Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25/12/2024, 19:30
General
-
Target
2024-12-25_b4dbcae732186d329770833a3c0d7b4c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b4dbcae732186d329770833a3c0d7b4c
-
SHA1
88c90b06c81b4d8e8847b12b45021f4da09f4afe
-
SHA256
3fb6bf20eb86ac0bc46d97506a27f27a6d4e2517a1175e8b4105911570f756a4
-
SHA512
d877a02f978b4bd139e3a586096ca1e6a336b467006a9f40b8c4b46b97c3c79cd38d43e32ff2faa1887182c0e71878ef9efd7ddb71655bab53fa6ef925ad5d0a
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBib+56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_b4dbcae732186d329770833a3c0d7b4c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_b4dbcae732186d329770833a3c0d7b4c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WFbQjmd.exeC:\Windows\System\WFbQjmd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kJtgXJH.exeC:\Windows\System\kJtgXJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eUzNPBj.exeC:\Windows\System\eUzNPBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHUFBRR.exeC:\Windows\System\MHUFBRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjBOjhZ.exeC:\Windows\System\YjBOjhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQwCqXb.exeC:\Windows\System\qQwCqXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\titENQt.exeC:\Windows\System\titENQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThRRims.exeC:\Windows\System\ThRRims.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNjbjcK.exeC:\Windows\System\NNjbjcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjqVqTe.exeC:\Windows\System\KjqVqTe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pkbthSN.exeC:\Windows\System\pkbthSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vGqEhwb.exeC:\Windows\System\vGqEhwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atQaPvi.exeC:\Windows\System\atQaPvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpINmpP.exeC:\Windows\System\BpINmpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oZmkbDD.exeC:\Windows\System\oZmkbDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mqVziXl.exeC:\Windows\System\mqVziXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOLpRAV.exeC:\Windows\System\uOLpRAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHCxvSf.exeC:\Windows\System\tHCxvSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOevpyH.exeC:\Windows\System\FOevpyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DZCFcOm.exeC:\Windows\System\DZCFcOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LzSNLHV.exeC:\Windows\System\LzSNLHV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dcd483a7f1743b564423ad9476877e01
SHA1f07f4585b743df3d6ef49141c9284540f9efcb90
SHA256f55fb1b59395b0d80278b86145f201275696a5c67b71181e56db6540fca0d63e
SHA5128783be83296783aa8281edc65201f00be46332f9bc0190a15b062e299093089944f51147a65cf5638e80570e43eb2e3e89411145fbe0e027359a182e27efae14
-
Filesize
5.2MB
MD531044f81702244a13f0fbe9154d55d63
SHA13302574a2b3f05d5e5fb645a3f09c5235f043a3a
SHA25602edddaef873bc130a1b4b84de209a6af9b362bacc72052325e0b8a55bc27995
SHA51245e785710baca0749b0327b4845671acd18971080a3667c0310ad30de6385027a52eb064b8e02df211f590cdeb6c440285657d5c7c7010cbbda2a6c226019b14
-
Filesize
5.2MB
MD58bdf34ae2465d1a4eb106d145f20a6a2
SHA1f3276e12c9d845241d1a281eade9479dd29c22a4
SHA2565cdc66b87fbad58e12cb717f5f2c7e236b6dbad6953fd6b1df5a9e85ffaaff59
SHA5121b1f8d49903d5ebf2039cf66d2b0c602894db7abc31290c208a186e68065fefed2d13995431c17df48dce0b4bfe121e69a437c5abb9d573c17ce2ea8110a38e2
-
Filesize
5.2MB
MD5b874d4fd9ea360b8d726d67967af4a61
SHA19461b2fbd28c8eed30737a38a6af88ef6b6db11e
SHA25617df12cd22ddf4db96b3f78f9784f4aa2a7108eb6b3881b4f1a74467d0ecee0c
SHA5126cdb84504c96f32a06a781acc0f2699d98cc64575641738d99c2e1150b5eee5ee1828e69573428254151a6a23d6c9fb084d2f86a5e410b3903509c1fb3b68d93
-
Filesize
5.2MB
MD521c91e2c58b3c1c00dd98e6e6cfac07c
SHA11ff5a5e7e2cdb3827bc78d893f5653904cb34406
SHA256316886cc26c66c1fa6047f56e316bd63563b98b2e4bdf2fdfc70a8c5a9cd1ede
SHA5124cb1d9610e669c8da5cb25095061c6d90e9637c685a92288f842a63f89734bc695de23c982c0422b830c523edd7c31a281162656d4e9a912328d179eed283dc0
-
Filesize
5.2MB
MD54d74cdec7936c8ed6bd7db487a5388a9
SHA18fde2144358eb43b7371388967b8be4e4907fa62
SHA2568a8569c54d32f7770f4a2d58724783ae94501bca2850638ce4fd309ac08e0e59
SHA512bfc83801e8a7ea95a03d30f9bfb73caa620c62e828d8f44de93ec37c0a243f15d7f0f4b219d417455a3e571a33f0e5954c803dfbe6119fe2d76f16a4d5871853
-
Filesize
5.2MB
MD55fb730ba96f05d30b2f32d4caf0d9716
SHA13bb21ccaeb5c2d5c26cf8d3d523e2210bdcb1d9c
SHA256cfc3086bfcbdf78f8b19509ea912fcc1a088cb952a57a5e024da8a8e13602e72
SHA51276bc71e43cad9837d12b2a823c75b14ffcbe7b91746b55706e07bcafc3d35c70fc5410241afa16e48c69115311d017940a819db9ef5a426b67344fb7fc769679
-
Filesize
5.2MB
MD50bce6827ccf9767404a64e660b10acfc
SHA16ba71eba5601acd8000eb3f4857635642c5c5dca
SHA256a97653924734d211173421b0f15c069e78552acd44fb9d67daf3d8bfb1d6dd28
SHA51212292c169a456728e77b833215eb6e7143f5506529cbf0d585d318011b595b3cdfbca2ed21aadc75abda8f85c5debb2237b75f174fea2223665a55325cf9159b
-
Filesize
5.2MB
MD5e4f643ae5a90e877fa7a7d0ca3d45eb9
SHA11644897d7361d08b0ddd137ea9db4ff2c1cf77e3
SHA256114bc63139b68fd3da1969c7bff4e9f3fae9f3ec4852a922ef2184194a481a77
SHA51269a6e00c97fa45e7cd0e94acfe6b65e783a84fcfe815b0404550e45d4975278c73a66feb40ccfa96eb677ffae10b181149950b0fde81a737a09edc5ae6e17889
-
Filesize
5.2MB
MD525f90c6a0ddf1f0a8b8cab3c1a900041
SHA14858c80a272d129bd97f6c8157def693aa22acf9
SHA256d683ac08e0d51c47c6a5612e9a7eca7ed0090cf8d7d4cd0d6458e7696fca09fe
SHA512cbc3188d89c378048857c1123c828f5079b63fa454d73f2fa2448b76bc982be44246b4eda5ff4c6c15530aa6b5029283cec3696979de049d53665b5ff5943f49
-
Filesize
5.2MB
MD5e901339f5ec7ebefe467fd48901d2ba6
SHA173b9f444484dfa6227e4943d3d61dd92690415b9
SHA2568c283797d0ad72cef75494bbbf132e801ad965e06325b3b00f0a31543071c5e9
SHA5127231b65c8aeeb054cdf32b6250fdaa5a9455810807b13ff4e108a60fe87748378dd4050fba48891a19b7f147e0be852012e9d7cbc5ae18fbe77f1585af2f5ef7
-
Filesize
5.2MB
MD5f443275124dc8966fb9fe9d4811d3083
SHA1b512df0d57bf6f515cd26dbfc37b7e9315c7b88c
SHA2566dfbf063d7d7289d7d121b5fc577f0f0d85a03621d94158ac1ca83b2730644c7
SHA512aed9f6054bc3d09551c0d808b7f70f769ca55a4ecd70272e50d6e9255968a2cfeea2b9bfa881edb0cbbd5a0f107065df0d8fbfef8803f3130cacb91ac6d88190
-
Filesize
5.2MB
MD58039eb5bdeb9f53cea144ab918176eda
SHA1c8761d7bb616a207b92fda1b18e820d137102bfd
SHA256067ec447b266dff0716ee4369a28f841caad3bc650da17efbf179f71146acc3a
SHA512612d3cc02bf459cacd2a818e7cd79c31af2887be1f988441d72ec31b014d543bca05d2c058285aeffc54bf4e51cf9f994aa678ce3f6d175543d09fb53c71fc61
-
Filesize
5.2MB
MD597d6f5766f18c461703a19bb3dfb45a1
SHA1b00ae00f18f8efae41a9d166cc6a303f62e39185
SHA256870d60da95fa13da8063a29d86c3acd2aca43d5d7441f6d315ef325f34d6bded
SHA512c43a285cf154cb173b3f8b2b62fe347f08e604e08689c751a25d1cd720ae6a8438c5ba6aa7d864c6e7844c4a7cf22c206561afb2f00e22bc18e8220a4ce109b7
-
Filesize
5.2MB
MD501f51feb8833bfe9abe2dcc61d7e8ab3
SHA157e5a5d64eca2272c8b27476028c3be720cff1a7
SHA256661032778a6796ad391d0dc2c1d519d936d1b9f9c185995f8a5bcbf3b7b4b4ee
SHA5121fc7850ed3160cf335eacb35d629494569ff97b1e0682e700fa5ecfac83321913cb290ddfd1fe5c1cfa5ff32506be119882028288e835c4a772ad25357553df0
-
Filesize
5.2MB
MD5e0f6db492ee2e3e423bb1c30926069a4
SHA1dd2d4082f8272ed39b43e03da980431d41104a3e
SHA2567d5c40f2343e437e9744f60018d1aeec562f5adfb59a0cf786973ce8d77974c1
SHA5124898071ec943422e31b06405d8b49f84376b90d5be1586ffe7ebf7c12c51d7001412d24dba5ab46bb8ce4f57be9c3e2207da341a88256ddecae8dfb1b6c731d7
-
Filesize
5.2MB
MD51fd3fe6fca16f5e619c63178315b66cb
SHA1bde594cb1dad2156f48098252e0d1dc9d2607357
SHA256dab61c297c6e75854b55a7f6a823be5312b36920bb32c93cbd246d4830e63af4
SHA512d1221332417b5f83e663f6cf67371436f6601423e7d843ee17904ee072f893bc935415aa7c69272801cf71cb4a15a44a4f1de2081ebd33c90c1bb67d7920cc00
-
Filesize
5.2MB
MD5511931be637aadb2f8e4e9225382648c
SHA1d9990f0cf734b6c2faff06cbe9d8b1dddc801832
SHA256257338e7a6e2c2da2fee9d6616b592b6aac8222c0c7dc4e347a5dbb4c1a2890d
SHA512fd9f927a0f07978edf1fddceabf513cc8c1ac15ad3409c53129035b83c2fc3e0e49ccd6204aeb5dbf65842f47f6f744070cf0945c1e1b217621921a749824fda
-
Filesize
5.2MB
MD5dbaf8b38085040c118f3b57678b32468
SHA19adc95f7398c2e2b4586668fbb3d25a43043bffd
SHA25678fc5400907fd03eaf7b2b93f605e139fda63ff9203377de94d1099995b279f5
SHA512fb3fd671729d38c7d66b503c24bbeb907fa96caa6d1320be4a99cd43ee7add07eaad8944afdbf20de4ebb9829015e7ba9abd5b580f8bfc7ac9b9db85352833c2
-
Filesize
5.2MB
MD5c9755395ef2d49540745a5cb8718e5fb
SHA11b537c83ffde9a8898350823a15a09a55a34ff3d
SHA25657f04084d480f3435535ebb7b05cf7392d04182d5907f600117e64a944f17927
SHA512be72412305d977bf94f66e9033f378064917d7725f50e049a73f451d45f4337d107effe05269116b9060e55fb055cc516e5e79aa3785ec4d37862d4bd3ee4d8e
-
Filesize
5.2MB
MD50e2261393bd6a4883cd902bff8bcc381
SHA11a9e34e08f0c9329364451daccc37f0224757fa5
SHA256bf34c09999cb246e3cff7fcce5acd0b184a75c35616f113468c25da291def864
SHA512fb37d9b9bc36c7c22a3ae81fccb910cb6459e0d143ec2b40306a3b0c699f8fa62c9af3100ac45c4e98d3eee2ad4abfd0b07c34b0428f92a8a42d7f2aa20e2ef5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB