Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-11-2024 01:00
General
-
Target
2024-11-16_a1c1a1fbfe18029c956ca5498c0c5ff7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a1c1a1fbfe18029c956ca5498c0c5ff7
-
SHA1
2fa527e9cc98228827b5dbb2156b4aa96eec6488
-
SHA256
4d59bf9a42ae8194b20c8683427320d6d167061448b96fbebcb4b5c02d35da2e
-
SHA512
c1edd6bf50578002cf37397fda96603cf86efc57754e810748649fac527007363cb3ddd1ede38adf976b9e97f4cce1590796490a7d0ffc404d769179f4f97693
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-16_a1c1a1fbfe18029c956ca5498c0c5ff7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-16_a1c1a1fbfe18029c956ca5498c0c5ff7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oHmIsfv.exeC:\Windows\System\oHmIsfv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WTWuHVN.exeC:\Windows\System\WTWuHVN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JVoUEve.exeC:\Windows\System\JVoUEve.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrHietq.exeC:\Windows\System\nrHietq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kllRfEA.exeC:\Windows\System\kllRfEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfRdPEh.exeC:\Windows\System\IfRdPEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwCQocx.exeC:\Windows\System\FwCQocx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZGKLqu.exeC:\Windows\System\iZGKLqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GmXDMIv.exeC:\Windows\System\GmXDMIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NxvVbVC.exeC:\Windows\System\NxvVbVC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMCQkuy.exeC:\Windows\System\XMCQkuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jlKUOKo.exeC:\Windows\System\jlKUOKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ENQyGTi.exeC:\Windows\System\ENQyGTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dGbPyus.exeC:\Windows\System\dGbPyus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLpKzzx.exeC:\Windows\System\jLpKzzx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\prBfVkg.exeC:\Windows\System\prBfVkg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bMjVfGo.exeC:\Windows\System\bMjVfGo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fJAIRYK.exeC:\Windows\System\fJAIRYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUeBXKa.exeC:\Windows\System\FUeBXKa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAAcYEl.exeC:\Windows\System\jAAcYEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmwXvLu.exeC:\Windows\System\BmwXvLu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5106c8d027bb0ddea35d67e479bf6ae80
SHA128fe0dd8484272afa6a41a2486117720a655f414
SHA256540823acbc65eb6e7577c608a0cda5286c6ba329ab089d5af2ff930b60eb88f2
SHA5122c5428b472c1e87cfd371973f576fb5f4bda44434de31a49e7840d9041dd6d6054c069c745eb1e1b43f149d320720de2ac5eebb4823e617a7a6e4f315ffd22a2
-
Filesize
5.2MB
MD53b833afaa3922d5722842e87b23617e2
SHA11e835562f1710131b13ff04386eecdb1cc5c6bdd
SHA2562ae57a3b2ea68b8746de47f18c1a4e9d5b0193fc33a7f4a5ce9e25bb6550ff5e
SHA5129a30c637fd6929d59874f8a9038a00208f167d4ba6f6160c1ae9b4ddb69dcd467196525e9d1f0ecb96d5985b49c4cb2f688d44fec4a29e53211a0d0038984f42
-
Filesize
5.2MB
MD5fb61ad76d3b2157807de4fec3b2a8e67
SHA1f852f6b31dea7d2d22c37b6457b12c05a3b686bb
SHA256aeb1eff0f87e1063be8ab7b82796e2d75c7925ed306c6edc390a365e0dd7207b
SHA5125313f862526461e0dcf6948c99da5d5b73f5be6d2d1c1d55da7533d421c0e758a08e4a8deb667b375c4660d1393b345781f637e81d7d5764673de4f098ece562
-
Filesize
5.2MB
MD5c40b54efbaee9af8e86d6cf357e292f7
SHA153809d4f644dfc57a6ec7a96a0ce8336f19d6192
SHA256ddd310cf64abddfab0af0b6501651059a2ae91edfbe065b4cf11532f09f3c559
SHA51252ca1eb8cf69ac6874ad95b107eabf30c1e416540a8e7aa72a532b6eac6c319ca28ad3038bc8bbd88dab6f45b0bf905c4c10c67ac244e2e8da01af9d70dc3808
-
Filesize
5.2MB
MD57cd1cdd5eee24fdc0b86d166bdc2a9b5
SHA1a00803b99d59241f111b912651795425bee35535
SHA2561f8dc80302cd2de3adc6120e2c09b5bf956eebc8b8456754b46ecfba48ed4e64
SHA5124519dc1961f194dac41c8167424088d9020b6e51511ba2be5aabdb3a0d57907ac39067439db07b9d89170b39bda47ed57c3f71ded4183f4b3a8fe1161f57875d
-
Filesize
5.2MB
MD5eb47980c025da154837d2eb49d8e0087
SHA12b0424b801641fee5a88f86b965231838fe42500
SHA256a5ce1459fe0e9f99a3c857522d0056705eb5a5c999b7329c13cba839fbd33781
SHA512a5e49462a95c765dd8e5c7a4326513352cf4f7fa76ba324ad278b635a98857805f01bab622c2fc7ff28ab6bf26e779ab0179db425c151d140087fa3c2856a045
-
Filesize
5.2MB
MD5751e129555cac612ebe560a117ee0232
SHA11012b4c15da81206389a781b2f5e48c61fb2034b
SHA2566d3a240adba1ee9d5c53bd9da0a46ca58e6a3def8859ce91ee5777bfff292b22
SHA512465be266188975cf63eea8a9711508e534aa722f70a65b6a7fd940668c1e8341dc6c1fa68d98e4b5a70480800ecec14b9c56328f05284b19d1836ce48c8b4af0
-
Filesize
5.2MB
MD5b5aa5edea333cb7fc8a8e8c31c6f29c3
SHA1a322759a66a72eb4f56fad7ddd851374648fcd04
SHA2563f603ba9f839e05dfa0281e05b02784db35a04518e1bfba242ae7657460b79f8
SHA51290b3c2b741054f34dc70b7a2c6a267b3909f3216dd0e4ad99815d3926f558fd99d76a5ff38afce8e01388bd09abebe8763e41a9609621ec8922fe393c784c659
-
Filesize
5.2MB
MD5d7db9cb11d65992db3461bedb9d3378b
SHA1673a6e8687ef5a90d701b1a5f74c58ad4affe9c2
SHA25638220f8d3edd9111a2c96d3f927e90a7fb04f9ed833c082156bbd55e40b2067a
SHA512676fef99196d3be980c1dc5890143121cd516ccb0a6ba4eae4ea755dd9b857274df56741d45b8440e4d0686147c05f6efab88f9f65d7a99aa68fcb38bb1c4ef2
-
Filesize
5.2MB
MD5a4dcf1b2c15fb0d0013c95d70a453a5a
SHA1040987e2b62ddaf99168de78a4f81cc4cf2d20a8
SHA256113f5ea68a24164a264c14071d4a1f7237d2e76ef91057dadbdf2b9d7f8d2d89
SHA51297b3dd569c40e2138e6013b229fbeba1c8425549dc6a8fd0b4c97fb2abd7bd55218ce18dbc35b54b295619b3f42131c687babe9657fd07e0df3c354c05404280
-
Filesize
5.2MB
MD501c88ca0fd5d0e6b9f15a7c4fc49eb75
SHA1ae887ffb4acd996cb66caa5ec118608321b8b7fe
SHA2562809934cb4df9db7255773988b584438acd49e70d8898457d08b952764d6b15b
SHA5123f4eb37852ffb658d2734e946e753e999397cdf00c7e086583c7b009fac0c0dfb228c50a7f72e8af37cd7b0248897a2468ed8a89cd3ef656d7b181b08e5008f1
-
Filesize
5.2MB
MD5246a9cb57a010483ab4e073e5d8b0183
SHA167e4fc7742a1e6f5b96a1338b94248b8eef63d43
SHA25683d0612ac350554dcb6ee3c0fadb7d2b60277bdedbc1ed960f003fe5540d56d8
SHA512fda4cbba5022efc399f4f3ffc511b1a50e71908fc1890e829e6926bf26bfaba54b23b39552fe101da3d835f0cb6188958d234e84aaee123a84e674af48a49d85
-
Filesize
5.2MB
MD5d0f0e1b2647768e4d0314792ffd4b1f4
SHA113a0a75b85e1cfd592173dd5b79e76feaed357f2
SHA256aea457ad7616b240599ab573b2892bd4206cfb03f2a27264bf71aef5cdad069b
SHA512f8fca825f2c4b323685928f2540ae1abc3c299260aeb39cb1d9ba5cf48c7267f57360158b4bbe20062b59bc7ab5eb995fe343928a3d367fd96c897280e8d264d
-
Filesize
5.2MB
MD5b76053da52af8b1256d02b54cfc429f3
SHA11c0c2d1be00f0cdcdfe834c96f14476d9f1de2d8
SHA2564cf3196cfa2efa39984eec75bd4e11e206013566eea7ec6151b1559dfef60d0d
SHA51271f388ba53b8313254a9454702c0714479407fdef5566972f4c2fcfc815e1cd627e8bf392284fce4e0a50474b6e1909b2d4d3084faa5bfa1f0ec7a140309ede8
-
Filesize
5.2MB
MD53685609215f7e106936ca8d3dd7bb3e8
SHA129d110fdb0a4a619976e814a0940d9633b3a09c3
SHA256c9cbc8d21541693d019d88a992eca0c85078032ad894907f8aced8e14d5d25e2
SHA51290681f50eefb10aa8f18847a3796b4127328a7bd3cdae64186e28d024993c02b84ca46dc59b3bbc83d9cd1611a700af3cf0d47e7e7efb61e1909490a7412f2b0
-
Filesize
5.2MB
MD5bf9dcebea6711a1dec22ac2773cc8018
SHA17a88ecce31ce7a7911518d07f5f24a12283a30c9
SHA2568503990fe4c6cca06fce00ebbe28c89b5393b09aebcfd62e695e8318996d7eee
SHA5127f43da4d155524fe684e1272169399eecd42741e38bdbb1cd1a2ae28a8a7c31d5dedb664eb7dd75f3888701c9a4583c7040b6d373e853b5c1d96c2bc9bd59349
-
Filesize
5.2MB
MD50cb99b4931d20b80302f322b62e74b59
SHA1fa1483b1d48db3d8e445f28255c2904d246bc974
SHA256fd2f39d4ab030382a99f7f2299cd9f6ed8d6404b49da7ce6b334d129d5ef570d
SHA512363bac2b6609e8ca48d71f783191c4a294547453d0914f05e5c7aee671cd52b8caa3e7a1515607a96aa575775f8f22d5d90b0a4413c8d2cb00934a1c3c6d68dc
-
Filesize
5.2MB
MD5c58e4043bb6a814109588ad8b306eca7
SHA1664dee689258e7ac7fe6395e697ad825fc195067
SHA2567784e9e3cdd2187ffce1bfe5352bc30a693342c1656e931b2646a985f6272feb
SHA512cfca3affaa789d53ae9e545b7b405cc9b202530f4460631400e1570a287b73813ab4026e39358e0cbe150dfa144d62507c6260cbaad2d8aa22486deb9e676767
-
Filesize
5.2MB
MD594b0a94f786586c1fc54c67eadf52752
SHA110986476e11b0e739685192b2b3e72ecf9ef1197
SHA25643d6da3dd6efcd44076cdc9715585f0b6ad6d1717ac054f247a5e33b8872217f
SHA512c7fc13c6b7394e8bc903c6a8e0bfefadb555ac519e2daf28868bc2a8792b4fb5ea8c9ab5b7670ca3d7c0a4b9aa3dae188f93265f0ce560abea1ca8461672aba1
-
Filesize
5.2MB
MD57372fd115e6be783cb4fa2fd157c7971
SHA1352d95eebe9b3ebd33f6faa446c69e746062cc8f
SHA2562fb010c2ab4c06ff8b5a9929b09003becc42ead802645cf37326984251fbfa27
SHA51244917bd34542829195b37abf76aa4c0eaa6717b7380623aaac0cbaf7cac9ee84fd2db3d1658db123fcafc30ec16522635272049cd9b471aa3b9af49cff1051a4
-
Filesize
5.2MB
MD58d31d9e60302764e28455d91961fdd03
SHA1dda4fbdea9b1e80f65748d04a9f9dbfe44a9dea2
SHA2561684a6a9059e1eff26452554fcf15d4683b02b6ada1ec1b552d44a1700187b2c
SHA512e7fe4e15900732bb1e458de6cd0487c273b4a847d0d33beed294895e61a57e95df7d664ca35206d11f17713bf58e0e24c5b62750dec8f27850d2fbdbd4f58324
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB