Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:01
General
-
Target
2024-11-11_4775b52861c72d4364dbaf393d2d33d6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4775b52861c72d4364dbaf393d2d33d6
-
SHA1
c43da631e6c63eb81af4fa4f2168ec50dd7dd03e
-
SHA256
cb3249c1e4ae6229f184b6b4cb6f0a49c2a3db5f54a10a71aaa0bbd86b7f6753
-
SHA512
62695e8a49920bd81f70849882e94c943324f04548d23bbabb5168fb099e1629cdf9959aff0de229709211a91f8022c2bdd3d830ad6761d007bb127f77a4fc66
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_4775b52861c72d4364dbaf393d2d33d6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_4775b52861c72d4364dbaf393d2d33d6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kYnDKQd.exeC:\Windows\System\kYnDKQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUgpivL.exeC:\Windows\System\IUgpivL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eiECtkR.exeC:\Windows\System\eiECtkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cRFpWbX.exeC:\Windows\System\cRFpWbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvDGewt.exeC:\Windows\System\JvDGewt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwtmYJm.exeC:\Windows\System\mwtmYJm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YkGTnJh.exeC:\Windows\System\YkGTnJh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCfCxSu.exeC:\Windows\System\oCfCxSu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GaKKeBd.exeC:\Windows\System\GaKKeBd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DOVSAyX.exeC:\Windows\System\DOVSAyX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCtxrJQ.exeC:\Windows\System\FCtxrJQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxjNviM.exeC:\Windows\System\PxjNviM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MUUqSSb.exeC:\Windows\System\MUUqSSb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzBufDw.exeC:\Windows\System\jzBufDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlvpObX.exeC:\Windows\System\rlvpObX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HmutLsX.exeC:\Windows\System\HmutLsX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oesbBBW.exeC:\Windows\System\oesbBBW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVVLRHE.exeC:\Windows\System\fVVLRHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FeoULuF.exeC:\Windows\System\FeoULuF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeFdqHD.exeC:\Windows\System\qeFdqHD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mCWdtnC.exeC:\Windows\System\mCWdtnC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ff50efcee16d9a00d33f71d556cbe064
SHA1ba0c97ffefdbf06edbe4169e360a563e5ab202e1
SHA256afe1a91b22d2116d06e2f2b6edfa2d7f11efdc0d626b309da292900dc1709c13
SHA51276e4078478e7d1394967be9e78069bc58cd723540f679b35e2ccb8d4ad45c185246f9c0169c0676279fa04b3feb966766a16b1fa47b63134cd4e41445d8443c4
-
Filesize
5.2MB
MD53b8cdcf610d481fed5b5b4094503c2cb
SHA156f5061e5ac10fa51642a0e006638bb4b981ac39
SHA2569bd1bc6e23065c097d495d4b5f0bbd5816b602ac8ede4a40bd1523d467f65600
SHA5122b2a2762df9f4bdd2bdcc22d501161c6b2fd38935a15b24d67fa8ae12a01038de8880f6b02f86aef530ff773ecc9795cf12f206ffac82761702d3e9122dde9bc
-
Filesize
5.2MB
MD5472d5824d96f3adcff9334ced85a9e8b
SHA1b81e92b034c555cd581662400ea76e9f50481269
SHA2565a01925b23c603e6368bd261fd38ebee7182ca1e9dfe3d9a93b0ae83806c4b51
SHA512985cba0c7270219a78dd6ee70bc99de8ad4855e85cc2d6b3e5a5299a0a3d825a627ce30cc09139fd20a88be631a97d1081ef41dd6c4cfe5af8e712243e146ad8
-
Filesize
5.2MB
MD5541428388ccb532e3275aeb0e0c56c7d
SHA16084deeb52e5012e5e9dcc121bd0bbf0188ce4e1
SHA25661ed94968d67649979eaaa8d093cb768f0b59a0bbf20087ddd53d455a270da39
SHA51293c24d04b01ac259b6ca3ed38bdbfce55588169af147885476db3b27f96869d0fd65a4a3d4fb258c21c4ff80c1a19d71fbfabd54227ac1719c0c97cbbb17acfb
-
Filesize
5.2MB
MD5e27054c36e13efb652d1ba4c19e0cf07
SHA1ab7ec0b62619f6d6729296d48641cf6d4016ecfe
SHA256db2729c7a550a5c9d0b30db1e85b70fad4f73d88738e25038c2ebd7197167864
SHA512dbe22b954855f064f765ad0829d5900da5a36c90c8517a3c1a99511d9bf4b6a560dc636dffe855293f5af9020e2199ff5a2e8e253f9cfbaa818c6082d47c0b97
-
Filesize
5.2MB
MD5e15ec56f89426d071450ed7c97f16c97
SHA13f94325bda0b28c90c094d5a8b67650b8aec41e5
SHA2560f53e59959a31866ce759bbb3316fd9537e5417f81b961701c0bd1030d249563
SHA5127c0069713bde3b79afc201c4febc9ebe2a114e93e7912c9f241bfcb8969e32a12d60f03ac010ce1c1e8865b898d1358cd245bedb6157d3593f042794c45cc00a
-
Filesize
5.2MB
MD5e0361d953ba9f033d1bf28a850fe37f8
SHA174b41bf7e294cd1847e41bebb4547fbcdfeed677
SHA25664635ec2fb3a417790621ab1c93f89374669bf2f3893f1af9c616a6825d775d7
SHA512c6c3e453c70b47c4b9ed1c5f63c5bbec7c18db78dbb6c0f91f75dd5d29e2954e469f73400d0ccb6dd6275fcd48db43358d125e2a2d7d16f62bdae95ee06efcc1
-
Filesize
5.2MB
MD5d31c16634393af3c9aa7fd793e92f59b
SHA18b0c3a039197fe700439db563a936af4d5c9885c
SHA2560bcabd08cf91f31d7331458828f32d1ad1eb67d07b7498c3d3008d11890536ef
SHA512b76c79c51638d7a0331cae69ed74e9423da8cc689d17ebe54c84d0aea63a8806bfe0ce0f64a1b0b378ecbae63b3eae7db2aff940a24536d0e050f301207f70bf
-
Filesize
5.2MB
MD5f46563eee548947fbecddc953d8c9d7b
SHA100c797d73f9bdc103fa4f8f4929f9e6d80a34eec
SHA2562c27f0aa9653acec752c4439dfde73c48f69f1e6c5291ec2da0748447b07293b
SHA5123c4f63631e49c30d261791504522429c39d29f1fd4740b38b46f07fff797394b7abf494ce06ce9ac4d582581991c5e6d3a530c915b4153f0542847a467e18b0e
-
Filesize
5.2MB
MD5963d1b11ea2180aa5a525fe7ceebbba4
SHA1e5a621854770c29f69eae1445337199f5651f3db
SHA2560ca9fe5c8b5cba676578a688fa770d9cec417ea0d48da5662e9b4e48c7b4d390
SHA51259860588abd5c14e5ce6a43f7a46954d3c77dcdb098c8e5786821ea9d4a41933d7f641b9eda0f48504a60fcc85734c887233e644183ab5ca0f2cac37d97b0d97
-
Filesize
5.2MB
MD54e41ee8851766251d2705b2ee6d11c26
SHA18de62de88a8e0f24894ffcdf66accdd345021356
SHA256cd8b999b419d69c7109b227ad1984b2232b88fc43b9e04bab7961e16f1d64f47
SHA51218639b3c422f92747720656b01336fe9e2f590c2311e474144fdec5496a0a79864a5f974a8e25dfd85f0a666fddcad3b4710f428279d9d7ad638ebe8ea862d3b
-
Filesize
5.2MB
MD53932a951a5ba09f7c53c0d0335891e61
SHA1044854b1f06cfafb6cacb61c3b9cbe1ed85a7a52
SHA25645f6083a357f185e53fd9f47f849a926ed0f6b44b287699e07135c014a1a9f88
SHA512bbcb786e04e62f623c8639280e2c7919d0e4d3e91836bb2787838289de0b35133db0d9aea3851d79f2534e52540970b89924a78ccf0ba50b5ec6724b7a7d10b7
-
Filesize
5.2MB
MD59b0ebfa75c2d6aaacc3bb42a62515915
SHA165b751ce6585439e033c9112059513ae7252be94
SHA256b757764214c477127167f3de3f0dca8dbbdeb516d8be41f27299d1112cde6add
SHA512b87eb508dff594cc6c747129a1afb2a48046031a4c73fa8e7b49ad18378eea8aaa2712a37a3e2cc7fee1b22bdc46d836c04d921251683fd01b80bf0c36a49193
-
Filesize
5.2MB
MD5af78e7581b021541faaaa246063f1751
SHA1329e0052aee3e87926cec8357f344b9b40b1bcab
SHA2560d3b9adb02ec23e591a2bab9da96e8a2a2475197db4a77ce41c8b1f67f17d68b
SHA5129c84df17f1b7687bdf259944793ceeee6892641ab7b397f30ab4a61f17fb509c9c4342650ffa691271c0750d9de253afcd7a2e7521ac1ede5f94113fcf76882d
-
Filesize
5.2MB
MD55e2f000ada0d299aadce6fa2c36ac04c
SHA104c4f8a2a2343d7c44457ab8d28ecf7756843082
SHA256bf27b555d373f65e303147bbe3aae4874886e99fb81e5f0137e0363e83d59487
SHA5126e513c0f9e590fe527de2e12d245083fa250503e07189e6843b9bc2ab6e31493515f2abc41e375d074ba8ae6a9e7c52507a5b179e58b7588aed352bf3482c75b
-
Filesize
5.2MB
MD56eb8ff138369fd8bf7a4361c5a3d7d59
SHA156face77e21d899b704c99478b5e5528bcf7f4b8
SHA256c05f70dd187fa3c42772a3c97e0b263937d659d86240bfa7fad3c9f8cc74577c
SHA512b65f1810eec9a54d3be91b294e529016bc4f34a19a4253ef620888c957f58b65710afae8859657ec502d6e25030ddc641f16a9c8e5eb5b72ffe7efdd0ed4deff
-
Filesize
5.2MB
MD5afa8e5d2302bdaae51d0f96b361d4db0
SHA15661b8e87381b607828099327e4e95124849e4fa
SHA2561f740dbfe3a968a8b63df678b9e1810ecda86346fa081bda429d6db07c123c2d
SHA512f872ccb6f8a41f0aec08cedc8d491a93a6dc4b51329edfc47af6c1941dbaa9ae00cdcb80fc6098d4e45e805fb78618a615364ebef881c34037a9a92c66c7b5e9
-
Filesize
5.2MB
MD51d31d15163fa8d6bd7872dca7aaedbee
SHA16f008939cb7fde2bfb62453db58f04a26a0790cd
SHA2564742e6b73af87173ff3182d0e60cdb5836f3af2637452cf14eedde0fb07c16b4
SHA512ea6de94588befbb5a0c7daa200754a468fdb81fd1a32553c072dc2c7fd7feb8fa22e02f0abcbf9c064a2292f1f3ad8591ad2a1f0bc89c077d20c9a0515bd87fa
-
Filesize
5.2MB
MD54324dd73aa4958dbf1e28d416aa5c9bb
SHA13cafeabecd33c65b71bb7762b657c352b836c61a
SHA256b5352af50606c9c076ffee282d1ec3584d0cf79bc59be333e30cbf06b0e41875
SHA512aee4ab0347bd5581b8673356db4e9a53729334ff0ee9d4ede9969eb23bab021749d6f9d1a8a4248dcaed5d8da13074fb5402e9f7e736ce7327969fcf73f572c7
-
Filesize
5.2MB
MD5d33167385e399c6f383132ea40381e2e
SHA16fbcfd01d2b666dbbc14cd0eeccec41cb17de855
SHA256a47ef472b7a83b151215fa534b20635f6aee5e393d5aabc3bc039405e35ef1f9
SHA512dde0074f0ec5e2e51d4ea50652e7c733d319bd1e0ac43f837ea6d4820434752752c33f28160f82a35c832f91eb65f7f51ee2d2a4c26e3a4248d988c449ad4ad2
-
Filesize
5.2MB
MD5dd17f92031ca96dca470c461f257a825
SHA173600fa4b631a8ebdb5cb837e3bd1f782c59fea7
SHA256d549a0af9bc7a2275fd230138807903b83bcc209b469d003c8ab4e3122c935f9
SHA512cc2b5979399fc1cea079f745a85b4c2cc42d0834c94ef4e39964e37e527cc23dcaf4c7d4f93a30146120ed118e0119b39e765812ece2db928d2200911c4bfdfc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB