Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/11/2024, 01:32
General
-
Target
2024-11-15_830a33b2d3108e090389d6adb75ca03c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
830a33b2d3108e090389d6adb75ca03c
-
SHA1
8542d38cad37dd82318ef31ce8cd66c27b818d7a
-
SHA256
27e182bfd39c61229723e5222c18e6f697bb41be63ad915549a832bef00fc180
-
SHA512
578d86b3bb6bf3aa0f45a478c05c88a9cac2ed19bb4fbc9578438447d330ada51c22a1e3959122aa5e542fef4ff658cda2ac69ed3813950a3dfcee289aa0f9b8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_830a33b2d3108e090389d6adb75ca03c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_830a33b2d3108e090389d6adb75ca03c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TpMXIyQ.exeC:\Windows\System\TpMXIyQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jKzFDOu.exeC:\Windows\System\jKzFDOu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SsoltXo.exeC:\Windows\System\SsoltXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kElpbvd.exeC:\Windows\System\kElpbvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGkBUDX.exeC:\Windows\System\QGkBUDX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pSoGZWL.exeC:\Windows\System\pSoGZWL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dEwATyT.exeC:\Windows\System\dEwATyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVoyXsE.exeC:\Windows\System\MVoyXsE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOmwaGF.exeC:\Windows\System\fOmwaGF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boghjaU.exeC:\Windows\System\boghjaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lGzLYGd.exeC:\Windows\System\lGzLYGd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlwzSDO.exeC:\Windows\System\rlwzSDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOoRRAq.exeC:\Windows\System\dOoRRAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxcwirq.exeC:\Windows\System\wxcwirq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRUqMiT.exeC:\Windows\System\WRUqMiT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFfHiGG.exeC:\Windows\System\FFfHiGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcRTODg.exeC:\Windows\System\OcRTODg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QjUwibh.exeC:\Windows\System\QjUwibh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cLxRufi.exeC:\Windows\System\cLxRufi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTdJgSr.exeC:\Windows\System\BTdJgSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fJOcIDm.exeC:\Windows\System\fJOcIDm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50e53eb8bbfb736412704ec76f149e578
SHA130865ef73e36121a1197cc4da1060afa5b0066f0
SHA256c8da32d2073bcb1d4068e15fcd5597b336310aa720f569eeedca21b1a4b1ad14
SHA51289a0f577c18f50767adfb5d15bf43e0af6ce172a64159359542f3f3e624f4ba52db25e27e8d0eb176c621d5a24499272878de39dc5a7f227653d4887a75edfca
-
Filesize
5.2MB
MD5be69a9e62cf73ce0ee22655e795df99e
SHA1beb9279031c6a4975ea4e4619fe9cffccb114bdc
SHA2568726ea2193e5049b00cf7bb690dd2813717b8705b9aaa1828da3db2291cf01f4
SHA512e23ed5798c5e04c4d2e5f0feac59c962590156cb147289fa9ea51123b5e14f592f861736eb2e3d2fd1d6b08328099674f7c4563ddf1c3a50dc43f8e45afc0d76
-
Filesize
5.2MB
MD50bc779eb03b5604e6b56f84e2a0b4510
SHA1fcf62788c5a39050c0e2ddc97ae7ff0ad2bd60f4
SHA25690e43b0325d95c4c96fe185ffd1c41240c120ea16b345cde084199bde8788cc9
SHA512ac8c9a5a7ab233ec0138cb3c07a913ec4cab352b878375e08216a585cc0ebced47e61b700daada771132ad96dfd5baaa5c21fd2f0ead24b68ddc6abeea4824a8
-
Filesize
5.2MB
MD54aab6cdc4abf1d90e790e5bee06d1c67
SHA1a8c8ad0beaa1fe6cb9945f2c13715b9728302727
SHA256029723b35d7328fb54bd3ff2cedb4473731a561f1312985f89bfe391c99f15c0
SHA512b1fbbf0c1c37857794e89a8d3acaf6062f1c1d4557be7eac4c8d0b6f40ffbb7047aabef82001ab7d582275f6ced053ef9e2b44331ceff33e85846169eaca4688
-
Filesize
5.2MB
MD57d8a14bd8eafb8cd9d45b3f9e2bb9dd3
SHA100f99261eb08dc6744c013d6b6673964cd8c63be
SHA2567bf1d83ac39739ea4154c85e33bea6cd1a288f0ab6f3d927dd82e0dc95cfaa43
SHA512b7b2eb828d69c903e616189be433a74549801645d60b8e85bcb5059e64a31e95a5984ed8bd2ce4a2f9df7beac327df4b0bce54d069ca99ea83e95aa30b5e5cf1
-
Filesize
5.2MB
MD58e49af8d8508d4bf84df2a6e39b6d7da
SHA1024978b2af2aef80a0fa39ade58082746f337b52
SHA25604b8c47732632b1ccf5da933badbdc34565b5ac8f9ac40065eac3fb6a6adcdf7
SHA512025b1313f661ecebb8f8498bf022338bed60f8066d8bf39f327bfc8570cb98e60147e66e11e67b2a85bf64179d14b5b35a4e017d7d95bb921d1ad691cc02f79b
-
Filesize
5.2MB
MD5816eae9c2efa8a451729db87578a8b0d
SHA168b93707fdcee24beb91637c50c0f3511b84028b
SHA256b74a22568f1d409ea93a7b5c5ecb2afa1ea35d89c1ce5d77d9d8ba1f6d5f0389
SHA5125b13cf6e36b1c2f177b520fc70d8a3b86951913c38da89180ce5d1f6783fb13659635b0b8ef224b575fdb660d03ec5941e4e9b39d98468e194c676ed5587aad2
-
Filesize
5.2MB
MD52bc45525794df915ef0ef8584ca0e604
SHA1c0f1c917d0c012a1943fbe8e767e86bbe3697c01
SHA256bc164b454499c95f0264056f56e22869a9c31c66402f16422cb011ec6deb3fae
SHA5125f2293087ca2bcd05f1463890d240a5e4627ab5e1397d2569c683b9bf229da40973db20627905ef671af450d74e21e081b03ccb58dfa937afb6c568155de8a6f
-
Filesize
5.2MB
MD5cb000cd1d71a6dd42564c9826ba5c88c
SHA1551d449ec7b0008632c0e10b8d39a04d2b6a6dc8
SHA2565a8845b118f82e6507d6525f3072c503664e48be78f93defc5380a1122bc2a15
SHA512d155393e6f68d8e55334530b3cb6f3e1261988a0a77e4c0c49484b2f41c89077e35a5e1816e5dee3c057a2675d372cc019df632fc3440d00b89ea3900b1d38e3
-
Filesize
5.2MB
MD56902f87baad7673ad6c7c1ec1d08b25e
SHA11155676d9a541116cbb987c3e67c39531778ebf1
SHA256c5b4dc0daee0a2f8f1ecc79d4c7e92c676a74fe3887a90dd2c2fdf086fd8fd7d
SHA512c5d2ffc5de9f809aa10256f24ecfab753f387523c22b653f611fc2660050bbe7b2a267155984d4c141057a6188501c03ad885fd9cde916575abe895dd7473fed
-
Filesize
5.2MB
MD597bf13796799fc7fcb6c553cdaf9e68a
SHA1373abbfb1b5e67480d4570984b720cdde5e2aa3c
SHA2567420a50c8cd21ed566e6b753866d02080cbd326d252755d74b9aa2172873b891
SHA5122acd8330ec70e82c011d469eda3d9c783f276e45102b4e7026887403f751b3cb995469029e652424acf17a0d8a566881e30dc7da18532b8b241a026c9615d9db
-
Filesize
5.2MB
MD5bade0ecf11214225024fdb5594d45735
SHA17c859c67181d8898ae594a767e23b2b487d67a81
SHA2561ac47dd5f22b77bf4f0df5dda1c281684fa426c333957ba7d38d552533fed095
SHA512b3401d8b80fcafbbac5231c08365a60d21bf02cc8a95dbba2eeaa697492fb5c5692bfb393fbbbc8b72d296e9c51d7b1f24285a93a7a66596a4f7e85271f5e946
-
Filesize
5.2MB
MD5281388e95f4817eea9e6967dc073dd2d
SHA1dbe00b0a9b6b3482e2469a613926dd98c84fac4d
SHA256d6423cb59af2f17bf8105eae5498364b776dfa2411a1454a50ab6469ecf6ca6d
SHA512ca7d90cdaaab0697abfa5f4b25f12453adc94a5ebe1ecbe4c689313ba54c341e539e5be335bc3f4ede674efa854c898756c5c695f9edb8195cb9b44e8fc6a35c
-
Filesize
5.2MB
MD582d8ba5da741dcd51c2ea7454f5aa04f
SHA131d34330b0de4f211250ecc7fe6ee8f0340afbb1
SHA256e89cf1abcb3af7b22b1dca613c71ff3886057555d446c8b206a79e4c338721cc
SHA51265bd919652df17c22d04d8ef174d659393264538d2013364912f3997e8838fbcd2e613b471f8f82546af1399c12d51712a2b4ac7d8addbb0221a2c981cab2079
-
Filesize
5.2MB
MD5c41a03601a1d533a01ecc4d9b044aa7e
SHA14f48cfd9b8aed797ce41e8a81ae8d678f747d913
SHA256622fe3aeb49a8b1a1516510b56f4ab438ee222c73550fdbc7ace34ca5549d775
SHA5122b5cb232af8b9d674b07fb72f8c48b17b437ff873e5e8d2185d964433a11b58e4e97d3f56d1b9adc59e8250f360a84dd879693a2dca0bd65a49794a68d79b8a1
-
Filesize
5.2MB
MD50c0b44a8d46b5073a744d1ca2f7942d6
SHA1ed7e11fff9b152e56d1a3bc58d5d50c61da261c3
SHA25648c08047efeee55612215afb20ddd9eb2193bb6bc33cba1f0dec5eca9a62c134
SHA5120cb54c856dafc4c83764d8ed728c1b2b97ea0996ac7492c663a99aba6bb4d839f1bc90bc2e230cbf477d20034864edada909d885dc379ab723e8129ba69faadb
-
Filesize
5.2MB
MD519aa35ed715a7010cc413d671c356e2e
SHA10785bce565d5071a018cd1648c379408775b2c84
SHA256579e7b5d8e7f67f9e2ab781d40cde301ec770f53fe38cdf248aa39cea02bf6f9
SHA512b467d9e8e07f430d5fc583ded0da5ab7416e4b9db8c9943241ba4381eedd7e2e350b2a743ff9c52e2e60b87308c43a2fd523f160d846f6a6452501ec3c628b52
-
Filesize
5.2MB
MD5aee58a28de119512c870002f2ca7064a
SHA11ed07bc063deffe0c3232ee30c4f2b4bf49dddab
SHA25683e666d82308728c2074b890a4b838625457ff420dc7cea473aabc95ab65d78d
SHA51232deb275204f8056d426a0f3ab727d5383f7c472ec9aec430a4c2184a2c0beaae9231ca21d24cfc8c033753923bf7f5913856d642e6451b2e01afb1a3e61085a
-
Filesize
5.2MB
MD5fa41b8296ecff81327d867efa69d8b3b
SHA19ed8b6e6b76ca844a7ada21cca2554d0fc4d142e
SHA256cb03519159d677a2ab011dcbfe32afb58cfee115758f618eff73e777ddc4a26e
SHA512c662f6df1ce65d3f1a5c5334498682c1f620b17a23f58322fade1afe65449873be501930029436acf08406ab19e537401c7fd7cc7378671905df7e087452a59d
-
Filesize
5.2MB
MD55d785993e81ced17195f1c2071d46620
SHA19e2139cc7f7cfcf56ab64ffc16b5279cbf5ebd7e
SHA2562ea5c60d34c64f7ddf791d5896134901273348b81251da6812b19717a5a4ebf5
SHA51237ccc53f6309e8c3711a7a910a0843076286ccd8501ca67a0169e32e5ba5c1f220bdb5b85ebe95bf38287de539ef5680a91d5fd4184f8e4bd6d28a8995a598ef
-
Filesize
5.2MB
MD545aaac5cda3a0aba3f1d6e38457db4e2
SHA1efb5dba624e5d733985c3d4b95a46e66e5a015aa
SHA2567a92315b2cabe979c72844720c75b098f5fa74a7c43263a32511f28a95e0c1b2
SHA51264828b207bc44ebc7ebd3223d94c58a1f3c28e92240faa7b31249152cf87b0fc5b1a542a8e1d6fce6be6c7317d9715886de862e34885f8b0fec7cdb27c50a272
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB