Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 02:44
General
-
Target
2024-11-20_27eb0f5bc3c0ec0c074dc8f0f92b35e4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
27eb0f5bc3c0ec0c074dc8f0f92b35e4
-
SHA1
b63c8a244ba6701fefdafaec97e1ee7bfbe9bcd9
-
SHA256
6c9682f9e441d85408c1d77da6d564f36c25c2b194029ebae78e51d830f2a3a0
-
SHA512
aa9f77adc960213d1fb4b979f1c986cc2e46a0db0022d5d5e133534a5476e185bd0f51733caf0d72777dbba426ab050928fe9b4fa79abac54aeb77190b8c1053
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibd56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_27eb0f5bc3c0ec0c074dc8f0f92b35e4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_27eb0f5bc3c0ec0c074dc8f0f92b35e4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DLhoqVZ.exeC:\Windows\System\DLhoqVZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbsAKuW.exeC:\Windows\System\pbsAKuW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDeqIEs.exeC:\Windows\System\LDeqIEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XFWHgHT.exeC:\Windows\System\XFWHgHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AQbvhLK.exeC:\Windows\System\AQbvhLK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAAQzny.exeC:\Windows\System\kAAQzny.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SrjbbhT.exeC:\Windows\System\SrjbbhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCnbtoj.exeC:\Windows\System\LCnbtoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELRwcys.exeC:\Windows\System\ELRwcys.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xKzFPdG.exeC:\Windows\System\xKzFPdG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YkLUyrB.exeC:\Windows\System\YkLUyrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnnPzeh.exeC:\Windows\System\VnnPzeh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xyGYqsW.exeC:\Windows\System\xyGYqsW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nHnPmcD.exeC:\Windows\System\nHnPmcD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdMLumW.exeC:\Windows\System\tdMLumW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVxlYcK.exeC:\Windows\System\OVxlYcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QTczeBD.exeC:\Windows\System\QTczeBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\osrbuZR.exeC:\Windows\System\osrbuZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aFFvYma.exeC:\Windows\System\aFFvYma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtFJXAI.exeC:\Windows\System\NtFJXAI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCQlzKd.exeC:\Windows\System\VCQlzKd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD515e8eaf273a030014fbfcb2b90c852f0
SHA1c443ed70f6ca8e12bd049cd1b9b01b15e7bf5cbf
SHA2568373dfe37e56979e01957b8c48ac66cbbcbee00676b1010d30b48260297cc3c6
SHA5126e3bbfc41b7e93de4258503dc67c3cf0b0758403453dea0123d12165181caab2029a0bc53c5180d01bbb48a2544b8e9f9242392b8df362e66cdf0904e211dcc9
-
Filesize
5.2MB
MD555a2a1bf7a53b27c72741c10bc4ecbff
SHA1a08dc7417601c367a3c70b36f45526df236e436b
SHA25601a8062b78399e73950e756df863187a39601c69c9575f3ee7de465356bb3502
SHA512fd6f873d044160aa4bf2960e6562f54eb5af1cb5d32dba6162e922b98e513442a0ec1a86d31263e2d34a35e418cf08fa02997eea038aa44929a09668f78882f4
-
Filesize
5.2MB
MD5e6635a89501266fb31684ac2c89f3266
SHA18d25cfd6b3c21fbad99fb3695bdea346a3ab720d
SHA256f0053c04a09614664a80e06cc7133ba5325b6f65863d57947c35543b232e42e6
SHA51299be6836b6db9cd3f21ce0024f6b6d49d7d06df3e766a01d514c5e9638baddcf5787a6be07d05ea5694812cf8071f1b63e7532ff69bd396d53b2b0e21a246b00
-
Filesize
5.2MB
MD53526138d5f31106eec09a906d93ed5c7
SHA15c739c0531a7d7778c006be29236ec93195d633e
SHA256a0a69af513f8b9c181d5ca7f9f3065c78dabdd12ac269faf4fa2d918a149bfa7
SHA512b15ef5aa51399d2ec4656a11f3c80ad0eea78477cd94bd46a82b63239900f6c26875f9c316e04d7e72d57ae2a5db5fdc9327fb710b897f99abf57f73ab0231d7
-
Filesize
5.2MB
MD5d270c340d0c6970866dc3ff3ee4a6daa
SHA191f1ae9e7abd70798874160acf69d4cb355324f8
SHA256c4ee774cd64a06a33fbb124a77643016d8fbe5acd6fbfbc7d1709247a4ab68c2
SHA5126572528b0702b29b972f44b1753f48e62b04686e9a8b0ae07a8a02fe854e5a0d2ffa20fbb806b25f5317c479d1cf6d03650adc7b07183f0e9cf06c42800cd636
-
Filesize
5.2MB
MD5a96b3dcd66f0274724d32b368ac38178
SHA19097bfc33979599a3f02dea4be58d04b8979f80b
SHA256ee0b31cde8ed1fc844187310ea4ed6a58a80d7995e7884d745642a4af792dbde
SHA5128cb3512d9ebe96cb86c8ffddac3ed52532c464ca5ca3e5115ce160eeb29647085de68a16737abe5cf7254a8edd03448f98deaf9c3535914d5654de0a15dd3027
-
Filesize
5.2MB
MD5c01c9fb4cc7ee5af0302b7b38470dbc5
SHA1ebaada33c6107de7e7a42498407378e0e6cff251
SHA2563c41e85a8d0c7e85050dc3c477cd9a3902585545280b5e737cb3bb21c30ba5fe
SHA512af50f12ee672a137e3a716b45ebc122ee58e1248a141ae7f607049352db79a053f6acbe966ed474db982e32e0b599ef9b93f780ff8f6a16d80c6b160b966baf6
-
Filesize
5.2MB
MD531761e969101afd347c99dcb9374cfdb
SHA1d8926aead15076bfd0b4177e54d023ba544fb2c4
SHA25683af92c1cfe9898f4b26762c4a0195e657beeb11c4bc8f60b9dc3ab3bd2022a5
SHA5129b8c3545e4647bd15e57a7f4ec9b114a723df4c072c63ca8bf09a844fcb4b127fdece72c5ceffc468c9aa529a40cc3643db74ddb895e9dfa41cbce306ebabf65
-
Filesize
5.2MB
MD5a02e28f4a51397934414868b94e9e5e2
SHA1d0a4a9697d4af1ada1d7052a57a3653c567a2654
SHA2568a44961d000b42b8550cc414d9f6c946d85c6f9094ed8ed0d4592da201bd3b25
SHA51243db6a1b25d3f7e51be22e0e2373c184c6de62b336d8c1399ea475bd3067ae147160db475669c1edcb2ca88654d7958ed6756e3bf1d9caf0a5c658a599f26207
-
Filesize
5.2MB
MD5994bfde43b537fb1c6403f4778d7eac1
SHA1ff131feb9fa816e5789e439d9aedd4e7f5838c53
SHA2561e52a61ddfc97d12280e273ef27bf8675aefeb2dde3439e69ac34a4ccc687536
SHA512d2ea9410b6f716576524ed49ee86940aa1c587ccf49d188fc931a30f57b0a974f514a86975956b4d92c008282c1ccfceea2cf035d05f7a325fa6662284f5799c
-
Filesize
5.2MB
MD55e14d74ffd5dc89ed4de55ef007fb2b3
SHA1554cca0d6040517939febfebdfa8ab21f9d9c24b
SHA2561bfe3cacaf7cf4d266bde26d91a6c5197d20a557329d29e1b7a429d20cf97e93
SHA5120d383ce47b5bca0ba69626736f856debfb77f32d71aea12ed87908937c3b0b6f77a1cf75affbbc6e5a70dd469582fe36b61c980280ded4f9de88f3df4bbf5041
-
Filesize
5.2MB
MD5f91023cc214282989977e6b3cfb5c193
SHA191a49ecbb32471350ca01bd1c2a9d00142177753
SHA25632d9f892abd6a0bb014264b4a0034bea878d1df8ab6ec3a6026085c0365ae9c9
SHA512981d46ceb8b0899f2b9c5d139cf716ea7f92d5411d303d1a543dc587b6b7b6cb8900c94d7b23d23cc99dba03d8181c4db2d17b49e22d75d53739069c59dd5c8a
-
Filesize
5.2MB
MD530408b2e4f303b75fb08f7a739bc2c8b
SHA1d49677bd10c9705c1876610609bea382544c30fa
SHA256e170ccdab9a70f63a7d1e08c86e3a038e0512e8b1f3f851b992f5892a5a9e912
SHA512fb84639267d4c38226ee7a92aa2383608470d4c68c34031178ee0b67b789485a206394c4413e74696922471624fdb66ee205911ba6db7088b7f11a656dde2912
-
Filesize
5.2MB
MD52e9f2a3424dfd519235b27714b33276d
SHA16dfb09cf38eb7faecdcf7c5efc0e73b6bae944be
SHA25640dbbd8ecb2f97440e5f3e6c5f795769684bda5e715fdf9517eef0fbae4e5cc1
SHA51230588d43193267e3475b7cb879ffdf8852f426123f129e94a26d1064be3502336d13cca368053da7edd255e31e06f6e7d90de04396498e1657acc1f9d841dfbb
-
Filesize
5.2MB
MD547ce8a6c09f070e3598bfa75666557e9
SHA17b44907cd67ba516341a2eb4865911c38fe9d395
SHA2564779bb4d8f5abb2a3151829e1deb00382512d70cb7ff4ebac9bf482c3a9049b1
SHA5123af3c33087dab89b4a842697a7568b8ec554aae64df48e9ed6b5d22fa77e9c011532dd70b6ae2a1684b129e651dc3d72b396fff2504b9a4efa5444dd16ccd69e
-
Filesize
5.2MB
MD5efd1a4e73371e7153ca0f56ea24a2e54
SHA15613a53742dff72acda7b39205e6d133cffed44e
SHA256a4bab7678a47e587b855176ea9a0ca7472ad7eeef1dd354084c835663ca06e3f
SHA5129c793df27dba8423fd820b12bc0b8817711e6e50fc6b09b84e418bf2e89a7af999c5766c3341b1c2751feadd3128d0cae1f0f526189f8720cbf9834e285ad1ab
-
Filesize
5.2MB
MD5f03341629515a315bb6dd11ad6c4210e
SHA140b5325c4ed78f65c04e402eccac663f930d2d87
SHA2567c00850a4b240d63c8ad0a375988b4740f7549b146a5398ca14b9fc8c6ee283e
SHA512846d05c50198e6b2126e755c74b8c4acbe4f2749bfbb2961d765d591ab8dd651c81a435354b83b0182f78cf1c237c36c54086a7a23ece353e4c028d2ee01f238
-
Filesize
5.2MB
MD58fef031b8e86557caefe8c5e3f16fd7f
SHA14727808f82fd542ab980cfea50320c8121695d75
SHA25661350733e7ec3230b6d75aa19a800b36e178bb68df8a9cdac671bc24b4db7a58
SHA512025769719214a0981a0549131004d92aa843c3689684eebf1cf5b810867344e378d9fa9ce1b847596fa9c745baf67ead8893c7dc3ebcecb3ba3462de1ff46b00
-
Filesize
5.2MB
MD587326fa7ac8b8a8ba1d090f086b386b7
SHA168f1b0aa041eb95b82e90d6edef02f699b7ae8df
SHA25693365b809e15851ef2388e67f46e8489b8ff47f8a9db2083616ad428c03fef4a
SHA512c3b05c0a525fc5df421bd358b8f5eb4275da1c164af77be6ef7317ee377e902d242cf1ea60877ed1484c17bfeb503826ef1a216396cb348f3931d02292010d0e
-
Filesize
5.2MB
MD56041d750827b04eb656fc07f13a99826
SHA1d1a3b3f3911f6f5ab0e275bb1f559dbbf49880de
SHA2562d9d9f71bafb06ca5df10eae138198ca7987a117bc9638e221e5fec5e6b19316
SHA512a1840f96fd5234a33fc562cd4d5c0825f47d23517ff097c6419e203744fc1945b16d6c2ef30e963baae3e9ba6c3fa8d2b78b0c674cb89dbb26660be2c1140ba4
-
Filesize
5.2MB
MD5166a9dcfe5feb278d157ec46f88b3560
SHA1a6f7bfba2eece95d18a9879cb63a9b099143f874
SHA256f79cac37f6c725a767506d54020089b61ebb7bfad8ffd71f5de986bb03e730d6
SHA512a101ec7e4d38e2e762b18ffa57c7364966ba0b5e6210c91e71f6a735850d0a73409089272456c894e13a9958f93dfe2c9cc18d95c5ee6e9ace218c4222e12c6c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB