Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 03:23
General
-
Target
2024-12-27_60ae59c2ff9203224752c549e133ce97_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
60ae59c2ff9203224752c549e133ce97
-
SHA1
65ce97a5a24b1b210c1bed4d5747f8e59eb4a571
-
SHA256
285537e506b3cfd1e3eee158c3359a3c36dd106ae6a41a4d1cfead4d8ef0affe
-
SHA512
a0a8ff4d66c364693e803e708e05618c43346bd87f857e6865c9df1c12fd202c6e7a045990db7f2c067572b729d69f4f95e1d41a15fe7708aa369554c3d07254
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibj56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_60ae59c2ff9203224752c549e133ce97_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_60ae59c2ff9203224752c549e133ce97_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AlDuReY.exeC:\Windows\System\AlDuReY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCkRYjq.exeC:\Windows\System\uCkRYjq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrdkwIz.exeC:\Windows\System\OrdkwIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LdfdZbc.exeC:\Windows\System\LdfdZbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULOUAbK.exeC:\Windows\System\ULOUAbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BtwFiaw.exeC:\Windows\System\BtwFiaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtteAQJ.exeC:\Windows\System\JtteAQJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ywqzmuX.exeC:\Windows\System\ywqzmuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtYColz.exeC:\Windows\System\gtYColz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igaxiSE.exeC:\Windows\System\igaxiSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHXLGrp.exeC:\Windows\System\zHXLGrp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGUlZmu.exeC:\Windows\System\aGUlZmu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMDIShQ.exeC:\Windows\System\LMDIShQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGRCakQ.exeC:\Windows\System\KGRCakQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rJZKKLj.exeC:\Windows\System\rJZKKLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OeVyvQr.exeC:\Windows\System\OeVyvQr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CkSCLaN.exeC:\Windows\System\CkSCLaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kNPRFBN.exeC:\Windows\System\kNPRFBN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EtPDZcR.exeC:\Windows\System\EtPDZcR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzgMbMY.exeC:\Windows\System\hzgMbMY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INqFqAE.exeC:\Windows\System\INqFqAE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d5ed3cf98639445de4dc4e6378e4a18a
SHA1fc15972e4f08dd55f985b6eba10a794d98c33674
SHA25671e7e435eb32da27f152f6d32878580284dce65c9f33a8dd1cd84c81ab1e8ee8
SHA51250d9ed8b6e0d81f70dfbf7943e910ff654e55d3973d90d20ad5fa139bc37d5e189313159c8e01308ef00ac10db70533d05f05ca868a35319b4bc2330ad47e594
-
Filesize
5.2MB
MD5e7c90e4dfb491d4f86aa46afd43ec633
SHA1474d6115c7fb9a28fd33cb62bfd8a818af2d6496
SHA25677a72728b7721e7a2203912c057085c8a38310f7aca76562a5e0a39a4c55834d
SHA512516e20d7a0c14700d476b20a24723f0eee621876c4854eccc4c832759d7a003fc2a009b85611d8400a29d4ab5acff6ab75d539a1fcc364bc86b0377633eb1ba0
-
Filesize
5.2MB
MD52b7e3881113edc25a959070295f670d1
SHA1fb419f34828ac377fc036842a88471cd01b8fb53
SHA256cd7de2acacf1376f496c75e81418be856c89a24c16a1d01e896e66d87caa4630
SHA5120b549837825ab6c72adfc2fff7fc5151bbffb27c563af3267ca38d5da69bedd5dc7f88a3543ef722a667ef9ad8a6a9adec4b7da820b63266958e9082b758f85f
-
Filesize
5.2MB
MD5777e1946208b9f02b4ddfffc29a6ab08
SHA17352d7155726d68aec06c91c13163dc55a168f4d
SHA256d6709306d3df5c3df6d48c98edeb64e9b6ca346ba8b72220d2c0baf0359dfad2
SHA51269c175c36540ebcb4519f47215c3d8e82fcbe532578e0b62e697145754ef4905dc82a6b52b4a0989bd043577842f597c0591196c985f3475c579c0621da3d028
-
Filesize
5.2MB
MD5ffb72e15877fa5bf32c8f799ec9e5784
SHA17be894c1f13001aa2932db57e47d1e61452efb59
SHA25670fae88b45b7c81ceec51e30c04e3f1ec778cbf3cbd9c2e05994cb83c54937ef
SHA512b47c0661a101c29c27cec6e3b190a14e642fc1b3bb976771f6e9b0bf2b56b5969c1c0012ac5de91c3a016a91d880668d5caffb8415650c336592221b1dd7bd88
-
Filesize
5.2MB
MD53ae54df8bb8da6f411b8734402df8683
SHA16f5649bd582f62b8d86e6db844f4b1225f9f6de1
SHA2562dc52bd2f599e0c53b0b4ee536f810daa6616692fd1dcd8618d194d5838100e1
SHA5129ee7b92809733d8f84480fb7340fa17ea688540f2fc029bf2b6e2823308f92b0e8fc9c659f89827b33b7883d7a1bcc825ced5e6382b2ff551961d879dd82eebc
-
Filesize
5.2MB
MD502c5996fc702899d32630afef9726a98
SHA14b49cd72dafb02899d4ff964bfa60cd2db3c9907
SHA256cf64f86ebcda9a19c9c68c8f5f7d55251005ed173637eaa2e7426491ed348afe
SHA51221724058404c2b786e0703e4be18484583920c3e7eb08c1dec30be435623d0b27ccdc6c09889392f5839ded17b548d50f02edc00b62e4fe11441d065274853e4
-
Filesize
5.2MB
MD5f253c87d6437a21492a5a5903c07b1bd
SHA13e60537b26e04f8635caa22ab51cc9982e84affc
SHA25698a3955ec626fc1ce2e8a7d66de23c2b3e98640dd9233aa8d07a829fdceab28d
SHA5124dfbb7f25d888196a3e2060f72f59223c6aa5d11d5ee95facf863fd2eeead19c0e69644009d72cab48da15c743b532576f41607596c49f6b01b8b45d5e51e509
-
Filesize
5.2MB
MD5ad1d3edadbc5a09639109ba77a928fb3
SHA19693ba7476fd894b8aee4f07d6db10e23664d217
SHA256e47551721bd7d051a4cb354b01abfe4065c0121d721b87db023c0d3e1069b63a
SHA512fc6e5987963c3870f833fe8962fbf6ed4b504bc8f24e1dce48930455b08e80917fc0b9c283dc5217c8b4db8865a34fa7d29fc4ca33db28b1f7ce7e2991cf3864
-
Filesize
5.2MB
MD5ae604da29367fde9db32ce6323a82243
SHA1c48f0176bd61791331579ec3e6bf6bfb065dc753
SHA256c057b65ff8f1a1ed7645519921a97a2c41bb97343811a4eefdcfb48dae463f39
SHA51257ff7bf791ab560fa6960243dcf66401c82b1827abc1c5d14d2b61f46a330f64dda7a294a23ada4e8db6722902a4a6bd8a1e25efaa9eed2203455a96991b0555
-
Filesize
5.2MB
MD5a7543497300796267847216c59c14d11
SHA15f02205ec522dacceb91a398462dba36b7cb5ed6
SHA256f504919d4d3e45412b53129f8f4234ad7ff91dfa636f246e69610ccbd9aab7f9
SHA512631719ad8a04da02be95e93d84c2ee09de4ce011cdc793181488a3b6d3b867901fcd334d9e632cc68f52a19fc8d932ceebc7494705edf15f2fcabc25db1f845b
-
Filesize
5.2MB
MD5324a884ba57039ab340316001c3eb02a
SHA14c5c5293e4c12ee6ac9dbf47ae6438c15d13bd0b
SHA256cc05775be8282d23ebbbb0b70becfe3acf3292925896a7b09977578e8ca3018e
SHA512d78d7acc0c4642af76b462b5fe74dbbaac5a96301ba785a8186a0a3acd2ed70c8146dad37c523f8f11671604e206fe7d391f5bdaf9f2ef9de759127254f5f53d
-
Filesize
5.2MB
MD5c8fc3b418298d86a8e57d1509edd4207
SHA1f8ccfcf1f2d665e43f5e80fc6386b00647143870
SHA2566e67e43259c79dd4d203dad3a83662d86f298700f7eb571a011e1dc536857102
SHA512a5220c6648632d614c59034b31dfc5e8f902f6dcf6c2e299a41e328cadabb50d0af64c92c40a1e1b18d068580deb0cf810df6cd774946c7c629f1780238d6a3f
-
Filesize
5.2MB
MD57d972527638e5ad7d06283adc4025d7b
SHA1eb6281c828992e6b3b2a295f27116094f9ff9167
SHA256819492af8acf64bcbc124aae1e126af5f45254ade5329760dbeebcd546c2b1cf
SHA5124efc6835ea8e277499188c78ecbbd4bcceaff157eb90c187fb9725b741c66256028bb1cacff8dd6cf20326be14aeb10f0aa358710b6de01f21738e509671c746
-
Filesize
5.2MB
MD54149cd4addcef3a738bce42b37b2636e
SHA1b912557bbe0f80811b767c86a353f9d26f6502ea
SHA256e7bc7f5108908d66c3adcd0c3934b83ee5c601624e0fc7882acb198bed8ceae7
SHA5129641b3bb854dba74608d30731c923a478a1d3c875221db073d9863744f30e5510b20b6f1fa8fb8b1c5d13335b1e479f28d3d7e3bcbe212ca5e352d2b6183a9cc
-
Filesize
5.2MB
MD56ed82ebbffa3a5e2b676f591e31efeec
SHA1a7e02907ecb21578981f6f295f467c844c77543a
SHA256b29992f4f7e837f205db8ae3f1c452af78ce4db68cd942c9afceaa81188bd750
SHA5128bf87c907fb7c14e987c1e2a5814b8a1b29bd73f6d6b52b1514cbfb901256513d178d7e46127cb336e4d83be11b86f27174eea6139dcae413868132e92d667cd
-
Filesize
5.2MB
MD5733cc1b0500df68bccfb8c17bd731c32
SHA1922d6dcdacd98f8d58f4ebac46d5bb0bc60e8eb4
SHA256d268b4f2613af167e17deb6f713b7812347f107afa3c53fca9636e27adceb5e1
SHA51257fea570a34204d82a698a0f417f773962761b880772cd6111aabaf82f63771e557291a6fa6e02f1c7960895bfd3aa4db4971c9edc07b5fa3ba47faedce78950
-
Filesize
5.2MB
MD5b03dfb094ac0defb9cf87e15bec491a5
SHA1a8f65c40fcf2150b038fb065cc632aa64e3d4a1c
SHA256f619dea77fdb38b0cf1bcde4d5f937f22f2df040c0f38daa5026e9b88c64f80c
SHA51231b09abeb0ad2c881860fc4ee7edc9d2b1f1508554e5319242fb07afc77fc351b0631979b6ba163f862ffbfadc007df738300e3aba22491b43b693a904fe2e9a
-
Filesize
5.2MB
MD50abcf1fdff922c1fa3e8ad549a3486c9
SHA1b0d43277f63313fa254aa4cb50f46087eb8a98a8
SHA256b6c6644f1bfbfe059d320383a0ad8608eb007c864b8c868db8733bf53b4012ec
SHA5129a1d3e2d61a171fe38e01011c97d6280acdb07f113a5ba153b8ca80590766701ed0781401031cd3b5ed68057dd5b377bcbc23b7b834237018e56832f21703978
-
Filesize
5.2MB
MD5a00e33072c493321a8cc8a9eb9188c86
SHA1e19762590d62044a92946a28b1575bed2339c196
SHA256f3369963935380fe96602cfcbe6d211adaac3ac5cf3f21a5f2115ac7b4462041
SHA51211458040f2065df108feb719348e8854b9d4839210f92c1bc38fe859bf9843d694140cd52bdfaaea82f366cd52cfc3b2de2863c4e58ce94d9dbf45b5c55bb887
-
Filesize
5.2MB
MD597c12ef0bd645a5c5a95497f5aa0020d
SHA1826db1bdb8d3d1906310399ab5cfc570c4f0dcda
SHA256bafb9b29458f7b13adce86f781392359a589eb852f6384f9238c2db054eb93b9
SHA512fe06e578de7b29df47af78aea1a058927cdcabad6226b47d46984331111cbbcc87518d4210a3ba167850d8cf6acbb6af17e20e828d2cef26caf48ef913790a7f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB