Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 13:31
General
-
Target
2024-11-19_88d79f7146d818176b1702acaf25cfff_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
88d79f7146d818176b1702acaf25cfff
-
SHA1
9c15d5ccdf013ae7d0bed21b2a8af7a401093abb
-
SHA256
3007bcbbfa8bd045255d21be82e1cc2d508f55c7cb59a8fce58723a7cdbf95a4
-
SHA512
1398fea9f2a2871b8816a8026182a3f7aab43e3d3d7bfbb128822993ee17d36779bda908cd9b8609a052df3f18f37ca69e50d0f39da968835f5c87165232dde0
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:T+856utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_88d79f7146d818176b1702acaf25cfff_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_88d79f7146d818176b1702acaf25cfff_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mzvrmQD.exeC:\Windows\System\mzvrmQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFUcoKg.exeC:\Windows\System\tFUcoKg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETfKZhr.exeC:\Windows\System\ETfKZhr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmPejiR.exeC:\Windows\System\zmPejiR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TSzKPnL.exeC:\Windows\System\TSzKPnL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MOMUIqc.exeC:\Windows\System\MOMUIqc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZttsFk.exeC:\Windows\System\MZttsFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RulEPda.exeC:\Windows\System\RulEPda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykqcwyn.exeC:\Windows\System\ykqcwyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auKqQdU.exeC:\Windows\System\auKqQdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOpijXw.exeC:\Windows\System\qOpijXw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVhAhnM.exeC:\Windows\System\BVhAhnM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nUTaKfK.exeC:\Windows\System\nUTaKfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xbwImuj.exeC:\Windows\System\xbwImuj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ppsfdlT.exeC:\Windows\System\ppsfdlT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzYlPJD.exeC:\Windows\System\fzYlPJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtrNdRY.exeC:\Windows\System\DtrNdRY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fLAXtdg.exeC:\Windows\System\fLAXtdg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgRrSKC.exeC:\Windows\System\UgRrSKC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lByumgi.exeC:\Windows\System\lByumgi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBqyVFp.exeC:\Windows\System\gBqyVFp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e66161c8d02996438745d2338f1a36b5
SHA14c3007086d16341d74b6f69edfdbebf2049595f3
SHA256581a6431f6765774dbedf05a29aa0598cdbb618805bf8d5888e8ddb27f4dfdba
SHA512ca5d110ff276e9f525d504f8e77b25808365d9cbf2ea34fd0481b529124e20c7b30ad5575b088e10375dcd491cf166133869bec7ebda764a3a6faaa4aa4a3f76
-
Filesize
5.9MB
MD5204fbb1d3dbcef4187c87509d5605e3b
SHA1b308788f7462dbff8c4ae14a41834633003e8add
SHA256060d9c03d141e7bd0bb9459f7ac1b641b67954998de65225e85f62b8b0339e10
SHA512ef8834063ab197f52e9534d045db0d9ef0b2ae48e37849d9231f8d19b6bc0c246c4e7622d9e4f80f72878a0d79e99a03b5a52ea170dbffaffacaf2c654e4ba78
-
Filesize
5.9MB
MD582e8e51bd9598723b75aad8a15b449d2
SHA1046cafac1f0cc4bdfad0be52a1276993d39a64ec
SHA256ef25ce8b5a896a74dfe97ed4c87746333206486c3fbe16acfc35edaa221778ff
SHA512dee2581e1322c2cd17bd5a1097a78d08790800cf383c03a4151dc70847fd67ad80ae3ee634dbcdeec39791af94734780ab9b2541af523be4fa934f573a87c7d4
-
Filesize
5.9MB
MD53f883862b175458463e59cd24150c138
SHA15b52166f903e25fe2fcab612fbe4a9eecac145aa
SHA256b6fd559913c65cf4d37a65a79ec6a2977e3a2f3365a6e35d9a53234380aaacab
SHA5121b64a203b580c5794389f93d0cc451b44654d95a7ac4e0e07115aaf0b2e76474da1b7134049694183fea07fc598d1a5b992f6c5a96d00f5f227809293fe865b2
-
Filesize
5.9MB
MD5c98a563ece2c08a5999e99586a8486ba
SHA18eacbc246615b6aa7e8b03667878563a94f6ebc1
SHA2561fbdfc46eaa496c63f560de3752d89cdbb7f0fc65c29560fb351cd8ebf9425df
SHA51245ad1028443767064d9e6ce068778bb5d47e577d5576905deadbd861d921f852ed2bbf979bbeaa8014348a1f97cfbb1a212d440ada09522cfcb3f5d407435002
-
Filesize
5.9MB
MD50c8313244103ed5322a61f8fbe673226
SHA19866742418984d6c9f064885c3689c28f8eb0686
SHA2562f864c97da9edd01518044630a1cd0b6b73e6490445c8aa2b865cb270459d9de
SHA51295911863ff667f1a490ac73210abed46eb1dc7f48b1493b13c7d313ea5a9dbbf782d844c83b036328378824c6be4c15dbfac08aff9f404d4c0b65a8bf89c14f3
-
Filesize
5.9MB
MD5531608a45c3db3d3337282ad26e1010c
SHA1a84a0be25a589f65b63c70cc5a36294462f441b9
SHA2564d3394a8df21c3bd053c3a75ca77885cc81fef096b7a6cb2f8c642ba8c612a14
SHA512ea7489a001f1948cda6cb5f1962202444c32d6f2dabd7d516b8f58c28d54d3a03933605f6a2668691cb7991c3a3471df2097f365abff1f22f6365362e262550a
-
Filesize
5.9MB
MD5a47eca540f2d7cf995fd9bab85e29d2f
SHA199f5523367638fc630e96fb60fcd35161497c2a9
SHA2568bd553f4d9d9ad7c633e29e0c3a4f5fb73b726a40a6f256243e28610f3865658
SHA512dc59a9a6c01a1adde28ad0a3dc4eb301d0360f81ddbd9b8fd06acea38e8722a0d49bfe979ba7fd71b900ce74444d233fcc61090b673db109fa83fc6cdf014f6d
-
Filesize
5.9MB
MD5f5fc288edc18899f1872fdc1f8b59cab
SHA13b46d2b19a41cd6090cea9350e00ee8f2f4f6b5f
SHA256baea460279578cf47fa220cb8732b65fc8233cb8b8282c1f741c9b6edd6097e4
SHA51272f712d133c3b1c1973cbd3bff3d59d2bc0e9e7261ee8285b197e78ab987da712c8f7fafe29afe8f2a31087d30595a06bd619160f90cb9ec3673a2f6d6ccb741
-
Filesize
5.9MB
MD539d0333bd437f5a82a4ba42967106a8e
SHA1392c2edcf510e2e6804b8d8ec87ae2f06d1ad8f6
SHA2561461dff006082d1102c54a8eb45da8f022efdebc2a973ce04640733a3fe32993
SHA5120882d68245dfd02de5568db0bda996b7f1a7fa3d22daee966adad24d9310f350cbc69fc7833f467cd4e2f10e1d7280f4531a08b452497516ad9a3468e7190e78
-
Filesize
5.9MB
MD5ba666aaf0f07fc714effe43a02e5c218
SHA13dda6f2cf7766631641b2fe7069956213ed6e1bd
SHA2567a021d06e693232267f5204f466575735b8bc0abc883a3d5bd779c9d9ef6a8e8
SHA51225b6193d524a01f5483defc3cbb04fd1165582b0d9c821f5e3fb863625ac5f6f03d355266b3f50efcdf664f872de417f0c278be5c4c452ad598bede10578ee8d
-
Filesize
5.9MB
MD57f1a89ce60169dd669fbdb1d71f15a95
SHA1121205142355245f979ce31d3601939fbd7467e7
SHA256b9e3acee43eb50501d54dac74b128a3052e9a1508d6b6c260455bc6e2949a1f7
SHA5125987ffabb96f288fb2222e7a321f28c8ca61a85f2465c4e18ceaf665b8f95a4fc75b7305aa60a01b149078425dd99a05afbc28118f1fddb0066f6f152d1040cf
-
Filesize
5.9MB
MD5704efd98d90fdf2b411c32590d39ee1e
SHA167c00cb7af2929cb3cc6562a5be0027ab85fc839
SHA2562dd39195c3ce322eec5e1e46cb5857b12e414812fc291f4d897cca79a6ade924
SHA512794afea3273862aefc08c24ef44853d66f1307762cca9fbdc3fa190a03bd4dbfa042df3ddccbbbc917316b4ad19211f281aae2db16f586e6bf2f09c07490848c
-
Filesize
5.9MB
MD5ad90acf9f89a9601dbf8eed09dbf5165
SHA184b3db1d46f8671f2025d4818934d8b53e073458
SHA256dbcb0298bca3304e8fa8dceebd8c2c88af1fc38360f827ac38b07e3a0f8814fe
SHA512d903d2e921df32b80cd494f7658ac1bcf07235afee30d99682b14c87cce889db595fa9df748069cebdf46ec8f0edae69f13e6e776717ea8b10d6267724eebaaa
-
Filesize
5.9MB
MD5cf59c45a50fda8620332658cb8eff8ee
SHA10d51bee1e5f8a9cd506a595050d59adfb69e6158
SHA256a1fb962b73088b4bfd082ab2f347f4e98eae5a1dafa75e63622475709af64acf
SHA5125b0ecfd4f4d684c00f96978763c154f08be9fa1c26a6936ef7f9bd3a42dfadc2832cd67a48a1cf090e9f2967a6ae420115ab052072b12e2dd5505577611f9f72
-
Filesize
5.9MB
MD55321f8e074bc7cbb80abacb4841c62e7
SHA13c5c958e6e4f8433e5034e3b3d991e95e09c0115
SHA2560ba7d848330ced98f113e03ea95a71559cff42823d89c754f383578d748c9fd0
SHA5127905e3406cdc35caa57b7a215b2ed8d15ee61cd44509515a387728b78d41ee118a2de84b721b32d67121d24e1e49659935a1690e148e5fc55ed2223dc581e963
-
Filesize
5.9MB
MD57bddac3af6257014874c5e42497e7b01
SHA142cb03d94ce2c559765ce8a6559738b8fb2aa4b8
SHA256254c43d496dd076358cb896824c756b837f8d238746f31c5f56fa2274fa6504b
SHA512d23da51c48091cfe09e13490d2367369ae4a934c540484111331f5930cce38bc7ac55a24510258d3793bf6b65123d6ff47665e847be72a3a1039bd43379e8a62
-
Filesize
5.9MB
MD50f25b4ba5526efd934fe4b14ee0c7936
SHA14b77ace518d639e58d720fa8eac88a4ab3ca5b8e
SHA256b9f0e80fe8e65bdabeb669dba60edaf52ba5a054a6818084b2d4f708173da361
SHA512047a925da9f53769e09a93a774f507dd01b8cc7cf8159fb44b5c7e99ed530292ee2939983494d73f16f70448e6d67a73e745b09bf7907481acec2ee69cefd4a5
-
Filesize
5.9MB
MD560a0133fa2dfe3c7d12c7e6719e7842a
SHA105cb2bcce0a8420d30d5be9abbad9a18c40f044b
SHA25658bb4da841f756b6cbfeb10b5e96dbc003185557f77be3a7f1d93fc767302743
SHA5120e319093bb07b5a184af243329c8389b30a9a98118e0768bb6e84ad1f458449d0cee9487c8d91b7e3f1b17c3e89844066af6f2a19e1d7a1e3bf0d4b2a1956ccc
-
Filesize
5.9MB
MD5d6355b8bebdcc08e7d2054c701ebd0d7
SHA10410ca127785eae4ae951fa59e907f790eec09cf
SHA256f984efb2d12ddb26c6527130c5a00c265a98dc0c469652bfef1630dcc295f4d2
SHA512e17ddd668628d91225dc9937255a41bb912501a437d769d835b95592e28abb30c015d805ac7a751eaae06c771cc27446422d2b8857aaeff97fa28b0b2cf1bc65
-
Filesize
5.9MB
MD5d48485b64c31ed1a4a0018338f6d07d5
SHA102efd72a8e9d76584010bfee47f72febda873217
SHA2568f134b3e552fe70e0cf80989cd8cc5e59120be938f5d5bbf5ca7ff997c6a971f
SHA51264494d7ca1e3d0478c8500b68d391ea0ba0877ffa8945b7f266c21fa059bda13436b084b66f6ecaedf4f8ebdfb5fe3f1471ea4e6a215f10bd34c5d7c5ee3a6fc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB