Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 02:50
General
-
Target
2024-11-20_ad10e3a08a8f10d7a6ceaea9881fa24e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ad10e3a08a8f10d7a6ceaea9881fa24e
-
SHA1
b703df52275e6a6f9de6fdf6e06f0c6fc43ec7df
-
SHA256
398edf7ec3ed8691b5d8a930706b87b18d5da1b50a0457164647acfe1fc1f204
-
SHA512
b40cc323251eaa6b99be104390dc3ffdab9193d6bac5dad8444e23040252afcae80650f14d478c84eea41be5319b79016b4f00069bbb6876ce6ef3b786b369dc
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibd56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_ad10e3a08a8f10d7a6ceaea9881fa24e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_ad10e3a08a8f10d7a6ceaea9881fa24e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pSXbetk.exeC:\Windows\System\pSXbetk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQIInLz.exeC:\Windows\System\MQIInLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tEFHFty.exeC:\Windows\System\tEFHFty.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DjhUhCS.exeC:\Windows\System\DjhUhCS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EeAEqtl.exeC:\Windows\System\EeAEqtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGJlFGr.exeC:\Windows\System\hGJlFGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcnkCtu.exeC:\Windows\System\fcnkCtu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGAUXTH.exeC:\Windows\System\aGAUXTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtkxcdP.exeC:\Windows\System\mtkxcdP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vLYwRFy.exeC:\Windows\System\vLYwRFy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHBcmOg.exeC:\Windows\System\qHBcmOg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqkbXJT.exeC:\Windows\System\PqkbXJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxDHWeW.exeC:\Windows\System\LxDHWeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SxZXwyO.exeC:\Windows\System\SxZXwyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sEJCBxn.exeC:\Windows\System\sEJCBxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spUtPYz.exeC:\Windows\System\spUtPYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQqVFwO.exeC:\Windows\System\QQqVFwO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmYftwl.exeC:\Windows\System\CmYftwl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgUnXSQ.exeC:\Windows\System\mgUnXSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQABloI.exeC:\Windows\System\JQABloI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sIQgeDB.exeC:\Windows\System\sIQgeDB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD509ee08e4ea48cb5441c9550fc5c408bf
SHA15c870d7085b11ff584c9ceb6782021e4294afb8d
SHA25691cac819881e0204d73a5eb7dcbcc1bb3c8d2bc6f7016bb48efcb816e0353e8b
SHA5129ab163dd5a2455ae55b9a3b2e653b718a853c3c208e82a89157d39c060e83bbdece4200d3b880637f7b2ab66df78e5f82a66c7ed85cd09d3573d9603bb1e6063
-
Filesize
5.2MB
MD59ff5c387e85e06e791884c1ee554f6be
SHA14ba54dd8faef43365cd5ce4f5bf66235398cb90a
SHA256edda8a9dd1181b975a1a4d3119d81b4a23c6cb824f32fd38b38fa95309b5ad11
SHA512d9d02df8905e98fa3518d536a4b04e8b4ada3fb6be4ca49117381d6a990e3b098d8973646cca6ccb4f131863181ccaa356484475f3746733591cf21521ef3e59
-
Filesize
5.2MB
MD5a3d152f48bf5ede566c6a9c1b332ed97
SHA17a141fe897b5536189185a2ab7ed96134a3f5833
SHA256df345df7c8cb3c83ae2accc23c63910664c938ace923a73c20c989e420e1f96c
SHA512880e9777cb0afd1c9de0e17b5fa9dbe4cf35ce009a484135a6cd17ed0d8bc84653f717df7495a675bee573ba76657d25314b736d44ed6f73d172aa15a5814ac1
-
Filesize
5.2MB
MD55ba6561d26f9ac6786bfd0827ecbf20e
SHA118b0331f73b524def56ea6186d07f0be205c59ae
SHA25695c4485a07a8a4e26cbb177626740f901f1b12b78aacf6312f668a81d92e3778
SHA51298d19f76db9fdc4ee374f295d7c53353ec5414db0f51344d1eb7de2eb42e1a0698d9cdf69fdeeb1f0e955aae960a8d70c6a8e9fceb3e493f732d4e4a3d62f2f3
-
Filesize
5.2MB
MD52123fc1d8e6050c1ab1082263dfe1ff3
SHA1818b144e76fb5d619dc267191e66e43a18b27cb7
SHA256f6d60527e09b56550d5369b4097797c338d53c5987aaf7fb52684af27522bbfb
SHA51295c7b73aa7f99007d435a0ba2f054c423759aa76ac0ae275d24a6b8bd33494f021a08d2288daa100a66d06992869c038b1862c6727db51006f35e768a5faa1fc
-
Filesize
5.2MB
MD501c8e10da7153d9b95f24cd3c62483e5
SHA13b3978043462ea9605be879ab8244ee38a4e1cd9
SHA25697c8138d4521b5fc95898fb9166e8e7a7314d543572c2f59113c212b971d7b76
SHA5126671528231e7cc47e87c97b66be62420ad7d42f52f0d2c6f08ecae98d3cc1e781df55702b60e7f6b3e5b65744fd4d3b1c3f86843547806a6dbbfffb3020fee57
-
Filesize
5.2MB
MD5664774fac9eab571761fc5bb0367e5aa
SHA14dccb845f6c4e6a0046e979f76d5a22ebf01afa4
SHA2569caf31f8f8546f2de9ebcca8c0b4889399a754ecc583434697e6580d650f82c5
SHA512dcb74cddff805745ec26f22f1a62253f3c800a582e88642a49651c55fa4d265b42ca2a60e25b29133e63c60ebfb31d8d665d7fb74be24e2683cc69530e9b25b6
-
Filesize
5.2MB
MD55007811b0998623632d468b7f0a30d06
SHA1dfaedf6bff67855abd3e6f1ed6139ebab3c90663
SHA2564c7f6a65292b8c0526f198bd292efe49f5c6682795fa1feda1a8d88e9ce3a278
SHA51204ce33c8bc12d3e286228d45383308311346a19385b7046a8f0f8d73a382a37e29db0f07c117ce9f84fc6191b0ed75170c5f8203d846875cb758f648696998ad
-
Filesize
5.2MB
MD5990f742b7ada4bb0224b9ca0044e1398
SHA1fec8af7aa079f5551301073f6a720e8269f018fe
SHA25643bd415cbbdb13b59090a8e0158ae13dae7b4059d81fe040263fa37d4b86e997
SHA51248a82fdd2283a7ae61d2b18e06c7cd92c9bf5e9d1053d6fac1ada5244afa410034255f5117161ab46cf3130acbee80348b57ded39772bba7c6d7949f218fde8e
-
Filesize
5.2MB
MD5ede36485a6e96d5a68552d73b75ac9f2
SHA1b87a7d37696a425d6c737eac3a8e59ee3d42c5dc
SHA256d2541a07df9fe3da61220c623f5294533fed02f849e327186fa4a57ef487782b
SHA5122095d576debb02dc89e6aff11588271e632a49ed98cfb20a5028804e2dd35059a6d8d2dc967d0d4e876f15daaa35a50ac4c300bcbd1eda3a46c95b34f6e36062
-
Filesize
5.2MB
MD5448ee1a07b965e66803d6e8039a7e3df
SHA13db536f562c2a4c5b71c706c7f688dc113406587
SHA25609995f8573c64f85003a03218af55322b8d731f6e41a04ec7ae462564d03b4da
SHA512bf7ec280da72a05e04dfd6fb57535de6acb3b3fcceeaab6dc78ddcd1c4bfba828c6a2b30e259cf95eaa102f72e6d437a048e0db20487cebbad99a8694b695dd1
-
Filesize
5.2MB
MD50ba554423505951230873b7394e8a420
SHA112eafc595bd06c97f83036212a83d7b23cd8b2f2
SHA25612555cf77e06952ce185f6e2376e3361ccdc71e24742b734300e523873904ff8
SHA51219ea37d5803bee123401bd6641fe20abe28ad98c0708d061cfe8987886d9d17c19e80460cf1788dc66175b29fb3536586595f47810335e928acbaa3326e4b891
-
Filesize
5.2MB
MD5312913953662989d5bc0ca9ff68fd096
SHA1719b06df08a55b73145f23dbf6c7e45d39019d78
SHA256b06b8789cb3af29a4f7dd877ef3597648b4978ebfe55d54c02e554a141ced02b
SHA512017ac7b96e47eef113d6d21be6481709668c145e0da67b04b42cb541f77613800b34ab1960d74c90aa0bbe8b0b17244a5a74efc08c0930b8741b3a3203982ee8
-
Filesize
5.2MB
MD566cb68398917870e414dd09ef010abc4
SHA11223b461554681111683453211f5403c21eb0ed0
SHA2561fda8c4971d2fbef7a3865f896893ab40def9a39baff507ff77a22cdccf7265e
SHA5128677843a9d305affcb9ba83709a4bfafdd78956ee8f1e7db560673fed72eba193504d10f6190cd7478196b20cf8669a828bce465ad08b5cb67c19b98a0dc965b
-
Filesize
5.2MB
MD5ed03dc903654767f9c707e581ce0c150
SHA120c9425e70169724266207c8ac9d1ee064efb9d4
SHA2568b848cbdddb38d93e0821b07f58ba0120b734e722e48678ecd6b40cc93796495
SHA5128abc8d2e0652e69fe9e83f2bf7a5389ee2443cf8a8032720f593f48fa1b37b0f825d4ee26a7cdefba5b9ca970dddf61bfcda7dbac012572a565d385ba7e2ad00
-
Filesize
5.2MB
MD5c46d003ab8940d4c8643fb7be1cf391f
SHA1ac6f1e9c5246aaa29be27d19ae349f40228c173a
SHA25665d7e1066b69fb9aa525e6771443435bcc9cf5962a5197fc271e48fc978b25dd
SHA512635e66b824a0e320632b82ed5ae284919103826b99d16ec95770b319d75558f49207523fb38b4e46c4bf58317f2ae78846ebd7c4d7993a42d3b1bd6e38ab28a0
-
Filesize
5.2MB
MD5b0b27b18b2905ff966293fe3a785032a
SHA13cbf7e6bd87abcc26b456b315d3d5fded5f6da3e
SHA2560fe50d60ee4ae88be49e31e4c3957925ecaf43fce99f1eb25b88a4a5a1ffff91
SHA512508d57e3074ac2fd827811c2fec3432fc814cd28cb98a56555609309998f56ded888d18ebbd7c6540b7d7599beffdb602000bd1bc3460ead0e2290350ef9853c
-
Filesize
5.2MB
MD58011a5ad8ab06c3e97aaef61d8a5f443
SHA17199c8f91864b0a6cc2492c4e82e5160e84034f4
SHA256e01da5f0068a8fd1d1d34e8656d589849dec0b5ae30b17aa3d0abf6111fadc15
SHA512d2dbd402c1411815e6bb712c1f602e0097756900ce669333aedcf8b0f1fc446ff54439571dfac75cf9a4b90da69bdb9ab52a46734dcdd50412c75335fa95c6c1
-
Filesize
5.2MB
MD513e50d8c3bfa51504a8733423a2ea9e8
SHA18411ae165cfab95c7cb9dd862f0e7c846f6a63b8
SHA25686b6b11087a3d00879c1c7b5aa94650e6b087d9d44eca87173f6842adbfad458
SHA512114bd82cdc6a790d085367f76d9f01976ff9d09b9bceed037ce1447ea4b93f0b837841cb24274b538f267329db8971e3bbc4ed47d59a5d507073ca2414555b8b
-
Filesize
5.2MB
MD5d9f02005bb618ac3c822d24d8f15ff0e
SHA10ec96011734967ed1f90e4cfd7002f4bdcbe5711
SHA256f8d249dd38751587dd5c915ba28a1c58f84fc57a1e78db336bffdde386002241
SHA512e59407a8e65fe1e6604d4b02bcb447e4f098d4eeb8152530a081713656fbaed00293908372d228db0af4c56abac69cc7358aeccd0d02269572df623caf202519
-
Filesize
5.2MB
MD58fcd3f7045e94a4cc1cbd64d965a6d09
SHA1cbb31d7c02071c9c3836e02507ff3bb74427f4f7
SHA256bdc2e48486c00b0fbe5d9624f8c88bee99cec0d2d673b870ded1d70ee000d8e6
SHA5127c8b6fb0d991c3febc4b03fb1f6dfa70cf68f6d6696128e9011c90afd7cc5b6dd5da6e044117beadf370e099c9bf5cadf2826c43f0daf2fb53295da4b04c5ccc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB