Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 12:25
General
-
Target
2024-11-23_04169a2a39c3b655025e066ddfcd540d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
04169a2a39c3b655025e066ddfcd540d
-
SHA1
33030882e8c96718b7a58a3d5c621fca74193dc7
-
SHA256
46e976125664253216f5339e8e0f1a83637a5b7c87549328a68fe0730c312437
-
SHA512
14c6a50046c017e1c914349011e35d038d0afca03e68209d117c8305e4a5196bf120c2db3945ad1aeb233683a4c5beccbe4e5468f1b00f4056eb68ce77599a61
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_04169a2a39c3b655025e066ddfcd540d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_04169a2a39c3b655025e066ddfcd540d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CPtLdce.exeC:\Windows\System\CPtLdce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fbOviDt.exeC:\Windows\System\fbOviDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPrqwYu.exeC:\Windows\System\yPrqwYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUagNZv.exeC:\Windows\System\sUagNZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeLjNNC.exeC:\Windows\System\qeLjNNC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqTgadN.exeC:\Windows\System\gqTgadN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HEuDizc.exeC:\Windows\System\HEuDizc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwGPicD.exeC:\Windows\System\CwGPicD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xtozDUw.exeC:\Windows\System\xtozDUw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FZjNSUr.exeC:\Windows\System\FZjNSUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWmzOAy.exeC:\Windows\System\mWmzOAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OfxAaoU.exeC:\Windows\System\OfxAaoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oLLDHbB.exeC:\Windows\System\oLLDHbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfvAYDZ.exeC:\Windows\System\jfvAYDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugjTDBa.exeC:\Windows\System\ugjTDBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJCVjgY.exeC:\Windows\System\iJCVjgY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIKPcIg.exeC:\Windows\System\NIKPcIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HODTcGz.exeC:\Windows\System\HODTcGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sxDgiZz.exeC:\Windows\System\sxDgiZz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rDcLEOZ.exeC:\Windows\System\rDcLEOZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DgMXNQE.exeC:\Windows\System\DgMXNQE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5246b203969c6d7bd25e001c19e9cf844
SHA1e3ef10ee7f6a964a285b5c77ada789316da895c8
SHA25673b0dcfe42584e8ddafd02839a79fb1ada81a8596ba2560043030c597ce349aa
SHA51213cc92af0010ab5951865830a23a11531c1366d56d125283e4a0f683df894c45809dc160d57d894bbd8af55dbe05e9f6d2827a74b81c63e881e3a59f4c210681
-
Filesize
5.2MB
MD5a281e96e6e0f60af6421175de99b1bd5
SHA13bde75adf4d3f21a2673dbed6019c9918064efca
SHA2564884d476bce1c6ca534c357c31c781c5a7b6fdbaf50cdc6bbb35d3d3a3c844ed
SHA51212fb6675bc761952997fb8768b8e043140ff42d01b8ae1c814c6170eb54b02cdc3f9885f4c60f675a2fe93ed5a3656c997ad2a1f4dc78a24e1fe8f248d2076e5
-
Filesize
5.2MB
MD524f1b700824ce3a857c22bef9d1b3cd4
SHA10570fef8877de0b589b2627911e9ae2879da9904
SHA25644a7e9a9f9a3a2410669db1291dbfbe87da2a8eeae8926cef81d28cf51324c60
SHA51292b13de3c2ce5faef21e59cf7e54ca2f2cc7df93b26e6c2880aa3f2c1e1008d3503d9ae26b706ea28289043a2527fad194a6f28f696c91a9860191a0836c4791
-
Filesize
5.2MB
MD5e03b293ed66db3da51ee8ee2f883ae94
SHA11f049b1a167902a9ff2abe859c83efd546d9e0fb
SHA256091e0d723e70ac660a94006bc3634bb8994da31b151e62e36138c9cb64b0dba4
SHA512d2320c64dc8ee57ebdd965a84a5832829a438f5910bab620462c4cae7a1205d1cc4c5fcd4d40c21ec9771ae97aa7a281f36970fc239aa98bc8fa1e270d28ed9b
-
Filesize
5.2MB
MD5211e43722a2be57a120a2112b2e5e5d1
SHA1651d0e6700d493c9e9b80d759e4c171e811f2864
SHA256fc9000d049a4cfd3c178aaf492c7fcbf75cb22b0a6ebdf46c804fbb572baf6fe
SHA51280733b4c7b174557ed2475e6c6e1cb94d41814a32ebea1bff308082795219578360eb486a1f00bd6bb551308eb43b36654d9d467d7d6b66bdb5bc1227c511fc1
-
Filesize
5.2MB
MD55c833f09ce96b0e2ec44d1ba83067442
SHA1ceaebc77d6d1538b571d2cc85d426119b1db1d1e
SHA256385b589869a379b9c4bd6955a37d503db1a03e7eb774318c7d548c5c25c189f5
SHA5129f53a195056f3481dad9a4cc6e58d5d545321a49c3bb47632ab4b323b3f43b8d06d835d013bd5c9b298faa987d6ff675b8dda0eb2386794e356b8162dd5f21f3
-
Filesize
5.2MB
MD542dae1502042dea319689f2590fdff34
SHA1255f751c810c243a8adbcf6912eff68cbb4796e6
SHA2562a7bd3c3444d23d593ee05d4d42bd3a70ec5b1d6118569298c6f2a600ed5fb85
SHA5128b9db105fb36f2cc5575cb00cf2ef41b0ca22c4919d41767be2ca440969a0b9381d2190f1253336357f4a7874fa98e02937e105be0ff1cfb889aafd5e33ff2bf
-
Filesize
5.2MB
MD53863bba6cc348be257912c6aca271b20
SHA14d5adce10a1666b92f7dbda1f9e798ca04aa8f79
SHA2562228e586fe33da64556812f891c763232c4dbfe0dc9fa7d36e6b300198b9e9f7
SHA51226005a0527f99c4d8e5c716d0ba618f18c549975892b685177c97a2e3277c8a9faefa9d57922ac750a5dec09aabaf26b87a8553c28171405e82bbe78f291a156
-
Filesize
5.2MB
MD5c5865153bca4198e4271e17fcfb4dbe8
SHA1a3422fbac5f4ef35b1954c53cbc52e3025f91a94
SHA2563ca5052ae957b94a4df5564d7cb12ff1aa01a916964b2c675d8235d517072072
SHA512991c60441cb06ccc41feadc9d735fca046b1fd06155ec9a39666e8053f04405519d9edb9861be72a9843504e6fb359a9238312262419cc25b2035631578e218a
-
Filesize
5.2MB
MD580b3951d53c572f4ea9aeadb8ad140b6
SHA1802994b8a3eb40c6dcecb01742278a51e59d57ee
SHA25612b9e059f89edf6a057764e43eff7112ce521955a92595e73f017bf195ac0155
SHA51208c65fcf98e883e0c099752f78f46e968b3f16c638b628f904cdca15b83dd3d67628eed042ae22d99a1af32e79dbf0fa0259034efcd405dde391788e5898a682
-
Filesize
5.2MB
MD569ccb1e00578f830dc253d0115347906
SHA105d6a8cf00cd3ae0f917a57b996b742d276f8d67
SHA256a40222b41e236ac9c69ee1947dd64456624305fe8e4dfec474adb7c402bda56a
SHA5120a8f322d9b4b0bb33ee736aff164e13908e6817afa9cc6bedd08645c561e4cb634e396ce1606addc1973eb182e729f2a35134bb0032758159e219679ccaa61b4
-
Filesize
5.2MB
MD568a36899bdf737921fe76f7d2e8c9e04
SHA16c4d3b510b7535bb3d22f7fbc405ff4286d56ab2
SHA25629aa34784fe0a050038282b103d2f45ab135754277c6b9e6482970ec1c71ed14
SHA51248647a93cd380cd8e93e7e50abe6b64cea3f33f0c8e95b3ff095abcca6602a9d3c3e87dff96e6692b39a400f5f3ef1cb9fe5fb48291ff6ae1b45cb3c00c8e634
-
Filesize
5.2MB
MD5981a93b9a076d51781188a2ade0bd6d7
SHA1ddb9301473dc16ab1546e04becdee127826cbd24
SHA256a3b8847f120c531393dda97ebcc49eb6e71e9568f0fee6008a6906ac3be027a8
SHA512070bd932d4add8163860bd05ae26614f794ae2fb7480d8747fb11cc672631d6b613de860e41f37f3a74b9142f29595f1def8084c96c57e8715ed8efb4f0df1b0
-
Filesize
5.2MB
MD5a201c983db71a91493a240ab2b3fa98d
SHA143299bb56f0be953abef14d78426b2dc86b70b2f
SHA2563f1ed74ad40cc7c2c82404a6bad6028acc2f60544e7d213b270ad155014aee7f
SHA5123c28445907a9f1df8fde75a97986ae9812738d7491415b5425284a7a47952e394d5588c32997301d9dd7132fb4bd2c630515f52be7a67b6c32a8253379fcf548
-
Filesize
5.2MB
MD50c1854445219a41e43ca7b11b489c387
SHA1671963e8eb42a8a6b3b897eaf9fbcaf620897ee9
SHA25674198f8dc3fe8b7bb54c010804d06b598d3da367a03e59bec4089cf1dc95131d
SHA5122c6ff8f38dc3509f0b5036314b7bfaaf5b7dfff911429313e99c8cc3a57a5d3fa1591fbd9713d5c42653e77eaad8fb12fc5ca78e0250b76cff409bba4174899b
-
Filesize
5.2MB
MD55982faf41bebbd6d10ac3cc8c5027708
SHA126bf7cd8eb63be90f7676a03cfb2975f627e536c
SHA2565e5c1606adcb585e1c687650a8ce8d68bc0f0ced13d5ad707c7ea4201dadb644
SHA5122460afec5699390efb952cba84c703a6813aa89932db06d319aeebfa71635bdc2d2b5e47a97f45291556519708bee58fc484e7953f4021979fa1e7fa256302af
-
Filesize
5.2MB
MD547b375569d60a5f17daaca5a13935021
SHA1840de95f85003dc81927cf2261224a50b7b865f9
SHA256530ea6e6c48f6f082f7bb69df7d195af47b9b95d3ccadaeb9d540b9573f0f655
SHA512349940cff5e612a2a29256cb538ab43c6a470704983754580e6dc14b8ce33035e9b92860848e8c5228dfcf5266740641c352ade5abdd79c832795ac3115e8fdd
-
Filesize
5.2MB
MD5603e8c7416c4cce6ca985d516d82fcde
SHA160b883be3df581caff8ef304b7a1bdf533c04d48
SHA25634cfe837505da53bc15c3f42c68319cef98805a5f2f54cd5b97f72457f98ffc8
SHA512795256af30f3a99f29ae0724f5b669b0248c1b4d68545e2494d7f84bb9a51d5d01a6a48066087129a099c50f68d8fd8319c447eac285be0bc7a962029c652324
-
Filesize
5.2MB
MD565b0a945aa9cea556abae36b49fc91c6
SHA1955401993bf48c8f61cdd6dab642f62434d3ab58
SHA256e3fda10b9e5ff170e657bde05c5040c64095edcaf439b4b01e84f53d815212d2
SHA512dfa72fe413e42021d406b04f13303c34e57229054ceee6f0d0a959fae5688171eb06df683d6def6f11840a03860c2239f2bbf2606327074227e0aca1ba04f83a
-
Filesize
5.2MB
MD5baa1296afa767bc95bc6ac3a88133523
SHA1ab9cddd3b2f7ca51818bf4b4e542155f9b942dcb
SHA25618dd8b32bc7665a36aded44e733fc29427682a29811146b7fc4fa1337ef91a01
SHA5122fa1b19caaf82e8218489100819cea1c0d65abd187be135a8e6d78201cda8e9bc1a3dc487bc11620d97e2c848ec4222642bad12dcd66d228b758d4f159f3a922
-
Filesize
5.2MB
MD550ad1a153d2ed6e5aa85aa5ec7caabb9
SHA170a1acecb7a9c05bacb0121be8b2c662fb2fd405
SHA256eeee7cd4ad656fe9c42479ccd38a79cd4f8cabba3cd7d23686be2e82d8d87eaa
SHA5127b4fb5d07b5eade7748eb304a6e1e20a5166ca0f0e45f42dfbe8558661aa9cc1310b119f9b6b1f77c91ce53a28ac9b14dccef4c62eb416b99f0ad391305401a5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB