Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 02:37
General
-
Target
2024-11-20_f02b157d8159e9b8d479b0ffaa3287f5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f02b157d8159e9b8d479b0ffaa3287f5
-
SHA1
0589bb19044ac053c9b1756c0250f5e6df613062
-
SHA256
453f2516e7fa7c2186974fa5ee7f11c2a2ed01de259efd0cb44c913a053e14b6
-
SHA512
d694ce49116cbb12c6006e3ed21ab45a8c077298c64d822d9dbb30eaed897183653aa28f407a2cfaad5b0cd9ef24631a5207b101c428dd226635686ca2275b30
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibd56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_f02b157d8159e9b8d479b0ffaa3287f5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_f02b157d8159e9b8d479b0ffaa3287f5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mLIldte.exeC:\Windows\System\mLIldte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AeVXgNu.exeC:\Windows\System\AeVXgNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NWIyzHY.exeC:\Windows\System\NWIyzHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olqdCzS.exeC:\Windows\System\olqdCzS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpZCBQJ.exeC:\Windows\System\LpZCBQJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IziXSjP.exeC:\Windows\System\IziXSjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYFvzFz.exeC:\Windows\System\VYFvzFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgySqtH.exeC:\Windows\System\jgySqtH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAFkDDO.exeC:\Windows\System\cAFkDDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KlJvSlQ.exeC:\Windows\System\KlJvSlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SOqanxU.exeC:\Windows\System\SOqanxU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylfnuYC.exeC:\Windows\System\ylfnuYC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKsPxie.exeC:\Windows\System\mKsPxie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pVCmfym.exeC:\Windows\System\pVCmfym.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yvbvTYJ.exeC:\Windows\System\yvbvTYJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQeCzLg.exeC:\Windows\System\jQeCzLg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\krRDWTB.exeC:\Windows\System\krRDWTB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnDwpvD.exeC:\Windows\System\UnDwpvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YnIzBOK.exeC:\Windows\System\YnIzBOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nVAetfV.exeC:\Windows\System\nVAetfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRXmaJG.exeC:\Windows\System\iRXmaJG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54c6a50669169d869525abe43d82c2db9
SHA1917983ecec4d62a2ff071bfd5087437061c211e9
SHA256e57db2efcbf0bb795dcc08b8b856aa30f84b8e4b699848b08b10666a8d61c1cc
SHA51227ca10382ff8aaefe7eed589eaee8ff17297b56dd08693093d42e7716f8a8a3f117e157f92668d243646d4ef9692d66be3244805b7dcbe8c94545190629a9e38
-
Filesize
5.2MB
MD54fa70baa76964c5151ac4c490152847d
SHA1e55cfa513a978bbf52a7cb69fdbb1c7be50a5a30
SHA256a4fe05481133459a9b6e5025a1c74ce23667680471ecc74dce8b1361e65c825e
SHA512849475c05b44067549a13f33134c9bf1aa15b9e56ce63e773ab31b3671f546c38a17111eebe0980abab586a789a08419aceb36438538565a3f0e189d09f244cf
-
Filesize
5.2MB
MD5654ab68933bdeef97448bca560b06735
SHA18bb7853f1ae8adfca8d44cfefb94e48c6e06a701
SHA2564caf95e135df1ad5ab2a4d9d1432481de44daee1b4d7e5177fd2df5bb673dae8
SHA512c7aa4e5d067dd0da5c7196ba816b086ca3bf89eec0b5c432d6e74b5369642adacff62103616af76339fb0e8f5f0a5446c14c4c4edbe447148d2908cec7b53f2d
-
Filesize
5.2MB
MD5072952319536fe71e1dcb447c1696805
SHA15af0969052492c194605df5985a651d2b2eedeed
SHA2561ec8924cb5dea7439c3b518899d02334a3fa2bc40381c437ab37cc056dcc022e
SHA512e8a7e22c1e346432099799bf6ea2daf5c0419c425187b43c6580245d7e0f2d28e5b3eb7646977dfc5d2c285f78f6e4a31684e6099a82c289256a64d58a80d964
-
Filesize
5.2MB
MD5c55db126517e69f96b8aa7b5076efd27
SHA17e3b6dcf70f2731fd847a101c0fe31ca9dbb833b
SHA256c9970bc728f45bb83899cd8fa5b84b6da56ccb27e93c1f06702fa0e319a910d5
SHA512e3174819c9b4fbd48e16aa6cbe9b08cbed4c21195149ace4b9216431a7fb296dffe6f3ebcd09b225f19069a94e0fea08a6cada945f3b1e054c508124ce5cc427
-
Filesize
5.2MB
MD5888e9b666aa0837f0a65c28b3c86c7f9
SHA13e6d07b414e7f627d082dd1a48cc6669c8861cf6
SHA256b0f73275bd0bd53aa324067d42b0f54c545afe73e39d784e145239abcf1dd1d5
SHA512a96b8760ce04d2799c0633a18d02503e02bebaa42cc5919d1a15cc872fbf73c39ec2e4976a729f353fc7a46fb5dea478a25546aaae8e4b1533892126b9bfd7fa
-
Filesize
5.2MB
MD5a27c9acdb67b0a6df2a1bdcf91ca876d
SHA1f6239422ad1576781aed005247ea06a1986998e3
SHA2569836aa31e364d8d7e8be7ce305d4a2bb0fc3272521d7fae4991406c8c5aae1b8
SHA5120abdf45b6c3159ffafca58a5679aa1d2534c468f3d7d7d2ec0acb236f3bf19c58fd6fcfc11e9792fa8ccc73d0224a5a156e82f06af3492c434c0626ea18a73fd
-
Filesize
5.2MB
MD587b528968a0036c62a5f6172dbde93d9
SHA1b058197db72984042d9ea76b7120418346288b03
SHA2565630180e0b2b501e8f07d5d229c72050fafca93700f71c509d197aa38c94afa7
SHA512b76ee6adf6448e615309c6230ab0251f349f3dc00a3bffee515e59f3436426ecae149e7455a7ca237adbc1ac3c1e5697c2801ea4556ca2b8e424006b9f320f76
-
Filesize
5.2MB
MD59e3ed7773387fa81b4cb80bb6b076bc2
SHA1687a7231e14cd03c76687928e912a1d2b5baf75e
SHA256273497e78a991321037c1f3c1d2b69bbf02fdad8d4cb92527b59e4f556644df0
SHA5127c12e3cfc346adacae9dfaf2bab228aaa54da7d48416ec9581ab30dbea55cbc5aef2df4d86f6c8573f5b8cd776ca920284d97215c54736e3f50c3861278d5f7d
-
Filesize
5.2MB
MD5cd2f2bf4e3fb7b831e87f40f9d6cbaf4
SHA140b4db20c93ffe232282e635c97513d2c0fc7656
SHA256e3c4cb013c4dd1e53c3833bbbfd589e4a00bedf96e500c5360db36d6c255e2ac
SHA5126695156941892621c04dcb968c68e8a1abd5f559d0caa1fcec54a742ee72a5ea0d3a226c8a8df54272df2c5b03c374cc03fea2d53831d9c1f6995bf6d003f95c
-
Filesize
5.2MB
MD5cdb57e2f8bc511f534fb9245b7c503fd
SHA15bca0d7bfac94eff138fc7370429ad1a83c0ba10
SHA256f9fed7b371071820b56241c28771e916a2cdc8a01fc8963b14a7d3221a01e833
SHA512dd28b57141eb8b37ba94dc46e876ab3e884fed48147306b25009220d4c0988541169edc005bbc15f7955a310ead6c0a7b26ce467edf33df94758ed7cab4674a1
-
Filesize
5.2MB
MD56e2e60c77e817528c7dae6f7d53686c9
SHA1ab81a1f8bf77b79861832afafd1ef486112139d2
SHA2567d3d2d664257f37681eb4290e7a36a71bea86326a2aae0cbc964199ee22c8ed4
SHA5127c9a11102371de0b2ce48e3a93c034fa634f3fcdb3d7c06e98bc07c2c007afcddd673067231b2ab8178e8e3c3be94c8574ba84f8823e584022627dfbe129ebfc
-
Filesize
5.2MB
MD5ad9f6cc656c5a0d8bf4e239a45f2fbec
SHA1f8505cc7487c6b7d32f7b6c88d42c846f52b0965
SHA25615a31ab484d5d4cfabd7714dfd72e3def7a796c9479b8e120424c1993bda5e30
SHA51284762bb2611d4ebb73dbd3b2b40035b4a79d7ef9585c0f3ff57280c25a8a458d4d332b30ed788b9220e559d2883289f7fd84e8d9b8999a2c7fc988150907ea32
-
Filesize
5.2MB
MD578c2d80686580fc997e9424bb1d8cd77
SHA16c6a469fb773a5ce5b9a28f024e4e12337f34d5f
SHA256f981a06ea84b964df2dd28473bb0f89fb31ade318129c894e5ca35b61a11587d
SHA512b295a33743b04b62ea3604266cbebc87c47c5079252ff8b0381b4c0a237ed4e92124fff7d131cbba4615a852bfbb785ffdd33e0ff00840d9648f5be813c3122f
-
Filesize
5.2MB
MD5ea5989d51e9986845c4183933e1bc8d4
SHA1c9c14232799dae6093872855f470f4d001afa1cb
SHA2561cde720d6befe218f1949ce1ef9ba3cf930093bcf98bd6dd13024df67526aa12
SHA512e985d660f0302524345fea57228d8d62b386baca3c54db0e9a9734c63ffec38e652af918faaf427e04696047f21444cc6b8265f2b3e3032c632112b53a894d72
-
Filesize
5.2MB
MD511ea86d249535b80ba7715eb978e4774
SHA1d05f431ca51bf2973c49686842a0e738287d61c4
SHA2565b29e91fab583095fc68715f8c6572243800e37180af4b2f3a8f5cb3a99c5355
SHA512aa0ad198a9a20a0a154d9d60d954beef8b746baf68be63b352d16427183111585ee68aa5a9a06e08efbced236284d14c8aa8533f70fd3c01689302fafdfb887c
-
Filesize
5.2MB
MD57f5df7c8ed4d61b58fe57df64c22450b
SHA1b0e3ca7c31dd7a67dc02b9ae62810342059e84f2
SHA256289937a1dff9cefd1d5241fdd4065a6e841a22ba768950485e4c09a51f753032
SHA512b04273506cbbd9c7777de54470cb1ced56bcd1f22a4b4142a621b5a13bd77f0be24fc40b4e063f62216883d5d00fcee79ad702d7a8dbc78ea83eb4dca749553f
-
Filesize
5.2MB
MD5586c2131ea84c0393a87a014758b1800
SHA18661c5fdc1f235433b2dc8c51fb87676eab861ae
SHA2567898eda76ea46250eef04cdc0522b6e4c39379db4c7946fb7ef88dd3c8fefb70
SHA512770b4438a51c7415ef84908f2a5e7555c918cfb68d1e8d753d8de90f11f0a534768ae23eb678db76340db0a629361e1865979a279e036cadfabfa2b3a981c338
-
Filesize
5.2MB
MD526b748049c6f53c0e2eb27b6b74ac503
SHA1115bdbafd003fd1b355c9a90a6d72791f51fead9
SHA256a086c2f158198ee4b2f6e6407e8252b9cfa2a6ed6b31c896b5d8819f069f0c69
SHA512cc3290ecc152cd720d1a6774ed54a2d180363c8f75ac9f9710dbd754c2dbe6ac19e374040eb1b7531999ef62c2552c5d9bcafb7d8d818b1c3ee955d85a32f311
-
Filesize
5.2MB
MD51c919d4a84be3ac2a32f436811cb62a3
SHA16ec1aaac8c08fb3cba220fa9d85f8383cc316e0e
SHA25646c87f833bff5a236760c4ed80c195267ca426c36d8560aa7e12c2448d4c1ffd
SHA512c0a3f267c382a8afcef5bfe04f827d5ec9b83a2b08ff4d43ca1f9b5e14e6e15d8c4f328a9c1555ee50c0d34fdb6555b43bae8e6138364bb49b69f57aba1cff06
-
Filesize
5.2MB
MD5637dca1fcfd23dcdaec5091c1478bd7c
SHA1424952a893aca2428250d2886e37c159f5e38270
SHA2565bfaffab0c2929442928ae0a650b8e306af306ada139914e4f0f864f494b3090
SHA512b3ee916252eb9f84c0ff1041ac775e0863c6006252403fa8f1cd8b39663e42cc54fe4cbc856e1269c6d29f832da8e8d7d92da1d386ca3ebacce1ce0e98043695
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB