Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-11-2024 19:21
General
-
Target
2024-11-01_873565007998c3a95a3e12bbca689002_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
873565007998c3a95a3e12bbca689002
-
SHA1
d05af4adbe1c1b9b962509a77c3b8d9180cf323b
-
SHA256
8c4f5acf8ca15b6737531b6571db71e5780dbc4593cf884228cfc285094baaaf
-
SHA512
e27caa83fc106b2c5c724083c0e9e72007df25bb0446e73edfdd4e1a1971087a03707bf7ca39e8fd558957ee75c0587a58031293aaa4a11e297d2aebe169d6c4
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUL:T+q56utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-01_873565007998c3a95a3e12bbca689002_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-01_873565007998c3a95a3e12bbca689002_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QuiGmQn.exeC:\Windows\System\QuiGmQn.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ijOOXoR.exeC:\Windows\System\ijOOXoR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KFJtKPg.exeC:\Windows\System\KFJtKPg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HzfJDhL.exeC:\Windows\System\HzfJDhL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\YzQvmYk.exeC:\Windows\System\YzQvmYk.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\BScmbfO.exeC:\Windows\System\BScmbfO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\XGrOoYs.exeC:\Windows\System\XGrOoYs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RgGYMNW.exeC:\Windows\System\RgGYMNW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xlHHifR.exeC:\Windows\System\xlHHifR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\NMyHEqC.exeC:\Windows\System\NMyHEqC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xyRpAkA.exeC:\Windows\System\xyRpAkA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\awlfxPJ.exeC:\Windows\System\awlfxPJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zDzhAQQ.exeC:\Windows\System\zDzhAQQ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\LFUbsRG.exeC:\Windows\System\LFUbsRG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ZVidqhy.exeC:\Windows\System\ZVidqhy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gqXdrcI.exeC:\Windows\System\gqXdrcI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PYfiXcD.exeC:\Windows\System\PYfiXcD.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FJVXFkU.exeC:\Windows\System\FJVXFkU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\SBFBFdv.exeC:\Windows\System\SBFBFdv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zgpNNhq.exeC:\Windows\System\zgpNNhq.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\HlztEBn.exeC:\Windows\System\HlztEBn.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52a8f162e245fc826e52f7c1ceeac948b
SHA1ef1fab7a6bc3d0b15732e0ec54c1d2088fcdd83b
SHA256f712a71a3eebe23d461b8f88200828e5324b8492b1adbd5214d60c06fe618def
SHA512ddf020c5468923b6cedd738b160a13d23725f83a820b2b580e09957989751a954e94c8cbe8111682514d675f8bfe32ce3792bdae4f15728a2dd77a7f59179173
-
Filesize
5.9MB
MD5b9a36d252fa2c1c52be77405a7f71dea
SHA1794e21751b43ed4b09a90e3659e2e59257f29a9c
SHA256f75b1236ddf870faf9610cc2d7a9749400a8653c061ddb238092e7304e9dfc99
SHA51282171d04d785d1825fe9c2a3f04cec85d261ab9934f5464177946584bde0db15171b58e58888460c4e19429c327161a96c39b66912fcb9b671237c0f72a85b94
-
Filesize
5.9MB
MD5949b80f18188ae6b5482facf8900c53c
SHA19cfdec0b46c68beb78df6fd9a56192dc6b55c586
SHA256a66dcff243b52af48aeb89ec08e9701d8e0245225cace8fc3272ffb89420442a
SHA5125ba46b246fe9b549f330459906d7297e3487c6ee2580d03e43632b4ed5e41619c926cacade7a7af2de2a6df802d81bddf4754dd1a058a2931edddfff0202986a
-
Filesize
5.9MB
MD5da3e866e7f277a0ba603ef5583fb47e9
SHA1694173175ec4c19b0a408bbe330b0e83412df39e
SHA256b67161020a3a3eab25e87add3e7fc85deec5c7795581d6d4348aa1b7f09a81c9
SHA5123f38fef9afb296997241df67343326a4fe4c3661d96119b51d8c41a4125184e06af6c1524f0db68eb33eb06be82e180ecd7296c36f66bc3183cf3d86bda75e87
-
Filesize
5.9MB
MD5436e610d37bbb4c7230b45a501cb6ff5
SHA13d7e1454446ca4a85af6f742431c8a45c0813294
SHA2560a84a44893f3e0333471367c8e43739f42c753641f7cc0d2639e76dac714a391
SHA512f1d312e90ff5bcc761ed3513d32411935bedaa0ecba4170e91f9ce1669215a89892082ec644ecb1d7461eedfd26035842599dc1a190d603bacaa76fc11d833bb
-
Filesize
5.9MB
MD574d90f31e6cca06cb08716d58584b02f
SHA1944e1cb9e294fb58743e4c59886b5fe5b60212f0
SHA2566585af7a05ece3be5b811ea66cdbea7a444ee4fcd78e15070d05695d1edb7dd9
SHA51288082cb5a216b5f8a9a570b87db17ccbaa59b31f0f99ab1bdc31bbf7a1feaccda6cb3c64c5d828300b58d41168ae4504c960443d26aba782e2c5534e5c9883f9
-
Filesize
5.9MB
MD50b8e0283d41c58f853c07b0d972d6180
SHA1c568361936a4d9e0d4126ccf6e011944115aee19
SHA256c773884b81c42956a6b5a01e72177f774a6db8de162d56d03d91106951559126
SHA512bbf67890bdc716649cc20a556cc1d07296005ca19ff101939a37affbc44a0f860db3077863a8cb35616d0276da2b3c52b9b5f4d22c3791f22b811da9ea1079a8
-
Filesize
5.9MB
MD5ccfdd0793bf419dfe3480b05d8073352
SHA199303fdce7113714698f94cadf3cb8b4a6de4945
SHA256bbe2c5519f3d83dff3aef2f1527513b7af1c0fbf685bb1cc5138f302e32db4f6
SHA512f1df85fbe176ab7809e1e3327a2ced5b3959d47e541545e1d859816875d58a00977f3caf47487564239aef6bf6dfdf38171e2be0ed6691185d27c629ffd5510d
-
Filesize
5.9MB
MD56b4efb4201157fb0605e38df93b776ae
SHA1b47fbfc9e62ddc01d826d1ea2991d1675d2076f0
SHA256b1dce35c00197de2fc6e09942245d5ed374fa2febeec5c537e2427db06378e08
SHA51251f60bc4963e6d084b2a16c5db5b246cb0aa4003a60da1d045e391f199907ab4db6d35fcb986edeacb7ffc384246f5452c9085f95a71f7fc67287eb271eb4eb7
-
Filesize
5.9MB
MD5728d65575ca72f826163a595a3308eb2
SHA1576131410533ab219b79b6be0023cd8b6c8dd4c1
SHA25660f2a40cc832f8d55b0aeed768caa158fcd03fda5cd7f63a6cba717b6fadd04f
SHA5125549af850c2aba655fad97d7741bae46ee771a234aa1a3d84cf631997a10239dddecab548afe22e004d85626cf5fbf3bc88f954602a9929d406b943948af89f0
-
Filesize
5.9MB
MD559a6e66373c9658dea097af2073910a6
SHA166f0ea50f73df3ef67269120b24d95fb97302729
SHA2568c82aadaae0c00a2db748f199281b821f3c82f3efbb6dc29984a41c409efaab0
SHA512fb6a610fbee4c975ba071660708f19ef7f49e5428e20ff4e24faa06ef8ceb6c9c4cb2a322a6522dd3bd7d6da0425ddd7aa77924fc24abe341672aec75587b38a
-
Filesize
5.9MB
MD578380f1d1e0f25c3016c6cbd379f0853
SHA1402fe7bf4951cf244639a9d0b6547eefbf876a53
SHA256b8132824291f8acb44a4e625b499c00c648dd5b377ab9e84f9ce673fc4f6aa9f
SHA5120ed8c1372e0edb7151263e62a8ba30a67be96df785592bcdfab5ac3a91722e744f1c2a5d060d007769b5c4fa3eca21daf1e5e2fd6d3a03ae3884ea45c2b180ea
-
Filesize
5.9MB
MD57b006b3bd5247a1b0bccf2d04bb3f369
SHA1bfb372a1c41ed30c6618230c6917a9a6fabf4cb8
SHA256d3ddd603e2d49af9840dad011559368d4f38bae117bd2f86ebbdcb4b39015807
SHA512b728cd7601ce89f5028844a7552a070d2f50f9c86b97426281ee8db847ca3b373e1be1eb541b7a403fe468828e95a0ba10ec40534c7db801865325a0c80cf8e6
-
Filesize
5.9MB
MD56af2f2f418f6d743ec1dda1d9d82a55c
SHA1b31204bfa6932d82987e010a4a4641227a9758bc
SHA256dd40726d295adf78b93e676c13fa2a423f72b822defb47673326311a7cb00acb
SHA512175c0e4e21a7dc650b0c9b1ddaa0e468b38203a5c683a21ef7a78f48c356a45634cba09a7e421ea18864295fde28604aa4092d8d7acd3420244607eaccb1de8b
-
Filesize
5.9MB
MD50a949766e3221bc1843d056f1e2f346c
SHA123bffb07a9fd8239a516b1da753df1d92adef631
SHA256a1b832a3d2cbd86022d094aa001a73565e22e6a3489990e134563ccf9edb30da
SHA51291f41b99feb68bd52009f9519832b52bd17065fc9a9ec31c6f86615477be64a992145a68495cff8b6caa65fe96d97027a1a99b805b6eaac3e9cb65c3c4002a25
-
Filesize
5.9MB
MD5e7d7075ff456256589e0e8d9e29254a4
SHA1991b94f7cdaa0b5d472c0a5e2d049332cd4095ff
SHA256ac518ac4b1e9a57ae3261656a895725945dc00a3959c496b5030f04eccb54f60
SHA512ee4462b2cbf93b744b8f06df0995b86b018e57deb1ca6392bca40146595a68fcbac0b9905bb051d3bea41044324f5375c7da7f723b473818555b1c405cf60526
-
Filesize
5.9MB
MD5373187b38ed34d8cb23b29f19506d8f7
SHA1dc11a45a927f9ca1646b50046fb9764b2a65ea3f
SHA25688bc6a1cf440f54aa85d944ab15529cd994e423a3ceb6d5c32a4c7b554991609
SHA512350a92503bec53f2360247fd036b4df59bf6c0483eb565a0cca086f56ab1404d2ba6395bf401eb95fb112c960793bf3d5c635960dba91138f595e5773e746de2
-
Filesize
5.9MB
MD5fc35cf9f7b4226549e9dd442c260393b
SHA147922b7c6bf9b636ecb85fb33378293761a7b3d1
SHA256a74f3453a71a1de48eb141e2d5fea3af86ec360d8c4e88780f0ebb84641caaa5
SHA5120845aca018cb5a5256fdc16f571a423de63e25a5473f985eaf4a37067e5ae66b3803e745040be28b8fb7b91233193168c11e6fa3367fde58f3fe47ede289ca87
-
Filesize
5.9MB
MD542c56f7731324f670e50d03c2634a4f2
SHA143bfe5781436b7155417e0551cdf29c30a5712bd
SHA256aefe8bc63913db7b3b4b1178121a5c12464fb7fc763e1d06229eb5653f663e20
SHA512ea83c00d702dede3cd1b7df8a2085eb5dd7336cb74de2e7ec07cb09502e24520f14766858ff843026833ac1e6478dc9364890217a3687b141da9cf04907cdf26
-
Filesize
5.9MB
MD59d12b8ce6f175e7d29464a62f12a39cb
SHA193c2cbeecac3428a6b35537145ae188d4fad5e30
SHA256f1b869a29f5096afb748482699dd3730ebb34b0d4fd86d54321a74dd33040f92
SHA51219566acd9c7ab2c2a16c5a7e772ea75b785a5e1225db360ae9f4ca6088692159adf2a77fc3d94aafd010509c38e3e8deabebe37af43f49caa8cef802abf905ff
-
Filesize
5.9MB
MD5e47fc4f37209eb1df9c8f36d0a8e8442
SHA1f7e407af79b6f14785a1509eec0c86e3958544b2
SHA256de19f05262cabd52cd425e9e00006c58bcb298880318355ea86a113d67e0fee8
SHA51264315b647aeb2b30bd29047ee6ce5ca477ff9edccd5da7da62cac89a40b8e4d42ac86348e4eacbfecf34d3bf1bc3de944db51c36e4eae64413099739a5ebe33c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB