Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 10:13
General
-
Target
2024-11-17_ff96732e7fe0d9c889c7752a069a5d1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ff96732e7fe0d9c889c7752a069a5d1b
-
SHA1
f92cdc2782da4fa8a14952ebe5931d4bae873aeb
-
SHA256
7df55db767d4431ede8e8cb48702514a0a66d79cbab0c9efddcfb1f71c943639
-
SHA512
dcf32944fcf203b5650bb8d603889d7aaf890880c4d60892cd7fcd97afa9cf4960e2f35920db92c39e3b168af05fd2c03283f4304ed55ee859755e4d2ee215f6
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_ff96732e7fe0d9c889c7752a069a5d1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_ff96732e7fe0d9c889c7752a069a5d1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aMXPrVY.exeC:\Windows\System\aMXPrVY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JySGfRw.exeC:\Windows\System\JySGfRw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lHLrGPu.exeC:\Windows\System\lHLrGPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQPyuxF.exeC:\Windows\System\oQPyuxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwwPyKf.exeC:\Windows\System\TwwPyKf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\snBUZvB.exeC:\Windows\System\snBUZvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfnFWlv.exeC:\Windows\System\lfnFWlv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JeTypRu.exeC:\Windows\System\JeTypRu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mJskeqH.exeC:\Windows\System\mJskeqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rAtiBbK.exeC:\Windows\System\rAtiBbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NzwSVlb.exeC:\Windows\System\NzwSVlb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdhWFRj.exeC:\Windows\System\IdhWFRj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLErjZK.exeC:\Windows\System\qLErjZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcvvetD.exeC:\Windows\System\dcvvetD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DbkmQVq.exeC:\Windows\System\DbkmQVq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDCltbB.exeC:\Windows\System\eDCltbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCOlXWk.exeC:\Windows\System\KCOlXWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXKmthp.exeC:\Windows\System\AXKmthp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbEVxJC.exeC:\Windows\System\hbEVxJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\krdclyX.exeC:\Windows\System\krdclyX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzmIcOS.exeC:\Windows\System\FzmIcOS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59a6120d207b6b900fbd8f31a82e72dc8
SHA130e6bb6c1a62b610cd9f923474f9289b0e64d27c
SHA256cf0f03459df5f4ccaf1eb952329dba87ad6a0dd69b65d2f5c705e3f37de21ed5
SHA5127cb5a62fb8557e6ce54072d06c6954845bc33ce0ca231fe8a6c42722099694239bb78a2bff8d00810001dded0d72e11facb0ab693dee8b932648e449c34f2079
-
Filesize
5.2MB
MD553590345df942e3b9ddea3ee3f1ebd85
SHA1a424c51f9fea21f687dfff88b136956d56ac41f2
SHA256159738b0ad0749a432572adc26b3eea39dbe555d95d447666843acfbab49019a
SHA5122ed75a1dcb0e58dc43435213487387b67c9f150c82954998699433cadf90eed1d7f474513b51a75265299d629a00a2082bc933c6ce848287f87c02638dfd9b18
-
Filesize
5.2MB
MD5b34971536be3d200fe9def804d7e7518
SHA141fdc4e269e9361c75e379953f3ebd06406b775f
SHA256ed2ab91027a4b3ed85723f8ece78d107c2c8b0fce4b8057b3dbed68d5a570852
SHA5126de6681945262d4a56a81cb83d8dfd46634efe83dc944dc64771e5ab30c16c09eaf53f0734cf3d0593e315de9dd8c4e6f9645d26ef5f11b41506490599145f0b
-
Filesize
5.2MB
MD535e84f9401a5bf56d6f861e6862c077b
SHA1783fc0f289bac53ef295e74058ee959f95e0213b
SHA256a8a20c2f6e58c1c12ffe15b015d1ea2115f16cb9e7584cfe4139858040800385
SHA51269a0ad97326ae65fe95f4f120554d14200f573a276afd4165ee1e117666333ff12db7001bfcec82ce575fd6db08844f568e6ebd0ce2a6309b674d88114f4f7e0
-
Filesize
5.2MB
MD5c44597c4b059fb098b21f6a0ac00a459
SHA10900795dc7aaad546981f479b2e9059191c4c604
SHA256c6bee634a74493bd41a96dbb9ce3dd9b0e215570904f61e4b60d0f241d772d61
SHA5126fabd25992718c4e4d40c070039e6381b9e5c016faec51eb4dfc330cbe4d77f31d19741e3ce59a8056d6e3dc7d75cf37787f7a2315ed6ba745f50ddf67f0a00f
-
Filesize
5.2MB
MD5fed2f1b283acad1bc20f8ca55c0cfee0
SHA1bdbcedd5c84308483155178187f267cfac4d11fc
SHA25697bd751c5558726fb687af974aa9f72828732c8e78043d6bb7fb8dcf1564abbb
SHA512362e83e50008c033005fc5eecb07ec1ff61446431ea68c622c3d88ccf89d971bc7283267256b7bf686a7ce4f635183de9b713771b8f9712ade810a7f2c6e9047
-
Filesize
5.2MB
MD538d503ce632ff6bbbf4c012e163b7b55
SHA18c7ad9ef617cdb6ac73e8598850d203715772a2f
SHA2563e74b2672286e0ae3e35c38e0015790354a001475d66009001e6a4a14258f4e4
SHA512368432807f395d952873a20c4bef5a48b3c1c854d4664eb8c43109ccbee2540d8fa8c20d50bcffeea5c2c23716f04cd38e127d8a2688f862a8733c726501ba23
-
Filesize
5.2MB
MD595e63c092cfd3db1b1d177052e2f447b
SHA16a051bac49151539ac181198d90cc127f405c8c5
SHA256fd434004a0d3d1b299c3a67b01b0f9cd7aef2a50103aedff680c4f1703a8d8c1
SHA5120450c616488dceeeffdb74cd27fee32da9e7201ee26faeaeaac7266927947e62a8564190fe1abe99febf1862ca1b751f79be476d787ace51864b9b033e8a637f
-
Filesize
5.2MB
MD5a6cf5ccf425bb23b82f71d54b2c85740
SHA1197a069089fb0481da0bb95d84758602dc67b3d7
SHA2568225ab25cf90951843cc54c01d5d306d698e8bf81ffcdc98dd3431fd4b160014
SHA512e103ee80c90e535ccfdfc5f2764736d4a1f25c9e6ca61c44f77f335839d6f0a234c880c11fdc550e8bbddd708f8d1f23def9d24114d6bca1f8766c9b05cd968b
-
Filesize
5.2MB
MD509ca465b4469a0ebf4d24f5081b47c7f
SHA17a56d319585070d9d9471bad20379e8572508920
SHA256b9b394332bb8ac4cdcc0f7bde2b0caa573a234a05128b74b512567340223cdea
SHA51234ec406c2cd14678f89753b6fbb65c365736bc2dae95a8fc9858a72187a941ae0a0db319998c709f4db7a60c7c33795ee746ff5d6557678718a36afe5b87d1ce
-
Filesize
5.2MB
MD58b387a3557565d5e8876ffe70650668c
SHA118f05ae251ddba1dde3cf1cf76aabe492c9acd45
SHA2568e987cb21829a6290583e1a105f05ab946d5dc145adee12279d6807bf254deb3
SHA5123ffc4f078f07759b1d361301b74b31096e5a622b2c34b8027f675a7e19f28598290c35fe79b7892b79d810d89b8d8f7ef3a8a3fa5d92d0df3d794eb2596c6b68
-
Filesize
5.2MB
MD55d2320f17a03c13ba992dbc241b87ed9
SHA11438b777b9cf800d050799dd255a7af9b55657bb
SHA256c6fb1b66abef5d16205b4092d0180ccb96469d394dd90519b3b64ac3a2ebe02f
SHA5129b24ebec3b313d49192bacdf8b82e43c264eba6ce9244ba528d95dd557324b9864b7b7f3f7081a17ebcfc8707ccc821f2fd35f38ad6bfc71aa0920ee06b469ad
-
Filesize
5.2MB
MD512974623e4f68a91b764cf8541ac812f
SHA1f0e3b65b73515a797cf85966ad3b728f76eeb354
SHA256cda173741dda3789fefa15c2898723cc594481aa4ad324a428a503ce37cec37d
SHA512b6cb5eb39d154bfbb094658ea6fbc6d59594e36037d37ecce073c2c76a9bf3fc843e0548b5b570d6b2012420b86c77cb374d93c2f8b474ffc5a9e608a1ef253a
-
Filesize
5.2MB
MD5ac3d74506da2f0c761e36ffc072f50d8
SHA18a4693bdb83d32c28be5488afc022906c419074d
SHA2561f71f683a2d008834e475cf1081e8e8df6f5b1f70c050de4453a52a7c309cae4
SHA512d32188d6cf40c1cee843d4b67c5e76c408a912916886ba28dca9d44230fd1afc97826f0d603458bff5857956ce24cdb4034ea43c6daa060f327917fb475be2ac
-
Filesize
5.2MB
MD59897f3cbb22d6dcb349c73c29cc7296e
SHA191bebbbdac805ac7a68b90b6d051bf021a041daf
SHA2563fcf68f5b896fc9189db61c35b26cef255511fc007e44b89d153ff3f8ff669b8
SHA51212ec82d69a3483f4ea11c0962c54fb19cd2fb7b1bdfe56dbff9d0fec8b8b0af27e30101e6637a27497c07d66a45270ae7d5f26e60f62de05054757c54afab6b7
-
Filesize
5.2MB
MD51015cdeecb2eb81be199bd23b0a6b83a
SHA1726a7bce08c2d54032e308d591df45f2eee57741
SHA256ef8d35958ebde7935b778f0f3a5bad8ea792a67244572a3bdd82ae14083ffd79
SHA5123c09d1eb54cdd37035f90b13c3651386a12c18e4334fe7d8b60d27973f29fcb5c331960b66a963b2392092f76913138acb0bab799776739fe4ca486b04f31e6f
-
Filesize
5.2MB
MD59dbe21ea2e4bb05de85a4217e1463e14
SHA11eb3e9ef18d923e72c1b7f9a265b72cf9c6c5383
SHA256d6828bba2718f6c2034732aece3e7362aba774987795b58df4e7a3763289377c
SHA5122eb2b08f4ccdf30518cc1a0532ff3dfd8af41bf709eb346d39c59815410f8e8ed6914da7d4315f7156481d85fe600f91d1ced6c909b42023df63c276cd1523db
-
Filesize
5.2MB
MD545c070ea1a3695b953b3bf65cd8668ef
SHA1aa615b59e8cedd237748f795ef687851eb2b1109
SHA2569ba695240921a8460177f20e58ac3befd6e856e57f1ab6352b6081eee3f6ae62
SHA51261e0f3e48bce60854393ff59c98c11893bed78ecef6689e68c903682ed711b829efec79519c34d3b7b7432969f7337ea2171745347bfc958631f2ec3f43870a4
-
Filesize
5.2MB
MD5a5979d8749f88e7f20158f5fb3e87d29
SHA1c1bff1f67767f309631b10f833ac1df2bb13d525
SHA2563a378b61b86b35dddddbe84da242091619035b3d7ac460ad387938cb2eda1245
SHA512ba09ebb4d51ee44d4db62b54bcb0c5824f819cdd6a11a26ca5d7d23a02b884e708bf6967b5c91bf4fef9126bb835cbc0555e17ed46d48e4b6a21ce98aba46497
-
Filesize
5.2MB
MD535b7b91cf3ccb231bbef1d7d7e206d48
SHA12f0bf4bdbf06483422ed9ac099a52cfb0fef7993
SHA256b40c89bd9ba7eed3ece2a920a121f9941aec83e9130728e24533a110eb59906e
SHA5129682daa2d422a0a108d2ad3a5732c9934b7de164c8d65a5536a1e4008a87867aaf91b02eecdaf2dd12fad5f58f5e950d1ddb7d7fb44a7e04987162f0c130864b
-
Filesize
5.2MB
MD5c19a6d59f147ff17b7828bda006c190d
SHA1efe7135467fe6843525480b0750c86784ef4e2c2
SHA256d6724758e05b2d3e3d4702c3c59736f9a4e8688ba5f3d0a260e142372151e185
SHA51216a997220791e38ac2fad7de940cb6e36985d0f5a8fc3fb2a552a4ee4c876257188daabfc06a44ea42563a89f017a3f1c9ce402b5d1d75a28f1ffb33cadd4074
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB