Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 01:50
General
-
Target
2024-11-18_20d07cc50602b45ce29b64e2603084f6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
20d07cc50602b45ce29b64e2603084f6
-
SHA1
e6a719f16d93582cfa70410f52756e04f2e4e232
-
SHA256
9e8b56f7ab0760cef4a7f0f7e80e847e1392e7c30ec84651f3bc29067b666f86
-
SHA512
1080a372e9c0f1a87533036ffea8c0006e4437eb95ea8c38c089cfb6040dd7a9cb69cd91481f125fbfba446ebbc730a1f0347c894be7c779d9adac3c26798f8d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_20d07cc50602b45ce29b64e2603084f6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_20d07cc50602b45ce29b64e2603084f6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gaEQLaP.exeC:\Windows\System\gaEQLaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxnCymL.exeC:\Windows\System\GxnCymL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdmUQWR.exeC:\Windows\System\KdmUQWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbIEMnG.exeC:\Windows\System\tbIEMnG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJqoRkI.exeC:\Windows\System\WJqoRkI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FQNxaaw.exeC:\Windows\System\FQNxaaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUVIsRe.exeC:\Windows\System\iUVIsRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XhvHfni.exeC:\Windows\System\XhvHfni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TETHIvN.exeC:\Windows\System\TETHIvN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEXDQSD.exeC:\Windows\System\pEXDQSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqpJQnD.exeC:\Windows\System\RqpJQnD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GjogFdt.exeC:\Windows\System\GjogFdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzCvteJ.exeC:\Windows\System\uzCvteJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrTlIFm.exeC:\Windows\System\OrTlIFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dijUepp.exeC:\Windows\System\dijUepp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWBgtEX.exeC:\Windows\System\eWBgtEX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JxXNLSQ.exeC:\Windows\System\JxXNLSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\epjvKCi.exeC:\Windows\System\epjvKCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sToUoRo.exeC:\Windows\System\sToUoRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUcCNUW.exeC:\Windows\System\IUcCNUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXCFwsB.exeC:\Windows\System\YXCFwsB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD551e920dad05dd120d37577dc46bfaef0
SHA17239901d23a838b8cb6d4d22d03759a878896988
SHA256e0c2f7baebe2d9402a8bf09c4a177f387e1bfd29a7ef830617271452eb8fa31c
SHA512da97791b05feac994c55d58ebd92240717f62793fe925e54fcb5a88f8c7486966e265178081d1c6c81f58965043b69efc1f800aba996007bb762dfc294897d2c
-
Filesize
5.2MB
MD57b01e6a72b53b72feb2da039001e3329
SHA12af51cb762248abf9461138ce373d746cc1e11dc
SHA25649ab57bc365b7dcfa748d3897bbfca3c30656e532f389d0492beb3d079fd5830
SHA512bad2b74831f0322a30e225944e696706e5a0c4ae2040bdb682bfcc35e84e1e411ac0a84e7fcd713f8d6bf31b657261df19ec49bbb1c17e6253f00d3994fc5e2b
-
Filesize
5.2MB
MD5c16662e07bac2279bd2a74e6e9eeb106
SHA16ea8b6146733cff437b25c3fcd40e6be249f0008
SHA256861efe59340d1cbb5dfea93d0c3cea90a588a280cdaf9f98c30529d4825e90ff
SHA512645a75f7e4a513958aceda05611a95731a074304b7f7ec3cbce42a9d5def8b86813006421b6fe9279c0b704b1cfb0c48179801eb751405885fdc066e1d606b44
-
Filesize
5.2MB
MD5cbb9ac4bbc848d1cf4ad6726032100d9
SHA107481efae7d122ff701705dabd153532bc017c68
SHA2567266db086fa10bf9e93acb16ff8a23b86bfb5259b7d2b6bcfa781d5cbbed4ac8
SHA512696ecde2b43004c7432b233aeb77a05e391d128a55c423c08baf91677fc064d78b9f270190b1b80415d56737b68ca180dfaf4ef7b9e399d65dea9eceb59a00c2
-
Filesize
5.2MB
MD5868e83949577c7cd19ede7f83eb531f2
SHA116ac9574cb128f641bce06fc92af0243464363b1
SHA256cfa2dce15f14a3ecdc30a0314231ad306089895501b037f97bc8888c8f362310
SHA512e9275b929029aac3bc5e7ece52f1f0f13cd281dff984bab6dfc3c65886156a8bbb2765c4e2a8d7e142a358a63124ac843236dcf04f9f20351aec97a71951a2a9
-
Filesize
5.2MB
MD5d470f73e067955970ce412bbe9a18ad7
SHA16b6019158edbf9de412f0290696e9013ec0e22a3
SHA256155a6f4f1403025f057223841b8090c0c06102c53f5303b0f8f59a8fbfe2e600
SHA512e44c5d9a9096c63aac1804fd70427e7a2ac4a942002bc1293b3247e8352cfe49d1dd02b8328d086e7d4baaf0f1abb4b4825fb192b8043003d952c0461c35ebc3
-
Filesize
5.2MB
MD52b1d53c6137728bf96c89f89ffc662af
SHA1c77e0015347fc7798f4478d902fd384fc90dec4b
SHA25602d9cd7cfbc463440c0fccc4e114c40014e1e25baaf93564d9b3724be31198bd
SHA51295f5d4c001369a24b7e61b744a81998f0b4a636f1291fdeb68a28f2e2aea4f5377b8d5b9137f3131a5f8cf1e0a55a811017d977962aa2a896166e839a3119b21
-
Filesize
5.2MB
MD50fc35d03f7e4b0636f2ed3dab79cc13d
SHA164a8f36f9946c94bb6af07ffe1ac49416e8297bb
SHA2568562964ea580c3600a8182a3435eb28ee9989a85fc3ad9a54be9935a2f04e285
SHA5129ad1a663421d48d42fb08d20520da5d3d4086db9895bc834fde2a950a8e70663f960aa902d983ad3aa3a9d487a23ac6a886988192f99a960cf895728fde41f9c
-
Filesize
5.2MB
MD5820d6c9bc3233ebe69d44d374bda68a4
SHA19c1cca1e2aa33fb62372c1d546d5cfbc231e0885
SHA2565e687ddb7173fefc45b05df75b5bd7c0ec3bfde52d9877ea69fcc61c7244c009
SHA5125aad09aa9ca0f1e09e837627e964d89506e69f025bfce2c0ed5b72dc07f0082ba74f58875d49d09dfd183d88ff17dfb06b4353bfc6a0c1c1d3116ce33447e65c
-
Filesize
5.2MB
MD54ad009d7ef66016ab39cd43da1dcf02a
SHA18c638787bfb05e288404d162b2d647226e6a78a3
SHA25659e962f681d3ca0d2eb1783e9968010a1d669a5f4bde78d9c7ee7cd21c2d9b6c
SHA512452fb97deebf64620ef716e0d1135c22a5d2ad28999effc48e0540d65e9f50427db2866e999caf96acc315ed27cf3367136496787161c6f437eb5965fe3f942e
-
Filesize
5.2MB
MD5d9028f74dd46b490045dc4820cafe531
SHA12fe3c8b497d261f8f7c430521363a5bd04330d55
SHA25636d906483c5a8104b614919587189f67f941f96faf87fe1b559410ad2ed545db
SHA512d327fc8af5a17a29a3ec5237b65f8bff0dfd9ef87f096be7042704945461a26c68f7fd6e1707f26ef354591a14963ad7c178f7ec2d457277ce0e1d0795f77222
-
Filesize
5.2MB
MD57bec4371a8084218c489115dcf79382b
SHA159ed5f1234a26a2f82dfa00c3a5930bfc94eabca
SHA256fd213250a4267de396a0b0cbebd62a086e7750c474130989be59945d9515e34f
SHA5123a53dc3902c6a54c9f9c53ddbf8462bf6c46993772400a8b8a74de0e73b6c40d3f732b133b53cc71aff75b4e790ad3039102a0d914c40875a9ba8e302257080b
-
Filesize
5.2MB
MD5a12794b7c2a746a41510120a6975ade4
SHA1f220187c69593da336482f14ca9e16048f6c5cf6
SHA256d1b7d2e51b8582466cda01a4a8a508102bda0698cfa9dc04f021f2884f48748c
SHA512845147fc744594f8520a2565ca5f4f15e6e4441a1bf2f853aded587b55e5ab54c59a3827125290a46fbf7e593b9ef34815a4b767c54a62372217bee2062419a0
-
Filesize
5.2MB
MD553bc6fb22601cb1ed9b673f3d2398fa4
SHA168518542bf3c3aed546e7faf4f8f3c2a9cf278df
SHA256afad85cab58d766299a6596ab168317857b2a8a8dbd8512f381a7cf00a14e44d
SHA51233801cb1819ab4033b26128e23c2a9ff637ea4bfc11f453432e69ba82dd4667a83a489af3f97fec7e74196a03c8d9bda0c1793985f4fd1531af363217968fa19
-
Filesize
5.2MB
MD5710890dfe10730cc1362521b4a7723ca
SHA12f36c3c6864795fbb1eb88226f54453334c846b3
SHA25695e3e86c3c37aa7ed7e268c2be6572e282b0d727661f565113bef1416baa87ea
SHA512f4dab77504187f970a12e8907e6f50bf0cb9f81a5241ab0604d14b4e1d8769d90eb054738c6cba184caec100fee07e72af5ad00df39bbb14bf198b24a7ddd762
-
Filesize
5.2MB
MD5d5b4d59bb26ffbccca1501a119b14971
SHA196a3eddfc4a5c40040aff426b5857611a7439065
SHA256ad373b68c6d712d7b442b242985466f7784abac441a8145580243fca51a13b8f
SHA5122c3a686c2596be3e2460012af19226b7687a9fbfc778def63885852a8dbf7a43913ae12f6c3f6a5035ddd7b42b54f4810b0d220d712960969eb96f15481a2af7
-
Filesize
5.2MB
MD5a78fc79e8d7ab477d5725a3cf13789e0
SHA1d58cd8e98556ba379d993715e686e5d2627ee3e8
SHA256ba95851a71480ae496008953ada55feeea5507157b9af26998c0896d312616a4
SHA5122ecb81d3df8fb1f3873e5c6bcc5f07ab836346b9db19854b7f4fe57f1e6f7be65536cc99d2b774d6adc8f562aca6d33bf70192965863db04787eefdf24bf261d
-
Filesize
5.2MB
MD52ce87a952e216e4250d5bf58a670220d
SHA11f7f082141ef66b3fe15e11914785d2b4d4434a6
SHA25676c11e745abeacc7f4d438090c112bc21980ae4abfd9574b5847852280ccc9b1
SHA51217c214b706e9aa636c4abd15e9910987084e5080731f69b6540214cf5752ae86f1db3163dad06fe64ef527f799627a64825a6d173455238acdd681bae51aa1f7
-
Filesize
5.2MB
MD566fe8ac2df71b42851b23fc7077d46fc
SHA137a3d3fca8cf375eb2956a048b681fcea80411eb
SHA256c595db39ca63f4b5de1de4b066bc7587418d08c6d21cd10a4ba14dedb7b99985
SHA512648f3530f3181b558d102791f5881b9ad917910449139c939db8cf78737fc042268ff8a79d02d2753a0caf480602f11e5009c6caf90a5c80429fd33b46555885
-
Filesize
5.2MB
MD57bc49814c10ec30c77e13e8db0c85779
SHA14639954948b76b7e053ed5b3d3a3ce507d9e867a
SHA25669f130eddd1a4ed29ab1e7daaa99c783988d08c73adc12217d37edf7459db216
SHA512c05a7ca562774b60f91075bbfd8cba3fb74b67a2971be1a9e27721f028b0d1ed5a4e6e503cb18a9ddafce5ec093bc4b2b0c14078d26ad8f2579b1ab76f73fa01
-
Filesize
5.2MB
MD5c45a4aa8fbd43fa888204876c9fc881e
SHA15c13c4918b47433600a6d7b9d1e13507c5fc8b64
SHA256b85c47329d68666f5bcd068f37d993f047596f0ce1168298307177f1447f1de8
SHA512c73bd080b5fc615c0bfa2c28ef6a26557c395dd4be2c8bda5ca577b2e2d7e64d612e5b9d4d4e5a01dc6d9adfd9925f07a4bd823fa32d58a5238f3e66027e4ad0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB