Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 16:50
General
-
Target
2024-12-22_32d7bae9a57e0da5d4e081064d258bdb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
32d7bae9a57e0da5d4e081064d258bdb
-
SHA1
cd532d6b056127c7f563e6e53d2289ba76e2aa36
-
SHA256
e5a096e7ed3ee1d3bd4269492ca8ac1aa131f86213e8772d6e8128c56fe3c043
-
SHA512
06e87a85a4d0ff7ec9b3327d6e710a8434ac268c1c287e1fd71fbdc5a948467dd03c1c8f93e9f079cc08c99dd2235b5cb7a9d03542573ff25b0a5c5bcac01332
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibd56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_32d7bae9a57e0da5d4e081064d258bdb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_32d7bae9a57e0da5d4e081064d258bdb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dzTGBSn.exeC:\Windows\System\dzTGBSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhjmmii.exeC:\Windows\System\jhjmmii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CnHjhAL.exeC:\Windows\System\CnHjhAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddJtJUs.exeC:\Windows\System\ddJtJUs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpXTXlz.exeC:\Windows\System\zpXTXlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgZsQMf.exeC:\Windows\System\AgZsQMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DhlKyet.exeC:\Windows\System\DhlKyet.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CaudyPu.exeC:\Windows\System\CaudyPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvVkWwU.exeC:\Windows\System\AvVkWwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohaRdqm.exeC:\Windows\System\ohaRdqm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BgWYCPC.exeC:\Windows\System\BgWYCPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UaRQppC.exeC:\Windows\System\UaRQppC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PdWIXYr.exeC:\Windows\System\PdWIXYr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YfuhXHs.exeC:\Windows\System\YfuhXHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykGOyYN.exeC:\Windows\System\ykGOyYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fbArIIp.exeC:\Windows\System\fbArIIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plfhdys.exeC:\Windows\System\plfhdys.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnGwTwX.exeC:\Windows\System\UnGwTwX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkGgpGM.exeC:\Windows\System\BkGgpGM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IxxMEah.exeC:\Windows\System\IxxMEah.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTpXSIX.exeC:\Windows\System\lTpXSIX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD505c69a8cefe669725d87775d7eb05e1b
SHA1910e5e794f1cc6e6ccfd481e5cb4ed866e380e28
SHA25620a07df7af15e7f2517ca8fc2d13dc891929cc47f7ac5b4f7c708e976c0c228e
SHA512841102e8c0bb8d24e6f7c9cea945b3a90a77ca160c8397b081454fdddd2fb6f04bfaf2b78c2f01f5af86bcb780bb1a4a194994cf19466ddbbb4536c23cdee158
-
Filesize
5.2MB
MD5228ebbe27a47690c8bb0dc8bd855937c
SHA14ee1edf6b91e4016ab7e51b0f056b58d618a6e39
SHA25629160f126289f35b8ebaf4d13e5e022575b0276520b4fcf8cffb462a84a19944
SHA51259ce653b0c0624c835c742d88585b6e1dedfc33d3654b4e2e5c13a56baf6fda5f153669442e910771da1e672d8bb15a6911bd61cdbc570600d77ab85f33fcf0c
-
Filesize
5.2MB
MD5d60f860e16261fe143dd0260fc05a93b
SHA15b3df341ec46cb01125154c67b221359b1ade896
SHA256a688c839126703ebfe9a751c12e746b39b7ab169ee7969131a40682b989f76a9
SHA5128ec59bc274a4f518cd13deedadbde4a9b42c924c3d8c9b379323be74d6d1b3c18612dd4e2371f82ed964d5d5fd57f9d73f83db07891fad54d05880e0236ad565
-
Filesize
5.2MB
MD524ceaf27cd610f905b2f4c0d77418a89
SHA1f306fe59401cfb04f598c96998b34cc97453128b
SHA2563ef24def013bd30a51cd38632ad3ec03f7f03e4a4ca38ecf883e4e9191d63026
SHA5129d0b238289e575f24180323a4c844e5f6e0cfd601213d9caadacf0e1bd1de73c8069e7b6d3aa67f9590bfcdc21e5c55d1ea61aa77fa3025278b6b444bab87fba
-
Filesize
5.2MB
MD54e1e730e6560cbbfcdd34f0855fb9dba
SHA1c61566d594a2328a58e404929f226380f26f55cf
SHA2569666400a5f61f1a56ef13691a0bac683406250b72668cff83a8eaf2ad40e8853
SHA5121a5eb2465d3f3a8b6c5b61ce04cefd22b1136e08f8b7ca5444955220c8b0b2ccda8b16f2894ddf3a1e93e2d314d554559319aca43c9585cd77c838600c07ef79
-
Filesize
5.2MB
MD5b5c72ac0d3c962d41fd7c1b78c1dda35
SHA1940626b8d7beed348153137adea6d90580b9deb1
SHA256ccff8b771b0ea1d11e3845e3430727c068baf2104db4291a227a467ed5de434f
SHA51239d5b2c91351d970791dadb87c4b83fa9b7513e2897aacc4153a878257f10dd384526c9fa122c6a831e86cc0e49a71eaead279c8dd0b531b5eae1b11af8552c3
-
Filesize
5.2MB
MD554754a7c14ad53cb39f9a96e72d0ea1c
SHA1e84fe34347cf0bb63541d092b3feb7a0cf9316b1
SHA2560a596f4148edada08fb117f2fa5d6826989238fa3f6a29204fe5b480deece824
SHA512fb55b5d6163d1f46617a2857ce1e1b5e4a1c0a341d16140e905423cbd4c48bae43b85c53f6140c6d733dd02a9a51fb1778af5987437aaa4d4ffc44e19c531418
-
Filesize
5.2MB
MD57d8be54a08b970637da0a62851ea7b1c
SHA1d0b30cf61eb10b0ab1d845144a0aa46dd4d3ab64
SHA25667bdd32b87e6e099a78b93327d66838779b87be07ddaa71567c98c97fbee2c84
SHA512a35ce64553a16bfb2a50c093674a4b9d9ca7044549c564877182621b8742a3585ab3344cc66b8acde4975e76b32aa5035623f86ae5fee2e37947e89547bfb54a
-
Filesize
5.2MB
MD5c299224f9ac56c12de7d0c470aa9b5cc
SHA1cc8c1cab7b4d5e3f463fa118b62c61ea3f2512f9
SHA25680fe3410e7afa0a85e80eb6543d7509883c2de1002057ffa0ed05015ffcf997c
SHA512ac4d666f24bc7cde9fb380928549c23d9c93ff6e68b5345018b727c75493444d7dc19cc03751f385a2eb80f7b9fe41f906fd586012386bfedbee6ca8b35ed6b2
-
Filesize
5.2MB
MD50666a486343c40f2ca08d8c1ab349d7f
SHA146aaa68d3621796344f6073387cd8a5e34f5c60c
SHA25635a30826cb7ddcbea88f0e098715caa28221a1282e5327088f0564c4d939fb73
SHA512ab6b885ac3ea8b48c5b0118ca39789edecd827668afe5e4285c4fea9b65efbab1859fd15031ff6713c166453c8845f9b1b5e755e10d7699a4920f32f17611cea
-
Filesize
5.2MB
MD5693e7c251023607fe6c96378144afc46
SHA10b2ebf6e7783b91087c891d14f8d7869bbb851df
SHA256eff5f2a59ccb50acb2311b8bc57c8e0484accc94a9582385754038083058e8ce
SHA512522e1da567bf21acea78ca8363accb85d3a2d60c6e43cd59656d7cd2a7c83cda812e08db8e1a1e95312b7c67fa8ab9f297ee433105a9b008872a65d2dd39c0b6
-
Filesize
5.2MB
MD51f70d1b07adf3589132c0d6bc0cf6b28
SHA1e03f3d05a7b2ed9dae4c0328a6f7ab7ee4daed94
SHA256ba2dd412703faf3ae9c09aeb52ca4494ddefc17631455784a993b89af8ecd9d7
SHA512b98a173c9bc273cf8bb3a931273f2b5a7416b433d0ddc5bc4fdc33ac9dd0e2efbd5f4cde4ba067ea1059f09181268d7e778fd5fbe4106349b7fd70c04840d6b0
-
Filesize
5.2MB
MD538052a10ae580c2a72ce5ebc250488fc
SHA19a43a858baf1f4deac451c22a156eaf45135f115
SHA256d002fbeb8eb47b3f47bd35ded96a33898c49ad24f26536bf2914dc1ee5ed9eec
SHA5120a338ec8e22d4aef6b0e1ffca6091101c662d0284238bf9f08997c78dfb204673d52c0d2dfe1ae6d6de42a4a6f29a4b47360255ced99caf36884f389f4c36751
-
Filesize
5.2MB
MD5338623840edabe18741f05d904128690
SHA1a30d90532af6379662326d64df3ca3f27b6e11ba
SHA25656168a135090949580622696cfcf7dc358a5c92c6c92b22672025b4f9200704b
SHA51291242b15fa7f69399d7573741d2e4d480301e67bba3b201651a6d35f2fb9ee7f9e0d8777948bae1351eea12b386261b0b36c40f805405e3de20b054be04f8d4b
-
Filesize
5.2MB
MD562aa85f5e56b5df349c64c574e9d7e2b
SHA1cd14c410ceafc718c1541ee186884adc52503998
SHA25678a893d23d07f13f4068dd9bb89454376324933fb3b207e5cc2afa669ae77b57
SHA512b4fc035e207eb336bbbb5c2fafd6ad6e494c16c159ce8a4a439f4c36fb6c1fd5be359a52ddcfc5dac0afcf18e25fc3f31a8d2986a0d32720d3568e5a9772600b
-
Filesize
5.2MB
MD5c6598e3e27710e0e7b3a0492ff1806a4
SHA1d3acc5d804b6369a7bc48a9aa92591c36d33d34e
SHA25653319dced54a76059fad27d6f7e2eaefcde2d549fbcb9ddc860a2ccac513296d
SHA5126f0ec1387e4f608f29c0ac160560b46a20c1217b677442b0ae5b136f83d888e59d96b629058c2df34695fa7551754638089918010802d40ab2d4c3904c1f4c74
-
Filesize
5.2MB
MD5d4db66df5a8930dcafad1b0d938a2f24
SHA14171fe6b1b486009a6e82367a76c253682ae0b29
SHA2565c9c6d06513d562d68ca3011b899f20488c3e6ad1fbf39953951eb189a227326
SHA512ac9551251ecd8eb11035116ca40f73d9b5a1dc3eab20820f86b45c85050868e75fc724eddec0438884f103b1ab3d63fd71119a3de4366533852f5750327b61d3
-
Filesize
5.2MB
MD5f96e13c139f9272b89971c0784d4413b
SHA13f75216fde2862b04439b2e23ff46eabb1777c15
SHA256f801186cec5129a697129a450dffc45ae7f85b722ae02cc063aca53d44ee9d10
SHA512371ec3470700ed6f2cd033dbc3d106f0177872f7246070f72801d4ffa4f57dcc457a50cf9cf91e47700605447ce0d4d282f590a5c82674371218af573be89fa2
-
Filesize
5.2MB
MD59902d66d1ed2cd9fe49b9ea4c3db11f5
SHA1eadb32ba8464ae79f15b95d941d7d6acd4c3d4df
SHA2561bacb9ce73a1331039bbd72a5d44fb3dcf1bee1fafbc54b65e9324a2ff6d8dba
SHA512703fe13dbe2cd77faededf949fad4b5c56756dec0cad1ef703f6d0ab917930ebe57ceff27b27bed1b8795245a3c92f7ad572ecd0a9ef57401d014c54ce190b74
-
Filesize
5.2MB
MD5027075996e1bbdb7894268b3c37d3ab4
SHA13bb047762d078e183aca3d601243dca8b36d8a80
SHA256074000b622a87a3deaa7b7570e416fa0d8d9f8d96695a4a3e73955b72624f128
SHA5121f867a9d6c9cdb540e52d804cb27889bf233c547da2e5b8e56f516a0029feda150a6beff7bc30fd45111ebff003fe6fa596b6438c6ba3bade9769202e9694bd9
-
Filesize
5.2MB
MD5197e61b275de8d3a846955f1290c7444
SHA19846e0717eb08cfed6b01b1f992ee029416d4667
SHA2562a2e1117412fb4458329969c04504cc216abafab3a8667a10dc3a45bd4f0afc8
SHA512ec690b60908c0b217c53d0caf1a3bc62b162c59bb6e34c16f0743db2de682915e1668f379630fcefa6253da2cd440a7216f0cae9fd52ac5ef4e1f30aadc3bf62
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB