Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 02:01
General
-
Target
2024-11-18_5899a7b8ae8d1dfd4b273989a82b8fbd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5899a7b8ae8d1dfd4b273989a82b8fbd
-
SHA1
83c943ef583811f61ee2c8c5de7a87537f88b31b
-
SHA256
d46de897c3037a8d75b8d8edf0ac2c3646a68f948c2720b80fd07dc2c85581eb
-
SHA512
13027c7cfcfaa588a37895a1a84237b485ffcaccb060f84a238b9f9ce0dae8dff8e7077741d6997983b7d6c24fd7cbd0758f6605d56d9723f248431abf524717
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_5899a7b8ae8d1dfd4b273989a82b8fbd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_5899a7b8ae8d1dfd4b273989a82b8fbd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uVwuKDL.exeC:\Windows\System\uVwuKDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GprYGMD.exeC:\Windows\System\GprYGMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vPGqExN.exeC:\Windows\System\vPGqExN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XpUEDhZ.exeC:\Windows\System\XpUEDhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GaYdvOk.exeC:\Windows\System\GaYdvOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSLQwYQ.exeC:\Windows\System\zSLQwYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByPoBDP.exeC:\Windows\System\ByPoBDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vsdqxek.exeC:\Windows\System\vsdqxek.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\borInxE.exeC:\Windows\System\borInxE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBXLBlx.exeC:\Windows\System\aBXLBlx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcieijE.exeC:\Windows\System\fcieijE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOSpGLB.exeC:\Windows\System\pOSpGLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVKPOkZ.exeC:\Windows\System\kVKPOkZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsZXojs.exeC:\Windows\System\WsZXojs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\egOXOBj.exeC:\Windows\System\egOXOBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tTuuSBA.exeC:\Windows\System\tTuuSBA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPAoHun.exeC:\Windows\System\ZPAoHun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bGLTQtA.exeC:\Windows\System\bGLTQtA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sWQRoGT.exeC:\Windows\System\sWQRoGT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwXntnr.exeC:\Windows\System\wwXntnr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTKHgvt.exeC:\Windows\System\cTKHgvt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54c9d8040386c7d524480f16046a65cde
SHA119a78532d56e5443583fc3cee31580a9c4935a88
SHA25658497271873b59421e614f75953a842e44af725a5f6f92a71c7c777acc938bf0
SHA512bf3d25163c96888aec1b590de1876a4c31d8e1b0aa05256807e2742962626ce1e8a4a339f021df2c955ef43458499a8822e2697128e7bdf38ac66b5838080b75
-
Filesize
5.2MB
MD5543e3a5c7409ffd4e55f1286d5cc3fb4
SHA11ea5adeb1b7b099c38894be269cdb287ae95b39f
SHA256225fdbf8dea389082422f3421413aa92eb429d1c4b2a8485f3de71f99a746aa6
SHA512d766f0b004458f892380c31192988b1f6eca49ab9665dbd4ad9a4d22fac56ff4ff91d110ff89de4198bf8c6f333fb995de8ec2d55038f9ab415ab53198f5da52
-
Filesize
5.2MB
MD5841dee9da46dc6f511328eaf7d32afe1
SHA17b6c750c2e080b5c5ebde7a3d101ee430c8c5d1b
SHA256a85d3071e13154d9410b772a415ebdc98db068bb7da9b5db279eae130ef7dff3
SHA512d1cddd8c2cbffdc6d46b8041858e344c98acfab76fe5afd9276f612a44a2d4095a665434eb2030dc932666c8af84787f03f2b938d382c5454106c63cd74ee8da
-
Filesize
5.2MB
MD55299784daed5552aefd49f72fea2f75d
SHA1d5ce96a5a73b269321f67e03ddfcd852aa3f6e8e
SHA25614940ceca458c6001a2c09fe68e9917b4a58379e592de12b2df5342a57935bae
SHA5120b7485c1dff50198c5a76f0cc273b79968bd6569d03edf250e2e3e97c3ab258a1cf324c6842dd80363c55d54b4c3990ccadd7140b95f0279d34719e5ac67a90b
-
Filesize
5.2MB
MD574642d1320f581146f078be1d88dcd6e
SHA1f2161e02d3cd831c19c29d3a92ffd6f2024c95e3
SHA256c1d8a265018d72cb9eb07e4e229f386698682ec94a6a2b99b12aedc182c16734
SHA5126785adc5729612613f139e40e5a7ecbfd5f21411a2d26a3c61076650ce23e1ee2371e8f298ce3d8878fb8102b3a9e6400002d33f33ece185ce9142f8e45fece2
-
Filesize
5.2MB
MD59935810e5452aede37947d66126585ee
SHA1a68e17a8aca77ee93a7c72d8b350eeeb48a35e69
SHA256c2bb579f59c426dd8db45d5c450eaafde3eaef97344912d8d141b2e65cf42922
SHA5129b87edf9b087d67819ec25dc1db2210822977aeb4b565f93aa517be63ab7f96c26c3420731f1ce76bddee5a55981abc880ca23b3fd21ff80467a3a852de456e7
-
Filesize
5.2MB
MD5327f895aff0ce8b644f7404e15f051ae
SHA198d80f0195bc5bd124fd14b5b3e7f1a80ec3a810
SHA2561620abb19a2275332652479e13ae28a48322f0f2a9ed804fa69b7ecf7e026247
SHA5123ff466e32171017ff3e2923bccfbd41af935c0da08b14ef5aca1d38dda4779c2453a64388d279e3016f1d67d446c26ce2ee1ca6d67c6deccdaaa2477b42cdf33
-
Filesize
5.2MB
MD5d49d9b93c09e73768aa8c9cd394c54e6
SHA1b0d6b65440d27c667093c384a7c6a95e7b8d3b02
SHA25632349645965c484ba3054554af39deb688cdfb1ea0b4b598d49e60d5e6669638
SHA512bbd6073b1492cdd5dce5021abe3682b32fd6cbe1607f9f292c9a9fe76c2c26b8d780b715087acb354fb4a1506b0098d735fec98a795d08f03b3edbed858c08e2
-
Filesize
5.2MB
MD54786650fdff2b4785ac81f86d5bd6c2a
SHA1a1a04a3d27d8b563ee612c3d0b67b079af486c39
SHA256fcbdab7dadcaee4bcd01af2207c5240147243fe674a73ae929d8c242bd688189
SHA51245b797a74d8e1eab8136d308ba39f580a36902b5247a7d443e354bf839ffa36bad6f682a7de084065343bedbccd30d0e8257c9927ea596b57e50e780409754d3
-
Filesize
5.2MB
MD58d8992a13a4cec5fa85d9615d4d00d19
SHA18e207841c29fe6641e4d912cbea30debf61865b0
SHA2569a61088e5a65013c01c857266584c225b09a0e0281537b5360a1f37d2644612a
SHA512674abad51fdc3a615bf3807dfdbfc344e27a0ec8ce0097b99092d680572f9d165a1d92e33b4bd982e8f425c4a29969607db26a149459f1068ec05122f603014c
-
Filesize
5.2MB
MD5d7f15e6acf2a59ec92c8427f5296139e
SHA1466892cce2a850cc7a4aa558dab3774050ca9c44
SHA256aa77644ccc421bcd3f23850fc199a6985f78c2ec1f50472c8c07c346e63600f7
SHA51244311602bd6212230615ee2195aa61db22c049db70daa254ce7e2141102cf94ec585bb79bc74d5d15e22725ac67ac7fa8629f6697c4487d76eaab8e30db0faf8
-
Filesize
5.2MB
MD5cc36984f8ab57ea913ee26fdcd507612
SHA109d0ea7f94a52e52a273efdbd31999d688002c61
SHA25652ac0b1cbff384a3b52475154f5767e89d82cf2a22851e2818618bf42e9cb706
SHA512139260bf48d6aec56513056b1ab25137877728fbdf753434d4c20029a4af18f78d80f09c8c01cf0e9a3dc671c0afd85d5177e1f1879bfb0ab132c956fa35fd83
-
Filesize
5.2MB
MD535d9421682d39c0cac8a20fa7b6f912a
SHA172c52088d3eddec1ded765064e1fc26426863cdb
SHA256f1d5823124068eee2a7219ef1bfab3b0e4395b73d560e3dedaeed05fe2eea5b4
SHA5121c91b909fddab6f8fa08ce089308aeac0d21e5624e545f079b75ca600742937e48330de315827ac4f1c608eca755d4a3479149ef9a1308a3c0c09247eef791bd
-
Filesize
5.2MB
MD5301ef4deaffd46d4620ebb3af3d16ace
SHA14e33e4cb1a4483e6b8f41781da6ada839c5848d6
SHA256e24655630ba89598f58efcebfe21558dd71143d17aa663cca664f0597080560d
SHA512a8db0ccd0803c321ea2c2c91073d6b5bea827e8e46a17090dd20d026fece03567ac2b255a51cb8be20c173a32db4922a07f33778cc8c2878b2c3302be0f0f20c
-
Filesize
5.2MB
MD5bf6aac02802993ba59ae3182b8de8069
SHA1d93891c0c1f671898fe85bb9ff645c137e9a89d1
SHA2568c36379f5821a6835fdf7828062b3a8e57b8bd167b25e15f215cd121d89ae5fe
SHA5123c84a91a3879ea07f54aece1f80549a05e079d0a1ed88d5cf38850349ce53197c0f1fd598d34088e5be0e50169d6577cc23ba73b60f661b3e6058f7ff01fcc26
-
Filesize
5.2MB
MD5e9a55c2794eb279e8c5e287ddf5ae513
SHA1015849e85818845beb33bb6a1e60f2d930c6a712
SHA256dd8f3ecd55eff82b81e9d71575caed7fde3d1ae4894b1429d45c5218210f609f
SHA512df99060c759665e7ffaad2dbba5ed6c3cbadd00669d9769c407c1ef09f795af07264dfb6bc1b1ac5d0e7c0fbeee1592c33f306f5c62faa8d0b5f8b2615fda8a9
-
Filesize
5.2MB
MD5bf3b43f4efc83a51c2d9a047ddf87e76
SHA15cc6f77642ca8f7482e36bba280f6c2e3afb493f
SHA256cfe736e3493d103fb0c09d13d0fbc9be495511c9ebc13e0bd0fd53be559b4b04
SHA5129d283517506a781e7cef7a3d118d5bb11a1ce7ffd97c03f29517a4c847e161b68c879cde5134581b777d83c9cc2617c785b3b70aca955a2b6f043dc35694f0f8
-
Filesize
5.2MB
MD5280ef0b87fbf53770eb69b49d89e1f2e
SHA1f22248804aaeaba36526a97559e2922a651452b0
SHA25673a2bc7d2d42e8e75403f0145c6a1a390041207aa1b1b013f75f6af75ed7d5e9
SHA5128f39e309fef10d34f8372e7fb7c3077a2b14f1af058080c298083ccf1cb6a939691dfa73e2cb89460fb829385615ca41b6b33bedbc5c8875ff15cc165d74ee85
-
Filesize
5.2MB
MD5dc264650205a6ff5c805c7f56e6c5d8a
SHA1f4b22d42c10549d3f39fa0a2a875908215c4fc6a
SHA25616348406adb19e1c1226c971b8e63ea7315cc31c9bd6515c89dc06a6f7a4db87
SHA51274fc55602d5a1dc62ad904310f00219c6cbbff9ae504c54e3369af6853600ea8339d987fc935e09f19b6e359fc648abe012502c4abdd8e0ab26a9fa3a0bd309a
-
Filesize
5.2MB
MD5cb56ba21daad2635dc9c1fcf95b827c8
SHA1d7af72a73d5b633548d378a8844e9c5d2afbbcbd
SHA256141d4c1bf817fff8d54d5264a5be0932c1f4990714f8475d5ad93ba14857a307
SHA5120ceacecdc546a0c8dc341a0f4cb19fefe46c430408920ad423bbdc71709fba5fe39e0498226729c088b08dfb3d4158c3e2134089f3080dbe6bee7222f6718ab3
-
Filesize
5.2MB
MD5661b8fa563d9cac44f03c026931fea27
SHA1a5139638b87a76bedc16a03322fd7d587c49a503
SHA256d62fc4d1bd7593621f4ab07dbaad13de92615a811bbb841c8617cc0dfe05425b
SHA512ec0986f66bad7f00c4cf3600c0c2be83e10afbbc8797611f65f11c07b521ded23e06b20097f4a8af9f435ce50da039e4896cb4ddcc7f9f3df02098cc5078735b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB