Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/12/2024, 17:17
General
-
Target
2024-12-22_f74e863d74cd4f968e6332750c3550dd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f74e863d74cd4f968e6332750c3550dd
-
SHA1
1701cfc6a432bd2d37f7df94422e1582415afd4d
-
SHA256
45f20c2f71ff2915c864635a4a6837e05aed93a4edf120e73cd04d2a221666de
-
SHA512
fe99ae584b1573b702ae781b5ffb71f25edd4ca820d21e54b8750980548da140e3f302849d6808413b40ae36b040f1553d67341ede63853aad888e6a2d1451e8
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibd56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_f74e863d74cd4f968e6332750c3550dd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_f74e863d74cd4f968e6332750c3550dd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LSSyvqi.exeC:\Windows\System\LSSyvqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QKBMBFd.exeC:\Windows\System\QKBMBFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vAXJLTE.exeC:\Windows\System\vAXJLTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LZLwdpA.exeC:\Windows\System\LZLwdpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xCettcS.exeC:\Windows\System\xCettcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBrocsI.exeC:\Windows\System\RBrocsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EznAvBA.exeC:\Windows\System\EznAvBA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zFAjXHu.exeC:\Windows\System\zFAjXHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhLsbnJ.exeC:\Windows\System\VhLsbnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OCKbwlV.exeC:\Windows\System\OCKbwlV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YsUyriv.exeC:\Windows\System\YsUyriv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvWHTqa.exeC:\Windows\System\jvWHTqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\trhJeWT.exeC:\Windows\System\trhJeWT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cwuQFzs.exeC:\Windows\System\cwuQFzs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IhnTswD.exeC:\Windows\System\IhnTswD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZrBRGa.exeC:\Windows\System\jZrBRGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWvXHMK.exeC:\Windows\System\qWvXHMK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AIUPYDH.exeC:\Windows\System\AIUPYDH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KxeAflp.exeC:\Windows\System\KxeAflp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oXspTFW.exeC:\Windows\System\oXspTFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aeUILtm.exeC:\Windows\System\aeUILtm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ada6c056dbb07777c8bae8f702d8d98c
SHA1149e9751a32d48e922ffe3608092d8985cf85eef
SHA2565e7ef2aa54541b1fee353a6cf893360638d7b748de778b5ea027751a5077e57d
SHA51286dccf192f4a49cbbd7d6c35c8a9b617857d6182af7528995dfa68630d8b26e61e83a4b4a064dec720aacc851c33f0a9de4446861cbccec428ce55413c6e5789
-
Filesize
5.2MB
MD5dc88eb9c9353286da41e9e6221d4cff2
SHA1e76b8ca4ef592e20d63da6ed5c1625d040b57ef1
SHA2567605ad4f0679bb6735da10b5d16fd0a0c5153f3eaeebc9174ac5eaf180ac95a7
SHA512e5604e3dc701f3e852959de46da789ef53aa0314000a7f52983311842784dcb2d3c4a461b3e7a4690509e7a18583d9a94f35ee268b240c16fb106a979345a240
-
Filesize
5.2MB
MD53a067b8b6e951c7c8d5cf82c061b25ef
SHA18ccf788ae67fdc11d080e5bf4ea24517aa5f81f9
SHA2565a3d56c2e79345297bf882e12af3a0a4beb2f5fbc8565d4ec3f9d644a6e15b6e
SHA5121485e8e468683bdb979a5a1a0539d9787b5b2f64891e95850da4d6e26343e8b25ef017b98f1a3a5f50f9e4f09bf85b6d040b9853e5837cf4a483c1ee05cbb7e8
-
Filesize
5.2MB
MD51e3f56f701bfcdc9c5603741eb3732d4
SHA1f94027cf6a5c475b6d10a526f288cdf0758de584
SHA25618240bdb20fc9935008336161a9ca241e76b6dcfd1952ae3bedec55097fcf194
SHA51234ba8a599bfdaca69d446f8092ab7130b640fe92813a56ef2f9fa63fe9bf4b10bb127eca5c409d8d8c2cca533fbd7942f5f6a08dbaf1b122c17d18f32dbf8c61
-
Filesize
5.2MB
MD58d5ec6c239ac2a4bc65e7c896168f17e
SHA19c7b41c3827d43221c99e8fb396d59ea4bb54615
SHA25634deb08e8f4fb9c8c328242510cc3de4088d43d60dde500ea9a6e80f3a040f49
SHA512e2fa4bce09f2013e8568a15acb854fb174edc2bc56cb072b1433eb7a7d8964f06bfea353d70c49c87ad100293b2f8634efeb918ea1c5041893841b5a6abffe8f
-
Filesize
5.2MB
MD522982dcfa489d5de4b9965e8542e55ed
SHA16ea9592de5e81fd84245d758d605ae1e977b84bf
SHA2567682ba6d4a817a9d0a9cb131b67c91375c433f5c5f5dd06010884650887f0c8f
SHA512ebd373b3691b26690f1247a3e99ad0262b38e68b0a9d523ed8e869e59a5798b73496c913a29f9ca58da24b01af9941dd717625d01fcc1d6b92f48a67ae789025
-
Filesize
5.2MB
MD55b88255ac59976bb71aa92a872804748
SHA1780719f58dce09aed5ca85abca88be469c7589c1
SHA25681614d6768734b55789115c9ddc80006345ed83fc7085be41c91a147c78227a6
SHA51261c71b94520928d9c62f29edc0bc70038303b266bd667bf64f4c3269cc9f2539e671e1da5394288a6699702dc6fe350f1e1952b32f79a9bd1645b343d0cf7e53
-
Filesize
5.2MB
MD5417b1a56acf80d08e7d27bc639c870c2
SHA1e039513ad1870c5a8580977b02b6c9b0a58767c5
SHA256e6687016fd500dc12b5ca284a7521bc943b348269da206fe37660a47880fe1bf
SHA512262da3c8872c367efdb2b6ff7f1a96477bfb34eb56473a1d1bb78067c9b4c4ada81cb6e5c7a875764d62e22c3f6aac857faf17f9dcaf57a774e2d139e6f51056
-
Filesize
5.2MB
MD596cbeaa9f20d431348664ca145e100e0
SHA19a21a7df60df57f5522f1df1721e6965f17a85da
SHA2560337b78377600beb9761977417d0c53d800cc8e8ae5d29d8beb273b081c3e777
SHA512787cf87e6defc71709d4a5e318fbc355301db743ef6c55af92ca198ec5b9bd91faabc0fa6d579bffca8985011a0ff7e46ad9a65e2fd1dce01d56b947a81d1d65
-
Filesize
5.2MB
MD5906f41161f27bde1be0bd7bb6cdecf4a
SHA1c880c48bd66b1fe013ea0b0b08b13f3daf056421
SHA25603542e886e22444c82e1fc4cad9ab53318cc6ff4300961a733173ec90cfbcce6
SHA512278b26e2ca442188e879183a1ad7d55623d4e58ca63819570e664fafc9da4406cb83fd4d3632d82ba939eae660af4bf2e50da3957682a876cae190c93a885e09
-
Filesize
5.2MB
MD59e719282c5f99446b05ccb9e94ea7a96
SHA162e46c7b87cdddbe6da5591c931449027fb78a2b
SHA25647a89014e264a4aed47fdc28aadc138fc87b4aad57bb3344a21167fe1ef18cf5
SHA51268fd992f89cd373c90d669aa31201617ddc0335edfcf6ecab6278d3be2525ac7a055804219593877caaca5b9e40e9bc6f59664ef7143dfa51712f0ade1fe8380
-
Filesize
5.2MB
MD5e809f867042c5eecbdb693dae4df7678
SHA17739b603de83f3191610664f70ea32b74f7c3563
SHA256213d1877acee1da1632ed4d27a6dcbf07f7f756358891e5661358ee7f36782d2
SHA512d9737890ff743937eb4d6692be769f71157b095223c33e309b99008e8216b203e663751e06b2571bcbd1ae76cbf3e72273c636eaeed54345be8d68b617210a86
-
Filesize
5.2MB
MD596dff35b47617fb26813d09db117b131
SHA191b559d282ef716aa762b527931c776323e30344
SHA256d2d36ac6d21dc4264c50f75911c8f25306adb91a73850d2cb0c15fd9f0a6a699
SHA5128af5b0a7e31934b0bd72172278c2272163b9505931f3af563745b5111425e4f0c9ea4b6f2cad5c17df8a149e61d30f7681895392db2de2aefec30b6c555f0204
-
Filesize
5.2MB
MD59f3899348d633c6ddba31f553edec8fb
SHA12796fa44f732b799dc6c96c4e3bf5636b26fb426
SHA256b33905a71aa6f3222a4e8e29e1b1d0cd0d5dbf343afac863c256c764f5b5d079
SHA51285b8122c05b9abbfd0bab1a48625789054b05d968e9af642a9af5a1019b3198ff4c7611b8f85728fa26ec0e0c16988b2913b0b30d29aeb0494b5fc51d639193d
-
Filesize
5.2MB
MD58dff5614183fd992c0df338102d83a5f
SHA10dd774cdd4691345e79ecf892288fb399e551156
SHA256d3c52fc47da5014d963b1f67946d556d4e5211a8ecf546f4666453718c2f5efa
SHA512288a1578d5f98bbe8a9c54e9373276cff8d55c6280af650396d4aaa303af4e3eb811d3a8668ff74f09be8bb3f21c907c2997c0c3aef2c22b6b28f1cd21aee67c
-
Filesize
5.2MB
MD517dcca4ca372c8424b811e62cd00a57d
SHA1325bfe29d60f85a635f0bd46a0599c098e5ab97d
SHA2561b9dde0341a0d325c37286b3cc9946b61b28cbba421a37522d8e0fba2bbf85fe
SHA51242322413308b60147642799a69eed9ae91df67e334132643de55dfe208f3b2a65ce86dd839eb7a175a56d417076388211b43bba11c7b4d3835d1fea43fa0c23a
-
Filesize
5.2MB
MD502b41bf826bb1c738c89a42b95f76f6c
SHA1c113b615a4aa34663b7551d9c8b5ddd1d62c655e
SHA256e507a9f2280e93f4162ef966471c599d9fa9830ad95cafdcf13588cbb5acfa60
SHA512bd325d25c195497506187c07230840819951e60827bbba1b3e151cccd409f883fbbd4d0f52e664ce0472a5ff5637fd27db07c1aa7cf11f51e9f9cb70a1fda6d1
-
Filesize
5.2MB
MD57bdb45aa44a9d73d51aad1abaca92275
SHA18b25de4dae5dbfdc2c6742821995e8ad05afe3cf
SHA2568323553e19fc11d3fe6a260d9459bde04c400d9d135e696604c35a0e17ed6ac3
SHA512c8152533280d0a8317f147f1fd00d9624017032ebf248172917e25a6515689adbcda71164895c04523f73ea91016e745908c029a4061a57fb9a3456f97e6d63d
-
Filesize
5.2MB
MD5ff4c0d4851059ff664ba9ae3531a13e5
SHA1fae67dd57636332bcc055a460f35bcb0efb1d9d0
SHA256027d84b4455a2cdc050660fb97b3b13bc19707f76d139f2af1464a9912778300
SHA512627f08cc8aaa1b8bdfafc0b21e071494dcbe79e1c0f5f07ebdf304a3b844b66fda1dd711d3e2ffe24ddcafba78926d3492ac2756095dc398aab141d74e781178
-
Filesize
5.2MB
MD5560ca4c317a5ee7ea39dc069c1c54d22
SHA16773980a53f6f46bd564d2b8aa93ec8bb272079a
SHA25626128d8f7088bd779cde3117178e6b804bf0b1450f7bfc6da879e50bdcd866e0
SHA512c6b9ba0bbee9c798365b828a5e11da21bf2c5ca36a57288656385a7ac35f453a8964ec92329bf7d647cc14bf625b9778a27b06e8686c5570e0cecf1a0af918b4
-
Filesize
5.2MB
MD56f85c4ba32903bc6b31d792942c664bd
SHA1172248503c4e372ea89a96e43f8422310d49cd5e
SHA25618048590582978f9cfd05953a5e722dcb88ae676b8906b50b53840a5c220953d
SHA51276b008eed4a62fd229d31798caf362a30689e40155a3aafcee6bbc30e8f95cafa4b9d1dfcb76d2906779eb1c6ca0b52fda2a3dec2a19d32a81b7b9a70b5db08b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB