Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 13:03
General
-
Target
2024-11-23_e727c9b5becd56c434ce1d7d4247f8d4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e727c9b5becd56c434ce1d7d4247f8d4
-
SHA1
0a5e86323da25deb53d0227bb296aedf81be0884
-
SHA256
85591d0f8567eadafdf51cb881ef28b93a06265f89573555a5c9843a713b4f9c
-
SHA512
f42ed876d2b8c6d4af72e68667d29adc9d23a30647e8819e7dfc2aa128bcbd77e0f75d9db3ea572e5cab7cd6d1c83f15e5ab8d087f06c8b5f76b5b5dc2834091
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_e727c9b5becd56c434ce1d7d4247f8d4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_e727c9b5becd56c434ce1d7d4247f8d4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YOHSvol.exeC:\Windows\System\YOHSvol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNTUnvR.exeC:\Windows\System\bNTUnvR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gstqHdt.exeC:\Windows\System\gstqHdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eHtnVSC.exeC:\Windows\System\eHtnVSC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qUgnHFP.exeC:\Windows\System\qUgnHFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRzhcyH.exeC:\Windows\System\IRzhcyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEUDAKN.exeC:\Windows\System\QEUDAKN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dSkMhOS.exeC:\Windows\System\dSkMhOS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQBcZsd.exeC:\Windows\System\RQBcZsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOszIsF.exeC:\Windows\System\BOszIsF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOabNkh.exeC:\Windows\System\lOabNkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\clNwlgD.exeC:\Windows\System\clNwlgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RnZjPdu.exeC:\Windows\System\RnZjPdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mqtlhkw.exeC:\Windows\System\mqtlhkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJWSooI.exeC:\Windows\System\WJWSooI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YryFXUo.exeC:\Windows\System\YryFXUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CienTUY.exeC:\Windows\System\CienTUY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\reQvRVk.exeC:\Windows\System\reQvRVk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdCAQrD.exeC:\Windows\System\zdCAQrD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuIDshM.exeC:\Windows\System\CuIDshM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdxyEkZ.exeC:\Windows\System\IdxyEkZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5552f74d2f6daa9b113ba17c9d283d838
SHA1a25dc7da4d1025a76c7f671b0fab887fe4d3dfba
SHA256c94239ae672994248e6c3092c97976b1e0ce89956bf9c033dfc5041a502849cb
SHA5127a1fc205719473a5d49db24d1c98d57b2dc2e539ffdf35d2491e22764d01d1b372c697f59b3bc791bc29bb0edee3489bd73e767db844c2d6991b13508a2ebfa1
-
Filesize
5.2MB
MD5d06a7f5cd8edc2679e2d80bc203963ef
SHA1ebc799c8e8bce87bcf31d92d3d0d0c77f69a3ae9
SHA256c0b22ec85d002011da947c652a31de10dd9619cc30a267217cc86b640fee8a31
SHA5120386819993b8aea606cb1018ed9db7ec615d287773428d50523418309fb47bb48cbddcbc74748809af5213a16e5963e8827d4f3562de2f28be9629309bf8b2aa
-
Filesize
5.2MB
MD540e6663be87f89fc219234624946ed2b
SHA1e5e36b4557df5c06f397131514b6cedd79b29367
SHA25695a4f6a5c697bba0b107bd95e76df837c205db49e4a0a501e90f41bd1bdffe73
SHA512e6f11a0a90c5d63ed8bdc26cfc0f87af48244c1a2f456d57ad03c60dc05f30540b8b6f7a254e61876c502f50806a8eb09e2f822ef60feabeaf1a1ced86ceaa0b
-
Filesize
5.2MB
MD5f984f561a718b7df711c766d39fbc73d
SHA1b05907442871a6522fd7e6166ee2fe4b1aa391be
SHA2562d7854f02d657c5d5f17b66de6b66b363fc0aa3053ed3d8b40253fe7690804fd
SHA512213bc07d6cc9ff306a207992fd504c599a4a3b8d76958847607b112aadfd44aed1c1bf429f0801083717641020e1c784e4d91e5606391cce794266a2081050a4
-
Filesize
5.2MB
MD53aa8bda37d59dc83224c21ba00cfbb68
SHA177d3462cd4a49c59fbca8cf4d908a0f5348d493a
SHA25646a0750508859519562e70ca81a1ec96e098d9d74c106414ed6953aeafea8e0a
SHA512052f550d7c9c4488d783ee657c2a36fc6302a43827119ac6a2ec547ecf4a6016fc38ac707c2fd767053d0b07c60fcaa28d5e0378376e11c104799618f062ff07
-
Filesize
5.2MB
MD5e86962dbf0c3876bdfd4990802d7cd7b
SHA171c8d6ebf08c1d2afe6ad6e423b7da68792cb10c
SHA256f665ea4cfecd0fc5e96881ae7b8eb55ab3e253dc16eeaf5d1fa0b59cb310338a
SHA512d84e339e48d3019ed913125fe06132afcd4a37b73440ba0a39c2fa019d8bf9b33e9dc2c4b1910a2b32b9ee97da2712678f46042018b317d2241b14012e73e587
-
Filesize
5.2MB
MD5841292b616dd40d484fc40d584f9c558
SHA1bc6fbbb5f7c6d2a882551fb90f359f1c06a64dc5
SHA2566c9ebd9b03ba0d643bba2b8c1762c149d8e4b4db50847944e933d377af35c454
SHA512d43c232ffbf5b1da3f43129b4e66c6ffc9d8d1db6b7da4fcaa43303c909e289f087fced1fd5b4510032211bad2f89db4863706b505b36651b9592beaee46bab1
-
Filesize
5.2MB
MD59fc827eede731093efdd4d06a3827668
SHA1da0329af5284e9fe02bff20a1f76591ff1cc1c5d
SHA256e720bf0754e06004ae7f48763b6e9ecbcb6e604b6d2510f04c023bcb83cdfe64
SHA51220bb476b005fcd3c97ea49a8f09e0bdec15b8d15d0a90aba7d329ea4e767fbbaa35ad1e5eaad1b1659490bcd02cd50af11010f1d972eb59b1256b841c27304cd
-
Filesize
5.2MB
MD5ca1ef2df3f728033b3e67a0e21cad305
SHA19da5f08652b8dfe224382afbb83a0608cfe6c90b
SHA25638533341be14167306d67812cd2c3aae80c3a7007063e598e81cdbb378eb439d
SHA5129b9d837eea6118c3d89d80a4f7068f22fe8766ba5ef8ea525ff8d73716719e53080c1e89faf30e37b90e56cd518304200ff425b6c2026b8f197ce23e6e49ef2e
-
Filesize
5.2MB
MD5e50960197eac044da9a7af7054021199
SHA13296578a3fab7529f035e8cac5762f4b74de044a
SHA25698141431a7ee1e288dbfb2193cccd6e58a3a623d74de991576d55edc0190daa8
SHA5125614fd1e32709cbc0a03987b19c5521a95b3d0e17544528c12bdb810f592c3675a210264150cdb748402b785f66a0a0fec44f059f7a37036da0c0296e2e105f3
-
Filesize
5.2MB
MD502ad4a36ea220691b754295b0217cdc4
SHA1de606356b2daba4078ba63033136eb72214f9b1b
SHA2563d4292847f69d0855428184b8d0614e2dc1c21d1422efaba454d33494b17a012
SHA512e1cee51012038360b1a113916ee1a76ae803df5b47bc80da6695e4f198c934e26bc83b1899a85310a106cb2072214cff4ad7847626a101e6ed917aad4d022930
-
Filesize
5.2MB
MD5d1bd080c1ff54cded8b189e270cabf21
SHA160fd84ad7eb0d9b4dd2ed9b7433be0076a3b9395
SHA2562060a2e5867ff06e935770e4871ba7a8d9d43f019b6b17a29c7923e7845109a3
SHA51201421f0be26422ac07e3d6a97094b496f3132b3aff9204d6a1f4fa0e28844e827f3cbf5ebe6944e9288c2ce9f151f04fb7f3c71057ba75e3660ab5df386fef2a
-
Filesize
5.2MB
MD5cc35fd0765e1af9223076c62ed786398
SHA1bdae741d27a1658b86706f179490cc74da1b0cc8
SHA256bfa1c8a7a88a453382022fd605bc839069ba5f8fd9f02a93527d55854a42392d
SHA512408e911482c1343189f77f4b721240561b73dfa96911cf480b5b70932e483280b748ccbdc14a2ea9dbdc980fb3ce889493a635c6d5178176b4682dbb50d0d9a1
-
Filesize
5.2MB
MD589c279ad63627c9b762f71ed8f5bb147
SHA1f141ed94a4c802a4c6daad41c6606886fbdeabb2
SHA25609fc8d39791192ee8c8decacbdac64313875a52f732d569ca5a68406dd8d074c
SHA512774ec1f70e85e5471d0e49655e28fc1ef2d76efe58b858a39e3bd4d04e53241ae1c8608df81017b5250bb78a0b56980b77684cf840e6d0bb426549bce6f73f25
-
Filesize
5.2MB
MD50ec6f659a383b208b877b153378dd3be
SHA138969be46aa93b5fd9724ca3d4d824226524a193
SHA256fda8d000371aeb9a695bf44177950b8154416262f58f42bcbc0bd95b3232e4ba
SHA512a38abe2edd45d4c787927faf7a2fde8371b8015a55e5b1e64c624d9e3fbe34bd239963ab7c0e5598754d8ff261fb508908473a2750d4d21f916f770ec9618f86
-
Filesize
5.2MB
MD516bf5d5a79b0a60f4119fcdb578c9772
SHA18b9c7511b93da22a8fab8d9be0f269e9920e6f79
SHA256cca6778c1c49e6939cc6aa423dd4ea0487d7fb4b0315b09e857c128b11d09c13
SHA512400d929fac1140edfcf077f9476060b5bf37bcb7518918d5abc55f73b5af1e5720f55ce7b1fea2b8fbfe653dbe382b0214b41f9c0e8e30a85831aedd34ab772c
-
Filesize
5.2MB
MD54461f1331069bd1a9d5b08d342969e47
SHA11ea11f5a724415f25e593e560b05665897239bc2
SHA2562efa8690748f385014d1d9cd2a56e5755b3b68262529fa224fd4d71df1d9f6b7
SHA5124c0281b665495e8c343abf9cd7da1a9997838dadca9b18f1ea53190c41615dbd57edfd14335ced3db135e549d1df056bd79d407f439e29768a971f64320a6d41
-
Filesize
5.2MB
MD5c802987ad8baef20fd9403be6666e613
SHA1fb591f9cd5b61d63552f7c5a8ae187368d311fd6
SHA256c76a3e5e38bb55c8b0a1893c6897eb064da7fb8a298ba73f30eebd5d665c1cf1
SHA51222a0455ce9c1248b14f933a9c3561a6cbd2c39c07f8dda21d3a69a669cd3a48029ea7328b45272999a3f7239a456c4505b16b610e9899064c7b194e911933302
-
Filesize
5.2MB
MD5662c4c74ff00caeb02a2084968091c49
SHA173f603bdc418b45214c14864ac48bbfa4d523f12
SHA2569a6cadceb01ef0960da09af6a92738e7f39f2c65d01f4608da76923221dbadc6
SHA512d59304c3a750a2056d0d336e1105f0ab1b1d103a64169b6393e51bbb30b29eecf2dfc988712dd950a81646cef9173f28dbbae7c37ec18d872702842c8927dc1a
-
Filesize
5.2MB
MD5c9d744dc8342453c9961140af121980c
SHA12c37aecd89882633034398d0d9e419a2be2b9ef2
SHA25691fdbda5af1df981563c50c51d0337ffb0acbae5432b0daf364c495c3a99da0c
SHA512fec3a3ea981fc2a6def5a3f157660e8a5b7274a6dc7681db2896224898ffcc88cfff4a520b0acd520d50a00ab4c25970a3492647d595b1d34ea419600709631b
-
Filesize
5.2MB
MD5ea1c097f5eb44c0016d61277724085e4
SHA1d501e7a7da98bfcd7ee9d1ae86ca4f0dc41a118a
SHA256e9ccbd3c4d72e5e2cbfa3b2753123d5ee4b920c14b9adec07a7a5101b711940c
SHA5129d8998163a4d92cd834e6cd95927ffb9bc298a5969eb4d6d985e2498d5f2aaf433da00c5cf76f2977b72a03efa0627ee0a830c58d11a922626ba47a9b0470e17
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB