Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-11-2024 01:08
General
-
Target
2024-11-16_297712cd8138dd42d5b87117a1feb336_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
297712cd8138dd42d5b87117a1feb336
-
SHA1
94aff345125f6e02ab4f2d5ae7f8c7ea139e74ce
-
SHA256
35ca215b492719ea0a6a96cf23682970cb8bb25609f05a5f66f47d328ad1614a
-
SHA512
a4ea8307fcd3ff4e3bafbdf0ee97e262cc0298baf62e285cefedb2286ea06a6e6b0744cbdef2a2b70829bdcb4e7a873532370e890d6d5b8040367356f293f3ec
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-16_297712cd8138dd42d5b87117a1feb336_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-16_297712cd8138dd42d5b87117a1feb336_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TDEWDjn.exeC:\Windows\System\TDEWDjn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJZIUCe.exeC:\Windows\System\PJZIUCe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MhXIibv.exeC:\Windows\System\MhXIibv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hWnOIHF.exeC:\Windows\System\hWnOIHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwUUucB.exeC:\Windows\System\wwUUucB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EWHYsiu.exeC:\Windows\System\EWHYsiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sAbVjVj.exeC:\Windows\System\sAbVjVj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eMgOXMp.exeC:\Windows\System\eMgOXMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZuCISwe.exeC:\Windows\System\ZuCISwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EFUpyoq.exeC:\Windows\System\EFUpyoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCjqMMf.exeC:\Windows\System\KCjqMMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFqXNnA.exeC:\Windows\System\MFqXNnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PWxsFKq.exeC:\Windows\System\PWxsFKq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbdnZnE.exeC:\Windows\System\dbdnZnE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ouvJgzF.exeC:\Windows\System\ouvJgzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNcrqXN.exeC:\Windows\System\pNcrqXN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzhBHZl.exeC:\Windows\System\xzhBHZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJycTqB.exeC:\Windows\System\lJycTqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UuuuHeN.exeC:\Windows\System\UuuuHeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnZvaiE.exeC:\Windows\System\EnZvaiE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TrzhHGZ.exeC:\Windows\System\TrzhHGZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ac442847d8fc570894eb9baf5ff3a9b0
SHA1d14fee4c613c88009934b50db452f8d00783308d
SHA256784e67519e1edc042bd1166b58472d7291ebe346e8ec12497d5fe6d4dbcf0930
SHA5128a9b390a9868b6c7a0b7f19e18fc4c9de47920a9b1ffb37778290ffdb8afd3ad28a5d21fd88f81e32b9921bb6055347dd07a2f5dc336146e6d1f576b525d7c3d
-
Filesize
5.2MB
MD596c604b60cf1d9f697a51f71bdd12a7a
SHA1aa55c12a64b1c0eaad73d748e8d49ac6fcbbf320
SHA256bab49c6a3d167341e47b1b4faa07af8a699d4c2e457a7af6d00d0274d12b83f5
SHA5121ae64a4b0712bedb59afed32eea84d2b7b92fb6936b84f48e602fab0d5056b8fdc488f8a07932141d4bdd4692db91843940bf5293234e27e7ab2df7cc916e2df
-
Filesize
5.2MB
MD514af4c3609aa88580c74d0d1c9638571
SHA131e05319dcea4a44901e1ed7278c018a8f812682
SHA256ae6ff60dfe09b66f881b52e519a101fbdb36d380a9538dec95411a4c19039849
SHA512b8eb9929a65c03a44fa322bc4df1d01aeeccf8a2b2100baa8c94e059356076c564efe96529e2ee7300a67f0b9bd83ec23c2496f0e89b8d72f173c88a5fdaa6fe
-
Filesize
5.2MB
MD526f9dfca36ad11d2e9f319062d806469
SHA1b4b676f0bf489e46d10d958c49e9c037c4e75015
SHA256998e86d48f714da2403f122cc07702ddb837af6bc1e533b0d98c9db7e616ecc6
SHA512949a985b2910ccf49cb3fbf400c10e185b5081b56a0b7a5d8290ac2476956a1f9709552d46c3cd828f3d24a61c169358aa5f650a8b3fe85eaaed8e0be9e43d3c
-
Filesize
5.2MB
MD52b2a6ff3d9262438aef71c832fc58b27
SHA16366377b81fa108a61ca54afaf6ec6eb4e00e6fa
SHA256dc06d77218f8158157c5160f30d45c7c33bde254da920c9e1628ecd6d75028b3
SHA51229b8198b1abd3401ed780c6b7f135b805c1558ce5b9b2d29de7d43a497c6a50b1cf6e0a139b62eeae3d9aa196d14b91c05f0557f7ae7567f8e5ff8d0dac3a096
-
Filesize
5.2MB
MD51273be32ca736067e8e0fe5b5d23ad3c
SHA102e90c805c01656283bfbce2ffcc59a97c8a8138
SHA256381d5759b695571b048e98373a380876132b74c4806779a241a7e25fd15332aa
SHA5125d2282cc0ec3dd365a43e75b2d061e8d51d075b9e91e2ceae506a26e6cf6f1e295cdb0740fc85419f2800f11c3fa3bf3b813f5390502801774481500be996958
-
Filesize
5.2MB
MD56c2117b97c76c20c24b51b1bb45b2e6e
SHA178f6aca9063ccbb4f3b3dc995912cbca4e0988fa
SHA2562f6c92db2b9c25848a2bc8c63f7d47e8e1f2c8af0f1674e50991891fa08e9e68
SHA512eef67eba44eb97820314446f20c61cd140d099d3e868bf34d16358b9181d6c797ef963c6774111e8429119e73af7327c63912bfd14f717ec639814050bd343e0
-
Filesize
5.2MB
MD53467b001d339e1628e8a2e83e7d20376
SHA111453d79f545eef56c8d219290998b09c2e01b4f
SHA256c2bb3e83a50882badd28f29594f8552a58c79d07c6dd9cd9c3c63693aa437993
SHA512cf74446cd776ceb63c0ccbf067595fd5ecd868415b92b831d1f3eaff2ba95ab63a6f45dc71007f7096465ddab11bf0c77af4ebf40d4f750f03c6802230831e93
-
Filesize
5.2MB
MD5e3767f26746eb33ae5d9db7d2cc1eda1
SHA11ebbce8c635e2efcba55c325b51ad3cdda6dcee1
SHA2567981f53b11d800b2c460ff3cbb475c3a2eb496b367cd0ba2a15c269c92b9bf33
SHA5129dd1d9e326d95019c8a27c5fdea1cbcb1f7167d94f7e5fb40b58c9066d795f48d3708e0e4d825689635d7cb9692be0c785c94a19ee23c2571527058a0a533cc3
-
Filesize
5.2MB
MD5d2673c1b18d16c49a27b0c6442708542
SHA1b2221766dd0c78fe091ab376c70f7e7c48ebb342
SHA256c16563ffe7ba59f36bfc5f28aa1d33945f07bbc2bfa5628ae537ffe9dbb86a67
SHA512bd3f15db9cac32db5092186f64eed6ea6ed1eb1009784f19f9de38a8b4bda2e0e906c6a222327291de0af8c323a36b82f2f57fe2141101874b473128bfc87542
-
Filesize
5.2MB
MD533237b8de047a6fcc9b8e29d11dfd605
SHA1c16e0413e28d46c1b9a623c6b80c4b72851cc5c0
SHA256a15bcce4af6428d1a469e1368880e6c8aa435730bfa1b8aded082495d1742e1b
SHA512106f5665280d2731421c07146a398e13c962d2636b79e4210c8bf5120be6131a7b22836292468edae7ac0891f5a53377ba8fa0e39dc01ab5378bb7c54687dae2
-
Filesize
5.2MB
MD546e9236047aef2b86b3f7773e0419070
SHA16dede58adf64291bc6d93d302d0a85effc71c1c4
SHA256b02bd7839f367d9a1a9b2914a6cdbdd493ee360e82d138f2e1bc978830537f68
SHA5124bab0e9cae5971960960d301ce6738a6614b3d8f761f2dc5625e552b34f7293ce09083fc3592113c336237cfbf312fef63d714dcb393afb3fb57b038a62ff593
-
Filesize
5.2MB
MD58cab55af77a483db9ad1d9e85eee1bc5
SHA1fca741957e2755c77580255c17e27a3683ba9b54
SHA256cec8ab2bb8439d93d9403d9f243f6f85f6a8b7efc4fd2bced5000a98593e3bbe
SHA51206fea6ded1c5a9725ade626e9701fd8e29514976975bea02de656646d96622f9fbb082f7b511511ef4bcc1e57d4ef20b959364fb74d5c2ae517ab5a6354b6bee
-
Filesize
5.2MB
MD5fc148302d6e267b066fe81f0c2166f3b
SHA130a60e78e92d77f2868210219899afad867d61a7
SHA25628ddb1a52ebf29ef61c796b17ed71a305413648fbf39ef5a088c2a99c7392ac1
SHA512a2b5c25093002f642c4d1dc6e6fd413493b7f87b51e9bdda71634ff18170112c0fd35ca96609f34c3003852eeb8ce6c8fe3c69954354778bb8cc606579be2a8b
-
Filesize
5.2MB
MD52fa1f0ddc42dc6eda16f75d4e82867fd
SHA15448727196018634c6274a63643d7d7ce8a589d5
SHA2568777bcfd019b1ec9feb38b1f74c4eca47d9ab737cc83132efbcf95af05198eef
SHA512fa6d9ce83f08f01aa809aabdd568ba60635402072fbb2b39dbbc4e884d23d50bfaa92cfb738028d971a5fc5d97800cc48ea2458ea9727cfd209353e5caa1ff43
-
Filesize
5.2MB
MD5e0cb400e7fdca8eebc21d0ec184b4a32
SHA16174c67ee96bdad136fd59f8eb8ee574d69f8152
SHA2560c6fa2ac783509ab57b11f4d7d237463148f48b8eba556a26c77ad6ece2ea4ba
SHA51204140523b30640fc0e93daec4d19ddb97858ab80badb708fb258d3403a89d26dd7549d18439214536f16dd70b1b9bd1de81d93681393050cb77afa59a67a2341
-
Filesize
5.2MB
MD57e392787139468ad85b20e926d22ac96
SHA175722da0142c1f571960d9df0b8016b8a7a74533
SHA25652a724af18fe77ab36636782a738a25eaf263076714752c42442b585e3c89f90
SHA512c4174bd014851203fa4c79d74bc82bf6b0c10180a39ba31bc66da994bcf12d221ed7c22a5c30a9783ea02498c06ee39e01a6d56d29020181fdefac4f08397843
-
Filesize
5.2MB
MD5e0065d099688120b1f4e4098f2db45e6
SHA1822d287d86d5c8bc04eb4938f51152862e41e87d
SHA256add00e14c9a417686920665068c6a0738ccf2b374da9e22bb1978aea360a0d4c
SHA5126050d021fd608cc27bb2a72c29ed018d5502694339e24f627d214fd4eef8c5b5b36c7d3d5c77569915b4706cf67851523ed262810e0f16dbad1a50a29b99a189
-
Filesize
5.2MB
MD51ed2a8d83fbe6feea8d328f3ec1ba9a9
SHA1214fb8643ad779e728bb9b16c4c7a397cfe4b2e8
SHA256ca15af0a0138b03221c1aa058147f351299a7f84c0f5161c64067960682b58d7
SHA51201c5f2eb291ea5dee8fdcf950295c901ce82a79c2a9af6b2f6fc1c5acf3e8846d37cbef3481bb182ae54d9f82ee1114a019c6dff71842f0ffdb0499de4a5f624
-
Filesize
5.2MB
MD55569e1c63c79f171536a3168bf4b0781
SHA16808a0de49333f6143b6a29d727f11f6ad4d68df
SHA2564ba292a97f3b7a4ac8dc786c247b8eab93830bb233d9520af133f30e66a25c2a
SHA512fd29ec1b3bdc02922495a8bdbb59991e9abe6a78e3a470a78610e080bee3bad46df8641491d58a75c0c002d38f2639afdd6a088164883adc39ce69ae09f2e1c5
-
Filesize
5.2MB
MD51867e50c5b6a2a189e2b46ba1540c1d6
SHA1ba4342b1c5a2c3e9c5a35ffa634da0dc968de330
SHA256f0b5de472a56549e1c41bfc37d539fdaa8e7e1647fd1e8972950beb01af57a3b
SHA5124c6929efecde3610d66a67390ba4b27a505a9c69d41868fdb59849b6b82b56188533b7779bca353f25a5f5b14c6b0d1ab616da0a80525fe1c82387ef5d25f7af
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB