Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 19:31
General
-
Target
2024-12-25_bfb5e6e2de5e6b0c4dea88ac5de97e43_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bfb5e6e2de5e6b0c4dea88ac5de97e43
-
SHA1
6a5b1590ddb323018e89cec1e29b4c88a5f8ce29
-
SHA256
0dd9b62ece79eb25fd02d73d49b8e657fa37ca7fa834bf41d9b15eb284eef06a
-
SHA512
c304ccbad984fc658b3577c1585596da8664402db4c6836595867bc8681a6ec33b106be769fdd4e5ee90d27c812cb5e567d7fa1f7f98299f5ef125284bb9d257
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBib+56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_bfb5e6e2de5e6b0c4dea88ac5de97e43_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_bfb5e6e2de5e6b0c4dea88ac5de97e43_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rdfUQZR.exeC:\Windows\System\rdfUQZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YFSyjTy.exeC:\Windows\System\YFSyjTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DLUPKtR.exeC:\Windows\System\DLUPKtR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKQaNsV.exeC:\Windows\System\cKQaNsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpHjhAt.exeC:\Windows\System\rpHjhAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTEpWIm.exeC:\Windows\System\xTEpWIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRsvaXX.exeC:\Windows\System\NRsvaXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPZRXcz.exeC:\Windows\System\cPZRXcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgidwCM.exeC:\Windows\System\jgidwCM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYflkII.exeC:\Windows\System\OYflkII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qUGvEsH.exeC:\Windows\System\qUGvEsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yQmjbrz.exeC:\Windows\System\yQmjbrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WvyNVud.exeC:\Windows\System\WvyNVud.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Urqezte.exeC:\Windows\System\Urqezte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNrrPfW.exeC:\Windows\System\jNrrPfW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HYYVdde.exeC:\Windows\System\HYYVdde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dszWtbZ.exeC:\Windows\System\dszWtbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VacodBa.exeC:\Windows\System\VacodBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lChbaiX.exeC:\Windows\System\lChbaiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFmxDDQ.exeC:\Windows\System\lFmxDDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpiKCfY.exeC:\Windows\System\jpiKCfY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d593ea5ffef17c5d28d2723405b45f13
SHA17911bfb5546bc5e7f89c10ade3df5420791efb83
SHA25613e86f9fb530e67c20f5f5dd004fde8b8fbeaaf9de8a961ea2c869747d66fca0
SHA512318524ac87210c57bb6af07ef6d1f03fd49ee51ada861723cc07cf5847117c902f7fce823651e3a2510c4b79960d45ff6b7d87e943663c35e8efc59ddab3bd16
-
Filesize
5.2MB
MD531f7936da074d77327497f233ff955b6
SHA18e857d1878a5048a036c5835d0c58b82e8512086
SHA256e51e243f0e748a11b9363b3a581afbee73a9ab715f8a3230be3996b1003d4df5
SHA512fc5978af9e98d5c1ea5a9753deaa838225816b3db6f1b273d0017f822e7bf337403dcb662548d5e9d9323e7bfcea0cf4ea917afd86067b33d7155645d5e0eacf
-
Filesize
5.2MB
MD57bf3a689fcf3cd628e526037756ad125
SHA118125b3075c8ed2150329c240576103d1b2d0b49
SHA256f690db104818ebb9f3cb74da5c3ea84fd6084ec3682bd9f6ee531ffa1e96bd5e
SHA5124d6967f9e2cc8e7ebb17e4a2a0f628d3a2c90e9a7de75561da6a5078be4476bea13b5a4ebed1c4bc2e8e0f3e23dd73ac5cee47774a50eb21710a7c849ae2c394
-
Filesize
5.2MB
MD55fbe8034914a1f9f52b99a2356b0664e
SHA1d16c992c192bf28ace9a4e9a4ad916844bd54fcb
SHA256fd50d521145ed0a194ef2113b14418bb28753010d9e30ffeb6396d68782c1093
SHA51255b56bd7b85f4b811fe04d9de69fde40bb8ddf9643c7aa78c3f0f4fdbeb700b39d1f0642767eace6572031bc6c1dd8a094219648bda5fcf21c2e18768bc7990b
-
Filesize
5.2MB
MD5af5ea118ff241baf2c9c7d0da246c143
SHA10ff6db318323f35fb100f6d0dd38db76415d5a2c
SHA256bba859b33a27b64ce5739b1ba3eaf3eefd5dcfdac10f6553d18c6f9cf3a78a84
SHA5123543628de04001d924da3679a5745854601aa548d55400a454fe95c0533c06d32925495e7bdbd72a8d0b48779bcc38ece6f0403b76f3cd3f7ad6579ddc0d3caa
-
Filesize
5.2MB
MD5e4638409cc4bc80f19262ac1dd56bf1c
SHA1e1b250b804fa7bedd729db49b3e459a5cafd96fb
SHA256734789b377f020ec14528a8e0cb7fc07322b7542e749179dd187b744831959c3
SHA512fb144a444fe5a447a69760571672cd83d72f7f696c84fb017751cc55038139b237025148f026a080f7a3327bd68e1874750b4a21b6532e33ef2a635d2d83c3b4
-
Filesize
5.2MB
MD5746e0b3de2bd065bfc72a9724da8b3aa
SHA1f8c3a9e66fc9a3360a258295863f19309058390e
SHA2563eb915360656e2a94294ed5110c235c260742dba6d23a546a2dfb1beb649c3c8
SHA512e21084d2d98d74a1f711109349145a5762ef2692d0ba79d424f46c582b523d5fe9e353cb6b326ec0fcd6e4a3e2da2bb8eca5c2bcf0e32ac0d14a63ad3d871acd
-
Filesize
5.2MB
MD5562630263d9da65051758c92b3b74103
SHA1cbc2c537e9525cc396e72c31c06ed6a02c5e8476
SHA2569b0d85b5f2faa2ef21d4809e2f0a17166f0b51c5f29f229c358c215c6afdb983
SHA512c68095b7a4e3246e569444e15b5c208dd7c5d799c461d9932e6981091bb6f46790b05810028122343403bef4d1094a004befe8d5b573ba0920c1f12ed80e7afb
-
Filesize
5.2MB
MD568107aebf70cc137412aa1df50ad09d6
SHA1d2f14480891031e78ec63c7ce824d95120f42d74
SHA2564dd6d4decdb62a8ee2d387cd05cd699a3f1b6d6258c916a8b2fd41d8c56e7199
SHA5126d5eec16e576ed7abf300358881bc8bbcf49ada727d23eec8bfc011696a6156981578228043aed510f1bb32051a90b7cef3ff13ebe4a5b8cd5f7d222e3db857c
-
Filesize
5.2MB
MD5c406e5f2e60c36a0b24e5a5d54fe5645
SHA159b5c6879a48dce3ad1d5824d5d34b24bae68e1d
SHA256f3e56c81b2cf8424fcab5c428dbd27bb6e034e71250b53f5f89b39951bc51b87
SHA5122621f3e97120eb5567ee1a9bb69b92630305aff6e3ef1f96de9247aae0478bddfc5e940eab5df6f79f91c4ffb2b9d416817e35c7094f856da7ca17133697e764
-
Filesize
5.2MB
MD5e66f2e5d0fab1849b2eec29a901ee035
SHA1bad15e7aa588224ce9d559e06319285ea635ddf3
SHA2565d326b18e002e88e1c94d21171edc9228f5980361faa659867983009d89eb239
SHA51208eb4700e3814d5b4041e10956a6de711abc6b0a61f25f1d54710e5d6f0912f4740e73fdbc8bf1343f8f5aeef674d0ebd29255f61f77d967da622c8de3174206
-
Filesize
5.2MB
MD5d8bc6a1c431091b5feade9dd3e75dfa2
SHA1e7d54a06926b8fb4cf5caf38d2de14d8bdc5f840
SHA2565817b21ff9a05a52cc2b342993c9987c3083e39860bbd8d8020840f50fc96582
SHA51262012411198bfffae07b228c3b1df4636e896922467112cf2f7572795ca8cf3a8bc18f0ce08b64aba02bb49e3059f2e1ecfba12e8c40e71f136542f53458c31a
-
Filesize
5.2MB
MD561483884fc4b3ce9fe9872590acccf28
SHA173b81825de13f02fa9ca65055189198c7608cd33
SHA25685fecca813a50af69a164c7c17ab067bdf5fa8e5372f536132a9a73082992bae
SHA5129fb95dd3242f7a4129465714ca17332fb2772a82ff13ce0f9a96178364d7a760393cd9a5c7780887d2b771d96d7b67adc460173599689348f60bfb9c0e3d45d1
-
Filesize
5.2MB
MD5b64c0382810b2c943cd707e21158d05d
SHA198557cb2f9f0c3c4f6580d4d15c94222af57b60c
SHA256b921e48b96d01739342ff121edcdc2124ae116ab216330739c89088afb62b61c
SHA51291f94626482362503968f9a3650c1c292a4b13dd4e4ca5de831232cd035a6938bb61179de0a12f1e54930c9cb6b0398a94c79c619a9189d15ee4991146a653ed
-
Filesize
5.2MB
MD507e4996af1fe3d2568406d623e9b4614
SHA1f2eea89ab470a8bf5597f3652ef2f11ac0ac9f02
SHA25692d3f0899c58301e851f4e70c8c085feabafdbef5d168a8f1f71bc72d8602779
SHA512ccea6ef12a1648e6dc9e33aacb7866770c4f6e103a5295cbae9f8074a8d21af978729dbedfd812fb4859b00d82a473de162808e1e492a7cba6251c7c8645f153
-
Filesize
5.2MB
MD5bf624cc323a95b7da9502030b70a58bb
SHA187b199fe72359d08a8d1d5469a81ae8abf88ffa8
SHA256bdb151e18acd4a91df7bcffe0eab698c0791b9a6ffad41de35275d095232c02d
SHA512ea55539779f8c22bc5d5505edb5fb3c0dbe235462a3ac27d7c62b53549eed61fe207b31afd907c8e9bd878307b2d5ca808f4a1c201619f48822d1d532ecd37a7
-
Filesize
5.2MB
MD5424f36fdebd28529c788d1b044d656b1
SHA1f8407ac08431f30b8e9a10d922942530b133d0ba
SHA256740216d8f567b374b2c1edd83394b9d4cfdf459d93c2b94501874b260c8a07ce
SHA51202786e314b84dcd9c37a5ad331c1f34d27fe74eb187de66d4e2824aa1f5faa1b080190ebab3c2e93b30fd26158f1eb4093eca33496ae470e5daaca2516488eb1
-
Filesize
5.2MB
MD596a9fddfe31b5ec9cf8a7318b31d2d11
SHA1f918f79a95f47ea0c36e250bbfaeddefaea64943
SHA25684bcdecc9055dcd73638d724a9c7b26866a1872907399296d6231e5809477e7b
SHA5125a07d3c38e6cb52bddb022e3c19fbafd24ab1a02d52c1c7566bf729b20a2b27d57572f3a189808a46c098f2ee5528d0703510dbc34ee4722874785e329090d0a
-
Filesize
5.2MB
MD53669f48b24da662012c665d178164b3d
SHA1f344071ea186f5de7e9b81143f2377ce30bfff68
SHA256a0e48c0ff153dbae6cc4f263818d96f7cf004b1c70a0009821b7c90164f20d77
SHA51292ab5cd29fd44963e140af6991847b4cf9f3598a17ffc825ac556062e428dd8d733b9865793ae5a0e5765f8c887994eb0af20b933b99d7a5f20a9f58504dcba3
-
Filesize
5.2MB
MD5e01162a9b85062ccbdc834ba6182534b
SHA181fd57e8cb3f3ca068932652df169a6c8edaa373
SHA256c1e5f93149e34c1fa72ab4e3892204b040fc51671c688e1330bd3659789ed619
SHA512a3ded5286a4bdf456d7f9b42b7750c6d15c80dad5c276982ef44f99f2a5ff710512b6329677532a702198500046ce28c3e0e5f9da51c184d17569d08f5b406a7
-
Filesize
5.2MB
MD5cd79b6176f148e1da316ff8b7004e857
SHA16f4fcde3fecd94ff9d08de0de23ebe8d6949e256
SHA25680f785055da4282e9eab37c073f19094db6fba361dc87750345dfaffc3ea8b9c
SHA5127c55fce5d0ca338f0d6ae73e1a31f613c5c475b6079a27db581f76fc9f4ba34f4baf1b2c9cccd48b526b927a11fc41bd07cfd065cbc772d7979f9314901e635c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB