Analysis
-
max time kernel
142s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 04:57
General
-
Target
2024-11-21_eae85687ee7c925cc9573d97c5d14877_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eae85687ee7c925cc9573d97c5d14877
-
SHA1
2f6716ceaa3624d3ab4e56fedfaea0628e6cef9e
-
SHA256
1744ba95c58ccac86f3239e50fb1b7f42b5cab656eba3f08ec83777fa57747f5
-
SHA512
46ff68ba7c6975db0d40a0e7848b3301bc78b81c3fa9ac12e0fae9b79f2ef3095826374e2270910534d778c2178ce02b3f48bce274bbaefcc4c0efe02a56aa90
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibd56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_eae85687ee7c925cc9573d97c5d14877_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_eae85687ee7c925cc9573d97c5d14877_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FXqvmjA.exeC:\Windows\System\FXqvmjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLVXFBz.exeC:\Windows\System\SLVXFBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GoElTYe.exeC:\Windows\System\GoElTYe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBjJvVu.exeC:\Windows\System\rBjJvVu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dpWFexH.exeC:\Windows\System\dpWFexH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ILgQyjJ.exeC:\Windows\System\ILgQyjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XKaAMlU.exeC:\Windows\System\XKaAMlU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFfxsIT.exeC:\Windows\System\bFfxsIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\reYjmzz.exeC:\Windows\System\reYjmzz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtyRenC.exeC:\Windows\System\ZtyRenC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnMfwXO.exeC:\Windows\System\GnMfwXO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaXWvCy.exeC:\Windows\System\EaXWvCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cViKPti.exeC:\Windows\System\cViKPti.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MUTWysv.exeC:\Windows\System\MUTWysv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpUyONm.exeC:\Windows\System\fpUyONm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSgnMiK.exeC:\Windows\System\gSgnMiK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLGcyMh.exeC:\Windows\System\zLGcyMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhPGrON.exeC:\Windows\System\mhPGrON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdUqnVv.exeC:\Windows\System\cdUqnVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VmnCNzU.exeC:\Windows\System\VmnCNzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMJRiZx.exeC:\Windows\System\TMJRiZx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5011686c4ab6a8d38e97c9c692c74e129
SHA1d00cae01550b7f367061ac50f84ca12830944dc6
SHA25681e1e59bd68ed3c57becf1d43ee6e1e8545444aa204a8e4449358583e0f43804
SHA512927a76ab58ea2e66cf3dd411f54cc5db0ef6a77ea99d4d6c51385aa421c67d158d529f474f943d9eaf78286839e2801507ee238d848818ffe0f1f8428299212b
-
Filesize
5.2MB
MD50927accc906d76b7b4bc065e3ca4ec13
SHA16c4f3e82eebbcc0b90db23545c9c2544e6677cb8
SHA25685e5e1cfb004fd96aa758549edd230c92028c450364f4d5cbbdc2881a60d5099
SHA512ba3a728607b4cc751cdd90c67e0f916976d755ed6028ea64ff97cbb4a9739d536c909c92bf371edd65863957a9e700e58d96fcc76905b3148aac7945869a7f62
-
Filesize
5.2MB
MD5b98e3297c3daa6fb41fe7eeec5add292
SHA1c5596dcf872596b05a11a73fbbd9daf1f90cdbd5
SHA25696cb3e1d7a6c91885326bbe1677793387272182cb1e5bbb16ec706b23791eda7
SHA512efde678f12cddc0430652dd66bef4cb31cb559df95e3bd24c4973ef8fd493e46b45a536e774f3523ad0e8b9cefacbb34df9a14797dbcda84ada1464d98167e9c
-
Filesize
5.2MB
MD57cf7e570320b7f37c75275c68c2a56e6
SHA1c2067c8c2fc4b4f477c3b789d3fd973b10f3b6e0
SHA25618a393fb32cfba31dba0943aa6be8378839ecd458c36fba468c29b79801d3367
SHA512705ccbd52650424753e6d7ae23a1c384cf530658152e8edef04da0d33472195131d2d19f6c8d1299fdcdbd661b818a1b18f3abc619425ebfce2224d8f6d65f85
-
Filesize
5.2MB
MD5f26d343e608e213455e9cc636d185c8e
SHA1bf87bead1c1c9f619fdf3717667fde483e6301fc
SHA256a8c2677b662a248d8c95564f9c0df3ede608c40348e7dbd14f1f4f9c8dfba3ee
SHA51215e146f3bc21a7a76d7611cf98775dc5bca3892256d95d83a2fbdbae7dd9ecad3fe53e8de29cf2e4ca84023a0c8939bbc8441f6b497fccdec98663b95ac63186
-
Filesize
5.2MB
MD5c5d909b4ce40c87cb792866b92734f9b
SHA1e9fceac6ea9ec9a9629d644fec41e0b28343bc14
SHA2564ed706d5d01888ac67fd100c13a36e86a87d24d5e7f849a962973ffe0dc66740
SHA512d5fbba5ef8f9f92b34110b65f4635cc6f451b9c01f5725555202319e86d54647034ff6765300656d3b5e6e8acd1ba9aad2982d964da94259d2b0e3a81560ca19
-
Filesize
5.2MB
MD51d1e1eeadcb7bcdde54d301ff0a0a57f
SHA12d4cc42633a3bcf09b1913b37fc354f196afe7fe
SHA256fa7443a5e68ce1dc21819bf7e3c8ca25ca3c7be1819bc5315a66718e44c487dc
SHA5120869329b781a29273c1ed9250dcb8c77e007c3274a8979cce6417023dfa1d2a09dd180871e94efee877e1d7de190afd8d5995ab39eaa3f61a50127ae21369c97
-
Filesize
5.2MB
MD5fd9fe621eb161f255446be911ac878d1
SHA11a9a2b998b10da618dc39102180fdad98aef571c
SHA2566b28d2a187c53ffe99f31df910dee7004aa5003ed7df84589ae5d8481e312dd0
SHA5122b6c6e7608f52e0f98c958960ec85b7c543e5cf3a29c5ffd19aa318b5fe71cd7a3029306c0630a8ffc7694b681d57d405be64da93b652fe785de056f9bfd214f
-
Filesize
5.2MB
MD5711d0f587e680796aa28f93dfe77e6f4
SHA12f8bf61c9abafb9f0dffcd58b5e0a330c232921d
SHA256ae9a083791f5e9aa870e1c4c77cade52ba45e283276070d31d755595578a5a77
SHA5123672540a5c224dfc333708d437707e5e47705ff9b57b4cfb4940e04f0e9d217a5fc6741a7cb33470a819503dc33cce39057ee77f9d9ef813779f083525e207c5
-
Filesize
5.2MB
MD586058686d94bc711c510cd4e88879386
SHA1f4bec867ff68f8dcc483adb124f63f536c37e6dd
SHA256721896dec5f9dd637e056d535310fd824df15ff86d6587966ff690fe6dd9e97f
SHA512b13e4a4722c8cd9410833e44871516acaf4d032b999b4cd1ff9cdad9d14107df3f0f66795206211ac4ce037f16fc71b6fff6a52a32907bcb794a458a8d973c5f
-
Filesize
5.2MB
MD5a4ee0624d00e4aff2368df55b4e533a1
SHA1a337ae549ea26e36efc7bad630090a529b52a0e7
SHA256b77c42df0118edba5cc2b34f4ce100a9a3d70f9981a9a45381eb3b5a8a5b4beb
SHA5123f57545745553f52af5a3cb955d0962171bebc8ae483a95ca200f4a839b0a041540fe447ecf8ce4a08e6dbc3572735320d524d8a0c487682917fd097a2f71e80
-
Filesize
5.2MB
MD5cddf93b0e12d2b502f16bc237b5e6af2
SHA1039d01df934523cf5967a29010543b70acbcf005
SHA2563aa1a391111d00367a3878687c8bf238ff521e3dc52a5be9b8e4a0739ec30836
SHA51213798bd7d9b9e13c29cf22ed660de49a9424a411dca2d1f9cac9d19c5175cf2b5f47333a8bf70f6d75cac2e37f825aaa7a8ce7bff2d6d52ee388019ee5ef9c3e
-
Filesize
5.2MB
MD5db48e4e3a586d2d902297f410fa6e7ab
SHA10f9828e8eabc2b187d8e4794916a6f62871c1769
SHA256622cd49b5474f3318108f575efd5d95b438c4c216b91e0f2325a55998c04159a
SHA51273cc9f3f4cf3fe4e2c715e66e71e9b88067b8d29912883a0e34cfd23d9b1656dcb110cf84f2073fbad0eb8c87a15edd6085990b2ee0df84a6aac06c980db1933
-
Filesize
5.2MB
MD50124de49b125618fbd890be3fdeeea62
SHA1f691584557e9366d56fd9f57e6f8b495bbe7e418
SHA256e351f51163f4c3c392f75a0c563ff5b645d23df46bdb63d8658ec6ada6b198f5
SHA512a00132f183ce2aefe7b88d5c16ac738c91d356f2d6a945b65edf340e0bcd4735b851bd26f01ad2d7f27c20abb9ac4548c3f3b4e7372f9316632493ef99f71e2d
-
Filesize
5.2MB
MD59771ef08b224b14e902e22d2bcae69e4
SHA1f15413d57788e83fe2cfa6b4443ab0da24338176
SHA2560bb9cb19c6f1b659692afe5f050c7893fb97dfe38f0e752a083b43f118549f75
SHA5123307e6d25c1c02f07d3d9a254cb13cfc5f8fa4e38aeb002f4279063947afd258ae1dd1819ddb31c911e84e2eb462107c39e44f96fdb1a916a8dc901dac5222cd
-
Filesize
5.2MB
MD58ab6e2b907a1ba134ec7eb21fedce1c4
SHA1c5acc88be27f99bea5b4c22ad0ffc61002895d95
SHA2565ddbdb57861d53b1437d07efba344ed396718bae82ea3d1832b662a3a2cfeb4d
SHA51224f3d637608454d5a1908443d48d4b95aa97914071d63dc62ac004840695eb69188e01d5e619c3ae181d941db4cce6810c456dadf42db0a79c575e349848574a
-
Filesize
5.2MB
MD5ffa62a35400362816d9a97e6b937e4c2
SHA15c3608142cad8ca3c252ca660287ce8d645abfac
SHA2565f5f5659631ed0cf3cee0b1154faee0c1d7f51a1873bed0a83ee2718e8eeacb6
SHA5127af5e67a7ed869e08b899681fb98f2e7d13cd984fdf98bba230eb0ab80f45ae809cefa6dfb884cf08c199fe1793f44b0bd62b2df61e7b235b24e8c80a7b8370f
-
Filesize
5.2MB
MD584e72d2ccfa809e0d79aec8478939c08
SHA1ed047f5ba8d1be6188bc69d89d90a3963f81e41e
SHA2569136567f91ddc34fbc2ceb87218d8812a2a44b5a2248af6b00976c7e97d21c3a
SHA512281045ce7d475688aa6ec5a0cd4ef920fd240cf6bfa779e84e8a82f1a1a50ae57270a0b425feaa7f6d1a8de15797e4bd786dd8de9021538e874002230e23628b
-
Filesize
5.2MB
MD5ce6541d9a58260ca36277f38d0b5a4eb
SHA1258ebb0b73edc935034394586a69557e59afc8bb
SHA2564c673665666d847f112edfee6e64b615ebc319bc6263eafa7da8d7038eddb961
SHA512afe0164cccf57a744afaf69ad0e5b15d5ad95942bc978cd94c1175f74ad728fd450c3b5ca84d9fb22e1a1c95e68a6775230e1f32d1545af375b544f6d6987eb9
-
Filesize
5.2MB
MD5331865f75718a58211a46381890c6788
SHA1514d15f1d1211494d414969530c67ea8f536f4a1
SHA2565cda8edbc107bc983c84efbb0c249c6246666358b892e7613d087568d643ea34
SHA512bc34efc5fb4c75334e522d682f692b62dc503a43bcff98c1999a64499c2343062061940194c3752c6c8234b9b27259199e0cf25372820a20099cb936706a613e
-
Filesize
5.2MB
MD5d89508375fc3c7e9cfb19819e675f76f
SHA1812f0774cbc121f4eb101afa4f02f299d95eef1c
SHA256838eae399cc70e33c6d93b77c169244d917b3cff0b7907d5cda6adabac880c33
SHA512e86b4b8f6d6e10c2b1b3e42b37c7f48f6be96b576222499128fec9b6c5b537bf82cabda5a35a0b64c5ff194d2d40eab083be25979a83a41bed34504bb7c1d7b2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB