Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:14
General
-
Target
2024-11-11_91c131688c9ea3f4c774dd2a4710d2fe_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
91c131688c9ea3f4c774dd2a4710d2fe
-
SHA1
2089b2b4835ee7809020722d38851e5d002976a9
-
SHA256
3f88f4ec32724d5083df9e5d1903e158ef530ed4d61929acdca1406e5b94827a
-
SHA512
9056d2b9658f0fe306f30cb6e90a4a864e28b52d96a165eaa4f78de2f29ba1bcf140a92dbbb8954257f1a31438db38040f4b07176737134cf2e3f367a7716b74
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_91c131688c9ea3f4c774dd2a4710d2fe_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_91c131688c9ea3f4c774dd2a4710d2fe_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JnpAQrI.exeC:\Windows\System\JnpAQrI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvQKdNM.exeC:\Windows\System\YvQKdNM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YukkQYz.exeC:\Windows\System\YukkQYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAZZdZR.exeC:\Windows\System\kAZZdZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVVCqPt.exeC:\Windows\System\EVVCqPt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aqwGRFI.exeC:\Windows\System\aqwGRFI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xAWSKRe.exeC:\Windows\System\xAWSKRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LsBRgce.exeC:\Windows\System\LsBRgce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OboiJxd.exeC:\Windows\System\OboiJxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FsAfchF.exeC:\Windows\System\FsAfchF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cMUIfyW.exeC:\Windows\System\cMUIfyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqbHQmG.exeC:\Windows\System\wqbHQmG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nsSYCJS.exeC:\Windows\System\nsSYCJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aHLGlrS.exeC:\Windows\System\aHLGlrS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwRqPpO.exeC:\Windows\System\TwRqPpO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaAjiXp.exeC:\Windows\System\oaAjiXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agsKXnN.exeC:\Windows\System\agsKXnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OsxYsRO.exeC:\Windows\System\OsxYsRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hFOOqep.exeC:\Windows\System\hFOOqep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odNkloG.exeC:\Windows\System\odNkloG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrFpFDd.exeC:\Windows\System\FrFpFDd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD589ac15e09f9fd429acf967217f59115c
SHA1653391f39cf0b79557a99bdda4cda91dfe9d27c5
SHA2564c0d5028261867f63d67959b7b1a49e68f3c0a10fc5ad5bb9ef4b8e584526059
SHA5124a71b9ab6acd637a0727101e6d1ad585d41f0db400378742f8bd9eed4fea75a402778833b6d5ee7fbf004bdde24d04e2af522fee8a5ecdecd1bfc4e6029f0718
-
Filesize
5.2MB
MD52f029b0f17348c3afffbeab95ca5c238
SHA1b1e2a2909a3bd03b5def43439e8fc3686dd99f49
SHA256046ff0db3ff14261e6ce1a24bcef08d3443e649be9644020c1ca35ce3e9a1e3a
SHA512dfe3fb8a900e44289f45df9c461b1eb84ba8b15640fdbaf043e3e8086bb838723361459bbd0c6be57eb65f9ffe5f0551e2ba7ae0fc31ca3f9e66b9d6b4115475
-
Filesize
5.2MB
MD5ade90ddc87cd8dc29450299c12de1384
SHA1f5d2a9f909d7478036d49038e6580d692a855a00
SHA256e4003da74964693df1fad632ce38cc62252c10db52f507839576e5a18f9902d6
SHA51213e6ae4265aa5692299117e5b79a02d1b5bd3fc3a26cb6e848977d576c9952173daf7db4eef75030231293c132913dd724a311c53a5a3dba059d3c408cad6e33
-
Filesize
5.2MB
MD5f5b1d5d704850e9c55929d1973c134b4
SHA1f7eaf1b38804324b89498cdd79d35cfa33bc92cf
SHA25625f7557e44557406c0c57c7007ed47bccb6ea25bb6336a5ac95cd3c4f095781d
SHA512b41459fa4c5f6dcaed40fd7d09e8157f66449e76c715237c3a6d7d4bfef90e0d24852b328a4f35d1fd698657a81d90f3dfbdcf1055d63d2f7193d5d192731ac4
-
Filesize
5.2MB
MD53890142e6d7f3aa0f8a8e4c26c391051
SHA1f28ddaa44197ad42099f6331fb43cbda2801192b
SHA256bffdea2ca50fb7616bfaf7f44c6f4da413f8f15891c8a7f4e4937e67bb8a701e
SHA512b0e51a9e6f32638d66cf10d2d95a104cbaae6cd9c141f2a2c9779d6d137c195c86ea17658c915280bde8d3cc876b72764452e88c989ca87a862f62e23def174d
-
Filesize
5.2MB
MD59d4f1265622e256bce1570da66947945
SHA1157143a206ee74d8c86d9dcf78c0c36af9c43911
SHA256e31638f428708f05685dbab12848f2cb44c0a9d8cf5b2a07c0c27d570587ab6d
SHA51262650d6c941ac4a24090d2c98fa3f3c2405bf27339c156221027216f3aa9210dd612d35db6d3dca7b1b57da561473994b2dc38921c0cd0cb629e3722e1e94f27
-
Filesize
5.2MB
MD554fd181962770c6295db4d33b80b05c7
SHA1ac7d808091a32efab35595db6f019e70fb601a69
SHA25610c99cc8900d95df298b3469b47bd64170efbdaa6deebd6cef6baa14047171c1
SHA5124e0766a7fcbbeebada9a2531b02ec7af5fe499b890a8718d77acc75105276a1cd39f45a0b9e2ebb95d1f25518c83b178d75d933f508992b533196853a4f04435
-
Filesize
5.2MB
MD5ea6bc1ca751f4ad2c56dd55a298da55f
SHA1a8a288b82838ad03efbce470a7771ce0184c6743
SHA256e46101a7e00b0446f1529498896c328f5cd8848d0e0a82155dbd47628ed22812
SHA5125fc247c057ff4bda7d5980864564424373a7fa796bb4a70b9f60998b77ec329b3f7b2cfa67366f21cf0fb186c789bcb7d60030ed5f88e40c75243e0eb3291582
-
Filesize
5.2MB
MD5d5562b6b878cdd8c4194eb5e48b2fc01
SHA1d87b59478f1b22686dac1426823c17ebbdc5c53d
SHA256104bfb1f6bf5602a916904a9d3088a5b1d37b37ddf60efc5eebd4f8b005fd3c6
SHA512a470a19291bdc02e36be762ae3638e4b9e673566624d156d0f193f492bae3616b83b3c965759f563aa0f460cba7ecb72d0581781882122ef1e0638c70928a1c9
-
Filesize
5.2MB
MD56dd65acc4c6cafdeea7fef32e143eed5
SHA134b61f5e8535d21e1bdf0d6bba1255576680480b
SHA2568cfe00a456e84efea0329f0667e74b4cd400daef3ba7bc8fc2c94cc9c970190a
SHA512c2be96d472e92551b5cd23dba1d827e451b2c4c04e57aa6396672f0b39ba32d2f5075b56cf61bf2c13add7ef21102b7ad95c04c926e6b16de94eebc7ab85c352
-
Filesize
5.2MB
MD51af0501e7e36d0e8f6e747abb7e36f7c
SHA1265710aba37b183b4f7f2d1e2bf07a44ae489683
SHA256dbf9666e63c5b5d949db91a60b230852203cc33be5f11263e1020e0f982e8534
SHA512d479122ec2adc3d0fe819e1e652a5a444b70816c864db609faa915774a12e00c1b7f03c6e26c622f202b54774e2deb2f6b259099eb3e293873ba93c77d4d8e8c
-
Filesize
5.2MB
MD582ce7f34966f3f50572ea926baf998bd
SHA1c294850ef0c4982c6ced5412033dac2a3c37981f
SHA25646bdfb40c4d58a473eaefb3de66dba4d35c05bd47ff8070f3570a1d7a6fee64c
SHA51252c84e075f7e0fc638130a14995d79e4a7785389e79542194bb5d6f544933e4a1f6dfa90ed2271f2afbdaf8d7d469346b8c3fe14a7facedafc2a772011e67e4d
-
Filesize
5.2MB
MD5b75cf1660395d0c2420669ea1c200d84
SHA10d01eab35f6d6713ffad52a66709c2bcaf5be76a
SHA256d69b7d0a9bce5974fd97e20df40cae310c4546f919bd91bf84291081533e7743
SHA5127bb6c6f5e46099bf76ae27b2a556953085ef751e21b3f1757ae0ff32faef95b9f6ce2e9e6159131c29e57679e6d2a95f5b293606031491fe6b09e9879a9e3926
-
Filesize
5.2MB
MD50745cfdf01f76759574318d37b93ac6f
SHA1a80aaf9fe5a28087d3bad1bc8bc6cc557bff7ba3
SHA2564c00637f352b32cdde894979cbb2ab0d9d846d80bf97168fea4fd90f9e2583c2
SHA5122c725e82b2ab857802344c3a0257c44c7b092a0cd992e8f0b1f020f83bd797bd45d7e9f8e7270ac19f419d14af95fc3b8ae4cd05b74f3657bf445c5c414424f7
-
Filesize
5.2MB
MD566c070e917c1b4ccd279ec99c9306e19
SHA148601edc90daa727514c74fa6c154d2370316b06
SHA25614b08e8016fa7e447c324535c130529568da85f22a67679c9310593cfa40aeb4
SHA512149be886c21dc306320b07cb9135dccfadef67dc45481e6a2719f4a39c77ad0112a496f0ec788b53410053cb220d23be4b31eed03f55a7bf7e24f4817b2342d4
-
Filesize
5.2MB
MD54c5ee392a6e2b1dae5465e0c7f985ee4
SHA110d0e09e88fe719b05bfa86406b8350f807f403f
SHA256ebd5f468641eb55ed245737f84368160771d6f8ae9f9a26b0ff28f254a2de586
SHA51218a275499cc19090920f5199410fadebe574a6a17de550c09ef8d9b037b5794d4150f2bbd505e8118f960d1e9b18a907bc08f0d1ba4a87bf42d816921c16ff68
-
Filesize
5.2MB
MD5f2d653f9d4d271b50685b903a806c62e
SHA109c7667359d1ce74088d88b2066c2300776b7f58
SHA256307126cbbd44c160e19b332da8d9e5ae3034a4e5ff0688f3397e0aee39976211
SHA512cade60269da59f1da64f6af6a97d3a1e6eb0ee8fca5076eab2634b3c4299cced2dd2574f2bdaeb17d5ab5285796349ea51180feb9687e0d1c85edc290586f1bc
-
Filesize
5.2MB
MD5554958bca5ca1c6f19b7da80c6dafb03
SHA1258e59b47a5ebc393569f13cf420563360d56049
SHA256e9043e07cbd558d91a6f318e8a04e1d71e39fd3d47fe53622a1876ce2b7e991b
SHA512eeda35799113efdcc302735f1c49d10a72ff3a8236ae0ca79c53164c6eb04b20d1698bc215131a63c3e5232c63e1809e463a110c6916326930833926bdf737d6
-
Filesize
5.2MB
MD5dc2a2966b423b6293f9f6e8757fcd56a
SHA1372a899a5b83acf0feac0055334afbc372190930
SHA256edf9a72a48fc14b79018ab58fd08925ec235c91ff2bb4cb34536102d19b3acab
SHA512144d60613be4b449c5f916eb01f4c91d29684d8a370586d4e084931a6e3ff11aa705e909f6cf9375ac3f407ab1b7a9ccaa65446679fe77ad32a22488b846db3a
-
Filesize
5.2MB
MD5cb5afa617950a4a3a99850706aa4ecff
SHA1511795e201fb3dda77dc509e294db9b6179f64d7
SHA256df6b3099e82b53e11c7e3aec4525640343e367217d3bb2295eb18d5f8925a9b0
SHA51265672b3b56a82e4c7ce072454068c058ae8d40823e9dfed2f3470cc934094ea5b4c4c40551418476efeb0ca410463aeb1fe7c3a9f4d0285394b0353f21de90d2
-
Filesize
5.2MB
MD5e4a97490e2f5c7f40f22fd9d4b43acce
SHA1990eeb2e04498770f8ea6a5ee075261c9eea9c4c
SHA256529a298bfa19d355d7a75a9d6382b8fcc83f641d061f19d7194f841bdd7ddeb6
SHA512841d765cd586ed4c9fefb535ae1e69b93b7329e2a39945252b8639d4e83a48c93d9deb4291a59959b0e7dbefb9b74df9a238b08c69e7364fd3b5baf9b096d112
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB