Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:32
General
-
Target
2024-11-11_cf3430bf55fb33d664d2d8874c970901_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cf3430bf55fb33d664d2d8874c970901
-
SHA1
7897dd3b9e47707f2635724f40b57119fd47e3ab
-
SHA256
65da0d0091a2110cb5bfcd14bc79f90f276025eb7828abe30165948f1bbffd3c
-
SHA512
c86f2f8bef0ecb90467225e99de0974b0f13f2e50a19616760d7d6139246be5f7a444e77c057e1b83514da80531823b8c1307817c07dd5ca7870793e0f4748f0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_cf3430bf55fb33d664d2d8874c970901_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_cf3430bf55fb33d664d2d8874c970901_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NoHJLPj.exeC:\Windows\System\NoHJLPj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXecyAK.exeC:\Windows\System\jXecyAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZnumsjT.exeC:\Windows\System\ZnumsjT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZXNEEpt.exeC:\Windows\System\ZXNEEpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VENKUNF.exeC:\Windows\System\VENKUNF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lNDvExc.exeC:\Windows\System\lNDvExc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHBTzAu.exeC:\Windows\System\hHBTzAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdeIKDI.exeC:\Windows\System\RdeIKDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PziPpcl.exeC:\Windows\System\PziPpcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DOSAyuO.exeC:\Windows\System\DOSAyuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMkeUgM.exeC:\Windows\System\vMkeUgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVZgHVw.exeC:\Windows\System\HVZgHVw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjKkVOH.exeC:\Windows\System\fjKkVOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KgJDqlg.exeC:\Windows\System\KgJDqlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjIOoLz.exeC:\Windows\System\OjIOoLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjpDNUx.exeC:\Windows\System\vjpDNUx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yoZqygf.exeC:\Windows\System\yoZqygf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLVlDFo.exeC:\Windows\System\CLVlDFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gekCvde.exeC:\Windows\System\gekCvde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTGBjui.exeC:\Windows\System\xTGBjui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnbAHFY.exeC:\Windows\System\KnbAHFY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5371f540ac87462eb94f73c982c7f7e1f
SHA1748b978691625a339517a9abdfe455a084d5a354
SHA2560e2f7f4975b5f4e9d31f9c6b0d86b402ba213f2de1bae0a32e65f0c28dcee25e
SHA512f84ab98153050ef9920ff888dc52873fa80c4d9d3075bf9e50c50e15db484987bbd135ac839791ce4748fa284da87cdd2bd7d50ffdaf09be8b10ff61b5e191dc
-
Filesize
5.2MB
MD5f2b004b9469d2a0ccf0b0e29b29b7ced
SHA11869a9c833000c6f659da8eaeecf876018b007b6
SHA2565530b1b56c281f961a50ca2330b677ac0ac53d01c94759a671e07302ae1793ea
SHA5124aaff52b8a50f9868281f9f28da4c3d7b400ee04849ce729ad65803f86b23e443c672f36ea8ca35eb774860070cf6a7bf4932368a4f69cbd8d6a5dab6f165544
-
Filesize
5.2MB
MD5b5a7422d5f3a0f85718158032fe35e5a
SHA187b4303b326396650e4e956f2928a03966d5e441
SHA256eb540e069760eafbe7d09f8dbba9483f5b4d2d4f45deb6019a81af5bca896e95
SHA5125384e93b1961bf6df6cdc64ce9e9668aba07063e9a1484d2a34f82571ef6d9b1e98aead41e9707336cde77dd80e7f37b3c3f2deeb359c3bc09f7c1fb4a6f8686
-
Filesize
5.2MB
MD51060f8780d1a057565aeb2a0c644516b
SHA1701a19c38564a116beb5cc16542ccdd78b61f3e4
SHA256110b881d93fe238b3c178b8effdd3fc6e131272bae73ff878840bcced6fca69b
SHA512c92b6871ed81fa62dd807ffa2e7fdfc4322458e092510aee40f7c5cfd1f4e69054a3d0ceac37e204b2ddf60f0fc0b376eaaf59cd55f813d171edc88669cc6064
-
Filesize
5.2MB
MD55bac9230b11e0f7a778670160243d507
SHA1b9ed2ca28b4d7802befca9cc9415894ff8fde610
SHA2563c73092174d8b5599f4aa6a6d0d1cc02dddd0610ffb56b3b1eb371f50eb87e50
SHA5126e2b0ec221c2695468ce3f151a46e544dc39cce7760f115f979314fa70d4acea8451f75f338a08f93d597cd10f495779f553566e86dda7ae686b438161667346
-
Filesize
5.2MB
MD5116843e72cd6e1e660b6a71b349153bc
SHA18ae76beac6b0a0b72236466048b3a60527035090
SHA25642fa0217a8d89bad26693578756c12b978182d693078d81f47a5f12d7552868f
SHA5125df55a0d7d68a2b39d491e01c20bd5435784e9cacc1a799971f2fe9ac81ccd5485790b2bcfa9d80c25fcf4b0e094f73870c4628dce4154c933aebba442cce16c
-
Filesize
5.2MB
MD525475762ddf3d785e3f167cbc6ab2b6e
SHA1f7076895b7723da3b4c2b1101aab002e917ebe84
SHA2564369c411b0e6c4d0f031f6e93498374cba5f487d66c01a7a239452a43b39322c
SHA512f32abc1301ed4f33347af911fedeecc51d2c6e4128cc873345bb710d4c5abcbb6604a26b366a284848e56b80c12a627c1da5ddbf540baba975bad62dc222d791
-
Filesize
5.2MB
MD54ebc3b83e2944aaa9c152708841610bd
SHA11ada93fb706d0a31560e137b589b71d800621d6b
SHA256c6a2ce38e2c55407a76cfe6039858771e0299600b424ebb9a67660a613e6331b
SHA512ac828f629e90308786cba1981db62d31f0b196114ba8550a742c6b0cca8f27551de2fecca8d0654374b5f673fddf7716f30b5ca3dfda47378f80582f9eb8d242
-
Filesize
5.2MB
MD5e87746520983ace8cacf14acd31a1cd0
SHA1dd19b64b7d89056e500f25a31bc0ca9094aa05e5
SHA2568851b4e38b1f13d7d658950b766c71b10e1785b8ad2449e1a1092650da0ddec8
SHA5121c68e42df0964b3eddd28c65975af4caf8d6173e89539bffe3254085d689ad20dbf28f261a64f4fd6041abd7d71bd1d494249a0995cec7a7bde8c70d2eb9d238
-
Filesize
5.2MB
MD51c5129673029c6ed856bca495141d40a
SHA1375b16a525f4a08a01ff3ba62224873eb6657fea
SHA2560cd599a1d3ca9b4beea26c6a5eaeb39c5989c864f0ed00fe1a89bef0032e4cee
SHA512f41b29f2d7e0ca98d889849f7ae3280d0ca8beeb981fd2c3eeb7bd8fc484746885d54bb6d4dd088241440a78b902c04edd14c92e57816ebb82839897f1c57ac5
-
Filesize
5.2MB
MD5ae5a2cb497a145da5702aae895dfcd9d
SHA19fc23bf268ef6f3297c1d4e92aa6993a5393e125
SHA25600d64402dcc87d8bba57e71aafa0fed7ff25ed0f725729a78f5adc45aee4775b
SHA5123f9c2f47da91c1a1a4ce16c2559eac37a2c8650a527680540351753c54ba2b42099b2d8161a943a62941b7ef62dce316690f0c73f00573727982e805521b1281
-
Filesize
5.2MB
MD503757fd47dd24dd2a6f7016c5908c0f7
SHA102bcb16a4d344fd1604b20710e6710f0de9d55ce
SHA256693e13b5e86c142818456ef6fd410f1a332a54ff2f936f91221461318e7dc718
SHA5126507246a7b082e54145e0c7abafbc1cb9db83fd07af99a8d9f38b1fa97f6a89309a477023d2344498d6cda78d1f35e1230e9ab03596109abf555022298a7d82e
-
Filesize
5.2MB
MD52ebb465987fb1f75027b52a5e9545346
SHA113cb3b5f5df80b43b074320844f804dd0ce8e1e0
SHA256e8897804e5ca8937359d106cc62b8fd79508ff29cacee4386bbc60241de5b2d4
SHA512423d1fb2856e87c2ee47fed781658611fed40b6928e948103830d323620e9f846374405713b79fe7500186cb344a5dcb6e39fb8d13e2e4771156a0eaad0e76d4
-
Filesize
5.2MB
MD5ff99b92e2dc833c7506e0e061fed82de
SHA147c4381fee9d65eee09be6dd204859489b4082ed
SHA25622bd6ba62e5deb40ef25479d2cb2f8add6bfb330a20d6b19564cb516658ac962
SHA5121740ebd95433c8992399ddfa057404be75190b89e28184d34bfa118c1fe38587f2cfc20fe66455a0e4c4269b4ad67a78b38259628c42549f50f67f4dd44a93d1
-
Filesize
5.2MB
MD5b59b90464c90238269ca5290453d3ec1
SHA11f43922971c0f1b32557202afcbd7e2eebe9672f
SHA2566b7af3dd11e16946356f34d715c10197356f1620b75f74e7919e9d273ae04049
SHA5126eae7c88ef08af3aea8ef62883bdf0fa9927c9296bc56088c6ba82025f269c68a7d961f909b14a8e8a143650415606d6d9c297b4b15532cc22eaa0cdc05712be
-
Filesize
5.2MB
MD5c6746c87e473efd201ee0543975a654a
SHA17f185a50a2ea82269a4ee772448f29dc35ba3a91
SHA25654623febf5f1e983b87a5f72f766f744f98bd455eecf459a16048e4a4ff19fa2
SHA51259943807f1953a46e3f4ed2f4a1b9174fbba6691adedf9960d15f2c42f506d0daf8bafbbb4b4e80aeceeb4bab7f0d8a34f3745b90c9e0d32a555db6e7313053a
-
Filesize
5.2MB
MD52e76912de1b3136816c23a577d6b4fa9
SHA141d2b3fda91982c9e71ab5960d4c1c9c1ec5087f
SHA2563abbc9e19e75b56e51b9ad95cd2544b90cf990ba6c6a07f0bb36c8ce162ba5b1
SHA5129b6513de521022d65ea3333f799157e83fe21693282dfe29354c1a18122e413fccac2a7839fa6c26ca16390f1181c2e5f236e03e3e5f2a8dfbfdfd9f3f742c3c
-
Filesize
5.2MB
MD50f7a6b69fed6a812e96f75d85a2109ac
SHA17051bf9a84780a8e3d8aa379916ffc3f639fd449
SHA2565cbaf42c5174e7d32aebd7e2884bfd1b9c10969fd979bce6d2082bdb43bdf058
SHA512af9e8da87c9d13837e0899abf2688cdbc84c181efede8beafd79e44052164b358f4bde8f0e9a34829388ec2a132177c79cc571b97c8f37856b9741c90d5d04d3
-
Filesize
5.2MB
MD568b0338d153896eeb25dbaf605a9a881
SHA10ebbc89c357b376b457df7766cc571f69f59970f
SHA25671488283c418ed22231fab6a9f8e622c9812f3b70bb328fa4d2cf53b1f340895
SHA512967efbe4338c068baf9f1a2fd2044c096e7b06b614f7e423d48828b1f110dad987a934b9ca36860bf97ea25b787b0f1068023932b98dec558d463cebc01c4795
-
Filesize
5.2MB
MD5649a28807d7abeb17bfd1a98472ae6b7
SHA18836a944cd639147c8ce863fe95cd3750e79101f
SHA2563c8a4f16d02fb13bf10f0edc9478509983fb85edbb9cd502663084ad69de2a7b
SHA512e71512a8a5d1e1259741816fdbf894782b3d8377e70e9d9ca0b5759cbdf4134715d3171b819189fe4e58a42e8589b4307ab7c1814e167be2ce396d3dc16f5396
-
Filesize
5.2MB
MD5d0ecec2f11b9a9e188d980daa37066d3
SHA18889a48688d3f7d9ad07d289c81df29c1755a49b
SHA25691d13a54fdcfd464a93b2502c5a6fbac77f189748d17b31cf020f4bc032d5dd6
SHA51291843069391a9baa4762b82f9552c2d29465df86b04316ee062b19d026f283e41969946593d8b2b8623f68360027c6125c1a6af6e08491661452f7e0a873518e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB