Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:06
General
-
Target
2024-12-31_dd67aae1da2d0aeab2832cac12b84807_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
dd67aae1da2d0aeab2832cac12b84807
-
SHA1
25860fad1dbc75d4463b7b67ea5ccb9cf237fe46
-
SHA256
fdfbdd1d76e82b2685e489d9e67858032df1c38b85fbda6e33b5be56830409bc
-
SHA512
9803d81183e13e3b9fff27fe0c46c4b54b2ac0a37cecebb34c62721def75c35d92cd776baf8d238708440fdf208c0352c13c8b809804ecbb22995015fcdeb4f7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_dd67aae1da2d0aeab2832cac12b84807_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_dd67aae1da2d0aeab2832cac12b84807_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IBHrhqO.exeC:\Windows\System\IBHrhqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kENYTII.exeC:\Windows\System\kENYTII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AjlbNjE.exeC:\Windows\System\AjlbNjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJMwdLA.exeC:\Windows\System\BJMwdLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZFVBidG.exeC:\Windows\System\ZFVBidG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CaNOJnQ.exeC:\Windows\System\CaNOJnQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOUqSDJ.exeC:\Windows\System\lOUqSDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ESnqhBz.exeC:\Windows\System\ESnqhBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WIytspI.exeC:\Windows\System\WIytspI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfoMOyx.exeC:\Windows\System\zfoMOyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsmEuvc.exeC:\Windows\System\WsmEuvc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPpkTGz.exeC:\Windows\System\NPpkTGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGdxtEy.exeC:\Windows\System\TGdxtEy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ySKRuLf.exeC:\Windows\System\ySKRuLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DznMTRc.exeC:\Windows\System\DznMTRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCrlfFa.exeC:\Windows\System\LCrlfFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPlubsv.exeC:\Windows\System\GPlubsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUAKeSU.exeC:\Windows\System\fUAKeSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWaFJCy.exeC:\Windows\System\DWaFJCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJJsgwD.exeC:\Windows\System\HJJsgwD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\thkrxDs.exeC:\Windows\System\thkrxDs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f9f07f255ba85ab17c51d22f44ffacd1
SHA1b5b50e71d598cf15c7480ddc77480422cb76129c
SHA2560ecc07e11ac1570f390520abd902671364a21cf11aa81d4f6d09f81a3e297c3d
SHA512b50b2683053a68eab991a076aee4216833715e9b7ef66c6e47c8a0bd90b087f89a8c0bc52a32f42d4199a46bc49be8501e1be5411a94e319fda808d98e1d9916
-
Filesize
5.2MB
MD5f216a5cd6761b70ce7c8e3c18d131352
SHA1cae718f040e91f92305535b15087016f6f2d3e2f
SHA256d7f33498bbb2135fb0a876f92b351945e923876a0d5b64c162a79727ce2aade5
SHA5129699770adc2d3daa04071f64bc4d8f7f2cc265871cdebdaa4ae3a11e54261ff810a46fc3f44a72f1713c6568777d061a8e80b44ff76e78162385e56a0fadacce
-
Filesize
5.2MB
MD5e0a83e22c17e2527311bfebc82040abf
SHA17f1417f839a824d8e8c787239d5c66f63f668c8d
SHA256c062dbfaa80ac09402bab6be07b9961b505d5135d8885df3233c7606df24926e
SHA5122b1d25e19795effff3b1ceba8efa109886cf79bc82181d320c833584476526db2e8570184dbcb7ac361b9e4be3470df669782c290b8f82e6aa40cf3908ff132a
-
Filesize
5.2MB
MD5b0c10270c3c34c198eee1c6c24c113f4
SHA150581860e29af911370c18397d21fd300833f97f
SHA256241a547ec701fa67569ef8cfd98ce6f9c9c0718e8a55a4ecdeb46aff85639c49
SHA512b4da9cde760048d2e248556d7be2aa8d26ec2560f4fd84ab42a4ee80ab36dd6393c959cc6f0cdb7794397334c27ecb878554b94b9bbdab13913320e21aa04c52
-
Filesize
5.2MB
MD567a3a22a92eeb4f3d1560b816493d71e
SHA1b6875dcf755f1d48e41ab56bd6a5b34cfd155235
SHA2569b975d43c01d859ab67b71149604c60b5c932659bf9054963cacb3cd8513d209
SHA512f1d3e58d7188137dd2fe92297fa981b377c5ca1b07931aa8e346e4ed3e7d833cd306c981018c9c96ba59e864d500f12307bc0d4ffccbec2ef07727452a11b2cb
-
Filesize
5.2MB
MD58272e38a360ee04387608065900a11fe
SHA19cfd2f9c4e686cd948dcbcf02b4e399092f27985
SHA2566cf9c021ced7497b29d21f836ce7b0b091806e4ff21475259006b50d675b6eeb
SHA512e7a905fa0e165dc31baa76cf9306b3d27d5eb532e32f354431f091984b3312fccd5d2c9fe9935eb1e424d4c03b2968a62c5c540eef56b30dd7ab9672670ae8fd
-
Filesize
5.2MB
MD5a21cd710fd838154588849ec42d82911
SHA1e55ef52cf1fc2de57bbb158a9e77c6ca8fddbe0c
SHA256a88934b40675379722f0c432f3971d9f6a61323b7efa328ae765631fbe2edf71
SHA512fadc7a3f5d63288fe81deb2ad19b660acc9d1f01a2f5464c8385bdf159f7710fef58565d477c606d752ec687d76b5248df48c19ab69c9324dcbd81abc541dd31
-
Filesize
5.2MB
MD518c9f75336495dc39709e990c6e61ca0
SHA1e952d9207b426183df1db23111e78c351945c34c
SHA256b5c5caa5cdf6ff79f1aa87071b9cc64a69859fed758f144ccda74546249164d2
SHA5126e7385b1485607887d99b1fce0cebd0f357dc29c0a5f4c50af60a4ff774cc6b44ee3482699e527b8d4554f288d31a1ec22b4c1db78a5e49f5b77ff047a813b8c
-
Filesize
5.2MB
MD545c01bc0af5033e1b23b8823b0746999
SHA1917b6f02562da684a958221f792cefe4e6b6e2dc
SHA256334b1da201449c893cd1f3ba2f667a8cab24ad29a774477f273d1141dcf073e3
SHA5128449e6ee592bd6801cd4fcc22151a244d6840c64dd06bb1514337af4735239d4197380349433a7afaab5b9dd2d850ead4b4249507662edee4e353fd779a65a5b
-
Filesize
5.2MB
MD5c449c090c185ca150926d23d6756de82
SHA1bbc0a4f58502335d9a9cfcabec9115a80f8e62e2
SHA25675ac7ada1238a55aa2a5995ffa060a67242eb39f58ab394ebd9b8099d31113f7
SHA51280d9fbf3f182cc8700c4145e7464d76427f9300da824d908342a48306acb45f374ff76cb0477c3b54ebb0341a8af3c5e919fb5fa554b086d4265d78e75186180
-
Filesize
5.2MB
MD59a86b96ad134e43ba456a504c7ebf2a9
SHA1c823011c6a1f50cc0138d8fd513b2f01e1b63cde
SHA256cd950934289e509e5e2b40f9fd2ba16e9f59857534e277deea049f978d6c317f
SHA512467a96be6fd2d3935f71cafdd0e51bae0eaa38360f247a632948dfdf3846c03e65f952ced3cce7192b1401e52a2d73c007bdb762231022875f6f72e9d0504cc4
-
Filesize
5.2MB
MD5af7e145f315f61e9cb3e25e2eb05191c
SHA1cd6b6f0eacabbcf270414d9c66e4fe8df469fee0
SHA256493ee7a328ee7539cfd825520c1af0e5e25bf3dfa70b67e29518c5d6aa393bfb
SHA512c417da9edf0dd18afaf875bbdca21fec8076831d576027b8d324528a55ea8fabe6d1582aa5d39e0da7050a6e810291f8d90392f6da90fbb9826c80bb9ec28ce7
-
Filesize
5.2MB
MD5980fddb4c046c8abbd93752577f6df0a
SHA17c5e589e76bd96bcc2d69a448800d28c7a019fc6
SHA2569843abf50e016e9af88a39885cba16159cf625cd7edc556b2f5bb2d4f0ccc31d
SHA5123a6f3bd29e8459ca9c3fb3a699edd9afb73719a456f5fca69df0bda5de66be55c8c6b8cc67a3bd453bde5e7ef2064f16fbd1bb8aa62e0f0c22766d1294da059c
-
Filesize
5.2MB
MD52c66aa7393f262e948dbf57b3a8c300b
SHA121d6143ac805567696ea7f8e2e5c46c6f1b070fd
SHA2563604f70a05fe19021a1f642d2693a65c523ba3e0d2b2665579e80bffbeb1844b
SHA512df2df58b46948c65be4d93d6797f19e3efc5a93823f6f3155f1fca04525ae24019cd4258adac10941c93c4a63bd4028e13f881c3f308830fcbd8aee7dff68397
-
Filesize
5.2MB
MD5dd3fa39ac42bb26b6f31475970ce6f6c
SHA17d030fd5ba946700b25159d4a1e1a345b798062d
SHA25663c86ee2f8606797ee55991d2032c66a4bedc1ca07ecb8210a77f4ad797d3d28
SHA512434af446c3b387704e4b4f2403e13d644e7701d992ed82f09c643a48bdaa6f320668a86eb86356e2beff022e3e36b9a259c25e986dabc5f0a3c60caff4a41012
-
Filesize
5.2MB
MD5d37fba0ee301e32282adcfbddf75b8a3
SHA16deaf595162a34891ee69926bdf09ac1513b0307
SHA256f8e50a68482b6993c3bdaf12e2756e36b4b4820f05df0c6c41719a2dae7ed373
SHA51272565e7ccef6772574dabb6478e32c2fd2136e53370ff29a1da087ec8e4c83330e1b9102fe991f56ccbcde4c0b0e725a28a44eb0dcfd6e593f527722bc9c45c0
-
Filesize
5.2MB
MD51b0cdccc9388be86575369b2ddcd43d7
SHA149f34f4ddf83ae13265f5c5a90476893225506f8
SHA25642d16d41f455180aa0891b1df3888b39bec40789c5bbfdf031c4d864a4c3add9
SHA512841c811fcd3f3fdf139dd7ad2fa3112bc0b5237d366707c0fdcb54b169cdaf1f2209722e7be9adcb0a6737959c52c4d3218a684c41b487e2cd9ab316e889b610
-
Filesize
5.2MB
MD5a5386007ee503b44cf1de7c6347f229a
SHA14efbc1d5b0aeacfcc6c6a518adc82ca99d8cf475
SHA2568ceab297dbdd01caf1a84f510ce6b31188fadf7e927b1c21fc86c2ebbf920e96
SHA512b44d86a25e00c23c142ebe42dc07d14d374aaaa6d8b2e5d6bdc483d700fb525e1d473ce0becfe1c74102b790e547110c0e25549b8bc8dacd06900817778eeac6
-
Filesize
5.2MB
MD5a536a6218e9ea4683b4077e05b53dbd9
SHA1d859922fd0b9f03acd4a5a9a9291c02f4a91aa9e
SHA256028b5ddc39d8cbff7fcc3bfb7fff479dbb95fa584d5579812a5cc1f0452f2438
SHA51276de6d2347564fdd3b227ba57fd6e11fd9a1ee6edc9c7b3b71c77e6ed65fd266156ad7584a41d86391d85b95222a50ceec27d6c26d7810b1d0af1e51b903ac67
-
Filesize
5.2MB
MD509f534da2ff611cf2c627090d1dc7fda
SHA186392b0f395ef274b0e10a1039a801902f0fa153
SHA256dcb30abad2054e34e0dac51bcfd1ecfee1fe563bcffa99512bead8d1f7dbe49e
SHA512370ed719d83f87dfabfb5b38f5ebc3340064c3f2988fabcd1378fd0d1dbd35d9b189692b690faaf6e648be8a088b9ca6d6f2c1fccf28f22339fa56c0aef89cc2
-
Filesize
5.2MB
MD5e63ea1021e34b42272a847e6f1d87991
SHA1c0571c0d30de4296d92ab871683582827295dc14
SHA256ccb60b942a9d8a2e509df8f0ac2f8f01a17d960720c4f917712d715204dcdbcf
SHA5126a1ed5735fe81e2c197bfcf2418b849a36110028e3cc6c855f7813e8a664a499f0a9620dd204c1ea899ea557d55713dda14fc1ec6126e32980aa5c93438767c4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB