Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:06
General
-
Target
2024-11-11_64bd96235d45e802567ae4a24a0641ee_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
64bd96235d45e802567ae4a24a0641ee
-
SHA1
720781fe0b4581cc94f4059430edb2df4741276f
-
SHA256
60b57b4b161faa5bdde560756c8855a6a1bcae122fd1859131b9c93acce8c7f1
-
SHA512
184a6bf927ad1bd097bd84ef5998bf5af9d5ca3635d5aa3b0a758a2fe3ca34d9145798cad336210044bb729016fd502b60d640fce53d22a17ead8ffe829b6229
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_64bd96235d45e802567ae4a24a0641ee_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_64bd96235d45e802567ae4a24a0641ee_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fcIMIeB.exeC:\Windows\System\fcIMIeB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVYYroX.exeC:\Windows\System\UVYYroX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGEIuET.exeC:\Windows\System\TGEIuET.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdFCUtr.exeC:\Windows\System\tdFCUtr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\czydCIO.exeC:\Windows\System\czydCIO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNougXm.exeC:\Windows\System\wNougXm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zTgIxGi.exeC:\Windows\System\zTgIxGi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LKUIqMt.exeC:\Windows\System\LKUIqMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJWzsUt.exeC:\Windows\System\MJWzsUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYDdMAx.exeC:\Windows\System\vYDdMAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WegCgNk.exeC:\Windows\System\WegCgNk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VfOikmc.exeC:\Windows\System\VfOikmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLCHybD.exeC:\Windows\System\tLCHybD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlKdcTP.exeC:\Windows\System\GlKdcTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TepGzLu.exeC:\Windows\System\TepGzLu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqAukTI.exeC:\Windows\System\xqAukTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tcWPnVR.exeC:\Windows\System\tcWPnVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNcReCZ.exeC:\Windows\System\UNcReCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WOHDXHz.exeC:\Windows\System\WOHDXHz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCfcPOr.exeC:\Windows\System\CCfcPOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwMmEzt.exeC:\Windows\System\RwMmEzt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52cacda4277554402cb36f0065fe05b9d
SHA1ce115b01e7315ea3330f99cf8f3d81bae34a8153
SHA2564c15dd4020ae4824b4fa9fa337ca0c7c9b7433422833e7dcc4f3aef808cac8fc
SHA512314ef61c8690464a8f9253fb7d30f0ef6ff5501aceeeb04d0d1fc5abce8ca47acedf588df183fe67d4b583fda1a059c1ded350069e929edc85470bc99f1f7ad1
-
Filesize
5.2MB
MD558cf8e13004d5d08956cf3b39f745282
SHA1b2349382314a1b4c8dc39a44a74e3f6c89c34997
SHA25607757f7b63bd3a56379c48fe07e61b2b6efaa5c42c49febe1c64f7d4374d5dc7
SHA51230b247a1bf2dccfff0c33b20a05acc2225aa96a1f750b7feaab1f02bd2ff68d0b975fe2e46cc97ca223945169aae20418d30914daf7d53092838b434d1e39218
-
Filesize
5.2MB
MD5c1efdfe7bb301d27120b6b8e39a333e4
SHA1df436f3b1d245f232ca1a223940a91e3bae29bb3
SHA2561860fdef8d4f7d5f1471636f4e3762c5c2d3d96c8e292f0995132a1758cbc9f6
SHA512c48e3ee18fc840e7987a0519fb2b8857d39dcaab8b23a705633a33fd70ac8715c2a687695d0ee6d99e1564d80761ebc731dfe029e8483a36b955bef19d8db18b
-
Filesize
5.2MB
MD515f35cfbe288e541909aed84e1947ee3
SHA188b0a1841c53559a12e13d8892787ac9f80f5c03
SHA2563bff5df3216b04227edf9d783f2acdf9c7a79948fd062a0d5a22696c527dfdb4
SHA5124ab237463ad111d9e6e238ffae7837a7fccdd0118af7bbcd25ecad3fc2fd077ab03ca2fdc41801abdfcb26844d8dc1f35e4600224ddd97caf66d5b465d16f84e
-
Filesize
5.2MB
MD5b5c06f9fedd4faa2d7679bc306d408e7
SHA13a4d4a5d031875bae64ca6cc92a325adf27afaaf
SHA256ddfe58827f629a3e2db85f2ce7d30a90f9155fb9a8ca264a14da294ae8d7634b
SHA51248ae5a50c92d55eda895a5d0180ad304b8d70634dc34542d0e168a2e91c2ce348cf5443259bda9ff71d9b73f76845223f05d309e18db37d9af1e898bac2a76fa
-
Filesize
5.2MB
MD50bf2f58f05cbb40d343301168ff72c7a
SHA1785e8e9b0e5434d2fabaf6908d588b993ac0bb78
SHA25684edae6cff2ee62d9eb38b2968e3f5066dca42503be464b4386f1d0e199407fa
SHA5126f0f0de08f2f60689763a1902cbd24325c5942dce48304dccf17fd0221dd5a8eea5bd04ed2d656e049cec94140e7675105f4bdd4d35e8b92aa87e5b477d4f090
-
Filesize
5.2MB
MD5ce9b5e3babd3cecc10e29258f8bae590
SHA197f26472abb2256fab7463cf93c4f7bbc59c606f
SHA25698161d5b26638f4b908ebb6085089516f5619c452144bef639d4d3c53fd82aae
SHA512dcef8a9a6a6bb90f0337f63e3a9ef75370ebe8b42c05ae7702d0fbb9094bea327758ad34a48383f061bbe317e745da87e5112ec2a21c6f35ae6de1b96e4c0bfa
-
Filesize
5.2MB
MD56c187bf8f6299f843b836b3584968369
SHA18b679228a7e21e27963125498cd533ddf7985b38
SHA2564d595fa3c851bab802b6f70b705def1a6d2a5a3146c1cd2c378204025912454a
SHA5124d536f3a5cefac5a07beb1ae8f80df36a9d85665ccd8112c98d2870b8947323ab7058744c46e08ae33086da23297ad8b926f76b292208c30c955ca89b52dcd59
-
Filesize
5.2MB
MD5d1cb011ff123ac7b254049f2f3390e72
SHA1c93e38d799b53d8baedc91f8d509f0dc30c95caa
SHA256c74122a09db7d5300e99e94668e8d5cdf6cf6c60de7a47d028179ddc06115daf
SHA512e1c0f9119ec5e4075d7105ddd3ef67d594abf8e8c92d4c73779aa1a0b2bdfc5f01417f721ab1e3ed75cd6554c3100335f43eb42c6eb2dfe836b406526e7b39c4
-
Filesize
5.2MB
MD5f499a5e918433c22a1415ca11ac45b9c
SHA1d8287f07006c7906156580c82402e20e828f0359
SHA25624dab97c40d696a20d57b3aa79fd38bdb3efe3311076faed0fca32984b2eb8de
SHA51222aa625ce8f9d5e5f6117062b71ef00ac40b1876e0279a44d176f88fa30213fc2d3e0ad567c4f474677dcf9ae4dfd4cddc1b4a6683b2bfdb7a1a12aa09415dea
-
Filesize
5.2MB
MD5ef6028693e3ca842f71fd5da5f855f1a
SHA1c9a4e60c91313986c3fcb6c2fbfccc2e1613601b
SHA25678f84928706c3131ac96541a8188af16a5d29acc7f83841a13f2fbdc5ca3c743
SHA512324c40454c50c4b8a12a2e29330193dda63e0d486cfd46dc97113e1bc12c953f118614268df69b31e697fe6c4b9ac35c7b22d33d16efdbf5a83ce4ede0ce07c7
-
Filesize
5.2MB
MD5ee61fdd4f1b605c2ece9bd0c005846c3
SHA17bb3d9acec172ca395fa4dbb737e9405b806db0b
SHA2564f3b4d18f6d41cfb409a500efe080239f6c5d0c5279198280963686cbe4ba8f6
SHA512908b8c4ae75328a55ff66e2e093f362dc7edfd6ddca023693e98c10066e0b8be1160540ebd97adebf819b7c8f57ab7556a9b9fd17f3259685344022914511580
-
Filesize
5.2MB
MD5376baa017470c1c44293542a8c3bcaad
SHA169ed83bf4d247cd1b682e182400ca5036ca1e514
SHA2563c1123e31ab98c97b18655a2edacb64062793174c4877331842338f6b73e8f3f
SHA512f78b9a6ff222383cd9d73bc283797723501315f853596ba3ac9efd53926548119e9ff92befb23d2402901fba30d58563360e32bed6fee8c51437f6aa78a73aaf
-
Filesize
5.2MB
MD5af85df1abee5fb5494cd07ba8ac8cdf7
SHA14f058ea6f54a5009a00c0a1a13fffd34504e72ae
SHA256283a32f9e5bcad6a8ca2b425eeede0b9f7b88b8231583aa65920358771eb73bf
SHA512b166ce26610eabe1423993dffa7d8d72c6d4dc3630343acb2fadb5dce5acce14812aa3ff9df2812f99cbf68ebb16296edda0751187e6fb0e8c41819d13af4331
-
Filesize
5.2MB
MD5c5c27748ef98bc4861b30cbeb60e00d4
SHA18281000b653f7c29a8e0ffb795d6e8f23158e4dd
SHA25621f7c63cb9c62bfa3719edb296c5f3e144d7071a246566458c490ea8c878e094
SHA5121ed180305a4487c4d6185942be7e3f9d643752a7ef732b7ea1dc78dae299ff5483bf0b4118b75265135b38c49cbdf00a0d43f158fe67127f04047654128a11a6
-
Filesize
5.2MB
MD57bcfddd58d3b1da409b6ea8d9ab07e13
SHA1eed9171d2e8673a0c6436091bd42bb9fe17bd7d2
SHA256a150b7967629bf6d75352f26ed0a70d7fb008c48b6443e8aaa426623533c754a
SHA512b88ebeefe2483cacbf474d89dadf22a15c660a7be83935b7855d4ef8049f853984445f45176982a497c2b613785e66b72984b3680da92df47a75ac563c08a45d
-
Filesize
5.2MB
MD51fbc4582a39601fff36e50920306cfb8
SHA1f6dcd6b1f22686ae4fc1cdaefffff27904919c05
SHA256e664d947c65aa700acd10b97e30ee47f0348f2908e36067989c8753ec3a8ad81
SHA512c3f6667b119706f72e69f40d4744712691749635a9c81c34b661006b7c448c9bc2fd66ed79aa98517bdae1a98de51211ddcfa4c6ce1decbe919cc1d758d64919
-
Filesize
5.2MB
MD5f323b8880651778bb095a67b40c37686
SHA1d5cc2a2d0eb01a647b6f3aea7b6d69735d8f3188
SHA256f00e70e0d40df44bc9358e2fbdd9964c8409c7f92ee4325ca3e19cd3c1bd176c
SHA512c6a3398e3001e486284c62876a354f93c471381efd1b76c1bf4c60efcf5bb74839b81ae0f56112680c1b43cc1d4bb59d2259188bfcc0ee0aabfda31d9250e507
-
Filesize
5.2MB
MD52fbaedebfd01653867365824609e0f3c
SHA1679e7579c22cda260d66ea08d641893d0aa8839d
SHA2569092691250becf4ea985aedf31e70f5cd222a2007cfd2e949c5a42f3d0ed34bb
SHA5122dc1c7fb653044b9f7b0fd486a7ce990546d39e4f59e242d56ac0acda006c0186bf43c8c1a12b81e178091f3f7f7264431accdd32d2e19efb2fca704f8658b53
-
Filesize
5.2MB
MD5cdfe90e03032df7d42f40c99d2863f7e
SHA15f0e4e6d68c11fe5c23532cbd06ad0f71c44be01
SHA256d293d5bdb8903dee29f5341ddc2b39c05edd4b1d7ad5c238aa8dfc0113c49e34
SHA512b741ea583161b60f94211460b58b6c72288ee3ced2aa70b85a8b647605594658fc9241058cb85a4086da9b229c0772eb3e6db59cd691a73bb8d067dd9178d30b
-
Filesize
5.2MB
MD55bab9e7762e3278f7c82b74f19b740b7
SHA159f4be245350db7b9813429fc6fd27f0e674c811
SHA256322b4e569d2b206d8fcf1b6c15348681d26e6391e7384c7c138c4a89a27ecc73
SHA512a4c0834eab5edf23bff427ddb270b535e967da9bbb35c87aa4244edd21d3678fb918b4de9890d718649e5c0ae312d04b7faeb4502423005d5c12cfecf3ca0724
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB