Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 12:46
General
-
Target
2024-11-23_3054f3ae6a8df22d4b14bb93cd900504_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3054f3ae6a8df22d4b14bb93cd900504
-
SHA1
f2d8b4c27de9715b481557c9986130e02a50c6cc
-
SHA256
3df27a54485f674a21e40067dea0e9f3813fb2dcde94e8d4c4c7481c601d37cb
-
SHA512
8e0fdeb4238578764b6e059439252729bfb6e43a4cf304c54d56332716dcfec76ecfd2721f890242cc0fa64a530403536361f7f5d1eccc0bfd702b234336e1cc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_3054f3ae6a8df22d4b14bb93cd900504_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_3054f3ae6a8df22d4b14bb93cd900504_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fSGunfB.exeC:\Windows\System\fSGunfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUwRiUB.exeC:\Windows\System\iUwRiUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGvZCvi.exeC:\Windows\System\NGvZCvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZuqwoPw.exeC:\Windows\System\ZuqwoPw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmgIuZX.exeC:\Windows\System\TmgIuZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqrDkAS.exeC:\Windows\System\wqrDkAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSGViSL.exeC:\Windows\System\tSGViSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZWEWILA.exeC:\Windows\System\ZWEWILA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBNhuGS.exeC:\Windows\System\pBNhuGS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHfrfAy.exeC:\Windows\System\dHfrfAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkDJBfd.exeC:\Windows\System\nkDJBfd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMxWAVQ.exeC:\Windows\System\uMxWAVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMhfxyD.exeC:\Windows\System\jMhfxyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRMuWPY.exeC:\Windows\System\jRMuWPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XzBiNZF.exeC:\Windows\System\XzBiNZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPcHBMc.exeC:\Windows\System\GPcHBMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLSmgoB.exeC:\Windows\System\HLSmgoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXBgRzU.exeC:\Windows\System\BXBgRzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WpULPUU.exeC:\Windows\System\WpULPUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gihsQhN.exeC:\Windows\System\gihsQhN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipOLGul.exeC:\Windows\System\ipOLGul.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5765fe62ab491e943ab6910d210cff1b2
SHA1f494351959d7e6836a103fbbfb86b9fe93ce133d
SHA256334c9225a4af0de37d9d968debbe3d5d2219b52c6c066c386eade38b6ffa35f1
SHA512c9a069e62b6ba8239e1d0970086dcec1d2af79a6b9befa2d777805189b079f8c6fa67cccb3478789d0b4065d0f23f8e03a14df00809914b292cade5a35ad74ac
-
Filesize
5.2MB
MD5a6534d9dea520cd187e01cf6d0e78c6d
SHA1dc659282a30402c1e24586a31b5a0c9da06f0957
SHA256442128bfa105c3f402ea40dc0da672df7046b0a6aa6b861b8db016ef39e703b9
SHA5122076e5013ef787ef8628d016c3a964ca53ad8533784e5c81071affa55c20edd2d71d6034efd055a332afd418021e5347e2c8d195e81b6f97c19b47b1778e1296
-
Filesize
5.2MB
MD5c3745382f07afe500b72df2f15f04ae9
SHA17207001f2e1fa9299c149745532e965cae5e8134
SHA2568c052924b7b55541e1281d4c33ff749729f6dff4b5daa28b80a2f10a071cc7b5
SHA5120f71d583434ca000f61cdaf1abbc5aa638768182710f59cde70d2df813ead29ebe127690e2a64f1f587dc12092e241f61dac9bdbd71557801d6a5f4b185231c1
-
Filesize
5.2MB
MD53f6f6652cb6c348b21d446ce149838b6
SHA11b54dc244a1f581f5e4a7df0daba4166c2c5d6c8
SHA256598e2d5554d0ada5093b3d8374f5444dcc6e1d7ed3cfa439a3b56cde9c58a99a
SHA512458c54e388306c55b9c7db987616a99f5575ba5f8877917805fb273ac1b4ce8b1f80b1089d342f41c52e13902a1c34cbdf112cb20e24ddd160e6ec35f2f0fd8a
-
Filesize
5.2MB
MD5b3c33dc049888a17e20ebe0d2c03b5d6
SHA16da3d44289d3882318f1a823e8182b46295ab3da
SHA256c916b5ca4aab46d21b6288ad04cfa278b2d95b1f247e088289a65f0ea02d4e57
SHA512b671d74962ec23f33971fbcadbf18adae47be2d53ab8629a72519ca4e7f48588e579134564ef5e40ba9c0633a83434176592f1bbec914832961d65a9c2ad18c1
-
Filesize
5.2MB
MD55be90b52a65587a9fbc9afdded4fb3ee
SHA1fcaacd96c6af2474b995546c64e1e77b60ff7905
SHA256469dc454a8758a031fb262bd6bd4775c79b345433e4cca4a3675931455c027eb
SHA512d72cab62982fcdb6976c719d1fca25950e8ff5c764808b3a5c79e8982458189744e9bb24fe39ef58f6beb2ec96883eccd2689bca3dd71ecc3afd0f34f594baaa
-
Filesize
5.2MB
MD5f239e728886c393716f76924670b4c82
SHA1a477f776076641d1da16ce8547b205ba444eed45
SHA2565b72c919466fe366fdf38456c94ea051fae5e7f1c8b6d7bd4dfa8f8fb08185a5
SHA512e242916cf343db4ee67004bc9f9164de6bbe3e0922d564d94b345237590821692b0065dce33f00b51f1db22d6fa5ba014973f9c8c8e3596e333ffa85acc5a66b
-
Filesize
5.2MB
MD5a2b90dedaa3c521d61f8b2905b83440d
SHA18d7c5ffdfa681995988905b59e9b5ad53d344aa7
SHA256a7a3cf6ce112532e18004cdb4fbaad50b206bacfcdecfd85d094719b91832145
SHA5126f1e1a732b8825fe13b7dd9ca3f917e85b448acf8be8c1be9f1b3aa73109fc3b614bf4d42643c054cf1c7de3010051808c2f2ccbb378bbe65b5b68ff4cfe15b9
-
Filesize
5.2MB
MD524dfa13e07b8268f9fd47bc9c215996e
SHA13d18b57daefbd4c65466684729d1c155fcbffd69
SHA25684d02aebfd14736e09e8e8874b9a94e59297ef25ad5a0beae263859bfc03dbab
SHA512d8ee1e14e507969a8cadb1f2dabc7c79bd4386fe66b9ec48bce3128cf668b8891467c9e9c7800684ff6e5d1b1fb250317bfa89cbc660fa297f2b8948a85863de
-
Filesize
5.2MB
MD586f53711ee30ea3292e8e373f1b777a2
SHA131757f0f8b2cbe593af8c658c01c9d8aea7e771a
SHA25659ef1e9c5ae3638625d8d5df7373252a74f02d29db4c9862629c4a2337a63f87
SHA51249c5f5f4581805bcdb29944387c10ac7abf352409cf42b1cd6e90a83300b24bf3f0e0c9d133817377c2be30791c44715d71b64ce965adbeaeac9232dd8170d29
-
Filesize
5.2MB
MD5c50ac2570ded836126a5d60389c4e025
SHA16146e9964e8ef7a2a5d3a69be1bda1335244c18c
SHA256c85a020ff751c9679cddb8a7e0c2e223423318b9c5e0346ce09757be2a1ca855
SHA512ceed3a682c2898dcef81d9708ddabebf38d51a309eea7557097dd92b5f35f89aae1beee5cd941aa5a8748eb86523497e44ce9e5a3e3e0f38536db112cf8f7441
-
Filesize
5.2MB
MD58eaa8e7c42beba73d1974c931b6d6dcf
SHA161ce19043d3dbbdb4b9a3cb3585d46c2e68dd3e9
SHA256fba59e2a150049a16061f7aa9e7698b56eaf21e3bea982b3c9d1e159b3b65c77
SHA5121ff161cc8c5e2a58b2f2c7ce008223113b8f616ea81d0404c2a8b30d83f6041e09a15ec288c34890f69392dae7cad63e464d26e45e8ac31784a3c7dc741c3de7
-
Filesize
5.2MB
MD592c47a667de29d13e8a78f7f3aea101a
SHA136dffb43ae009e5bd1f0471369dd0106090c89a5
SHA256ee908553d26319ad346010cbf18b028deef2f0b13921133b1f3ee38ecdc491c2
SHA51291348c9506ec185d2af423fed5431e34514a68727dc0ed76058d767aa8b49d756858de1c0d03c2f45ff0b4491a63d8266731c73f17730571cba780b855d308f0
-
Filesize
5.2MB
MD5f6ecf6e29ff01a920c2ee82f180f29f1
SHA17c4fead769a6200e3c82b2b9d6be3a987a733ae9
SHA256a05a3c857766acf03829769f125c102c831d3f9a622cc442d0f093d94f38ea4f
SHA512b117fbbcbda374a8886f4a376502c96a43f54ce0a244cbc8ac13aff20f6d7826f2d1681976904649acc5a46a9215e47c4573425f6614354d9adfc8432e321208
-
Filesize
5.2MB
MD5b2be5b82aad75e6b452847d66b5c97dc
SHA1fda23ea606e2e115cc0d7b076d7f401a83cc9d42
SHA25694a4314fbbb07626d9ae476cff554c7f4f52c03f17ab0cff506aac2668bb7131
SHA5129e4fd29371da6f9d6381818c2c0c82a8be0d95d34a487064c33298829cd188c44505f3b730a9802e81b0bb7899bfe3a7bacc681198d44c0385e691c69c3ed5c6
-
Filesize
5.2MB
MD5bd8aa07b3b1ca03f68a40cd392699699
SHA17bc009e105915fa6866f8c12be1ef17831d70361
SHA256f8572c462c2b6644c812b469666ff0f26477c6ed4570092a29fc947971e97c0d
SHA51259a5eca12a2910b83ccae800894eed2622bfe48bb8b417dff4cdb851f497d93922375eac430646a726c088f479397eea82d52977276670d150c56c408a7efa58
-
Filesize
5.2MB
MD5159b7229727938f74caf9d692e7c2f09
SHA19d7c67ddbe712a1395272d4c5e74b117d5d35150
SHA2560bf695c572c2098200bac6557632925dff65e301db05f5a49b6288187041cf18
SHA512e91eef215f37d6d7ca609a9151e201290eea2f1654c1e544a9c764d02ae9787c61d9bd3333b395e2590e2a37ce962a1a8eb61f54ce712b380533edf01382d4f1
-
Filesize
5.2MB
MD57dc27fb3e2915bb395c402e26f2e42a2
SHA12f1a21062521050a9f4641c0101dfcf9540d173a
SHA2564fc62f743478b930b513135390e4a0b3edfc788925de63ecbc2931cec81775fe
SHA5127dc4ffbe5a5a27050eecdf2f9c85b2857c48a6bff3d22946202248dfcfda89334e94ca03a77cf083a5d5675b1ae90d737e218699b61cc51ff311e644ce8156a4
-
Filesize
5.2MB
MD59b0b9e09fa02cf2fe9a1c414e953927e
SHA13ed901c9f8ec0c81a23eb6adce3a8e5631e1adbc
SHA2569632a8ff7a949cede49eacb9bffa92ff6d9a999b8071ec6921ee6e1cda0af5d5
SHA512435e83dd7d4e07ff51db2870896a4aa15e3a9cdb05408479c6d7d6b35c69b53eada16d7285789460cad468335263f27d4e9353105f8659d90b013021a3024cd3
-
Filesize
5.2MB
MD562a483fa686334db49322a25b1e23a86
SHA1205938549f8a2b3417e5956e917ff12e0851d598
SHA256e3451223ad85c3b0b6d436f1c2113103ce00e791594d23f3096adc1848eab861
SHA512626901a0b8fa05b57dedd42ec2a2ec22b94f74c39373982ed0cc4cbec206056d2ea9df1297cc2ba6619d8f1326dd8e4dfd16a3a11fc2e4759f7e5112a21e1fcb
-
Filesize
5.2MB
MD5812f3637185de0955a2735454902c22d
SHA122b90ed64224a9c00f3f2b724856d3ed31f776bb
SHA25627a34894442d38e8e438206edd5d07064704a140f27bb9e2897dd384b683bacd
SHA512831a71f3d4757ea8be77a52af13892084b3d1356eb28c4443a7e54c81c12b0c168c9f4f6f1b5a14f886225489012f8d9eb5539c7cdc00742ba48fa1a58c8351f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB