Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 02:42
General
-
Target
2024-11-20_0305d5e34684137e29bebc0409fae550_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0305d5e34684137e29bebc0409fae550
-
SHA1
eff60feb95ec1d923eb332090bbd6d3ddb6137cc
-
SHA256
6b43a9c364befb360b7d01c9383624412613c557f04da49a99ecc08a3c941276
-
SHA512
496cc1b0d038af767fd5946e5883422f4c702c4add51e2d23080a4f68cdd86d2ce47bda3bd7ed7b08bd23b7e971ca0251e63eff1e04534c48b0502a8d1c5d84a
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_0305d5e34684137e29bebc0409fae550_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_0305d5e34684137e29bebc0409fae550_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hmzOYDd.exeC:\Windows\System\hmzOYDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqOlPJu.exeC:\Windows\System\nqOlPJu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BKfoaDp.exeC:\Windows\System\BKfoaDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjWjPIL.exeC:\Windows\System\DjWjPIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNIwvpm.exeC:\Windows\System\sNIwvpm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXHAesK.exeC:\Windows\System\cXHAesK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOVLeyD.exeC:\Windows\System\rOVLeyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ivjrcqh.exeC:\Windows\System\Ivjrcqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxbgkml.exeC:\Windows\System\qxbgkml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\otdTEBk.exeC:\Windows\System\otdTEBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUdQHVD.exeC:\Windows\System\sUdQHVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fymPXZo.exeC:\Windows\System\fymPXZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWMbLrl.exeC:\Windows\System\tWMbLrl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gkLBlco.exeC:\Windows\System\gkLBlco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXOljBe.exeC:\Windows\System\dXOljBe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvTppzN.exeC:\Windows\System\VvTppzN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZYbift.exeC:\Windows\System\wZYbift.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpDnsjA.exeC:\Windows\System\vpDnsjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtGUNnO.exeC:\Windows\System\jtGUNnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JADmbpL.exeC:\Windows\System\JADmbpL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbSKIIv.exeC:\Windows\System\YbSKIIv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55f8b75d26586623be88bcf5a2e2fbfe4
SHA1580f3dd40cb97a23fa7b0227776a88db97cec8a4
SHA2563285100a24d2d913359be98fe26601e96a1e03d6c98d6ac00b8e9d92d76efd72
SHA5127ac7267c2cef333d633b694a46f5b2bfefb3995a0be03ed79d916f0ec5516f4a136b582adebc5769fec6e58c223e8da92cc667806a1158d19a545314f939ce49
-
Filesize
5.2MB
MD5306a3c7f110478a0b8a156c3987d0478
SHA1c4226237e3cf68a8ca857653e9d406523e13c8f6
SHA256d8ee18efe1a34d0a3492e0d31cec53f3e8936132c849ad07f4f95e09fb69d6e9
SHA5122c37bd62cddb216d6681a83589d6b3a7af27d765c244342b77648f4612298768453ee6b95aeba8e3b6a226d196cee583322242426482c7740348adf67cde886a
-
Filesize
5.2MB
MD5958f207c7efe7fc37f16456b1e289b20
SHA11691e367f70c1e6e12afcebf3f9327a0cc1ea770
SHA2569fd88394d09cbe7220e3ed5e95ba0706cc84f5738744f253102c4f411b368e68
SHA512b2e68c66f0263dd8a7ac2ea65c577940f7a5857356bede7243d7acc8ffb45c979b0b273c0b4ef0e7d6985c46879b9137a2a71a0ac479ea03f13c5f3697c61062
-
Filesize
5.2MB
MD5d0e05f6c70a573745b1383d6b8dbf9e0
SHA14c2d7452f146f04ca24ee067b1404ff1c2b32684
SHA25679b118dd56518d6ef719a043051342cea91dfb49783c3623014ffbf7d2cec8d0
SHA51244e978aa105a85e2cec88a51e8ed0e7034e3ca95c4f3f7b70ff7a114acd1010285bde00d04411e03965089b4863f8d56bd4b105a1a23652199fd8a778edc781f
-
Filesize
5.2MB
MD51dc7b3e90ef76b94465f02d15dda0c5f
SHA1d2dd0c77273fcc51bbd3fe8ae4d4823553aa9ed3
SHA256087bb89e4d89eb7229cc195ecf113dfff969bd487e81e042f2e55d45cb9f926c
SHA5125e9a7a9722e432cd689c6a8edfbacffc11b3c674646f247e0078e5a08abff456e463b42d04593378d1801574919688f5146c543b5a799cdc6dde90ac6b4f6b29
-
Filesize
5.2MB
MD53dd7618848603e37dc422b8f1e3d6579
SHA14029f8cf9ea69c7d68df0a5894bdd8f6396d31d7
SHA256c0b92059e03643f99924715f2734eb423bd50b1880be8bc245237ba985a5caa9
SHA5127d38a71e33c499c0210ac248ea705b05193a38659f1dcba2bfc58c49e5c1383f5f021de88c5ca0a9ebe618fc59c8131d5716e23d6cd1a83c473ff942e5125f7f
-
Filesize
5.2MB
MD510ee5f1b9ab397d4c142b439d6089a73
SHA12bb1501e7f8aae5b9b1f6afa874b861be28c4dc8
SHA256c6241ea77c3b41ffecb40f3b744776a8db66c810b13055c891b0ba4f98674b4e
SHA512e570534e14dcbcc9d9e46a727ac16e4f8a34c58753f7f7478bf657d6591a77b5f7bd502d00cfda1355ab31accda0b7ede14b35343508db3d3045449237848926
-
Filesize
5.2MB
MD5b2bcc8c15ec82f339098224cf125fb7f
SHA1fdae4acc5ff38e6c3b37fb1ea714f42a1f16da84
SHA2568cebbd519ae2238778f892a73577b0e1e457b017544ce8c9a1274a581abc519a
SHA5128b3a5ba4c22b42b18f5178128b87f28a5402db02ab0e39a826dbeda223f529f296a4da40613b0b00e9b13c466fb7799dae1c43f5761742dfe995e337eadf0ea9
-
Filesize
5.2MB
MD5a71976fab743de7c12577535dd9167b5
SHA1407207101c25f08f83ea6e5f02b55543522d116f
SHA2567fc31be5e4a8fdb65ed6cc75a8f678fcf9e1e03cd6d8be639b35060942079ddb
SHA51227157c257bc9feb6f714cc5353f4fbec8bf5cda625a7dcd9ae4d41688fcff0c9c31261f553d6f42519d417e98a6b1f96f8497b69025b194452d1d5fe1415e4b9
-
Filesize
5.2MB
MD552b43776a7dd8fae28869b21335eb86c
SHA13c78534445366ad85e386c78129dab228e2d7f19
SHA25634c5c0568f7966e3f9a3da595c39db36cb4cd4e13ad9a55ece55f1c46290b23e
SHA51211213ffad9670f1dcfef3ce2157ea698b25578fb97ed5deb4ecd43265cb27a0d071fd70a3ebf4a4dc8b16979a204976ccd7681442bee78e5afba5a97cca56c3d
-
Filesize
5.2MB
MD54cc01f2e31899f53acb706d53af2a716
SHA1f6a287131e3dce74c1dd26fc1f15bc8fb1cb27e8
SHA25656571d4cc1224afb52dc34b9d2fb2643e39efdbbfa04ce326645518d53fdb3e9
SHA512730b73e18ce1d9f4f20a07a1f2cf1423ea30d4fb753921917bcc4b226dd6777e7f433d8e981e99f6c5fb90ebef7684d6ac74fcac74b83e174c71926af9f827ad
-
Filesize
5.2MB
MD5e7cbbbebb46a3cf2c191891ec4fb6b43
SHA1ac58b635a6c50e80cddb6132ac637be8f381e3fa
SHA256f9db727719c960663a1e73b3732647927c6a31f99f4459b0b39b8f8ce42354b8
SHA512632cad4446d712a5dc52dc018ad9604e5f710f951aa7583840d994e716c7db64b90a021c00b16a138efd753a2dd8323d04e9ce19302bec44aa3ac271eba8888d
-
Filesize
5.2MB
MD55f4b0def33d585ee1b77840589ba98f1
SHA1aa68e99da58ad6f80f06b887a524e75a3a90e927
SHA256527dbc8122ffe901e5cad32c8de8cc0ade70534b7de050aa8baac7908f2fa277
SHA5123aeaefdde646ef9dae8fdfd180e219aa3bcd95cf0c535812af587742df31d4ad12e0251c2ace5ad6de48d7811b11a2463c42ed20da0c956e56bac948cf2fbba9
-
Filesize
5.2MB
MD5e3da89dacbcef93212727901c7c9282d
SHA1cf6b5f77eecf8d3d4a1e0306b985212c727df8eb
SHA256b85f49a15ff6eb1ad9762fb97a5ae5b24a8bcf48e4a0011a0bfa8b2492fe7ba2
SHA5124dbc9cc4e5067ba1d07629b797fefd6060eb7a393191eee6fc19cc93a20b6642be76b472f68509fd5f31a775543d64dc79ed3748839fab28260d52156bb37867
-
Filesize
5.2MB
MD59f39423fdf44dfa091801df502156b1d
SHA1a2ce3b4917817b8c85f68d435544359c017e41af
SHA256240805ba1e13d27c6ab5b11f39eb0e4787a83fc25a110399bd056222b9626419
SHA5120bd4250dc5ac7c6fa6a91a1f86fcf02f9ec86522e817a71504bb99b74d5e3db06ff6f7c0197197ef12fc792bc0147f80e96a6c6d32ec2dcb393cc7e90367316d
-
Filesize
5.2MB
MD55b18e35dc9f04b38275f2b4efc136c62
SHA1cf43098646b21847585f86d871f16b648c5f33a6
SHA256dd8d85e74bc39ad8f66ec136ef8b346609327ca7beb771bed6fc76413a2f40c1
SHA51291e90e264a2b2768c3a1ba001bd1fefb3ce0e25e93ce660a743a0540c814cee6e81b0dd6981e1d7c96a37588d0befdb880ebada5a8ba67842be0a615aa5f23d7
-
Filesize
5.2MB
MD5ddd434d3db411ab48a100c4d1af734eb
SHA1132dd22d61790ea1370eb8ca911b2e559824f7b3
SHA256b2cd3048991028c5e4eb0ad8af33f9b0313abfeecf698c870a61fee399a89a36
SHA512082e136848f14576c56993223879c3ecd9be8e3dc632aa4a962f337f38679620f8922647de2c6da6163644816c438028d10d8aedc64ae6db8d52af0c5ad2f871
-
Filesize
5.2MB
MD503c7dcf36465d7f00f5cf61e5c15ec22
SHA1a1dad3f9ca2a826e2dd3b8e371860c3dbf63a7b5
SHA256060bce4aa7aae8e0b2414bdf0b87b5ede8adb0960d32c42f96d82fa2e8f71170
SHA512c0236eb789650c1d0455047885018b5b0c95b341fca69a39217f1e87d128943971f8aedbf17499ce272e249da176c8e483f7d32c9e9700f37fa3ef65a70b8dfa
-
Filesize
5.2MB
MD5410a019cc777c36018a9dfc40d7bba51
SHA1fa40a83cf42c11ba1ff06fc66d707a5a74956fad
SHA25626cb83929b99c623ac47611b44379ccb10cfa3de76f3e03f812173986a889e06
SHA512f863b852fa6a14cc5356a5052262848e914d810cf4fbde97dd8b5924dd7d4b3264a3a570166e219a821a9abb1c187acc5989dfc160a27301a57e61ef1ab692c7
-
Filesize
5.2MB
MD52ce6e96020a2491067f934da9d8da6ed
SHA1fc97c4001db7b61236d6e3ff681789bd0b2719da
SHA2561ac0090c71afd6769880180e68864767cdf2ae32c2b4e9f07e153b2ec3374017
SHA512f4e6d3e5cc427139f489f019517e59c87c745d60ca00b285f06a2cf02a2102b4f5d2fe8ff06656f82d3e5e213a93a8e48a45d4a96196ade47de5546c4204f297
-
Filesize
5.2MB
MD58931d4846fd0024dafd08956979109f0
SHA139d607f9f1849a1e2f524ac0befff942c651b0c5
SHA256b75128cc00744577f69b4f6d605c353e2850ababbeec1de61b7aa4525a2c636f
SHA51204a8990750c235b9d9ae70d1c4fcd1106c2834e6a3bf471a675b202158f459133a9b67d50afc8ac0eb138fed2b81e7d9e37d13d90d889adc01870a4755164a27
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB