Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 01:34
General
-
Target
2024-11-19_3db0c15dafd6a009dd6f63278c55c12b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3db0c15dafd6a009dd6f63278c55c12b
-
SHA1
630b74e582002c44e841b70583c041da103cf72b
-
SHA256
e71d3730c8c2386dd5e780ac7de4c717327d945a168d8e950964342ebe2b9ef2
-
SHA512
ba081e27e3e9edf8fbcf3aceee9094ea0721d7f438700ad46190742fcf16c5de634417c56df96dc347696edd3a9256b3a3c4151bf351c260156dd4eac369dbd4
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_3db0c15dafd6a009dd6f63278c55c12b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_3db0c15dafd6a009dd6f63278c55c12b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LqisQiF.exeC:\Windows\System\LqisQiF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUqMvgv.exeC:\Windows\System\UUqMvgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ckmzanP.exeC:\Windows\System\ckmzanP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYOcErK.exeC:\Windows\System\VYOcErK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMFZIkQ.exeC:\Windows\System\aMFZIkQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAfJXyA.exeC:\Windows\System\MAfJXyA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifCiydE.exeC:\Windows\System\ifCiydE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGdZGSl.exeC:\Windows\System\TGdZGSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApLqogx.exeC:\Windows\System\ApLqogx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sWCsWzK.exeC:\Windows\System\sWCsWzK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PVDAJpu.exeC:\Windows\System\PVDAJpu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UOorETs.exeC:\Windows\System\UOorETs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gxThQId.exeC:\Windows\System\gxThQId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esmbxMb.exeC:\Windows\System\esmbxMb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FqdbPnY.exeC:\Windows\System\FqdbPnY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEtHVHW.exeC:\Windows\System\TEtHVHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\THhrnkW.exeC:\Windows\System\THhrnkW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQBffHK.exeC:\Windows\System\RQBffHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SOAPTUb.exeC:\Windows\System\SOAPTUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WrDhTfZ.exeC:\Windows\System\WrDhTfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQYSTjO.exeC:\Windows\System\LQYSTjO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53a23f186107e5c202f1d1175197de2e8
SHA16f2b1a50c7f82d2cbb59a0731712b1cdd26500b0
SHA256beaa99ac88bc546164e529b04a48c26fc160243d1a930731860e362d0dceeae9
SHA512e2a3537786182164cd8187195d7b277bb9e6ad3b1e4b0cd69705a1e03ba753f0aec380815dee8e27ece8289c2f332b34c25e491f0e18aad1c631a1453916a627
-
Filesize
5.9MB
MD55f4bc7187a1e0869367e14e1e0de806b
SHA1f3ef7a706273c2c3a2366799cf41800d7ed249a5
SHA256d792a02b27aca145a39252c8bdf75ba5e7bbbecd5a183b51b04c1e5a5c9fac85
SHA5126159ac738857d69eb089638fc4822850590f2bf7211c3e8d08ae260a00ba6b05e3058fde2058bddc22766e84422f03816f37bc5f37a1bcb5d6cb8c2ad6c90a0b
-
Filesize
5.9MB
MD5e3d2d2e7f33c4d89b39ee0497287f36f
SHA1d72c4b11ba78088a490bf74a7a1d74f9f782cdde
SHA256f5232875cb0ebf5a40beb5aa2e1cbb1b32d9f1b9919ef84a5c3806a92b0b5b79
SHA512d0beb09eb645d8f012b24965a3412e14f8fe2efc1f0e7602a581aed1037074307cfbe0dd84fec1ceaa2db934785b25624106f579662dbe4201e1b22c97fe5cd6
-
Filesize
5.9MB
MD5ab26219e895d3765e712ca10a62991c8
SHA17ac06b979913e5ee5bb686c9aeff678b3cc77e5d
SHA25605851eda7e2262871321491aca0318b04e8084dff43a34251d27fe9dd013cd0a
SHA5125f18d0f4cfdf1c5dae61ce5239a6f91be37f48538a8ba2d5fd329745fb2fa0b9db97cd26bfaab918c4711d44032ffdbd448247d81400bbe358bf374fa98e1a4e
-
Filesize
5.9MB
MD5339273ab999d147f98acb996484e615d
SHA1b6493b6c3a1c6d601bf44ae50bc5bcf8489d0ee9
SHA256b971063a541e81ff7a56fdff30c898657ebe722b1fa46be721c3e3ffd6dd3d18
SHA5125cb60514d994668f40be3aa46752f177e658618088268e08703b2c84d9dd349bcbf276438006d7339a3eb322573db360a7f0fc0affc85054b3e17c3930c64857
-
Filesize
5.9MB
MD517456a73e1b2bf918fbb2258a86f22f4
SHA1cbf2b594ff958510beded731d31a316cb6bc94a9
SHA2567a07da503b355225deceda293ed59f79a7aa9aab7cb8795e66946f7839f0ab60
SHA5123c19bf9c446337b7bf9e8771d76829631302c8b9452d5695dd1a16a554626f51536c2e3d4d063ac4ce815a3be319ed174aaed23c927362850b9172050e4a1b28
-
Filesize
5.9MB
MD52ab256d7a3e46a75a45fe8d636db97d7
SHA10e8fb858a43f24ce95b6094624ab5276dca598d3
SHA2562730effe8f342bb5577779cae1b3bcb6a442510cd8c3e17d3e0a0d277b7a9654
SHA51270214b3b904d98f20a5060d8895e77dda2c756e830dc9c40bcdb3de7455440e0858c0fec1238db5850b89510a8df53b404ed8611c9762749f1b2aeb54737fca5
-
Filesize
5.9MB
MD5c440a654dd2ed5dac60b2bd761339159
SHA1d746cfa904e3660633453c3e029a10ba1564cd09
SHA2563b6c1db8d3d39d3c5d8adf183a16db584f625f66c1e03b5d7a23979b6d0ea0f9
SHA512f9e5fee3a9c092370570707430aaf4fecdffc79ac3c4e38c47e513e802f72f1f07eb514bd0cb62e1519e122762ca562f37df1699d21341a4a90c01854bb0da75
-
Filesize
5.9MB
MD52745454a1e54f71ad0672586c61f55bf
SHA1a04a215809afe72db0e35e12f5a0424eeba9ddac
SHA256bcf78c75d35cdc27ed5c10172cd5051ca3f8bef3e234c55a53b7e0c05e387d54
SHA5122f4d4c7105b9753ed099b0ce9df5354c987acccf2a2660137ef8f4b35aaa24e4fc57cbfbec1e7173bfa3ff861c4698f80274ea22bbbf066f16234d2b49936631
-
Filesize
5.9MB
MD508822ade5675a4b51592f7c4307b6e54
SHA167035464a008f548d3460bd452a8e0cd7a892769
SHA2569dc4a94df0e79dddf7f79efc506ba512def8027b2be9f14958c672f0d136eff1
SHA512d7f5c4d98c8e7794990ed88c5e25154c5e5ee0bdf4fee59e2542566ade911616fad604702dc266547b377384d2cf0eeb4e2bb26546e55167f4307e29e5b142a9
-
Filesize
5.9MB
MD51bf727002ce580629bb95e1a9610e770
SHA15413645b4ac178fcbf4854cbb72c60b97d6fd310
SHA256f0244114db0d9243f38a5f4fa5d72ba91b4d44d5929cddf53df5cf9a9763ef4d
SHA512575dacbc83388dd53da533d0d3dfe28210dd75add06d48fc65d17bfb5db014034e22c49a3fc56a30efbcda946f635573e7966c54ee6cbc314471d171e2fbff90
-
Filesize
5.9MB
MD51bc8123e462d5482ef203aa57b293c7c
SHA1b7c8209192753c3010d1f2b0a15ae906e30fa1ac
SHA256b3966151a490123816915981b68dc16ef534d62e48b871c6c5bb7acbde5b5063
SHA5120a9a76fd428355eff0afbc7ce8054f619a41233184dadfb0d3bdac5ee4c3c02524d47e2a8ca5bde19b28326f542f3f16289405dac754cb8b164fae89446ed51e
-
Filesize
5.9MB
MD51ed07097e4d9f0ff47ce61f5becc11bc
SHA15f3387552d4960340e465b71949122a9ee80b09d
SHA25636d44a8263c9fb081603217c2ce02cd08bdfc4dc033ef184f6f569463beedc4c
SHA512dcb8c5e7f170de1c9df79214d5d648a7a1887a7dedf126ee1d8ed62002bedf5062ae00a08c2d05872d4334d6ea001f57ac1369823ff11a29df679fe3980aa877
-
Filesize
5.9MB
MD5f8d5edcaa79d0d0fbfba3e2a0b5a69e7
SHA1b68359a7f2d74d53b942236c3839717a1354c9b7
SHA2561fa8e138a257e371772007eca9884dbb7ddc4cfd38a994573b606ee08f2b3c08
SHA5126279f9d7d571480cd8288aaeb48de952f3beef809ab9d243065fdf94f69b4056cccb0c6ebaf9e98cd4899aa04614228a8dc8d76b6fc4cbad9f668985cb2a5d9f
-
Filesize
5.9MB
MD54585f5cd0e624fa9702984c0c0177327
SHA1b1ce95ed23f5110671bee7482e0f6cbb56b5d403
SHA256bbbf91e953934e97a2be4bd9a30827836f58015adcdf9bf1ef53745f3b8530f5
SHA512af0438fb9cb5067f6b5535eff6b1e6652e6985ef6e255093c22d77152476ba270d587fa8c5da0fde89bbe7bffd51a8dd05e7a51a2616d177b7ceeb9340011377
-
Filesize
5.9MB
MD5fe44659d8ecdfce2b34806ac7544bf00
SHA114a01b1d97860f00eca81321935b504fc1a1a483
SHA256c39c477b37d6cdc87001de9a08c513a868b7e0ef2cdc24e263fd356220c26409
SHA512a48507709598010aa3f86b687137cc65b59df0e14fb4ee7c6255c864c09850800aab1990b68900a6a1975529db0751b74b84f0621e41a4a9433e7d7677eaeeb1
-
Filesize
5.9MB
MD59d4de3999f62504ec142945559dac264
SHA19b3a0b7ab90f4326b799e965836ae9c0a6071db8
SHA256452c92b6b771201c793c58d2a11a2939d3f1d27da7d09d00b33c60679b28c020
SHA5127492f020d9176989e874ef5ec04ab924ef9a876063a53b178117f7e915415d8391c0502521d61ecc2d049bce31191298b405365984112359cbd9226977638b4f
-
Filesize
5.9MB
MD516645764dd6cf8c7f62d7b60be76c697
SHA1df24b6d30ed38a5ce1ca4d3fab5f2a8209d994d0
SHA25681969318cbcc9203d7d975cb078b5e56ad89737d53716e7355d4f028319df56f
SHA51245186fc3a08b4564007205fe7031ef9f3b0d0c95e6d5e07ba1192d96cec23ef829680fcb23707e4d0e8cc498afd0661ebe572c07814c57cb581b5620face34f4
-
Filesize
5.9MB
MD5a5b1c14a95b9a43d2051f56e292153b7
SHA12721fb5dc1c74e188125f7a09728b323a74e5002
SHA256cc8ffeabbe38ba46487d0974a4585916cd122e47bca47cadf146921f44f6be0e
SHA5123ecb8a3b6a7503d3a9655cd3410998c8b4d129a1d4d382ad6db16b8062fea892c1e8b71610e8bf4fd9265a19ec3bc647d9738334743fd32e96f0473119163d50
-
Filesize
5.9MB
MD5504d1ba813441e667c684f5e75133618
SHA1ffc8b6b4263cb98c836af769b774563fe07f28be
SHA2561f460ebde543dea3c319352fa02e03a1305011a76119963e4852ba0a57a09ed7
SHA512a37d01bcc373781a3431b958264d5d54a75299c04458c48792c74b4e00a0083bfb7185dad767594b974c4b6fcb99b98daf3cb7268c1acdb1b50c67ebf44839c3
-
Filesize
5.9MB
MD5b533893bac89e60d21509b2600292ccf
SHA1d5541f38e0d00787b667c6b2371f256165e9a79f
SHA256ded22c876cd9da95597f597313e1b37a09716dca0ad205117198bf8384d73a5a
SHA512dc1fa562c227e82eebb1cc8906bf4ce4544187876f7093d49647e855b661d025cac0eb5cd6fbee34184d277d6a86c76b14e8310ffd2e8723171b87b9cead8e04
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB