Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 10:08
General
-
Target
2024-11-17_a85e71a04519498a8dacb40825d29b20_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a85e71a04519498a8dacb40825d29b20
-
SHA1
36779c5a3c9a3edc3216dd3cd88b30f02e816ba6
-
SHA256
ca32e834c6a719da8248e3df8e118c02e592c7ce7b0cbf7e758ab6eb384db953
-
SHA512
976926cce083cece58498bc6b3cecad338b5f17bd9d559838b316d512cb0d1328e2a7fe69218439eb6313f0d88216eca9613bbd43071b816ce9128cfb50cebfe
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_a85e71a04519498a8dacb40825d29b20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_a85e71a04519498a8dacb40825d29b20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CIoNGiY.exeC:\Windows\System\CIoNGiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmgIKrX.exeC:\Windows\System\tmgIKrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNuRfpP.exeC:\Windows\System\RNuRfpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgseYZn.exeC:\Windows\System\QgseYZn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVkupni.exeC:\Windows\System\DVkupni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xBqKXGu.exeC:\Windows\System\xBqKXGu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPuagBn.exeC:\Windows\System\hPuagBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KerNyPe.exeC:\Windows\System\KerNyPe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Wigyetp.exeC:\Windows\System\Wigyetp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnjiSok.exeC:\Windows\System\QnjiSok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\voZWeGA.exeC:\Windows\System\voZWeGA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkwPIgv.exeC:\Windows\System\TkwPIgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UyRYOTZ.exeC:\Windows\System\UyRYOTZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWhnOQW.exeC:\Windows\System\cWhnOQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkmQqZp.exeC:\Windows\System\JkmQqZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFUibSP.exeC:\Windows\System\DFUibSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhMOhCE.exeC:\Windows\System\KhMOhCE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VwuJvuE.exeC:\Windows\System\VwuJvuE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehzkmTl.exeC:\Windows\System\ehzkmTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IXLVPPH.exeC:\Windows\System\IXLVPPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cEmYggH.exeC:\Windows\System\cEmYggH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5601721ac78de6384330783cd57d63980
SHA12b11e2429e18506939fa0d48715f9ce15fefd5b9
SHA2561459f6a5f64aa050f0429fe892afcf9e9264143ff331d36a7745c3cd649281af
SHA5121c93b3c426f6b4db8e85dda101055486b31c7b4217090dcd6d9dd2a8ab5fed49d50e237efad3e63f117ce6d8d41af1eb24b550117958f0083e1705416119192a
-
Filesize
5.2MB
MD5382848c57adfec2aa4a5ac7f351f8880
SHA16be5487a6124dc1eb3ad707c9badc0f8c8154a19
SHA256b04a7fd7eb24dc2dd043e909ad484d8253a0b8f5a4e5e21175d66c70e66ae2dd
SHA5129287323604346d20b97f4d0fd5f53f9ccb0518aa6faa356bba4f24268b1dea1893233b138293e3ee137143b3656e9dcb55b51fdbb9733de538cf23e0db656722
-
Filesize
5.2MB
MD5fb09f8070bbf6d47f0d8f0ac4e332a2f
SHA1c0a6f54527d6a3959bc4e16bcdf63329784dc936
SHA256abd019be32012508472d25a24e7dc5baf4947b3cf9fd22768d2ff822e900aecc
SHA51241a1e4f7daaa2b35c2cc376a0a6cd03165e415a8b95192e1a2798a201023261d0b4d1ba3de6c17ff3df7556e3a1ba9e989d22fc144c629ce2fac52402a878849
-
Filesize
5.2MB
MD5e42e00b01ec7d9bcc754949881f60f4e
SHA1e4edb2b21e796b536801543f88ab060d6afcd88c
SHA2561f0c5834f9e7f685dc2ece026313f04f46c9384e7e12a0e164183da0388a4121
SHA51277ebad15cfabdec76d70b1597cdbc467ecc0d6f687a50afde9137a4b866a5f5c3017b17781c5caa8839a43f4366ff3c6a869ac8e80e5e6eff9c5b0e36e84273a
-
Filesize
5.2MB
MD5c1b3263dffd71602081bb40779526de5
SHA19f4cb0ea35078089ede6e7433b696e45bad46e8d
SHA2563df9f751dcacfedab7ad697c5d1aa71892dd1d23fe457ee35e16a6debcc3517e
SHA512e4f458cbc7e511f624e3d6553b33e09f2df83fd5ca24f464342c9290ce0e10a8bd99d10d5d202b50bfc01b0f50174641c5c4cf43366b55fc7c61110e964c7b8d
-
Filesize
5.2MB
MD5d5b1008259015edb024cd7711b97c702
SHA1a93b6b3a87ecfff411ed45335475a4558f533f1e
SHA256b604d5bfadeb3ebdcf1cb239e5e7be02e885fa8b038f0fd57fe09dd19c9b5d08
SHA51281d8d998c985c8c18a751b237088835204ffc83b365fbbfda366d8a371905749871c657f2530076e8b778e2d0542f85bc2687395285c9d52ba7390a05342126d
-
Filesize
5.2MB
MD58cb3de88a76c0aa2e7eafc2b774709fc
SHA12e5edbb45c9d936891d37cb98f756a01d621af25
SHA256f851d468b0f71f085b08f2df8ecb553f026cba498ddbeef2a86ac11c35782201
SHA512f10771500e05cfe98c4491a243fd4f111a2142acb92c39e349e7896c460f1f2c11035425c1499fd35042bb6e5cb9a529d0b1db4f4333fcf3dc67a0dc28ca4aa6
-
Filesize
5.2MB
MD50e6ff456efb0b8c09b650186170addbc
SHA16cc075386dd60c276419f1a43b475507b9af8dfe
SHA25639d28cf81e08f70f5891c908e8bf24b5a098d95ddce5f114af03d66b3df678a8
SHA5123427c8baf56e72ad223ac986bf983ac855c3e4205b8726e1cdb2c9b43dd2aeaa2fb782fff3cebf63105b68814df0ebc67e3035d319bd1600354d6ad84c2d86c6
-
Filesize
5.2MB
MD550c4aff1d313123b3b17e72899e420c4
SHA14dea3a7fc00c2f6ffd4e06cda544686cd012a815
SHA256a58167a345045ff0a370080f9fd2bbb54eb6458bc8d52e2d78631c5e99b390c0
SHA5121b6286c4623ba235fbd92f3cb19e3bfba1a49af5e27ac66c8dc81f0d074e5506d0d518ddf468109b4e8345e16ddca0d70c510e13fe8ce77e0716b73e8fd3d0b2
-
Filesize
5.2MB
MD5b895947027a42577f35fccb522de402a
SHA1c91d7be93a469af0a61050970a746ba8333d9b50
SHA2568b75daff4df54326e80d1a821990047fd557e076372153cc56e7236591230f33
SHA512da0f23fca5307a6345ba33286d386087d961df3adcb3d8141c3817d2ef4e13250e92cff6363f5dd12553f635d8635e22e79be4dfdf8507c8d167b22db2894572
-
Filesize
5.2MB
MD57b72fdc9d198d792b9bd28666798c23c
SHA11a438731304486686f717587ea9e593307532fdf
SHA2569e3a454daef7a920b143238726c7275d35bdab5616fe61a48ee1cfb48a6f4bb1
SHA5127e6af0b1f3a058dfca5867f6dfa4bfed0248ed05049b0bf0552fa4333bb254c62f0711149c2d35dc9c3aef94c3cc368fd550e9d32aaa9ebed152598d50a6a0ef
-
Filesize
5.2MB
MD593cd2f952500a379b6d44692a26d525e
SHA164b9c3a165135700b1c85bf9ddfedbd6dac50518
SHA2560f727636d81a47feaa08c5fc627be78a06875f7238fabeca1a5eb3f8ac229517
SHA51273601f94ae7652bf188d5606cc446236aeb515fa210877ee824566394a94af09d6cad442ad0a6f5997d1a9429cab7d64d69e51d8b45861d44b8c08fdc5b27412
-
Filesize
5.2MB
MD55b144c7f655ce7d316dccad255ec308f
SHA194a21e2099b7c222b3e03cc7754b2ef6c6000eef
SHA256b900319cb21ca57922c857b452a74bd61c2735fb29a0c94fb63a2cb853ed027e
SHA512070e06b00b10aaf888b311071e2d51e45c217c1ebbf36e5fb10fb4ff760802edc54c0818ab84634c9c839734c9f8d26d40da4d4c7f21d435b20041284581da84
-
Filesize
5.2MB
MD54dc381133e195e3d0caf6bfbdbf08f73
SHA1d4ff37fb15587a3b96630ced083d8ede7c0f90b2
SHA256b94744ad0bee50a9e6b07e90721af38257f504650e52ee56167285ad512967f8
SHA512cd4b678330401489f5461df1660300860472c3c634b9800f43b87f6d1d74b9b5d66838e84c3bc273e0d2c38563551e0ea31597c2939502ff43c9592df352aff8
-
Filesize
5.2MB
MD56563f53a888b56c39cc56b282e7b7c95
SHA19607b98e1fb7dab0b872133679d74d267a91c5c7
SHA256f739e8b5c8b218ad6b96194d1014a1bd8c06158523d833d0ee0dfd4bca94e252
SHA5126de9d7c04c9cf7b04428fe8db0c72a3d0f9e999e5593008f5359d077885ac8c33cf9d6345152da572e518a97dead51dbb7974861c02d7f65b5801c514d1a80c2
-
Filesize
5.2MB
MD5cf22f8b74964267f1139d92be3647d04
SHA1f3f29e9451a81030df04ca2c5ed978b549aeea8e
SHA2569a79ad7551018b84784d7e70dfcefb48034446883c2518e8b7007137f2382886
SHA512567a5e90d09a9bbde4bbc6118c889e3842fa8e4ee5690ee1bc845d7c887cf8f14d91dd8f5dd7bddbc9c68447b82284e000c8f4392aebff8259a3800519826cf3
-
Filesize
5.2MB
MD52f3de512943c93f8b906701bdc6f7e06
SHA12751cc9a8a0bbfecd2ba67df2422625b9b00bab5
SHA256360c806a82ec26eb966d23d7cd0e86380580c4199d9f6386bc9508146d978149
SHA51215cf3c7041dd345885ff2682527d7b9f6c37f20e674d46ccf0c265a82c861f1ab584e3c0471a8f2097c64461da6eff70c67646a2d4e2f53894ef84119693fc89
-
Filesize
5.2MB
MD584526b80fe82e635ccb9dc00807adcc6
SHA11ba47ea6877628bb73462524fae14ed7c17c9019
SHA256a65585d173e7a5921e49019df3ce04d2f14e229e9248cafe073ef88c0c7a781c
SHA5123496b4169d08e680cdcd8323f28bb1beeee5daf213e7132b0c131f2b0f315a8a5fe8938a1321ef8b16726b17e79e65f6b82331c7ab3626845e10e495bba2ff5c
-
Filesize
5.2MB
MD598b21e312c87127453f5181e1c356d43
SHA193ec08daf2cef513ab79ea7704544b4e47deeff9
SHA256040eec8001eb5eade0dd0624bfcfe10c70a2fde227c8690b8284425827986837
SHA5122fcb16b3c31f6ffc45d850c9221355518887fe2d1a8f3bfae84e7d3da53a606aaf855b100de8d85481ce08cc7370f466be214251dae1d6b6956abdfd7a245c8e
-
Filesize
5.2MB
MD5aa2b4d82a495ffe448b34360b80acafe
SHA175bfc79b802b27d793d63f07b56e7497f541fcb6
SHA256e248b13e1f7cbcd69afc1390ac6419d56a57cce8a0de94a1cdc20b1eafcee48f
SHA512a1add9dbe2f55327addf7a2e647abc78e8a9d9085019aa520afe98a2d248064b5dfe096c5cfc21d55a66f64fd600241ed07c0342ac41b2c942da46c67e9dc133
-
Filesize
5.2MB
MD5c5d14dd626335f4b99d6a54a846711f5
SHA1d27866af82647bb8b812c595474593f1674efdf7
SHA25644be1ba65534f26307f68a026cb0374b3034b1250f5d0c1b2b0d96980b126911
SHA51237e2cdf49c662679dfc2f894d4b9c218015b415f1d2ee1e7139fed837db5c5bf7ea879deb20c7c2899ae834e758a958bc592f70112ffb78a3a372faf9f199e67
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB