Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 01:38
General
-
Target
2024-11-18_a9bcd1e3392651c6a4265e174ce9904e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a9bcd1e3392651c6a4265e174ce9904e
-
SHA1
f3add6325723b34e4621b78c2b18c25aa9e90a50
-
SHA256
fb102bd06b27191d75de52a20067bb8726a06e70ec332b55c2066adf0066d23c
-
SHA512
438eff2a3191ff406ae717c02dc15aa1f307314adbb10003c7957d1764bfb79dd0edf7a13f144eaf760e21c698c13ceebb644dbe0011afd0fcaf434f4f4c4c6f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_a9bcd1e3392651c6a4265e174ce9904e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_a9bcd1e3392651c6a4265e174ce9904e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bNjDoqF.exeC:\Windows\System\bNjDoqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFTLhaW.exeC:\Windows\System\TFTLhaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iAEMGqC.exeC:\Windows\System\iAEMGqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRExDZz.exeC:\Windows\System\DRExDZz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNryhYU.exeC:\Windows\System\hNryhYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OToERWp.exeC:\Windows\System\OToERWp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jYFgMVQ.exeC:\Windows\System\jYFgMVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GKAaAQg.exeC:\Windows\System\GKAaAQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iAdWWCX.exeC:\Windows\System\iAdWWCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vaxBIKx.exeC:\Windows\System\vaxBIKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lmAQKEc.exeC:\Windows\System\lmAQKEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNRKrgJ.exeC:\Windows\System\tNRKrgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pQQETei.exeC:\Windows\System\pQQETei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJrLPHF.exeC:\Windows\System\dJrLPHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcgulST.exeC:\Windows\System\CcgulST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WxORKJC.exeC:\Windows\System\WxORKJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpaLrOa.exeC:\Windows\System\GpaLrOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSxgTir.exeC:\Windows\System\kSxgTir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLlblGS.exeC:\Windows\System\CLlblGS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bvjeeav.exeC:\Windows\System\bvjeeav.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXeaENX.exeC:\Windows\System\KXeaENX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5adf1ed98994e806eb7084e09be3547c4
SHA1a2415c425bfb33605fb89ab3d6cade9fdb51b47c
SHA256f02dfe0050292eb9f63a595fde46edc745912a70045bafbfb370a864dfa85d9a
SHA512f8a51f71b801b461f4efaa73364b4d407392657253b405e392baf41742e01326ce5a63e56fc77e41f5da863ddfb67520d2db299adcdc6d2fe08f4c5bfa37d176
-
Filesize
5.2MB
MD5630c5e4901605ae2f62d8e6b34e0c73e
SHA15ab4c9200afd9c53d8196ac4a93b16bf26502054
SHA256f970e6922309d5a1dc76d464d8f412829bf9852e2fc9e4035f418aa8ea814c16
SHA5126ba537b56982303ec92f5cc674322179655e50c0f5704ba863b43349e20f19600b7013ce670dbf324306c104fd7ea30091b296188cb800185d3e8dcbe1fcc208
-
Filesize
5.2MB
MD50397818b6c6ffdd394e9e28ce310b52f
SHA1290335dc69ce622abb1c78f440f1366f1879e458
SHA2564bb8f93775beebd3408d3a96c62cf6067cc24e25e7c332d9673131eaaf38ce77
SHA5126e197ce409998286a3b580168f71ac3837757f18d73fbb7d2f2d5ba8845c86eb805beab328456574d345734fc3bd5d133993adf8778111a3c6a0f818655d510b
-
Filesize
5.2MB
MD5651a01761df5e27199bcfabda0bcb86c
SHA1d40c21a6402b202a8476852c4cbdb373aa71e818
SHA256e19ca275973b7f58b2d0d29e4d98e29d12124b1a916c556e8bb604402f5bde7a
SHA512910a539304d7a605757defccb481b3bb613ae9223380f4ce8ae9b38b55e743971b483e9d18ff2c32d4a1633f5d1a0cbf834fa2e9eef07d1d4dea0d1c60937d50
-
Filesize
5.2MB
MD5ec2eea0b17a47f6744da9156c5ea89db
SHA15e7e6b242a2f9c0dd80367d91ec7708fb290d42f
SHA256e07ea2fe2ae76688250c5a2b6b21550f621c94acba274395ce93d7065f499e6e
SHA512bc3ae3f4039578c4940b062f12dde708db99456921dca433fadb3bd816ec6a839bb5addaeb528da93d0363ecf448d281e17879f638b3abe353b33cc0130c4f2f
-
Filesize
5.2MB
MD55ef6fd09f99aef634751aadfc4197d44
SHA169a10d56981b6ab6d731fca886ef0c0f51dbcccf
SHA25617afb418048c438ae77617f5581f4a2659f1bd6b6785877d4f77984d9ee447cd
SHA512aca0e0ad255d5265132eb62ea3df6e3f154babf438f9f5bda8e228801d45b1c50b189956bc2bc1f2205376fbee4e9a5e71c8a5f03cd5e81d94b2954eceab84a1
-
Filesize
5.2MB
MD5ab8cabe4ff44410cc07abd70a2fd2185
SHA1fb8f5790b914fef2eb9c8543a58a01a820a77700
SHA256e62e1c3f241fcd4f79c586157c19d0005e96f8ac02ec0d341a60d18da0bc02f7
SHA512c70c8739752867cd70282c448855263ebada8b661b714da7983c20e2467b9d5717b2a50341f1a34b6a7ab0631059ec324abb09110d4220ff2174d3e275834298
-
Filesize
5.2MB
MD5a750fd90251f2a229341d044da25d0f6
SHA18a16aeef96bb0f2f46268af95d5fbf718cf5e79e
SHA256da6ea4bd61cee5decd5beb41d29027ebff6df07f236c5723b430db9d94e0ea42
SHA51291a55bbc3bbb228eb1793e1220aaa721253435f24a228315885a4c6665565e1b1525861eaeb8b94bf535460f03f8ce015d7c9648085a7d7dd92ec8b889c19479
-
Filesize
5.2MB
MD5aeb712504457c86a3f67f0f4624cb575
SHA14b497b7cc475cfc34b0f65fef97530e190fe075d
SHA256bbf8b46099730a0539fa76dc2f6eae3f14e94a350bc7f7f29f5b3076760dab94
SHA512b473978281d714fd130765e56d6fb3e9c354ec25de1fa09c3c08e016647f3d125531b8244728e153486d4a7ef66fac601f636e40ab0162963616cf126aa5a5ac
-
Filesize
5.2MB
MD5b9dd43fbdacd8ec7c2ffddef57448886
SHA106db45d5be73131888bb52343ca7f9d153519278
SHA2562c483bbe7491808016e7709e025a2610e8559fdef77ed2aa82aba347b69a548d
SHA5128b9b84c6da0e6753ecf8983f8e7a51a9823a694e0c21dc0bb57eda62e2cd12e5c9be348dd17739316d471bc3d40e03931f508f01d5f89ca8725af7b423e7366d
-
Filesize
5.2MB
MD5b035ef6000f497ada5f4e0ef6b4152d5
SHA1c6e5adc997969c37dbc89f014534c3daee0d4d79
SHA25693442b18f6b06bc3792b29697fd5eb77a0316162823b93cf1334ab44833d8908
SHA512183e09a9a71ee14670c83bd39b51e61d0e8df2e971fb027619c40f8d362e9699dff00b0bb74cc89a877bb82c7e2722a1d257b5c333d8cf89e07e5121b2e6645b
-
Filesize
5.2MB
MD550d679df9d764dfec9dd84b277bbed3b
SHA1f796ace09b74705aed344b719c7cff938720fa66
SHA256575bf35f340a3d6efd3cb78ddc7df6d32d8f3b958d1c44bf28c1dc92df183fc0
SHA512ec7d5b8f28eb8d647c1dc0be47e2e8216d5deb7739416214d81e3896e49cb57393cdcf936d6a8064f2dc111f13a07a138ca7f542eb2d1d9708e8915555b6d2c2
-
Filesize
5.2MB
MD5d58818c6365842fbbcac7cd7fea844ab
SHA13f15b14afb95ac66c3239cd0fc0b82a6010cbc5e
SHA2567c9613c4a6daa68a2796bd02f824eabcf0814309fc0ca5171921a30c3c379999
SHA51213caf4cfca30303bdd3f2453124c32be62b0aabd95f7fe2c6fb339feeb043e1e6f26abb48c614a063ee9065bdb9a33eb9ffaaecc23479637e895532859afb585
-
Filesize
5.2MB
MD5742789e991c96efcfd92d34c45e9e4fe
SHA1583a00c2b2dee4277ef7e8de39e04cb26475f781
SHA2569c8beb651a68701a0959039daf398b3729ec2fbbf3dfe7045875a507e3008391
SHA5124aafe4768ed1969eb9564f994f7a5c3e8dcbbcbba967e821bbaeb81173680cdac3b7322fffe313b99316689b9ace60efac49b8c25af99272697a2b91aeb2bf74
-
Filesize
5.2MB
MD52dd62d15fd748c6ddf1cc3f7de447667
SHA1c77f048043dfc11dbc5e95acd92cf86992758d49
SHA2564c966c62de755720bce35c05aaef90bf569b20ade527c55e9485d7c47340e81c
SHA51255f2b804248dfac46c7d6cb8374365c62e8eeb79dcad2aa83d4ccccf23253bd0755cd267ccc57ddb154407e8ac8e38597327d87530769c663061a31ef6e723ac
-
Filesize
5.2MB
MD53c1e0f49a5fa3217fede451609e77fd5
SHA1d18e5b4ed05d441d906e0f77418505a53ae52ade
SHA2562f77dd3c33686956ec0077c2cb2428f534f04734f2d4891d10a93d227ec74723
SHA512b698b15ac3ea5b031473f918024078416c108dc58ebd7b891efdf409f3a526669dc6fb898b12b0e5ea7efe973bfe95d2c2e5b1a7f6cb6a8e2ab442e9792a4312
-
Filesize
5.2MB
MD56ef7526fbb7cc9f346567de6f9941d2d
SHA1959fc2c827ad54d2d23f78d3a9b29ab7fd27454f
SHA2565dba3f5494951a8dffa50a7e81e58d10f82478d2e8ae5fa4ad64c6f724422ef2
SHA5126f2348ad8c18988ec34482631c49b455ec653c9e99add5190436ddf5529d3b1e1149de0d63701750fc33110926d0fd47d60e8b235d6ab51d214aabb56e6a6090
-
Filesize
5.2MB
MD52a04c71b3900755999a81b9f689d7981
SHA17c94c77b33a1f8ebcb27cad0332c1196faf6f6eb
SHA2563144d6f2143225640b85c22d4beebb7c7ab444acb5f5106eb0b3860eba6b1622
SHA512595a99ade88e481613e227d45839bf25bc92647897da3f32baae1c4a8571929bb191588419dab5363af642bfdbd3e0b6cfbac6d43414267cd57f4171c3f875cb
-
Filesize
5.2MB
MD5de403f4fc813d32581e1b43448f4abc6
SHA18fd5cf73cb00c7b23ef9cecbed7121e60e25e16d
SHA256e24507fe45c7ff1ad63f2697b4a9772a0604a0ea446099104cd6472a8a677902
SHA5129cc64ff6b6ea51fb0743af247f8780f2331688b7773fdafb09ba372a2af77df68c1a77af7f3e31a23f578e442cd35ef2fc8068ae8604ae26af0b91bb7125d949
-
Filesize
5.2MB
MD579dfda80a1d8e435bb181672b7c4620e
SHA187e7b5ef3132e9c5665122eb87d51cb8f3c78665
SHA256cfd6cd9d762978b61771a8cd7c62dc99c1580c0a34f3225179758e9442e66d73
SHA512ab14fbc2eebb9c242f84705392c6b16ac6f08d0f90a1c7307f89ecc9726cfb3a36dade2b35cc58a9205c5edd3a382d09b1db50ef998d7a2a5d077ece3d36af10
-
Filesize
5.2MB
MD52a1ea436d2c1ff4c020e993d1ef8acfd
SHA1d65a451be16bc07425ba3db0a7f892933bfdb464
SHA256673acb4f4c3b6806bf776c43f300ef4f95ffb53925e7e3bbdddef6445619d10c
SHA5123220af7437a0e6f0c42f4ebb5b207517b35b582f28463de6833bb1e065a13278fc2413179fe9a6e3dea9ea9e83ad4124f3da818f0c2e7da6a1881e9fca7ba68e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB