Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 02:34
General
-
Target
2024-12-22_8994ae92d415ab0ac2334077a90f1e44_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8994ae92d415ab0ac2334077a90f1e44
-
SHA1
eb39920e631d8e6031ca320de8a9a42870700bad
-
SHA256
91259be9c86bf8034a3febb5e887dbc77344de37539e9175b028e4899ad4df9f
-
SHA512
2777fb63f8249a845392631b3ad50595b7a331d14a2db6f9de046256aec94b312511695efd36ee237cf53dcf36ea1e59cf33082cb25f7aff9da60264e6742c68
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_8994ae92d415ab0ac2334077a90f1e44_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_8994ae92d415ab0ac2334077a90f1e44_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CgNIIin.exeC:\Windows\System\CgNIIin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mkZpDOm.exeC:\Windows\System\mkZpDOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRXeAcb.exeC:\Windows\System\gRXeAcb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JcWAiRW.exeC:\Windows\System\JcWAiRW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIGLzhv.exeC:\Windows\System\qIGLzhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTLWjpY.exeC:\Windows\System\cTLWjpY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqTPNHp.exeC:\Windows\System\gqTPNHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KlQxVAj.exeC:\Windows\System\KlQxVAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNtkdBr.exeC:\Windows\System\dNtkdBr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcLyrje.exeC:\Windows\System\HcLyrje.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCsLFPi.exeC:\Windows\System\lCsLFPi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgZmUKS.exeC:\Windows\System\YgZmUKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yLGKoqI.exeC:\Windows\System\yLGKoqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWkiTIf.exeC:\Windows\System\FWkiTIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmFKQBD.exeC:\Windows\System\RmFKQBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGRwiRd.exeC:\Windows\System\TGRwiRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VWAKKui.exeC:\Windows\System\VWAKKui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxFNZCg.exeC:\Windows\System\RxFNZCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfVfqRf.exeC:\Windows\System\SfVfqRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmiXJLI.exeC:\Windows\System\BmiXJLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCnIsxP.exeC:\Windows\System\uCnIsxP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD574720b42523804f6d9060fc41b3a2f3c
SHA12f4058d04682af5ddf240653e1443012a85b464d
SHA256b67e0bc117cbf56b3daa2d03d0d067b66479fd87f11276838389e8a3881fa608
SHA512498c7c076991d510047c3a0e20aced544a27aebfa1ecfa40bbd525e41361a4a86aa29aee44c1d492598fe0ada8ed40117f4605236b482d163897462c115ebefc
-
Filesize
5.2MB
MD5bb73594f38c7d464519172ca26b8379a
SHA17f4225c9f77d4391bc323d4c35f8c4b110807c0c
SHA2565bf016fcb28f38aee1d1840b6e1ca3c7c3fa79d8319bf749987d1e0db3f41d6c
SHA512982a8eea4abe4ef8f93c1248262773fa8ab094d7d6e52bbf86a73afecb2f2bd4902149033df73bfc570dd0cd4ac9056222b76cf729ae2f5a953a336670d00fa0
-
Filesize
5.2MB
MD5df349729aa0b0f90a919555dc5f3975f
SHA1b9eb233a2fa7f94c4b0c4cd8eb179e7a7486a181
SHA256e7d3f2e9113c6a012cf854f35e65e3bce155f55488d51a3079523869d5d90486
SHA51289fb79c154857d908599fd54527429f83c86b7a5dc66bc566d067da15a3cae30fc15e316b6bca5b254d8986357f9d26db0ef09d66bc4bdfe888d1b8f1c3410e3
-
Filesize
5.2MB
MD595867c35106b8962d01be7cb6efb8f26
SHA17a2e0319a742e7bd4936097896c246e9f9577189
SHA2563c1ef67d09e7f5af88491851b502b9b60c7db7cd69a145da72596579cd15fbb8
SHA5121be6ee60a841c1a260253e17781dabdbd05aa747ad601b698c793e311253c553b70164dc279ee29f7e51d9b4336e5997ef425350b07ba798fa6b57b5ade04910
-
Filesize
5.2MB
MD58f04c42f8ffdef03ccbc841f3b001ed2
SHA1c24b36db88bd5c3629178fc5124031369e551431
SHA256ab8a3b6c951524e4479c8025c61fd997dc17efc083d9b0efb4f3da299d09235a
SHA5121bf625e50d40f061405bf4ca21c231a2791577e4db9cc080e82988f430075e87c67ba58caa1b77e92d76d61ebe5cc439694848a4ebc616c1bd5d3d2b7408b1cd
-
Filesize
5.2MB
MD506e8d7a18f86e3a568a17ffb9a5d9026
SHA1dd148f922d544f25c62e3b765a73650126b788c5
SHA256243f772f59e2fad0ba694fd14f383ca80c1b614fea49d80eb236828358a949b8
SHA512beaa9db2b6f9f5e54a0c8150f8a7d1fdb999106c3158c904912c8de81e0817737b9ff595adc7e4fea7079f8acec3dcddf1c8cc1c8f0b99d385a54d2e276884b8
-
Filesize
5.2MB
MD58a662e32d375fe7a389aeba2cef0750a
SHA11b1f5c5abfc0c812c5346caf7dfbee935fdb4fe8
SHA256980fea3425649f5c88d6c2305ea282b2734d3a2defa98084231bcf0db7b88d7d
SHA512ddea974b30dc7f6dad92ac1c756eeef9070da7ff6dc22b5e52c1085354f4ac5c402c67a08eeac807a187f60824f71c6423d87e66029aa07ea49ef35887805a84
-
Filesize
5.2MB
MD5f0e83fa37450909472e6a77472030efe
SHA1370106ce37ba8c36642b877bacf92f7258ec0e81
SHA25639eb0ebb472e666ad438a8e8ac9ec003acd7c54a03cc279ad536862e2fd67f65
SHA512d0a79b5f883835b68e9ccc66fd7666534b952b4aaa096a2d8f95f8e14f0a79ead238386b5b0495a2015abbdb5e1a16d49e6cbcb06a82ac9bdd7a89fc770fd220
-
Filesize
5.2MB
MD54c491dd3fa0dded1b039420c2fe7120b
SHA1dd33a84e4ecc27f258ec3fc560226227fed1543d
SHA2563f2c596ef70f768c5e259d5d8af9ebc6324b88e0b5b7c2d8d31869215355f746
SHA5120db70f01e37ef36cf677b86315d1af71eb26b9a65cceb098b59e06cab2412d298a9e8d7617735e8c5c789149e19e00f9ecd472eff065b51c81dcc66697bd4ad4
-
Filesize
5.2MB
MD50b63ccc690e9c0be9b13bb303dca3145
SHA1f79832e2aa4652855456b598cd89b8bc8c3d02f1
SHA256270a86196109ab58ff40ab3f069fc7fd3232837c3258c2acaddbc3c8b689cbaa
SHA512fbb7ebc27fc6c871ae0bd0d087ec395b05264cd1a06efd7fe4d2e0bde644d8e52764b575375fcf6b43640eec5a39ae8d7afcbd08abb3f6d05d74b244f2206967
-
Filesize
5.2MB
MD56c5ff5429dc2c2195c8cc57ae66ba004
SHA1bdb183dfb4c7f9db7f75afa9763ee963c708a5af
SHA25694e7a2af21512a2d464ed60ea57c0c98f2e8d9dfe70b12c9c48c4167c3ee6f2e
SHA51226be061910a1d2fa3f298628292675ec8f7e0cab8a204b5f20ccce1bfdd1e7d08eb4eaf06fd968c1b2214865b82a04cae603edb330745e7f2870dc201eac4fba
-
Filesize
5.2MB
MD536bc2cfe22c54f04193ad1dfa140926f
SHA10129bd408d539e6ea832175a7d223fdb87f814ed
SHA2563b18635a0cc748fd894ec972faded24a5cfd5db968802da36b263d04d1970328
SHA5123be2302ee4392d34527d1f6ff0602ff3e2c45babb66ec311ca96bd48518bbf755020da9a28d08db66a5e90770e3e55b53766fb79f39af258f37fd748f8f65973
-
Filesize
5.2MB
MD51da26dc3d0992c9be90ec813be535e2a
SHA1fa00217b94f667c88a37d2a10d06718982e2f12a
SHA256371923822451aeeb83fa2dba204259509c76176a85d90c09368607f6527e622c
SHA512d239378a78e35a83a77adddb1d5769287484788dd4a72c89dde65d8b6ac4499f39fad8749904686412b9ae7a4d9ce9f5ef9c9a85cd676d9ff644b9df07fa099d
-
Filesize
5.2MB
MD53c78efef580d3933cfeee3a43fbb64f0
SHA100d9354ea555c83138de8a8c9e6e5e37949addc3
SHA2563a8aebd6ce775acc62accc25552c37def2d6b44034af57441e6b184b9a02c25a
SHA512b52d30392803d0cc282d1d327116f53a4ddef011f77ea2e2c8784928062791a349b10c94ab9f539aa25603f7f0e7e10c50bc16ea9cbf2184476c94a2828ca997
-
Filesize
5.2MB
MD517983b628cb41cc2e0d5da3c66aab777
SHA10ea70490b23a50d1ac627f26e80e37c6bffe4043
SHA25678dbd60bf3a00596e837fec079b87e763c18ed31f9aa8626c5797ee5aaca12a2
SHA51200a45baf25fe0fdc9be87e3e667ce340ab69d0701fa60f87b771fc8e3c3eb7f15c1343cfbd0a4d027f4663885f14244bb5e285350c0da424463f87f6fbb2b9e9
-
Filesize
5.2MB
MD5b1f92214a0ee2c7975c68b50988cc8cd
SHA1715c8ec23c686e165eea2cb1faef37c1f50b02c2
SHA2562eda7f828f4f9b558e32d706660796c7c342fae583824fa68051a931ba19616f
SHA51202cf1fee19c25cdad314c6e428f889d9fde15457e9d5a2d6743a1883fbbbf70f9bcbd5305ff3dc4d5f7406de2905860be1a671158de69fc1fd81320b2a558c19
-
Filesize
5.2MB
MD5dd1aa833f33e8e6472dac7f79263f0a3
SHA171378767bb8d8d403886dd090cafb5956226d363
SHA2560ef0a974e148f3dadcb53631349b11bfbbda4b9396fea2ef0519ac362ab24a13
SHA51257fa6b3568a29087b0564afb51381b8b82d6f4b1bdca0965cc64c84896f86b83932dce9ae7cf6596271051cbe9d3e7a1d1d592f56927cfa4267be60e6086e766
-
Filesize
5.2MB
MD5956bddc5143082074e6d584baa5aa0bb
SHA1beb6994340a4d4c9b48572bd453ae7dc07ebea04
SHA256376eb9fafc640e7ce73ca1c6d94b4aaa9a6168c2c07f030741acb82f9036783f
SHA512b6f91116dcd82dce6976fa9cfa1922ca3937f2c07f040626f54a5f197583a0542f0063002d22c7256aa352a79f5230213517cb6ff686b6402c0f4eda5296525b
-
Filesize
5.2MB
MD592c326b3d50afa9f3bdc47fcb6668652
SHA1710e39364d79c8d62d180b6d50a792e4dbdcba18
SHA25613c731030c538fe42963ec88f9d1e6b7d4755bf46ce7f7f4392ea661fe95f23b
SHA51203213218b500a334b21a464950ab2a0a85ace40e0da2a625028817718af254c9f66d9ebf2e8a5e99e32c094745700d17b281213505c3833ad492ef26c61db349
-
Filesize
5.2MB
MD5bb96c9ea6e8d82b343a8f207aa27f267
SHA18ee0296f06378b46439c42439de2ee5eefbe37d9
SHA2562eaf3589d4e14a23de83fee6bb3f8ea210278be96f3dc3e451ab6e5326dcff51
SHA512138db08537fca51db129aa9450d3f27a1a4316ec9e4631939006aa3fc9a4506ea2946a5c7d2d7818d744ad9afe6fe7a2f793b4c56e3be6f63aa68e1b30a7a36a
-
Filesize
5.2MB
MD57a71ecaa552c7267c776b825e53b9903
SHA138350fdbf5507ce7d601d11f4c715007b3a84450
SHA256406dcdaedea0074f2e3c975546ba0f9c4b20b3c3ed62153dedc284a174f339a0
SHA512a02bf8f24b279389e7563c7410c2d19c8c40c8355317973659d974228b3f52df31078d1dc7399d81e41dd255871b40cfe4ed8b655e8488c368846a53d61b29b7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB