Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 12:49
General
-
Target
2024-11-23_394f2d71e5bc4b0cd7ac3506b2cb43c3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
394f2d71e5bc4b0cd7ac3506b2cb43c3
-
SHA1
581dbd832a359f8b5756f57d6f21d02fbe5b9252
-
SHA256
22e448bf096356f93b5576582aceb02133036fb2eb0dc5d456df781acacbe750
-
SHA512
d4e879ee170d2c077435bbe183b006ad882e02ec8809ca717d51a98e9d7c69d95bc674f0fe3045bf3ed8744e906059cd3169028e614d91de12131e055775a56d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_394f2d71e5bc4b0cd7ac3506b2cb43c3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_394f2d71e5bc4b0cd7ac3506b2cb43c3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bVonXqP.exeC:\Windows\System\bVonXqP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wscjdOp.exeC:\Windows\System\wscjdOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SuGybMh.exeC:\Windows\System\SuGybMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQKRYTh.exeC:\Windows\System\YQKRYTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\epzaJjk.exeC:\Windows\System\epzaJjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olqvZqD.exeC:\Windows\System\olqvZqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOgahuc.exeC:\Windows\System\iOgahuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YOFKCBQ.exeC:\Windows\System\YOFKCBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DkNtUKg.exeC:\Windows\System\DkNtUKg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wrMXdhd.exeC:\Windows\System\wrMXdhd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OtaPoBC.exeC:\Windows\System\OtaPoBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DYApcML.exeC:\Windows\System\DYApcML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJCWmAi.exeC:\Windows\System\FJCWmAi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhoRcuF.exeC:\Windows\System\NhoRcuF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxSHEsy.exeC:\Windows\System\ZxSHEsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNdeeJT.exeC:\Windows\System\gNdeeJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTRwchN.exeC:\Windows\System\DTRwchN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQwUeJW.exeC:\Windows\System\LQwUeJW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QziejYn.exeC:\Windows\System\QziejYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcXnlSj.exeC:\Windows\System\KcXnlSj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhTxODT.exeC:\Windows\System\VhTxODT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59da195e3a51053e6c572f7d293b6b699
SHA1b70f39bcff1ad4a0a7f4b688e2a357a7096d32d6
SHA2564368e884cda24b7bb211bf48092f14320e7443be500cefba5bf727ca94b44acb
SHA512313704247f00218311e9aacde2162104b12de67fd717348f3f07c502bf7cbf03f8eca8715fb028cd19c4186f69faff2df466eb366a3f2559e50285bb586a5aad
-
Filesize
5.2MB
MD50c1b7572a60c9893b688a7a4f64e6af1
SHA1037ae8bed247a5889c190888f5a105b1d4260f5e
SHA256bcbb356b3a046bc7d7e8fc5d2d5a22db233c405cca9937b7bcb0ae4fcbad1ede
SHA512a213171d839145728fd06fe1b1967439163bd9c24a2f968bc18029b7fe31810f545c741a66be2904f568fc3fefe612bd5b25e6a5a3fb1fcc3d5f934ff4ced389
-
Filesize
5.2MB
MD53a904a67604fe59d475463396486c985
SHA13a60dcb910608e8d774510ee064cffd6825996d3
SHA256eeb9bcbcc5ef56464aeb78daf2a5b0a7d98d42fff8ecd2bb01fde2156d5c0d73
SHA5121505a8247f87603752067d62195858c7c7b03cd3c0b379a536c72f309f12bfde013750366c8c5aa83739a3851c7a9770b4e465e785ff4e191707990c1c52d04c
-
Filesize
5.2MB
MD5d97280a8d3b65b4ad9cd5d988bce95df
SHA110c6f02fb2e9c81230d1ac14f9abc0702d2226b0
SHA256bfb6bf313a8501ab3d557c0a5e134fd3d56fa45881aecaa1b7eb4aa7ecd1c64a
SHA512c4d41bd97486d08673c42339256f3300f866c37d70e969edb7a696ad88ad5a006bb9e6bbf43d83e43b9a4c1f4140821a430984cd53cee6015fd439fbf74631bc
-
Filesize
5.2MB
MD52cf0a835ecf69c871fc816c6d6f6da3f
SHA1927d3507f2c4f0b8bf8de392927ea4cf5c8eeefd
SHA256eba5c2fba90320b4d1f853b38bbf08e874f4e7b9f4ee7d551d05bdb784cc498b
SHA512f1ec0af61fd54f505fc192011e8bedb4105f6ed9a86c684a1708a7618fd481de676a6a47679d21b80f0fc5eb844f5fb0342fd29c285216cab7e5ba382ad5033a
-
Filesize
5.2MB
MD57543cbf9ea58b993f925b71ab9b2b75b
SHA10e06288c62b51c8e7bcda8f42fd56387a2f66c24
SHA256e7fb55637e5d4a9ce54a5512d8652e89465b454ed698c2e53a4a7029f18ab681
SHA512a52bbb07bafd09bbe7648b93d3dba18234c984ade678ff63d59665f34151a04e4ae0fdd35952e2465772c3f4ae8dd3c6b3dc9cb93ae06dc8c1514f1758b2791d
-
Filesize
5.2MB
MD5a095304c02d036c6a20dd5bd1f8c8dd4
SHA1e75d570d80e63cec944e2760c9c1ada7735744c4
SHA256c37df96cfbdb5b26ec3640117ed86d4c02e3ccd2c65149e3d450571c5f534e54
SHA5128dea915f4bb37b78d1971315038a1d8e75c133ebc8e5b313d34bba5cd6b2718edaeb3b981f60f0f53bd02385018172e98d3db0eba96206bfccf20f505b8b5c7a
-
Filesize
5.2MB
MD593b5d7154cfc4e30d6144303620bc5c6
SHA1cd57fc40c68f0bbe7342b02f0841ca6d7166792c
SHA256fb3390fa744102156c2d52a84f98436343669025a426aa3a2166cdd06edd660d
SHA512c59fb8fa77fec2d24713df74ceb66833af033adbd1c7928f1386b6d0abc76fb7f753f21c3afb89855a790632365f846c1d7bb826170eb64a361af7fad2b06289
-
Filesize
5.2MB
MD54ae275c2a414d325a9f688e2f9273775
SHA1005c0943b9f8c20f0ed56ac8f3be382393b18824
SHA256f14a5386b4e8296d7a5119cfd741c683e4506812abc33ef40f86c59ee09ae61d
SHA51244d076594113b9bd3b6bd452ba63ca7329b313bcdad4071c929f4e7eefe7f09a28364e4e9fede5d3fff99beb693260045f8b4f75e34a122cff904f5d1abeb4c7
-
Filesize
5.2MB
MD54cfd1b32bd199a8db4f970ad094e7412
SHA155705246f0d15101eacf82c7b91fa463e436abd4
SHA25602ef97c2131ce2b08495b302780b3c5b9ae24be5476ff3c8dca1eb0e93e430ce
SHA512227c15eb70335d9fdcf88bb04dacb746b81cb2098ee5594542ff252c2d2034c993e21d71263b5d4bcec6374cb8026c9f4dcdc13ad48a56c76088d4b358d1d5c6
-
Filesize
5.2MB
MD57fd004e8fbecb35ae7a1e96861df561b
SHA164f609851b5b2fbe80c6922c861f604b3f7fe426
SHA2565c2cdf556793607f37b64898c04c8532517e7d941c334085c875c8a37a1c7342
SHA512161cb366ce347dc9f886c7a67fe22af237efc32d9603cb5a5dd2f49d415f4d2f9153cf84f4764f87f4807bd37bcf3285ee5076530ee7da5078c1e27667134dc9
-
Filesize
5.2MB
MD59c6798ebba4355ff87d70102142fef3f
SHA19e1cc38ff3af726b053879dadb92d030a09c2846
SHA256bdf4e16865b3e636eaf3801ff2d8c506bb93c54ae9db94d8d52816831fe3c45a
SHA5127aa6745efad94515a24b5fed2687a48824083e8d0e1a20f4172eb1d3d40d79de473f74e1f4d10c560b3251868b2a4ed3a5fedb144d7af0b598666c25fd44b309
-
Filesize
5.2MB
MD5a7e1bc9f283a033e3c65ceb4bd0a4556
SHA1c668f9ba3ea550c1d1a5097689ecb5110d2bf628
SHA2561234ca14c03b5a44788f018c4a75cc7072d4a663db519a0f828cf5b2fe22d4b7
SHA512171e9bd279cf4187fa9be16787a17dc0d6aec42e7a9d69d4b4fb34b29c6fb9852a77210a5fa53400a3a6d1fd1df21aacdd791cafbf556f43d40c2a58a70652c2
-
Filesize
5.2MB
MD593b12cad20f4d38ba01d129ba4609343
SHA138a1e4560d1680e3e0c26cdd18f450d1de409433
SHA256c7b3b4983a10f6e96f5299800cdc7455a8e09a2479ec3b55a12023d0dfb04944
SHA512c0795a2c3cc9e2e3c40afb8029ce66602c09ac602661ced50ac7bdd27e2ca9bfb1d3609695f4e87182bad4133d22d62be259e627015161dcc153aa9bea5232cb
-
Filesize
5.2MB
MD5f3063eb877d97a784bf3dcda061fa07b
SHA186ee3fe245e1b1349cd96be4d01066e6f28248ed
SHA256d492d51d392bfe7b9da35aa823f9cee70c05f5356bcc35b960fdc50cf763d110
SHA512894ee91d6f81215d647dfb3a4490314381b16ef6c8448043391b40bf47ac7a3a5729dd618e1f08c52302f5cb6984125f42d0781c7e54e135dc5403a9cb544a09
-
Filesize
5.2MB
MD59f948527e486af81acb570530c137d8f
SHA1019d40bf0d21e0af64c8019468476f1b1c3156d8
SHA2565214ddd7867aa4171142c22b6733e21c62c7f3916fb3b590a8be6ee1c6c2a5bc
SHA512a37400a2c7e7ff66192e1f27d3ca8621c3b397a388324678d7060751ab84960e9a95675db9a9b75991b70365f46a5a277dd5a8fb862a45032b2139dffd75b0ea
-
Filesize
5.2MB
MD5b64f1f297d8d15f70d652d7a7f16e0d2
SHA14d6ec647b8db2998f285ef6ce631f8b680aa5839
SHA256d4d26fdc18ccbf975d7502bcdbcd9b4fd1045a3728efa2a8e23a80a5b5085e33
SHA5122b01e8c368cbe8c879b21a5e83377298afc24651741d69e95198ba8df404e097a753c9ced59dccf6ce8919c84fbf9fc6eeec6a312c25676ae3eff545dd5bfaad
-
Filesize
5.2MB
MD5402a5afd21cb53d37ebad81ac8a47120
SHA1737e75bd08f4e13dd0a0464bee2acb6b142afd9c
SHA2560b4c390c24c990abe153576ca4a8d3f03185c644f45d3cdfaad7756c12c8d526
SHA512dd83c65b50e9cd10d248b0fad68e66c941496540e832b0df249276db083546f735723078c62eef0107405e27b8274d857b44291fada6191fffc3a831dc757d04
-
Filesize
5.2MB
MD510e61a92f8bf678ae44a6ae126c31133
SHA109a8ebc0c1d61910793af28e3044e5e25ca6d2b5
SHA25652b90bbde07b25f0e690452075fb6d113e400e4b90fb80005e42385215a8c302
SHA5122bc6fd4fe92b68e70770a177d42136e342a8a94244194aefa8417784216df62459a452b477ecc17105787319012e517792622e1a04e7afd659875faeade8ec01
-
Filesize
5.2MB
MD59807a98059e166b9a4ac572b0824fb24
SHA18d8a41de25a668e9aad7fab624df57d6e5a652a3
SHA2566eae40738af72e57001505829127416ed989fbca69646439de787f808690fb0f
SHA512cf925a5ac86e81e756b693244c940eca8a33f707d7db9ecdd8cb32831b9ebe6b777ea42ce9ec36033743f08bd1ee25cf949cc5d7260b43102de8f6757e1dbd50
-
Filesize
5.2MB
MD50f9c9b6f24e5a99a31b83d316e27a993
SHA1a9f6379ffd31b4cf2cabc2181e9d8f861298ac65
SHA2568a877a0027a9c7b4372ad9c03903ea22fa9cdc75e80ac46883cbb0f8da5ab4b7
SHA5120b17a5556ea99a47fcecd88984fb7d100cf73a3f256b597c55591e07cb8d3d4013731955a92901d43d7c9d607417810f25a8327ab221aa357afb2915177cf11a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB