Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 02:15
General
-
Target
2024-11-18_a6016ee33ea98acdaee2212d168ebbf7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a6016ee33ea98acdaee2212d168ebbf7
-
SHA1
2e40871d784432083befe800b876925109c0d5df
-
SHA256
fa898d29c2098544aff71ed3b9bb3822d4df6fa3a728d813be2e720079d09274
-
SHA512
0f5143c0407a9a9cbaf6d7d470ee57cdd356de93d486e8df3a37caea5f2b44e8f26e5625837a250682da4f600959f61c06bd55dff3e460d8b51e6977bb4dea8c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_a6016ee33ea98acdaee2212d168ebbf7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_a6016ee33ea98acdaee2212d168ebbf7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qlemXxI.exeC:\Windows\System\qlemXxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FNjpzET.exeC:\Windows\System\FNjpzET.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdYRJqg.exeC:\Windows\System\QdYRJqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jSjaGQK.exeC:\Windows\System\jSjaGQK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhtFPwd.exeC:\Windows\System\fhtFPwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMxYvhQ.exeC:\Windows\System\kMxYvhQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvuthOv.exeC:\Windows\System\lvuthOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDELMmV.exeC:\Windows\System\uDELMmV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhpFMKB.exeC:\Windows\System\qhpFMKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPoBHLU.exeC:\Windows\System\aPoBHLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUaSvmy.exeC:\Windows\System\TUaSvmy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pxHSCTG.exeC:\Windows\System\pxHSCTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WNLYoWQ.exeC:\Windows\System\WNLYoWQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfeOCfR.exeC:\Windows\System\QfeOCfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTMYsqr.exeC:\Windows\System\eTMYsqr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIzHTRR.exeC:\Windows\System\qIzHTRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWpZQiu.exeC:\Windows\System\XWpZQiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mfXXCGp.exeC:\Windows\System\mfXXCGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lWOblkl.exeC:\Windows\System\lWOblkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUdFQFW.exeC:\Windows\System\xUdFQFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYtPJPE.exeC:\Windows\System\iYtPJPE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ac4fe8cfdd5d494871402ac39b1aef7b
SHA1f6e83a759e5f325fb9fdde0ab411485dbb56b352
SHA256faa81d4bb05cef7acca1f61be1ec56573ebea923603138e3f186887d5ccb303b
SHA512cc380fabaaa6702359d5f5c3928780262a92919dadc271e77950d4f4c3ea512a5302b2054b0386d41e0a7dab5e672484a4524219f5a7269b3e06925dd8309d11
-
Filesize
5.2MB
MD537eef460e5dd5a6e856d027e94c18d90
SHA128b8f6acf34cb0b032663d804b80127dd2452ec9
SHA25694e4235cae9633152d0b134033dbb5ca17e7a656e87670c2f52f478d684013aa
SHA5123736460e873dd6f01e7e6f0e98391382ec192c1a86b541c50bb0e9795209f6d02ea21c3d80a74683cc4a848f1af8f942870f940e6b9bf56a66448f766f13f555
-
Filesize
5.2MB
MD593b67bd18288cebbb46c47622eb4a055
SHA1db513bd6b05ee5171eaefff571b663c990e83c6f
SHA256e3a88f1b7837ce4d2f52603662e10553ca567eae3075e3cbef033454fd9fc5c3
SHA5123ad22b0f86c7d5aa9f1181378b75001520a0784dd8dbf5c77eb69d69838a6e733d40fd201f0e3df01ba94af90c641030fa50e51ee66960182c8f4326f4689616
-
Filesize
5.2MB
MD524cf354d52c00a3cce9597ad321c7f35
SHA1db9ec87ddbccfff422fdaf138dc369d13ae84042
SHA256caa7e61489fd45026ff16af866259f21b910f318f627b0a8ec04bc7d0af85262
SHA512f7a4c7837688d8d2845a807706d00f37e86475d1225762c8a6f011377fcc8e65d1c38a75218239c17a022d1a8ab7c47cb19855b7b0b4a6ca8c8977d5179a2bab
-
Filesize
5.2MB
MD50ec19d0f8c4ef051dd95b83bbf69a581
SHA165d824597afcf20a9d290f6b646e06c484eb53ba
SHA256f58ebad3943a8fa188a9b1c9d4570a8d61bdffb76138bf98cd202ebefa739993
SHA512dd1f30b186ae9ae0261b052b38dd2c09319ed260ffaffba338c08daaad7894387dbaeb1d6dd5a1cbaac1499dafd37fe7deeec96f5728aee3197f0daf56c08930
-
Filesize
5.2MB
MD5b3662fb5ae40e5c2c6f440dbe77d0267
SHA12de9e672c975c0e5033766089da585209a12a52a
SHA25607cf66cacaf66035ed6650467e095b47b6af4c43b83ea698a459b965eb35265c
SHA512aa80e1ee03b6c5f023a8f50345011b1955c7ede96ca4c1a0fcfe12fb1d9b6b3f5e11f970868359e70f5c949af12eebaa815a01687122d4a54c41a308ae1d7a75
-
Filesize
5.2MB
MD52f9ef5c56bef638d38446d80abf5a9d1
SHA19be2442f95cb076978bce395a3b5bfb78dbb903a
SHA256bcafa0e1c7b8dc93e5cd66056c92a863a92f5952bd8a51e4aa495c9f74311d4a
SHA51286aa1a1bea5586996460c89471f9e983e34fd63c812003d619907e415b8575cb5297aa2f8279140a2a85377adef0245dd3719c6b97d4e760b92436f3381c2413
-
Filesize
5.2MB
MD522f9f6e921a41d23198723a67eb9d4cc
SHA143a4ebb755b32177ec3ea8e723bc90452bc69747
SHA2560e81c8384ef1d852124f1c9f0d37c3da8aad6457b938b66db4dc4c263f5f1b87
SHA512d7c343d3cb6c9959dc6def7c37d10b0b25fdb741b52a35df5668f806a9933a19d205da041036f9e6be86970d6892cc36b8cef93df508183118886d9ccdf6bf02
-
Filesize
5.2MB
MD56b1b2d89d737a0ba7eb82b35b752b594
SHA11b67812f88b29e46de9ebef46ec04850183d29c8
SHA256f4925ec266665d0111a0663515d94bc9e890047a61485d3c4e3c270e6a132943
SHA512016ac3cd32516eb35bc4df03e4f130036d3159d3988abf3586efae204874a5169382eb6a215271afb8c7d58ed86097580be3d4589f76cf741998310eb03ef4d1
-
Filesize
5.2MB
MD598120d709a09d0dea7dd0e1bdfc01e48
SHA1ba17c45a1265f580bd87e51620f0a0a9e2aac14e
SHA256646eaffb32785d76c43c46c67aabae866dd9d0a27e670647a4949d7050148a72
SHA512c09e8e7bfb5e8771fbe991343de785929bf60b63580481fb321339416026c164f6b0cbb785115032c8c40502272eb5b41bff027764b255b3c51b4f9ae0fe7e71
-
Filesize
5.2MB
MD581f68a7d1fea174e47c8d3f6aaa1abf4
SHA105ef5454732227f72f4d066bfdff5763ccccf4c6
SHA25635dbbb40884849c9b569b32dc53f7262e6dc7900ed7fd03e04b0e5d44e65cf39
SHA512fcea9fafbc000037268db60d8da6c7b96a0721a93c747c864e827caf05a5b127393c77ba745267eac3cd1db8566d89b5c3c71b4b4d3b600e41d37768cc68f405
-
Filesize
5.2MB
MD526ff4caac891bf499b6c6a9986c6bac7
SHA1f55e033bbd84cbc0fa25dc7133f3cedb3412b63d
SHA25644399abc5f0bd11046d6b47ff0f0e761aa415b9ede8fcbb44f2db839ca250ef8
SHA512fe5b4b323d6915e17d2c931233b2eda127f2fa6d4a679e4ddd6044dfbff05edc45e87325240b39c7cf9c3dfa3aea22a46992e511a0adfb37403879f878255d0c
-
Filesize
5.2MB
MD5f085922c7ed2bb878812cf422ba947b6
SHA127224c08a086cbfbd6e34afa407a7e3e22f0343f
SHA25665e940ad5a16d3e08a3cd21f9ecd332f3e4eaef05dd8d2bd40eb4b9f1a6554bf
SHA512b8c8f77862057d3cf73cd745c60e4e87da33d24a732ad5151b70681fd6da97ed1c40e43424a8097dcc3ed921c6c36a4e2fd4d17040fcd5bab53321620660bf50
-
Filesize
5.2MB
MD514d72fcebb8fe8fbf06bc69073d93faa
SHA1c3abbeb6bb66602a8ec9975f7f4bd5dcb6961f2f
SHA256711a3180a34362334f35d858ecb1db3f507615ce69701065677c8ac64aad9fb6
SHA512a5ee045915ebd2c8e56da20a849bd69aad4de29d518c642b7e9411aac987c26a72b89348db3dd86789c8e41e3c8cd4cbbbd13fdb3c207d312f6a5c1553dc1383
-
Filesize
5.2MB
MD5337b88fd8f843d05fcff03666b475021
SHA1bb9b4dd010ec802492d1f54ca96a83c7e197b601
SHA2568a68607514cfd19ef23c657d0aeba2c3a6604caa8b4887a9929c84e11b6d1fb9
SHA512dc80da95f3a6531df9264866769fe80a01ed9d7222145134535b580774c40443514767c28c0827c33ac8e06b1fbcc378872541205b88850c01ecbb0c4ed54309
-
Filesize
5.2MB
MD518fc45f5f8fa8a97eacd76b8b321d451
SHA10d5d5bcf52687f0e5e1bc9ec1f270541da0477ac
SHA256dcb3ea177f62fa192c1429213311825f4520a73aa66ecb830b00f5fea22f8ead
SHA5128b090bd0774bbb7a393455d758c368d40150a8429a163afdafea8484731cd2498daaed9ebfdd8f2f22f78042f68fb7082886e6fd14304b2ca4eb2d619d53cd08
-
Filesize
5.2MB
MD55069c9b3df57a26a1624a23786ba81be
SHA180e557c69afe9b5b6171c87ad1ebe6b79760b1d2
SHA256685b66841ee121a221841c797346c4cfde67a66b74a457815115097ed6ec43e5
SHA5122e250a6e90f88c6e18977fdea182bb11a0c16ccb08835116a09c04283c7e235aad2866198d04a646e5c84704efca9750eb023fe5599046f0f097e57a203a371d
-
Filesize
5.2MB
MD59e4ab472d54c93248c87d0ae6b24c4a0
SHA1e0ce9e2623e813710ec5fdd87f670af7657d8bcc
SHA25626442bef6ed6f3c4e751ff19fbd61638120d02ed436de3f0668f457d37d289ea
SHA51265147c6e36457086a9cae7fe21be89f7ec07631e095e468926b48c4f27099132538f839642767754eb66dab984712b16a4a71625db0eb74bc6a318efcd5f3173
-
Filesize
5.2MB
MD5b2dd651f17e24fd531d6dc07a262a694
SHA1f26c7f8be7f06a63295c5ab4ff4fe3c3ce36ff2e
SHA2569816735be9bade99c758d1adeaf853a7ca2b6fadb5047e6dd2b1bdb8c635ce10
SHA512c8eadb6f3e52611052ee0df3fbf90cb3af60dab17e4ffea850b22b4c53e24d64e078f16dd26f50579e407715d10c81c00c9ebab2b4ff1f807d444ec4bd02be22
-
Filesize
5.2MB
MD53748b6423f2beb13eb5d17e3fd2a4bc0
SHA106771218ddfba177def4b481f75745e59cf82141
SHA256df0aeb72e86381e4861b42663630193bbab40e7e810f5fb02156259c97b675d5
SHA5121e7edbd2ef7448266dae34f7ada79fbe2794a5e6f6bb4ad474dc68157846e37e58cb92b7d77bd356e321d1b9b3e64f93fa3358abd5c706c68195715287a3b48e
-
Filesize
5.2MB
MD509fc57f114e11b70ec36315d464ca6b8
SHA12e2cb2ebdf34a29dbbf3d67e947aeb165ba1f0ba
SHA2566cfc2c1ffae03a7c8f02d6860af41365cf62011bb069fc71d017a425fcf42afb
SHA512b7a6833d1e65b17ba9e97b4b0ec844c4e025322c6d136de54f034a3058132e062b1eee5746d414c042178dbcee78ccd315e9f27af7613ffb3e6b8aa70d501478
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB