Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:35
General
-
Target
2024-11-11_e3ed426e7ad495fdb649578d3e50e500_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e3ed426e7ad495fdb649578d3e50e500
-
SHA1
e95009fdb0ebd368a17c0c15750677175f8345b3
-
SHA256
2128ccac979b26d874bd54b97b6d6feaae133ddcb8340da6a2d38614c77178f8
-
SHA512
e36819585c52637e6f5eff8250125180dbdf87f3bbc68c6149d06daeafebddeae634498c01e9a58182c8e9efd883b2688571ac63592ea9f841fd6ff221759633
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_e3ed426e7ad495fdb649578d3e50e500_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_e3ed426e7ad495fdb649578d3e50e500_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AXnTooB.exeC:\Windows\System\AXnTooB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYhomQc.exeC:\Windows\System\pYhomQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwJmnlP.exeC:\Windows\System\XwJmnlP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piMokec.exeC:\Windows\System\piMokec.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CyWHxpJ.exeC:\Windows\System\CyWHxpJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HrmonyK.exeC:\Windows\System\HrmonyK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyPZeni.exeC:\Windows\System\OyPZeni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FDAQDjY.exeC:\Windows\System\FDAQDjY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GKghiUz.exeC:\Windows\System\GKghiUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psFzTeY.exeC:\Windows\System\psFzTeY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmJEauh.exeC:\Windows\System\OmJEauh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYKjekA.exeC:\Windows\System\kYKjekA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASIwUCX.exeC:\Windows\System\ASIwUCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWGTIPf.exeC:\Windows\System\cWGTIPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgafWDY.exeC:\Windows\System\kgafWDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmQtsho.exeC:\Windows\System\FmQtsho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCnhaID.exeC:\Windows\System\iCnhaID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xvGsNxN.exeC:\Windows\System\xvGsNxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USYrBwi.exeC:\Windows\System\USYrBwi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOwgbAG.exeC:\Windows\System\lOwgbAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebdINIh.exeC:\Windows\System\ebdINIh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d1dce0d85072c0d43023cb8574d5cfd0
SHA1cd84a3a378fd419fa909c6f3b1c85cc5f4895db6
SHA256bcf713b0844f4d784f80c2fd2e2bc36570007d8364f61f12bf5e8d8a7bf25824
SHA512bb1e40235d7a081911876793615cb90c0ec1c0baef074ad9f04913a6896ea672f6a65e3ed92b356ebdb167b888b1acf0c886c790af1f7ecc7aa9c976fcd71bab
-
Filesize
5.2MB
MD5c22d585db1576fe6794bce2774da6b24
SHA11de55509556aece4b7899aa5bda0ce420f069bb8
SHA2568f9c44ec1b9d03ea3b998d5530be1d40e949ca9287533c7d6a7854fc106e1ad4
SHA512e4c8143cd7e64a10ee39cc5bdd2c3a9ec655cc94b5c8433a4fc1e12a40d546d84dcd82818f728780092e8b48b7c9180460d4132a1cd3f0da6673ca999dd3e217
-
Filesize
5.2MB
MD5722f5d17c686e0addc9bde0ca878c27d
SHA160f8148e4e7ac60a23659b95ecd24ff03e415f4c
SHA25623024404724713a4fdfdd4e4c27cccc809bf60f60476537980eb3dcaf29b2588
SHA5120f10ba0a3d76dc6d482fbb0ef3c5f88af2ca7a441ff9f763eadeca297ee240f53dff63d0e7fcabddfecc128df3f88002fc2143f4ca6298daeba5a765a6bb8ef5
-
Filesize
5.2MB
MD5f62f00c53c24bcc2d70c4cd5aec6d148
SHA18c717271bfeb9d3a7925cda6a1a644b1b9bd72e4
SHA256b437eed6c1bbe6ffc282e6865395a789f4c57b7efe04b6a1516416593ad327de
SHA512fc28c79ad7f0f9a95dda9ba1f86c83191ebaa344212ec8757a4f1c675b544f6faa35b55b2254b169acdfdd3514791aa52c16d8c4a47f642bab4595680cc98ee3
-
Filesize
5.2MB
MD5d427b554b0b9d2acc52c08904195df26
SHA1dab43ca675425c9edf23236c0774cf8f31a810ea
SHA256d96e40fd17aa9417f07b677dd19eac1039f5496c573644504bc3ca510e55fbb1
SHA51273adcb801631bb0b5a832e4c9029be314bd3167e8c9c3c4b2dea3ac94840a72dbb243b8e0bb3aa2eef012df8e98337c2cff38b929587280be5389ee64cc986b1
-
Filesize
5.2MB
MD5c99a661074bcbf9149bf6f6801dd2fe5
SHA1f63a2ef3857e8427a003e476f3ed9b40be0b76d2
SHA25657a963988b9c8b1ebf9b751373bbdc1bdf1fb09a03673121600408dbb0b0aa7f
SHA512ad029a2918da7ab5163b5e25964ede6b201bf82cc14acb7fb0e8603807e2b54a46195d928e957ab99deb5fa19a938f85f0d5b192d5f478c76d89c89e89c1e98f
-
Filesize
5.2MB
MD52b869b6b2859fa2a66cac6bd1ec8f079
SHA12ce71d0e9289973833548ca329f2816cd09b5d7e
SHA2567ff8a6083576e678f9c903c45d253a0a3605b0b38c68545969e5520da18e0877
SHA5127f599117b2a2f790047920dc3f2064a0611598cc1ca17a692adcb24148712f19011673932d7116e382abfbb99649be45a356fb3aac9a0551de0fc715e60afee6
-
Filesize
5.2MB
MD5a6ff06e26f46d2971fda693f1ed1cd43
SHA10de24981b4ab6a436438e9322b07a323879bcf2b
SHA256ba24d3ba7029985d125aa2612da863fb6ed5d22ec6c5312f7bf258123d03db1b
SHA5128fdb3f37eccda19b4c5f271579ae85369bfe4a6688e7ee3304f2d4be1ec2199f604759b8f41c18a3802f49bc73080343cf7d4b687957d12e2f8e3f3f9dd1a329
-
Filesize
5.2MB
MD5de52d970b309ae0526c2fdb57f5b901e
SHA15760188ea7193e7f7f6519f3e303e82222e006aa
SHA2562f07c31379c0464732b9551e18485f8f46b2f420784e466ea283770d5d2eb63c
SHA512b42bbd0d0f4355dbde49fc0e53f315d8f6de71089159b9800e413216bc7747f0f4bc9c7d6af019f25d291fbf42dcf40bb278214d9d3adc156452c059b3feccce
-
Filesize
5.2MB
MD51e0b5eba752b8bc3108cf91d946d47a8
SHA16ff626b885515902db433aded94299683f03f64c
SHA25684d0644c722fb15c1d1d95f710aad19fc109987d06ab68a780d5b4bc3bf01846
SHA512ac51657b78c2dd887996f555da6a74868fdc25f93c5fcb1329fe4b54132e21a926f46beaaa48e22f4e46db00228ef6af8dc35addfe4d2b45a49b8d55493ff124
-
Filesize
5.2MB
MD55143f834321c161fbafa265f76473335
SHA1fcaa2e4ba86615d10c4dea7afaaf63058d95f10e
SHA2566161ee7351433b6e5179293d719939129b0cd5abe3648f33ad4fa9eb32c3695b
SHA512a30fdfcd43edd933abefa77d051a16431783762da2865022e372863bda7d20446c738917de9433ed6416ad4db81487f37702a18ee607120cb9d62a035ad5be83
-
Filesize
5.2MB
MD5792f40974c245ba22c3ef993feba8a05
SHA17c3dcb2173603b29dcaf1039b8d7d8461950af38
SHA25638e1eefadd0c95b0ed8522b539580c6dbc14319cc722c31d7b27c6f421c0809d
SHA512f7e341c270532a0626d4962e9ea73964f48d8376f12bd62f309a2a2f9b710cbf1dcc933e407ca186099c97f772e797c2a41d7c580fd5ce5d20984539a760d899
-
Filesize
5.2MB
MD5aa85184b19e28b95dc14e43b0a1f8341
SHA1bd3b2fa5a9730d0e8411ec1479bbcd942de27df1
SHA25687f51c791ce3fa358278bef5fe57b1463de58d60483f631a3bb0e6f7eabf72d9
SHA512ff9ceecaddddb326a6244a81f4d9d4d031db5c380f9fa6ab05b76c7a5992ba2dd09a0ee59b71c968732a908d219e259975c93a4b67e363e029475f9018814915
-
Filesize
5.2MB
MD558cf9d7103a07b687104ced82e6b5a86
SHA160d62675664af8260c0b74b7fd16dd02f98109c3
SHA256a9d1ec5719cf68d50e094aedc22e1cb8293e0c9aeda468ad0e4d3711b2913788
SHA512375e0034ccfa7617ab48433b17160d6402405936aa5c9cc23d8c389fa79a3f40eb29e48670c70be7bc143fbd86e560ecf82f9768876e345c82fb5ba33a2c41f5
-
Filesize
5.2MB
MD538958e4a29efa90ae82903fa57cf24b2
SHA1dfe2edca15bda69437ad0f6b949ba1d8b9e63cb6
SHA25692fc87886637dc4ece2e4719b7976cab6340c162c93ebd69a81cd8dce347d3c4
SHA512ff33d044ec6f512a41af102ff28323d09bd8a8c3a3cca00c9dbd8c944d6399b84122a7392c97884d01db81c6b9fa639a65185b99b5e5356f153f520aa3701e72
-
Filesize
5.2MB
MD535b8aeec2410bcc28bf9bca4ccd55394
SHA1e2f6ba5d63f5001aadd5cfa31070716fa0f9196c
SHA256acf24631b77c80e587f8adc41353599a3d8a15ff59be76b523c7272bbbef5287
SHA51286f379a87117b1b1d83e9bd0c845ac670074743f8e595e255dfe0b1bdb09dc181292ae44b16921f5a68e236b3018dd783f4963546b567604e094b87dee34809f
-
Filesize
5.2MB
MD5df74be8cbaeb1e73bbc85d6eb774c10c
SHA1d313f04b5214c92626be8f7853b3aa4baab54e0c
SHA2564138e1436d5328d209492c667c6bd9f0673acff5659d5cc501426c13417caecc
SHA51226b3d5fe13aec5070365afa6e26912b5cf681f9326e12ef69c38408612759c9d5452310a76e2c2a2288850f279a622500981f0e1f9c49c7d9c8e5c0a4f0341ee
-
Filesize
5.2MB
MD5b42d7bb2386ff9fd0b36db56a3da308f
SHA1809c9fee64d56e3095c1341299f017a5b062261c
SHA256f6caa6578972b3f2cd85922007d95237cca47b13bfc07f5f5b3496aa51ce1cd4
SHA51295a838be857f7addf74f2135a23528f0c3946fd415c647a530d452e90a05412418250a5373f708f7553d8b20f7dec15aff0139d0458ecd92b94c1fa7b4a309dc
-
Filesize
5.2MB
MD515c2533125fe158cfaea3a80f8ce0d64
SHA11854fa5366c0bf304cfdb1b305731e67cfa53390
SHA256247b94223d156aac6220a53e998adef5dcbd78aa29edfaa2c8f3cf4389d01933
SHA512d4aa31e067f21b8aeaeb327a6a31bf2d543cecf510aaf93809a5b262762832ad984a335d8bf083423223bccf7575bf138cfa1c48410c70f1d7370892a2a61af8
-
Filesize
5.2MB
MD50ec4d93ee4f34aa02dd323264a2cd54b
SHA1ddb5595d0ec0d34c0bce332752a3d3dd2c8ffa99
SHA256c7e0d9176dc3a2e2d5b8a1a94ab552475df75af22d84385bb3479144dc0195e9
SHA512d0734baa4f5d0dc5420c6d7532147b81e702da3bc7a88ecf0adcbba27986527df3089e8191bec0fb433d414f23505a50cebf8329a89a2bccb12597678c25ceb5
-
Filesize
5.2MB
MD5cef0ceb39a4eac2e27079df5fcea4373
SHA1ce946e16d1085049a310db4992c36ac58bdaa024
SHA256c474462bb24ab018970165f3a12efff8eb3c65ccdcbd5197558122473c308a65
SHA5123b1a60a714f5a2e7bac7a4ec05554a927627c7fe8661007482c74f96912f054978cf1d99204a2ed2a92cc52d17bfb87cb8e8a8fa2627ecf9cd32deeff3fd4816
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB