Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 10:12
General
-
Target
2024-11-17_ef669fa0aa37beaf6132b9b05b594e1d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ef669fa0aa37beaf6132b9b05b594e1d
-
SHA1
4b061f6769e2b52b9ea2631d75f99543a021e966
-
SHA256
08ce4102fbc224848fbe3863ae9f59e347dd4d287a8ad9df5ea06d34c9b01f95
-
SHA512
ea71f579419d2b0398e9810cdfbefde47013128b18cb4e5d27b1c70e9c190e4be5a5beb49ddeb947f41e62bd04eea4227910c1c90677b43aca14f16114dba848
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_ef669fa0aa37beaf6132b9b05b594e1d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_ef669fa0aa37beaf6132b9b05b594e1d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wUoASKo.exeC:\Windows\System\wUoASKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqTtdKy.exeC:\Windows\System\rqTtdKy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\chZYuIo.exeC:\Windows\System\chZYuIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTuhQkU.exeC:\Windows\System\kTuhQkU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\albuaxG.exeC:\Windows\System\albuaxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FssxrLK.exeC:\Windows\System\FssxrLK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpFqVWC.exeC:\Windows\System\tpFqVWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMsjQCj.exeC:\Windows\System\uMsjQCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXBZwaI.exeC:\Windows\System\AXBZwaI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CdUXGDT.exeC:\Windows\System\CdUXGDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hlRZyWY.exeC:\Windows\System\hlRZyWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mfONYiq.exeC:\Windows\System\mfONYiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AWngXRT.exeC:\Windows\System\AWngXRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Kgwahty.exeC:\Windows\System\Kgwahty.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUoFEIm.exeC:\Windows\System\RUoFEIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\daGRMOE.exeC:\Windows\System\daGRMOE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPaKzbt.exeC:\Windows\System\mPaKzbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BEDLoiv.exeC:\Windows\System\BEDLoiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jteQYSk.exeC:\Windows\System\jteQYSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrSxMIc.exeC:\Windows\System\zrSxMIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMCDqWT.exeC:\Windows\System\pMCDqWT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54d2f8d0f4bc55ac1dc868b5865c7ecda
SHA13e8be77c433c3453c8585810b6671d569e10f332
SHA2560d5b13300edbea911fc9252d86b2153a431ffd68999f48a730b3d03beb9c457e
SHA51234eae6d6cc82fedc625946c39f28627b55920ea9fdf6d7783a9de19c0e48ba3b751b045593a6560122e53b2fe4f676e6cbbb3d11937eca94675db83d96c2df58
-
Filesize
5.2MB
MD57f7d56eeb2ae4e1bcb94901065d86808
SHA10dcccce4d1fd2aed6fdd1fa46409615583903b0c
SHA256f9091483da8616cc1cf13bd883cadf971ecaef358f75af397274c04e0fdd3b1a
SHA512e2b33a649ab1c9be9c31fd2add9ec7c10ca9d27a563b1b0ffaa37bddfc7afb91c7a411b8e51875f65f9248cf910d592ed31147420005e58bfae35b51da236487
-
Filesize
5.2MB
MD5b51b1a93db6c82907010262e326983e7
SHA1e0981ef056b9f7fa0c3b3d36b9e5b15f4ee28f63
SHA256503289c80d574374180c4bd5e73a490cb74b9bc6ac1b581ea68a0c8fddbb34af
SHA512cd7272d3073b8631182ca4285fb205a368ab3db70281dd0631c2f86ce462e00886e4dda05cd93fe7976308c2ddb8f8bef5dfb32dcfc79ef11e0c7a2edb595d75
-
Filesize
5.2MB
MD542e3e664636780dd2b07d6f91e6dbe13
SHA161bad1ef09ab6caa06e32f78ca846d3a76c100db
SHA256e1afb442fa345bb134c3327016fc61eac3e06fd5f43acd1993cdfc776f0fd5f9
SHA512612d2b0a8bd9fbc9bd257a1b0447da12dda5131b1caa68bb41ea7db690a5c090a6b9200bb1cc3ce59995ef50fd6cebf3b88f22646bcc35f1b8e754d84464edbd
-
Filesize
5.2MB
MD5ef096b3497cac3f00f122d6080548c96
SHA18013de9f826948da24af368232a2b63ee321aadb
SHA2562683acd74085b98ca17f7dfdd3a3ff8962ddc8c179158d3a51a205b584dd6bfb
SHA512e67caf399f77f2b6a5ab8403fc1f474ea838d8ab00d89ca742d56ee90be61c27cc1597338c5800cf6d104ab7580185d6b5b4c094a6ccfcf8b38e2c6e3912f665
-
Filesize
5.2MB
MD549cf2958e006b7beb78c93265a4d6ea0
SHA1e4853b4d38638029057968c2e1d5834ae53ea581
SHA25627dfe3f0399defbfcf0ebac39ffbb00573da1eba8d1127042f7bd9dcad0466dd
SHA51203245fe9d21c45855830f8de2f767648d3ba6b84f6d52e8eac0de5de35409a3599fc5b64f2b98e51f0158e22a74d912c474a0405bcbc93af3f49a16143d60541
-
Filesize
5.2MB
MD536e9b9d7d38f5d8a773f3f9c7f891d37
SHA17b506ff8d8e8f157157136c6ac2e6cee3dfaf17d
SHA2562ba62a835e2d2240f34d7083c665210a043b3058cd4a00936e0f0c20d9ba363c
SHA512862a153d7ebd4f3e46a7bab09b6f04c5f74677dee88c85ba70aee52130989bd924ac6f7e2e4e973e82ff93999d4e8b4e0c3d2c0a86d58c4f559b854a140b0262
-
Filesize
5.2MB
MD5034910c49127536459f5705ede469e61
SHA15fea3393d44274e5e9ab9e1f7612a11a5924534c
SHA2565972278642e10d89b47f393eaa5bd8268a8c12d91b1c19973d8d7c644c5434ba
SHA5125632b1e999cc7bc6fe7d1cdc3660e5c4438e8895be5a648da4815a6bd5cce646a696f4f9c39439c9a9c4c399f3a818b43f3b04cf5b8ae51ee3aec3f50d3d3806
-
Filesize
5.2MB
MD51e6ac8a16194e924f974bf4891cbc477
SHA1d7178e1c1ce5a50c8eeeadd4c58782cafe477fea
SHA256d0a6459b41a3c971ed30714a3133fde763c16d4cd1be95978136b1e3ed48c030
SHA51223b9d6125ebd30766d669699b4d8971b3414283df7e88575351eedd63e645b8e9f9619e60ed535e8601429dee55a5914abd0a228655da313eb80997baceff0a9
-
Filesize
5.2MB
MD5ed40d5c5cb187724cdfb4870bf47db88
SHA148bc424a6ba531ed34beadc9c09ea3e2294703c2
SHA2566d92782e05f898ac76c02992b70ae6a187d57dbd061b4d3026cef649f916b486
SHA512a14e688ab72c602770eef5ad06b710e4b4df7a075dca42dbecf59ef85ab03e4a4498a9e9b540f72ebb238a1bf65895d792a16de73f8e4a44a8038b13a9e930cd
-
Filesize
5.2MB
MD5153e116b7a4013e9ba180521330c414d
SHA1d0ffcf63c71138d9a6eb8a72383b0e47ae269b96
SHA256db88b4c48f1881d165216a4ac1420d4af7af25b6ac1dd6dcbd6afb0028a2b451
SHA512f40bf21abf7b5b6b9976c21bbc7e1ea7d9cec4a9f6aad92af07e882320750afb648eeb786226685ed2a60532bf3679b4510346d40ae888d77fbaba0a0a30caad
-
Filesize
5.2MB
MD52997b47497ca340c27de434321ac4c80
SHA1516aa19337b2f4c9fd6f27de6238ee0683a3b69d
SHA2565a8f968e5009e79343428bb30bdc940cce6f9af5dabb4844d14128f171f6e272
SHA5126581882f8735f50e5027fca0749d87e717bac86e7826be1138b8aad4fd261d7808b14bc4f42839a550728f455e392a2dfd597f67a3d3ab9995fa1592a1217c11
-
Filesize
5.2MB
MD5fad9e2dd2981b72c70dcf9ea5a60548a
SHA192e74b8bc752881bd0ae7895ab25feb7276f1dda
SHA25637ffc7c1f5a4b3a36d2b13ea9964dd4e9cbd4989b984888799980cb613249202
SHA5121045499fcee334ce31e5446a6c7c26133a9f98ee652417392e8624d6515df2c3db41f57f26c0ad7c792fdf3bca12323d268b5aa47a1d584387a83d3ee678645f
-
Filesize
5.2MB
MD5338ff71c9fa225a1252d31fdb3a75a4f
SHA1fe3192569db2a32211c955f69a79a956810e33ed
SHA256670c3ea3e3c973cb9e6033bd71ddaaefe1c58402154ba6b82e15d6a19905e419
SHA512305cfc35a39d081f62a36f3cd4b8c175de4686f4e1fed66f225c1d696be237c8a79a628f462a8424531706d6df5d16336f46655f0c99acb668035795ef92c705
-
Filesize
5.2MB
MD58e8dd8eb65a589a13e6c5a3c69e14a85
SHA1fb2911223f9ec4d326b264481ad6c99dbe4c6c95
SHA2563c7fa760b60f6456e3e7a91255b3b63eae37e275e003c895f22f8f714bfd61f8
SHA5120bd9771e3e0eb4415eb06c8c2003179f892542d1390e7583c48b5cc62dbeb7b571a68fb8ce313fc98947c038a8f19fae670efe33a49142d7a0ae9b112bc45bd0
-
Filesize
5.2MB
MD51b65136330af3c58479e9559989710be
SHA110c250e621c07603f6b77d1dad4c1a340b364cc4
SHA256f64707cc871bb1a1d8e637adfbfc2fc509bd2db7cc3de8e445609bb90b6d1da5
SHA512033db25d59b0cbb503fc54a242d3c992b21e8caad050e698b8b07b14e399b8b5b5a82fb47cf914e60f1cee09f6e6bb71271b427ddf22e14550a8b3dd3389c530
-
Filesize
5.2MB
MD5a91ea134cdd2b65a4d46edb0b15aab9c
SHA1e4cc36c11a1edcd18096b8331fb05ceb0a5884c1
SHA256b4ef69d5d475572c2b2f0e54ab4e622c5773d70edb94019436aba755ac8d2f93
SHA51265f254fc93e0faf496445441067aa1e4b850c237e90e55d34d22859fb404e67eb7a309b73a5302ab373f36145ff9aa3c419d8adc18a1ee9c21571abd27c77832
-
Filesize
5.2MB
MD592d74c86cb1587fae44510fccb234660
SHA198904a1a870f88b2f6ae8fb573760cc60c7cb194
SHA256b1b73c1db981a4a291f564a199b575aecdb697ffea477d0eba5cb69b8a2dbad9
SHA5125d6fc410b526f3e02cdac3d73e84f8736e5686963a15bb6cd5e0f40f39c933fe51fc5d11d3769514a29b4363ed52255b2c08d19c4d4c1f3d05fa3781a885dbd1
-
Filesize
5.2MB
MD5f0f6217bd4cb3613f9caa25a4d9b5380
SHA1c3862603777393d8de57b3ab6de09e91a0eb5b05
SHA256ad2541215e7e8f9c89d3b9449e5d287c2f16fdb522d62b0ce2b660062a361a56
SHA512ce10a6046b4b72db7c6dcb3347b573cd527b1294df558a1b3140963787484c95ed8be062c2af53de4e8ce55a9d236ae6fc3386bd94a4b73e96490a6445cea9ab
-
Filesize
5.2MB
MD50a3ecdc068796aa2646f05e28027f056
SHA19fd9e2e8d33ff9ff71a3496354efd65cd57bb8b5
SHA25634d9a60e6c861552586ac3b9992c122a7704a9554c90e5bd645576330c3ab6b1
SHA512417787238e3068948ecabc91826573d7a9d97c57499b155d79714408ef545bcab64eaac8d06bb7de33e65f9e1876e3b78790c1eec895846af8cf2c3a3d71f372
-
Filesize
5.2MB
MD5aee861cf756ccf28d31c9f3661e0e931
SHA13ce5169e8c1b654218a99d27b05bd4a4c1a3341f
SHA25655b9c248cd88a3d572401e3e68bc27435bfd46d0ca6444f0dcb1168ab20a6e09
SHA512aa2dfa82764c9d74be5956196d2c045114163ae3b10543b1a5362624c7489678acb609a5f1f13ef9fe9ba03848e8bcd7741e38d086ffff6d2cabd14a2acafc68
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB