Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-12-2024 01:08
General
-
Target
2024-12-31_f58e63a004039d7d24bd664375d5c550_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f58e63a004039d7d24bd664375d5c550
-
SHA1
bd5925072c043eda2373ad32bd583a6a2e8e5ff7
-
SHA256
39d2e8d5e6d6b2024ab3f978a8d8e7f76a195a38085558cebba63d5f93bb1a9c
-
SHA512
b89147b7fad0fa4edb1411c3b2a9230da6c9511b30b6a5302c4c11ed16f6864bf04e619019c29161581a4385f16a2d1e6321e3ae4fca59b7d2e75aa422beca34
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_f58e63a004039d7d24bd664375d5c550_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_f58e63a004039d7d24bd664375d5c550_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UdYSEow.exeC:\Windows\System\UdYSEow.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\koKfAzR.exeC:\Windows\System\koKfAzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCpoFwp.exeC:\Windows\System\RCpoFwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWbZsXr.exeC:\Windows\System\fWbZsXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cOFQJSn.exeC:\Windows\System\cOFQJSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSTPoeT.exeC:\Windows\System\vSTPoeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jrqCoRN.exeC:\Windows\System\jrqCoRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ewbfych.exeC:\Windows\System\Ewbfych.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eZwHrjR.exeC:\Windows\System\eZwHrjR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUTQFVs.exeC:\Windows\System\RUTQFVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fXcCQgi.exeC:\Windows\System\fXcCQgi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MlDOoUt.exeC:\Windows\System\MlDOoUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERbKHhR.exeC:\Windows\System\ERbKHhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZVrVVo.exeC:\Windows\System\gZVrVVo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVmtcTh.exeC:\Windows\System\eVmtcTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cBMNsoX.exeC:\Windows\System\cBMNsoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzICBuH.exeC:\Windows\System\jzICBuH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZiIrzlM.exeC:\Windows\System\ZiIrzlM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etgCoxC.exeC:\Windows\System\etgCoxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZpOeoSt.exeC:\Windows\System\ZpOeoSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AjKJRZU.exeC:\Windows\System\AjKJRZU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57e9280388fb2ae3e147f9b250158c1d3
SHA195bd266c96dfbd36e4a35456c66b219107618f7b
SHA25682951ffcc3fa1c436aec0a29e05b88051d4a54cf3bc4ad0981282844454f68e3
SHA512c6f5a666c02ef500888dc3381626f5ef95f328368238936d16f97ed20f7759ea244c1cbcefa06d85f89a0a3a232e3762f3c16479eaf17c185bbcaad9627fd34f
-
Filesize
5.2MB
MD56741a47448d330089b52ba49cb1da609
SHA14c3ee0ca3ef7cc42366e4b32a5dbc092147bdbba
SHA256611c41e511a9ba2d24feb81644a62931e39c97ed1613aec9ff7b9e0a7b0bf8c5
SHA51241b715e64b32eb37bcfc21f85c7ad05961b20f8b0e22613c8b5deb4d412389affa0aba349be4f6711fbedeeb6d7ff1452a8f3a1bc0e8bb8c6f88958eb722163e
-
Filesize
5.2MB
MD52bd93b0228cdbe0cbd6534e03a4548cf
SHA1ac0fbd090c531296f12b72e60568545f384c7da2
SHA25685b85bc3a0bf45d727fe17ef7a9838ceb95094ba3820daad0d7ee50c39eae20b
SHA512be362fb7fafefcc20bdbb48b9c9aa17a4142cd0f36ce5c5439ded25fa1f2757849afe9f590dd73fe99344d3cfcc4dfc5474c9caa151d86e58c7d9a512408f10f
-
Filesize
5.2MB
MD5d7fab6c2611b12986603f3d58d5ecd46
SHA198cac5617aa45e409ea98f4266e1657c58b44958
SHA256632089fd06c21f12809ad9260413338a7eae603dac52250d011d390bc889c79e
SHA512e89460092e98a1866ac7d07f711b733f7c0b5ccec7a184fafd19bd234616a68a89ad104485183b622e09975f974f91673a3d44fc1224a45f061d7de50567a264
-
Filesize
5.2MB
MD5876756f072e3d1e48b6f46060dcd8b9c
SHA1f02f16a85d634c701c8cc0df0a27ebb32c608c34
SHA2562d790a1868b28a5a5fd807388ad212b7c6f3ca582784c1f60e87f487f356c948
SHA512cb677c456162bbef94f4ad7815cb221743428d9059017b31bfa0232413ea53a65d734556d51d28081cd1f72aed5ba8d57e6eb15a62b66dc28cd3c3a7cdfd5e86
-
Filesize
5.2MB
MD5df2be1fbd0c1581936d5e6c1d99f6bbb
SHA1a765420d28da0beafa16305ec9f5c869ce97c264
SHA256aad58e1a9067fb3a51dd7f9459e1c017151365fb3689232348f95c15a835b5ca
SHA512167bac08156e2834c7a4466cd5524a6dd14850725b84f840f6f0fe731b4246df0d2adbac1fd9d38ea7c98223a936530ce5b6026f9504ba0fdf948a3fadd59677
-
Filesize
5.2MB
MD57f2a8831cdbb6fd5b4292f01ae10b9ab
SHA1dc57d3e6031b0afb7ebcbbfc79061853007be12b
SHA25608c35a899c1e14b196c2f06995d42d9a2bcc0d373cfe19145c0c99381bc7ed77
SHA5127f3216d4ae4506581a63c31675e59807ac72b45cab710685bd9d6e76e42269d095aefaf58b03a13e61f21a85a87c884d56315026151c8fa992c309fe99d9bcbc
-
Filesize
5.2MB
MD504b07a5f2c72f64eac394a5d0513d7bf
SHA10b6dad613c042a38785b55c700a15a303f13efef
SHA256d9a077ba562c33848fe0aff2be7a4361a51974241db01ce6da6caf7469da3563
SHA512c95b912033de09442356a1d82a923c6a7cbe269f254bf35263ad676282c9df120f75e8930aea43e0aed1137faf2e9f55edbe207d80fcc9bb2ed170bc64c9dee5
-
Filesize
5.2MB
MD5b1d80f0bd3dc12f2a15c4b1300438782
SHA172e8c806724aef44901719a8e8667e43773dca81
SHA256f02d15be8abee04d67c78f17c5a90bbbd38705821d6c5bfff95b3bdd3c70db91
SHA512f40110f3876a1d4e7213909ac5f8132e5daca17dbf274e769272257dda13f1dd1d456ad98dc47fadebfbed2249deb321866c1afcc0d4bf20913950b61f232423
-
Filesize
5.2MB
MD5d648fc1e68f1822c45aef96340a5bfe4
SHA11d1fcd64ffff93e30a5475ab2686c050734eaf2e
SHA256e1d3d083ee66616983105bd69a9eed3f00b49739550ba0cf607ad44003a4ffb4
SHA512662e698a6c5418135b97455d95b8c105cedba5c3f7cb93cb60cc002ee27a0be20ea23c5e18fe3eb04df13728b2ccd5e8f7cbc085174f8be03653ff8c0b057254
-
Filesize
5.2MB
MD558a18a12d31b0f80fda8f14bb7168d44
SHA124193e2f632f9105cd5c7334ae63d18e6603d1e0
SHA256465e09bc02368741536126ec0f4462a1ae399a490b072cf3dc8bbe7afcf54781
SHA512378b782eb60e01229a2a303247516f032c1f1d7ab9b634e2ddb5ae7fa7a856330e6c1d7d35fec1b8b99385cd758048b956c17829d3496f771f32ed428fff2e7c
-
Filesize
5.2MB
MD5b14575dd3533049580df5e5142a5366a
SHA1aed6ff7bb8f2e55c6ed96fa8447acb39a1c4f6b5
SHA256bdcc065b762ebaeb623caea936677aeeb78ba541943c1d8398eace4c5bd71c43
SHA51252a29c65386ec79af6a94f9c311223b56c7e58369ba5329897c922b5bb7bd620674fbf3396c6e6cd3b02152dfc6f39a7438e96ae01f66637025a79f883a2c724
-
Filesize
5.2MB
MD584a5d240291faabf066348c8be67d077
SHA19ee4224f16086500ff2e03a4e750aaf3cd45ad42
SHA2560a1ee959f5f1e65b095fcb12b9dfdb791206770ae5f89d2533aaddf174c17997
SHA5126800b61a48afe70a163b309b9b6fcdf843c769f66e3ff9b96e250e203acfde09a0ab9a9b214203d86ae85dbbe3f66727c89c958befdeeaedb1e61f65a37e5c42
-
Filesize
5.2MB
MD59b9017f59bb64f0d6843f62eabcae73e
SHA193344b2812745cac4d90073047c158bb3174941c
SHA256fb3979dbc4a8ad323d8f02edb3a381718a09f9cefacdd3ef28df101ff32804b0
SHA512c76985b9b3326b2c817d3bc4b135b16eaa7032d56b6c27347b16895af93094b600fc5f0a6267e721b45ade7d8f95318b3e0a5923e92013f76e4818e865bf7680
-
Filesize
5.2MB
MD5bdfabc5c6c31d2a8fce7128c25d16d34
SHA1454ca463e81175e533a84d5f650002b092587cba
SHA2563d1a31ab789886854b3bcfb0a6fdbc16f8c28441e593585ae7b20a0257128698
SHA512f096c9ed5d43064815144b605cc6556c20e0580722c0ae389b0ddacdfacca573ab5bfbe5d6f92cf338ccc21ce92eafe1042f84877fe38c34eae02dc4feb70cc0
-
Filesize
5.2MB
MD5beef3e4a28489204bb3930eb9c88d3f8
SHA19744f1038f4125eabf508684a42f82fc52b29947
SHA256cfbd4650539a5646cac35c3da8b8e23aa03308657cfd61facb3dea0dc3c1068c
SHA512d9df97874b5b0d9ee5d7a57e5c576098575690653020b491a1d1e238e2447e87beb124644508af297efbaaf24368bbbbc0429890da83bcaa72661acb81632d2d
-
Filesize
5.2MB
MD5b14b6912e647164e2e5f485dd03b4f5e
SHA12ec3b0d9964ac21044bb535ecbf2edabe56a4005
SHA2563425212940184b68a6269ab4aeeff52e74be2e28f0778c4be2e80b5791a52150
SHA5125ff396c5377553c56997af92105f9f53d289e4cbff086aa8bea34489f9fa18522642821bb79fab66414a1db1652dea1e051336ed1761bc9c48a608b882082d87
-
Filesize
5.2MB
MD5d8e93006329e66d83befec85818e93c2
SHA1e2a3e418ae6fc2e87b7e0fc33f97c52d5a57422a
SHA25644c47b5e41403072ac85bae5652c11dba5694ba52d5fa93e7063af5504602ba0
SHA5126e15ebc3a8d7858629fcd3c6bca617ace0e9222ec5363ec3b0872d4557c5317c677193e61b6a2a1f52a8a573665fb555bee0a8c4b05fd37b3e674b48d535d653
-
Filesize
5.2MB
MD52fc0acbefae9142d76f3a705cb48ac0e
SHA1e96dc4b93c36ba34fb62d43fb1ea0aba875926dd
SHA2564dc8934ecf57ee0cb370f9adbfa488d1e9a4d0d0050a2f59007f83236d46c1ea
SHA51293f494ecd76efeac00991530a5f8b7a57f203527c35ed3c508dbefed7e4d51a2a0c004f6ba2befca66f94e35e415d067a6579d0fcb4ef95d9e986e3b28a10633
-
Filesize
5.2MB
MD517f8ae4131ee0bd7f7c1ddf74182fab2
SHA19acbbb456d1fa7d858484bb99ea0c393d1bef3e6
SHA256976e1dc17aa97f37095e6451e8845666136d4a0873c0937767be4576de43b33c
SHA512a540061a27227dd305160d0c7f2f16cb9f71432f52cc0599c2b11ef0513e1ec689ec73c4b6cd87b81a2ab15e561bad7cd8bdb6b628fd3506b3478502665f5eb6
-
Filesize
5.2MB
MD541049fb1cd7d6b7c3a27dbeae7ceda22
SHA1aaa7c777052278336c8305d98ed9e0ad7d6c17d0
SHA256c39bb9565b3cddde01bb133b70f5b20b3463323f5f9fa1b1fc329454d9342b5c
SHA512beeb9ab76fa2a586f33cd1cb4c24c5d80b1ca61dd90c86232eba2aee6049e65ff2d12e65302fef33dac525bd1f616c70a3e37e48dea5ce584e83ba927d484cb2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB