Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-11-2024 00:52
General
-
Target
2024-11-16_42f6bf204c0787e141bf43c3c07316f2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
42f6bf204c0787e141bf43c3c07316f2
-
SHA1
1b8bf49cc22409203909e4d7e1c7898ef2d6aeeb
-
SHA256
6fd2467ab928a34c7cfcde2a56e81f0a96a98fc894d65c4e7c4612d303c3f35f
-
SHA512
bccdf82c5156af35b314d6474dbc0be14923e3dd33ac320f32291532fd388185e6d26a9712d0e56b8efb2778f586cd19ab098d7314e5391d3f34a52440ac15e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-16_42f6bf204c0787e141bf43c3c07316f2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-16_42f6bf204c0787e141bf43c3c07316f2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wIyRQPN.exeC:\Windows\System\wIyRQPN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXxSmbt.exeC:\Windows\System\AXxSmbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amicYxH.exeC:\Windows\System\amicYxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bkcHThv.exeC:\Windows\System\bkcHThv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frCqAAF.exeC:\Windows\System\frCqAAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOgwSwF.exeC:\Windows\System\fOgwSwF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICNTxMf.exeC:\Windows\System\ICNTxMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMYnvAV.exeC:\Windows\System\IMYnvAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UdqhByS.exeC:\Windows\System\UdqhByS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPKEaCP.exeC:\Windows\System\XPKEaCP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FajrpgT.exeC:\Windows\System\FajrpgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShRTWVu.exeC:\Windows\System\ShRTWVu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AhwOFIR.exeC:\Windows\System\AhwOFIR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wypOcWc.exeC:\Windows\System\wypOcWc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICzHMJt.exeC:\Windows\System\ICzHMJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvVqCmE.exeC:\Windows\System\YvVqCmE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfuDosg.exeC:\Windows\System\dfuDosg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GENIDZk.exeC:\Windows\System\GENIDZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yrghrXJ.exeC:\Windows\System\yrghrXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RflPFyP.exeC:\Windows\System\RflPFyP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xiqEaGZ.exeC:\Windows\System\xiqEaGZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5858b15cd76862a92f1c11d32b606735c
SHA18fc761f4054c22b00eed78c78092f144d21c15bc
SHA25655c201e3cc224996e231496a8bf2c6c2fe65663468b905ab25ff02c077b95b6c
SHA512b0b0edb468c2d43cabcc05787c41e77911deef90d9ded41bcdcf84387717fb770ca37fa3267e3a87749341965d62abdab9f37503bb51ec79e76c6e507ca71eb5
-
Filesize
5.2MB
MD5e37d81fe37270d5a3959aa0c88f814f5
SHA1d607bb70f13b4c15cd3770a6c1cdd5939f6ed48d
SHA2568d0d02c65e895f90c0c9fe3412281ee7d301810c8b362d10c0841d3bfd15d901
SHA5125731a1d729e2961b3f1b3497f1dfeae0fb2b1c2779ba777aa7b20c8c28e10cd36705fd3c287abfb467e43e38395ffe78ecaa56f9ac492fc542c776d953bcdeb2
-
Filesize
5.2MB
MD57a20f3c082e8c5361f64dd644d8b5723
SHA13a9f2a81ddbe20d1e76725a11cfdb3b81d2fc869
SHA25677a391bda06b12f8c233879aeda387187b259aaf78f852559665190cc9b70888
SHA512d4e9f17b3551e86757ffd2711bb98d7cfeb860883837386874612b9c02bdc5a4e40b182c1d73427e3e1283aef28bb861a665116813458eba5c974059d13230e2
-
Filesize
5.2MB
MD50669f758243b5470ca50d699caa09e5f
SHA19b569a56abcdcaf027c33bb238ae70843ba3c188
SHA2562c7f74486b9e38b4833326ab5db7ebd8fdc000520a8e88e8a621ba2b6fe0c4c9
SHA512d48d7426231c5d3b955595b19c1bf21b6e8499eac6fa38bd5e876ec5b4762aea018e74aab6a6041b9c780944678d644e3f5ee31703f21cac9b5691fca2f13f99
-
Filesize
5.2MB
MD52d39e645c3ce54dfde23cab038c6eeda
SHA11fd0dd61742cb6e40ed833fd4f398847da9566b2
SHA25679a37c2ce97977dae337a2a99f384ec1520ad1474754d5d65520723ca957a944
SHA512b02f463db80c71004268b86a919271235ca5395e5fe6f08d7d3e4a950682978dc84dbd81c3d6cd97ebf76d745ad4f73ee6d8b752479b058d817c693091327910
-
Filesize
5.2MB
MD5649a51a39630ae152d5ee343ea16dd4c
SHA1feb0e6d387fdc9dd8d7ff7948c7309f051918477
SHA2569ad389302d71725e8a0fb576e89d3c21079599ddc27331563659a3dd0f7b64ef
SHA5123d95f1fa5ade62bb1566c9d17e53e7c90d2777a993ccf7819f69f90bff21a3d3e5c3e9b9fca451b8f1b6a0e1fb03f071b79733339bdd5d41586e392262c8d668
-
Filesize
5.2MB
MD5c6291087aaa0e5ed3e99f5815b1cf39f
SHA16b0c110883c3571201d17310c4fbc17b951f2ff1
SHA25647241ee7100da24ce8bd4fef19a8adba1384f43d374cc3c858911aa66dce2500
SHA512efe89c85e5a77a0f210a7fe41bdc3d68434f0482e462c812a44e4f4f2e77eecba9a0c2c1f52d7ea367e954757c4d1062a0bdca82e30f7d68c9e5b778e18cd033
-
Filesize
5.2MB
MD51215dea63cad96da4f13ff21992be158
SHA1021ce70b184b67b13d572a7376dc1a29337c74c3
SHA2560e912d3bba05f150648e6513cb07c01bf224e95b5d48ae257ae3b3cf38b9f75b
SHA5128ed113ba75ebdff05976aee5c3c4a8f04cb4b192fcf9a9c7b90d2d7f9d3b5badb225512eefd5538a11091ce3218b5d2726da055ca7b650b2e359a2566fed67e4
-
Filesize
5.2MB
MD590ab268596f7cf9c09b5cd547f362fb5
SHA1562659866ba47848f2dd29cde6490325d2dc421d
SHA256c8fdc5c7894490b8961dfc7df7d1beec972090990beca03695b2dfb7938a0a2a
SHA512aecf873afd4d4e9b73f2bb72b4b1bc26c45c1c17a33880b918c0e56ec9f2214ea37027ec16b18d9b41a873372c151cc4dd578757aaa4a8f7c5694f759193bcc4
-
Filesize
5.2MB
MD5488f09abb064853db599aff4df40257b
SHA116037e3a6abc5f4962a271f2f71a25f7f73211a9
SHA256fd44c74b161af1351902fcc335e36821bf9f011c65fb090af8549894e98347ea
SHA51294ed888e97c1e99be9e5bafc755cfc5f5c0a6f5c2f11b6c65e67912a53828033c5b8498254c727481ba2b444e427d4d202fe89863afcd90eb61f3019cad0ff88
-
Filesize
5.2MB
MD5f602b4fefdf5a09d7d86fc5df8ba252b
SHA181dcf3334e6d088d6e63c0a17302134416577ac6
SHA256b4bc03339321202ccb8bbc2197b5858da3110661b976a3cc409bf44a324a27ed
SHA5126cdb03957fbb38e65f61210ab3cd9b351002a90b63b2e80ffc95dfbecf51c8ef890603418f825d56b6924d738f2d6c45f407fbab43a8a0a72d9ce32a4a11858e
-
Filesize
5.2MB
MD5b88121def13a83314cf78b957f6c935a
SHA1e95ae006690247dcb63a2258980e0213d136aedd
SHA25687731bb7a41de8dafe5dca98e79d09f98c744c02f9ebedfa819647230dae5d16
SHA51201cfb61c2b388bd919bf72d99e2ec3c01c0448cad26bd7139ffd6bb66eaa779796c9ca0d1d9ef4900f7a7fb00a631d623631f71d822ff4b026713493c4820588
-
Filesize
5.2MB
MD57ebc122fab8aafa0b3973b691bcf6a57
SHA1f3fa7410c1dd5bb030a3d9b1901cea8f4d85ce6a
SHA256796a56132806af0054c11c068e714f626ab7d3684718ba32ac3b1865567864ec
SHA512aeded7e9bbc40e1d2a7aa20ebd8158e50c46eebc895d9abf62d8caae59d9db1a04be9c49a3543efe73fdf27f8cd1aaded71c5a29e31f5212b39d2b74cae3fa7d
-
Filesize
5.2MB
MD5d1eb2c9fbaf18bf67d0bbc66c1920e17
SHA16ee41fd93b3f8458170c1ab27edc4a15ca213683
SHA256147b6b91d92fae84801678e3fa115fb73184707fedb0a6be427bcc5304b895ba
SHA512c9a5621b6cb6c73608b0c9d064913fb8215478f29a1279f4b89cbe48acdd5763ccbc435373ede46aa8111ba6de637b96c9a53a1edaa6734d0c4f142cf84cb125
-
Filesize
5.2MB
MD5a34bc6af9d0e87348dfcade6be044dab
SHA17f5789f3ccdf523add2273009626bee543c5f6bd
SHA256d212d49c77e16906a1516ffeef03310da0b0d71215d3ed1621f29aed94754b51
SHA51264837262d449e2e3bf873579e163929a3c6c74e674555890e6caf9d86954a32eeff7df35369fa0d9171fc72bd1febbf6eed76dc4cb2434eac5b1a96915df011e
-
Filesize
5.2MB
MD5f0071917f96c674d8f43cb9688092d45
SHA14de46a0d3194e974d40d9ef761625c21fbfb5848
SHA256c1e15e37ef2271183c5b49df6b9168a3259720fe04b08b81553e6d8f80eb6a46
SHA512b835df097fe852e3484933f9cf8dbc6bcc23dc9ef04a851216cf3374637830973720eb42df9bcd7a48a81eae44ef3a058ea60bbd3787c9cacacd6eb22c935bd5
-
Filesize
5.2MB
MD554761fd2355757711ac3786dae89e0f0
SHA1f8f55dd9e9d28e085e1cbac5dc9699fbb05ec462
SHA256898b88630ee51eb90e278af9bfd43711b8cf1e572cc325bedfb748282f5d42de
SHA512bd19edffe26f239f6d05cbe0846c1b2b6adc4ed078c8a12cf0861a8105eb9342193385fb54ac9eb5ec16bb9d5aaadb72674b82f646c785a8d914ddf4dc5ec3b9
-
Filesize
5.2MB
MD5f3e9b7ca8c42de4321e612d6679652e0
SHA10aa1676f02f8487c03aad3719680bbf634ba2f3b
SHA2567d368472b052c1b77ba1054a79d797507de9ec15a21c8926c9f447d3b37d6231
SHA5127556e5c0753e63e84bb1b56cdde5080ee681537dc7af7adf20a43a6a9f3f96c07059a8b44fd9603057292fbb2c2d282556dc93a34ceed4a730483b47c2828b22
-
Filesize
5.2MB
MD54975e53d7beb05afa4f6566ca67138c1
SHA1415209660ed801f70fef5aa34b0c91f75d323afa
SHA25602d303e5134d61a523938f4b03d8cd16abbceb6ac052ce2991caf6369e91cba4
SHA51225b7ad3c77eac263e90c8e71903f3b74b99c5aef42ff268f6f13817929453b3efeeaa7fa75a15fcca67ecf93d6c8ab24d5b1181b82068e13fa151745ef76f028
-
Filesize
5.2MB
MD54cacddf8d39be83f82eb01031c83f641
SHA1c2d083938eba82c2f09069f189483e93cfc89813
SHA25662e5df85db64ea2470d809bdd8c97cde04eacb0eca63c4a80b8f9b10666f424d
SHA512574bb46d6917d340aa68e58cc4c88ba17f540abaa019b502353449b1570752a3896c5b96b7ec3eca6fd8112f915493ee0b4cec8cd08d75e7896c812284d71be8
-
Filesize
5.2MB
MD587c6f627e5446c0f90acdabbfdb5633b
SHA1531b5e116faa94594bf408decce6062d4ed873c4
SHA256fced77803e927d936b4c141a3ee2c3440e2158351b760c3ad861ffef667313c5
SHA512f738f1a3da357ae37869df4c408dd4f3f70d3d68020f95d34a6d7f7bbbae88acd50e8df46cf72570ed80e4d2c8ec06a91a21249aeee0cfa34e1bcd8f289c2c59
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB