Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 10:12
General
-
Target
2024-11-17_f0dbce2a9ee77cc36d383f5d622231bc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f0dbce2a9ee77cc36d383f5d622231bc
-
SHA1
35f451a6f446662ca30d2f55bcf99fae597a56b7
-
SHA256
256a6694427a368e630801789b5fb52e3d99719f3fb7bbda904fbd56769586a6
-
SHA512
2cd8257bf6c2b78995ff0a5cf5fbd3b87f6350b922661622b9a6ffd4aed8306d6644bc3012709695382077133554a58bd5b4a395f2ff754d8e708ab527d5cf2b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_f0dbce2a9ee77cc36d383f5d622231bc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_f0dbce2a9ee77cc36d383f5d622231bc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nePxOdg.exeC:\Windows\System\nePxOdg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPpAfjo.exeC:\Windows\System\GPpAfjo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YmFXiRX.exeC:\Windows\System\YmFXiRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVuvqeJ.exeC:\Windows\System\vVuvqeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAkCSuq.exeC:\Windows\System\jAkCSuq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aUQcpUL.exeC:\Windows\System\aUQcpUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ydvQoud.exeC:\Windows\System\ydvQoud.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDYlfoz.exeC:\Windows\System\hDYlfoz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmpIDrJ.exeC:\Windows\System\UmpIDrJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgpdErD.exeC:\Windows\System\lgpdErD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYbIdBx.exeC:\Windows\System\IYbIdBx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrVjeRe.exeC:\Windows\System\XrVjeRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvdVjCi.exeC:\Windows\System\ZvdVjCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mdYwjeh.exeC:\Windows\System\mdYwjeh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjEZHwc.exeC:\Windows\System\jjEZHwc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwyHGRI.exeC:\Windows\System\IwyHGRI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cnxPEJB.exeC:\Windows\System\cnxPEJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmsuuQz.exeC:\Windows\System\zmsuuQz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBRzCWb.exeC:\Windows\System\bBRzCWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfogbbc.exeC:\Windows\System\zfogbbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DyuRRTx.exeC:\Windows\System\DyuRRTx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53857902bc2e8f342547f535ea4d6b84a
SHA13b73cb10f4f4d1dc07fde4eb9c84c1c2d147db43
SHA2568da1b05e74523b940ee542eb68d5109937d84bdd2bf48a091578da232b37ff8d
SHA512ec52ce9893b8ecd6ec4563096c22874a4bb0d2e77907dabc745a95a58d57fc5624c8d88d6deade1fb700c1016fe8442e009236f2e7d78166a564b22cd0f9422d
-
Filesize
5.2MB
MD59d9728a3182bf1ddd281a00cec473b63
SHA1ab2516e03645baa0949f494cae8d9e673337a614
SHA25648e8caecb91a06f579b7a979c04268b8092459a947c017cac1c02878ccb16a03
SHA51276f567119e2b806988f89e84a0ffa77ab031df18503f3baf7cd3249639c1508f481334d925785b59ea8e3dc7ff2e9b09a85d85be84f07d4eab9b85b3d75c68d8
-
Filesize
5.2MB
MD5a600f59ebb371c9846725767919b2fca
SHA1fd2de2e82eca4d89f83271d50176f70332170390
SHA256ca1a87b2b7361936aae95e0ca092339c9c19402c5756d20c30558c06694009be
SHA512ad0adadc408c7d7137e28987d0d687cdfd390e597f92776557be91d3e970b0f3bb676a10727e9f98f22f37449e639ac61060f0c198c12a5222929f62c52c24db
-
Filesize
5.2MB
MD5608d9fd174fa4e4fecee13daa8d8cc21
SHA1472b8de8ba16613ff3fa1b5108addf80ed829b73
SHA256591b2d0daef74100bd1c6db485cbf817c846a9f97ee8757804e7a35e80fe6dda
SHA512dc4de05c8d6b14739f89bfdfd6d7133900b615fdc63283f568bf482fd0da1c87b114f354594414b14f380fbc8e9a990087a2f5760d207026dd8c7e7d42faee4e
-
Filesize
5.2MB
MD586a4277887c1747f60805fcc9a6bb4d4
SHA1710d08e26f709215a2e23ada7278d8f8827b07cd
SHA256b1e9f81a130d61ece4f4100d6ef7695cb5c1386105c6e5583a34e834c935dd65
SHA512ab1c44e58dddfaa97bbfe2d8ae9012afe4c5ae7021bfd579071e56197d32b1dea50c3dc233750717e12e9b20274cb6909a6d59144d54115638bdd36a203ec233
-
Filesize
5.2MB
MD5832e0b2c8e88bcf187e977cda8382b1d
SHA1f632523fcdfa136d4c961db34b28b865447f00b8
SHA256f4980fd706ca314c0f28230fc4c65aec816d6f6a97aa797ac59c88dceb037e9c
SHA5125cdced7079c99e6aa3ecae75ea620317a54fec0d8d2992e267485b51d988c0ed346b843bb1ea83dd040dd393cc2bed138713b2e41aa18ae389fc76b36ad78fd2
-
Filesize
5.2MB
MD5e12a58268cbb0e6c4432e65b5e3256fb
SHA15157917d8cad62b9f55e1c424985c08c9b35ab7a
SHA25664ea0c5f52ba2e5657a3a2933bcccda85d6dc51040fc5c2b71a4f544bcfd0fca
SHA512be77f501adfbe1cb74c640e9429f7628d477688f0360246d3a86b1ab489c87e8c334c37081ba1ea241cf307ff67ef2132f68f7f3d401f2c885b48600fc373f6d
-
Filesize
5.2MB
MD565c47febc547c1d3eeec5945871e8656
SHA104f312d7db74f70656460de1d11346173cae8584
SHA25643267a590534e25d939cab83d09c67fc87dfc55a5fdad8051ab8dbebb7081192
SHA5124a94b51a5d73954ff79c6859f1d90d8754883412a9e853d0a7ea978f73396ab2cd9406a8306fd7a60a903a9f6c9186c4f66c9ddfa450e697913635edbc849ed9
-
Filesize
5.2MB
MD592e5d5048d16eb3e83b5ab714f76326e
SHA160bc46383d6d2718efadd452b2cb1220ea608d17
SHA256b48e22de8022c508a3c71bcbe0262ddcdf8807f292ffc80afcb917f2be3fd3e2
SHA512a4e4e3931946f4ccd980a2431c2ac22fa24682bae8d2bb5bf1c8bee2587a31ea7ba503c645c01ffc75900c28665f845bce2302988de7957c64c39bb9f9bf58f1
-
Filesize
5.2MB
MD55eeb01a1d976c6112db3a7707695d545
SHA1ec8a22080c9886b13b0aafeee73be812d22e0643
SHA2564143bec72fef93481b45aa741d4ab45ca66e63e41f81f4df18ff970fbb521b64
SHA512169efaec9cf5f3fb4aaac154aa937feef5c2a1ee5b1e503be070d0e20929a230343077472a83869236b6b4d5fc89a0cdace8d71488dce22449cbdc7f76439fe4
-
Filesize
5.2MB
MD5447f0c0403223e8ca1d78bdd45f30e71
SHA17467cffde89c5dc5112c42a666d148bb96ec4313
SHA25658d2e3303adc70c0e93d43d160bf85051e208afa6cb248044f2e640569c3d3f6
SHA5127ff12ae9ff85900d8e23168a93d300fc4074594aca475022142fb3ec46ddaca6de12bcadd516e581dac92025450ddd9c7e0a74366ed639058179a42e72664665
-
Filesize
5.2MB
MD5fcef8dfae0c2348eefad7392b8c02c61
SHA1300a53ee7c0148818308da23c9c769ffce4de8d6
SHA256b3ed555b1aebf1eed0bd7d6f28ad5b586dc0833dbb4d8e6ed1eb5ebf3bf64243
SHA51290a67f8fabf5e99abfdc81d5188bad4323149edce7fb7021e886269170c165b8ee3f70e229a75c57a4b00c75fede1e66a3eaded064f20cfdac538705338242ed
-
Filesize
5.2MB
MD5859b0c90cab4f82d9779487464ff2ceb
SHA1eb899d706d7bacfda2570fa47ea9f9c6cebaecb8
SHA25682db9cd8361313009ec9dda3de2b366ef5e986e2573e80f6f16c42cf5176caee
SHA5128ecf5db45618ffe0a40ba58086344612459201775406c000dbb35202c9efbf8007a735c368d662cf05d7ff035852ecb8e3efde41d7eb6da13b5e54df8a66ba63
-
Filesize
5.2MB
MD58a2a24206c60ee0ebce7a80400ea2795
SHA1f19b7b4d51e825d780b94bcd7432a6b7f166bd52
SHA256331dd999a6d8349f2e40ac850ee881a75942f26cf406786fccd7f0b15cd6b4b2
SHA512d889476f438986bd474868e8ed3114402ba6e5d0669c4eb08d94208cf9b6b5924b52c444c3a2981d653f8b9558970fe5bf40ecbf65b442f09d71a7bbb6a0bc6e
-
Filesize
5.2MB
MD504128c65b8ab9207938b2bd22165a56e
SHA1f04a03ac05aae0013caa8f3dfb74f863b575b47b
SHA2561d3c7d0a5c28c4e82594e39adb7a464fdc32eb6f767310bd18458dc71b559534
SHA512b6aef609a5aec9e23471b7a61e2a7a1d326e9fb01345da8d4f3fecd85d49a5bee1222c0c690dd965c2c41fb489dea31d21ba14a81301e09f4613ba8cf283dafc
-
Filesize
5.2MB
MD5047243983b0b748236ae7a3014154fef
SHA1db6707ab5aa34aa77601140432af4ad6706d57c3
SHA256841f03e589410d372a8f77ad3324700c617150211c68e7a25e95a854ddd19d26
SHA512d57442f73b083b0e5a2a3f6ae44c0616e29f4eb86e43134a8a21c7dfd8c517e400747b8ce9192b8b8421f82cba9a11418e45cbf1753d5615a1d0b4597fd794d4
-
Filesize
5.2MB
MD5bb9484dfccea3081887788eab3171dea
SHA18d59d497b0d54c64eaa35870ce53eab1c6e0459c
SHA256a47f643ab3209958954c7e9eb73ea8f594a182b239e5547d35a075b8da8bdd65
SHA5122492e1aba19ce4c3f4fe886363329c9e557de2a995911619e7e4cf396b6044410f02a01cd25f6e953549dd2c45939ec016b69688bfd845bcb270183ad203166d
-
Filesize
5.2MB
MD5bb3242ec954b6c7017ca6b8b16958b0a
SHA1a66fc3087e194e075c8f6088a9b1fc5ca44a76a0
SHA256ad8d06acaf1c01fbd24f6d4104c1aa686d5ec4948df109fec9f8187e6a3640c7
SHA5125d34385549dcd3ec52945d2e0a38d0bedb9e1581b1c1d9ab12e75bc9be22d5286ab8c5244fbf7e649a51f4cc2a122af5b1889160eb96b67b57f3cd89be984046
-
Filesize
5.2MB
MD56381024b6e8befa3dc8f72a86ce4bb0a
SHA17b488c91264c2f50b46c80574798e677da56e80e
SHA256e052526dfcd2f4666ec1f57f79b5f9fca8a72437a3befc596ebe69420a4b483f
SHA5126109f2cc813ec2e37f6a6d8103da04988f90ab8b0c9ac86fe646d6cf86873cbd0e87e8f7240ff3436e6ee4762072d8f06f37d7f63e1476ba003e7a7792b9d767
-
Filesize
5.2MB
MD557f3b641f55e471c1c6e18fe4e3ab980
SHA1dbc4210d8682d954db5a8edcfdaf9682b305fdb7
SHA2562f5c7d3a3fed511158e44eee9049a9e5aa34f8c3b678ce80d9b604430d2f3ba7
SHA512558cf8960db8c8a6970fea0830b145890b9c97e7120de3da151977e772cf0f6a953205909d097ce0c046819ec2fce58b806e771f846e3eb296ac4b8bfd7f62d1
-
Filesize
5.2MB
MD59517355fedc79e2df7baf6004079c070
SHA19388a552769fa4daf4410cd6588c4340c614cc82
SHA256069096ff04c05fac54960b0e3061fcf0e4a4d09bb2fbd2f078dcd6b12baa0757
SHA5124f0a1eadf08475ccfcab93a16977445e249a4ba47ed702c52946fc126844ebe9bd5ff1a3fff42cce54b67e94c00f087be59e698967bb290108ab7ee8d2870a27
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB