Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 05:12
General
-
Target
2024-12-22_ff203b8e89a14c3c43210ff13d7696bc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ff203b8e89a14c3c43210ff13d7696bc
-
SHA1
4abc3d2f66c326f0af3f266d984cbd32290edf9a
-
SHA256
efc701632c12aa9811bfbe737a0ff208a8fdca3afd3583b80efd60fc68e8e1c3
-
SHA512
a1c7c2d5694a2bd7970228eb9928bc92c16c9f1473c418f61450a749ffe29d2016d7f4601fff48900b7d38a958bb1e4f60d01e19dcc509af74547b42adbc3512
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBib+56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_ff203b8e89a14c3c43210ff13d7696bc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_ff203b8e89a14c3c43210ff13d7696bc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DMPzQMT.exeC:\Windows\System\DMPzQMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTUUYIx.exeC:\Windows\System\JTUUYIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cRYRMwH.exeC:\Windows\System\cRYRMwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcsdJLb.exeC:\Windows\System\PcsdJLb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdzuCqe.exeC:\Windows\System\KdzuCqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZuFUVAM.exeC:\Windows\System\ZuFUVAM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zvbExtf.exeC:\Windows\System\zvbExtf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZnzUnA.exeC:\Windows\System\TZnzUnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeultQr.exeC:\Windows\System\xeultQr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVUBfvl.exeC:\Windows\System\tVUBfvl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmUHkec.exeC:\Windows\System\cmUHkec.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMaHlZT.exeC:\Windows\System\vMaHlZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPPgbfc.exeC:\Windows\System\IPPgbfc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eKiSrGM.exeC:\Windows\System\eKiSrGM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pPhOJAH.exeC:\Windows\System\pPhOJAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqjcVkP.exeC:\Windows\System\JqjcVkP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cyBoplI.exeC:\Windows\System\cyBoplI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLtjhpy.exeC:\Windows\System\RLtjhpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYQqWLz.exeC:\Windows\System\zYQqWLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FkuagmT.exeC:\Windows\System\FkuagmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkmcdEp.exeC:\Windows\System\kkmcdEp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD583ee635e38645c0a62050c72c938cfd8
SHA13994fa4a32e8232454c51f56143dad8501f2f855
SHA2566ef94e689a0fbd389865d1912984ac1ae85efda9b64e75e5e303104829e2fe1d
SHA512900ef234223be460697422579af8f7666af506fa18451739e67ee14a9a0fd8783465d2595671ce8285b8e5e5580d00eede8b6f10ca3b559df8140bfe90228618
-
Filesize
5.2MB
MD5e01ec1f52b630c3080cb448f6390ba79
SHA12a540460974af6399506b35d9a69658ea2eaefe2
SHA256bbe869a8696ae13b1ede957413cac30bae2d434d29b59fd3a862a0a5a3bcf15d
SHA5127cc4a8131107314dcc0385effa9c99fc1983a02a217e9f8a73628d6543f648aa267af050c21d652905827d21c1bbbd24145229510d65268823f7c66f10f36a29
-
Filesize
5.2MB
MD56644a18bc73426d837d41f345e81374a
SHA115cc072c0465149b44835f7f52f6dbb4727e94c1
SHA2563f97db4372b2842403e8eb37fab666bbcdbe4af7ae276be07099d307500256f3
SHA5124c6c3e2df9b1afa50b9d9bbbb7eaef10f35d3c007058b0e1eab5c94b7df9d6a653db69bac86998d1e93a85ba208e149569ac2b3870c3623f72dd3235f45d344f
-
Filesize
5.2MB
MD5bdbc23f97d1f133e6306971cbff28e48
SHA13b6ea819df776c38576b17fe714d0c47d411c0c3
SHA256624af526a0e1cbc80b0db7e0df08d14ed57b16de22fd9c760e48545d51ad039d
SHA512df7a99f6a0fbd7d5f7231af1dbb385cdced8d1aab027a28c0ec5b2d4b45e0c702248b20121fc8715cb57336ea3f542a07275687710f10179b44cb40ec229cf0d
-
Filesize
5.2MB
MD53322b64db131111019b25f12c0487cac
SHA134248f66218740438a9a9b638534ef1c6ffd78ff
SHA256d76f432f0c975a550d1ee0718ecd7d992c565c6b7ece97c60c4be3c0f237ee2a
SHA512938d7c331f0369ef3f45098ab5bc71d156b50935457761ca59b2a74e944d698d7ada1a7a4fd7620b3d26c46b354704fa21b04f63f91ca68cb3830e77af5a5415
-
Filesize
5.2MB
MD582062e234966973b446735c7dff0543f
SHA12533c22c87be0c321a3c653fe5f49e0de901422a
SHA256bd335ed888d29914ae3aa3b5e82fa64c13d3e05d3d73b477062c8195a0126148
SHA512669e6bd7daba5fce52f8695b6114076612b09d172b8c965dadd365c7fe97a4ba679767751a7d615ca4ea52d771a6f49fd564249b8178df5178232a53363e87d0
-
Filesize
5.2MB
MD5fceddd5da8d19caec308afa75671c932
SHA152eec094d14f426556525b1a5cd2ce1806ba7802
SHA256f1ad46b344f18351d7b8e15194e9aa9e5985eb62086b242c69725291e9b569b0
SHA512f5dfb949974687043316b6a744f949af2f09ff45ff7f10814258627478d3aa6eeabc6febefb6364bf57bbf2e67f0fb72fc66f6f6c9d421ecd8c7e9ff35279f5f
-
Filesize
5.2MB
MD5635322b2b2cbdedbe0275e820634feaa
SHA1f6aa3d69494175a9fe15bf3107c2cf09fc96bccb
SHA256e98d38a028dc2423060fae729ce321947529e8faf51ade402422cedaa5163cd1
SHA5127a400a1a9e31def9150b260a3d85ee9c7157c8630fa33709bfd77b1d51313f425969414e75d6e263c1d9d6f7d8924eb589b9bfd9a8cf1d941a0ac585b62ca61e
-
Filesize
5.2MB
MD5553dc60536f7c5688ea1c54e91d8d76a
SHA1f691213e8f2f0d051cc1c9365e3bd2eaaaa2b726
SHA256da8d0064eb94730c3ffd5fc84e7368a5bff049ad361ef6a5230b74db87b7c263
SHA5126b70f7e2202040c7a068f28f4256468085ebf57fde0639964d75024ee7844aaa94a6f5ce74fe53ee513c22f3f61fc455c60415ca35afa6a929a06c58013a2b30
-
Filesize
5.2MB
MD57d71d55be2d57580406fb73cc6e40b96
SHA1b4623f272caf8ecfad49aa05afebaae1588b773d
SHA25687570de001a7624371d09afbca10f9919267b0da81c1c170cdfb71bd08c7339f
SHA512b0e9ef479e233690c9c7055f516db0a95feac5c668c226ec09596dd0fca9091e20e583f61dba1fbe1ddeb981849237254114fcb871fc7595202cb21f7bf67470
-
Filesize
5.2MB
MD5b88635111f5f8acbb44b5906f22199da
SHA1dc57b8434f76d37dc44a27f62cfac7ea709f00a2
SHA256b124da781a065a34bc53ba5dd4533bea95c3c78213e67ed021f145b3a2d8393b
SHA5122a72d3745f508e05b0115e475a367e9b0efd7ae4230d7aa51188fe85d382634abbd7bda6c3572e4353c8d89173767e221cc1d1714296425eece44227cb7588e1
-
Filesize
5.2MB
MD5eaca8abe9e4ba873da5a14e4d0c42a4f
SHA178dcc4c36af9e7caf3e8c996d1eb7ade2695b358
SHA2561d03e7563c28b889f603231e1ce3aff487b26c91549d19778862ff76e449af4a
SHA51285f06b0dfd41d5ca3c718cde0ad594d42873ae25a5cbb8c56766e7d1cc1425346c6bc9fabaf0bb3077e60e510dbb802fd6773700ad2c2777c8978c2003d4f4a8
-
Filesize
5.2MB
MD54152efa89550827d22a014464657e163
SHA197b9c877bd5ed46b31810f0fcefe08f3e50a5282
SHA25620b7affdf9cc8d44d12097016f8fff4b9bb0cb2b6f285b8dfec2e4aa4fa38b5b
SHA512ad504a8790f2df689fcee617bcb3eaa294f23b601f9c5c1b984e58595bb766a5ec698e1a409d294340c271c7629b1ef9d6e977091b6fbcee6542b8a322b05724
-
Filesize
5.2MB
MD58789c5c4942f5f37b9e0ce32ad998172
SHA1d66a00bd738b30d328a96bfa75d74493aa6a212a
SHA256f02179245676b964fda85cecc765a85ef75efeeefcfe4bc52af642ed1663781f
SHA512964c8a8b153df504f93af12a54c08e855c6153c266b6d0dc4fec4e2c046e0b1be7d27e1f2809e28892e2143ffd9cf8e2d1ae31e96beab43697e2943b9a716309
-
Filesize
5.2MB
MD5d0b4bbdb06c2fba18b055fb999b58874
SHA1b7c93f63e06b1ead9d85f26cc99495b681f93dfd
SHA256788c015a3a366d88c0a93ab091485efebf9f0585add88e52d8fded3cce8300da
SHA512062be67a03d934df8ea0f51fa40ad0062ffdd94ad1bb8f0cf021a6efde6cccb4ea208ddabe9ded8aaf18625cfc45f77d24260fb69ec1307f79bb6b76b708e1a7
-
Filesize
5.2MB
MD5bff222340a7fe183dd3e7db417ba5ab6
SHA1a0f41c02305e75cb6eff3162685e7d05d2e38b02
SHA2564e102154b781a5f2fb8d1a1c2d5653f85e9d186e6e7c2523edcd7b6b4ed1af89
SHA51224747223ed3323dbc860e3a68650ff567ba9521af96a154ddc7b3ce41775424eeb2c5df4fc8a18890c3fbd045031c20bc4b113ac7a5fea013bd8912e6da15ade
-
Filesize
5.2MB
MD5f528599f44d19f546d314275a7705804
SHA1be611118712074fd1061e5431848ac9aff732dab
SHA2566dd24447c0dba1619bb258de8e16ec1739c27e9a44dd4835668dd75a81880409
SHA512f7da13dfe3ce21d6ed22b8053e44c7810cb06709c83097fb3ac0dff7a3c83e7058bcfa30848997ec747b4607b6667e3e67f49fd10625116be16bf05c2ebd8925
-
Filesize
5.2MB
MD55c8a7b8b2f3485e3f81d68854fd206aa
SHA1176d8097085779cc1ec48471c7815194b30a43b6
SHA256c56fbd9707c58047b10e4e386ca36d2cb4a24875373598ef8b8eae4417b2a5ca
SHA5127c3ec08bec6e3735a0c9f9fa41e8957fa07ae6dcb733db50d5a06c91f616dfdd869a1f51e140671eb6d90960697f6b7c715a6a0ea5b62fdf65536bc8fc05ded6
-
Filesize
5.2MB
MD5aca76312715210ecbb748b53379c21b5
SHA1d65ba0003fb6b2c81fefdab027bdb1d64ef7f426
SHA2561b8634f51be9067e2b8d0a648041797dc6279ca2632aee89883bc96b1d0e5022
SHA5125af0db635ae03e111966aa4ab0bdecc680f3c2e320ed3f59ec5cf74fb4932eccaf82b544cb3e12df0e7cebbba07ab98972b616df286bbbf2a85981d141311d86
-
Filesize
5.2MB
MD5dddff5f44c6ef336e61eac454b338d17
SHA1a6316eb1e9705976f2c1dc4335eba6e192a0d9c0
SHA256637fb8a8b137f8d22bd526fe2b21a0337aab1001db20a1456ef1aa4b19799345
SHA5122db749390eeb5b80dc0275c2898ca1bf892192e9d70a217a6015d2777ff4f97522a586a2f8317078d0fbbd748d9c0b74c6858a01cd2601dd2b6b4bbeab2c9dc3
-
Filesize
5.2MB
MD5bdcfe04ff2f26e1b4263c13fbcb1abe8
SHA1577fd79dcfa482e3886bf566c38587ba42c6834b
SHA2564e4b1382e26e9530efbf86bb61b5ca9f46643e342db240be53e16d71b5900515
SHA5126a59fce7f823bff3ada158921c079d32cfb92ad881f76068eeda8a8fe44f077a339959164829c1b223b1b7705fefdf947740dc1aad3c8a7465eb2b1e84970cf1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB