Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 05:00
General
-
Target
2024-12-22_affb5ab11ba8331f8dcaee2929210cca_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
affb5ab11ba8331f8dcaee2929210cca
-
SHA1
605e08735c9cd2c38cb653ebe0369c1a6c5e5ebb
-
SHA256
3082e3a62c7d86815094493d7958d8c739f7a02770ba06e0dab7998fc4261eb5
-
SHA512
5cd43c81432bc69a5a002c8d693a3fb201c27554f3f63969890aa8d663686442a6e3c70b0113d2fcd24a3e1fb6fb5861def0a1255217ddf473ff2a489934bf67
-
SSDEEP
49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBib+56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-22_affb5ab11ba8331f8dcaee2929210cca_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-22_affb5ab11ba8331f8dcaee2929210cca_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FGVeJWo.exeC:\Windows\System\FGVeJWo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GQoMkXG.exeC:\Windows\System\GQoMkXG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HuCfkFb.exeC:\Windows\System\HuCfkFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqIsTrh.exeC:\Windows\System\dqIsTrh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfFXsJJ.exeC:\Windows\System\sfFXsJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OlgkoGT.exeC:\Windows\System\OlgkoGT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IlnrkKb.exeC:\Windows\System\IlnrkKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\snHwFiy.exeC:\Windows\System\snHwFiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ReIQHSF.exeC:\Windows\System\ReIQHSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LhxrohS.exeC:\Windows\System\LhxrohS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPtRZRd.exeC:\Windows\System\XPtRZRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqFnJdj.exeC:\Windows\System\sqFnJdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYSFkAq.exeC:\Windows\System\YYSFkAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euKoUnh.exeC:\Windows\System\euKoUnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfVGhkl.exeC:\Windows\System\JfVGhkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cHkCQrr.exeC:\Windows\System\cHkCQrr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EajpVRl.exeC:\Windows\System\EajpVRl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCtyvFU.exeC:\Windows\System\lCtyvFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cGPwRzQ.exeC:\Windows\System\cGPwRzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrPMWqG.exeC:\Windows\System\mrPMWqG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XgoyvWn.exeC:\Windows\System\XgoyvWn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5933e25b1cc151fb60c8aae7e10f6db2a
SHA1edda8b80901ee497ade3ee03a1503ec560d3bc4c
SHA2562430db63e45b74cef5e84eb50110219a83639ed1ebdbb1b3a3d520fecdd0bbc6
SHA51265264c95faaa268d2d72b84d92527a95aa55a488974c9dace0c66289cf7b587c0973537cbe87497a4b85c6bdfc1c8a7264c77da49d45bb4e4c8ad2edbe5f9c93
-
Filesize
5.2MB
MD5df7e131b499ccd43129597ccf82a96d2
SHA195aaf3c41c0f9f4efc40f237317ca8fdc0c1feef
SHA256415bd10baa7127727f9ed7cdd80bf9da4053cddda42d9c859203cd6eb28769ac
SHA512b06b32c7a1e334282180a7f642cf5e37eb9ce9fd37263a816298e1d41ba0a07cc7de4dcefa4a7277976bf746b925ea39ed80330c34fdf82881885b2b82f6bbab
-
Filesize
5.2MB
MD58f2e32eb871f578374694d8dc852bd5e
SHA1cc8c906ff4164c9da4931bd145ff44a3f5e23a6e
SHA25699baac049178f67e831c99a7c2c97b58315e18f508af9bf55d093758d93d1a42
SHA51281b471c07e1fbdfb2ff4115b32a22b012e5935ed28ca69582f4fa0ca0a4b23e4e36680270c944baca1f3cb613328ff468a967c9114f95c13b1ab966a930fca09
-
Filesize
5.2MB
MD5a039d05dbb1d67e516598cf2c5585164
SHA13177bfcc1789641743c05539520ccf2296f09ee7
SHA2567c390e68c8dbd29425ebe90b38864a5f2a414740db4b4497d8a26f911a4c2ab9
SHA51273d550958e70adf6bcf1c48364991dd993bdbbd0d95efb5dcd9ef8f8310e3ef6acd54bfbe36329d28a976924fd0922d9998462244409414b4fca83885ca25430
-
Filesize
5.2MB
MD5f34e6f4ac1894ec0fbbcf2f873be76db
SHA1879168b38dc2685dd1978e2bbc358a275f40f84e
SHA2565281a72df3984e71991148215aee7d0dedd4566dcaa50b5dd731c827ad40139b
SHA51225872093776601705f987516a075b2ab3acf31d34e1027a463782d6c5c8ea553413a26c0b6cff3ad0043c17c7f85e098380d8abbb4a283fa45a9c71a3edb9789
-
Filesize
5.2MB
MD5d320edd705f27b687352bffa30d41400
SHA1a5584875d7f08add430aa60a7fdc4b7e27081e5f
SHA256576bcd60b15f0ec011f9ba2369cad7c1f83fa58c018abd8810054ea29862a5c4
SHA51275226d87a571c240150f7cd4980e9b1751a39dfae741c9a1406071fc1df8e98a42a7b4b19e46c20608263d80a6d904c16de95e531ad1852daf14d271a6fa6f26
-
Filesize
5.2MB
MD5d775a694eea98b10b1c56ad9f6f4d2fc
SHA1c5083d07c2dc76789afb015c74ac3d70ae849796
SHA256c7556bb74431bad3e12cf648103bce5941c79e8a640185469643998c7e032385
SHA5122673ebf62d27ee7127de4c16494d652aaea33d3c84f397dd0a75c2dbdeef8b83a1419904e497a8416b0cbfdaa473f1efb10017b41432ba75a9333ff22337e47e
-
Filesize
5.2MB
MD50367617e32fc2a6c015c2bcbb194576a
SHA1abb58e7b24fdc7c9eb3fb5ff553ebf5db6b4f8ba
SHA2565c7c69490d5d2d681427cf419ffaae53f1dbc4d3c877c657b218d4d3415ae236
SHA5125ba6c1e8c9544f1e2b1807ed217b7d425f7d3cc8689c46a8b4f4921921c5e41055ba674b7e38f39b3eb43a4d05c0cbb34561ab476bd9c4083a94e0d156866d24
-
Filesize
5.2MB
MD5d11f91c847e99668c659916d7f59c24c
SHA1577be8a53666249ca5897fdea8c4a99f22da7bdf
SHA25690d3c00d70df13009352cebf0ef81720f9f1e2e2f83d318aed31e4d866f539f1
SHA512d9c4c97abad9e5e8cfc7ba3c19aba37dc0b9d96acd0b9f4964161d9d4ce6dcc3aa2148e0f3eec032833183d04321d9f9169e56ec25d4abfd4ec17ce259a691e2
-
Filesize
5.2MB
MD54be966f3f021325c05d0e61e80d9730b
SHA1ad7074a0db299ac4e50766372e373324ddc06c90
SHA256025f11a77865e35e2f2a4f283fe11600f3808821a1cbc4a285a604b7f79a1d50
SHA512a1b3fb929aae747fc95fb7fe6e5b760a97f09da91a11ac149dc070421cc52e7090548636ed5ae88e45850b97561abfe78cd32a91844d6310fb32011f5c928759
-
Filesize
5.2MB
MD5d92228b5217255192c475098fdb98c78
SHA1c1f8173b85cbee16723c4ab5d2946895935cd03e
SHA25603f6a21bc90b381984d5d72939ef1dee81638b4deabd2e001593f5c88294399d
SHA512beee59dd3d2467faeea5f65a58ab9be43fc90fe81dc8823336e5283bf2e3c04b19604edd29e06951bdde03d620f44b6e1a8620719579eb3bd2568648c93f5e16
-
Filesize
5.2MB
MD57f3afe266f9a1bc7af31a4da952430e8
SHA1acf1060ecc8b86e591e8d9cccf3cd51aa7c849a6
SHA2566063609dbe2708e0901842276cb612cfbd21afe5f7f884f1f1384be3a4488a01
SHA512c4366e2dfe12d03cb1b3d134197ff4f4ea7534f504112f641565ee3af77aa677c7636117d6fc71e3938eabb29814b6ccf0686c0ff04f693f14c6d1fecd992550
-
Filesize
5.2MB
MD5b25ff83282ccb335aad8ebd226a2d27e
SHA1c570c0f470774c991ba52d29acc1762a15a7c7d9
SHA2563a7af4d10640c1203d4fe67eef7b7d5dbc5529089e8f95bba7d7ca6ed3a6e32d
SHA5129253a6523b0a61a05a2f6a0dc35a430c7aab9aa7650b02c414ffd511669d8870fd75ab9ac7394c66c30b8bf3595d9950539efed58a418eba58c819534f771553
-
Filesize
5.2MB
MD54140f2dfc4d2005f9e063c96fa7920d6
SHA19a3a1cde6e279fa7b047b6726bea5cdec196cf86
SHA256e1edd3fe4c96dbf16a303dfead1f0ef625153ba25f9164e2f6ab7f2ea1b6d384
SHA5129f7ff08b8a5210e51f98358d83bff6a6e362745a2b22453d00b60c39d120059be6b782f9a00e2f6b3c24f4ccec8252818c5cb13f33cfc999ddf6e948a030d296
-
Filesize
5.2MB
MD5d2371d7e0b89d3dd261a394c00240b47
SHA1bd0cf702a3ae59ab342a207aaed0527fa1c3429d
SHA256c27e787e82b57f2c76c7eacb3b21dea369ad4d15f598c4cd3fa5ab0afd4811bc
SHA512b6a3f18755a83fe4a5f0db48f171c68939b1ff03a4310823d5b826f50e23d0b236ed661d63d4b367bdbf67e31ed50cbe4b27510c86678eae14f899ac81f7b8f5
-
Filesize
5.2MB
MD59805dd268645d9de39b88dc36245c579
SHA13d77328bc34a0337cd3436e9452040cc7e3bd129
SHA256b0eefda998e7fb0818b1366cc7a5dee97a64de80ad845abe985a797f7ae6580d
SHA5122b23d620a5b641be2bbc2e6fb29566e66d18df3eec832c7b753d7f0f58b48176c25b6d242381eab777c589257720f358e0c7203bb7fd7c882a13c85576a24d22
-
Filesize
5.2MB
MD5318690abc9d55b05b2522f6885d70bac
SHA18d731c8c689911a746758925efccc08767048ddc
SHA25663f453c356b1339b8703f0f5dbf77cadae3f0e7bee2e2128d77d4fb837901dcb
SHA512f69bc60fd840f20980c0d113e8baaa49eed5ac5d6145032c3219d053f099e2142a6423d14f109517af88452d6fbad2311a3c746670fcbb4b35950719d3d94ab1
-
Filesize
5.2MB
MD5320eebf22023379a111ebf065e53b9b5
SHA1eae70d116231186179f95f8a30b1cbe9a1ee15a0
SHA256b6481ea6805407f4f8be7229311f1ef0b2c7e901b673b8fb9f3108470a65f862
SHA5121cf779b7822d921026edcd6f71f0296ff1a25e7a7b8c41c5a3006f40f97b9a2a0d5bb28b8eea002b4e5de182e0b310d5887819cbed4a6d5c7d9fd3f8accf1f8d
-
Filesize
5.2MB
MD54d5578f5ab05029ebdcba3ef888eb986
SHA12e8949155e944278df9553a36477e835ade8d86c
SHA256e13cc50770513fcb2d89d3978c90636572a522940177321c3b6a191fb9f5a2fc
SHA512da59fc3c374b0563c93043b743771fc854d768564dca8826410648e0baba6fa87c32ec6d87842011f23f4da37a309ba70e8c62796e0c72c4b65f84372682f6a7
-
Filesize
5.2MB
MD5e9cf5a0eab997054c47afc9fb96910fa
SHA19cd30f8d41719a55ca6d63169d88b4f5147520ab
SHA256a55d391584bd55768a17ec110b42e3deaa55d9084a23cb1c28a687ca85d4009a
SHA512544ed15f7c327e6f9b1680db2024da28909f57b0d295a03f5fa4496dbfa6415c9b2a0ed19a7305d93cf0e085d61c68f55bafd6328f9bc13e6924f2ff616e49ea
-
Filesize
5.2MB
MD54e94589eb09d94cd9aee3bf7bd6632f0
SHA1adb0cdd1b63c3658630542ebc69e9ad21d480c11
SHA2567b3868c93ea1e59dfbce79a8e55f66e94b0ca6a04d7f4082c47e4c219ef86088
SHA512fe9ff5070fe903913ba53b9fe822bc66f1789fc9cbd10fb4cc1750b0fa9ed60e3368d1ea325afc099e06ca8969cbca617aa67a90077169092d045de3b3d44600
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB