Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 07:43
General
-
Target
2024-11-18_7a52c26e02c8afe47dbc7fabaee8bdc8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7a52c26e02c8afe47dbc7fabaee8bdc8
-
SHA1
77cb7c4524e8b9f9153c2eb999715e99fbb976e9
-
SHA256
4c4776dee5ffc86a5b19db43a7ccaac8254a599e1e4eb5796d481c69f2e379df
-
SHA512
075d95962153daf08318a9d197e98295a02705d180a6635055975fc5e483f9a6d5afca41e6d07e6fb6d5c5e3f221a6766cc5bc716f4182bfad1678b24dce4640
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_7a52c26e02c8afe47dbc7fabaee8bdc8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_7a52c26e02c8afe47dbc7fabaee8bdc8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CtlqHIU.exeC:\Windows\System\CtlqHIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jKlnLtG.exeC:\Windows\System\jKlnLtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rJMBEzO.exeC:\Windows\System\rJMBEzO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxNgQNj.exeC:\Windows\System\uxNgQNj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dskmOsE.exeC:\Windows\System\dskmOsE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUwbKGx.exeC:\Windows\System\pUwbKGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdgdBXv.exeC:\Windows\System\VdgdBXv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrwYCxu.exeC:\Windows\System\XrwYCxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rGsXdSp.exeC:\Windows\System\rGsXdSp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMKhJjp.exeC:\Windows\System\vMKhJjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXtVowe.exeC:\Windows\System\bXtVowe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVtKXyR.exeC:\Windows\System\bVtKXyR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\itdCDCj.exeC:\Windows\System\itdCDCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auSeiBo.exeC:\Windows\System\auSeiBo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPhKdYx.exeC:\Windows\System\hPhKdYx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgGJLIH.exeC:\Windows\System\kgGJLIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aabtBQn.exeC:\Windows\System\aabtBQn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpgUEAY.exeC:\Windows\System\zpgUEAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVqIOIb.exeC:\Windows\System\vVqIOIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OwGUabU.exeC:\Windows\System\OwGUabU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrBpJnb.exeC:\Windows\System\lrBpJnb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fe473729485d20146fab6584a210f115
SHA1e8675b133611d6323c66c501fc52f2c8903fd0e5
SHA25686fa0e3caa385aa8fee2c1cc2ce30c5b91e01f066accec9296640c415297a7eb
SHA5129bb9cee13ed80bcbb328208a9a340c7023ac3e3b22d43113d6c3dfe2662ccbdce75619e122886ef407addb3cfaeaab79ba08d296d7a65d3454cb3dfea97b6f24
-
Filesize
5.2MB
MD5d6d0a30eac8418a4de54c15dee096f47
SHA128760671298346c1fb3cd3cad800735d45f00aeb
SHA256a2b38e74c5d1722df16af9d9ab5f0707a6276fc02fa823ba8e723eba81f6f281
SHA51267c9213f1db36b287bcafde8b4d1966c359dafd5fea5821276f989b36a31c5817c76b6cc3956f62c0474e8247e863c52a266ed2308a185c427007602ea25f9d7
-
Filesize
5.2MB
MD5e42386689d85dbf0a09b8b352152616b
SHA1d544d5249d33773e0969e7e5ea8a969b802fc97a
SHA256ff4c618a05b2442ba32423930e22de825f273b9b03b4e40c0177dcc49cfb5195
SHA512afc040cc0e03972afee40df6e573c41cd7443cece5aaa93fc074860b0b1bc45693d8aad6296b4cdb8e1b6b989e03fc7a56857405f186316058cf4ed049d244ba
-
Filesize
5.2MB
MD55096957491ecd56c51a50d64158f838c
SHA1e6e538c0cf5f0c64109f4fc585b5e176b6b66871
SHA25602067a1d9c82f0c6d4eed7961ac74e9bb303c7f68582da9e77266eb610b5ea05
SHA512aebc1e6bbddd76139eea8b67d7fd0330010349e5f7dc1b73a499a52a75f4c613981c6f43b9a4344fcb3b898144b46abc61e8672aecbdfcd071f740e09d06d52a
-
Filesize
5.2MB
MD52e290ee25f228831716d5f2324596bda
SHA10315a493d50d2b2ec81d3095889c4c1aff7684bd
SHA2565160e31ab4ba39cb57bad71717202a9dc9bf3b3683f1022fcec566b7daf6fa75
SHA5121bc1a573c675342409037e383931aef23f4f601894f86ea8d62a87c10b8a63d635291e71969cf936a386b45634b51494a781538cf51607b85681a5d995cd19a0
-
Filesize
5.2MB
MD5cdf66c54d5da671d98882807068f36a0
SHA1c1dc96c3fbd22678a54c426364bc6c731c4b6682
SHA256c94694e4bbbb3a9d49fa08737a183a3fa69a0199ad57a3dfce5000330e982c38
SHA512d0b6ea4ac58790d24cf90818a737e3a5455bd511186a6833303a21dc838708a3850d2213a56d28de2a645fbb6fa2fc95e5a6e5c63014350fb9dbe3c03984667a
-
Filesize
5.2MB
MD500491ab12681cf11f6df10d74e82c510
SHA183bd4f2f26d662e7d5aa9e39e01c89ea98e3dca9
SHA256d5d4819ea015bba9d4a723f5fb0f1b0b7e41f16838aeac6b82a48ce0e3569cf4
SHA51291614c888e48236f6326a36ce5eab3dea229c8ec065ff7340b3e0548904b42ba5c4b7e0a05a631dbc0137c37d756217557975565e3951095e754f6be7f357a9d
-
Filesize
5.2MB
MD5280cb34a323506ad0b2b9f13414028a5
SHA18cb11ca7dbcdc172313a2598c9d78fc925be263e
SHA256556355d8d2ca0e3150c48d5ef3ccd9ac6d4db81d7b1150366850a98ea8337df8
SHA51222ef3683eee181296bb2bdb14836a0930d5ddb66a1df1b78b9d21bc15f3f9deea2374914a382df833909977b8edd820302e650317245dfbf1ec4cb90efa9e33e
-
Filesize
5.2MB
MD515916fa1047386474bc484af661cfde5
SHA1cb4e8da327a2558bafa1b169818d38c84b79ff75
SHA256ad6835a233c43ce1b1c8cab4d5ee0b657f3d92a5b782ca133e42d617cadf5ced
SHA5124ae0b96d35a046e849d0b33766517d8aab7452fc5418b7edc875d550d6ae47d5de31238b4bd0fee9492491d8316216eb763480e7f1fc616636b369a6413d00a6
-
Filesize
5.2MB
MD5bdf682db3b967a9523591f2d9a3c1d5c
SHA1c0ac1d8321e2d8649dd506d37bbd5ec757e426d6
SHA25698a4dcf509489d1d1d93e5cd3def92b80a69e12aec6fe0827fabe89da2cf2ad1
SHA512bd0d1b7d0b43e32fa4bbdab530825d68ac1daf90508d35664dba2c84b5bd2957ff9f47feaaeb38a4b084935f1a20c9a28d388e51f9f602e010799e46083ef7a0
-
Filesize
5.2MB
MD54e22a80ca20667d9568263989edd414c
SHA1ae39e08a3f8d41e7f489eaf6a9e9f3baef459e28
SHA256475c2e649c6a71890739445015254969208eb64c0becdb6f04141258e2d91cbb
SHA51205450289b9d24e0e5d7292f177078934211c907d6145ae5881ed9674532ecdd4662ad4ad47263a44968e45f5d2105ad51deb9d7ad614bd7de58a245b67148fe5
-
Filesize
5.2MB
MD5d62f55271fc012d272fa73a2132cf457
SHA1ee7221c63b4d030e0b6c73dbbb3db3e2a8c57ab2
SHA256c69c78f62e9ab50633c3c708cbf42428bc09a0f862239f6425e438042d77045a
SHA512e1b58cc5fc82fb2ede52cb76b201d062d01a479d088927ddb65c16a9da01a0b4aed44d7a53aad12e5ca7dc6bc2da4c3b7578301822be1535c488a8555d95e96a
-
Filesize
5.2MB
MD551f740153489befb24b59c9db62869bb
SHA1e5396c169ba9ff7b3e60ba2d7c94f0eb4e8e76f5
SHA2566c3feccd26869d175bb6f99c95505173b1648e6608d9642d4938b4aa8b990460
SHA512ad695fa9e8970bf82578cda68db126e0306aef9458451070c6524f4ea6065d876ea88ec30cd0703f1e304d21d40794df2c4ccfa6b025c2ebfc5e02cba6205a5f
-
Filesize
5.2MB
MD5169d5b16554d0354a6b595f9ada6eacf
SHA1e5c5887421d336f65364779398f91983fae2239d
SHA256cb73b40e1df98209b8739779815449a4b1677c42124207478062a0085d376b12
SHA512475e464a3f3a3f400bcd0df66fe7242bac59b6b44176b8aaffaeb29a54b4b6375590a24047c31a749da02026d0a01a93be43e5d4bf272769b19b381005bfed8f
-
Filesize
5.2MB
MD5da015ec8b30dd5b86251a1b18ed739db
SHA1d33fa5d63b360f470d2bbe38f222c13c80b6a45e
SHA2565b0ea58cb49be8d319bb767f37773233211f0048a32506f71c45acb0deea889c
SHA512b4ee9a14e07f6fcfb0b842fbb090dd8ece9f5fdf5ae0422fd91576053e3e3d57549ec5a05494b2d66536c1002330fdbe85a1ad0df18935ad3601c2e858f0dfe6
-
Filesize
5.2MB
MD5b539812a8c81df8e6e9fdba43df281a7
SHA1dc54ecd5a0ca5d618de0610fe37b95496ec7759c
SHA256456f3e68520580a249a87c7e1fa729f303a302cf2714d837f2465fce3c437e52
SHA512151813d59ce0d42f09d2ada7e57adb198180024f85fb175eae3e1442976c3a6058d3cc3504638619f51a02dc013d183c7727b179616c5144492b414cf6b0b074
-
Filesize
5.2MB
MD5fc01433dd317da033e7d8774bb8fbf8a
SHA105393fb2356e9fd2ddfa6680008e7d79142949a7
SHA2566720c586f48fdcfdd2800040c020d93083fb813df00119fd52a96ce62df7b78c
SHA512cec99507cc62019adc09df0db37ba19db838fac6ec130f41ae0bd4347d1034247fad28916900bda8e59c0c76957ec4f18ec16251be488965a8a57744f653893f
-
Filesize
5.2MB
MD5e1f13876bf97ded2762653a33b11afcc
SHA1433e31a236a9df3f07da9f09e4fbd9be24939448
SHA2569e16deca2f12a942a601eb492d14562f35208d0f0dace293b5dc52d88989c98a
SHA51207b528ff6f01f92793cac51aafcdfddd59864b10f849908dc094aee6991b7cb57fa114814f47f1aff299d5380856135121c989d5fd0f2feb6227f00c5d7842ab
-
Filesize
5.2MB
MD54a2092722e03715eb403df40262db789
SHA10d3420daaaf4f724c05f8171dfb15878bd87bd75
SHA2560f474e0010f4aa8fe61eaa37bc6d29361b5a92af3f4890886a710a27cc83f5d7
SHA5129975989b38404e341a378c6a2bae30fb0887b4cacb8fc4eb9a24db5d198646d47f68f2b582264dfaec535b04eb50d073e698939b7b73aebe6988220162d970fd
-
Filesize
5.2MB
MD559d971865a49d5a016c7dd85992226ad
SHA1d3d29fa31030c244b045c6e3f8133a5c3f109082
SHA25673e27ccdaabf9dfc7bfcf0d9137f90b5e2e5aaa9f2a4d18743252f5a7f230828
SHA512878158b178422a870dc66bdef79a4bb10476c4e5fc1dffce0415cb537fcba1fb07304e4289c4bb426aff4a3d2de891728c442618781e6fef3b8caee8dbf111c8
-
Filesize
5.2MB
MD52cc4d8b53d598baf66b3c6ec22fa73e8
SHA1e8eb206051d9e5b3404243d91792e309563f90a8
SHA2565c1296f3854e16f72422c8d2998c51416cbf3d246a2020e22c2e8ef07f7e55af
SHA512f13383c2bda756bccc1b92e97acc373c372ca69cc27a6acc4287ffa746524e164b1e1f8017c33776de840fbbe0fbaa02be9d3d55aa5baf8c722fca5b81088c9b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB