Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 13:07
General
-
Target
2024-11-23_d238249522a5fa6b4297313a078094a2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d238249522a5fa6b4297313a078094a2
-
SHA1
133a4657faf2b5840958476f2de01c5307d48991
-
SHA256
563559bf4e24eee103b441a36a5be61d2dd9c0801e1e1988bdeda5801d7a98c6
-
SHA512
e6cda3126c4cdd438a35065b3038d26e5c53b0300dee43c07827f35e029a299bdf8120009a8a0947effddc3f76ea573c88135fce6636646bb03cfb06ca245444
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_d238249522a5fa6b4297313a078094a2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_d238249522a5fa6b4297313a078094a2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zJYaECk.exeC:\Windows\System\zJYaECk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAxrkwC.exeC:\Windows\System\HAxrkwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tFrisCG.exeC:\Windows\System\tFrisCG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZahRqbY.exeC:\Windows\System\ZahRqbY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhdhukt.exeC:\Windows\System\nhdhukt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzGxzYj.exeC:\Windows\System\nzGxzYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yicYAuf.exeC:\Windows\System\yicYAuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qUFPzTt.exeC:\Windows\System\qUFPzTt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SklyZLq.exeC:\Windows\System\SklyZLq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWrisxc.exeC:\Windows\System\IWrisxc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sdcbfVJ.exeC:\Windows\System\sdcbfVJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEbXvOr.exeC:\Windows\System\QEbXvOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\caTlRwI.exeC:\Windows\System\caTlRwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKUdlXq.exeC:\Windows\System\rKUdlXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGjYrUF.exeC:\Windows\System\KGjYrUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSCvhdc.exeC:\Windows\System\HSCvhdc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVRQnHb.exeC:\Windows\System\UVRQnHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhaKbdp.exeC:\Windows\System\RhaKbdp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\reGQIto.exeC:\Windows\System\reGQIto.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SvKdeHl.exeC:\Windows\System\SvKdeHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJnqxvF.exeC:\Windows\System\MJnqxvF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ab8a5ce34501ef83598d2f96ce075bf5
SHA1ff888c6a09f09bcd0db5a5aa35b90f05b009177e
SHA2568be501e9fae14033c02c918c4e507b55af12c6f2c02fc644a5a79b395db88c20
SHA5120743256a6a4dcb64657747eb69c42dd97b13232a7a30e75c4afc9fa18553b640ed0a886b3a4223557b1f0233982c74a3b3b1bb4e1636ca91a5ed2ebda5fb7d5b
-
Filesize
5.2MB
MD53251f34b7fc05fac669de8d9cb520fb9
SHA17c2fe53ae1e985d7214876302a7559851b3e3cf2
SHA25601ee1019309dd2be35a0b445b20ddc21779b64a6620648082f26951bd2effd35
SHA512ad6d2e0a380c2de7c01337911cd37017f0b9684164d79e7053fb6d483c24dc6e60a639945618abb74d6fa7df28b620049701d25c40ba0aba9d98e3f43ba37523
-
Filesize
5.2MB
MD530851d010df9d22dbd37d8e1197c6419
SHA109511e072c66b51de6f16bb5fdf8b6eea160ab31
SHA256d3d93b866d3225b2bd0dd4752d819392ff022f8476a19251411f58ab707811fe
SHA512f3788425f43407d9bb5fec38baba03a8632378d23016f0477531a09f785fc1a3c21b0a1953a5a6905159abf4c3bfd2045dbdfcf10aefe25086b3bbc965e2be9e
-
Filesize
5.2MB
MD5727e6af3269d35c649ec05fe3df82d12
SHA166088f09b599a525a9aefa3f12218137df8cc846
SHA256573569565fc7322d1da7c63c565db44fe8dbb1f0be629477d020cd5093c27fa7
SHA512dcebb8f224983f9862902096f7a535ac20f25aa4c9ce57f0ada6161919e0e435f5a991c1e8e63c212ba43e159486294f437df196713d43c6d12bb2b9e770503d
-
Filesize
5.2MB
MD588a7b8d2e33a3f7c4e78ec4df0f73757
SHA14a709b62334a370b1badefbcd7e6ec75b6c1cf42
SHA2567fc9503ba8483ad35be38ecf983ead7efb88f1a3808cdd92c57c48461d830ddb
SHA51264ed846c59e2aeb5042636bdc9e81aacc9c900049c42f7b96e5078c3d002bd3ed187d76a3df25ebf77fe84f2b62ecc78306f6cac401cea695e3f009ce3d3ba48
-
Filesize
5.2MB
MD5752838181933a51daaa993f4dc68b087
SHA134dff3ccb227cbd87af8595ed3569b84e203a68e
SHA256f2dab3f79c4154baec82afa909d2123ffe3b2ccd0fb4b5423ac66809d1bf8c78
SHA512f501aaa201ea2fdede978068f628f70590266d0320965a5b64ad9a407a6a0f63d1d6c4e878733e5d0c7893c009e1c46e39c5c5caaa827da64d6f861ced14cfc1
-
Filesize
5.2MB
MD50526ac7798f11a8c1f42a1c95fe55e1c
SHA10ffafca14689d2c8df1b7e0e070533381d6d5126
SHA2560fac710b0bd37442d2030ad5709a5de2dbf4caa023c01e195d844d09c49c263e
SHA512c58ef5b20d861e1258ba37fd6a8dcdb5522835d59ff9e92dd96544900687529e367f9623bbae85e6c694cdc387aadd31894e457c3359e2993df34e7e04169833
-
Filesize
5.2MB
MD59a178fc2697837f32d86b027bf1de846
SHA13a0bca1f7b1c855418a4e82e483fdcd7d729e187
SHA256b02bbb44760d9a854f6892b7910614b952934a00a127a5b49a1343ffc92f9cc8
SHA512a1b921d848bc1a2a90b3c04a04f52e30e74e57e8335ca656c902dc9f4a8e3f6658d0fc72d266caa9c09581cafa8c5e9e1898b48df341ea84c7ee437a6fff698e
-
Filesize
5.2MB
MD5690a2b18129caebb8bcd6e390e5e8d36
SHA1d2fa8f68a33a5256fb520cfcde7ac82107b58cec
SHA256afd3cdec267453cc5ab7ba6b0de6e0349d222598428dffedeca694b4cf3ea06f
SHA512499701fb1b2fdb87a4e99083a800b3571304acb739b8e64bd702fb05748a2175d5c4205dbd28c3e330d8fad87136b3daf722e976b9fe6c1e4fd57c614590ef5c
-
Filesize
5.2MB
MD5db6d2f5c9363fc5abb4236fa64afdbdc
SHA1060155408e282fd6f941af0a7e84fb7e2e428845
SHA256501f1f88e3d2e056357e692b56189e840934ba2de9f4259cd96fca1f488e9184
SHA512221f9724a3e5328277b1389fec872863d3e998cc815cce0c31533d3b18491fa207e3a9422b4239b13070f38389ef240cc6bbed26691a154b1bac048a6a58d461
-
Filesize
5.2MB
MD52f403ada28ef61aab2180c77e2eb7fd4
SHA17b49dc622b30768970050475b80906bdff83ad4e
SHA25671089107d8f898acb8d4a4a28c35b70ef8b069c1aa0e5bb95a93b82e1b43d864
SHA512b78579ff3961cc14e64c893dbe30d8c16f63cbcba6afc8120f533a7e24c41337badbcc1be57d49f52c53f6f69f7064f2aa06ee38252123d42b6e1bf877f9f582
-
Filesize
5.2MB
MD58222676f6b0a3431211ed252b1d8aaa1
SHA1b67bc89102711f4d81e35177de0bb826ab68ff46
SHA256fc6ce50fd457241c9fe477a9bc43b9c93d018047303c45fc522c692735c95b11
SHA512a531104aab4e28810e95f49f993410f436c3f4271aa3a66f35c8d8e73aceccc16a0a0ebfb6b149b807729aeeed2954fd549d939d855ca3de797d559ea8e90b00
-
Filesize
5.2MB
MD5ab92484750fbfb78f88dad4c702a7571
SHA11fd66829d48a96494febc12cf44083cdb54b96c2
SHA256956a6f8c8041ea46a59774849de085e69f8907e8749d4bc396c1bd2242afcbe4
SHA51205a8d473e1098a091edc704b06b2e52845a216e893d044b3ad3b3d9d82b3eb4676bd9c2f6a9858dfc9fd1b3dc3d7c38d53db60579a51fd44351205e0a7c20d24
-
Filesize
5.2MB
MD5b14a586889296355a34527cf3d146b54
SHA13dcb234db9ea3d5566f6eee4a42c6b9fb58118bf
SHA2560cc76f8ddb9c470c1e1e5a300122637a36270c996764d39769f6de099b8af6ee
SHA51235901dfa6faa7c29d46829c3531e549f4e1fc7d3df1167fdd34a61a75ffd64ba061e9d76daced5a688ae8521a988d26786e36084501020ec3c5564eb7faa91b7
-
Filesize
5.2MB
MD572963017f75f26ee77ef220c9a6f4670
SHA1f36894b92cb407ae71f4ace821b40628cb480291
SHA256233134d90eb40394b078f5741cee6668206f4371188470813f66df8357e8b9ca
SHA51270691bb7a115466b679d6a5eeb23e1531f855f819149356467571506dca577576bca4efbc15271e594d65eb4bd947d7b49ef1fefb7dbf066700311b9fe9b72a6
-
Filesize
5.2MB
MD56cb13e514a50289ec1cc3350c059adb3
SHA1c0812df73aed0139ed9e7b84a6c53f38e6e76328
SHA2569097b45a863de2592cbde30d623b34a9c96c4cc04d476f79e11a78d4a2ff98d0
SHA5128edc89c44bd52bb11323f67783fe48ebeefeb1ddfa6df794930fec4ca389b139aae91c63d2bc44644f766635943248422612b344ec40a72edaaff8bd215f8d96
-
Filesize
5.2MB
MD50240cbc4247833c34deae33927a8f457
SHA10ee471362f05d2739dcfbdcdd911d6ef6559369d
SHA2561bba529b80a691eac8f75c32f33f71110c39563583fa2f64ed604d95113f25bb
SHA512cc4cbc099e52a5613c347e8c5fe2f058abbc4e824675bfb5b25374721413654d71fee02da0ff824828a77f55f446d79d9e19f20054315b9572412866e5c10568
-
Filesize
5.2MB
MD523ef5cdc8c8680dca7c6fc20fff1ac23
SHA13c17aa50ed37b73b8c95d25b5b136ccf480957f3
SHA25655fedc3f0ceeccd61518f673fb742d6fdea39b21f9a84696691294245a35eee0
SHA512b1d8ba3b9f68e6460685082b655c3e07a47f2a1282294f6e7097e6607a68fc8a53c4f890ccaa419385b9a6167db5226510b1613b44f14f93ec216e87dca62566
-
Filesize
5.2MB
MD5b50653d51ca8c229b00b3b000645784d
SHA193280300804b0b519945cbb6d22fa481c82db4c8
SHA25674f99962ae2273822c3838e7b6f69b4f75c3054e6bc6e30103599473f34c398e
SHA5124433d9890d828cc5d8970097eeee401072f1b3bad5c36f5b8a47170c76b3aa61b04b21cab48cda4bb6ae0dccb44099fed4d07218635b9b80a6883771fe51593b
-
Filesize
5.2MB
MD5b3d57ca207d9f4d3546a09808fe27a6a
SHA1c092e66764a500d2d8af9e26fff1c7b950c46c6d
SHA256ff381ab668ed49a098adbb3aff19b8fce9bf63be1f3ebbb886f4949d6ad9223a
SHA51210e797afcc8347c3568acf24c28a121d862866c153d6dd814fa52b7e38483940325c544b1a64d235e8f9a85984270737f09beaeed26d1613d47bb1b1a802ba0f
-
Filesize
5.2MB
MD5e11f2bcb50ca4587980fc13327856a87
SHA1c157de16884c1af07bd0e2236714627a4ece280a
SHA256d73ad13c57ec92192ec2dde0f33207254c75bac1573c904f77a4f7f6769cbaa7
SHA512127d40aea143d71c95275806fe8113dbb5b2bb4627df78177b06a57f73dbfdf7783c64503fbec90dd8ed6567cd0b8fe19512a7302a83f1f3dc09ca4e1c9fe37c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB