Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 12:51
General
-
Target
2024-11-23_5c5329fae83ae83617c5aa58f6f24f7b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5c5329fae83ae83617c5aa58f6f24f7b
-
SHA1
136821128e727064c48a053070aeaf09bf38fc43
-
SHA256
3f0a9a4c86aa0d46f60b8162934d3832ede261583addcfd955c892c37f5daf40
-
SHA512
2c3a876f72dd92b96458300f058b020dc66b6978c0e7f6b59e2fbddad24b6c21f2f001e564dba0c1b97d8d29904278f09a509215b999c15589dc734b15fa16e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_5c5329fae83ae83617c5aa58f6f24f7b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_5c5329fae83ae83617c5aa58f6f24f7b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gUIIRrr.exeC:\Windows\System\gUIIRrr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjbMEUD.exeC:\Windows\System\yjbMEUD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxiNEHc.exeC:\Windows\System\dxiNEHc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcZXNuf.exeC:\Windows\System\AcZXNuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FgpGogj.exeC:\Windows\System\FgpGogj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbjZfUw.exeC:\Windows\System\BbjZfUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHjDXzb.exeC:\Windows\System\tHjDXzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCbJTOP.exeC:\Windows\System\nCbJTOP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcGlAmm.exeC:\Windows\System\xcGlAmm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjEGcns.exeC:\Windows\System\HjEGcns.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YOCakFQ.exeC:\Windows\System\YOCakFQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZQkBetk.exeC:\Windows\System\ZQkBetk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mFQfUJg.exeC:\Windows\System\mFQfUJg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rsoQWbB.exeC:\Windows\System\rsoQWbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWgFKBx.exeC:\Windows\System\nWgFKBx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SDUnplO.exeC:\Windows\System\SDUnplO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUgPryK.exeC:\Windows\System\DUgPryK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGZJvia.exeC:\Windows\System\NGZJvia.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSJYIQK.exeC:\Windows\System\PSJYIQK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FetxLmJ.exeC:\Windows\System\FetxLmJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RVGGlYV.exeC:\Windows\System\RVGGlYV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53dd253d715f6b6af630fcf1dd15cfe31
SHA16674832af9c9ddf4fc65e4bf3330192fad90a4a9
SHA256152de9b744437f2b76fbecd326e64a1043a6580062a5fb6deaf0acb84ec9ef79
SHA51273f6a0aadfc2389873d15042c088a23723cae875f51a883d8f2f4ac59280f92e71ca4b925082799711af2d3ba4aff18b953d306364dbf4d44a518194c82be4fa
-
Filesize
5.2MB
MD5157df62fc4abab60c7cd9f854037fbe0
SHA16858cfdad865bbe53ac8786779aeef20c2ff08a8
SHA25628ee6f3dd1b3178421a95202d962712d92741d118c4d3f5379daab496627d90b
SHA512e34bb098e10839013e09726ba0519d09b5c9712efdcf9f84ced7c16226d1f055e48ac1f2515fbbdab56515d37f9ad4270cfdb10dae7c90281c88c59a0479782e
-
Filesize
5.2MB
MD5b9605124a3a79f22a0dd925f2a600775
SHA14e99e79b0371067ef552d8e9e1b8de9e69680040
SHA2562d74f3d2f5659d97c8256b2ee70c8a0e327e7653713c40afae8953e890ab931c
SHA5121a8a214eaf256a47905fd8d86df489004744d269fd188b635d01d10c28eacadad5c4799a406e95fcb2045bfb214c103aa61cf9f76b466e834944aaa1629da7ee
-
Filesize
5.2MB
MD566959b6faf4d71f95e1af5617b5a03df
SHA17061d7be678f871386d7ab336e46d05e9bf0fb41
SHA256cb5b4bbfbfc541db2437b3ef16528b9ff5130c7bb66fc357440ff45490d6d81f
SHA51211a013ea07b602e21c0ecf0676499729e7f3e8134d467b3df727b51b711bd1d6fc9d93227d2eb95f61735367b8c2a2060975746bdf6816c2753a5f415d71ec68
-
Filesize
5.2MB
MD507cfadca1deb8fda96b34c61034f9bdd
SHA1eabd18f4a279b5e8b5d222466fa4bc05ecdaa718
SHA256e801248967d6b1ecfa68fd4038af12585b62d9c5e6c4f867232930cfb3a9fa52
SHA512cdbd20b5f73aec081494058d325ce1093139d72157e5e75f8350b6e8c880828406ef39ee0ae53ef7d68b85f5a3fbfa1f64ca8bca4d61ba82628d49f8e6940024
-
Filesize
5.2MB
MD58e05dd3fc7c265aa35b4e5af72347580
SHA1f6a4224dbe4a08c254928adc004ed7d0fcdb3eb7
SHA2567d23c5f2fa15c473affe01b641cb9a6bd35a17cae83552bac94b21125e6d987d
SHA51272b2bdb038994360d561f4a80ca560289a8a226110b82be9b237aacddca179bd7991697c9eff66efbde0359467a77cd6ec7bf0294c0877e116125e02405f1909
-
Filesize
5.2MB
MD50e71cd1a03084bfea5d83d2ce51e39d7
SHA1f6610668477cf4683aeb6ba9817bf15419f4c27b
SHA256d3f430974ddc15679e9b2819cd696311b10def1fa79f40511d23e8589c4dcb33
SHA5126d4df785da88308482285b70dbea601189e40c825442537406921ec9b85a2f26b52fbe060738116d344cb5c17d8f9296ebb10c55f679d4daaf8ef2530e771ca6
-
Filesize
5.2MB
MD5b753e64cf292acbd99c8b76986ccb205
SHA18969bb50f950ec3806214fb8d18b5f91ddf10e38
SHA256fd1ca55f3dd0227e7ad02f93ca22d524eccc83d88627d42921c5a09f213cd229
SHA512974a4141c7f7b3b143dd6ead27272dfac513055b110538934f830b153afb93f2c3c5f001012709019e8a277a14945ee74af49b5e34f21b438957f274ee9e990d
-
Filesize
5.2MB
MD5ebf127c627d3cb3b5eb7df78584737bc
SHA165004ca7956bb2b97568895e338518b4b2345bb1
SHA25646fa1dd4ca0ee15cf66956b8c46256cf13d186d7d85e028516563fd32e98185a
SHA512f2e1c9640c4e580a00ca72e8b03123015a9536827d62782f204182c342fe8d1383bd9a9a8316fce27d823dc3af3544e37a71c44b107f5739b28b87d158eefb4f
-
Filesize
5.2MB
MD5a8c33ba41c2570680aa7f025890746df
SHA1692593626930000a6608b0a55c296083869790d5
SHA256a74bed8ceb5b9c499d152418d97590a70dead46a384adc2405cc48b911628375
SHA512dd350eb5864ac4783ab0e986980d1843a8153d082229a640eefafba4f527e6409ba42058e8100e30152c39e1798c35cd7689f88a750b4d9b46f1b33796119ca0
-
Filesize
5.2MB
MD5db58a167ac0b729e9f1fcf4f23433783
SHA15cb8f2e2fafce88168fed0b79762e1b0cfb68ad9
SHA2560e8bcd69d651d2cf53fe62cf3979bc5e13e918c80406b52d62ea56fc9568e8d3
SHA5122a183ed3ffadb7b9a3693b9e2f506f7dfeba163ffa3a510be2df75d28b2d4693a0f7fbc5e1007da0def3fd0b2127984ed97150a311f30c756e80d5e2fb6f5aa3
-
Filesize
5.2MB
MD5953eb7d75fb536c1ba3c2345184b9d0d
SHA1b5c3ae630754face680052b10d79dddc223a04e6
SHA2568d76a4484b466d5e01ee9a8206d1e1c7da41b5e3a39f3ab56108a394bae7b37c
SHA5123ff4a9327daafb360c01a01f46028debca7258a28b4553bae78585939e8ab1b3e2d52d3daa9237e6f1ec8355c7cadf14cb863b4636cc16f0e710aeeb1040984e
-
Filesize
5.2MB
MD5983e8bd1c7675869eb423afd574038c5
SHA1e2347d6e2db785ac84c853884736795c3188db00
SHA256829b3e76b4f41ff38190b77e76ca7f41580113e017ae45e2834c48704247d4fa
SHA512d8478fe1b7c7a26d94bbdfa78bdc9137904e48fda7f09f2693b310d81d077b026051e44f89951b9a640d0740ef1019e783e1fecd719a916d87da8e883b8eac56
-
Filesize
5.2MB
MD5d2a81880f1bbf38b3a8ec4d54008456c
SHA1b052316b0bfd545ebfe16b01131ee8789a1f7178
SHA256aede13751cfa90f45ccc6c32a709dd54cc9c8efa86a8920fdcfc9aea03555d61
SHA5124a4ef2a5aae6cd49063d3da3c5356259d850f1f7c122cefd3c3c0c7e033ea5d0de3951dc62676cd84e62a23641c2b7a1a71863f3f344f6c3ea8b922e2ff50b3c
-
Filesize
5.2MB
MD58013d06d2802b3980c3ee9fa4699d615
SHA1e73a679fc3e6d0c6df11a338b6567a38f44aebb4
SHA256dd8cf011f763f744f632ad1dedaa01d99a893c7855e0a372d9a2f8ea4df6ffbf
SHA512eca8f9822866448045b7507daa3e8b50ee5735eee82cf3efae0d3e2c39c95fbabe272195fa194699356a9f4e37a788bbcff41bf27f9be562b3d9b8cb37586775
-
Filesize
5.2MB
MD5e7f19d398e1b3735749ddda44a2d75e0
SHA179f5f992a3741b3a578999b41ca5b1cb7fe7d66a
SHA2560414d0a40468d51c7bac11d77691687943a6e67b220c8e145b0edf20f71ab7de
SHA51234b9f501929b7e4486c3003b31bb110d3c7f883b71b093dae30fae9bc0295608c49397fdaf51325e37d223be76094355ae18bbef348552a609a7fed8ebcaa445
-
Filesize
5.2MB
MD5762a7afa8f9ad6b7ac02f52b892deb8d
SHA147e61235412517a06964a183046fa9393ced8946
SHA256a7d635d79f092989402e11a8a59caeb272786c08a530c8aa7d06e3330b748d80
SHA51231e08cb2766f32867455ec7047fabba7adb77a17c634e8419d27e0c4322cee0952424ccc5453fd5d11f9c93ab8c30fa7d7b3fa7298c53519e3ef195967ef35b8
-
Filesize
5.2MB
MD523b13dcf5aa6190c8b7106105c7df7fa
SHA11ee43a2bfa9293d8d3312e850a5b118ace0ebc4a
SHA256271b411b760ef88416d5c5cbab21a05344f30b1842093d316cb6664d220f7590
SHA5122af8166e72e81597f68e499a524e9d36e7ff4f61489b6609106352b9c2c9c8a75229b9c01ff4c51b59c5b0e24f86bf761c2d27698d1eada65916450257804315
-
Filesize
5.2MB
MD553ebd3ac197694fbe427dee1070775bb
SHA1a9bbcc01faab8741023ddaa94f89bf0054b13fa0
SHA256b6fde6a16c73e1acf4ce529fc2dadba9f0b158f502bc72543875650ca90877fb
SHA512b52c7a74289ec1e4c4fd1e16e4bae878a19f4919cc7dff1e7851646f762a29d99f621535d5e775511b012d3d6d0103200ec43a2e29442447b0201aa23a49808a
-
Filesize
5.2MB
MD5da10fcd36621dc67afe42d7850eeb12e
SHA1833d2858c28355e78ea3f00d04d463d7cf542372
SHA256801a90c53dd6a42a8f0d302f4f1ac261e239eefcd39071a5f0a79038ae0323da
SHA512642e2d3c8f89da35be58a27356df0615b4a8b880699edd64aeeaceb18f955b02c31b2e887a5b694f2ce4bfc8e8d9309f8302c6f724bd7998cac40174a225b479
-
Filesize
5.2MB
MD536542481235fef8d4ced655146f7264a
SHA12537d1e3cb6b0a3a3e89cff17be8dabcb08b35d8
SHA2562efeebcff4ff94a87b6e4ccad9b50a6a4b43c063989f8d46804ef6820c5693d3
SHA5129468ef5e5e7b3f202c35d4a3cbd3606d723251638641df6a9448ac1324bc23bb29da5d11b1befe5e07b8c81e295697ce4c6a33d5bf8e745db5b7133bfd45877c
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB