Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-12-2024 15:43
General
-
Target
2024-12-08_34ba92dfd1bf7cc56bec10176786d921_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
34ba92dfd1bf7cc56bec10176786d921
-
SHA1
bef6c6ea6885761cb61a74e8bc3dd1af60d70d0e
-
SHA256
aa5646b61dfd06af4d64b1c0c18233eb660290b512dd6fbc2135b9989164ba12
-
SHA512
d250c48be33eb4320aea5b66eb0fd49bb5bcb7ad8e8643c3e3eae4b5c1f862edccf7821c7c98e437b97b07b0f25a35e73d22a9483c5f3be9085f22043fbf3dc8
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBib+56utgpPFotBER/mQ32lUn
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-08_34ba92dfd1bf7cc56bec10176786d921_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-08_34ba92dfd1bf7cc56bec10176786d921_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hrOiEuy.exeC:\Windows\System\hrOiEuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZCkiVgk.exeC:\Windows\System\ZCkiVgk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IvrolzF.exeC:\Windows\System\IvrolzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auARZYm.exeC:\Windows\System\auARZYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKWIXmc.exeC:\Windows\System\CKWIXmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWgDopn.exeC:\Windows\System\fWgDopn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aogGnmP.exeC:\Windows\System\aogGnmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jiFMVEn.exeC:\Windows\System\jiFMVEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emgZbik.exeC:\Windows\System\emgZbik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgthvCW.exeC:\Windows\System\GgthvCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbJTFLJ.exeC:\Windows\System\pbJTFLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sBeRVEX.exeC:\Windows\System\sBeRVEX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Nxwdqyd.exeC:\Windows\System\Nxwdqyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\erRfHSi.exeC:\Windows\System\erRfHSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kRApTup.exeC:\Windows\System\kRApTup.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lscVrnf.exeC:\Windows\System\lscVrnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIiGQzV.exeC:\Windows\System\NIiGQzV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GeKkEew.exeC:\Windows\System\GeKkEew.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHrRBOo.exeC:\Windows\System\PHrRBOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARTcqqi.exeC:\Windows\System\ARTcqqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdWkJHJ.exeC:\Windows\System\cdWkJHJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d3af108a8828b095fb43c2eb8ba0ed5d
SHA17b5f7e2ff51fd3cf62d6de8433a8929f174acaab
SHA25612469442e3ad83ba1bb175e6c63e0fa3711db044dc39a5511d83f6e2116faf18
SHA512bfab723c9a39c3bcf2a0029f45bf92ef2ad82530f2da128b115a477d9772bd252f44fcbee069a2ae1c9036bb90fc20afa8c34bae22c6dc409f4c185c12b20189
-
Filesize
5.2MB
MD52c108f0c14f7671de3d486ea9b76cae1
SHA13878c97517a664408665c087f2121d6b973a1ced
SHA256eb60edf2fe95d6a2e5f316941334078ac8d504a9cefa99f4bfc4fb41d80a89c8
SHA512a1ccabbd730e8659e936f4da9d129d25436c49b6586109fb23b7d1d97784a25d78851312aade551096f8361bfe8bddb044e1c4d2f84babde652f753080def2e6
-
Filesize
5.2MB
MD5623929e7801d48b65693c74481891e4f
SHA1de5337c303e472b89ef547fd53864f07759ff6cf
SHA256faa0dc682de71f82ae080a4883516f007405dd7e7c3fac795d95adc9f06d490c
SHA5121fb2bce4e6bdbb5f340bb9529e5dff9a7a7d2484d954831b9bddeb29767136ecc963f4157130baee0d60cee3ed6f12cbd3a9de9a89d8423c9b457fe197ccdded
-
Filesize
5.2MB
MD55db7b5076a5e5e01cf1a757178c9d119
SHA149c1028f5263492d5d31ba45b14a1ae811617dc1
SHA256fde7f48bc120909882054785cabf2908f45f4fcea5cb8006355d333d7be75048
SHA512e7e259d12304927a94af9372d1ac602ec850d0893afed70352b288161c67ee517908c817345c38522c0e2bc620aff0ad78d5b1080f681c86f1a230a809b93d18
-
Filesize
5.2MB
MD5d6889020a034d70e2c50dd3f8c79aedf
SHA118d2bdcc6a79a98702a9937005db575a929f9506
SHA2560522697688afe7b5f7a0fb991557a8b8b7e7630c57f119dd736c5b818bd24898
SHA512e37adb3d329d40bc162bf7d4cc1b1f84ce7af9e5f02acff0038757f7117249fafe990b3ed2005cb6157036e2dc24cf127d9654b65388a884d2e10ed08edad0d4
-
Filesize
5.2MB
MD521da56eaa77b806eea1c8d2995beac70
SHA1d2d055a8a19257f6a2e0b895585bf911671126fd
SHA2564a51c29897a2fb5d84b2a7d25a5b12a4af42d4fde85fe46df617cc69bffd55c0
SHA5120f4f8a45e2ace738991535ee1e252de7abbe5bf6ae0bb9870520e2f759db6f66d9777ac22786c16edfcf805b8a96f9b480b24258e5111171becece779c9dfad2
-
Filesize
5.2MB
MD5e0e403754a780bb306eae706b7a47b01
SHA1b4d1ddfaf9bb33289329e7c355774b0cfc594a34
SHA2562bcf27792935f437d687eae9512502caf73e346c4ab08cc1ebe9d27ec254e282
SHA512e0390b1402f6d279304bfa05cccb58bb1048fce3c01b51b06f013eca93e4556c0b6f981745bc2362cfe03ce6bacd050ccc1d8e24745401d24c1a20eb42b47c09
-
Filesize
5.2MB
MD574d613ccc5de950dcc7b9dd7b82ae361
SHA120aed23c1dd19f7487e0e82f71fe45a3077cc080
SHA256b745f222f518085a15eae6d77c61cce52dadbda5cb108b182285134f188e268a
SHA51231f33b61f8fe87b539a5fc11202212d66ec86d895cc4731d7b02fe57bacfd60401ab5268d60451bdd38e6af9b267a9c7c48e55345ce4cc1453ded8ce080ceabb
-
Filesize
5.2MB
MD5eedb5d1ef08a944b2621f60afb73a797
SHA11fdc70d728a071552262289639d99a3b7fa2bd35
SHA256f2232166482562c851c68907f4b34f7e2c8ca307873ad759b55d8df4be8204ce
SHA512ca0fbd7d4ba931971ee4c7811bb02878aa8d2638d5b7d91a66148ccd5be8bbe88be8a892b4ee7c10d453ae3e50943424429cf7cb469aad1478b7f9a4d3d6d038
-
Filesize
5.2MB
MD57761b0cbee3dc7adde5d8d9606ebe24d
SHA13c679b0d9527b2de5b2020d99833d5ce39ff8c02
SHA256c0ba972bfc3d940c1f65a5b7745688a900306f33d406367f3f658f59448c92d2
SHA5128121cf46813f862263804645114e5e4bebafc8d790db01750298477524f55e9031e6404e76303e72562a9560ad1212f0d7eb0422fb9e2c4f349ee42fe1af21e3
-
Filesize
5.2MB
MD525c82391d7502014641a962f73159d41
SHA18d3c6f5f53e115f3faa622c1397390d92efe6e63
SHA25678e21743469071bc78494e575f988ec2db59b4c04877e1314bb0414081f09c0f
SHA512cbffe842bf5348e26a2856a4f59d828776152b67563888f74e38041e94a4a3d927791eb84061ecc0b44649fd7616c01be5ef035123aaee6ddfaff27f7c2530b9
-
Filesize
5.2MB
MD51de028b1fee0126abfb50ea62b62d303
SHA1d7e1663d7238e1e16ec7bfb6ca9f0185141d438e
SHA256cf61ba92c9417d3160a9cc108dc2d507a94ced8368b3383f9d5160d93fb444fa
SHA51297890bb534e4bcae63eb784c5cf88555a3a2c7502261e48f0b51e0ac148dfc7b7cbce7f36c9f22c3ae0046861bfc7373236fecf3359b77a49a0cd567f335d1c2
-
Filesize
5.2MB
MD5368fa1f6074d6c790562c57f002fff5d
SHA1633c5d6d86c892fe5f4ea39bd40ad68269979a05
SHA256ce38dec681ec220702b6e35e96e4f38d00fa5d2733a58d6591c2ec5eaf3d4530
SHA512ad13ec840476e1592196c96e0bc999c215349946749817c44c16bc32f018575e067b15b948bc72b0bc306d0f7872b02ebf0f3fd6dc176debbc7be6f53148f54c
-
Filesize
5.2MB
MD5dedb8e69e9364bd2dfc6d225cc485ba8
SHA1a479b54c4467a8900c206ddcaa77940175b8186b
SHA25675e56b870673d321a2c6d9d5179bdecc2da63f258bda745025700deea5385a78
SHA51234210a4ad25047b18c7dfc5b66a920a835fc3c18dff2853b7e50392ef765ed8373d007477d097bf172f3c32370ba93d7f18d0b80d0cf957703ae42fc1be522f7
-
Filesize
5.2MB
MD58229c23130dce718156fd273e66f2329
SHA1ad0b23aafa51c00d9b72266177cbfaaee931427f
SHA25609ab1205c40a4cc8aefc19db8ba8875bd3942f977d04e72f5c08361edea10a47
SHA51223cc18b59cc4cda6594f864828dc62aca507ea065de7874b9584b193ff6abb1bfbc8fad397541afa33560024de5596432498385a980d978197f66f353ed4d23d
-
Filesize
5.2MB
MD5c567aa9b8df1940256e6ec4263449257
SHA193f46c07884196da24b9af3691d9a491dc05feb3
SHA256d05bcd4d28b63f531f375d568328434a4b2856c01d6ba297f71d53c6e331c975
SHA512bcc3cd5a10601ef774b374dc923656cfb5111044a1c271c14349952145c5f6590edf9213a8cf9dafe7ca6b556a94ddc5cd61284b04d3e2e4f8c8e73a076bebd6
-
Filesize
5.2MB
MD5b7f3492536268a5a22b7b46798f0a328
SHA1b2cdba5bd232b976ae516fb6791736bc063a0c55
SHA256f7835addf7a21e2afe5739389425e6687725350221713e222d62e34ad71100fa
SHA5123c7d8698b68c719c1e861320a0d92c69cbd498eb9f7c550dd8f5e708f78ea728700ac6a29e2fc3d4c95613d9f77217b440de760562cc07b59f49b592fac0dbde
-
Filesize
5.2MB
MD5f0eea69a77b5d95cd0e16c8e819cf11c
SHA16b71acb005d9974e26ea782107a6988d2b8b84e8
SHA256b13fdb96b82b42710b1b4bf9e9e48433439a0ad7c312a6b59a17dbbe24cf2c11
SHA512cf1733006a6ace0a7600aaec624be24bc72b7861e3e9ddfa0772e2c0b7f70d3c5f915cb162e672de8a32a6783bf579f2092ebd78800deef4e80dbbc2b6e38b24
-
Filesize
5.2MB
MD57bc55a675a34651a9723518f7da93b7e
SHA1f0b44fdea3d92cc26a065d1d5967381a682c517f
SHA2563077547f6ef655d88e1bf909bd06d8e03c4811a9dcd532d602a635ddc574865d
SHA512693a839f84db47c0d80fa5ac45be039757c0dd0559710cc234951cde5f69cb120379774457e547bb072a6605175ca22e94241e2b2b013f723edbe12ee5a219b4
-
Filesize
5.2MB
MD5f506a96a2b9626b0ca05cbbfd37fbe3b
SHA1a6ad32487a01c7f876aa982045a2ecf0c530fa93
SHA2568dba267e086ccd173cce971486b13927569ff6e1656f99c178c617385b982da3
SHA5125ff7e75ea3bb344535ef04544de6350f473d23957c6f217c57d9347f2c47d51917e3668f97f63d778be330c01be44354e8e4eec6681197f0e30265c9a5a67a13
-
Filesize
5.2MB
MD551070e937ddd060b810e234fb452989f
SHA1ba62895444551139ee5d9dd15f91e40fbdacb14e
SHA2564e4b13dc9c538c3c2b7a88a8d325bee5f6be1d40317186187a7d90192bf7ea23
SHA51276988beb98c0ea9f41368688eb47b09cebbbd13bf6fc15e444cb6a7f3c5666b5b88984e14ee6936c1027bcfa02c437d73d7b91002e1954531c6eddb73526da61
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB