Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:03
General
-
Target
2024-12-31_ce538d1b99223d8314e0a30c29a9d501_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ce538d1b99223d8314e0a30c29a9d501
-
SHA1
df320819169ad039d86b87bd552ff596054dfc84
-
SHA256
5b39308d2d47e69304a1a2e2fc116aab2fd6d389022e578f73c0c8887f42a37a
-
SHA512
919199f8e08c3512d2956bbb1e18134cb0137430616e34d4d37ccac25881fcca9aa3d69567f5b17ed9c30dc217501a63edb888e08220d0f9d0d53f41f99fb896
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_ce538d1b99223d8314e0a30c29a9d501_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_ce538d1b99223d8314e0a30c29a9d501_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wwMdQxP.exeC:\Windows\System\wwMdQxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgYMOdo.exeC:\Windows\System\xgYMOdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYwzDGZ.exeC:\Windows\System\pYwzDGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZkFdyi.exeC:\Windows\System\NZkFdyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIZBeJo.exeC:\Windows\System\iIZBeJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RndairI.exeC:\Windows\System\RndairI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZrpqKcB.exeC:\Windows\System\ZrpqKcB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDvNAeA.exeC:\Windows\System\HDvNAeA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUulESy.exeC:\Windows\System\XUulESy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxtdFxE.exeC:\Windows\System\cxtdFxE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqFrFWe.exeC:\Windows\System\dqFrFWe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWCOega.exeC:\Windows\System\xWCOega.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRSgccK.exeC:\Windows\System\RRSgccK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpzOWHq.exeC:\Windows\System\jpzOWHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mNZEpIW.exeC:\Windows\System\mNZEpIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GXFwhsh.exeC:\Windows\System\GXFwhsh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iWrYcjf.exeC:\Windows\System\iWrYcjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRkHAAC.exeC:\Windows\System\RRkHAAC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMyEmKo.exeC:\Windows\System\dMyEmKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HbZYhlY.exeC:\Windows\System\HbZYhlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwXgAeG.exeC:\Windows\System\xwXgAeG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a1444c5f703bda0d6c307f218531d715
SHA1196dad2c0fc07fe19d7f19be4ff9d3e7bfd1d965
SHA25652e3c0da5e46b5340bfab8634d41c918ae9397a508252d6b4d6fc50a597150fd
SHA51261e72c420dcf43c75635cd7af0330158a2d54228ba22c8651a51ca93de57741116ca1e8232cbc8815a77be563779d5864e3f266e6e7aca64179281a0e507995b
-
Filesize
5.2MB
MD5bfc2892e018a46d4a1039bf8b782886c
SHA1f658d83a46191864049871f908a14f7d970ab391
SHA256568e280244754e9cb32c08154c5447cd8e85ca22393d194aafda225615258a74
SHA51229ec27a9f5caacfe40e709dbae230dd3162a0c963f0a746dadb20295d687b9ff3a771700b3f6da4c3560940ed2ca03ef088db747eae7c88cf51091e749882082
-
Filesize
5.2MB
MD52478d207173bb8054fe7acacab0199cb
SHA14b6f6e5c0c672d044216b85287cc7088a6d89d12
SHA2560ba521de7bd09281372e43a03e3c82d13fd4bd2633889ebd5a5525d9e4ca9a0e
SHA51247f62fec6a57be005e0da68c9095f0313b1a4c7ae8e8544fc6f0735e2c2cc326ca723c6776ae743409d8d16a1906a898e73c5d4536d3c5ae2e5f13362b1f9e0f
-
Filesize
5.2MB
MD55ce7c4a45fbae1d6ff1bc61013a93731
SHA1449a6f02ab65cea42c39e49c98e2dd2df56eee2b
SHA2567965f1f1f7cea68f8d8b55fbbe40ada5353757a47c2e093bfac31e1c263eb177
SHA51220336e11fb03ec0335ed48ff598620aa274322f214dfab5a7de9aa459064af5e91838474716c77a5278728e305d759a4707993f07fa69a9c0d5ba10eb2f2f325
-
Filesize
5.2MB
MD519acadb11ebbdc00fe4836b9a9aa2ded
SHA186704b8b3bf99c02a66df75a96447a5e14bffb95
SHA2561acc17ac0a4e763d1861e20f4a4c93a7a785b7a81d4dd920b34a87d86cf568d1
SHA512aa9784c0435374dd3f3179b7c2ca29201e9a7626910d313543250af53ea590b0f51d280dfbb0a10632927976d13db73499bc123ae34d5ea5ed01450e32d8ff8a
-
Filesize
5.2MB
MD598496752fabfa452d87f6c595ade2fb8
SHA167df05be1a8933fe3239e9eed61786ce3015927e
SHA256621328243b96f349e811b45db5ea69206547c34579389806cc53175fd2232384
SHA512045ef075e5ddc24479a2946970fe35d1e72731c7720dbb0b5dc6e43864990076abdf9092659c8b0c50f7597ad47ee14052b4bddb106261a1939c2622cd16ffee
-
Filesize
5.2MB
MD56cc8dea3b1c84c154eced3fea72a0ce7
SHA184d3178aa6ca8de45a55e3461d58e716a83b7303
SHA2566d80cf1ea48b99ecd102429ea09de026a8acc2fb66aff915fe73ed70207dfca4
SHA512072641a575893e16311dc64c8c9301d7bbeba8b3ee73086ec21e097b77425feb0a61a8cfc809479fbd605b1c37327f824f6d130361d0af01a7674dfeaf165274
-
Filesize
5.2MB
MD5dbcf802e487b9c1c453e07e226a2f09e
SHA16d7e17b1db62e72e283fd2a91fae15aca8f196a5
SHA2561d4c5cf85e67352d355ee7d880f377f2ee6bb7019d20bca4f420be56f6b5245c
SHA512e7378c01c019354ad56d1a1e6408691cee4db94192dfd6b537e813d7e2572c16465d8934fdb853316ea02dba474359ec8ad0c46727c012807c93a14642ec2a0b
-
Filesize
5.2MB
MD5462a44e4ef36a10d71e42adbb86a6112
SHA1ce4c85c2c3bb7fd757552b24ed361f20898e556b
SHA25672afee0cf6660f81342222c6bb17d54a6e6b8f2ceb402139937b1c2e94668c68
SHA512ef04da65a5f09ebc719ed7e5f96ac5d2b2b42616efe1a4a62084a70e15e98effb97078b80b60bd25c70153e3d1a2dacaacdd50d764c0a7c0e2d414c49b412464
-
Filesize
5.2MB
MD5fe3e2977debc7b853dc807c9bf50f658
SHA11015acb1785d98575ee7ef9d61bae435964d4987
SHA256ae02873042509f70c99a3d74557bfd0ff7dc0d294b060c39e172386e27761145
SHA51250376e5b58e6bc78b84e3b51e1a18a845b30003c580beb3ecf7ebd798230f255dcabef2fdee0d2b886fc0b50bcf52e860da62ee72aced0f18c40151263b284a4
-
Filesize
5.2MB
MD5651280f08f84c4b08b26401effc928f7
SHA12be2b9fddc6ea97a538b8b02088069c82e2f54e6
SHA2560fb98a74e10cde9a7c1e7afb7c71d7c13d7f45cd118c541abaa2564c977df9ce
SHA5129039a83438cdc9ebc2305f370e6617edceadd8115e7b43916371e79c5035c82a70e759fa0a31b5637f93be214f0950fe0e88fbe759a0ec853cb87674fbd9346b
-
Filesize
5.2MB
MD5ae34e8767be4303b3939479120882816
SHA17a5426a7fae9238c7dd330758934b63b30c26787
SHA2563784f69de43cd47e8b2a52e20fdb575fd1b713de7d9b3bf2e98cf2cd02b8bb5b
SHA51278a34aa544abdbb915cebb955fa53db32f669ca62559c38e9666ea8737e24d42153f19ddc1d114db8db9e58d7b87f8c603b0b112e8d76ca63997adfc79f92d7b
-
Filesize
5.2MB
MD522c88166f7d2a2ea73791f43a44bd0f7
SHA1859d0e6f5c2673d7445e1794c45c60686cbe7cbc
SHA256deac7261b92d3a7b9b9b85992d36732f30d701c2e6429ac9400d3be2e48c16b1
SHA5122daee26091a967cc0d0f5af9ed9b51401fb11f644c1bffd9ae46548136f7608dd6569bf523f1bd668b023309cb7fa4cb9a3dc1972cc001c6bfcd662b03eca980
-
Filesize
5.2MB
MD5a90c5d55bf74e7a5e45e714cec76bc60
SHA10c02ac385ac4ba2c7317af63ef223fccfbeb734f
SHA2567c96c57bc60dd88c9be086c496c513a0fb95aa59091244b2500466961acbfa15
SHA512ca71581ec4b42fe8ce70fc14ffd6c9ad95ecf0297e7212ebdf331a4ac9f438e5ebd9babc507509272c692abed3fd3dee4fd7ed5d67c34ef97a839bdeff15a25a
-
Filesize
5.2MB
MD527900c0f9fa22a1f2886a58fa9ed5ae0
SHA124a3f166f9114c28e6a8f7b2685bccc37a58ece9
SHA256b643433b5ded6bab3fc1e487e495a1a2d4bfd53ec7ac17ee45a48f27810df13e
SHA51282ae68279897153e673ac2eb7679cbc7bb85fd35b39e156a0492d9601b798b15e62dbca88c90d343ba298bce54ac09582d974d57fca7665d425b024ab683c477
-
Filesize
5.2MB
MD5fb13c64a57df319f524201926f09f326
SHA19a6cb8c79374012b0d2e70af1d2ab9209d5eb5b7
SHA256b88565b6755cd736dfa08d12ce5f2c15ca2ab37dfb45e16971f5a60c8413a116
SHA51245bca7ebf34c16fa8a347cdf5c3115da974863d234411ea48deaaf34e214729fc16d071ba8b419bf51e1b537f77e95099c5a1ebb08b3b13003c699b4ecc44923
-
Filesize
5.2MB
MD58cf3b18028c4443abe8e3603296c97e1
SHA175a794fdc3a06ec4cc1cb1bcbeea39c585814d8f
SHA256afd995565bd253caa86ab6fb8a6487c34b1aa82fabc9ec0159309e74b806315f
SHA5121e1c0b3c827f9580f37a0b9699a84b77acf55199be63190c5d2b60b7c5c00fa925aabf30157b516929c009caff14776966c36d49e6f1b2b664163a9adaaea606
-
Filesize
5.2MB
MD57e71a103833eb749047728ccceea5ac5
SHA1778cf86c528cc937fc4b8cf43d7424efa0a45f84
SHA25652f210729d48127669849416c6d90478f73a82ec4f4379926becb1fff51e614c
SHA512e8fd1aec725d8d01a82a7f0e0e391e5d6565ca1fec8933d41ba5b021c3d04a103b78de0fc183b632e68a34d30ae5c22b1b22820a37b15f08b2294cb928ec2960
-
Filesize
5.2MB
MD55d4a7be3808b04e94633710ca698071f
SHA157630cd42104b8506504a3acc8f29220a5329ccd
SHA2561fc57e5e127c9d4dbd1790291f216d51fac7695c4d41798d7c9d7c815f23e6e2
SHA5128d537a02431f6a17d8ef9632a080bb04e273ab0534096f8f31cb374ea9850cb39ebdd1eb451daf75ed8a535ded96195cfad263ec0c1e8c49a0140f1078c66b35
-
Filesize
5.2MB
MD5f388537b1b06b0d22b9d9dded16a20a3
SHA16dcf2bfebb7fab027345de5d04a9a498f3454e5e
SHA256fdf1f09b0ea61c69f501c4fbc17e967d1f7172eee4edbac937cc4cd5b84c7961
SHA512c52ba9a063db2076f618dcef92fff27ed82605aed6604d59e8ffdd2529f99c645e9534c64dc64b4187dd562b0c2f290b1308e7e03cb78d287a17da580122c4b3
-
Filesize
5.2MB
MD5aa61cc288712b44cca3a5d9e53a9a1a9
SHA1c8818185c18aee0aabdfa540ef3fab5aca263476
SHA256c5b9ac00b58e305411e304120c252f88195e98157b4e8158259f812e5f3296fc
SHA51214d5bbb3be2e40ed61d77ce01aeb05c69904548d82c19354729e45afaf2120af286ad34c3ad72d42549c6e57625229af62fe67e12310bf77918fe22e120379f9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB