Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-12-2024 02:48
General
-
Target
2024-12-14_44966508581295940c56857c364f5e7b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
44966508581295940c56857c364f5e7b
-
SHA1
625db84125d70f31ffd4f2e5e6d854eb4779008a
-
SHA256
cc6e0bb06efb785a4e4e3c938bb3062e3a26c0078f81e2cff5d65919e9fb6829
-
SHA512
46c9ceccb323b9150f5242f4ec72ece9c17e66485e307235812463ee57026d23369aa42f34eea82c28c6a9ec022dfa2c878f44859acb6b608abbf0e8c5357811
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibd56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-14_44966508581295940c56857c364f5e7b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-14_44966508581295940c56857c364f5e7b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oWgLWdN.exeC:\Windows\System\oWgLWdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiiickv.exeC:\Windows\System\qiiickv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxAArCY.exeC:\Windows\System\rxAArCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HHfoMTq.exeC:\Windows\System\HHfoMTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QFEeAIL.exeC:\Windows\System\QFEeAIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzIxNcj.exeC:\Windows\System\DzIxNcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AmAXwUp.exeC:\Windows\System\AmAXwUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLbDzyI.exeC:\Windows\System\CLbDzyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NbFINTZ.exeC:\Windows\System\NbFINTZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnKlopx.exeC:\Windows\System\VnKlopx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zvhcVEO.exeC:\Windows\System\zvhcVEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJfEXFW.exeC:\Windows\System\JJfEXFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjNhiPp.exeC:\Windows\System\DjNhiPp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGRVzZm.exeC:\Windows\System\nGRVzZm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGcQapA.exeC:\Windows\System\KGcQapA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GjyKFXK.exeC:\Windows\System\GjyKFXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boAnagn.exeC:\Windows\System\boAnagn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZgSNqso.exeC:\Windows\System\ZgSNqso.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vNgCDNd.exeC:\Windows\System\vNgCDNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KxplrCd.exeC:\Windows\System\KxplrCd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCwbgas.exeC:\Windows\System\uCwbgas.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d3c3379b53dc58ba9f13dd72ff13f391
SHA106c33aa6e4a64e38cf728214fc5d80f13c2e08ab
SHA2566db69ac1eae1bb563d04efa451c80195f76454d8cdca83282ee1899f1c191937
SHA5125238a428c80826675edee4ff4b4ade081b89afa3e6b7ee7a8609753f7a2f892ffc78b1433e3cbfaad320b15ab9ffbf904c10eb8656db7aa343c714f57a3d919a
-
Filesize
5.2MB
MD53c5e9f39f357054f7b11adf86bdd2d4e
SHA155b403b8d0815b87ea9b8963ffa575bf44c35811
SHA256d7e7e03328bf2ba1fe2f1bd0b665f4f60c1d379b4facb1c4c05565abfc9e6cc9
SHA5125c1efb457c2f2f1a52ae0cc6ebbbebe9ac2c07f91fff61b95ccdf72101e4f9ac4494be89d7127f6a504fe559f3419fa0b20ea664cbafbce117e9bf3cd5d4fc23
-
Filesize
5.2MB
MD5b9f9f552a2ec57e0f70dc460ab41ea4f
SHA1920b4ef7b17abc7d7021cc7e02b1d100cee89a3a
SHA256b38a00889f969c0c3bd3ad33f456863fd0290cec33ec052cce54360fa033bbe5
SHA512abad6b84a2b5b67f9b5d5a2c5f2266ffa0e120e428a6548c26223ab1d174a025040831b903b7b88e2bc1b61a51092072d65ce01b3635dcaf76713ba2a6aaa377
-
Filesize
5.2MB
MD568cf3e805014baf87bc48ebae3e20a1d
SHA10f173e38d8709774109ec87b71e448c0f8b6ed51
SHA25689d02590f0dce09a2d4e95a9f7a3480cfe2665e7075d38148b366a5a8fca0169
SHA512fb9eb208311f7d8cf1bdf83cf3874a6346ac6ba43e78e7060c8dd35e9645d16df177eb5532b6845aa8eeb231f607fa631b7c055c35e1c58667649072b74e83b2
-
Filesize
5.2MB
MD5f7041f72d4c84cedad4af3ca566cc669
SHA190a84b7863165b188c9b05d764296d7b2a943390
SHA2566aa28953798a35d8ba53909a5f34bcb3d2fc5d8a67740dd5b7a60a2aab0c4749
SHA512c938a5e09d4e776781907361adcc8430af5bf7dc9f33cd6b1bf47e790351887bcadcb3af586e0df8aa37802a660f1f9249cf7dc29383e48c4d081a6599301ce8
-
Filesize
5.2MB
MD5ea9fe24982a5931846f45e10d29bb68d
SHA18fc9625d33dab4db09b3c400d344edc65b7927aa
SHA256b712f2326c3d2dcffc71c4b423eeff4287887a3a1e551cd9ec0e082bb9f27a9d
SHA5120ce85809921822a2ad8fc68189d73e63221eb8239a8285cd709627826229d73416cfb72201622a0b99b3702a3f63de9c1ecc93d813185a3b8a6eef583b8cc211
-
Filesize
5.2MB
MD553754032a6263e1577050cfdba201f9e
SHA11636e22c835fddf30b31fd01a20917d63c044b89
SHA256c1481cd21f244c8b63c13dc8df698c164f0b0217a5969720dc3e0b7887dda017
SHA5122d474b318c83d712f4afb9930e7a8f2bd5a48145debd656218b5dc06ad6ce317ad34723b93a073764d8ae13a9fd501dadb1821e7b89e58a3cda3b1d7c821b0f9
-
Filesize
5.2MB
MD5d391a169013ee431ecdd751ddc27b857
SHA1adfadbfb72db838800f8201d2024d34a1beed289
SHA25685d1ad9f61691e3dc1cba523fc041ca8e87cf997d0bb87edba2958af7eaffe3f
SHA512a94b14a89e8296412bca2956ed3d8c980783ebf6d026a71645a164d798cd3970cdd70ac7d76a48b06caeb09937ea12d4890c400d1589f099bed7cce844c11786
-
Filesize
5.2MB
MD5b024ab706ec9650fb375c6407e02c7d1
SHA1000f4386ceaafa5598b024a4eb873d51be79cf07
SHA256d5aa99a9493436f5246f1dbbd1a36609b779cf523bd9ecebb7dfd8e0b6318853
SHA512e057db7464101b14861bf122b577d389a77787f9b6631ef5af665cc7a0fadf613ac71b1a271f3d542851eed42d03bfe8195d8b6175457440ad5fe5116c249a3a
-
Filesize
5.2MB
MD5d7351963f09788d600b75d558f9dcf0f
SHA1b2a07919b91f7518e45b5276d50d781cf75f4d30
SHA25667cef383164182b5b437444d82d0c983e527657f09906efdf0e170a964f7d44b
SHA512936862f2a6c582afeef4a6a396dd1b40f102ae342b2a8668ad2ea6188d9b3b09187ca71c5761f7e6d6a0fff9017a5c5deef88ec6a0177f9e06b7c281f680daed
-
Filesize
5.2MB
MD596eddbe073e6ceb7ce05e93f1caed864
SHA1eab91f7c5dedb9b6d4c1ed7e1436fff332a72a41
SHA2563d9fccb4e5e3678095dca282e14aecb3907e9e6091ba006626e961b9a7238ec6
SHA5121a257f708671203422ebdb1434536c5b8ad87a2a214657a99bcd4e50cae4f89634b66c6c71d7ff2932461019875eb4af7d2883e041be3babde310b76f92f8fab
-
Filesize
5.2MB
MD5aebfdfdc426aa98cc4c77f7d67172788
SHA14826a743636e2b0448773e2208a481af44506a8e
SHA2563c679fa50706fd4a4320ab2562bb4b9d8bd08aa0b8e95d085ab9f1648906cbc1
SHA5120116271b0f37f7ed8bc8e637308f1a546b6abdf6d327d2197f715f1541ecb93d628c75a9798134f3efe3afa53a053eb959cde93b9a7e256e036112f517d0c1cc
-
Filesize
5.2MB
MD57d6acd94d3ed77929b29e3fe3e8e4ce1
SHA172e83c99892e55033ee2910a15cd0449492499fa
SHA2564add144c4777734a0787157939c945a99e8501548116bbf1b129a22081c9d6a0
SHA5127d1c8e60b5f005fdc40f5ecd1e971890ac01a3d52c4c52176efee474af72da73f231cd72adb00b98a66e27ef39bcb5ee67fbdeda20c369b27342ffa0161bc455
-
Filesize
5.2MB
MD5958f25091ea8abed1ae7988782c865d0
SHA1121b750f7de61c45e95110e0af58db34d5b05416
SHA256ef58c62f68f6eb75863c717937ff6c5adfab4fb4bedbf544470537d681ffe1a4
SHA512320ebe04472e3dcf58821f13681605d62daad44e6f0b4b173c6e1fd05ac786d8bfa391d65f3e7cc9079e449866d4bd23a5127726d2b2dbec4bd88cdf6b9f0c3e
-
Filesize
5.2MB
MD5518e6b240c9fcefa9be94eb7d5a94dca
SHA121ff254463b9241e367aa8377ec7e432619aba11
SHA256e837a17aab2c57450e478809ec3775e548cb04ad116344ae17d537ba2c16fc45
SHA512f1d4b218872023a0f3e4a97bca5a8a1d426a7d907c36c7f79f7fd950fd46b92d6b901756cb8445b9077e018f540a7f99aa9e816694b4e778d3cd9c91eb407d31
-
Filesize
5.2MB
MD57a34d9fedc38e8b79ed4aefa1687b56f
SHA188fadad64912cc3d779ccfdd990d32bd6c2d3932
SHA2566f4a1f8ac15083afd2c16d80bb3525dd15301229fc588e8967d90b9d9a480490
SHA51244e30f426e59ea1a85f92bea6d7552efc51fdd003f149f628f3d3152fbe03fe04d13541823ab72750bcb9c1b33af8d5a81594f6f2fa0e5d666a4459d9ced6874
-
Filesize
5.2MB
MD530158a4637bc9690f684f91ee6ee51b4
SHA14af2f8248881ca60ab98f8fe34a8990a0f8e7a19
SHA2561aaabdd887feff1589c5fd465206cbdbe5e14f44be1595658ee4e82b282f6116
SHA51217f5ea5070dbc0746cb42ef40150280f7d7f86bfe3a1300f3661b2e94e0187d8a5070418c65cc668041f3c3adfeafde1252090612d5188f6bea887208c0982d3
-
Filesize
5.2MB
MD512fe798ad65f31e9788c0b5c89d46123
SHA184e1981c56b39ea2b7daa42b8f8caa46eaeac88a
SHA25600ab564ecbe0407082c49da9cd127f69d30947d4b13c404b4e43bc16d84e6b3e
SHA51255a4572a5d93b0caacc9807ed183d52c91293b37946eabcdf61e2b58b1286e281f290e52627e7042afef205eb2ff4b29fce5bd3d29af75300da4bf83cd79fd49
-
Filesize
5.2MB
MD507adcf678cd9a9ed3e8802e4268eace1
SHA1fd62b647b127bb881b54cb847723f5db71b3f94a
SHA256364f9090ca219ebf9fe12b9b435378b9eee4c7422a1332d0558acf765f21dfd5
SHA5125a2a4131ab120a5bc5975e70d017176b3b4c644a24a8a28d083a1241261ce03de939e6e91daf675287389a0af2b2ff57e4ae25fcae28ae061a074e9ad3c07c59
-
Filesize
5.2MB
MD5cc1a84dc913f97b2887548d202adb053
SHA1de285eea2b687a0651e834f420a0819d8d9d3a29
SHA2565073218a358c1aea611733f190775c2d4080c573194cb47ff3207bc77011c22e
SHA51299692a01231acf20b84479f7f654d3152fda63ff13ae5440af16b933e0e188493792438a13d68d336612510f8bb25df4a6347a54c9c3eaa65b53a6df41735b7c
-
Filesize
5.2MB
MD5b8b607320a4a98380c1fc40a29cc989a
SHA193f3dcd76096c152f399479dc9bda7d7b16e5b96
SHA2560af7dc90e968881e9b75c08816ff0d2e328509d21a04b0a719fd1d24f8b577fa
SHA51208ca7358749b7c4806f4c4a05e9cdf39895832aa9d7f2b3518bd029612a93a26de7e0b6752d8b554decf64383216455231657843089cdc341f1b6e27a105a005
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB