Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-12-2024 19:37
General
-
Target
2024-12-25_dab1c3501a2622fceaad7510ce5d3b37_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
dab1c3501a2622fceaad7510ce5d3b37
-
SHA1
5fd3e70487daabdbc6d0d75c65c2529f6aaae184
-
SHA256
3e333ec749a74bac9b35fde28280a3705893d29bd5d6f5dda8e966b8d938a07f
-
SHA512
a9a70cb89d78db183fa3c59aac3137a98c6a1895e5271608e5fa5d999a6bde4bd389a1219c34a96021ad311302d01c101864ff262c27fac1a277d3dceecef060
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBib+56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_dab1c3501a2622fceaad7510ce5d3b37_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_dab1c3501a2622fceaad7510ce5d3b37_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QoORAzn.exeC:\Windows\System\QoORAzn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzHSMEf.exeC:\Windows\System\FzHSMEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LsMcRIo.exeC:\Windows\System\LsMcRIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvfwboC.exeC:\Windows\System\BvfwboC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQUFnAa.exeC:\Windows\System\MQUFnAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRSuUDf.exeC:\Windows\System\bRSuUDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ALRETlZ.exeC:\Windows\System\ALRETlZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RcxIVfA.exeC:\Windows\System\RcxIVfA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLRzvZk.exeC:\Windows\System\RLRzvZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYDZjwC.exeC:\Windows\System\OYDZjwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GKXgDfr.exeC:\Windows\System\GKXgDfr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxRhfBa.exeC:\Windows\System\ZxRhfBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzoNTKv.exeC:\Windows\System\jzoNTKv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\daGojxu.exeC:\Windows\System\daGojxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txMSuyJ.exeC:\Windows\System\txMSuyJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wTPZTiU.exeC:\Windows\System\wTPZTiU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QmxHLoD.exeC:\Windows\System\QmxHLoD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HQOAyro.exeC:\Windows\System\HQOAyro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uuhoChm.exeC:\Windows\System\uuhoChm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HihRWvu.exeC:\Windows\System\HihRWvu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLGRnAT.exeC:\Windows\System\BLGRnAT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c035bf9ca089890f06f047f574047d2b
SHA18087d8453ad767c55b5eb663e30b642aba9f5635
SHA25669fa02980abb02a2a215f836d16f2a30a919377726c995b3678513a6e79cbfe5
SHA5125b85298997919f9a76e9f706e9e9292ee2081c6977f27c0553af99fa58e227dc555a78e8f297236149920d00b416b77dd1d7533c9a7fae973b10cebf1b16ea54
-
Filesize
5.2MB
MD59cfa71fc5beb14aed856b02a04a9c87f
SHA188c59f9439deb01a0cc972050b4805107c604a31
SHA256649ac3465c027c739872285caa208c3a377be569e75a019508e698bc804cf95e
SHA5121eb34d5ef1dbcfe680f1ed46c5d112553412858df189eda87a4736d10da179f5d0464dfe8756f0119fc1189986db45dc0a07d25f01bff3c985a2380a9404e3e7
-
Filesize
5.2MB
MD549711fa47d703f3476522196b8d689f1
SHA159c61f95700faf4efbc5fe563ce69753db8f0e33
SHA256c408ce6661a41b00c7503f5cf958883f38a8f8e38a98c136730fcccc320c550c
SHA5124e62ea76c3eaeb087fdf1c09aab4c0e8abccccc218407d57b84fe6ef8022af0297aa08699576e11108520f16f5015ff3e48b5909cc17c8a48d0188e9424e7f09
-
Filesize
5.2MB
MD5033dfc1d51f1e9f39cd670c62febf324
SHA11d58fa984f6decfad084cb256933e3e873a2d36a
SHA25641a3cce64c96969ac0e544fb37f39375f8647172a973bd569f6a82f613e18375
SHA51295764fc089b67fb340a63c0d400d5bc4f7b81a8e85846671c17d91bffa05bf1761a3e1b866b3de6f207bb15105cf6461364aba283ae70816a6fa12a4580af6d8
-
Filesize
5.2MB
MD5a1f60b1076e4b115b28a8207eea72a5e
SHA158c7fbab205feac4def6dc49f276bb5f24bc610d
SHA2566d295fb2b67a983098452bf356bc67d0bcbc08ea8aed2d5acddd02ec06d71ad6
SHA51210f7e59038f5a239c1b8c1088a9d787fa2d6b32b3cd9193ffff7b9e3eebdc097fbf15a17fb37243583a2f73fdf7d5322946655d3805a7660bd997c3b34afe625
-
Filesize
5.2MB
MD5b26f2f99c43c8b6f39b224fa8f18fa28
SHA197348f2468064bb64953224a8650254bcceb0e55
SHA25623a49bb02d9ac07a7a54b04dc530ebe8fdfe044c1049dab9e80f38641fd46b67
SHA5120ba712c8844a0da0041c141a0a5fe23d6d690e3e9769081b236e013ada9e78a0fbeb82e7e8a1341c6a8a0d40ce99cddcdd63dd0446a03175e07c4d64e4372e50
-
Filesize
5.2MB
MD539891da67a06419ba0159d8ad67f1064
SHA1b93a03e6759d286ecc22b4ed47f8192697ca548c
SHA2564683f8a54467934776ef660b50aea51540115469411c773d82ea6170d814c3da
SHA5123c4ccd126e23dec3e8c458cc4cd56b1bb9814a8a902a3d072481733080644a27bf1848da7cbb866a5cdc9ae87a6b64da68bc9053dfa973269a2ee6f77c7435ee
-
Filesize
5.2MB
MD59ae873e28d592ee8ad9b58030bb66694
SHA1ff1c232e08d9167ae1438b3762c7b68290d2ff66
SHA256ac10f3f6bd0ba88fdbd18194b85129aafa9769e35be4064522a0a00f3d28c033
SHA5122d53ee7f00dcdc3fde6fdde51b94f8d28ccbf18a5586ca3f046c9da5e5cf6bfb6e9097dfe695062d895fe72268e3469616116d6ab5dcd8b74cf060c2bdcd7841
-
Filesize
5.2MB
MD5dd9116990bbda98929bdc07da575d89c
SHA1814001d086d07f308f4ddcabb2030311cb58f296
SHA256e83145452edd006d27fb5ba8d68974a46a1d56431782f086a0d6d3e29b12811a
SHA5120e7d91b87bc339bcec2acc1c9fbfc62c3c6163601781dda375d9b8c33c7f3eff6feb703452ec32502f51686ba6e862235c76109e783e79fa1b8188a2b7e1113f
-
Filesize
5.2MB
MD509ff9e383fd095aa015be0f84776e295
SHA194cc6b92a603e3492c554d60b24f2ef5aaa8cf33
SHA2561e8b56fb776123887f48416c2a03e984c4588e3508b7903ed691705ad26f6c6b
SHA512420201ea0c074d9a46b8d2438ff40996e7af25a13b8b87db9a86e292d6b81d100d06f9af4730ea869bdad53e43dabd4b6f2eb49c0a9c871346e30fd71054e244
-
Filesize
5.2MB
MD524dc2f6e80147172ac833380d20c61a4
SHA1f66871dd915ebd87cea73d3c367a444cf21afcae
SHA2565a526da77bed81711d32c57e77f083b49b85ef555b309c0c7e0ef10b365112fb
SHA512bbd3410f97a6e40aaf2442f56572b4944614452e6b4c177350e186947956436a250f60c66a66d888e251ae81d7a95bff3dabfc2bdbfa7e50ee0a31b355e85985
-
Filesize
5.2MB
MD511763d8b7f34e4547a47ec89fdc3ad74
SHA123360cadedb7be3eccd1b72674082f1539a6ac04
SHA256e5ad3b4cd65e9f7d3f77e6faf4d6308c8ca1c5cc1c9da102575c43140900e5b7
SHA5128af020551f486d11e1bbf11dc39556f7a922d1f700378096080076bd28b54c94a17faa1f84a262ef00f5069c22b5132a4ead360a276c336fdf344f7beeadc92e
-
Filesize
5.2MB
MD505954ded05c3474ed13859043be07f1f
SHA1e4a47372ee546509c1cdb2f389d2ffb01d0d70ca
SHA25683e71092851171b76021e96909a71c18a00e3d2de0b506ecb6d9def231da517d
SHA5127cf377e2c9057593a6904b72da32fe9f0b0b66334bba30313fc6da4bb854ae46c272271d6a9769dd792bcb61eaa0523a69f368d590a4d7c6e77cf031cc768a94
-
Filesize
5.2MB
MD505c977d06b9c889432ce757af1ea3034
SHA19b46d59cfb616488ff2c2b402aae5fdbfd78a015
SHA25662ff3d9a68547b0dc052e0c5ae0b3551f1ef2526ae15930cafd2df955cded6af
SHA5125837c5e1522c657b66a509dbcd280141da550277a576cf66943080944bc706d153aa451f9f6c7e0c3d2e71ae6ba66dd3a6b57f38871585bb9749d2444ef4d937
-
Filesize
5.2MB
MD598e5f43509010de2b17bdb6b28b7991e
SHA18e8ea5fd3514e82fbe3089930ee79ba06845d391
SHA2561083a8f7201ca0c518814db2efbc40d50e421cf5019b46b5d00681811a36d293
SHA512ba6a9f620166a0651959fc62b01490da4c5c2b32bbcc9cd25959e7abb5f67879a05ab016b783909a28b55a323cc9cf33083bc89c54fa6b3c38367ab1e11c5eb5
-
Filesize
5.2MB
MD55ccef720cb1aec54a6283beb00940013
SHA195a83fe957cfb175d8c52c3faefdb2e61010d4f4
SHA2566ab3e045bdea19562f621f5b47eee30be90937060681c6ed3ff47cf7725eb0c2
SHA512b7d4a452459a36b65fd4c1ecedd3159f9a9ca0f5f0957fe88464e580c783d8b3584d64875b4d244e49a617c33b3aea8bf09e87ac2479cfd87543ba00f8e443cc
-
Filesize
5.2MB
MD528162adba8183c2feedbc644ab2379fc
SHA125b777f9cfbf657c486ab5dad4babb3c22e0a8d3
SHA2565773f3342df0b0c0bae520e09ec099e72e4c310a832938043d8d3595bbd90500
SHA512a9eff5839253776ce4f7abf5146ffce62c48c23a9c71d7268fa587e58802aa0d4fa532a682d9951deb1aa882714f5d41f53276378e1b5af96eb69163cdf90545
-
Filesize
5.2MB
MD52ff91335c534c59a66686d196a8c494b
SHA107f7d0806c9ee5e8f72ce2d5eafc5b5314e4e018
SHA2565d539007261118149b5bd1967861ea3064ad6e87a8d1dee521aef3cfdcaff11c
SHA512a7b07c500bd70c85620231338ffdf444b8ab688e633e23857bf2a6ae11aa71b3be98b783a53e93ba33b2959a35d54381eb68f6178af499d7ca033e4631559367
-
Filesize
5.2MB
MD598f508487482ae42f346ffb3771451eb
SHA1a46c118fc60f81aa112b3d179cc71c6bcac9917f
SHA256716f4132d783ede25f96ead786ddc0ca08bb374c661a405cda9b549133036595
SHA51271943281a2ff9264b0c2e47ea0e871bd775e1e0a2a39bb3e7038faaee5cb108749680d401688c41a69264e1e22d97a2805d97352cac43c2e47125cc4e1678437
-
Filesize
5.2MB
MD5db36c5325a5d445101e40565833178af
SHA1175b432729d27bbe45a8a6c54565a796713cf5fc
SHA25664c8ad70abf54a5de76389afcc1d11f79e95a0195624323911f39f1bc4c3b1fd
SHA512da67bd36838021b18f558c58c4932e2d7ce99afebbdb331118363f9eec7c9ec1e5c58ecd9effe0f78ffc60217a82c23ff3971b81f04c2c4153f2282eb12e9637
-
Filesize
5.2MB
MD5bc60488594fbabb47969728f2196190b
SHA11c1a0832c185342ce854fae852c0be1bdb89d324
SHA256cc985dbd03f30278fec768176886f41510fc801cf12f01dd7e69d3fc48b914e8
SHA51295dac0eaf56ad9e8c3c6f0057dc8385faaf8073252fbcc0e2d22628fb3c23f447722e75bfe586e95d7a7d1066e43b19f2ad100ff3bb6e6ba42790829cefcdc4f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB