Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 02:46
General
-
Target
2024-11-21_659e76ce67314c68bf4a1831ddfea722_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
659e76ce67314c68bf4a1831ddfea722
-
SHA1
337169fc0ec7483e2e4a3ad72b0cb075854aa8fb
-
SHA256
bd191079c6eb4dec87246fc227542e9d6a9748943bf3c8d3b67a093adfb41bd5
-
SHA512
c740cbf4c6cce1c073cde74dbcdb9e1a036e7fe47eda57cb2ff340d840889611c189b746f7c1d56a5640f693e57772206606a5438e0a1966f6c8709d29d94b20
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_659e76ce67314c68bf4a1831ddfea722_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_659e76ce67314c68bf4a1831ddfea722_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oDQWTUJ.exeC:\Windows\System\oDQWTUJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUlmakT.exeC:\Windows\System\RUlmakT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BaXczjb.exeC:\Windows\System\BaXczjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WUckJWf.exeC:\Windows\System\WUckJWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOFhowF.exeC:\Windows\System\rOFhowF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSewQAw.exeC:\Windows\System\uSewQAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvKwHVj.exeC:\Windows\System\tvKwHVj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRxooND.exeC:\Windows\System\KRxooND.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqaUzev.exeC:\Windows\System\KqaUzev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BKuyJAL.exeC:\Windows\System\BKuyJAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQUchQA.exeC:\Windows\System\TQUchQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GYmOcQn.exeC:\Windows\System\GYmOcQn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FQtaWCI.exeC:\Windows\System\FQtaWCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMOPbze.exeC:\Windows\System\hMOPbze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTDVpPM.exeC:\Windows\System\eTDVpPM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ESXhyfK.exeC:\Windows\System\ESXhyfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEhRobh.exeC:\Windows\System\jEhRobh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIbIcdp.exeC:\Windows\System\kIbIcdp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZxZGDK.exeC:\Windows\System\QZxZGDK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRUEeJK.exeC:\Windows\System\gRUEeJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHAyAvh.exeC:\Windows\System\vHAyAvh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fef45fa72f240cfc2dbd079fbdd568ef
SHA10bc8ef2d78c576ff036592225c03a6c536d9d89d
SHA25692b3352a347d84455a83913790f2ca672571c23627908b47ca410b54359cd938
SHA5127ff7bd39897f088e3c8352b2e5dea89968a0118c7cafab3e1c96e567d3ec3ecc1a0b3c3664d1d57e7d723328ea21856876bd447c416f7e313ed4400f0dcdc763
-
Filesize
5.2MB
MD55a2473fbb1b56e63d5322e21b8af7d61
SHA1eda456cce663452a507be1d1657ffb1722b7c634
SHA256fd624a6ea0ab979f5691273834853a78871d584612c61c8748f78c7acdf4593c
SHA51248aed04acba120ac070bb588bef7e8572ced1248e218cce2cfec185f7b703b18ad0d3d14fa7846fbe4850817ba007dbe6ad2c3b9b49296bf7a442bd9bc318d6f
-
Filesize
5.2MB
MD5689744a9aec66fd0752f3b3ff1162170
SHA14c0712318aba7c5a35f56a64af0bf0dedadcdcb3
SHA256cd93e1717c259f763b575b4690a057ce6c63c3232b1a4d4f5c58f8a10e1d4699
SHA5126529b51b0bee835f8abb888550ba193a3e4d7220eebc89c1b05fe2dd85e24afd046e37a1c738ad1dd7b2e4645933023457daf28eb998cbcb6e2f3438dc2005e8
-
Filesize
5.2MB
MD5caba291a2de924d6a3db2164eaceb1b5
SHA1668e09e3a43e73dcb0d7315c4cbaac135aa5904f
SHA2560643081179d3103111088904684596201787c3468cfde9bb92843293c21d94d7
SHA512d4bbf72f24122eb10ea52e733761e03e5cafa53f821a5ba26571f704e2e1dc6e7f6d7963a5b293535545a84950bdf4ab9d7bff1f2937bbbc90d3eec6dce38330
-
Filesize
5.2MB
MD5048f15e668335220408ffde112c24201
SHA15ca6647f244ae9bb0c4f98b59fe3551bea25e55f
SHA25689f84ef9d6d10fee1125ba2097ec0e3a4121e78e35a5f4b7f50d72860882fb41
SHA512a78439e7faeaffb8c253dd10a36d4166cdb6d94806102561df57e06500df98c51737cf6b5cc1a3b3d5585cdacd0893277e468b6c9ce6a1492801639e154d8729
-
Filesize
5.2MB
MD5a98d868ba8166b0e93b704fc07c642d5
SHA17629ff46a024cc1815a72622717e30416e56bcd0
SHA256f0a0ba0c6d717310b520c2316ee17d5ab5c83e714f2b02c99deeb3f70343c091
SHA512e10169aa4ce9a5fb612e997c545e8feb49b9707efe3cf0e3a94399faee8620eb44443744f1d7178fa5578f822b7dea53304be240f8de8275e9c4cacf1dfd3d0d
-
Filesize
5.2MB
MD5c05ff2f0fbb8efb35a1ea70c8543d6ac
SHA104395eba68ffba4a78fd2b58aa7e6ab148b0f488
SHA2565480be0c7895680834dd1d8a903251114a1c9a0c6bc91ce688ce24261914a6e1
SHA512717cd1830073f73539d8c8d38f6db88ee42f6b0d9ae0384a4bcf981651228a55734fd851bdba447a1f3d941446a42a0c4ffb7fb5dd7a621db685160b7309f0e0
-
Filesize
5.2MB
MD56e783bd5476e5d22a1c26a4498093fbb
SHA1904ab02ebf4ab8d9ca4b344204f922cad8cf6a73
SHA2564db821bb73606aa8b322791937bff182029b9592dc7ad9ccb6a607fa03a27bf1
SHA5121f7ecadf28bdf48da48fc8c3e9b529231909d2165f71d5087373fe1add8bbf32e15a9a32b5afb055270ffe5f8995e172c406a30317fe765d14a183d1bc74905c
-
Filesize
5.2MB
MD58b2a60f7cd9457c634c985bec6364ddb
SHA18ae977d95953d281602cf6d059a5d701d240f512
SHA256e87d0b26bbd7ece7a1f969e50b675bfe41b85a5186ac978c5a7c62dba387f853
SHA51209f1eefab301cbfa1b01bf4940593d372b2c39953308cf3adb44c09a121ed8166a63e1fe14b7929ec9f452bfa07d433af66eb942ae934e2376ce865149dfd2c8
-
Filesize
5.2MB
MD5bb8bc680166700bf8ecab27b8e1b7c14
SHA14865078445993d4c0c9c780c605af9a1fefc7dec
SHA256579d18883e92d664abae42355aca9b1017fe5eb97025c0a883bf3750c3fa5601
SHA512545c43a27e897c6a5278e3273dedd42686fe184bb200a0f093fc7e5205121efd599b456df8f6765a727e7abae101cabbc06ddc3b4bef47ef2d1e862deea3c81e
-
Filesize
5.2MB
MD55c951ad5b3ec9e31f97062a29a3af322
SHA113385e2f6a9c1dd71e2e4e9c81f69cbfcffb3d38
SHA2560de3ad6ab4b41a846b9fe2a803953e2baaa7ad5986a3c58061c08e2eb50eaf79
SHA512957d6fcd6a6bcaf20d166d21b191d5418c815c8873c7fd483fbff7693fd98e882eef29c76ec8e0c7c83da3c9e7cead49e4900470a94e57a7781b5ca477c65ce9
-
Filesize
5.2MB
MD53a5f94481a1414b4d716246af1245c46
SHA1fa3687686a5b76897fe0f53d62c58e643538338b
SHA256cd960f603d1d4a83df87547ed0e652a28ab1df2c1fa3c6ed1df3e208d3adb27e
SHA512d879dd5d3d8aef4c1d79e19f2c5583d7e51b3ede3f2c4245126abfdfba37fc2963cf3c75b2fbe601141a880f071ed1843d1be00fa99f531785d9a96ed11fb8a9
-
Filesize
5.2MB
MD5334903a78658676b5cc4d11c888f555f
SHA1439b67df03de18fd028abc3397f4a81d7f412df1
SHA256fe013f7576e246f43f9b69391eaf0fc2dc5c2dcc3af91160e299c83aa2305afc
SHA512ecae7b614a4cdf50cd778b4f1a425070c9eaa3e4a49694299713175c10841941d7a63022c8b06f78a6060af76b823dad1ae02ceb35018c82dc8de170eace9e3c
-
Filesize
5.2MB
MD53021c6f5eaed688a85bb53d96bdf6e44
SHA1555af5fdbb34c1904b1db926d9b36803e1ee0859
SHA25618f07d962cbf96ac76dda91275cb7adc1aa2314412666f7824449dd73b2de686
SHA512a15c7fca9ea8824847af476d45c60b294d4042ec03820e6b2f1e8e71826b4acac50a12db822471384dc5ea2d78adc0255d8804c84b20f8a3abfdd3a856ba48a1
-
Filesize
5.2MB
MD5c178c11e83a8c7ba0d7d7eb36c9e27d0
SHA119b15d1bd8e6bb7cd84411c18fccccfe81bb1aa5
SHA256e5c19a52a5087c02a87a54c13edee6abbec337e699ef7d4a053f89ebb6178034
SHA512b3c166cb06b4f55ab8d4e97781e685201f84a8838298e021b7d584d54b5bf30510b29dba8b977ba418a0950ede6e12ddd9639aaba8fbf8831cacfff7e4c49b1a
-
Filesize
5.2MB
MD5f62a9dc94fce98b7061b65d84aa79fbf
SHA18ac74184ab0981c26f503a53e0b447cdd93c28f0
SHA25657a08bcc6f08a4ef7756d6b6e0daee8621ff4f768734e9cf80b05ac917fe72f8
SHA512a1cfc4e7c1e02a4c831c70eee923417212b6734c15282596b6dd2379716ab45e4a71fb9d1d2309952632de82c6efc18621d98b565350ade35a84cb3092b1826f
-
Filesize
5.2MB
MD5a085e42b175487877b8390643da20293
SHA189e0486447b1fa8c17a3be45cd9e5bf5ed3c7e87
SHA256be4db40877d165626a66a9a31240a4b0f1ddae6f633de1339a32ea629b2f7ca9
SHA5125978c85a9aa909969320429c9d652098c05ada778282cdbcc68e08f4825b4809968110d33d5181cc2b80199f13e0ff785bc5086da7002b688517a648ca3ba364
-
Filesize
5.2MB
MD510e074a2d09eaaed2ea55936487362fb
SHA18831e15195d003b956a3017b7481757338b9b04a
SHA2560e8fdd17feffc97368ea3020efd689087aa0387025b9f915a63365ca0b3edde7
SHA5125b46460f187bd5d277d012adc2dc1461973d844022a86ad8ce79e246a2c3ac0d6a052b37ad071c51dd0cba6d401296b4ad738a15ef9a4b9c69d7b8bbf106a930
-
Filesize
5.2MB
MD5e8210a1c9b2ae16826daf8883f1f0678
SHA14c0045d0013b1450d01de3d0abe526ed20c273ef
SHA256c082ccb9b351e8504bdd05e5af8ad0997779870be7c72c9ada83e93bb7894b31
SHA5127ef1090f6d0adc24fd64bdbe58f19e02e163ba24ffe1af95858fe79df6b107b5714c04442022ccf919b8127d01ce41390db97170450b365f1dc43e019fb77a83
-
Filesize
5.2MB
MD52fbb94317378a7510ef53179efd0ce5b
SHA165a4536085b74a6e4ceea519738714dcf24079f5
SHA256eb9116fcde062a709c9e3207c137afc60271488c08739b0a1d5605a11b2cc589
SHA512b29a1cd28f4f00671dd46334031953c5f91f967907ec19901d338660bf681f24c6abe63fc3c8ac9cb60412e2694441cbe5764810d5a9aadb61868f8c1df64148
-
Filesize
5.2MB
MD5265df767ed10d168fe2760f33728eab7
SHA1bb599429259ec70ee425f44e4b971f0dd1057656
SHA2560bbd3f4c7cbc4d8940e2b15ff82759a46455ea28b9b4f128d1f8a6cd5c446c23
SHA51273c836886214e39c529ee34b64c69929d3710ab337a66a923ffaf5f36ba1ce97db2c922beb7777646d63d7e91a01c87423ae25e07fb6e80a58654f0cc630491a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB