Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:03
General
-
Target
2024-12-31_c2679a8f7c782c9a3c86ce0f054d359d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c2679a8f7c782c9a3c86ce0f054d359d
-
SHA1
f35ffcceb73a651a43aa21fade171b2274eeee5f
-
SHA256
a547099d06df89e4ff16a9a7427d2d7217306eec385087534d9e5e68c719d341
-
SHA512
86efe86b182c653cdf26d6da752d98c4d2c75ab7c36fbfee46df83b5affde0ac2cc2fed5d42ba28dfbc41e0e782ce7aa7e26df10059217ead63715cef08318a9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_c2679a8f7c782c9a3c86ce0f054d359d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_c2679a8f7c782c9a3c86ce0f054d359d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LkKlAko.exeC:\Windows\System\LkKlAko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uVpaiSg.exeC:\Windows\System\uVpaiSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfCaPpq.exeC:\Windows\System\EfCaPpq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FAMTfQH.exeC:\Windows\System\FAMTfQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\siWVyGv.exeC:\Windows\System\siWVyGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sguBYvk.exeC:\Windows\System\sguBYvk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKDKGfp.exeC:\Windows\System\CKDKGfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\McxkDIA.exeC:\Windows\System\McxkDIA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEnRxNu.exeC:\Windows\System\yEnRxNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nFWbrCf.exeC:\Windows\System\nFWbrCf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFPVUFg.exeC:\Windows\System\eFPVUFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYDDDSq.exeC:\Windows\System\dYDDDSq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvdaOCw.exeC:\Windows\System\XvdaOCw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AhpffSQ.exeC:\Windows\System\AhpffSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTtyxNt.exeC:\Windows\System\HTtyxNt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olzluvn.exeC:\Windows\System\olzluvn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQvAFze.exeC:\Windows\System\TQvAFze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaMmTHr.exeC:\Windows\System\iaMmTHr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyZApnc.exeC:\Windows\System\OyZApnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TKpvvIf.exeC:\Windows\System\TKpvvIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\noZxKyN.exeC:\Windows\System\noZxKyN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56993e7de1486bf24ecc187e878f20124
SHA18e5608ef15c3aa0e3a334e50de4a3ae80184fd34
SHA2562b7a0a660a26adef05a1be31c02f5df30f6ff200ed7436e461aa7131c4cc5c40
SHA512457a01dd93162204306e008e2f0b44b0582e18e154a816719b862aeef39a7b0254ac5cc8822685cdc5a56ad9f365ee5a34c6634da38ec55ccc5ee25b5a9dbe0a
-
Filesize
5.2MB
MD58feb4980f9464f23f2343a5031205f47
SHA1051f30d496051f9dd58d49f88b0299311f818b78
SHA2563958f3a3cb64547c74b8f577c912519cb57cf5d425cdd6b0a29c8909c2907d29
SHA51231cf4a9605367360df2e74f418953ec890373ddd9c2063338b0b6da40e541fdabd4c1b6844c9d1180b00e2c0248cf281196aca9a647f56f2311a3e0a01267890
-
Filesize
5.2MB
MD5760ed930f3d349ba83f57737e069bf5a
SHA19fefeb703d4b48bf047a52e5c464635e8d5412a1
SHA2564cbbc0862c6dc54e458e35e9ca0cc2d48ea66609584057909513230b08bdcf2c
SHA512c2b791d2349cdfdd5db032fa5e1065fdc3d34e44b76eef4dfb82622095b6fb83b6c8d1f01b44dcc0499a8d5f0d17853f339f01daac39ca48ebb84237044ea441
-
Filesize
5.2MB
MD5ba5dd9a70bd74a3277a71bd88d586800
SHA124c3be91cd765dec7fbd5f4a4bf4f6835c2e5b42
SHA2569993f6a9a9ae9e2e3c0cee5c1cdbccbbc7083dba685ac6be07a1cd2fabc6ef08
SHA512c19553964905c312a164eb821cd6dcc836c7facbe1929cd852dc46901a41566c1d58082dfedfe4cbf793098853afe7cab622bafac89d09e16b20c85fde75ee47
-
Filesize
5.2MB
MD5a20780d01ce9b35dd7169e31fce6981f
SHA136f2e464b54da7e7a9b3a56477cfb23bce996a18
SHA25646eb4e7e690420906c7256086217c7d72bd9fbfc18efcf5c5d49407f579dddfa
SHA512e8d49be02b111d30ab68794a85e47bd73cf38dff088e8369d5ac9387b57ff382f5485db573766e0e702a818fb2df291bd2bb7384514e87e78cc72e852980cf13
-
Filesize
5.2MB
MD5269c1a192341618be68c291d32a1661e
SHA15439fd233b832b4467a6c7f47d9c5f24a6402daa
SHA256a5f9111e8ecf5dcc991ff53b10b2d44d71c831b803d03e5859c2c80902eec0e7
SHA5125eccc5fd2a90c4d147fc2469d3368ad3e698b89560791de01f51a48a93d819abbd06cc46dc4cea520676f67b7d968db26936035a265ee38ed3cf46f075fce1e9
-
Filesize
5.2MB
MD51c22199bcaad213eb24bcd00ded41170
SHA1969e78cbd0e0be4bc62870f52315f96c74a76547
SHA2566178ef6db51c61ffe521f51673409078ceca0227b43781b870f9569f18df03b1
SHA5126092b8bebcbe034413d70e6d77270b4d92986951b5e9f89ab7f80c14b16ae868935fc6b1d2e632038d9e5449b6a1ce7411c91250a47f249ce6d33640ec56838d
-
Filesize
5.2MB
MD535f6812144da8caa71235608ce3b7c2e
SHA1dcebee0c12c1080c3b954ac06e1f6f9f2cc366aa
SHA256a036c708e9149268bb9f6509ce8922095d342f631d785a936c965676a87338b3
SHA5123aedc78539b6a79f2e5ef060c3f69a5441d24748bb8eb6175cb820e529d9c3556759583317eb94295f96db881262dd2e8c606d616fa12ee3c5fea6e10937d32d
-
Filesize
5.2MB
MD510de816a1366307a65099ae01b855947
SHA1ff6e23c343397ddcf1cc972beb5614dcf8dd3a14
SHA256599630298da2418b58d48b938edfe4c1c610089de5da4e33ceca849329191ff2
SHA5129499826829cef2d321185c37b27dada3074d1cc18a8aa15765bc0b6976125466c9937ce3ca21a34d533594f3e5035339a43a6984c8f985596a3b7723e5473869
-
Filesize
5.2MB
MD590a4b8f8638cd0040e8032927c1c8909
SHA164b41df1b8219df651105df9bdb4354ac08264e2
SHA256ebb5a269ed51e993497f0d119b0eeebd20c262e729eacb25bb643cc4a33f8862
SHA51270b7aad0dd2e0b47882a6a7ff90e2e65fa789125c6ef6cb2cb5468c9a84436550573b50bbbdc4646e390961c42794e01073b1686a4f05ca2ed8ec2b00df2c947
-
Filesize
5.2MB
MD57e0001f17fe67b6bd6849c6825930e92
SHA1c606e2b939c8b870458a94dd275006dda60daf92
SHA2566e68da4c5e89ac09acdae4e7eea556ccfcbe15281325cd61f3720c798eb9520d
SHA51273b6c2d78099b2eea3fb598d643abb9347d3b9e26e4ce9705d4024340ae459c15015138d09cde48007c023b5e12e84d4c781f516b4edd39fa2d29becbe1640c7
-
Filesize
5.2MB
MD5c97790324b46a1d0e687ab032f420646
SHA1c5a438c5e039c7bad79cabd3f3cabaca3c109e6d
SHA25604fc855adaeccc1c0faa6f30b2ac1e77d3fed5ce997aa92056212fc634a27d33
SHA5123bc5553bb0c69891ad12dc09833f3805114fb8823a5bd5e9cdbe48db18e189d320a8c2997705e5ed5d77ecda1a67255a45c31602cbf02517117771c45160c521
-
Filesize
5.2MB
MD5981be027a0e91cb37494bbd6a03d51f9
SHA1cd476b7fcb1b93de124a96933db41fce5f88ab66
SHA25673a04d60d9a597d76adcd205b75275235e5cf93823c969d92d62bf58328ba586
SHA512940defc82010313859f86c4fc2edacb9cafba2d094c7912828260b4ab47b0e86bb489e9674fcbbbfdc139a4c09b35128b3eca721bba1eb46eb9a8427d3f69db3
-
Filesize
5.2MB
MD5f6d0a4f5080ff22e72f71a6f05fd865a
SHA1e8b2e39fb1e27b236542c4171f3c3589e1732312
SHA25647c2766e127faae02a6c26068ed706988306799f2ca3e95b056daf6d7de20bdf
SHA512e7530e629d43de75f028f6b90cafa98d6fe090dd69c4bb90147812883c30a96b4876aa77de5c33b38be4966e513460bdcc7ee824f8cbf8675b9c3ac3d4b93bd0
-
Filesize
5.2MB
MD5d8513ab3800c0f2157a2dd73823df25f
SHA19adca4e9504e92b584f0963aaeecb90900be1758
SHA2567d34760d83f231130a43576d3c151e491406b7cc1f403a8e41c172a67a460573
SHA5124d393e3c66c69ce95048ad5e73a1e44b6dae6dcc0b1e67204c5bc735dcec91cdb10ec2b8a31f15cfc0606f7c769b414af27fc268801edad3573e35ca08063875
-
Filesize
5.2MB
MD56389fa3abb9620bb061e1e3b524c3d2b
SHA17e8259cbcb81e0feb8e03e80f0045f1159b132f2
SHA256dd918d0c0ff50769b1360e10ce82cffd44435f8757c1cffdfc7d1e120974bfcd
SHA5125924508918ebd8d66eca209a38043b7cb470b0cbffa2d19c3bc45e8aa8d594b69f690a3a3442836a1869124a80aaba8afc9b3005fd9dcf923415cdd450fd4f78
-
Filesize
5.2MB
MD500ee578487d77cbcd6a2a1dd4f657fd3
SHA1aac81fbd54cb22ce0dffb8d17b6efabdb9206c2d
SHA256275cd71a4b775a4c17b0582426f7dd19c9e07f76f18104ae6e940cc7111f8a42
SHA5128b876a33b204d1450d37449ea60862cfe6b7dea2359264d3df4a5ec78eab408b7d987abbd3810917408f1cecf23e96b0f05a1115fe25a22f40fe53cae1c316ab
-
Filesize
5.2MB
MD5d90b06e17b9f4a2d3430cd2823bbf3ab
SHA132290060c47c1d1b5e5e89f049bdcd25ae37c27c
SHA2560e7895f542609ef21ebf28d4a14cbff2f6c0a7716314a5596dcdfad7c1f2fe11
SHA51216aaf14c7c1509feed6f8b8c14b133e57c6d0ef3838a92093088eb278180de7884a9f8b4dc4fa240aa1a9d9009716cd0dca99571700cf272360538f14d1c183c
-
Filesize
5.2MB
MD5d9a1bb56cf463a2820e8db10f60da30a
SHA1376f43e1d7497bf80122bc02c5e8a02ea36ffde1
SHA25618ccedd1358d476af107861e6c620fc400edc34191f000bcd187a5ce7e8b3ff3
SHA5122bdc2037ee626240aacea653c3497353fba0a582862a1b12cf63eb878f6187ec0a6f96d86ddf3b6e6021633bf9b297dacaa395d697e9afcc3d71893a308d2808
-
Filesize
5.2MB
MD563c34308185f1240f50990c388b5949b
SHA1495834db7e0eb8bebc57f80858b6f270ac1fd435
SHA256c4f653eb0fe76a884c037f76b364d5e73300e91b2500e382ace9e14dbce00fdf
SHA51236820de93356b7bad01cd4ffa0b9fb7e5133a1afdce03bc73950a7338ea732318317f1b516795c618e62170c80f0aca5f8449aa81cb8fd30e2122ca76ccf0418
-
Filesize
5.2MB
MD5d19c8a50107c86a7891abc423a4603f3
SHA1c629b2d22621d3d197006a50f61812f6a2cdcbe8
SHA2564f79cd0f6f35f470fc506b38c9b7677e9dc52c74ae9d1a434043e9fa1f461b23
SHA512078c921743a4c4d05ae5386153bd207fcae597cba2b420bfdbe4c685a0ebccf889f5638bab094fd6dad43017929a3bb726260185d2379b68927ff86204cf2c07
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB