Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/11/2024, 02:04
General
-
Target
2024-11-15_3e3ed853167df8318854dda16fef727a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3e3ed853167df8318854dda16fef727a
-
SHA1
e4c648900245da9a8e64878d2d3ef36e6c235df6
-
SHA256
7191d0259c0661e8d153087bceb961eb7e6ae992685cc83815fb42e5c4bea1f4
-
SHA512
398bb9f5b10a98e292f85f1baeaa00424c48629da1d14e0ba4874214967f6b5a44acde3946a32bc5c45337d1395d78e3533fbbf14359b1f15a4928ae9c0fe34d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_3e3ed853167df8318854dda16fef727a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_3e3ed853167df8318854dda16fef727a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\biIalrA.exeC:\Windows\System\biIalrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZkGguaU.exeC:\Windows\System\ZkGguaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TCLHMpa.exeC:\Windows\System\TCLHMpa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oXaPPwb.exeC:\Windows\System\oXaPPwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOkMSGe.exeC:\Windows\System\xOkMSGe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzpUgqk.exeC:\Windows\System\tzpUgqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfWTWmQ.exeC:\Windows\System\LfWTWmQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AUGyfyg.exeC:\Windows\System\AUGyfyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIVpprS.exeC:\Windows\System\iIVpprS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oAPtTYr.exeC:\Windows\System\oAPtTYr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pnPFsgW.exeC:\Windows\System\pnPFsgW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQHvgJZ.exeC:\Windows\System\QQHvgJZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DuTGMNX.exeC:\Windows\System\DuTGMNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XakMBlw.exeC:\Windows\System\XakMBlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgPDYBv.exeC:\Windows\System\tgPDYBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQvIpXd.exeC:\Windows\System\DQvIpXd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BAIebXo.exeC:\Windows\System\BAIebXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMMDNSG.exeC:\Windows\System\MMMDNSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmreELc.exeC:\Windows\System\wmreELc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMfXfzV.exeC:\Windows\System\UMfXfzV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsWcSFC.exeC:\Windows\System\xsWcSFC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54ba6aca1fcf5e1a69d96378be991c694
SHA162848c8a72bc33db54addc8794643785faa79a01
SHA25648f33211f4fe5268b16dd8094900a53edeec2bf63e65049b3d2d36ac5f9fa966
SHA5129905f09f6a281dc2292c9483041b8e46803f54455bc6a3e06b3e0fe82b2dcd6569dd7115a62aad78e032947293b282b9148330b58be8aff590edcfe1eabb65d7
-
Filesize
5.2MB
MD54b4f1b5a67195f930092f954ea33dfaf
SHA19aa87256bcc6e9bdd683015dff527eb03d6058b9
SHA256972dd059ee57cbe6ce80603d4313ca4e8dbe82cfe808471ff3f657b8284902fa
SHA5121fd6fd52e2d79129e0d12fdae169a72ca9124d62d9814aefc3c908e6bd8f38afaabd0dacfb5c4f01098cd718db769e1277cc32bb65c3ecafd9bb29036cdee21e
-
Filesize
5.2MB
MD5845083f5ba7070ca348db01b461ee8d2
SHA1843cb79cc0d147baf967900aff5e000bfa5eae15
SHA2567832eae7ecdb6ff43c694595ac7acd5eb594972978bf8cf6173dc1507de133a7
SHA512476b723b7ef26869497da1e96968f1ee2ac866bd575da2f2f941e59de6b75e78c1e6cb12d0c5aa86d625b6e3a12bd87ffc19c15860ead313b94c4ffc9d00fe14
-
Filesize
5.2MB
MD59860fda53a3cb3383518ca7ac5e579d0
SHA1e231e213cc730b558109e5fccb0180610a033265
SHA25606b40461251123428f906af8162ec61fa0b159deabe4b213e1c3c3bb8e140d89
SHA5122f695bfe51eb9880e470f9eba11ab94647cebfc1022eb6fdc148c291b3fbb50b282a5d4f8bff9a4912ed90efda36bd507b1b225835acb9370b8137a75be82b31
-
Filesize
5.2MB
MD5098f1168236b27c4486a99067f89a8f0
SHA1ed8e57532215754c3c77990e31c38b6f7fc89080
SHA2565c598e5c56ab439b10bf1ab5ae3c1e147aee48c9387ccbf7078725ee8b77fde4
SHA512ef27a37962bc2c480704f0371810585d9e4fe77b26b9895f0fc4cf8756d6fa9a3f9f5f85343fa556faad88a52a712ac9677683850fc0a46f1cba7c48cae956c1
-
Filesize
5.2MB
MD5cd48a9637065625202349e3e616666a3
SHA18d8e08df3c1c4c757c9102ad1be2df0fa13add2f
SHA256252ca1e2f3ba2078d60267df249a39fa412e4c5ee72bcac4c743daa77df4e9cd
SHA5122a2eecd53c12b4871db2e61a7aa05196c08d57b1475a2358a2330bb25f070707efa16fc63a5f368a26f06fe2823e4ce95b33137db042ab0ce46d21a7623e77c8
-
Filesize
5.2MB
MD5c3771722262feb6dbdd23ba1ad529a14
SHA1c3c07251155cca769e9c3b3d19ce5c50d1d9957a
SHA256d97f4177af40aa1f5748d4f8f4078c4df949c4366c7aa9cc5b78eb0c8d3fdc56
SHA512603bf9407d178235b969da612d0c5257e4f3857483f5734e399544dc72b0771f7f17c0233f65c2282c8fb72a08b79dc745f80f161914d54a56400b927c747314
-
Filesize
5.2MB
MD545a65973445c1c9c1b6e91f79a4aa34f
SHA1c5aaf51ec90602d3dc7b95475b3f9f546e8abebd
SHA2562a1e6bdda1bf29b4d4177a19f0ff054d22b84acab55f449f0e30b3c03612b154
SHA512a8c13808a0a2aec00ea8c922115bc341a45b21696e9aaecf24d5b27be4938d78742113a2629b982ce88a0cbe595866dde490e9da490931669ecd5286c2a4db89
-
Filesize
5.2MB
MD565c3c74f85426da59674984cf29eb5b8
SHA17be930f7500ed1a055ec105d7155d307b3fc47b9
SHA256b3392632694bf2feb2058cd5e5be7dca8f398106aa82541d7694b92c9e4f72bf
SHA512d11e93fc7413c3084ffd8c09b84f5dbfa641eb0cb16f70e84aedd6eb8ecb83ba42f7ca346066dc530bcc3b2be88bb784e4eef6be2eb2ef5fa5027d2841c929a5
-
Filesize
5.2MB
MD589973c31500b89d8efe0c425e4ff50a3
SHA14acf83b594dbe4e1f2ac474fef7aa8bfc8bc8709
SHA2568b97e55448af73ca7e0dde2a3d8b976e65b72244787bcc3e2495280b15a474e2
SHA512234d1570d19ddfd20f6224468fd87c87f77928ac2df8903af2395cf06d6d4c68d9c211f6422e428a87f9df9f08254f987fe2f3831af546f771e237263b5ac13f
-
Filesize
5.2MB
MD57e78f972904300140815d93311ed2046
SHA19c35a0be4a0278dcfc8e2d820436649937df82e4
SHA256e515fcaf4209a9a309459723810289045c71564bb83b0087407bad9022c41636
SHA512b9b2fe4d16f37ee8470123a0f3cc1fb11846d90c2f4a3fc74765f4a5dabc2d9bf11083f9046dc06fea404a52959dff1fafb44b31543bb10b2a4179284548565b
-
Filesize
5.2MB
MD5a766cfd58ae23f1a84c8bb4a5acff319
SHA1bb536c38350d28fe7ce26c80de529e57c99b8270
SHA2567c4be6100fd4c54556b4b16aa5d57ba71f4162895f1e2adadc2a7b7bb3038944
SHA512519708229cffbbfc29a198208da1aca31f02b97517bb780c5305477c86fecbfa460f965e3fa195ca7df2fb925183405cb974e4f15382445263348c66a4b629d6
-
Filesize
5.2MB
MD58675aa61f59e16dfa96eb750317c6532
SHA16aa6dcb5632554a629c58fb542b8303bbd52e040
SHA256619ac231df8f490b9661a799c736cebff755d0e98d5e43528cd066fe5936fc70
SHA5123db88a7ba33cd11f3691988357b14a4672e0a8834e422a40d23f22ff16377d91e54e18bbe5c62b2330cd634d8a883a7a52999efe95bdcf53ed096dce77015623
-
Filesize
5.2MB
MD56baa076819bedf15c5a6a71fd399b818
SHA1d4855ee5b96c42a149aade29de6aa7d6221107a9
SHA256be2deed193f5808c0ff8cb5ec117a3a58335909aedcf5e99ffdc1464f9ec0656
SHA51220bbfe78621d97cad4b2ab3b77907f5deb360b46e727750658e8af465ab4a4fedde4b3a05214e95e6c3eb78450290c8ee6fbe92759f52ac1408e0162ab40663a
-
Filesize
5.2MB
MD5f23743a34962d13934b0917bfde65ccb
SHA164244961847c44e2f3ebffb5c436592ea5639169
SHA256a6751299ed7741c8bf7a5f5a530503709611878731fbd9bed803bc50e14fece0
SHA512b8176b1322428d49a244eff21005cff1c23e930f80ca77ce662a99c67f5c7b108358fd477feaff1d30a56112209092f6ee51aeb068ad55ec44fe39072372073b
-
Filesize
5.2MB
MD596f0b40a9493289d1188c64308f40fc1
SHA17143fdfd397e02ca8ef97c6d99e6c1e499b10fba
SHA25661efdbce892c6bdf7d62dc9a053e1eff05809d9bc7efdf76faf9b4196a914e80
SHA512346e391265ac80834b4cf12e8c4d9fe36a59476f2a0b576120cb085255e7e2cf00bdfcd270a7bac1306622d5e4966a085ec6a2d79dad1089720d01691403f7cb
-
Filesize
5.2MB
MD5e9ccceae147ac13d13a89ccf42d46c58
SHA19e4256eade75e9a0ccb18eb3a937f1cb088f81b5
SHA2566a67dbcb3d2e3cf591be0efc45c2ada4f478d53be9ef76a5f9a692fd3215c51c
SHA512e5fe9bbba932734865de13d3ebcb7b006fa80dcf2e025d11497b18781fbca5a0470a71f1a9783bccc232e7510200a90284c853d55eab5f0a8814256c864035c1
-
Filesize
5.2MB
MD57d3383163a7fc27cc6fc3db4b6fe5264
SHA1254638deac5e0fde2e80ed0c97821a9391173fae
SHA256bc6d8536351df4c03154e1571327615437b03fda679ef2988216b07b8acbe7f9
SHA512b746040812b96415ed9b2f90a833cff14c0b4ca19405168170138bd06ca598e86c2ac3f9f5a8f91acacfb3a96b6bf6eab803110e559bc4aa021acc535c7f7458
-
Filesize
5.2MB
MD5803b25e2d706b73b78dfe514a319c772
SHA17825bd2f2869cd6b9dbdf4f57e91071e7968de1c
SHA256d7aa3d9c848653e7582d465ad3e2764df698cfe71f122c62b2023ba2cf3c4e17
SHA51250b7602c2a92f5ad7958e28af5865f818978627be29d50b303a9636059ad9a84bbac0965773b9e76667bc5e2a15febba022b2a8e2d939f2d952c3c4b54b8db7b
-
Filesize
5.2MB
MD511a5706aecb0a0f3097f4f32c21c65fc
SHA1db23b98ba0a19e5896ffb8b1c3dcd25d717d06b4
SHA25686b7a92c019401926a558b845ded04e0d905e634f08e8b7141d4583242bf2bc2
SHA5126401947718ec3a53e70408b48cfeb6224c3dfabbc2569805aecf3a79163c5a9e5f60586b1bf61e68e130bb3dd8ab79eb0de6647acd1fdbe2eae52b35a1949a0e
-
Filesize
5.2MB
MD54c03090d9453ea2c47bcf55fae0eda52
SHA1f1a62f2947e703a9e5413fe84a5d62cd22a9ee3c
SHA2560ed2dcc2dd4a3ef3cdccb926c0982f000f2faceaa9cea9af5a8b38e1c5f0fba7
SHA512031dcb69e50aeeac6c8b77ecb21cd99d7228d4b1788bd1da5e643dc8c19b72d7381f2a98c9d644df51eae6ad8598f5ec6cbd5802a6f16b06e76e72718407286a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB