Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 21:04
General
-
Target
2024-11-23_3963418b17686b038bd362da1c25404e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3963418b17686b038bd362da1c25404e
-
SHA1
daf964dfdaa1891078e91855f2f7eb2ab8e967dd
-
SHA256
8d19cc5138dfa504d97257de734325f78861394eadcb60307c095d2f2d79c514
-
SHA512
b92589bbb293fdf876403123d1f06fb732dc87d6e90001078d6a86a2a35237c3e82eff03cfef79b49b7e03964bcb8a15035bb896a33b4a5d04b8245d6cbe6921
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_3963418b17686b038bd362da1c25404e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_3963418b17686b038bd362da1c25404e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lHLWfKz.exeC:\Windows\System\lHLWfKz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\micsBry.exeC:\Windows\System\micsBry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jkgvQfR.exeC:\Windows\System\jkgvQfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRWvuiM.exeC:\Windows\System\uRWvuiM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNXsCmY.exeC:\Windows\System\bNXsCmY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGPsKoe.exeC:\Windows\System\eGPsKoe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XBKhrYq.exeC:\Windows\System\XBKhrYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDeTZGE.exeC:\Windows\System\bDeTZGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FhgFNDu.exeC:\Windows\System\FhgFNDu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YiSTEVL.exeC:\Windows\System\YiSTEVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zjIHKvi.exeC:\Windows\System\zjIHKvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCnUnXU.exeC:\Windows\System\DCnUnXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISyZwtW.exeC:\Windows\System\ISyZwtW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WSPxUpc.exeC:\Windows\System\WSPxUpc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPZGgGZ.exeC:\Windows\System\PPZGgGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DKcfpfQ.exeC:\Windows\System\DKcfpfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpctBKE.exeC:\Windows\System\BpctBKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjFRbmh.exeC:\Windows\System\NjFRbmh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPacMLC.exeC:\Windows\System\rPacMLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuNQOSW.exeC:\Windows\System\CuNQOSW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYqowMN.exeC:\Windows\System\QYqowMN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a57dcdc051e7c6d752eb62b93967694c
SHA1f27ed3a9ebf0088e807697c0b6ba8030555aa3ce
SHA256d5741529555c38868f9d8e3ac11b9c2c0450b60148d2086774062f3dfdc48acd
SHA51224201336faa1aa354168e400ca2dc286f0d751898e581d628c7f0ebddc5cfbffc39ab4dad88413a406e1489cf624fbca3fc5a2c1f6dab614a30877bb2827947b
-
Filesize
5.2MB
MD5b5c5c5e70833d4ba9a0f3baf3408f64b
SHA115af99f7f76bc3561d8615f02f99238bce23bb7e
SHA256e66b5295c98e8e103aee1975ffe4372d46fdb7a2546da643e5415ddd163baaac
SHA51248cc22d633f93023e52b62e8287daf6dc69bdac54e9fd7ebb300e5278368dbadbee3ff448e1a665c2d7acdf9ca9994b971d09332d5061cd51986a1f7d4adc911
-
Filesize
5.2MB
MD5088d43f3d12f9e13f78fed90385a3d4e
SHA11190b6cd0660768178baddd6e27fc427e92d9e42
SHA2562798255c1c596f49be5b06fbf99d8c99a29ce0f1769750b271afa7d587fd7a81
SHA512307275f24a6ebe32a03c53bbc10ff1cf9a0b6200e8d48d2fa2456371089b8b89558c90a29587aed40324c74e76d7e78b4b24433d2895636965078d3c3fdc2ecd
-
Filesize
5.2MB
MD5f6c8c029bed6c16064af800a70e74508
SHA17606e21011d15e9d97eb711a4d993ee782a9a623
SHA2562db48cbce4a04c5b17ff4f865ce36033609335d32f0d0606ac022d875e9e09b4
SHA512614d172c2aeaeca2461b4755525ee12c4f077fca47d6138993ea29800cb8d36c19d969f85fba71399c1bf92ede9478e036b6b5ece02877a0d4131fec61cc931b
-
Filesize
5.2MB
MD50545acc69d37416fd8e33b5ae8159322
SHA177152a08280a5078779afe14b19d4c46e94c9d37
SHA2561862625ae83f8da99b34fae362695fafb2133c06e7ea4d9a425d2e405bfe2547
SHA512b43be0657494a2a52bb3c831edd47bae372bbeb388b405c4c32b48df171413ccc8d764d524060ebeace09de460c02dff80ba66648b6ed2383a8e2ac6da2fbd19
-
Filesize
5.2MB
MD5897f2a310f0431a316c4fba3d823c6fc
SHA1715a95ed0ac322a8a9df19b216c1bebe773d47f4
SHA25680667a8c44867b9b7850b984d46776b0ca4530c2b0ef4d0ac1f13c188e3bb43f
SHA51218f6a9ad083f9a76d83d584d6b77968cc15679b7a39c376e57341c9146204e48320479f18df4a74a6ca79b54ff2af0cfe6ea98e950cb2d5c919678055e53738b
-
Filesize
5.2MB
MD59b64ce29b041c06a4bb0170a8691ef28
SHA111a07bab0a450cd1e8ac98418b725385369f5b11
SHA2561a1acd62c8d953accceff8b216c8557b35aa907a3d075c7ede5c3463b110b47f
SHA512d9ad50b5c540b6574dac3c2c7890a2fa82e5180fa56a48841517fb1ac66d353ccad440d79488be42e2c9f8264b08ec645ef15e2b0b5174ed2396bdc21b71d3e5
-
Filesize
5.2MB
MD51938ded42ab493feb5c74078c6787cfa
SHA1d5dd3973d061e5885c68b58bf9f66806b8394690
SHA2566156ed5092a57a5eb39377db2da321f5e041b9408faa5e44c48252051d0cb084
SHA51273f4fa6b339b3c46d3a8fe72cf32368abd2c51fb34752f98e2d54643911682951fac41250fd61a0434b45f33a08fd301c8a4f83ad8eaa793755ba207dff19aa1
-
Filesize
5.2MB
MD53fc84636e5ba12890914bb03b8b2f8f4
SHA1aabcb56bd7aaf88fb273a4ca278c2217b6266b46
SHA25652b91f7524c6d2f446419ffbea05cc16f11e6ad922a240bb4480b2817493a39b
SHA5121ddb0dea1730f91698407f671a8edd589d7e1bf5564da83c7b602fb9bd8e5391a3c28b5db51a2fe361458c0db4fcf513d62905944fae884b16186f3fa8aa23a5
-
Filesize
5.2MB
MD54f3523403b92c893c5ad66d89f976c6a
SHA1d0358801950caccf9a6b2f0abc85965173140391
SHA256d2c2c92ad51bd0859a045a31924883c8da8b5c989ae77e3f53f3fa40a199e084
SHA512546556ee3bc8b68a5357b1e76510bf92026251616b6680f1a42210b47d17c4df53c173ce5d4abf9cbe3ec40cd0d72b29c071561ea9388f1c9c6dd374ac81e99d
-
Filesize
5.2MB
MD509ff015c1975a815722d8b72703c0db2
SHA1947dfefde75ca666b677604a20a450e77b65f730
SHA256be50c7264367ed8d90828a2f8d3f3f616a3991609e6a8d38c1c843f0a894e6ed
SHA51296fe839e13277bcceca511b82afda6319dd56dfdd88a84d71e89c1fde5b0ee3b74faf792416ae62a909536bb1b6deda2d9b273e2ffc8fc7a7727d197cb18593e
-
Filesize
5.2MB
MD5bc40f88353ed1862050fbad142a86326
SHA1069ff6a45b497631f0ce031ae4dd0f281cc5b8b3
SHA2568fd06c7f5481c7ad4c4b472f1aea0641bfae7787a9696863a2518f1da288fcbd
SHA5120f318315fc4cde185dfda89bef7e14e55fa7f38f6bf3c7e9110e30a53bf320eedbfeee5362ae3da37b1d2fc3e2664f9623c37106319aa5d2f05ef1c350ff1a83
-
Filesize
5.2MB
MD56e98b226c56f257263b2032ef28c78e8
SHA1fb135c1941cb4c4d482c2cf5ef210e49c13c6870
SHA2560b257c2d60133fefce46e01d8c3233eb7c7f083b89632797d2dd864e1d25895a
SHA512016f01e7aa80858dec162ed772076f7e2115ba4318c3a1353702a9b16a04964192534f054dd0f9d7d311a8cb447de2db8aa869f437216252b3c063986a324770
-
Filesize
5.2MB
MD50eac1ca3dcba4ae95679815cb86c9f78
SHA1589b9b3167496e4ba5140790da7d6669e1096b91
SHA256d93538cf52471982b9906f96dad08a3cb560ddd6516f93fe8826f91c224e1316
SHA51298142639dbd0207be30e2581d65e1363527794d872fc85dc2b9bd0d0d280a1927081ac1a5d4552a5eab5bb38f4892bb3645c15481c775740cdaa89f5fbd83c93
-
Filesize
5.2MB
MD5861326e579558c462b46c13bc46cc7d2
SHA1d2abea55accfda0c373c76d7b3c799e3430386b1
SHA256a1c1d62fa9ce3a1b31396ece4f451c5415d1986db1f56d23555b3e8de75474a3
SHA5120694143591fbaf7fba2ee833e50989cf4788b19bec3e305e773c833af457d9f770942bbb21ce0f0746fb08335fc724bfef0630b804c02d86c43a5bb9437935d3
-
Filesize
5.2MB
MD540955afc7e34d207d32a7a0547c16adb
SHA15ba43b1eb06260dce2f94ce5d77d763604499b0c
SHA25624657b093574e7f1f3400c758ca1772475d1fe164f1988190acba3260b739bca
SHA5126439ec47a799959465ec709cfea19c9a2be89d4d425e14184f042b40b50b8ef58fe8ae0eafbcdf62a6ca0f2101cedd2e662e5cf8c0c76307760fda9617668a0f
-
Filesize
5.2MB
MD55a79628c9374cf2a03008b3f8a377db5
SHA103c57a6b8b5bb1f8e96ad8781acf40d76bb25de4
SHA256022295a0b3dda12805434f86ab4ca7b6ce3cfe584a15d2b200804e86c6e2f17d
SHA5122bed4c0f918cf3cabc471ac131e65068cd8c66585ce4c3aaab9a2e105eec0ba230a875e565426358cfaccef001b6e8ac2b2e53e83236dd2e15b080ba373d522b
-
Filesize
5.2MB
MD5be23b622c3a9bb7c2ed3074ee4e832ff
SHA13707e60216d49e67f20f7e940a8364ef9a225865
SHA2563d94178bd12cd27b8627f7570e09f237ee635b6982ca160400e5f9ad6789e765
SHA5127cd303e303a17705dd0eeb5d8c931b947d472dc659fb6786912b1029378e2ddf305b8d224e8ceb66ddaea75b8dc991f5c9683603be8e76c8c3522b12e2a398af
-
Filesize
5.2MB
MD59830d94b2aa39e464907652e27327997
SHA1ed4e3df613d3787c439ddc5bb985745dc21c0926
SHA2566417a0618d835533650356104bde7f915e5cf3eef85747d7b55cf509f89141e5
SHA512285acec04bb5b5c63bd8eb30bbe2aed1643189e3750c027f848e7c8d3e9932e59111f6b12861a75d4d80e5ac2ee157638e0332f8adfa225a043614dcddc2bd71
-
Filesize
5.2MB
MD576e8bbc6ca2989549ca3eb6ed284c05a
SHA10ff134d16fff444ead9958dc8a73b4cf1bb5c027
SHA256ef8e242600118abe65a1ba3ae51d9cffd51408345d37c59bc27bd4c3b3bc9212
SHA512039ddfcbca681e100e22f6a62fce8bd82ac2b6f5990c2c93e6ebe4ba74b1f79f828032b19ae145a84834f4548c1f6509ab9a373b8a0a3145bd84500a770d7bd4
-
Filesize
5.2MB
MD5ff3fd993bad31a96867e9ded20ebd241
SHA1d9045be7357a4f1a50fe9094a6eec11d61a9fac7
SHA25607901b67414ae0400d22bcbdb493bfd7cf1be375fc131392f7c6a6e16f942a60
SHA51291ab0ef40d738ab1e23a429fec5a849e5dc930d7500fada381c56b9f0e44363727db871fef48fd5a77a05681f51dc7c899eb4b712c07f8736322cd91095700dd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB