Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 19:26
General
-
Target
2024-12-27_99a5e4738bdb888968c2703abe3dbce5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
99a5e4738bdb888968c2703abe3dbce5
-
SHA1
c73256936ebbeb491fc635e9f9a0dc2a4c605e18
-
SHA256
c08a09c4360b33cc61a78e18fda9abf52b1d1d91944c4256fd64eb50ccf35146
-
SHA512
042f67e405e036a080a485359f9150c9737da7da6ec1b5a17f2d6ee35535832b491c60995509749dda93fc9d463c9b4107ac7b23d795a2bffa841c270f3612f7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_99a5e4738bdb888968c2703abe3dbce5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_99a5e4738bdb888968c2703abe3dbce5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bPTClVq.exeC:\Windows\System\bPTClVq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JttVHbw.exeC:\Windows\System\JttVHbw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bcCnOTn.exeC:\Windows\System\bcCnOTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxdDYHE.exeC:\Windows\System\qxdDYHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qpveigk.exeC:\Windows\System\qpveigk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kXkTzGi.exeC:\Windows\System\kXkTzGi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmRlizY.exeC:\Windows\System\OmRlizY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSeFXnL.exeC:\Windows\System\uSeFXnL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IcaSXyp.exeC:\Windows\System\IcaSXyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTathQH.exeC:\Windows\System\aTathQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axwPsdH.exeC:\Windows\System\axwPsdH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bnbicMV.exeC:\Windows\System\bnbicMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdJxQEc.exeC:\Windows\System\tdJxQEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dKRateU.exeC:\Windows\System\dKRateU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WeOlmnR.exeC:\Windows\System\WeOlmnR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HPUqfwD.exeC:\Windows\System\HPUqfwD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BoXNkAZ.exeC:\Windows\System\BoXNkAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TomJZtH.exeC:\Windows\System\TomJZtH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XRwPJRz.exeC:\Windows\System\XRwPJRz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZzymcZs.exeC:\Windows\System\ZzymcZs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XtkkMEp.exeC:\Windows\System\XtkkMEp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD545901def5fba51621fcad72eac8fb0c9
SHA1ddc4c3a4863a77a0886bf0c70e486431da855df4
SHA256ddfdc3eed47ea94e24c1d5248955683809e74a2ea2c6dae575a6ef6f0ad1a7a1
SHA5128a03267069e3b25132f4f4d6ff1e063a6ac590f626194b86ed49ba5c572180491c035a5c8605e18785dc60075f1894ef6e399150f1ffa7e1acefbf26b6a22a13
-
Filesize
5.2MB
MD5e786b01ee4290f1c4f04b4072994b521
SHA167a8ace0a0b8c7229d0d5ffa92820b06a0c4ae5c
SHA256c85a307a26217e30a5e5757c63cba3964035f078ca3897a5ecb07867859783ca
SHA512f2657b45a869aa7ad18bd7bcc22417280945a298b16602eb5a6e713b3324baa7d0710045e963aa540a6205e2f70867a8b634cca4364fb0c3edc1b8d7fc805652
-
Filesize
5.2MB
MD5080bf9ecffd8fbd1aadcf22dcc9395fd
SHA1309f51edbdbc051aa6e90563dc68ea68c3025569
SHA2565691512fe43243f316f1208dcab3a4735f06cd3bc66ad4a4845eea264c80d3a9
SHA512b511db3d5ec11ed995135678f2b462694b8df56d296e54b38882ca68c8962135d2fbb2ecf1020158d2e8a9819ed9275794dba2b0c459bab67fb206dad0e6ed08
-
Filesize
5.2MB
MD588d787f313daae82bbece162ef132715
SHA1a5b152143e0302c8d580338deb0becae4543ea3b
SHA256d0db1134c9e81f1da8061ac1888608306ee28e1ee28a102fd6860f22e61c255b
SHA5121ca5ccad25ab4f536b49c42c26020d2052d8c46a4735a41b12050d83b71f268bf3974170c3ffbc930d6247d8267b897f1845e6e64a0abed0ff032915da6498da
-
Filesize
5.2MB
MD579d9f9e41b35fe5753c084cde89872e0
SHA1a6175e6b9514f5067127ebf8ccc3b96004166d1f
SHA256f78b5796f7da6bef7d67586c6a9c68f33c18d2c03a5704cdd2de38b68cc62c2b
SHA512f23b568e711be268eb7d3496a158d06afd6e51676c59db38b913f3e6035aeea5ea853dc890fdd3c210a758e5745f11b92bb87830747bc1f4d3d8c660842b0061
-
Filesize
5.2MB
MD5ecc0f694e3c9f85f140f3f3cf7932e49
SHA19efce70342b931dd2714c025d38bb2c57bd9d3b5
SHA256d834cd4da67c8f6e54edc9cc112c3ce8caef2e097256f965bf61a2f03dc96a4d
SHA51273f79485215d4f6a6c8041cb23ff4c4fb6b1e6a1f5b3e7001cd53017ab71ce84c60cb43bb29050b7792785a45fb141a1bbb3990415f56c433f6ad35d4b446fa2
-
Filesize
5.2MB
MD5d331762130c87f328111a591b2588e5a
SHA187b5be594f4fd2a0d492732b5220f88eb44e92a8
SHA256e151900d01d60d2905c621e7324bfa2afa78a1e46ee7a25ce4164fb6b93e3c7d
SHA5129bae88cfd7ef7c8c83ceaabf9d157454e7af821fd795ed7017a9e9e60f283f45c8b25ec5e69b1009c9a7e75f8e109f3eea2e5801c4dba819aa2ecd2152a88691
-
Filesize
5.2MB
MD5c9260066d5f25ea2efe7743bb8b3e847
SHA171f15cce349f92576c5a53826cd713878db37360
SHA256b36042b5387f00644e77d9d29ff66a76b30027d2b39dd6c2c01d3d28268b776d
SHA512a305c2bbb02e7b82fa1021c72012edaf4912c961ffe4cbd8b7454421d12ed32ae9908726a525fdcd3fd9afa3a9d097bb01d4f6eea7626f579b79f0dce8bce53a
-
Filesize
5.2MB
MD5d783ef86c8794974caea457034370ccf
SHA16109231378cb8d77fc4d1ab786b1f425e87c2c31
SHA2566ca3f91c6e13bbb7e7bb23ed839df7273247c464f8d1808545d832c427764042
SHA5122d6e471636774acccc44108f6cb68b660e040abcdeefbf7d81e5bbedebeb0c7a495b08f1199a33b3f074353da6e42772ad5068c85277ea6cb2b2cca2b31f4d16
-
Filesize
5.2MB
MD5ecf8f688dfcd338e88e5f76e89107ca7
SHA148d20f9a4b566dbd8b06dbdbcbc7d58b676439d6
SHA256f3a9e933abbccc3a4c21f6d111b6987db863600fae7071aa4031239b15830f78
SHA51221304832ea4999914f1b4544e8143de7515882dc50b59fbefb3158f8e244079636faa025acdfaec448ca9de06052646a06fa6dd909e2bbba5785423a8285b572
-
Filesize
5.2MB
MD53ed2606cc8b821ce97be52419bce20c0
SHA110a86ef9c141af9952672ee656f267a192828059
SHA256646af59667de0bd98abe5b99eb791cb69aadaa4d2a782cac22ebe8ef1e41bd2f
SHA5126af09e184e6cfe5c99b73efadc995babd9ed26adf79e11280dfbb5210b9972880554be5c5c52e24a7506c03ec4d1a2f8aa410f4fc57ad6f1178e6f5bec068df7
-
Filesize
5.2MB
MD524d0409d34f39fd5de09513d7db2b27b
SHA1a5104ad6e250c4e210da34b1725d8b859602e7ef
SHA256cc6335355f9b50e8beb4d27036f9fc53e21ac757bb9fe76797eb05067468fa2e
SHA512a6717930d3c9ca2be917c295d4ea22a62515e99e4196e582aa2f7bed2f49ec464d4d41ebb65dce0e94895170d85af14503ec0712537bf1cc67ec038cd7ee4fec
-
Filesize
5.2MB
MD527e04844554f0d1242295333cf96c8e8
SHA181c70e4033394d9e305722cad45f6961f5ad0d6c
SHA25680be3109fb290edaf3aabd8f6535c62c18be765bb66a7c92280e4a9e14f1b4a7
SHA5124a34c81dd121d539831564c4ee0d595cee5a1decbda38d428484c880467147eac30fc27a6f0d592247a0cae885c290e30ee71dda0b0f999a0dc0250e979f9db7
-
Filesize
5.2MB
MD5551c35368307964daaf0e2f09dd3a65d
SHA110aa76b1edc4653347dfbf026bb8ae5ab38d33ca
SHA256d96ab6b0bc1464a3f3033eadf0524ce2ccff9e31f894f174f2c4e47e4b02036b
SHA512539d69c8b1c9a8d9a6a65999389cba28320793a98f61196e23cae500a1154922e6e4dba81e0a08b4490c457f2637f930dcbf2b4cc5c89275b670e8f4857e169b
-
Filesize
5.2MB
MD56b375ff0937427ab54beb482bc2c822f
SHA1784fdd33a3f8b799322ceef743fd98d2e0f729aa
SHA25658730f669f121e512811bd5d20fae29d36deb12dd2ac3fd47db4f74e2c1251ce
SHA5125cf948019e4c4b9be67279b3ff216bccc566194dcd98d3e28aecb6955e25aa9e29ebd37502c3a0903338ff3c780f1cb08df77cdb927262f67f016b2627eaa9af
-
Filesize
5.2MB
MD5341c3d6ad5aeffbaeb5de8c9b256106f
SHA14ab9705327224a603eb1c9b289cee0bb7f9b61d5
SHA2560904cd786db0750fb03c5d11360f6fd793a646795d78729a94e3afa64868fab1
SHA51290c1ce1eea95ae26069e3b9817ca5cd5fdf5e8cd4104688588f53d8696f6397e9ee34a2630ef88aa340994fe07d0030e0e8c4cadb5889a7df602ab597617aee5
-
Filesize
5.2MB
MD592f7a23f724807811f4af40d7be13e68
SHA17a86a12779396a3e348f14cd8e60390fcc4258a9
SHA256a8975190905919a7e5194f757724db2fae39b8b591311ea295f15e89b00a972e
SHA51237e5cd6ba5f836990578ccbf3b530b19292e3df91e8aed387804cf95ce74a4b772224d997b98e4bfcbecf4cba9a33dfb9131e8d08347a306348660a0146170dc
-
Filesize
5.2MB
MD5f857d4c6fb501f91945d22b19d1a30ee
SHA13fc5853a4be96af591524ff22669b7c9cfb6dfef
SHA25617542ce91cfdb802c23c35cc710e083e3358888efb9fbbc4b241483ecf1805b7
SHA512980a6cef6a84d627c49bf870a0d25fd03e71ab903fb821aeef2e99fc5f54a0734b6b8e2360c26c05794808cda1ca71325e37ac03430be4791dcc379cadab0541
-
Filesize
5.2MB
MD56bd6d5da156612fadc1ba2c5eb275019
SHA174bf51f3fda6f580a2cb892c98be8ddff29aaf25
SHA256736672e498c2c8faf0b6675a1cd168ed171d3668e43107f0f7c586967b933acb
SHA512f06286891b719ce3a5b5378bbfc7cb0c48cdf6b5f70bdacb833fb57af42141408bf631b183a2d97c1abbe644ac5b54e59011e491bbc79a04ccc42475fe159e58
-
Filesize
5.2MB
MD5c0ab773bf71478deceaf5208d45a2383
SHA1faee8afcbbf10099437a4d0ca949f09557febb76
SHA2563ac111ae1a680aa9a9dd3f3dc1091ebe0b52d6fa2ba6e13ad7c33d87d75a5f2b
SHA512ec283ef52b3e68ce5e6e20cd35ba09bbf179bd4369ee7375e50bd564ef5bc6377aa644fb4f742d19314da787f95b8b07dc64d506888bf4fcae71ed9154c36478
-
Filesize
5.2MB
MD595763af06ec6adceef2d755526213051
SHA1248d52e4a24a78d449872c08483dbff85a894d6f
SHA2568d3729fc9d84502f6487a4f7709f6c76d79bcd92355a04cffd659cff1d4f8dfc
SHA51267e70f34bb3bdd0712bc9415a5684b05177713faad35474cdee60e3f6ae6d884829b3070190241ed05b9226b9c4d9e1cdfd5784464e944a7e95819988e175a91
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB