Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:22
General
-
Target
2024-11-11_a2f34b5b72f1d2b387a9e35d2b616f25_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a2f34b5b72f1d2b387a9e35d2b616f25
-
SHA1
3d6cc9e8b70af7eaf319e62148172de869a4128d
-
SHA256
90af0e2fe69322a67d3df713325a59fcdcbe34751cd2716970ffa442215ae91a
-
SHA512
155e6daf21a4df17137f2ab4534129446feebcb089ec2e3b1dc9bb648bdc2e2f0868ea43f8c7860c1852c162d68ebaeeac52963ca672192b78740cf4fc9e7d0d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_a2f34b5b72f1d2b387a9e35d2b616f25_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_a2f34b5b72f1d2b387a9e35d2b616f25_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TDDWDVz.exeC:\Windows\System\TDDWDVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPzsVYV.exeC:\Windows\System\EPzsVYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcYiaQq.exeC:\Windows\System\OcYiaQq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaRhKnN.exeC:\Windows\System\VaRhKnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZxjLqq.exeC:\Windows\System\rZxjLqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oJkKSrY.exeC:\Windows\System\oJkKSrY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyPLpSk.exeC:\Windows\System\oyPLpSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlPPwGg.exeC:\Windows\System\AlPPwGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFyBDdw.exeC:\Windows\System\dFyBDdw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bQXvhBD.exeC:\Windows\System\bQXvhBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Rocjkqz.exeC:\Windows\System\Rocjkqz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWQnOmy.exeC:\Windows\System\tWQnOmy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCOGJAz.exeC:\Windows\System\LCOGJAz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IFlDXFP.exeC:\Windows\System\IFlDXFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NrEdEpa.exeC:\Windows\System\NrEdEpa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wJPXjQZ.exeC:\Windows\System\wJPXjQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aIzvMeA.exeC:\Windows\System\aIzvMeA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BCjShvq.exeC:\Windows\System\BCjShvq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBoyYNM.exeC:\Windows\System\KBoyYNM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\haazONp.exeC:\Windows\System\haazONp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LhdvrnV.exeC:\Windows\System\LhdvrnV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ead3c76893baf1dfb8ee9369d662b38f
SHA1c26d66a8544cc7f1e1c432028aeed95650f19e85
SHA256e4ed76cc39c504c3a7cc1939b2389f1297dbe6e90bf25e938858f71bb7ef10bf
SHA5126c45ef8833be0062dfbf5ecd9e9910a39394f323b07af148c28420f27c7efc93cc93dbfabecbfcc433341114523aed0786352a4cd9d574fa31d80b5aaf95f02d
-
Filesize
5.2MB
MD5a3dccc44c1ab0e28ab861be1fb3b155e
SHA16ea430fbc207d9d2527413f48c141bef1027dd32
SHA256ceaa36ed1b596af565c4ea2f867a2fe21871daf6cb6f1bf2f01af488f05496da
SHA5127792aa8c47c5db3409ace694c90bca134a2c5775a80d7d836c758731233d45a8c56baea50e258379d7b77675b4d625aaaa374e748c76bd60d5acdf853c2d7701
-
Filesize
5.2MB
MD56ac0503e4780ac07f3de9df1874ccaaa
SHA196d2df35f16d58f84b389118690defcf80b57190
SHA256c08b1a00bf542dd7ca6b6f41f091df3ec935be4be75430b927fd4d47cadb4f85
SHA5124b2db608d6144a366e38d4258022614f37b2d0188d30ce756959e4ba8bda7c5f8cb5bb9e0ebf2786ac13c6d3f0cf47f01fdd4d6980bdfcfd869f1169b03ec904
-
Filesize
5.2MB
MD5915538274f9d4fa7eb7aadbe89b1bd49
SHA1ab393589871da56f10f5a076f6f2282d46e08b51
SHA2561123be22c61348522324205bba437bc7114c554e3328ca0889a7c04af43abc4c
SHA5129dfa633425de8186cafc943cc2b9053b2ef874ff844490fa28597124c46c64c69201c86d2c02e14ca719cc78910f13731dc25b6602a29380a786ba40d5ee25dc
-
Filesize
5.2MB
MD58a286981a97c98a83ef55a617d092a98
SHA1db781531746a57413ae643f7c6f1cf1ded12da37
SHA256846846d8a2eec27e581b0ab4e7b77890d116a850d84c109c67dc1cbe3f0dabd0
SHA51218aa2c9973e60779bcbe696c78c5a49bbb5b0fa6954260afd02a41f85378eeb955e2b2fc54d053b59605fb165ef7ab80af0ed77437f60748fa5e423602e1c135
-
Filesize
5.2MB
MD532566089f4f3752aa5836dd0c2dbf328
SHA18448f6242944b41bbdbc1af47a137c205a4169c0
SHA2563c13a5f624e77442aa055503a0123eb9747f28c011b477d81cfb5154eec045bd
SHA512041abaceb0877aecd9b5fdefe873b7e3cde94a4b718b2f6cecc3691b93d44ca69b31867532032963747336d440a208dc7bea45f99e38c42dc4144a62fa505b4b
-
Filesize
5.2MB
MD593b7b0d3adf6f8ce69be1b00deda5565
SHA12648e3d8688e3aaeceb3c1d0f21c1c2c5815c8bc
SHA2563ba7505eb19f685388b8e0a7b97ab9e5f183cc1c93ecfe061b996e94e8668553
SHA512e5fab474200bb57bf5945c4a9f68b217d0791ba59d6a3536349aaed7c6545e58c49c1981f77d07b16df5bd33ee9a9337b3598e0d889e0019d69d37ed81ed9d15
-
Filesize
5.2MB
MD5a735ad183cdd02009b02e3ce4611c910
SHA1b497b76545cced785ab41e8eb927487566dbe2ad
SHA2568b2e995cad210d5446a78cae406c855283ab489e7865fcb03c82e7e4022581b6
SHA512044f1149b266b118f4344148c98b54e0d1438205cd7e27fbf88f0278c749edf68dd9b9ca683ce2975b1c0a16dc9c221467994782b94ea224f990da48ee60e20b
-
Filesize
5.2MB
MD5efe5f0264181a17a37507673a71672ea
SHA182bfde9155b15cabd76f3d2d4ec7d94aa3be9d40
SHA2562c9d53074822ba94b4cb6482e798f313cebc23f50439caa6d7a08f487bc13c7c
SHA512fd151d27bd0df78b852060a1136b5f68ad68a4f3c8009da412188a32f4cb9e80b553896f626625016cc93746d6692f1ae54e5f790d8fca93cbfd41f5c7e35adb
-
Filesize
5.2MB
MD5864215435c07ab24e508afdba38387b8
SHA18f8b22f53ddc4e117d84d060abc494ad23e2321f
SHA256e4210342e5c1955ce31f140b68b9f5513a1ea7e82096282ee6a31e3549f719a7
SHA5123e2383c346a8b8bc837b3c7e8dca85d9f42b91fd18e237c185e7157938649d8c4e65436b85ee1530d27b166600c27fd2a7dacff1bff0aeef056c0fc985f30136
-
Filesize
5.2MB
MD5713c4cb2ec85e3edaf0d1910e63192a6
SHA12ca9ec3578f21fae5831f424c23c5048c0c3e67a
SHA256bebaa48385fc52f65f1f77c6b94d7966071c050da5252ea1795541382a970064
SHA512c5aea2fd70521ed2379c86d856ba03af77c6626866af30fd02bed89f05ac16ac11b7506ef3dca2aee4919e71c2ce0ef5dfdbff2b83f0e01a23cf64f6fd00e40d
-
Filesize
5.2MB
MD5f9df9c676ea0b4f226db814a5c1f0417
SHA1c4453949e7c663985830cc17ec0d89e1785606bb
SHA256461190a863829dbe7c2010a6261eb5a2cc4a24aaa7df31c383042813f67eae06
SHA5129579c69e056e680ff60b7b0fc0749f8b1a8118f4a5093f240a0904117e39b697b190bd19464b74d0019c31c96252751c3fea27b49e814b341ab6e2a7e3777c58
-
Filesize
5.2MB
MD505220c8932a94ba2ec0e232d5c425dca
SHA12602d4046a69b421780505d6a595e3ad5f984b5a
SHA256ba7551c774737a9f871d8bff6db94d9cdb0478d4533967e1d0a0b93e7288e3ab
SHA512112cd3c242f80a1a07cda54e87e3b933ecba7b10eb63dc359de611f0fe2852446acc0bf7bb39150f24a9f540d677a9ee8371039cc5c5dfa170de7008d36e8e73
-
Filesize
5.2MB
MD5eba4a1007ad69f971a235df2b66a8fa6
SHA1889fa00eacb31150475c35e076b2e1a690703de6
SHA2563ead3d7c005f9bd3e1bfce911480515c2e45c7f951a7ade162f3b18c704a4a8c
SHA512f4022ea12217ea0b163d86b5290aedbaaa41a54ff9cc656789b2b8c2d4e9665d02feacb591a643dfcc2f93a936a57d0b0a6c5c9258f0363a08538bdeb9350e38
-
Filesize
5.2MB
MD5e88ddff6e86fcc3da6bcbc64cb97daa2
SHA1389f6288fe373007772909ab9dfb5e65803695d2
SHA256d0dfd0dd76ccbef606246ab9beb99b10865e4c5d599302c5afe804baae5d91ee
SHA512aa165a6df38e16349bcdee07388f633f730b9fe981dc37a16bd666193c23eb136be3fc6c53225502a18c269b090ce83c0a9514ea4e12341c8eb3777289106dbb
-
Filesize
5.2MB
MD52012137c7c25e99d0c356d316ccd56ef
SHA1e0a4b317eb94fb1eb5b9cf153b6fe1ff57a79500
SHA256ba600a26a2a647965da4ddf27ce2243cd7d0c77ac84d2c51e2e16d1e98aa578e
SHA5120b4b0d1dae27f6cb2ad8c3ce51b50bc0a4b7be76fa07f67e015e28db01093cb8fb4a0278dc7b8081277dd482b4a0d5a9b09da8bc5f292094ad3a2cdc65db6802
-
Filesize
5.2MB
MD52992ed0be030b12a76b1bd6598bbbcdf
SHA1240c9915f3c1ad78dbfa93f05a49afb3d44dcaf5
SHA2562164fc97dcf1d7dc82c0e6fe433bb8ea812e8dd10188f4dbca809ed8758e5a87
SHA5129d91c781021b6741400d123b028f316c4cfc2192d7ed940006820ad4cd72a5d88c4524bd1956cbd95963af7813dd44a13af80e55067f604af822d12f388e68a4
-
Filesize
5.2MB
MD5be977659b14888a812f168f40c2dc4aa
SHA1f8f7113bf960d4fa76db97628a687d9939387574
SHA2560b7434c25ab1c4b431bae2f9ab7096ccf5c42eec67ecfb6af1d069cd866b6bd6
SHA5125b9fe93abac7b75e2985e53262a2c1383df75940c85d45e154c2579c8c76a8c524c1b1fb98b4fc26b9e738f6254196ee940d4166218080b757cfed7b238c1a74
-
Filesize
5.2MB
MD5210c3ae70a66c7b8436bbe9dbc194880
SHA13e66f2e6bf0ea5d6ba2c88e1c238b82730f28019
SHA2566b6618573263c2bd9b4a18120cdf19e200ecd1b3216c4c1e57453a6876469521
SHA512b31c28337a5b942bbd412a69dade5172a7b6d35e927640020c5fd68141b3f0b2f9017b33a8e103a2981eb3a152b5e47c3a32b8afff2d21c0c009995dfb6389f0
-
Filesize
5.2MB
MD5ad315d87b7847e82c7bf20a4422322ae
SHA1fa1d68bb0d27f6143be84279a033f564acb5d5a9
SHA256f1f48e5acc317c59629a11ec853301f49cfe2fe8e7789845618d50cd1b09dca7
SHA51213a5782ee5064dce4d4b48aab9f563d1d3f26542098c38898ebb28f0ea1de57a2efec67166a7b2a6faddd0a213f76e4dc301ead8d6a29f41c8d079e9c5633f8c
-
Filesize
5.2MB
MD5ebaf86217aaa1e4e5515a23d46af2163
SHA11cee2b9e40a78f13fb4c6ee547a7d84f9b3b9521
SHA256095a2d428aac34ea27db3c2aa007636f26fa745822904a0574f28db20da37e2e
SHA51211cf7765cf2804970e314b9fb144e6781a302bcd5abbdf7b8b5917630f9e59e067a8d483edac4fa4efdf15131ebc4a94d02dba9295a016dec8180bb414cf8cc6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB