Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 15:24
General
-
Target
2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
21f308bf659eb603b4df09f06e7f6641
-
SHA1
baf719af332a52d9df08cfe643bb7dac3ecfb095
-
SHA256
8ee6a69509b3669509d7fad8f87452cd8598f6221a0673b1e8f8796dec77c2c2
-
SHA512
d0f7bb575c53463a41dd60e857c1d6d463a71c7c2892112b3095212593a5e90a446d11720ae37a386297e44045c4e84b2934245c53f4ad6cd0df81ffe8098cca
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jEqkaHL.exeC:\Windows\System\jEqkaHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XqHGwiN.exeC:\Windows\System\XqHGwiN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSstoat.exeC:\Windows\System\JSstoat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EhQRyMz.exeC:\Windows\System\EhQRyMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNPaCXI.exeC:\Windows\System\cNPaCXI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdqQCgF.exeC:\Windows\System\MdqQCgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUcjjue.exeC:\Windows\System\ZUcjjue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmTyWAy.exeC:\Windows\System\bmTyWAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAPyvWv.exeC:\Windows\System\wAPyvWv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPZLZXC.exeC:\Windows\System\DPZLZXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLAKKCD.exeC:\Windows\System\bLAKKCD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugoKCxd.exeC:\Windows\System\ugoKCxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bkvuTJq.exeC:\Windows\System\bkvuTJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRmBXqM.exeC:\Windows\System\sRmBXqM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBsOtLH.exeC:\Windows\System\RBsOtLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEurdEa.exeC:\Windows\System\bEurdEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lZgKiFN.exeC:\Windows\System\lZgKiFN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkYbXqI.exeC:\Windows\System\kkYbXqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EkTodvH.exeC:\Windows\System\EkTodvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgLtebF.exeC:\Windows\System\UgLtebF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aorlkjx.exeC:\Windows\System\aorlkjx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f523a27caa1953a536f0778d086c8f74
SHA1076b504e18ccc50ad282e0986b5f44f5ba84b323
SHA256428acd6d7374a647ba9604b6370b439c641351abdec144fddf6c89b62b9869e6
SHA5121cbc97fd9162e32917b6181bff8022adec0109f5155177b27bb58bf0845a4df908bce9d918b339fa906b84dc39cc1ba94ebea5d3a12eb0c2274ae260edaf99b6
-
Filesize
5.2MB
MD504c7714eeda4afa89e895a7ed84ba54e
SHA142753a6bdf9084b5594b5abf22393b6a02a54998
SHA2568d7046bd74a1bea5ccf689bbdf02b65d4a7c4522b0f8956dd0536f2ff34fcadc
SHA512c35733af63e9be57d08d19526987f774e4ceafe6ca07bec10a750e1a25369129da8fd3f0ced3944a64d37767dc69c9120034621bbc723ea0181ab67244f0af8e
-
Filesize
5.2MB
MD50037cfde79e14b7522ae595896bc976b
SHA10ee67200d8d7cfedfb663129da9740fc41344118
SHA25669983474a7bdb369e3dd794b9290440262aee3245fb26ee5228a9726e32bd22b
SHA51287a76ab5df497096da526944b2ca8cf804c7d03a4248055fd8c891c5f84b53ed32225b9ad9c5c77905e2ba188b94d1a038829200ed01be9fc0742fd9cf8dbbf2
-
Filesize
5.2MB
MD5cf0a1666abb553ac2d1c2c1c0fed2330
SHA17327109665113376d3b9dea075b698685f06cb5b
SHA256c92ec6e2cb8015ae55990ac0ddae30167cdb49d18967f4049f4a3172270e4a4c
SHA51230cd5dc5425f90134e5e491a18e952222651e07bd97e340099e9fcd2aa120e5159cdbee23fa2fff0511102e4ce5aabd03f9705e4af6c9b51ac2cef7a8709ef23
-
Filesize
5.2MB
MD5265c171e2ab649aa796e8283a6ed1268
SHA11cc2e1ec8ab404fc10aa3c237f311c4a5756c9ef
SHA256f84110719ad2f3c428106af54b6ec21b735231636b790df0a993fe02c9277ad0
SHA512aa65bd72d610bc727a0bb5b663b406bd1d70be60995640e50c76ac36d3815d1d5ef963b063cd8252590a81bf385299a301514945cced9685f3e6109ac973bb1f
-
Filesize
5.2MB
MD59cb995690a19acfc63b994c35274a006
SHA1a067fe4217d325d5badb2dfec8cf7a48ae7ddd5c
SHA256a6cd98eb86eeef6b1b5395a89e8a260cedc6061022f0d8a266e0fa6fd0905d45
SHA5128607004c229aed97875d9f3aa83ff2f4c4031b5f1489232ab9dc662f1eb26bb98e74d400f98091d16492b7b0642ee9d2ebd0d601012414fd59aa7506858babd5
-
Filesize
5.2MB
MD539918cad1f7df2d4e9f483ea68391bc1
SHA1fec255732227da31cd3a306181112fd1a05f7fb5
SHA256e8c5669b67cc573f7149b021e7c30788e3bf8d907e42f3d129a7ac710f9b1c25
SHA512b3c1803bd496b7aad4e5212c156dcada529b4f2f1cd2815b607320403f2bd603ecfaa0213914016a7008585b5e09067faa6aae76e7a3cbb1a5a2bf5467694f7a
-
Filesize
5.2MB
MD5e5e26f9efcd389b7c985050cf038c641
SHA12c73759b5cd7ff4380db2746a9d269d111c17a39
SHA256453b4e18b1ef486e8b946e90a2eb2ac3e5613a472022acea634df43c5f4b572c
SHA5128c2cf93d0b9dff9aa1c8683ceea0abef049417d5985e95614316d570e87bcaab70cf90d27e45941afbbac3c968e0ca40aa5d05380bc8499e3b52a70d1234d30a
-
Filesize
5.2MB
MD577327f641e225086f9485a42e4e36de0
SHA193bfc3868ec3be6007c6cc4bfc4802bf4021bfc1
SHA256c5b7eb5d7b58271150cabeb354b540ea04f621f1f161fd3c11f5fda828ea08ce
SHA5128efcf922a5a4c53cba6bd2b9a397f46502e30ee848e975b83f682fc0aac2b85460e05549a2e12a0e805bbdbb96f9a38111ea96150b99da99075afa30d6baab52
-
Filesize
5.2MB
MD5ddef9161cd3db53d8927500c6445ccd1
SHA18030c5f5d4e56948cf038d7f9a1842e892c29ddb
SHA256db0cf1fee724ad2c3940b6470d0efda864d30da1ef863ddf113933163c95cc87
SHA5128bdd6498d1dac93adbde802ae278875dbbc00d347f8a5453285279a6b4be946a8485ac6f2ed98424cec0db24ddb82d2302c6627b1eb4f428d7c4a49fe749eb2c
-
Filesize
5.2MB
MD56dc3766aa2cf03c00a7d216c1abe3f68
SHA1fa81a402e9f0c08cd4a93ad0888ed6799a5a9ea3
SHA256322074c5c4e4c4d7bd41014ffc6e6e6cdc4d66cda238a963641cb050fea74878
SHA5124dce0873017ca4403b961f7a2e1165a3c46ac067d53a505e4472ca56496c3f4d23de2a606cc95fba372e6a8776b32e5d4b8675a35ebe30ca127f9b14230c3c34
-
Filesize
5.2MB
MD519c5af626f2de6e6c5adcf2ee30af8b2
SHA17c80d9a30a9fa200864d6eeb394d1512e55b1748
SHA256815ed816721f588e8347f29bd4510b9824a9ab6a06fe4ddc2fab956ee2c803ae
SHA5129ffac5cf1449ef4bdf843a805756dc5150d849f54d638a6a01b4e38ee6b62feded3a9db3fa9b955dc432e99db032635b566596731ff40ed1af839b46c1559555
-
Filesize
5.2MB
MD5e58bc0cfa4814ee8544ebb38a135d90a
SHA1a20479e1732dde26c437b361e3c55a9c11950336
SHA256c6efb25cc3ce6ea63fa0d8093caa3f7ab4f3ba824d16f88f33fc8c082a147941
SHA512a73aba276386c4347c9a38d6daced18709166590b8a985fa720c4b7a4c3e865d4dc6f009f6a07a96e841635d1124089e80443c0f5fd60edbd574921a4aeeecf2
-
Filesize
5.2MB
MD58c80d2f79682d559c19b947f4a401a4b
SHA1b78807f8b7051c1a75b8682c2c6741801e0dade2
SHA256e16ed001a378bf1e51e22708a9ccb2484f08136a8887a0da7491161be3c515ba
SHA512eb7121c049ed2b8524b926d6c78407be0add3a9a64f0250e3e116739ca89532aa3c8f9bd8dba31d8fa4fc29ccb07fddad08fcf23c3e797cd5b66cee2af0a912d
-
Filesize
5.2MB
MD5904a3106f3b51c5f10eb08e8662f2361
SHA17ff913f2cc3cfc61400471b576fdd8b5bc9d15b7
SHA2565266480529d3512cb9dd6b389f0a06bb3adc88d8fdd22f1cbde709f25675a54f
SHA512f318a731301dc530119b3013f3e3a66ec06afcc2422beda0f274c4ec9720e15ba4dc7c319eca91062ec586b48ae6646b819424d80f45a10cc542da4e256d95a9
-
Filesize
5.2MB
MD551596f2d10e5e4cd4f6f801a48d94da1
SHA1bdad12e96f118b7d4fbaf9a1e05615a719f9e845
SHA25698f252d4c6124cc1900b1deb6e23ff85df98f34d70eaa018d00905bb12014091
SHA512af4b16debfcb41845a2399ef7d9faf9ca2dee4b84f01cdbe49154d62296473b535539dacb7fe4b7153868f1496824226fe872ea866dc4480f8cd80b5ae46e6d5
-
Filesize
5.2MB
MD55e0de7c23a7cdeb265b14757e18d965e
SHA1dd996765510e0942741ba827ed9b642e078a4131
SHA256b360ab82eb2df661d697a71bb08c160e18c4c1f7284a11c045ee6b11e40a58aa
SHA512e82a9c40e17fbb4e3ef103406373275f1e91ab02acb7725bf526302fa9bf505702252b413e1ea114e2d9be23c8a60f45638323a04bccd2515f81bdec76ba2d63
-
Filesize
5.2MB
MD5f4e6f666c0e82355ce00bea0ea7c2108
SHA1369e6d18dc50f167f11bde7a494045af16946bbf
SHA256e3026ee7abc95dd5dfc6cc274c4199d3e3a78a56447f25794887e88803337fe6
SHA512c2abdd75e218e36963c5f68f2a588e8b8ea31b03da2413d53aa9ab5257ece5c71d6e5c6795cda351541eb5e5a44e2faa2a722786976e004a36a509b6f7541d00
-
Filesize
5.2MB
MD5bb4f76454f4ae8758be69f0346f1e89c
SHA1e1ebb3da54f913ca8b0c5d9f3af9c0e59c26f5d9
SHA2563b4bd7d29903adbfa8a2083c90067d2d6574dbe5664e95e3a0364f9831517cf5
SHA512655365c0bb97fb5f28246ddb181396e697d49ba76588b655a8ac25c6ca1ef6063800f3b8ff0eeec538e49985ad86f098f48d6e4d0fed9c9f90a4dc3d4380e21a
-
Filesize
5.2MB
MD5292d92a0d8ded4d039597425363c77b4
SHA1965ed737b7b99f4d39a5e87415596790ca5b9b2f
SHA256184d545d57fc62dccc1a2efa0886b0d9b6247bdeda37e5f91cea58e2f281cc4f
SHA512fcf3fa75231a7a13a8df6d7aafd6207e9424c712e7ad8d00c99a041e3dd92c8a8c01fc38c6ce98e1d37d5c4c856f3b57e0578b25eb8057ff00676c8c1c44af6b
-
Filesize
5.2MB
MD5a4850925d3ca45a60a583d28fefc8cfc
SHA17c2d47d2260783b78e039da4d83d1e2f6d32314c
SHA25688a2598df264918271e007735ccab46c6932445cd5b66196bff50612909d6673
SHA512617e718f6350504549de9f9064e8a4e2216dcc726e22fb27cf6185ba1cbe5edb2d8e0705aac10cb5313bebd1d16bd22857a6f65a400f9fbd547d2c79efd821b1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB