Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/11/2024, 02:05
General
-
Target
2024-11-15_43a2c86e693f46dae0cd570ec5c0584d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
43a2c86e693f46dae0cd570ec5c0584d
-
SHA1
ff50d4e864646f5d14241b59359f12c75067d5f3
-
SHA256
626fc6ffd0789756375b7c924a05b30745a1bedb55fa9974e8be838c0647a81d
-
SHA512
76624c7572838b564852c25d5a3d4ee973fd3d12f144730e45e93cc4b302d6c1881099aeba73555322663188cb770be726d090dfb745f0ceecaf4fab40cdef04
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_43a2c86e693f46dae0cd570ec5c0584d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_43a2c86e693f46dae0cd570ec5c0584d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wspRUbV.exeC:\Windows\System\wspRUbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tUWKQgW.exeC:\Windows\System\tUWKQgW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\skRZjxt.exeC:\Windows\System\skRZjxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GopkNnO.exeC:\Windows\System\GopkNnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsKauMr.exeC:\Windows\System\CsKauMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rocuQiz.exeC:\Windows\System\rocuQiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzWiOyy.exeC:\Windows\System\lzWiOyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvanjlN.exeC:\Windows\System\GvanjlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EGKcjuc.exeC:\Windows\System\EGKcjuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyUwnyb.exeC:\Windows\System\GyUwnyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBtfint.exeC:\Windows\System\ZBtfint.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\twcSvQc.exeC:\Windows\System\twcSvQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YiXFdMn.exeC:\Windows\System\YiXFdMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dzSGOjl.exeC:\Windows\System\dzSGOjl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llidZAP.exeC:\Windows\System\llidZAP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgPrVPa.exeC:\Windows\System\cgPrVPa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\luLSlxh.exeC:\Windows\System\luLSlxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVCJxzZ.exeC:\Windows\System\CVCJxzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aEXXpsq.exeC:\Windows\System\aEXXpsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvCGruw.exeC:\Windows\System\tvCGruw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BggJeqH.exeC:\Windows\System\BggJeqH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD591c4be4d40390ea686881419e8c229e3
SHA11098fd07049c5ed54875168b2d3ee4c5e51bbfc0
SHA25679a3eecba1fb1d2d3e89bfa561ff95db68051956171a00ea7d640e361dc416fe
SHA5120d3c2888afb473abe6bdbeb45c97aa2ce320fa81c6eb3c9158b17b378f1f52da02fbed6035d03c00359f0da1dfd2a6cd22b2a7a79fd8eef2b7c23e2bf916f741
-
Filesize
5.2MB
MD5e76ff064a1edfee6b0d9dca01622fcb1
SHA1267e5d8d2e999ea2261ea71e1001d9542cab35c8
SHA256dad85d03b67db9895c0b8a8ed01dbe8b7ffaac83888b84f95a517bef048f4884
SHA512c11fbb17ee983f06dc62ad58944b19a437f3514cf8a4f9629416552552b2c17d45efb1ba641160ddd6a1467b1c765e0c4268fdfd92febacb3cd1b55318169342
-
Filesize
5.2MB
MD5e3878cc8e7a88b7c01647a22bd89c890
SHA12d9b774ddfe84ea51963b4ee78377cc391ff4e98
SHA256e5ba97ca261ee19254915ccea18e89bb49d79bfba368668f25275a742e34d493
SHA512e549241873cb04f122759a07429c16b65c50a9084157ed0bd25951ddb7be14c2b0597130e17251d12eea1261140f32a76cddbbaa79576a3434291019565e483e
-
Filesize
5.2MB
MD52f575e7b24c313766b0b429173162385
SHA105230f38c12c27cca3c50ffcb8d5974b2cc1d594
SHA256b244d6db34280553c50a4e1bc70efe144226c07bbdef1d9fe1339425ba481c46
SHA512485c02e0942a141c2c9a9d1d81d53a5e96fea52c2bd1afeaf52a2dbe601c949b69a109fa46bd1ab6f58bcf51ac6255f101f4b5ca10328a416ac3e2f4fabc105d
-
Filesize
5.2MB
MD53b57960dc95ec7288ed66bbb929d7045
SHA180b0813822d2ae2ce520acc75d248dbd58a16e51
SHA256ee8fdddc873061f360be65eedca6c03f1aca4db6a7876592325489bc85dca0ab
SHA5126a42dbdbe79e5b2345fab2bc43b9c78b2aa18f0914faad2c4be4ecca30cd78796d396c19b7bc72ab98c607ca43a408874a91b42dd542845096ba43207f517523
-
Filesize
5.2MB
MD57cd91208b52192d5a4073f9f8cc4126f
SHA120699ffb110408e6684ae300f6975db4e5d608a0
SHA256b125c43c505290ca4eaaa24cae9f70081bcf5701789afc7e581fbfa29286edb5
SHA512e8c4700794368568c0ba6558752e5b59e43d4b91e9ed5635c462b24dba0a9d50b7e93f0db6f07fcedaad90b2abfb3e39426c0657dd41b34a3d8320fb20382e13
-
Filesize
5.2MB
MD5a7c766482119cbeba82b263bca30dc98
SHA139522e1d0e1578c21c48c765f2f57e551d021f31
SHA25600fafbfb6614fd3e066149e8d1404953a77b6d9de548d7e131875f9e2a8cbac1
SHA512892a50a53caf96afc4871a787b3b7215f22bc1dd87655f6c8a228788730cb181831cead27373f39969d1d9350b50777546548557ed5dd73a955e2af71125d832
-
Filesize
5.2MB
MD528c78a304cf828382d46d7456c91beda
SHA111ad7b475c5b913be071130a6daa92bbc9562577
SHA256420254c9c8a8b08ff9381711fcd074d1beb30461d3ff9fc693f48ddf56740760
SHA512a206f518543551877d6281cd0ebbebf161b4145e6bc9ccd86fadacf3d76100d63be5443a6c802f5c98f47944743bce94a98b129babecde92657a4ba860bf6730
-
Filesize
5.2MB
MD5fc551621e19f1250792fcfc714216b94
SHA14d6e6209abbced02566a702accbc3c2509d11d3b
SHA2567d446f34ab9bbd40a0b4c1eb5483d6bca718836b5c06f42207da5aa7ff7f5742
SHA512fa4f75aad55a7ea9835bf112a871d7d13510d329838628899ae526ffcce15d30a756c85a8fdfaca2c40e0374d47ae5e1230005b59bc10f485fba692b9d280d76
-
Filesize
5.2MB
MD55c7ec121dfcc0a63df12ee0c9f524e48
SHA10d863f87758b8894337d2231dfe3043411d8b359
SHA256abda7bc6b3b5672bc74893dec76880a2f124d0fa292f35ac860869002ad5a24a
SHA5124fd74ba17de3e7b48f46ffa163aa4e424dc3ffe9a019a9090cb7aa6cd28d94a71f51045e52e9c9acf69201978f0e318117901a2d6b55a34a19715f7bdd3fdb18
-
Filesize
5.2MB
MD5501a5f8a5a7cec21cd1ffd969d43d386
SHA1e549b1d543b6fe1b7d5dc7b8ff0aad82489d61c4
SHA2568e8ae355e2126705e4cf4f0b0e936679e9c2e3aa713b2e7f25126f22a3608162
SHA51209a2199327c42bb7f19e5fe509bd777de11f515db2f4d7ca6312d2bcae5084de8ec618b3e504800ce2d12e03c32fd9d72238fd9312d4d354cdcaaa0cbde8f18e
-
Filesize
5.2MB
MD5b495edc46fe47227f203866e2ab26ebb
SHA1b39f01427399f2a5892f447feb2b0c3492a1c7d4
SHA256eec935eca8c281e884bf84f75fec38014de707efb97e7ffd5206eb077c1582d3
SHA51287892d115dba527e119679494aa089ca1c2b3e39b601a31e74f430be8e8369b2a22f31c035eaa1bf320a96b94ba7ae1254c595d4dc1fdc47ceab9ef97f799b53
-
Filesize
5.2MB
MD5484f2297d7dba02776cf3206bf58a495
SHA1415143eedcf89370d0a0fa6ba2774287d2d957cc
SHA256d306528b6c423bab7fd9e04972de43e17c8e798c92c13b53fd4486c8fdb5ec1f
SHA5123c217b864985d454a37c1fbd3a17cb7e855d399126decddc50db4eb2675c1378e6deb60126bdac46f9408f2e8ed1a2f7d61aaec9f097c67ef65b5d00c7d12f9f
-
Filesize
5.2MB
MD52b8ebaa848e91373d5b5eea3810fda38
SHA1bb73c92bb03dee034dc3001bb4b8457004763acc
SHA25682d7a00a3a74d05e077d7a86b80b0aeb9a84bd929ea72492d53b6a371ed98203
SHA512e83da83b47b3406dec48a81f6f1929263994811d0ca7b3369789ce037569f410443b50ffb8627a9a27b600c93b7ae321cf3e8a4b0f03ffda7734a7b35e723c9c
-
Filesize
5.2MB
MD5454d27491c005f13de9c4e48cdfcc633
SHA1f0fe1882aeb51d213f1e0711cc0a6f3e912fe91b
SHA25603089191bbc07452a499b127e9cf6cbf56488dc797c894fc94c028664c138abe
SHA512c39d792b6be86ec5e551a91217e2e1e7a3aea8e8dd8ee38b6f3ad3251dea56e8f2f6ab5ad734465b810853f63fd12ad5edab17485c87c87101b88c2f39ce6a4d
-
Filesize
5.2MB
MD51ebd6f8b5d0c2ba6c22a534f1c8aac89
SHA13bd71d6984282ada3ce3358ef3103da6fdf259ab
SHA256f60301ffce512a1f305431309d007092449c0e26307bc58dcaa324490316b888
SHA5128350a9709ae2f12fcc001d93ae6ec099924948c53a3f0a1457d60f24f46decda37e57f0af8dc379a3b3ef33abc3957fff88704422bd46023019e79fe16fe0949
-
Filesize
5.2MB
MD5432e323158a3a50c5a8cbb3b0985dfd0
SHA190daac81cd8628a4e8027010b9465340b1ec78d7
SHA2561475a2c8e45ebc81148f2e4338af6b8e2f378b5e4150175f2050ba65cdff866a
SHA5128ab737a011074087b4f20f4070c45c3e1cfeb9a364ea49b25b1882824a365b75e091bd40767cf4c4e29d90bd098eab6bc7387a3e770dbdb759653fa6f4ffc071
-
Filesize
5.2MB
MD59125f48faaec374b8d9109036b6c9f9f
SHA1eccfe7d33a79d0ae17ece9a644d542cfa7a5c3a0
SHA256f6ba21ffefb127e9024d895450a8fc42f13c95608811813b037af9bbd301cbff
SHA512a6de0d733b874afc181a9bdcd3757ade53d9f91ac9e31594d6ce82574250ea9b04b4d27842880f350897a7450a2616381c97f26e198c3d5330f8b22fc65130ee
-
Filesize
5.2MB
MD5a1ed0668a220292f8af3bb4e6c582c0a
SHA121a8d4db684b9fa3a1959e442d24f9e6823cfbf5
SHA256a9e1fd511a4b47bc1790ab36060370e7e8adc9c38d44819d30fd923a2c11a6e3
SHA51296b513773fbe042a7c638cef42e7cc7390c44f982332a9f4faf7cf7377bced106f0addaf5c72e6bf9f69823961a4496e75dfa79dcf0cda82de19a6067bbee885
-
Filesize
5.2MB
MD5420f58a66f320f9e002e2acdebbefe6a
SHA18be9acfdb76668ba93939e090a815dc774dbf7c6
SHA25630b1c0585b289a591632446402375739d97b84d26edd5ab5d5d23faee403f3c7
SHA5127197f0010be9455880a139f69a221ca4a67ebefce85724460643d53d8978185cc2d3dd21b1dd30d92eacafb8c4cebbd647d54d2e636c102135cf9fff800e6b56
-
Filesize
5.2MB
MD58b786903b1e421a6c13ae9e1eda5e88b
SHA174776fbee0d179496d78180e8603aaa4afa0d8ee
SHA25688b11186141d25fc6dee57ccd291d14370e507c36562524cff0776341a9c2d3e
SHA512413683da43cea4b7a2351e0f53c7d6491a1d9eb4da87206ab4c67970f8fbbaf0b0d5e7fab4dfac20b3ee878ce1f7c481418444d1bb3a635eec25e468d0f336c3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB