8e201f0797616f6a2ed7cc79047c597c68e8ed28
-
Filesize
5.2MB
MD5c807356e4b8f4cf7c9751830a04c72fa
SHA19fb65bde52accd54491ca0723b1351e369dde3fc
SHA2565c223ddbc299ec51389e7ceb6114bd97b76a81a1f7fbf606e471f7612a00cca2
SHA512e152eff5fd567f9bceeb60d08cd33b21779472732922e1b5d0ea46722cdc562d59f63ca1e5d6cd831f601965b326a128fbd08d8291cf134fd53d83d51ae970c8
-
Filesize
5.2MB
MD5641d4005834ae759e728a5c8cf76f233
SHA17f16975294ccfb1ff60ce3e149e8ffd49dcfdd7c
SHA256b63177f384ffb1fe8c8332261db3cbc5c0d8b91350c416181ca2398d41295f42
SHA512826c5fa13496240d2c8d5b9c69736bccef6ea2127ff3498a76bd8f41a6d4f2ced79540eaed1f08071fc967f558ceeed8b64cc425e82591bcf36e6c50b7f1c796
-
Filesize
5.2MB
MD5e89bf0722f1bfdfde4aa938f15299d71
SHA18298e3bdfc08421dbda48e6c95d8104642ceff8e
SHA25642725ba7cccc31db77f9976ebfabf90856fab996d8d318fd4ce345b952cec840
SHA5127403071d94d53f689ebfd08af5b3ec0b82ad46746f9f2898a7b31b976e1bb59e86b16172478b671cb4e664a9315817ee0e24b2182a22bdc9b381772ca0f1d214
-
Filesize
5.2MB
MD517b9f74a7a44556d0f491f5d649c8c4b
SHA15445f3011eac8c88b9e32d89e3b27a35c62689d8
SHA25601d1f8ab62daee3ce11a5910e49a3c3ddf3dd99521beb6c139b14e929b09f92e
SHA512463e189ea04d7f66e67b556e570512a2734c3b3fe6603c303123050c1b957b480e6e47d8c18a8b429042a368c5cbec4d519b91e91f61003e9110d7bc0aa1d17f
-
Filesize
5.2MB
MD55df106cb21dc9c42ecb4a5ef4eee48fd
SHA1d4a30bfec5e31874284ee0ccb5739b5dafeab515
SHA256d211056cdb834a7310d2f108369d6816e34abcc2d506772cb54fe457fde69c90
SHA512b6d01e3ca37b3110a15ff093b43e66bfc1286e1e7c8453ea955c9e15b95f4c8cfac6aed9c4a1925a7078197835af37840ca7b98bf97e92e7d2d0416650d6e065
-
Filesize
5.2MB
MD569e3266eff855cb011df575c8b8028cf
SHA1470a3ad8fe65ba18cc9da204ef15d1c097e8cea6
SHA2563623330e8b15e03cfde2f89b23adbd231fea683cb924fda94ab7123628c3df8b
SHA51290281bb419fef3a0189d135ae40a9e285181197e7168f326c8d392e943f0d0f5ceddc4f868f005dcd1fdba19325a4c15a1f45627611ef4bf7746728214f98687
-
Filesize
5.2MB
MD536727270ef2f6639602ba6c0685bd676
SHA13f3f6ac80a73ee7e4b84f17c477a37b82052e415
SHA25661eaab4e2c5ec3d2387bc5d19955ad5f5f9243dae6f640564e2aecdc9b7ac901
SHA512a664575fa23c786eedf0f3a4645e7207e73b06ae783998ae42cddbbc8fbe12ed4e3f4ece344aaed63b435f36097418c7b026ce8d78501c50885251323a5304c2
-
Filesize
5.2MB
MD58eec871aa46082063efb666fb9571f64
SHA13c9bd651b779e2330ea3eac01787b2072afd8141
SHA256a5d86b0c1e82b5abe6125fc6dd0183084dad1422b0779693d11edeac9b25b7a1
SHA5120e0e9070d97c5eb76dd59a4faf1cc7610661b072d9f4cb6f946417946fed6a7cf8dbc152a988186a50678c0d72c2390ff67ca7974893b2d2d7449653224065bd
-
Filesize
5.2MB
MD5dcc40a6f0407820358bd8ba412364143
SHA18060169e1ab1e037a5a827828200c84ec2664560
SHA2560766fae97d7e25eccd084194f8397538cdbebc4dfd605d4751d1bdb0026c6e96
SHA51274a56755e3b541f3d61a07e662ccd1f612d424b19d03518260a1d004d07987e81b93401343d0c2498e73e95f9bb6fca6409cf1a99a6d21d2f46490e27c1f3389
-
Filesize
5.2MB
MD5f9690d3db9deb0857b6eaad166cd6f15
SHA1d2f370715bcfe89b16c9ea3b924093b89ce150e5
SHA256b2545c83a70ce2ff878f3c0a9e68a226d85f805716680d58146ffe7d014061a9
SHA5129afa4aac1c5823590b3cea27574e81f0172554375f4bd0551dd441cdf838d00d9df4a18fb6cdc74e4912ca773fe7f5bbbe5713894500efa3ee4a2adc6695ff5c
-
Filesize
5.2MB
MD54f5321fed6cdd5938cc22fa3ef8672ff
SHA1d807b99683f55ad18f60e7ce69d27e88c714e7b2
SHA2561f376cab4d8de22d06efbc5c2c6ed7ec501b01aae2a42ea56188aef35c8ad73b
SHA5128269b631a3bd8865be30f63bff51765cca9c08492ccc72e0fef3f83be06a8ffb261d7a119526fda403ac5948cba43b9287273aabf64ada42b10aeacdbf187971
-
Filesize
5.2MB
MD583e57a0765e7216ac476da486a33a0fd
SHA1abb9e0ff70735d6f9e429892343c3aa5075d7255
SHA2560746b15651b88f6dd9370671c3458fd40683721df45079f50538a486e7b41466
SHA51269546bf0ecebbebfb06ea1a6b5e417c9a12d887848337b81da2903eed560f0d1ba73ed5869525efff6b5a9786308b3299b12c5f9c18429149bc69263305aad9b
-
Filesize
5.2MB
MD5252e51efb8c1166004b83144be5bc659
SHA176324fcce7ad840254078b6c77e2ffc2b36c4076
SHA256ed5d0ad94911572ff1c2462d905569f0734accdc62fb64675eec846819575c2a
SHA512b6f143e42d635eafb55df61687da437ba36c4265f2a3501c61c3285e5f669c708b8224d7fd3e894be897941bf52d889ab2f66c5d5201f0ee4a5eb5b3c814b8ac
-
Filesize
5.2MB
MD5f6346f8bbb389dda44fb71ed7bb9e125
SHA10efd1d2ef350e9b4fa28f3753593d5f457d59aaa
SHA2562349592673368d4581b62cd5e3445c74cfd84436f1ff896e6fbb818d80ed4695
SHA512d057e7c58aa79cf64e71c2694f9c91caeac951b716e6d040b9c344df26861c3c5e0a9c603015e9ef1db74bfce4114a014c80542cd208091fdd4e58bc44ed60e0
-
Filesize
5.2MB
MD5ff334ddeff4baff2f23aa5e7ec9873b7
SHA167a53fbac7071e6e781c4f2711a406abcf1cd2f1
SHA25613a291580b6d6f41118c9685ed4ef32e341f08f8ece472935c3d9dec83f49197
SHA51208c84efe92c1ffe5508ec95110deea8acfc3140bbce2a3f627a35de08b3c465de5cc0c8d7f6d93f904e6dafcffc24fbaff9e59a265f2b0875ecd61d4bf5ae94d
-
Filesize
5.2MB
MD52b0a1ba91e978711034cb2c50befa4f7
SHA1ca0184384582ac6ec54cd6c8860a34b1a3341939
SHA2568123be878fa34dc01992842b15cd94120018119c79c586e304546c3fa5f75b67
SHA512060510c304ebdf380dfdae9ee22efbb5f915c64bf56133edc07bc2c68856f14f5eaf3643bc1d960e438203129faed4fe47e7478486d569dacb4bfd337b76fa69
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB