Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:05
General
-
Target
2024-11-11_6c18a2b853ce2293145749434d6dc4f5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6c18a2b853ce2293145749434d6dc4f5
-
SHA1
381243435db07785c21e9622c3540f3b081e4d90
-
SHA256
8aecbd294377851b00c0929d44252aa2ee0fa0a16a0effc4a6e8746ff220a97e
-
SHA512
54dc5f65c051b2e0a3fb32276a7980eb6dae5752eadde84324b4c252c0b11391315602b86aec1a5cd1ec2bdd5527bf8ec65e2a2a9f7f9cbae2bfa186588a8d40
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_6c18a2b853ce2293145749434d6dc4f5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_6c18a2b853ce2293145749434d6dc4f5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uQGUsRb.exeC:\Windows\System\uQGUsRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RKgeCeY.exeC:\Windows\System\RKgeCeY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNCjGoc.exeC:\Windows\System\rNCjGoc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cEgJWTI.exeC:\Windows\System\cEgJWTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\maDwfGV.exeC:\Windows\System\maDwfGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XFNdWcO.exeC:\Windows\System\XFNdWcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmubtSW.exeC:\Windows\System\bmubtSW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrWftqt.exeC:\Windows\System\IrWftqt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCIglQp.exeC:\Windows\System\nCIglQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GoYczFg.exeC:\Windows\System\GoYczFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XtpgmDe.exeC:\Windows\System\XtpgmDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AhPWJYs.exeC:\Windows\System\AhPWJYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpNBcAq.exeC:\Windows\System\zpNBcAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVsumeh.exeC:\Windows\System\WVsumeh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkJAHPS.exeC:\Windows\System\nkJAHPS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwujFWN.exeC:\Windows\System\gwujFWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWarQdQ.exeC:\Windows\System\eWarQdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVEExIN.exeC:\Windows\System\kVEExIN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAiGSlw.exeC:\Windows\System\HAiGSlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdDAdmz.exeC:\Windows\System\OdDAdmz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QoWLNTA.exeC:\Windows\System\QoWLNTA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD543788fbe62de2d5405323e6ffe47870d
SHA1a612dd05cfa061ecf4f1cb1ce67f4fccf31ee75a
SHA256f1ea64f6e7166d9b640195bcff49db4f76c8a27ff249f6cd65fddd63710ce512
SHA512b5284ea9952ef8f40d622efba06c82e523d6d0a1143a0c3e561e411ef69d3b2f015cce6a0137393bf5665747e7d15663000fafb1f995283ee2f66478df32d0fb
-
Filesize
5.2MB
MD537448c0c232a4b0d34fc0d4eb64965c7
SHA10a202d91f99d5d6bf61bcb225eac9902f2ed36ea
SHA256362c15f43ce9810e1183c603490efc4af4526b80869dc8520ae4572b151d3289
SHA512c2cdaada1c8aa92650a5d29b454f4de646bc0a925c557eb3dbfdf8699a9155b114453123825443d316d50a68f89d9b5da0c5393a556492627bfcd1b13596b259
-
Filesize
5.2MB
MD5dda8d3b9e280c87af8ffc17af65c2b1b
SHA1392a9c0640216b3ec47b2f125e00f738e7aab7ba
SHA256d93723ad0e3700935e898d06146a36cba2e131b62afef56a6920b2549f378be6
SHA51230bf03dcf3a6ab6876994441694f92d50056f9e0d992830a2824530c27e368d802de921f242d03d4d82fec70b6c9e227e1fc91e1f12c35e79be987236a246ac6
-
Filesize
5.2MB
MD566e094638494b69a5ba60726c9df0721
SHA1c6adb2a6cfcd94399b9de9b69cbf362336d4e5ed
SHA2565789ba60dc624ec8ecd6748b3e351fd5ca4fc30410ffa0d353a548b8a68a0c75
SHA51281904724d9a87f96240f700a2388573507a94f88867391dfd052cbfa76d1f35d5471997e53945e9813faa9fe7e427175364c2000cc4ec03db65d548194530af0
-
Filesize
5.2MB
MD5ea25916cb706d4b78bc17fc4841f9953
SHA19dc1a29c9b1530328209ab7c4f6ff1b6c89d94e7
SHA2567ea78a65134bb483a69fca06f5de080f5d1b16468d1e89dc95d96a2fbc46269e
SHA512b13451d64bdb0a7697fb59932b12307db3517de6ada1b9046350c0374ac080939b4a6a3dca293788035c66685c45e23baa4329620bbe553e1bb6d3efcbc3778d
-
Filesize
5.2MB
MD586d5e49357f7c0cd44f0f3a89f155477
SHA1f5b780eb587955b047d532fd840caa974a51f23a
SHA2560830402f788f18bf5b4d9e8d0a289b1b5729dd6bd5c36c88a1fe181757803220
SHA512ac1134c429bc8d62c1cfcdfe923331ccca36020d10e9721ccf7ee78ed1731b9361531dd8d282f00034edc4f0ee71c9602facb3ad48aaa0708dfc570d32bf97aa
-
Filesize
5.2MB
MD5d4fb00b07b6daf8476276cfe379e5eea
SHA19679c1dce81b2be019685952c314dd8d4ffde5b1
SHA256903833ece59168d7849c08a70ff5af5d9e425ae00a9e7510deb8847bf838bc1c
SHA512b87ef25fd5dbcb95878c9bb94418ef4258e2d05bee6dfdb08294cb3a4c1f9e1f209ea9e89b819d2261fedd6599c604b284bea36db46697bc99d951c838d1265d
-
Filesize
5.2MB
MD519b611c816685714f7740945907c1200
SHA1f620c363cc2be41e0137d402b7ac189c93bf64bc
SHA256179e2854fd7f57df1654915fbdffe5ca04099c69096d64ea0036eae3d740cf0f
SHA512f89ee1045127bd0d0f976b0e82a855faad1c5c18c225c9e8f65329eb976d6cbf27316d55faa539e70edd7fb9be2f745c92fa54a42fbc1368f032c2eafeb7b1bb
-
Filesize
5.2MB
MD5c6af0d76c70c5effad5e3d9bea591ae0
SHA14407d92812a7ca8e8f82d3daeaf1ea77616e4030
SHA25695f4a0d9f49a1c4b08bc87a1d889e7a3be8ceffc8cfc08a570a86c3c602acd0d
SHA512e0f8b39e2425dbc4814095a66670d1ef1fcc70611f3b27657287bf686e4e3e72864ed8c041cf547dcb2b64dc5c14132b90e5fc8cf2dc4c73a03cec70196f3b28
-
Filesize
5.2MB
MD54f4d071227e2aaea248f4633b73de05d
SHA127569dade78a71fab23784e01c58e0033f2dde43
SHA256d8139a7ed1f7f6b671f662ddc1be09735f3e2e4ea4530e30e4ea8e5d9e4f2040
SHA512a5fe0a0e274a21e1535947d8d1b3bfad53f0faec62a8587004dcf5c75023bd9a0ff16eb01205c562ae55416aa0e05fa319335dfc1eab14ef2c90552c2ebdeb2d
-
Filesize
5.2MB
MD54d1ade437fac23b89ba66fbf4bfb27bd
SHA11227b03f2074f49360338e893c0f69ee63d5564c
SHA2567e9f82925d0cc46c2cc67eff635e660163ba846c921105d9f15c0b98db90addc
SHA51297710ef314fd63712bb19c117c6971a64b093e7c5cfc64280b48caaf76128c3c5f675811bde94c129b74faa38394473549a2d949c9a5dba7355001eb839ee1f1
-
Filesize
5.2MB
MD5998a2ad4795049d3ec02a94684d27669
SHA1d0f44174a95682bdc1caa41220f8c13e12fd5f61
SHA2568099a20195b3c5fc9d1844f6830ed725da22d8d69824f875924a41d23dc86f8d
SHA512d9ea18dd7a96f699e01d849829a73935add3b1f995e33a454c8469f8dd9022208388b730eb5754e6239ffce219d8583d84a2d97e21c377446ae327a8ff618ad3
-
Filesize
5.2MB
MD5c1e80a0c8b973134d71009d1eb360b4d
SHA182d401a0f6559c16020527fd6135df2c22cd4f6d
SHA2566ed3c4af126157249a0d4734ebb0ed3839108f47263a28511d40954c48d8b855
SHA5124fe24d6b75d5d0085a15557aa94cc37ce9fd6e3e6abdd778fba1bdcbd89180bfa564bf8cbb72fb7f37d892727487cd728a21dd0849902bc81743eafd5cc641c2
-
Filesize
5.2MB
MD54c67463697520a7f05ccaf272d18df61
SHA1e3bb0d4388190ee16770453fe91db61249e888b7
SHA2563f42a4af93e2dbaef2d3ff12516a8c125e1230e792caa3457f51cebea5553cc3
SHA512ac5f42dc645cc42c2cbe82c5706ab005bb5e5ddb2b8d61a2a73bd771820b425f9cd1b94dfc01f0d3c63a8399c32dc3ed501682bfb0264e5c03f56d43cf59bee7
-
Filesize
5.2MB
MD510284af51440d5023dceae5737d71005
SHA1136a6320e886e203d95df700c53b8fc766f34e82
SHA256d3da649603323309ad88d0ce3d4987f07d550642c71297a64ecdd3331cc4508d
SHA5124f24c9fc058332a492cc03bbb3de7c152bdd5b3a3af5303298c05ce0fa713f54ff3f8dc260dd4f8b3b31243918601b1bc8cdab2dedc25b3d997e5bd92271a6a9
-
Filesize
5.2MB
MD5cd667422ef4862d01c2f9a2690d53859
SHA157c9f6169510632bc4778ded9598396e6cd5d6b0
SHA256e3b3079f64068af8ec8c513a96a1eb1870ef2c2de58a46a7afa49cd680b4ba27
SHA512ac3a59a96160b6de1dfacba528f98e68243a476408802f0cda0b29e4ec1e63c5f6770fb0a07793684f1fbc9679cdb10e92969951583e221e1fd9f4eeab4077a6
-
Filesize
5.2MB
MD57e345272dcdbb4f7a0545d3cc7e83120
SHA10b37985c33421bdda56ac34024a428ef99e7f5db
SHA2561e03ac0538cd287b25a776bd4c5b019d89310d9507515ca20dcd99c3ed729791
SHA512c6d970e5d0ec7c9baf0f61bd0c2701a0958a498a134c6151bfecc8fc4372974f66e510d588cb47ad57a083fcde856eab37527cfab2397325d0d52664fbbdf858
-
Filesize
5.2MB
MD5be9d51619a6f39b062c1e44136a3d20e
SHA19d619fed0a550061e934c7fdbd232513069bb766
SHA256e2cca5a87e063fe0f0716eef2610ff539cdf7df740016db452a7e45c8ace3ccd
SHA51249b5da8933ba31a58099f0298257d64357ba770f2edae48a62b33ef74dfc8c19578e021916f2f3f2c5b0654a04a83ae812a9ed51b4ccc9047a06fa8c726ef036
-
Filesize
5.2MB
MD5f5e12af57908b4bf518beccac6432dd1
SHA110d304cf177c392b827178392a42de5159646129
SHA25682560ef03a9b89ff90b3494534a5626a0efb8adaa92a45551198241015403cae
SHA512e5c4e28f20bc7cb5a8f4aff6e2309f990690c13a43b34b2c872e69f360584ab8276b3913fab9645731a09e7c99ea91d7118d67a03ed7249fcfed34b078fabce6
-
Filesize
5.2MB
MD521ce7500c78d6bf6e22ac484707b9173
SHA1fd8d56e4bb89165ccefbfde8fc6064e9ae08e055
SHA2563f7b6f67b9ee8cb1e3d989e0afb0cd10afa2626557a9c7d096dc6ec44694e26b
SHA512ecf07a84ea51aae4b61e4db955ea6c2ba819cc675df23b98636093173166bf323ca0f5f0ecca6b3fc1c037d1d2efaf051b242703d9b0fffb1bd76c8c533593d1
-
Filesize
5.2MB
MD556f7592e8dcf4a46f779fb7be150ecb8
SHA1627f9dd5cbe5b141df89691e6d9a271972fbb57b
SHA256ab3e55e1bdf564366743f63d1339de11d2e4993e4ee86451d6af0f5e3de0c4be
SHA512336c68f73be0cb5ff6a8215e3f673750972d38b9bbaf6a87d82b880b682ddfe3174e281612d5bfd7ec443cfc456571980284202cb4434699416f4c9f93542738
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB