Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 03:24
General
-
Target
2024-11-21_34a71234a2c4f6fa23051a3045563a23_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
34a71234a2c4f6fa23051a3045563a23
-
SHA1
3351c8bd1702af377f477dfd3642299bcedda476
-
SHA256
44430d9865b6700aedce9f91036ccfcc79a37c35e795d1d756d68721692dbfce
-
SHA512
253829d02f886ad8ade61cf5330500a781b81efd223ea55cc330adfb5d3ec66b9985199bd44c31156be9adf6841b7341117bafdb6ce0faa6d498086e0e90abab
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibd56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_34a71234a2c4f6fa23051a3045563a23_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_34a71234a2c4f6fa23051a3045563a23_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oBkKXjO.exeC:\Windows\System\oBkKXjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iquwPdM.exeC:\Windows\System\iquwPdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMJiPcD.exeC:\Windows\System\LMJiPcD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RoDIZmq.exeC:\Windows\System\RoDIZmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ujjcPkW.exeC:\Windows\System\ujjcPkW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rakuJJr.exeC:\Windows\System\rakuJJr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GOkRBxW.exeC:\Windows\System\GOkRBxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EkDWqHT.exeC:\Windows\System\EkDWqHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zICmHPc.exeC:\Windows\System\zICmHPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqANnUk.exeC:\Windows\System\GqANnUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNlljjr.exeC:\Windows\System\QNlljjr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlKwuNx.exeC:\Windows\System\xlKwuNx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxXoDUj.exeC:\Windows\System\OxXoDUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUTZPTy.exeC:\Windows\System\XUTZPTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omIfccK.exeC:\Windows\System\omIfccK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiwUDFX.exeC:\Windows\System\uiwUDFX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FiVnKoH.exeC:\Windows\System\FiVnKoH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JOSpZoS.exeC:\Windows\System\JOSpZoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMcYDGj.exeC:\Windows\System\ZMcYDGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMNIKUo.exeC:\Windows\System\IMNIKUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSKOZYF.exeC:\Windows\System\vSKOZYF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c32f0fea38e84fb2b5113f5df1ace449
SHA1cbf3e2e38d0251a78d54311e86f7fa9658f95e32
SHA256125d8d89e725f68256c6547a2acec07fc0769e9494a8b89cd1d01f767bf8f75e
SHA512eef547ef7296d4df510d4f6dbd2d9f1ec7fc236dcf7300d40d517bed1fb9f4d4bef5788d948bfada038d43e4a726ffe8e35597cca95336211249b8e966a324ca
-
Filesize
5.2MB
MD53b3cded661d1cd036d4cc35e2419aa90
SHA1faa51fdde2e4e2b7366c2f1c2a8d449eff2479e1
SHA2567167575a01ab9346dd3c0884e9c0bac75e5f4f7bc2bdd83bebe3f02efbb779e3
SHA512db70c84b0275de6d0249d4b86740f8394fd04b4a0a675b496ccd305ca2146f7324833d5d9fbb9acaee2189dfbd52d1f49d37703b3f076e311e02d3250a5b9dcf
-
Filesize
5.2MB
MD582272d26ac5063ff05254f98607d30f7
SHA15ba744c8f2e6a37c58180c9cbc1f5e56b466ccc5
SHA25632727e6f73b705f77ee2948e9d7da63beef85c210986ed1170678d7809064b05
SHA512d2668efb350f8c5750007f909c51bd38d58144d4049bd4a85ecc9ae3663c7403e19ac678eac2c06c397efc19afd2b7ae9df5fc0e2b575503a9ba0dbea1b6628d
-
Filesize
5.2MB
MD507cbca63b04bf7bda4f2f7a157abd027
SHA1f0ac5bde3e5fa7e8632eab5ded6e6167c8035054
SHA25699c955c9eed88a6945e528447c2150a90acfb580c1e0df2b2e1e8ee540fefe6a
SHA512cbe3da5b264f05ea90e0e25058546b3b83dc36c5cfe70cef20003ad42c7e886cac0ad51e95c1aa3e0077062fdc7a35d0f65792952371c8c02a0e17b8ca3b7ee1
-
Filesize
5.2MB
MD5efab93f0aea318994f91da95b69fbd78
SHA1e49a6a1bf3f996ba2aa1c3f9005229cad96c99f7
SHA2561366cc0f8b0dd0e30f4c4a70a1f95467b7bc54090bd6a86090a9bfe8eae93a1d
SHA512713fbdbd0c75e08a94e38405698be7bbc92e03ca3dbef65944364dc2ca69a8a7a43d77e683c388ad459aec417eb5b964f42779a4786da0be242cede8a238ecf5
-
Filesize
5.2MB
MD575ae389434266994f1c5b21785da650a
SHA1f0cc3989e34b72a58f623a75143ecb3803a139fd
SHA25636ff8e48c66bb502c68231e50992f7e1e81b923b68377b4fd0260ff82b855055
SHA51219ae69da58398ddf39c82ef67918aa24b33592d21742adf87852f85497955f18c1c23133d9465079ca60be794b7dea41a0efa63faaf9575a38d4297fb40c621b
-
Filesize
5.2MB
MD52e52c16a652852aa0e17c7197edbdf62
SHA13bd43c2d58e92a484965387f0c4b212436a65162
SHA25642cd28068c81b9c235f60c8496591b71a902789c4ef0225c2287cca2b9002ea5
SHA51252abb3f6547485356d3b6b9aa525f30c026048c0c8e7548483cc1abe68df48a98cba3b27c877f168d63a4834b8354bba51281b8049a3ea3797d07d19ee6184bd
-
Filesize
5.2MB
MD56e69a2705ccabd0faf7d54f8454b90ea
SHA198fbc2b408da1884c41607815dbea020dc8a48da
SHA256d49b0705a10c4dfb25571b96f60d69c8d9be8694fb3812d5fd5a71655d833603
SHA5128e76a1fbcef99ba943505a00f83db8edd13bf6ca10388cb6ba4ba02298f8fd26b1812866ccb3200452a5419e56961353f4e6f0be3f4343583d802498427a5cc4
-
Filesize
5.2MB
MD5e11c594c039acd461a20676f79ec4748
SHA10a85b2f33d289c21583815116c4ad84639ee844e
SHA2565f7324ca1dc4ce413b8d5677f53b714f3334fa3ba53e8a360d6b7a52cc70c07d
SHA512f39866b6f70c000cec4c67b9e238158fc6e8033fe2f54e5fa613bc9e13db39656951db5a80e68dd39e0b348d89f32818280efe3dcee236dd82d8133cd561bd05
-
Filesize
5.2MB
MD5d470800f72b6384eac89a9b52b87ccc6
SHA1bbac4cd88073493d89be979a86cc6412a351c4a9
SHA256047a6e31c67bd494f521fc82ce1d773f4fba21b34673640611b8530447f4d2a3
SHA5127ac528e746977d4865e7df0b79a55e3c26d5b5571f2cba6c7d9c88167732a85d2ad635bce376d26547ff38a753fc057faa7d8b648bdfa8969d371e35ba83ac29
-
Filesize
5.2MB
MD5c2bd17e7452d8a2fd658a984b9f25e83
SHA1961fc9233c5e62f5f44a05556cbfa6ad82b82e34
SHA25642235bf556e947750ea27114bae0666c1fbfa09ab513a4c8a7643abee73b4cfd
SHA512073619f62ab7a51d3d01e132414abb86d3d16c90b9d90f12296e134890863154ac4df4610f26682161d5157274c2490bc688a5b2103dfec09e899b065be4cabc
-
Filesize
5.2MB
MD50783a1b36c8f0df15cc0b0f3567baa43
SHA1e178aab87cb9339862b32a73b8c1d848fc01e08e
SHA256f4268ebd80f74cff1f8d106a79a77a11efccc13226498e42c08cd46524390c3d
SHA512748428165989d77dd15b8e10333c4fd3e1f2b31cf02d10f9f0a3a74797652695dc5cafce8d4734a67c3b9465d33d3bbef05f1adf204098ffa00f1cc48d76e0f5
-
Filesize
5.2MB
MD5d01db1167741b5795f45bb37d142bc7e
SHA1a2e3adb38d153adceac3f0ff491281f9a0cb8b2d
SHA25678cec2ea27f160bb75e2be251a96a3df65e9db1f3976e3ad75b836f3a970bdf2
SHA5122df73a00bdc8d2d11b69da9d6511af215241644003d247bdf509c4c25ee67018ca4e44e5f17318ca5a6efb759c3e32ce815acf8169e074e73d7d5324fe6075d0
-
Filesize
5.2MB
MD52abfe774bea4899b687019a824cd007e
SHA1448d09da424b6967ceb478e2148e291a16e0f633
SHA256f940360001232078622b3090ad007dafe3d2d8e95af46d570673a744b5f15e2d
SHA512237b39f4adbd366597b3ab3c886a37b96aca0ffc76044cb9148ba20359579c0abdfc5b7041f2e9b7d02cd5dec6189a54c7db4ce1d5190410c2dd8bfdfbaa17ab
-
Filesize
5.2MB
MD5fd4104a7ff8002bf324bbed5b298d183
SHA1f87d572d53f18bfb0b458c2a8273b5b806e844a1
SHA2566db2da3629d5c37c9eed6e5b001238ac282b4b3d82fadeec4ba6e7eb22129814
SHA512861ce2c513e4fc89335a5c5f1fa0afb9dc27d935c6dbfc72ac7732b95715a39270e28ea394e075365fb562f0bc26237be158b5df27df20add43f390a8380f760
-
Filesize
5.2MB
MD58cf377083f33891bba9d0a63e417c57a
SHA134684d6e3d9804ef591974402e358a2a5c3d1ee9
SHA25661803c64b547577ec5d994c0f0cf7d92577ae2b39c29ec6bd43801b6359070a3
SHA5126fea020dc0deec99ce363b387e3194dd91e7574824b142bf9ad0b868e550283323b6db9bcdf3e713c7268d6233c2917207a98e54f9767d221a83ccdf9daaa251
-
Filesize
5.2MB
MD5d80414cb0cc0344a54b130c2c620bcf7
SHA102a33d4ea4ad021453bc5e9712b29a3982fe0fdf
SHA256a7a590a84e18f1613ec3a9139ab24931a8062dbf574f2aefaa7b924826253291
SHA51281da141f8c49470b341ee8b822ce85a099f1d0b86fc23d975934c9c00d4fc787362ab5c61fed9984e2b0aaa2395ee241c1f6199d5580a45c8e30c9db97fae9f2
-
Filesize
5.2MB
MD59c713b21b36a0bcfdbd2fbe538027c78
SHA152f94b53280a4c2db40aa78dede8c8c2997a3166
SHA256bb970020286d4a033a1fd07f46fdd454ab6db1517a9ab7ff5db876bc4d688003
SHA5125002871382014be71d64abdb79cc502378c58fe2ef977a93e03f7b172b1458c4167fa4db244534febb193ba456bd0d244d1357447b0729d4a52d35477eec9bc2
-
Filesize
5.2MB
MD57cc95b5fd068fb6356bf762903a1c5b4
SHA1678cddda0eb9272307140b5593fb30bbb18f216c
SHA256a7f3c2ea58d732cc6e47a2a1efb6c2b6f0294d4e77137092910d9d9a5768d91b
SHA512d59741c8e38d75991434fe98a70c801c638889e692ead1241300bb422c5fe9507b45b47c603343f22b47f95f1adfa97d72c4c156626ef33bc1bf42661ad09452
-
Filesize
5.2MB
MD56939526a1b38b32184e637332c9371b9
SHA154eb1f1004cb9943b31c990ce6bcb069190ab119
SHA256233f2bc5bb8096e4d5a757de78f180a17c64861fc73522a32c02143146fb3c44
SHA512b7a180dd22e4a8c53a1068a3e21d0b46731336bddbd9d571533e42de9eddfe06215888b5c823c42aa3c41fa89ff5afe72a4ad23fb3119305b37d762712390c93
-
Filesize
5.2MB
MD5dea332c562c84ae3936061eae2c71333
SHA1393cba0397365b291315d771db792a17c9b818b4
SHA2561e7c934e7def43d3880ac6f1c2a368a3e0d850f43ec19a7232d67a291fb2e60f
SHA512dbbf79126577791f9d863e9ceb72b7175e350acb6c7abb444388b3329e4d773809dde6ae1133017b8c101fa5c10104202915850ed9caebd129ffd1838c22a941
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB