Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 21:07
General
-
Target
2024-11-11_6696390bce0edc19bf94afb76e5544f3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6696390bce0edc19bf94afb76e5544f3
-
SHA1
af4c987f21a83f1cbed1ca856efc90e83dfd8e30
-
SHA256
ebf7e5db3ff5ddf32f8cec5c67c7de67dadf65746659ae8349748757bafdbea5
-
SHA512
073e9055bd5161b6ae0e52e0f33b32396a024133695c2f8807d9ce2554b5f821c5d943147f96ef2287d203365ce8b964c26c2ed1afc5a2be8ffd717f98aef512
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_6696390bce0edc19bf94afb76e5544f3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_6696390bce0edc19bf94afb76e5544f3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dsSCbqZ.exeC:\Windows\System\dsSCbqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbjFXgT.exeC:\Windows\System\UbjFXgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WSydPDl.exeC:\Windows\System\WSydPDl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QDYmNaB.exeC:\Windows\System\QDYmNaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUWFdlS.exeC:\Windows\System\tUWFdlS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odDjHrL.exeC:\Windows\System\odDjHrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjxwqBT.exeC:\Windows\System\FjxwqBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncXoVJS.exeC:\Windows\System\ncXoVJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUNyrYx.exeC:\Windows\System\tUNyrYx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRUjUiU.exeC:\Windows\System\hRUjUiU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxvnFOl.exeC:\Windows\System\XxvnFOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsYFeOP.exeC:\Windows\System\IsYFeOP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mkyEuXH.exeC:\Windows\System\mkyEuXH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIyLJks.exeC:\Windows\System\TIyLJks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQFbbGs.exeC:\Windows\System\oQFbbGs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKmJZOJ.exeC:\Windows\System\MKmJZOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VkZXcnz.exeC:\Windows\System\VkZXcnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIMWhcr.exeC:\Windows\System\nIMWhcr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMDtyMe.exeC:\Windows\System\wMDtyMe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWPdofF.exeC:\Windows\System\IWPdofF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gnmCoCP.exeC:\Windows\System\gnmCoCP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5110d58dc10785e99a16d6efd76717925
SHA12362399742cec80773a68653b56b2d4db562bd08
SHA256e5bee33aa8855ee264fee9b37bd23674abf5dc9eab4a9f88c9af710edbceed82
SHA5129b89f1a3d60b4f578bb23b16784b46f40a6b8c9b1095090951c58a377fc08a9f9563147e73938a7082968845fc3ece724df56319425044981da1c7c93a881790
-
Filesize
5.2MB
MD58579b2e718819d9fcf13055389e1ad2e
SHA10ddc02ac2abe9979f46a2dae23e70bfdcc9d403c
SHA256d664e03f9a6e0e25ee3614356c556504acb97a71925cf677820576d64c9510d8
SHA512ad21365eea4b8cd3685c5ab1ea11a3ee3059b70e0c7c18f25a5f64c799a8ab38678343a251833484b89b2f15aca9487753a80b5d16e6f2a164054970eabbd47d
-
Filesize
5.2MB
MD52a5d64ef0f80a94443f546ad6ddeed11
SHA1e977ea318285bb38b4c078063d7abbaa37d7ad41
SHA256495dbbacd16f24eacd1b6f53c4502ee57dd3558c2d8a8a5822de9bfac97f8b94
SHA5128f3a49b7a58c77fe97a0aeeded8c755e2e792ce3ed616c13ca57eb309320b994fc5624dc0bf2e64449f1588c37869097a3065566d3510cc27a359de9998fcc46
-
Filesize
5.2MB
MD5bc29eaa7703952c0e8f38da0d9ad09e3
SHA17b94af87f96cb0726f1b5279666eb20affeaccc0
SHA2568f19edccd6b19a7c3ef7d07262d17370a8e53caddabd6b48acec8555b83edabb
SHA512e778a4fdb9cf9f332cebf050c98f2f174a8728b276ef4c8153449fb59cf2d8a97a880f2762faf4bdb593156f045eeb1d66b09db286e2500c58cae5de5c771bbe
-
Filesize
5.2MB
MD5466c348575f54a92518e79d9efe837f7
SHA122123e49a1d92b31a3668ade6cf440692e80d36c
SHA2568a146c05ccfa515c090498e4286546f7c0299f9e7de3524aaae17159cd052926
SHA51234cc38c97bbeb7b3718acc66544baa2c7db045f57b08d6655eb437bfd084c01c78927063a81672ea0e1c8d97647626df480c1504ad210a6a65e468ef9629538c
-
Filesize
5.2MB
MD58a81252b8d54657caead936d8a706285
SHA13222d41d625e7345e9df416932446a2d4d8efeab
SHA2567a1dfd3aeb62af5dff50b46ef61128c53b3ad3ee55e268b5f0487be2529cd87b
SHA51232ce0a43e679606449ec10043974b63169862d725d33c3c01cf2e0790a6dcdc18de883e58c4875b72320944f72f04616a3be7c3a4b061131e6e4d1139fb12e30
-
Filesize
5.2MB
MD59ece95dd11e44e33759ffc491fda0c29
SHA1b4a28ec61912c0a5078758e89f55e336aac0889a
SHA2569da681e60f94c41d3628140234b47a277d9153ddf1c78e823f1ce3bab0e667ab
SHA512e94fdba242cb9649c5bd8d1219c484b4dbfd450c23ddad8a92e97bafd3290e768145d1b642217d68c84cd4bfa89b5ed91725c8e1174c24d3adedbb19d9d7fcf6
-
Filesize
5.2MB
MD5a30d5c902ba38677493178260203b58c
SHA110ddb643e11290134fc3b59bbe584e809362c3f2
SHA256594f0cf0d7240d685ef1a476e88ceca750b49feed27302bb1f51cd3757885b64
SHA51260416a071b8de23fb6efaf6e0f582b633ff2b0993e421660c8411d9263f71125a12e39b0d37c78fe1e7d37db8e7c7350813898bac02a56fda784bf410587b506
-
Filesize
5.2MB
MD51101cc04f8d74f78877d851a704724e8
SHA1573b888c68e5d85a0dd278fb70a7ec5811ab5056
SHA25604c23f89abe74b50789982902f3af77c3bc705c27fe8d3dd859788cc17c1e77b
SHA512ea69f07b210a888f476953c6f1221f5680640653e8eb23a9ba30a5a02ab719f0370c2faaaabeb8fa0d4c2e5909a817f0230a8565d61855218bba5336c73b0054
-
Filesize
5.2MB
MD59904ea1af6403b72800da9c3df518be8
SHA14a75062102b29121652d4e6f5950702aa895bad4
SHA256ca71d29f744db69e8606d0f1f3092e359b4c65e535b4a6bc1d0ca0cbb24f95be
SHA51264ab37893da64a49cc358688d5d8b7d22c687b1185081c9e8925cfd113b4970086e3e48d65ab06564d6d4af3671f1a00facb588eb8e2beddbef3feb09d81304c
-
Filesize
5.2MB
MD5f22fe9d99871d250fbf20f2e563f79ec
SHA140b87a6d4a48ed31bed6b71c2f2fdcc8d3b06025
SHA256be624269230a0f5635ed67da419100fb8240b1c2b1671fb6fdd60fa42e4bc560
SHA512c51f4cbc89a35ad80509f92ef089f28a72432d827d60ad4292afa2118b207206abb8b4e14d41172b993482de34b50758bafa1fd9596644aad6682219dcaaafcf
-
Filesize
5.2MB
MD5a6c78f7c4e83eb47eec11e33e0d75797
SHA1cc94dcdb78157ee72f39b28a89552e1ac36d815c
SHA256189cba07bb851b32fe55d2a0b30a12c84992223617da9f4abadf014f31a85f3d
SHA51253de2d779efe6fbd22754519a382b0eb2c270f04cdf0c5372d85371f375313c81a68684eb5bd14810dbdafd08e422402e893ab69a78daa7a70b815911069346c
-
Filesize
5.2MB
MD529542f53a6ee1cbd46732ea30497b703
SHA12a336942a12045ee011adaab0e7499f2b23aa401
SHA256389a0920f7d78003d42519378547e266ddf4aa5a2452ca5f682d2d7f8a6d990c
SHA512bc3f407a9ce3d18d5fdb1f3eb30b649a3187003b5377c1c9975dac6e1fb2bbb3c16b7462a87616c8c2bbff9e78357d4342de31833d1851f5ff80bc0a14273a81
-
Filesize
5.2MB
MD549c9cce0b6c66b56c32902c6d6d4a38b
SHA1f846ae41c2b7f59b117c8b71550d198d94aba900
SHA25683dcf170d90d83e112e2dd5b08109756e264d195f031d3520699cb581338e936
SHA51280e07a1192dc95bcc88bcb94cb68fa4845e20ee8b06ceb1e3bbd5256f039da0aa3620db7a3a3cfb141c0cf7310adaee74a4b8b1d19a92dcd77e98fdc9bfb6a4d
-
Filesize
5.2MB
MD5893c174df3c4bc275b1066ff1cb6f877
SHA13a244011fefa7c7813b204258d837ff4cd4fdb37
SHA25665410dac386e16e50afa6b3a8f99db8dfebbc173c47bf28de7c1f89d4419c336
SHA5120f6bf63ea28911a02a4e5223801c26968ff69df2afb2ee0b2aa6764362fdfe7ec838efed26be3c62d94ec47c2d9226eef9b257e7df0c37b68a82187e98846e97
-
Filesize
5.2MB
MD56af36ba1d197ff329658476adc94063e
SHA19e6b6d425932ba92a907c3bc306c75489b8e9a79
SHA25644ea3391777a5123375c85d8d8cf47b050977a53a1b309194f94dde4c8463038
SHA512b0ea94b6fbd93da1cef076dced11eebf1aa246a9f38420f7585e86dfdadba0dd4f5209a2baa937a9b7c3fbfdc1006d9b26f3aae24af546488449f4017b9033d6
-
Filesize
5.2MB
MD57d9705c6e5d5f0f778393f9b25ee6204
SHA12e430003e4cc7a17c89c5efc8a8fe5e61e1cca6f
SHA256e73c457c1012e7f7aa1ea778262b15126c4b537021aef1040b10c1d220a8edb6
SHA512e52d0845bd72950d6ebd2049c5fcdddb7d3b27c1cb068347592e91dc6af678ba5a792745c37f384490e418b1fd47dc12b722a4769e75e7f7bc4adc834a5d74c7
-
Filesize
5.2MB
MD5fea7c2337543ccfcd5a0ffd894a47eac
SHA11c75a7d29458ad10fdeb83c919d70a7081a9dba7
SHA256f5f2826d170a1da9610dabb13fb76d5758eae3213b104e7ecd239a7ac02cb3f8
SHA512d984fd86781aa9d05e3c3fda2b5b3dbbc05037a6febadc0fef625e13bb3000e662bd48fbfcb83e47e5dfa73055f5f303f5601cb2b628ef65a31c31a6a287fcff
-
Filesize
5.2MB
MD593b2f5d39b8c6c3059a35ccf748041a4
SHA1df2f5ab46fd073bad1933fff177a2ec4855b2442
SHA2567463ad5a119c6653bd2854aab9365931fde8474d69137fa33d52d25c80f01f52
SHA5128967d7bb288e76bac537d56b706f6bae80cd71fdd78eeaf285ea61cd3525e3766c1a35db2d2ab0dfd4e78a60e2556707c018827de35311d2826c0547c5bd1bac
-
Filesize
5.2MB
MD5a770f4c9d0d4a925e4c2c98ad336fe8d
SHA1261e4531ed7519ff052acc56038f3e5825c18a65
SHA2565fcf15a247259441f17c604ce156ed796271585c4cac3727fa09ddccbc70b7fa
SHA512faecc27905d2db94d7feba2c467bbc27bf0fb33116721638fbe19d68139eb289b882986c2125942c6861784812d51e77869d30804b49f73df6376f3cd13f2c8b
-
Filesize
5.2MB
MD50b78a1aa9f25482418a59ecad0a44546
SHA10ff3a039921fa856a9f9aefdd9152125bc57ad7c
SHA2567336425084d50c097f136249ee405032269e0fa46934e5c69014a971400dea0b
SHA5124772a0d51598a5467c54d31137cfdf12011ee964afb24454646a97ba07b112d812301d0b7d37153e5fb9d345802726e9a5fef7051c6f22b616479930099f385c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB