Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 04:41
General
-
Target
2024-11-21_9ce759427e025ea20d909992eb133d3a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9ce759427e025ea20d909992eb133d3a
-
SHA1
0f4114b928841aabf63b23a5b35113052b4dc625
-
SHA256
428108c339ddcbd303ce85d6c9d0bb66acd45e07d19b3e8712a4c4ea85637353
-
SHA512
51aa7b24741ddb6fad297a447e21e85cc747da96172068e2793a0e560e24f042341592512e8e178e58f04934a573f11e30f74f4b6303db43658118b750d4990c
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibd56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_9ce759427e025ea20d909992eb133d3a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_9ce759427e025ea20d909992eb133d3a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uKPjbMO.exeC:\Windows\System\uKPjbMO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HuoGeCD.exeC:\Windows\System\HuoGeCD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\owgGtvG.exeC:\Windows\System\owgGtvG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MNTusQm.exeC:\Windows\System\MNTusQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hycUUeO.exeC:\Windows\System\hycUUeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrUPurg.exeC:\Windows\System\LrUPurg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NcAWOIV.exeC:\Windows\System\NcAWOIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdThURQ.exeC:\Windows\System\HdThURQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lozshsy.exeC:\Windows\System\lozshsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WDzCGmq.exeC:\Windows\System\WDzCGmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djsRjoV.exeC:\Windows\System\djsRjoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZKRFWE.exeC:\Windows\System\qZKRFWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHOBraa.exeC:\Windows\System\hHOBraa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RyykYZi.exeC:\Windows\System\RyykYZi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NBBWdnb.exeC:\Windows\System\NBBWdnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XEcxOoq.exeC:\Windows\System\XEcxOoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtdPMnn.exeC:\Windows\System\DtdPMnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iduFGOv.exeC:\Windows\System\iduFGOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\deCsluH.exeC:\Windows\System\deCsluH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyFyaXI.exeC:\Windows\System\fyFyaXI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rnIrTDe.exeC:\Windows\System\rnIrTDe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e7653bba1b717e4ba9f8bb0c2fdae7cc
SHA1686945943a6bc8b03e9dc7bd491f25ec78054338
SHA2566e4263d99aa74c7df627d1e52cb400b78860de44ea3a91a00251cf8dc52a2f43
SHA51208b5a05c2aca57cca8e23618adecff0c0f360a270f78bd55e065998c809b4369e7d12bf3dbb693eb0de06d77ac9f275799d2174d0509fec277c2686379b87538
-
Filesize
5.2MB
MD5d549585c4c81adb94ee39d546d82018b
SHA181f211b9ef8c810351705a6d8f2ac0af3c6d8565
SHA25654bee47aabc1b52a63e6d1994b004c2e22d1a2bea8b45a493e17a05dab8be896
SHA5127ffdbdb80ab4ec394474cfbeb0f74481e3de8822caf5f6e2f039915ecb0e1343da64f4544a03ad63fdb189be01a90c38ba1b49b08dedbe9d8b4bbaba44a86599
-
Filesize
5.2MB
MD5a5238b7569252ed345f287197f6becc4
SHA188bce18d59482725273e7a68c8699b9fb74eb7aa
SHA256ced0dc9515a6db037ae00a7e24d4d1da769a92fcd5de4067071f8a63fb8f8a04
SHA512ff747b5af5e55ee79880bc09f9ab156533b14d8bec1ee453fe7031261af9ad8a0e60c1108afd266e27102c362f23c93700faa17f54f4fd6929ed49dd4ab81f22
-
Filesize
5.2MB
MD5c137f578d3111982edeb58f325987995
SHA15a043d6694ef9dedbc9bf1b77099e40bd2b6f126
SHA25673d17a627a92b254bc441ba5adbdfa010e7945eaedba1e4e3837388ac7a3390c
SHA51232a3de44195f8d3a2ab06a24e325667e2673d11837985d8599c6de0c82bb84bc7645fcf27bcff0f00f8234980ea79d3426c9747c7accbf903a049d7425fa046b
-
Filesize
5.2MB
MD5cb7efa52271f1ccafbc99e07a6109e8c
SHA15bc226848f87b2ddab7513e373b6b61517f6c7e1
SHA256e549507d4ae5fbe0908d3a9d3a401ed161a9052a68b910f255b63c77400c1e45
SHA512c62bc0a4db588267368542f048847dc4e7c9e34a6c9db43da8787dbd0827982175a15e2da737f09408d4c564490c8bdc5263685f9e4b80e240c2edd5d3d5f8bc
-
Filesize
5.2MB
MD526d84c7e1fa8dc97d81b98e4dbe40878
SHA145b9fb6bef2c3dd8facbe2231cd261242ae66b57
SHA256746fb3dba81b8778a0af27d6b41353a08e0832d741daa1260a137ef1e6c0bd84
SHA512d6beb0ca8ada3cba4b7ad3d1661d22729b23f7b6fe302132cf5e1625ebadb8a56d312d2f1da8c1e2711b56eb69bd150a58cae8069849a1e0937d694f429dcfa6
-
Filesize
5.2MB
MD59f6e6f43a11cc7656da8019768ec49ae
SHA121b69f65b7bd7ce0988933b7267729ef29f71032
SHA25625c85c6b3f8cb68b9be583c1b887792ea0f8b34cf70ed5252c5f7c2c0254c220
SHA5123f54fa2456f9447bb55f83672377db9fc9a965f6b69dde49a5ba02b40f507fef6d0fda19a93baac90ec2430035c2c754421ac597ff072696b0f7381faf2fe3c0
-
Filesize
5.2MB
MD5716b65c467feb03763f875e29ac04d20
SHA15e388d696c3341004e51d5b0800d87721dbabae6
SHA2565b2fdbc466423da3e422060389cc31ff101af1efeac543527153ac95fcca2ea8
SHA5124173a5e2b8c1c6c0a14460130be802e69c890e4b70d396879e86c202b58af5800b472f191fffbd7ea2b8d86dfa4271ecf6d6708b84ed93c906218f6923fc3324
-
Filesize
5.2MB
MD55ad5bd3f14100a5b79d257a0553fcc8d
SHA1ef0378ee497968ad2dcd463c2d1d35af848d8ae9
SHA2566028075b58664f161495b8f1f35d8b37cefbc959c0a00d572218e49eec62756e
SHA512ac01d2a1bad6bddcedf970ac45928abc35c72e0bae3a71f8318d7f0aa6d5a60be5fb1f3bcc2a3e57d3262b7431025cc31a7abd11af3244c5c7ae531b26dc1c7e
-
Filesize
5.2MB
MD5ff98c72e928854a4f221911ad8c6878c
SHA1684b9880d9b98c8eb6f146e2104422bf2036a735
SHA256f77f5265cdd58ab6a0f308d9d10ebd8f025dcfd5d77c68341617d4b6a08faef2
SHA512479eb8492db91c80f4c125b5b725d191c936c0ad8790b21373c33d2954244e86227162cd4113a6bf6060f18709344629d670bf10355c44325ac51b581b794f65
-
Filesize
5.2MB
MD5b577dde6d825e93b4e4a24a671c92701
SHA1895fe2c404b6e481185143dcbdfc0034ab1bfbcf
SHA256085e5e0cdda18745e9d2cd7a1a91b56d97eb966c3c9c555d6d5c3b6127e4c540
SHA512e1958b0c561488754d60dafddc1f714e374a44f1abe3992d0e62af7296a9974f1cb512ae4317696e5aeb311ff254bb4ea3d70177a1844c2f2f6c90dca47675e6
-
Filesize
5.2MB
MD5c51f6fd045a0e00b612378b6d10411d8
SHA162a7864960fdf89654430f007967ba4fdda49ce4
SHA2568c0a6bec61be513a270c24905b31e4ef0809b74199b7b7f15ccc7fbbd0aa2fe9
SHA5126b198db13950515d4e79a5ce51794bde7eff96d0717b5f1fc75edf9c19ec3bd7f1265892fe48789bc4c3c4b18b41dbb73403bd145c3277dded5a985fe88f350f
-
Filesize
5.2MB
MD51c63504e48dcd8c6d577db16e278e6cb
SHA1c7f187713f851ffaa638c949291965d10de8946c
SHA256131466cf4e4f6c25fe2a79e0be31c50c3741dddc3e09ccf40991e7b711188028
SHA512d86033d102ca6a539cd9cbeab9a9b6fceae2904c29928c6449aced0c50ae052272dc5275b81359dc7e8827af3395ba26452802513466b8a05a8b0be857a2cf3f
-
Filesize
5.2MB
MD5cef46b998c3e6474d7e27d0bd7f1aee4
SHA189a356d862197a67c99555c9563967366d84910a
SHA256ef39fdfc6effb7e3e2bed0c2eb053951d245783ff37230e80a309d8222727b77
SHA51245480d8db3c84fa0d44e4fcc78dd293a9969b0a5542289d83456b0ccf3237086c8df78f105070d933305e7ef2ea088a49d27ce0d0f68e3cf9740d02774dedcbb
-
Filesize
5.2MB
MD56a5340ffce07d243b5537d00c54173ab
SHA18b3fc833ac34afe08af99fc7925298eccf17c3ad
SHA256262e1aedc8b7202dfc1df6a71a1bea1dbfac489ae953fc77b0be72506df4f47c
SHA5120d3056b05d1502274e1766ef7ca28b0ca40be8a10dea600ce377701eec89bff29a6726587ba09447174146b91ba1d041be8e55b9d739676cf1fc3e39bfe25419
-
Filesize
5.2MB
MD5e6639578a11d48e03043810389555488
SHA1b067eb218f7341ec0feb8c9035c9cac58f331efe
SHA256b8809dfb36826c2999a76429356272f58d253c2b620ce3c317d791d55e8bc192
SHA51297e432d13c6593ea12a0567d5620561542b7580d1c5c1ab77326dc9849ba67d579edc42a35757e6705f61b5e764ddb2ecac697e14a3efd6e5bdb45b1a858c552
-
Filesize
5.2MB
MD55dd6a1cfd2aedb5d4cf7324ec7b2a7f7
SHA1ade248d6e34d6f508ef6db5dc609bec319740829
SHA25659ea5872d73c5cefca29cecd9b37253746d9cafdf57b2c2d44cb30d7eb8feaf7
SHA512d63500303aa2410cb4b9e79af3c378864300b2e51926ae55f183041b517d43ab82e24b182307a3022e57f9cbc8e2a91582253f30a912401a112b55f5cba303bc
-
Filesize
5.2MB
MD5cdb8badbe445c66978979cbaaa977efd
SHA13d3ead348006f6c6c0a5ef49071ddf052063f900
SHA256ced69bad7108c3184f5049b05be2aa94189cb0c9f3ac37f3a21322de0763e48c
SHA5124a33841eb6e6013692a569e86abf0a48bd9e903e54341e6ee124d1ccad1286574318f0008e283c9cb72986f6a211bb7192dc4ba74638ea2cac36f6f0b36aff97
-
Filesize
5.2MB
MD54e792fd45c20db9c60a929ab8d107027
SHA1e765f8dc382791b8aaedd544e028c0e4d0969e59
SHA25686537a5df04617aa21f21503c891d32fda7907a2b03a5ae9bd97ee340c35dbe3
SHA512338f54d43bdcda353bc2a29c7085d834e8f1ee868cd00cdf0a43fc6923a7f1d4096ca2d0930736f129861b42449ffa363a0de7d874423fdd2f47c2fe9a144cb6
-
Filesize
5.2MB
MD5fac8f8f5b666d84ad19acd4dae60f328
SHA1be2f545ce002848f1365e0c7ef341983f16af811
SHA25615965c1cc86f08c0cd71d36c09394ad35217a3ae89b5491f594579b0ac384eb2
SHA51243889aa9fabc934de6af12a4150274b92ab1cae07076ec7ced0d3d74aafc161a5e86c429c2fabf20ad9efcef756c969b0092fc461e31b78ce079b5ccd2c7c24a
-
Filesize
5.2MB
MD5dee95baea3853057adc34fd32efffe37
SHA1c56ac9f200e10e0ce7402f422b1daa44a4c0fd13
SHA25696658dfdce590b4b8a5457097d7b3424578f18126713c95ed15ba34333cb25ea
SHA512ea3c3df7d5a5b8f3c0e47f5a3fa5de57d5b2255ea22c616330deb8fd71e90a9ea81505a7c5c7e87ff59f069ab54f7ef3679ad7fe903e73d37ee8ecbec0e40f4a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB