Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-12-2024 20:19
General
-
Target
2024-12-27_5054368619cbd5c917be75a46dab33d5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5054368619cbd5c917be75a46dab33d5
-
SHA1
6814d2a4d14998747ff22f24d32dc2655f5b9759
-
SHA256
9b760cb95a5b9f632b856e419b02f7ecf7d5d1bb599cb10730d2134357280b04
-
SHA512
01415d643ccaac875b7cb995daf97c4da6b51c9894199d47b52eb0b7a499e104ce2bb2a9e80fc1eb91c9d289c51ead9724efc00a58f1006f2a05613ca975c449
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-27_5054368619cbd5c917be75a46dab33d5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-27_5054368619cbd5c917be75a46dab33d5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OZhStBK.exeC:\Windows\System\OZhStBK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJYYBhO.exeC:\Windows\System\VJYYBhO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRPsGmR.exeC:\Windows\System\uRPsGmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBwCKJZ.exeC:\Windows\System\KBwCKJZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMguIeZ.exeC:\Windows\System\FMguIeZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OnHjkgq.exeC:\Windows\System\OnHjkgq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObUQWPX.exeC:\Windows\System\ObUQWPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\govALZl.exeC:\Windows\System\govALZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehlArqU.exeC:\Windows\System\ehlArqU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URiyxjB.exeC:\Windows\System\URiyxjB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvGSyBu.exeC:\Windows\System\mvGSyBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dRNsKEL.exeC:\Windows\System\dRNsKEL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOtNukl.exeC:\Windows\System\uOtNukl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NoCiniP.exeC:\Windows\System\NoCiniP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRwRTkX.exeC:\Windows\System\DRwRTkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coHuXTi.exeC:\Windows\System\coHuXTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MGvnthY.exeC:\Windows\System\MGvnthY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqlKREL.exeC:\Windows\System\WqlKREL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyqLhrm.exeC:\Windows\System\GyqLhrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBypeKy.exeC:\Windows\System\BBypeKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvYQBMM.exeC:\Windows\System\QvYQBMM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dfea91045b861e110905df8165ed3b15
SHA1a7f39b49b77d32e385e19f57fbcac70a595f7e2c
SHA256f1e877cf3a2671c467c4caf71461a8dd03a3308f8f3004d0df849a2a053ea9b6
SHA51298d2a5898c428bf8b8e7dc109d4ac9c63b9429a220117b619488d348e92b0e0ec6a95ca67a04fa660ece57aab51dd6fb3a1c63163a612945e58a64b684568531
-
Filesize
5.2MB
MD535fb32ce59a9462acd2cbfd47aef5f91
SHA13ffb119429598f12b8c004fb92441d9b692a00ad
SHA25615d51605f50b2987259ec20faf17b5dda6d75fd4d8c591593b7d9bb4b43a54cb
SHA5121e85f66a63bd414a026a4cdbe2577cd45ee86c9b2c8776627cba04263fe1929cfc18beea9f360f7ce462821d6f1afd4a0ec31b35d293f18804ece09410649e65
-
Filesize
5.2MB
MD550100cea7114c047a8beb27f265f20bd
SHA1e7a3c7552496860181b775e79b3abb56d124282e
SHA256cfcab0a7c39c2b4c114253335987e0eb2b74ea91323cd89b4d0fc8d13476c074
SHA51280b87c462247db47698dad781b798970ef2387578d79d9be72795206a8af17ca96118ce8fdaa21fb6cb7507e02a9fcff2e5e28631f3021cf8e752367577546fd
-
Filesize
5.2MB
MD5d247f2dc5ae906188966e9c0fe7431c2
SHA1619366d77b1a1ac2e3a381bf5f3001759f11423c
SHA25644cc2242a944f9a81fde2f4b2d7987d1460bf066335410da601e577d5c21551b
SHA512282536d53579909cb23760a1edc0739e65a6bbdd3e7e90b5bd0deb4d62cdb936c133118bd18848cd8dce43628c91af135bb49dbaddfa4143b43f50f78466b1d4
-
Filesize
5.2MB
MD5a8c49f489dcb2cacb7237e25f4110262
SHA17e611fecfb675a3892a7e92c948e2d4bbdffbf84
SHA2566424c93619d870d70a570917b5be37330c5660ec47a88b3be37ff134869f80d0
SHA512a44dc748fce647b7c0de22e8a0081b2adeb166d04266233c679144bc9bd077ebfc12af3fcaf03e6cd3a9dba77dd5664b5fe47e1d077fcb43d57a0ea82b1704ec
-
Filesize
5.2MB
MD5eb712d07879a61b677f8a2d5a83f1c34
SHA1e53fdc020e10e067eba3069b108ed4b8e52f8433
SHA2567d2fbed64a994e17ab1249b2c534064835c1f02d49b087334d7e8d95916f274c
SHA512953f4c5c8a020090955cc7e3a1e9130d4216b73ce3638b47cd395395bb97078467861f9430559acb0af8f16605f1b7d213c361b2334704c6b66c00c17c64c757
-
Filesize
5.2MB
MD547b77c2b56542573e63646af7d319bee
SHA1a69e5b2236753cbe7dfd7acd50337ab2aad690c5
SHA2566bcbfd9deef5d5e3a607918fa978a5d048c30ae380fff073754eba9ba79784bc
SHA51228dddf71630b634752400c0ceb59ad712f42f2b5e59c0ce9d7f81b502ca8540699a3d1944bee5dd8ef8c61dc455b19fbce4ba42c9af3acacf209d91b15ac9044
-
Filesize
5.2MB
MD569b848f0c9720c8472b788a2861f8450
SHA1abf4265eceaa469829ea12d3e7ae8d1b11b13ecb
SHA2561b2aef7b2a44923f5349e831c318e70635b558b8f3dfacbfcdfe999ab1f6aacf
SHA512bc730ae0991d40bf71776bcb9225c970b654963fc9fbe1b519a69880f00b7363224fdf6726a7674b6e1f5cc4b9cc7229d801b87e545fbcb13e1fb5127b525a3a
-
Filesize
5.2MB
MD5c12f8e186aecda0f07af7f5ca137562a
SHA14815e8ccd77bac47d890718fb59dd0ff6ecd9088
SHA256df172036bbd138427866ea75d1a648f33ef76ae6a2d62a7c4270bf68fbdd41aa
SHA512360eb300e4ee11410b9d13f705bfa8c19c8357f1a74c0a431a676823938ea95e02e6b059216caf5b02d3579d962bfeb4b08ef2c00202be98029e268b907693a0
-
Filesize
5.2MB
MD52ca4ea5d5e5c748ec1c2ed46adc4e83a
SHA156ac406bc475d9032cf2b9d01ca6190458fe4bb8
SHA2564fe29f6e86f0e265dbcce4ad7ab291c43b656541c994e3bd34eba546c9b468e8
SHA512bee63737b5320c7bbfe1724105fc38ab52302f833b91654708de32213d733abb437d79705100a69b3ab9ec0e9f41e5f524f6d0670969505d89d3d9d1e6009622
-
Filesize
5.2MB
MD50c60034e6a8e7f512830b8a5060dd64f
SHA1761599cac5e590a2e7f1bf5a7fc0d9b31591759c
SHA25686578e7879c56fd6b3bdd77f0a2fa1f65cdb88e2eb09b6bcf3be75beaba8c289
SHA512459d4dfebb0b2851e4b4864f9ca65d71f39a04cc807a854b64bc52f936c471042f3f6c9389cd0ad857a7d28021be119055c1edecc3e8d624a39c534df084c67a
-
Filesize
5.2MB
MD586f83fe51723a5913c4b387c5042c948
SHA1ebfd74a92ccd7f19bac9dd1914321ce7107b4d5b
SHA2568f9c27c7703d6f6216b93d30ddfc4b7b47f93bfd2b62c483ed301fc748e5137b
SHA51223459902241f9f367c16daa009246f5f63eecaaf7b4ed04b4981f4f846b62438af0801bd2153503d4854d67a7312cdb628edf6bc757211abcee175085c85235d
-
Filesize
5.2MB
MD5ab95a34db8ad52ac36f21c5b02fddbe1
SHA13b7c2b2c2bb2c88e5a5e53fa6eda675055bebf31
SHA25623e72c187ecdbe7462650ffc34ad3aabfd51cf3d2267526137127ebbc52da217
SHA5127d60626727066f0b182acbccd1c3e9b170794a87c53b9578cc7cdb78887c342261ab453d3a5f8da2bd42d65b32cf487aa564ed5dd9b508027379eb78632d7eb4
-
Filesize
5.2MB
MD56107e59f019d8c26deefafe8855f3ea6
SHA1795eacf630e69daa71ad6c0c01674ec7f6a4fd70
SHA2560c65aa3423400ac81abc219416ea2c7fe8fa28137c87edcf950cbce698c02574
SHA512d43be09c5427a5d01116fa0c8bf55a20318b420c763d39def982eef9c06e0a1498a95e12e0b092608390d58569656b787dedd2388472bff3a500893d19154cc4
-
Filesize
5.2MB
MD53bb335f836df7e3d238fbb9400beb3a5
SHA16831cf8889eeeaa1ccc3221547d99b0681e38f42
SHA2562ea1a4b81b7c69f479711fbd2675a88fdf0c10928f30059049c787e8a2290f15
SHA512a1223864398e85193722a8ecf6a221b02219d5799a2258f4c9a6a7821dc7b1540e58652b14febc57d7df826276096c16ead9174e436ce69b78e5fcd538b8cc45
-
Filesize
5.2MB
MD5d3f961528b174568377bd030c9353c7a
SHA156df89adaf2919f99dcafb0905b9cf48122d9416
SHA256a13cbadfd5fdaa98cee4ac220f010fb7a5c93527ad2eb84fbcb5ca9d0fa53501
SHA512e72b459eaf527064879674f39ee10485e8de2d4d5adbaef19ec9802e770eaf7783f1197c624dcee2a4f3f8ec2d2b8f7bd87cdcf7e12651e794f759b8ad9fa93f
-
Filesize
5.2MB
MD54c2a0e794988007bb7522e83db3f76ba
SHA1502a770db95268059fd941b9d03f2886efe9079d
SHA2568f4ff46688122786f5bea96dd0fb1a8ea96f862cb38f82c2ae46e17cb332deb9
SHA512ccee578f3c463fc3f6c241f4f53ba5b4583be4d9ccde96ce0cac8d74c1bf7e28062b4db973ea796c718a2f790146b4436d59633bb08aef41dd99512d902d5f91
-
Filesize
5.2MB
MD5bcfe328dd841de2166e59994fc3b8430
SHA19204fcd1407f200131f1abfad835a687bdca337d
SHA256c6cc69b9b1748f628b2491701565b859e17fc17de8be335c6ca7e0b89752ca80
SHA512b4b58ff2cfda5101d4a832f1dc3d87b2e8f5bb0dcb2b50127927829adb5919faeb24c8b4054070aba3cb3cf8ea3007f1f110501571a3e6c67da770d9c1b5092b
-
Filesize
5.2MB
MD5b1a261fe56aadae714a6af610f395ce3
SHA162e9a88c1beceae1dfd732e23976676b411e4bbf
SHA256a68fd6699890510c01f49c54954d435a660e707d422ba9b4d35560d18cac9036
SHA512468da423ab76654dd137efdc30024f067f470e641175b4dffda52ee77ca385c66c030219a309c2cbff139b94691d208e7196312e6fc566ec7e9ab45add6f9e2f
-
Filesize
5.2MB
MD54b6a14bcd454eee8deb5b93da66f9455
SHA1038c815ff9e6ae593918ea7d98f31d0a294a38a4
SHA256d85d4744a55cbb5d8232b7e97d762553387421450e9116819bed09676c735212
SHA512316711519e3cc7357f8d8bddc060cdd5057d6c62a905a92999e7a761859e82ff35a8332887b2b7ea5607c317ba4d8b759247030e3363794473c9e8c8b6179422
-
Filesize
5.2MB
MD5195e7952e2abaa0abf80500c444da622
SHA19ae76373f54e8ded842c886bee54bd8cf826556a
SHA2560cf73fd0c8a0a48d9b766819d91c0bff7be83485d229b6423a889ae3e31811b0
SHA512cb84afbf7bc719986c51bebe97958839079902885a385f63568d28c6e2e37c3a99daa63c3f60e3079928ff4efe67c5480745f6eb1884f3b60e5a7af5618bd1e1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB