Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 21:04
General
-
Target
2024-11-23_605b6c3e4a707547933fb3ea006ccd5e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
605b6c3e4a707547933fb3ea006ccd5e
-
SHA1
695f2398e44c3915bdb5c5c5441351d9cb7d9cc1
-
SHA256
725b446adf33205c9467dfe622290cf2b70b79427a6ceccf5f2a30e13c093f31
-
SHA512
4a0a52c94da4003e9c189cf3d905eec7ce7bdffaa635bb1ebc0c2fd04e562b05b187977a830720dd4dcf4a8183c0ffdd811c66a43246e1f768f160337b5be85c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_605b6c3e4a707547933fb3ea006ccd5e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_605b6c3e4a707547933fb3ea006ccd5e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mswwZBt.exeC:\Windows\System\mswwZBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFeTbyS.exeC:\Windows\System\bFeTbyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gIjHWru.exeC:\Windows\System\gIjHWru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xpbwQRB.exeC:\Windows\System\xpbwQRB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LBrWlDt.exeC:\Windows\System\LBrWlDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUFaCsV.exeC:\Windows\System\wUFaCsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DYskZOp.exeC:\Windows\System\DYskZOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRWGvEO.exeC:\Windows\System\YRWGvEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WQsjAGB.exeC:\Windows\System\WQsjAGB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWvtDzk.exeC:\Windows\System\LWvtDzk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gkJUWjd.exeC:\Windows\System\gkJUWjd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKyyGAD.exeC:\Windows\System\NKyyGAD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCPKjug.exeC:\Windows\System\RCPKjug.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZPsfCl.exeC:\Windows\System\CZPsfCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhuVylN.exeC:\Windows\System\UhuVylN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MwuvFOQ.exeC:\Windows\System\MwuvFOQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXxWBME.exeC:\Windows\System\rXxWBME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XEifIpj.exeC:\Windows\System\XEifIpj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vyjKVZy.exeC:\Windows\System\vyjKVZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exMbvXj.exeC:\Windows\System\exMbvXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tiADzwI.exeC:\Windows\System\tiADzwI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56e3a7137ac6351d77b419958dd43814b
SHA148d12753d19aa807f206892563073c41e2a5440c
SHA2569ca96482158644e3232ba6980dac1203bab6dc1212062e2d9eee3bb5fd5c1e94
SHA512d199909100e977a1b0c22b65bab6214c644f513c3d800bcdb334ac1dd2328ba2b0d98a27f3693b4fc43c5ee8cd16544dd684cf7e38dfb8f6e7c927512abf1bc6
-
Filesize
5.2MB
MD57a78fe95015eb13378f45007dbe34979
SHA1ebdb9904be7dfd7289361909bfb95698884452cd
SHA2568fa7425d75b66976c7ac9f8869c1540988b7ca6cccadc5a1d0b649977180afde
SHA512c8e06de47f85b32a190c910b7137a2ad75ff670666a4074cc5927a84047e403d58686249255d3502fc4dfc81c420feca273f301875874f9eb937fe8708148816
-
Filesize
5.2MB
MD589463c960965ec4653c53b47a3a1b14c
SHA1b7d8beab7bccf2b6319f416d9b52fb26fafa98e1
SHA2562d5d1bb6bc705cc9ae5c901981a4d66e1e874c703857e7f9285e1de90eb54cbe
SHA512e56a868760f744c740c9a612301c9989d95701e5787d85f973b5be3067bf9ab3e05fcdc5131f0043ec1217203071c9ce6964d39f47312fb36fa7de7e7f9d4956
-
Filesize
5.2MB
MD565b91a383766aaa72750b093bea49fdd
SHA102f08c4d16725620a8e60fe80be2e3289a221fad
SHA25621346a2b405a87ec4ef90f0437dd5f3b87327cd26ea2c07999dd18605694c78b
SHA5120a347338d3bbeadc9fe264269433a13ca960e54e9b1e7e29d8d8bbb0abb794c4552961041f44d2b31fb283cf23d75462d7f990b318223e4622b7fa92b5b6dccc
-
Filesize
5.2MB
MD5dc5b080d54230367ff7039a124dabe3e
SHA1dcfe71da8162263fbc24fe662a431528b5bfc4ae
SHA256b03e3c826b5fd35c8455aeb1230ed7319e6a961930ef8d28fe592e3090b1b173
SHA512a69fa75b0d5d0da436397bdf52a1fa617d7f8cde260226b128185a0f27792e0cf226a562b80a0b5463e59836259e76ece31b771aa8a4e7e5c1b49d155f4de7b1
-
Filesize
5.2MB
MD5a896d856359a7718346caa2cfb5412fb
SHA171f29ee4b6867196568cbd818168b998f695f01e
SHA25653650b38954539fc146f388a28a5bb9e20e659193a1c57eba82221199a930c94
SHA512861a50c803df8304d74f00a03e961ffa43a11e60e6ab890f89b3e78f85e96e5b5ffa41d5e2ebf718fc4425abc133b14abe4f77bf1963cc26e797fd7ce9412ba8
-
Filesize
5.2MB
MD5aeec30d2f717cf3166fc1072de8a2649
SHA188d9603e958d4f90c3af9291ab10a0099cb73d77
SHA256161583a86c1fa203a5efcd36001f7c188f902dd6eafcd9de12f1b3b0d9bedbf3
SHA512fd780a5a8b24a65e3db78e0af60bbb2507b561ab76e6bb42771c873fc022a9bc7c531b0bb1765721a2e11107847cf2a1683b800e42e2349f42de85059d09ce1a
-
Filesize
5.2MB
MD5c9dde3eb364e1afd43cf393c533d0ddc
SHA14d7f71a9ff3132d9bfb07641c4f3b06d8f951457
SHA256903a81ff1d62ab7d6b2978d9b5e1700d7a4960eaabc12e7e2252b40e619b812a
SHA512a1c08d31bb50f775bff4c32f6e09aed927ed5b00f0fba355c2d68122bca54716b4863655cd284d83e02045ac31e48197510a7de756f83382c0b3745f154c445a
-
Filesize
5.2MB
MD509526a56d14346000f4b3101db2b4adb
SHA1f4863613200a2a69f9396576d67f325f8e226b81
SHA256779908af30559fc49d7b7f6938c961d06474343e586f704b13b445d21c4bbc17
SHA51286a8f38049f93aceb9dc0c32186f6adce6ece53d8c69cc41f4967bab083ef2b92878f10f39a26129f1062fc7a305742bd3762508c75454dcbf148f6abf678a38
-
Filesize
5.2MB
MD58ed76a524b3deecfef9be3677d652b19
SHA1ac3571da1d9ec49a3c74b8b3a8c20066aeba6a6e
SHA256f7dcd5f9b5873be9ccc129975b10eb2a1e4ea8b646873de3b3c43259b0d2f816
SHA512ae527bd87bcfc27f9bcfffab92046559fe160497d59bedebaac17587211fd554e0a8eeeb1e3b3316c5db44ef792726372c882424154213b74858707bc91bf170
-
Filesize
5.2MB
MD5ad7c478c12246261221b38b7ac9d2fad
SHA1dad8688cc4d11cb7e7386c05bff927b792c82301
SHA25603c2c96bf185b99f54d2240494d0f197b4db51203fe69b29a894a61cd328fa81
SHA512fe79a2fdc044a144613bf715d2e104f884f617682cc3b046bf2968020a9b38d226d5ec6883c142f175dc3092e57c23bb765af67c5d42d20612aef308e45b1b6b
-
Filesize
5.2MB
MD535d893c0732ef0a04f3c95f86144c253
SHA179748046772f921b9447fbdbc0c729eedbb09e60
SHA2560f998cd7aeabc5aae995afb962827bfe6686ea9d196a7284eba6290a9c1e06cd
SHA51221707b18af68b5c7b97f4d07516b38218bb76ffd5c819982dd57126442cce69aa0e7088e26421cc5b2c8f4306d8d5dfc7f44244284bc89b091c606897122b9a7
-
Filesize
5.2MB
MD54f5d99cc1c7e54b50fef9c1e0eb2c37d
SHA17668e53f6111e56e87755fe7460ffeb5c77c888b
SHA256c40ed81706102aa62e6e1ddc316d437075676fcaee2f3da8edfa767f8e5ace46
SHA5129813595fbca924df2ba0a4ef4846931a4a369c65ebc3563d05008439f17ecfecbb3b8127218eb16c75455086e5b23f5d48b0100382ec56e42ee382097952f6cd
-
Filesize
5.2MB
MD5f5b30702da91497fbe98b4cab7f91dab
SHA119b08c995bfda7f4a2b413d3a720f85ce138dc85
SHA256ba5df5009ddf2fe73d06a881a082142978524231791b9f8ea34ccc87feb79b31
SHA51256f14157ca41392b26409574b79e2ca03ba0df85aa9862843fd485bd684ba16d58a384259a1db831648cae61d4f39fc5f9a19fad454b4063190d2172eb024f43
-
Filesize
5.2MB
MD5fb05c653d89cded595130c4c8e9e4e1e
SHA12c7ff8a73e60f81b44f53d69b46f4fe1c5c2cc3b
SHA2567856aa2bcac7e4940a92ab819886b197006dcda142a40472ae785937f3c2ab36
SHA512cb65b7c7e3df09ea547a03f7595843edb35d46780c47fe5bcdbf51bafab74c8253a8179c8624cd20431fbd67a69d460a89bff3ab5a4ea2fc26f5e4fbc69ecda3
-
Filesize
5.2MB
MD5f5e74a937836741e8ffe36e96412815f
SHA1d6d5086e089e0797ee41aa3c1046726af21c173c
SHA256bee73fd9cc5ffac3940a17559899957e5e2b1071dc319850b756907f3b11cd05
SHA5129cd3ce930ca7517f2482987937ed8e35f24437851746a4aa057a83c6cd373836e137564373189d67ae02a6b130dbf86179161f107fdf5d2a90f9acc51f71bcad
-
Filesize
5.2MB
MD5ecaa15a3b046a69de0ab96f42f9f0c89
SHA1001733defe536f1219fe2b98e58fa6eea7f34aed
SHA25608ae636e1c3839e403896f104d8f852c0ab0bd6af2b9bd0b9c97c11c41a96848
SHA5125635561b560955fa3da5ae96d44ce14a5754ebc9bc0a7015369570ec4d1c5f7e933aaf84f17dd8a28daed896b2a2390fcb982409f10995fe11fc5a11f0b23d96
-
Filesize
5.2MB
MD5257852cdbb3ae5de5b4cbd9fef08fc89
SHA14235fcc4d6bc39123bcb023aec50d66bd0d61bc5
SHA2565be968c9abbb4be00aead2f008e9d632148c3790c81e117992e4947be4ac3e4a
SHA512dfabaa69cf24366cf84daf35ab8f062e5f8763b4aaa7fe9396d8d9fc2926594598bd062b4f204420ae08c902c66c4b43b28ebbf2ab980736fca2c51672a74202
-
Filesize
5.2MB
MD57bba24325f2a1fa7071de2621c5a5dd5
SHA15aacd744a2875ebee2f1507436e7024016a60dd5
SHA2567ba5c14fc867cdabe0c6184a944662e700d63c4866f0c9f7fc0d2b1e29f3051c
SHA512b7e89c78c428096e901f239ea627e6f559b87fc5598f9275f503ba186d50d2125c2eab2cb9a1a88d7ad2ad8ac97a591f32b708b796ad7243dd47961d82ba2b10
-
Filesize
5.2MB
MD5d792bc4aacd309d1d98e941665e499ba
SHA15a831beb5a41e96e38416fb051eaec606a7d48b0
SHA256c4c102757ef2f11d1311717be4b0ea0f068296410d0aa6c0ba035ceb10e74bc1
SHA5125aa31985caecb3cfdd3fc5e1dd07c6cf37e6bc7518ea9816b81fad125ed74bdfb3c99e8548fb4ca77e5030b97cef4b1fb5da0d3f54e178790aa634ebd25545ca
-
Filesize
5.2MB
MD5de36e91374cc53cfbff18b9c41f46aef
SHA18ff9163b683b3625387b79d3823f9a97d3af288e
SHA2568fbead56d04485130ef0b1125b90a7610d7c7edde75c4804d8759d5ef418cc88
SHA512fdd3197d5b26dd96aec91068acf9c5012c80e3aa9febba52e0cee93c19fd00225728558d4c4641d41b8e6e1396c7c83793af2d86d12058b90c33b76495531492
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB