Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 12:36
General
-
Target
2024-11-23_3fa681447b31acb2526fd782b98ce0f3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3fa681447b31acb2526fd782b98ce0f3
-
SHA1
543941d48fc32e8098349136e3b5c57e8262dfe0
-
SHA256
1021699ee73d77efe342e940ad76b4b886482eedb7a88a301799d41a199a3699
-
SHA512
e460d8226eebe4c7a8f06d3ab810fae1c29fc7bd9dd011afcd6ef6a53108d6fa3ff8d19aa8e460d6247f57a00fc69eba2fb3c3e53a220da43bfd7ce822a991a0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_3fa681447b31acb2526fd782b98ce0f3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_3fa681447b31acb2526fd782b98ce0f3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZzCfQiD.exeC:\Windows\System\ZzCfQiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gcrRoXE.exeC:\Windows\System\gcrRoXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bcEBcms.exeC:\Windows\System\bcEBcms.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqfTPyX.exeC:\Windows\System\EqfTPyX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfkBDfV.exeC:\Windows\System\WfkBDfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkFHmQR.exeC:\Windows\System\hkFHmQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgfgLyg.exeC:\Windows\System\MgfgLyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dtwmziZ.exeC:\Windows\System\dtwmziZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DivCjfl.exeC:\Windows\System\DivCjfl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyaverU.exeC:\Windows\System\qyaverU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAQaJZk.exeC:\Windows\System\PAQaJZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oUFXbVc.exeC:\Windows\System\oUFXbVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pGQPtFr.exeC:\Windows\System\pGQPtFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YESbWOm.exeC:\Windows\System\YESbWOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGOPhFI.exeC:\Windows\System\kGOPhFI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YaFEeWB.exeC:\Windows\System\YaFEeWB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UdNzuwB.exeC:\Windows\System\UdNzuwB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EdEHGLq.exeC:\Windows\System\EdEHGLq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpXIOam.exeC:\Windows\System\HpXIOam.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QkVaSXJ.exeC:\Windows\System\QkVaSXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIkaMsL.exeC:\Windows\System\pIkaMsL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD512c04a80e40d7e039c72fbe2bb4831d3
SHA1922cdd2462c1b0457557a399e183cbe7efa65625
SHA2565935af6b8e648b909562aaac663d2c03166f88451a318cd14fb2bcc4711137b3
SHA512deaded31a6aa0fbfbbd9037d6ef314bf14be5a96ca6c4b3f2143b49bcccb4affa03931bdfa8ee226079824d55c43d6123806d2f14c471cc3cd884a1ce90044c3
-
Filesize
5.2MB
MD5cf12c660770593b7ffe8a154a3ce13a0
SHA1efff8bd8c342ba112a43ece2093cf2af8409334d
SHA256bef689f9b49192b9968e53c0a95669abff632a866f179856e07373cdf9a631ad
SHA512c9eabf95bf5301bdfc89e5af25852daa07000b8bcb252aa0ea643ea590bd1d9bee62dc3c813bf5b5fa9a44a0da71d238e0703a85ddf62653ddf64a4302a43824
-
Filesize
5.2MB
MD51e1bf498492b48a2e724678dccc88afe
SHA1b5c0655c2f44d61ab2b8f113b72f638571a0a8ed
SHA256f17e88d88934aaf0bb93a890e965dd96862b6a668ad59196fc14b776a2f0f375
SHA5125a2c94ac1acec3095c733147badfa6ce30ff129858092102dba4c879ee53ddbfc3340047ca18e6dac58e4b6623db0fd606a78980771d72de3370f68aea7334a5
-
Filesize
5.2MB
MD52dfec3886fdc349f1d83d08df4773efe
SHA1c1d22fd245159c442e2a43fb18c30e717caf559f
SHA256fe7db4696c123d837ecd6e359cb3c0ddd9ac53b07c8ab6388d51b0697d7cc5ee
SHA5129eb507a53cf283b43d92a51a0b339a1f62f76aae99953aa21ed76580c530ebb185b5e73532b0b3c7a9afb9d8c76f43aa761f16f9f92cb146677f12e533263033
-
Filesize
5.2MB
MD5f0a921d49a09cd7833c77822a7833381
SHA1a6e8b60aa160200668389c246488caf723697a32
SHA25617214dd1247f26c5c076597aaceb951b04bf0bd0bc2b747870ab90e3aadb639c
SHA512b4a2eed1e56d4ace9b4c0b3192f09fb41094a203e823c64a66f469071bb6a5316595412066c447c0460ce573e009056345865d4b12fd82285d97493fb1dfec9e
-
Filesize
5.2MB
MD53b4760524a8ea03819cd208f36d39346
SHA17e0af8aaaa478cd6e24bd8eea897ec17780d7ba7
SHA25636634ee362cb7250532d91ebe2fefdb15adf5777ae2d265a195809d7f1f208c5
SHA5129deafe5e7222de37db4e18cccfa20fea4c58d0f318e900676017c1b609656d2a4d21cc4e4a5a84d9f3ed7e2d65d63540f367de5bc286c3a9b626386229bc31d0
-
Filesize
5.2MB
MD58c8809cc1d6a2cc0b0f4d383fc5abae1
SHA1a95ae622a3e5c44b01be8239d6812e018316ef32
SHA2560ad6de948d3ef88d8876cdd500de43c942d4f9c56542a885fd89719f34ffce59
SHA5127683e4b1a6aa7f04433db198f13a8ed056f903bb4b0b7de44ec110e27466dcc2c642a49b16c60c931a0dc459aa068cf250a104d3b4bff62f4b1c9f37d7a66bd0
-
Filesize
5.2MB
MD5af70a695d3d20ea1091ec98e94fbef91
SHA1487e6f18051a22e1b60139869b58e7b5fa5b99d0
SHA25657060973a173ebeb52a7eb1be622ad7a7ad6695daa90979c2ad4cc50bdd9b627
SHA51244361ba271a7895cadfb91d861a1a96bcab3871edb113bf69b0ab715c9a86d7f4b13f52ad29796350d1dca9a707f67e916a4593e45e5109e75bff489fb7382c6
-
Filesize
5.2MB
MD566e2db236e6ed5634cce613fbef53717
SHA126b1993c249d963bec8e524df95008145908391c
SHA256121c44809e5e068129cd8a1c739e6fc9090289d05ff73c604402aa6cd137186e
SHA5122ac13e51ecf539ffbb0d582cfbde9bf6fb769ce7227843a2753e977d97f86bba8ff8434a840a48ce92f7a85ebc296cfe502d8499e398eb18cfecae88d8fc82d2
-
Filesize
5.2MB
MD50ac24e593a3158e4442500ae25d2a110
SHA1060569c8d6e22a870dc09853c36378202f701e62
SHA256fbd72f72127b8f747570cba4ab245da63f50bcbdc0f199b9d1f61d0f61982e8b
SHA512e1ee05f77b2bb941330b612f200089616cd4c31b2a590ac528b2bd05e1e19e8cfa1f294167678e1b3b9c19ab6d78ea4179ade73e3b1e494b07196864928137e0
-
Filesize
5.2MB
MD5cf8c7d2f0812f737b04bbdb8bf9342e3
SHA1f6a36a341e0bb5db39a681e2c8000ed5d9626cfd
SHA256f573336c4b11277ed2b9c8ac4972ab67864568398c35f908893cab3b6b9122ba
SHA512f39345e209a1959567044a7215fe49280869b155553eb1208cfb195d94f16b7461c163fd3c39e3e559ba026bf8b1e361761d34c9fef505154429f620c08a8266
-
Filesize
5.2MB
MD5df24d5a0223bdcc851a958213241e20f
SHA178d4bd8b94506341c79692953265faaa2a9aa1c7
SHA256394da285e5fd708158396194de1fe539326c34595a0ac080881397f8e8fab218
SHA512d01e0049186828224c95cbac8aba706c89750fbb1928017ac3ea2bba616935fad2540d3019fe4a133ec7414131e802a44e45f01c41f1d2c729b8fd5051f1796c
-
Filesize
5.2MB
MD593a70bc9c62050a5159031fdfb6be4a4
SHA182f5c656c0bdfaca95f787c12c1abbc114a0023d
SHA2562b8adfc4e31a083518d52473c1265dba840db29bc5e396d41accfcc9e9596cb6
SHA5124bcd73d47bea99d439199f8ed0b365b936c7458f6930fa206db12736e2b663c37a3b2892cbebcb24348a0af497495ab223cfb0a13f2854aefc1a31d7d374fd40
-
Filesize
5.2MB
MD51cb00acad2d0d7d0e2319af044ad5a79
SHA120e314155c282b953359d6889cccf4d466129a75
SHA2562ee08e03c86f87d1398d7dfe95a23e9c63d9352d58342f5b1df9e6428a43da37
SHA51280f6e0a60245c630f00f8d9af5ff5db408b737df8337f28cfe2e164a248fef75cec1adbf5691ddc17d8da712677b1e3c74dddd8c50e536c1a416b4ef21a8ccf3
-
Filesize
5.2MB
MD5d5cfa0f9da5500e97dd8d55acd86a5a5
SHA11f46b4be5c1e7fcbb6feb26a3dc5824bde022298
SHA256278d8e5640d01e69a4216841a3937a812c4ac123405f4e38155c797399fb7ff2
SHA5121f3dfdce0ef5fc9eea897befbf6ecb3564182a725e60595724eb182ac56fbea4552a9c30612c5d65e66ad97bf619bf4463b44ffc0ab1a3839c9066a0fb8f9354
-
Filesize
5.2MB
MD54bc328b0a06b4fa64137019b3448f1c4
SHA1cd67ed5e2bb3e68e7dc0f64268a5740bf3346d32
SHA2568ef22d432c8e23f1a5f1bbc0dfc4d0040b34cc6e6900d67520ae3f3fe9914fb7
SHA512552dd655e167ebcaf255075ce78f48b489bd187f250474b9e4bcf7066ec657fb0ea6c5424b7adff5b3a0c586a72c0906956b591c65727771b5d4dbebc07db93e
-
Filesize
5.2MB
MD5b2bb407f18147c6b926f38c183a0c250
SHA1a05f1288ae25f37e0bc0856f33531dcd0b647810
SHA25613926b6bf20de37f7065ef7d84a58bb8b1eae5ae0c5fef47e17aa106a6148193
SHA512c1606d2cbf0c97ffecf3206db23028dfdf40bc0741781174c8983b7ccca89580b09feeb5a9fe1d301ceefb69e9e0d148548f51de8e72fc0d7bbd00445854891e
-
Filesize
5.2MB
MD5253799f9be597dcb11fabbc8e3ef2b9a
SHA19e5f16f439977594ef446dfd6d4fb452e276cb10
SHA2564a7d52ac7cd0a133d576c3d96ec43aa62a9dbf35a861c9f74588504818eebefd
SHA51264fa56a45614e2f36fb1b1027ab76d8657ecf8efe2b1d3b7706a0cf11e711ee30f74055d8f7677e683ebb9fa73cc6935f992e3949c5cd9c3b7f7fa736ec61bad
-
Filesize
5.2MB
MD5e217a12896bc97b4856bed5c4ce5cf2b
SHA1ccc939c41dae016041f99e9782c5ea7e67900625
SHA256ee196775ca6b1cf7b5a4b1a2fb78a2ed1481307e6b9aac5e5d9f070c930b1bf0
SHA512a96ef57f1e19ed8aa71a970c1706d6a433b04d05811abf763a0e07f97e51b2c2b758542acf562ffc444496dd4b764d2cb0d4337213d5705195966c175d3e71d7
-
Filesize
5.2MB
MD5b8189eb308f9d64fb7ef01699ed9a3dc
SHA1e2209532a2b1c201d66368ac893cbec28a17a643
SHA256aa57b3e05c909b3be051accb47c2a3d20bf11aca743590ea2ca2fe527f5e7c7b
SHA5120b424c709557bfd99435f8a78a2e94c090ebdb12c3338509bf4fff4ef25b6eef246279ea63eb808b255afb90a8682ea623f6b237bd37e33fa87bad8a612d6645
-
Filesize
5.2MB
MD5f9eddf47720bf0e992d6b88f0bf056f2
SHA1975d113717dba535736f9db516d7ae0502fe4d47
SHA25601488b1d47b99f596aef4cc84a43cd2459b90588ef2f9c41e5672b258cd13714
SHA5125b4340a72c8c9b9f919f0eea35db4504d05ce34c9c3a16b43e0037912e9592291da3ab8a67673bab4fe3e6f86f7be9e282d3bf84809d2af2887ee0cef321f4fd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB