Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 20:15
General
-
Target
2024-12-27_4485d19fa4c6770a92c3f6d2be903bb4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4485d19fa4c6770a92c3f6d2be903bb4
-
SHA1
2071cb795d55d26a16de981dff59eb8cde55170e
-
SHA256
9c6e72b2e0c5767da5c7fdde052394a7eca3c0793ed2d9d15aa2963ddeb10bf3
-
SHA512
3ed4d32852bb4c262e62401ee9b067803daaa7ced94fb8a0412ce14cb989051f9d6dc083299def679145bf0b46ddd6abe1fca3ccbf231bbfff7e37ac7fc701e9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_4485d19fa4c6770a92c3f6d2be903bb4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_4485d19fa4c6770a92c3f6d2be903bb4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\urFdVgw.exeC:\Windows\System\urFdVgw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WviABqO.exeC:\Windows\System\WviABqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rocJvjT.exeC:\Windows\System\rocJvjT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqPtewa.exeC:\Windows\System\YqPtewa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pJdpMHj.exeC:\Windows\System\pJdpMHj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgSvxMn.exeC:\Windows\System\vgSvxMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMHIGLQ.exeC:\Windows\System\AMHIGLQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EIExngJ.exeC:\Windows\System\EIExngJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aZlQMWL.exeC:\Windows\System\aZlQMWL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTKgXmk.exeC:\Windows\System\tTKgXmk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YEQIOyI.exeC:\Windows\System\YEQIOyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pGjyUmo.exeC:\Windows\System\pGjyUmo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\okmjolv.exeC:\Windows\System\okmjolv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnmAvFO.exeC:\Windows\System\MnmAvFO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NQFHOil.exeC:\Windows\System\NQFHOil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIYTkUr.exeC:\Windows\System\TIYTkUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVTdJkf.exeC:\Windows\System\bVTdJkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfsDXma.exeC:\Windows\System\zfsDXma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFnVeis.exeC:\Windows\System\tFnVeis.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IkMOddk.exeC:\Windows\System\IkMOddk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLqKQQN.exeC:\Windows\System\jLqKQQN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52ad13799b967856ede8e8b32d5bbd8b5
SHA1494ea287a00561a5e37ce94084f52cf54245f6a2
SHA2560e2f5fb92e5b3e7e69e808f668f18e1313549664d0cf52ab9e57bcfaffc6da24
SHA512b5ae22d805a2bf093e9431786b92a0bfffc371785a5b4cee376b3f4d19c4a3ed8a3bbd93bf515c5f2201e97c755a7920d409e3d61e02ee65eb8f9a090047e424
-
Filesize
5.2MB
MD525f74cbc508434330a3e3404a30e307a
SHA1959defd17252016844987adb3c3ee0ddca8ad187
SHA256b1262315dbab67695b3de021870766ba50393bdca82fb2a83a171a82f7f5a9af
SHA51275f3bd9473265d0da43576bab515f062dcf8aa88f5714c70afc90e80d5e3a9593e6dd0f51aad62737581bf0cf2ee9b19ec4afd519654de943460dbbe1b424f2e
-
Filesize
5.2MB
MD520627fc5219bc690fca15d79e8e29a90
SHA1730dcdfd5a1de052201c1304b53afdfadf9e20ab
SHA256025a041357e64f4c9d94ab47feb651e7e06d575fb95b4962117ccfc61b336fcc
SHA5121acb940ac3a2afd44c38d702b9d2970264115cafc245b9469e9f2f8e921350e317fc4a68f774561684b78eade1d1f140d2d2dc81563ddc247b8c28a3fc1687a2
-
Filesize
5.2MB
MD552ef68f31523272b2add76b07ca4fca5
SHA119d7f6e713693d1bb545bc0d22fd89a00ac45c55
SHA25671e14f35b5baf64a9042e979f2a05121e8a2fe53f73bd9d6315c1b63fc3a776d
SHA512d24ad57178e51ca44720331379c5d3bffed347ee6b20f5d57ab3447f1a0237a378cd94c25f270ab6624421a5087ff554ea45a009e1c7ef6481e61f2a92258c4b
-
Filesize
5.2MB
MD51a097d25c5ece4840cf65610449737cd
SHA1286669a5e97d066cf6a23226400049eec9dad5fe
SHA2563ed5266924b7fa8146a88d086257a7b0861a03358fc094f3351af4a938c0f836
SHA512c88455d17419f7cb1076bc107061d33b67c11dc9f4e01cf7afcd7a0870bfb0a9d8fdd670f77632677e90635331d52d0ed0f8a235d38c9e1f9899faa00917f125
-
Filesize
5.2MB
MD5369d62e6c59ba0d1830cdf06d3dbf851
SHA14a8e9b66c0cbaab29248d5a5005e8f8b6d1a97d0
SHA25607584169fc578e1ad67df94faaf6b316983dd155ca918fc28fea59d416129ea1
SHA5120ca3b45fe493fa50486348c04e236ca5eaf34553ef0ff60a2758c131b57d598705bda159ba424390672a99f131b9c9a13ce8fdccf831fd3e9e518bb03598197b
-
Filesize
5.2MB
MD5177d5d89e6da19eea6f5fc689dce8658
SHA18bf6d144de8e7af7a98fc614f701509bf051405b
SHA256b1ff12ad48ec04fb1461db22dd03c5838353488ff31e923ac328870b6582d25c
SHA51262cfadec3b4d5e4b4c01e6ce39838e670e862da1402bcc89fa3f49ae093c8081dd10a6523719ae0e81471bd52eb33326a9e1399dd0dddc63d3dd563eafbcf0fe
-
Filesize
5.2MB
MD581ddd373728b2948f06546e9586ca3e7
SHA19d18f76d2b4deb784c27bf0088b144cd159a86e4
SHA256ee464619dc7567acd832492d987ec4fd76bbf3edc2843d0cf478510e54eedf3f
SHA512861b37b100b675791ec3822cd18cb10efb0ba9ffb6a02a50aa5765cdb102046070d8148582ac754648b1201a8e70a0e353c151ca5ab4ae13f05c347e1604d234
-
Filesize
5.2MB
MD5605eb2c10f04cb3b2fee04fb1110b547
SHA163e75fc391664ee1e8eb1311fb7fc2343a3bc948
SHA25686bfe1c9007f44a541910e85565a38100041268adb1d2d7af27360d1b90254c4
SHA512478b9fcfba594b1acb5a0e8ed0c9ab4f031c612c583f738465641dc0c4145591fee520d36f91c13ff44891e74cac66e345e699c85181f738c9a690c654503494
-
Filesize
5.2MB
MD5e30a41496c2d8ecd78567e581e8bc118
SHA1363276a63975b0c56d55b9f8d1909593f7e2af85
SHA256ab9130b15cc2ee7b6f264a2deb5237e7d962388f8f8d4a86297bca9ff857c2dd
SHA512479d8b1b4b6deeb21836d17b0a3065940288d2f1adf44b53d0a6b589997b1fc59de8ca209ee4152d808ce44c4fe79ffb7ff93fea45919bc654400e14796c7ae3
-
Filesize
5.2MB
MD52e5fce5b893dd0ea67789f6be5992850
SHA126f6207da9cd93ed9b311782a27b19310baf20e5
SHA256c33f67fa484557b2cd8bddec26902df7e49e0b3d1496dc84260794c593324287
SHA5121e487a0c877470e39a2f9d310933f8b5cf0a6d6a90e566da4b1490405c63e8e1f7b66423ff3fdf35267f0c78a01c58ff0f309c01d5b6c69d7025eb61cbff0412
-
Filesize
5.2MB
MD56f32ee4c75e1e0165adcd472db024f1c
SHA1202e4258c1e1a9a06d4f0b8fe0b2d134ccabeaf9
SHA256750bf84324116962b5d058e35eb651a29a02abb9dd94d60d994bcef77e05bc3d
SHA512056a9817c358aaeb5379c64d472a15a639db01e1dafd51d91bdee594a98843d8c850035c2ef41675056403f671d261836547e8358d7521252a39fa37752e1fa8
-
Filesize
5.2MB
MD562e863ac20853c7ab4cf8ae799131342
SHA11d8c416ddf98b68a6504324b857e5c5a52576504
SHA25691ceb6ffd7b4013ae383a8fd4a2a37642fc968b8f1d7d03dca68a796d12e02be
SHA512e804a390937d3b82a3efaa0872f65494436cf976f6a0c5ff04e1b786836ea2e5e67c86d38fec4167c8ae1ee3a305f8af7dc69b976bed36d9c1eeb540ff4e2e13
-
Filesize
5.2MB
MD5381f9c0ee829cd65021482e176fa1d20
SHA1ef1c685e42f7a27a28db5d84fa81a54d9610b0ac
SHA2563f6f5be97e3dcb03a9bc1572f291ff39fe5d26fd26159c02d59a69f83d9521db
SHA5129db58db9d446dc7c9ed0767e681b0fd1db6b0138196a6007a4672155373e068bcc0ea43b852cd87f7c357399d129facabffdf5df4805d29bfbb45d9bbf5db198
-
Filesize
5.2MB
MD5a96b84e5a03ac97fa1df577b09345fe3
SHA1c3d27564cd49e8886f7686ddc0c468d20636702e
SHA2565a84094f02589ba0b9e497c0f40474c8a1b3c73a573a4543b46024b6ee8e4c63
SHA512159c6ca05c04f2eea29aba71e303e5fabadfde33f720e001b3d8376a0ed339fab766f3949cdae09113ae878d14d4b8406406d82c087fad6143e716351672f050
-
Filesize
5.2MB
MD550274635e7e8d42dd687a370fc7a8b7d
SHA193f588cc8b8754faa3fd1c57ff13e937b4ec0433
SHA256ecd6ff1b9a2980c692c88cbdb6847e1def1c1e8891b8ff2448128efb35e41283
SHA512c5d5a3c7e8d8186c000882caa4a09bd9a6f5fb054e705add6aa60c459c3e328edd1bb2a381b94b7b8557d0d642d720c5ef1f828590e5ff7be01a23c73eb68c77
-
Filesize
5.2MB
MD5060472a6b658be3ec5ce3cc8c908c0d9
SHA10ee0df686bebeef829d7902adf0c93fdc38e58c6
SHA2569ec55df593e7359fa0328e3a8b0358b41159ef0e358e76d62539615a6448a3f2
SHA51234188329abc16e32c9e7a989af284ddaab2edfb424227eb520a4604a89503d9e249cbef3dd3b62b7486f380c9b881eaf577922d296bafdcb729cb85a1b4576ef
-
Filesize
5.2MB
MD592948363f39b5cc0893b92884a1d8171
SHA1a51bf08fbd829d2e12a1d09df3b503c0b93ab182
SHA2566f69d5f52e45d7cdb46cdf07ed750f5c696e43d90305d9e665f1e61ea116bb0e
SHA5128a5627ab203ef9215439d15c1abd3aa1f72098b211edfd7b253f5c72fbdaec1152286eedbc243978de127ff139b231b756de7e9d2776aa6eea88778be852f2c6
-
Filesize
5.2MB
MD54a4582d418c05cffb39cb60bab7248c0
SHA1d15a814676bee5004cfebf359955e83b3f9a11c9
SHA25601d45da0e70e6a3bc618aeb5cccc14852cffad088bac2b51b2d74bdb19a926cd
SHA5124b5ea2d0ca23ac0271b8fb8f1aca5dc106da21e7ff7b816ae40964ba095e561dbeb004a6fed67a519aede8b51d41507b5d241e3cf17943b0b6e60c833aa67044
-
Filesize
5.2MB
MD599a08e953da0235fbc2d0a675c3f7416
SHA1175ffa6b33f0f50474b171ca60452096667628b3
SHA2560165d83f0246b0624e907f59512886b8ad6e52b03199b26a77bbc92d70fbc38e
SHA512663b7d1aeae607a34f1f2d297b55ae85e0bb38ff1dcffc1bda68819878c00e9f3db38920c3cc6383fa8b6fe48b01e8c353721e059bec0b0b1706939234c67e4d
-
Filesize
5.2MB
MD5c0ab4e3f7dddfd91a2bab47b5c67784a
SHA11f9811c627a69c5164c37c2183731b103a351030
SHA256c22bfc322c87e069de6f118d3a41373957885d4f3be1ff793665d0c3b5c70210
SHA51272ec203fd0043ebbbd4c165ad9ce24b0f99e6513fd52062d6143d6fbaaf4b9d319e0f707e2d4f6632a1b617ed5a6ae295a80bca4b46e0d009b1526589685815a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB