Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 02:49
General
-
Target
2024-11-20_730bf266126f0d6d419d4663b60a3741_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
730bf266126f0d6d419d4663b60a3741
-
SHA1
6aa4cab50da2af4f90ce9eef07809ee2870e8ae3
-
SHA256
17a7537f6b044c0bfa4c4ceb8b22aceeaf12d07f62fb5f10adec232cfe350ee6
-
SHA512
ed04b0a698d134e22376429c5de8f19e6aec09b2b5286269e56c3ddd7207b7ab9f582b64cfaa59900a7d48942aa28b02712aaec407a36d006a4343e01544ee9f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibd56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_730bf266126f0d6d419d4663b60a3741_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_730bf266126f0d6d419d4663b60a3741_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kpRTiok.exeC:\Windows\System\kpRTiok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msJTCKZ.exeC:\Windows\System\msJTCKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hIJUBZS.exeC:\Windows\System\hIJUBZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKyOGKl.exeC:\Windows\System\YKyOGKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHrnYJt.exeC:\Windows\System\zHrnYJt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPdcCXC.exeC:\Windows\System\lPdcCXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqcjZjz.exeC:\Windows\System\OqcjZjz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZapqJk.exeC:\Windows\System\MZapqJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNCUIhI.exeC:\Windows\System\JNCUIhI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQZSrOV.exeC:\Windows\System\dQZSrOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oIateeq.exeC:\Windows\System\oIateeq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdbWJRH.exeC:\Windows\System\cdbWJRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPTmeOu.exeC:\Windows\System\EPTmeOu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BPSoLgI.exeC:\Windows\System\BPSoLgI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOfuihd.exeC:\Windows\System\hOfuihd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MaMOMSA.exeC:\Windows\System\MaMOMSA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzTmYgW.exeC:\Windows\System\OzTmYgW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGwaSYI.exeC:\Windows\System\oGwaSYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qaffGdv.exeC:\Windows\System\qaffGdv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YUAtTWk.exeC:\Windows\System\YUAtTWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdaXfex.exeC:\Windows\System\HdaXfex.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d562a9a900d254ce79ad4dea0d9bc45a
SHA15c59543f4cee925662c8475acdf72a456fef3551
SHA256c9f457b690b428dff8af355ebd6159b0c80a9a8a6d0b3e9a99c0b0c6224fdf9f
SHA5128a1f871bf87fbac850a74eb04a1f9a0122f92da0b52432076bf5afb253422e2dd47997df64ea130ec05fd265f5f528e772706836dc4209ef031910c0acb2edeb
-
Filesize
5.2MB
MD54c6d78dfe5afdd0f05ea7af1a562e5cf
SHA142a141500aead50caa2533f0247836ede1866312
SHA256464b391b9a8ec78077624bafbbd4bbbed205802159ed986a35bab4b8ab5f7114
SHA512ddf9536782ae3a09c63da2d67e999206ab92c930659d3dd07bd750fcd150655176ab670acbc328edd6fadd35d3f5d20d7e56e009b2762e8ca97e3e6069811a8f
-
Filesize
5.2MB
MD58a1670a17d7bb383383d010cd87cb7ef
SHA1c98c4ed0554871f4c1bc2ef5a79a8f15d23edaaa
SHA2562655cb76da9975dc7c3e59a7df66210c475d619465b842cc1ac5eab7d0ce7875
SHA5123cfd056ecba32ce17c1b8b4442f4f9088bc6da676c1425f25ff6034bbc21e06f232fe23ad4329b854f144c10d06a66a98017d3826fcb1b1552b2ba0e9381c89e
-
Filesize
5.2MB
MD5122b92578783005b9f7a591580893c9f
SHA1206ca0cc4f4dd6f74be5d3275e665c0451dc33ec
SHA256c531e4923e58a7826422ac49ae96d72ba3d56070643fee55d1cd36d5742dfc66
SHA512a8c78fc1032fd7295f9b098e4d9d14e21a441e49565b06db5eee0f4aa746295ce989e128f3df4e823eeb6415b00a247773f3c2fdbf4efbe9f8585e4b81d840b0
-
Filesize
5.2MB
MD512a7e45511c7e7bb11c169dc2c1b1082
SHA1baa3586d76c4a2f29b80031186c740d58954ae1f
SHA256c218b2761b476f48c1092d6c5a8befbe55994dd312cb2185c455d4ebe6109f42
SHA51206aa0efdeffd44c41fcf5ceacce6ee3fefe6be77391d0f8083a87224171e1c9eca95b96307d0f3597d25d65ffad7ded0eb270d43261dc070333d71623b09d890
-
Filesize
5.2MB
MD5fd6df875d845368c9083aa947d67963e
SHA1cdda9dacfbcd98088e1be1ee9babac25ee71a911
SHA2566804cc4e2fba8305108ece9094678f20116d35dcb88ba128478c82c66d2d2135
SHA512f27639fbb02834c554b2ad82b2c9f99a8c4319598b6c09b3443401f533584e18879daa4fbebd61588c598f7f1ad1b95c4128161d3bc4949f917be24c2ed240ad
-
Filesize
5.2MB
MD5899d3371055b3500ebdccad0ee108da5
SHA1984bc7bba5b2176be335c529b34604bd51bd8f0b
SHA2565a29207c65da9c0306dc69480598da0e1ddbdc7c192b09d46cc661ee59436fcf
SHA5129238d3f914cea95543487c5629d1e9c1302d6e302f92524bdbdc7e005635c837ba186fae86a2bbb5818bc4d163c122569f58086885b0d3f12324b5541ba51cfb
-
Filesize
5.2MB
MD5f847c16832a505799acb4a3daac09c78
SHA171f6b847db11dae926fd60823ff0ace4af22fe70
SHA256cd0f996160df7ee56852d0a72c33d2b37fa6f1e3aa2e6c5787889bb442ff6333
SHA512aff384b4c2ed75167a3d59dc0f12006cadf01a6bb4c9a8c095f9bf9b8205e3beb6a8a9eadf1020ca76a00a5fed3e1d7b00e4bcd824068ce0307b5dddd0e0ecd6
-
Filesize
5.2MB
MD5573106c2cda7f978de9d6d141118987a
SHA1c9b7600fea0fca2b23f43e1c09a606089401f421
SHA25669ab411b45e769854b962eb7a64622da36ab5b1f855a9cdafc0a6f7cb54976b2
SHA512aa2ead517ce6dac97eebf504b98c5f62c762c1b01aaa3779644feab90b35ecd3786ab849d7be59b3ea67ba9f9f6d767626e4a8cbe3754278327ee0e1b58b4e17
-
Filesize
5.2MB
MD5a903be6fb78a177c892f40251da12581
SHA166eb7b8cfab14b1c8e8fcb6a36a6661e4ed606ce
SHA256e49ab53034773c1e16b458ad90e855c3c6b502a3c46abc265a5b6634acc0aa73
SHA512da9131a91ae93a39dc64049395205e018d9de696eb5bbae5d999aea045d5a2f078425cc4aac8778f71aa396ce845b8e7e2807068611e1d137856ae5dfcb9f80c
-
Filesize
5.2MB
MD5532e10b412c39808492714a9ce8b0a6d
SHA1f1d3cf873146ab5a754ee897bf82a0bd43f083b2
SHA256008127df3f36b15073f1bf7d2595521ec97af9d1e910006ff10f2c4bfb356424
SHA5122d8acf7153fa5e2aec9118bf30781f0e505e18b8303b6e74c0ef973280d3bfc633bc5c7014b8853d48aee1b550c2b29bd31ac6a8bd18f6a336c79f981359758e
-
Filesize
5.2MB
MD5332628383ea6f3d8bf6c5e6e2aba306f
SHA16a1a472f3d05da7791915ef316f601cc3e225e69
SHA256084693edfbdf27ff7ea199cac521e803ac059a666d6d24ffa49d5db6ff3bc705
SHA512bb373b48fa107396664d7042770879e936db9ccd6682dedc68e92606e4a0ec10896cd2b656bf7a5d159a45f17b7a4a8ed598266ab63cc72efba164a8c28ac7b6
-
Filesize
5.2MB
MD5da8efdcbf6c0ddb2a13a10aea29fe003
SHA113808fade7188cba10b0c347e2c37e7ccfd33548
SHA25601bc2814eec02bdf2443087fd461c37e877bce5d545106104f9464ba6cdf7463
SHA512c0436731b22f27380017d883763fa2ed7d0ab674bedae959d67c2bef621f1a81a3a4164fed09c562d65ee99892d5b5fe45c6853f2487d518d36f040af6f97081
-
Filesize
5.2MB
MD52174d92e4a370f60678cf9fe7679e8fc
SHA14ed6242b736ffba657afe43a244618706d3c6354
SHA256132e4d411d6287f478c7fb88e78b70fa4ec72814dc3b6bb675b7dbc4dec5e92e
SHA51200a0f8109b906c4ebe981c02b5dbce7d0f60e34d673d58cbfe14eeb520dfff62839b4ba35007c068404b3e63bd74be897dc4cea3cbaa556374b77c154e7d9cc8
-
Filesize
5.2MB
MD50db00f92ecbbd0a32f9b0a5f29aa9c10
SHA129466f6e11d8be07cc9a83531b037083443c8d00
SHA256891b04a127257cbc8f0216c97afbcd5cc9c38ca1fa9d01a032f51969f36caf8d
SHA51259dc3534003b7bc174081bb55255444a5a3de2778b6d8c79bd0cdb709df29a2eff3add9d63fa25d67fc04401173225d44efa27681fdbacd3af281d63da275a14
-
Filesize
5.2MB
MD5e30f3c33be3fa6f31a3a3e60236c9bfd
SHA16d882e1b8736decc16200cf1b4bcfde8205be52a
SHA256b9012cd463c60e0130ead5b34e702d40e30602104b4845037565527bf291452a
SHA512cac706083a77507aea4124568bc906368841db32d9646cc0422f0ab7ec1229c7a20a8b25f2218a3d09195c2b0678c6bb457dd6764233418b1e8de8dff37ba16a
-
Filesize
5.2MB
MD54b328a2227b0015a61bca19f1c1fc854
SHA16822584efaa7df24b73e6078c804a610dcf1e011
SHA256e845e5e6faf9c1873d1a9a2401d227a862fe82b19665f1df63fff1df10162fc0
SHA5121fb75f3818f06108f2b7641e85f90e1ea4edee2dc9f066fd2c61f8c436fa0c50b55914896aefc5640a79e69300f6b193753b5bc4c51b2f4af38eafe05ebee975
-
Filesize
5.2MB
MD5c500efbd0d591f8da01505b2851fe79d
SHA1795d442824ec7f505d89ceabc43920b63709db69
SHA256385e817ca8766de8b61236cd035ddec18d79fc8e9b34bf16e4304a7fd315d38f
SHA51258c2eb070c209c31afe52da1db1e8fb1b25390eb666ea33cb80895f3db73d54ed7e87ed93f9fc983df4576ffbac6b90fc092aee94af0feb7435c949b557bd8d7
-
Filesize
5.2MB
MD530f557870256740a4e6c4928a1cb2197
SHA17dffa6385d9530fc36155d02749f672de6437887
SHA256bc35b4402e1142332978f993314c4c16d08b29756a1f4784ccd6ba3cc4ea6a88
SHA512d316250b458807b314d125977d24e2ec33e5ec9fbced4edeab4a53b9987c37f59e1f4e81b64b7424ec50bb23b21bdb9e9bdb023b661118f474b30f10efcb52a2
-
Filesize
5.2MB
MD532b63829966cdef5feac1e6865a08bbc
SHA13903d8d8c78e02ae4c0de6be949b875a661d1d89
SHA256f7db76aa5bb9db3df5653a8acf723387d4f7a0e081742ae52b896dc892e4a331
SHA5121eb5fbd3f4be9c8f8b0146fb998e9c8fc7825c50009cf83b851b21734de08e91fb7b04d7d133b34f384f615e15dbd582be268d4e814596d422b02e68a01d77f5
-
Filesize
5.2MB
MD535c9719a86b50f90fa119587fcb12e91
SHA13e236510643f6a6be7d5d850404e294410fdabba
SHA25613c2147abca15da6908c124a5e245509b113116cb7a6971f8c484c0221cad8cc
SHA512bdd8585be0b750fc2d4385068c495fab2f11873255997f382b46032274ea2720d3164e32431a43c5b98e169572b611fda54e51950345ac7c443b2efc1f759801
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB