Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 21:05
General
-
Target
2024-11-23_b7e1714ec7fbbc72672716a1e63f7e6e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b7e1714ec7fbbc72672716a1e63f7e6e
-
SHA1
2b81fb1a8acb9bc2dd157c39d045b349c4d17cb6
-
SHA256
93bde989d9ecc1f99eec668819aeac5b97cafa12b1bfd5098d68e03f0df0b0f1
-
SHA512
15577d4aa7e9014c8912da8d8990cd1d410e2488cbfdb98d215e1528d70d7cfb228dd7bcc461c0ee6f85cbdb5dad71bf30d3613884d16fe226abe16ee9c3fee9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUa
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_b7e1714ec7fbbc72672716a1e63f7e6e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_b7e1714ec7fbbc72672716a1e63f7e6e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cCYtNMd.exeC:\Windows\System\cCYtNMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yWAadXP.exeC:\Windows\System\yWAadXP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNPGLAd.exeC:\Windows\System\cNPGLAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QjiKxDr.exeC:\Windows\System\QjiKxDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYAeezd.exeC:\Windows\System\LYAeezd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QwVGBBX.exeC:\Windows\System\QwVGBBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADhJAnQ.exeC:\Windows\System\ADhJAnQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzDHCre.exeC:\Windows\System\KzDHCre.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXgSHXB.exeC:\Windows\System\iXgSHXB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mZIHBnc.exeC:\Windows\System\mZIHBnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HXLDKOB.exeC:\Windows\System\HXLDKOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yXFTNiq.exeC:\Windows\System\yXFTNiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbNzvfu.exeC:\Windows\System\pbNzvfu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWsOgvV.exeC:\Windows\System\eWsOgvV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxLoJQL.exeC:\Windows\System\nxLoJQL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ramlzIU.exeC:\Windows\System\ramlzIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\onUbymU.exeC:\Windows\System\onUbymU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emeOOfn.exeC:\Windows\System\emeOOfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGWtHeq.exeC:\Windows\System\nGWtHeq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etiBCqa.exeC:\Windows\System\etiBCqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HUARZBu.exeC:\Windows\System\HUARZBu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f1d2d8ffd6acd3ad211a36f05461c02b
SHA141882e816ec67e11eeb8f0c853ab535d163182fd
SHA2564562f9e721be5bd82ff4b3f501d0bef7ff589689339196a1520b19f7044203ed
SHA512346e40569464078f621bcd0a97076e1af9445a31ae30cd4bb86631fee26f0ef2182f77f7b941a77b3b6b4d6ea276d11c064643bc50f06b2565e489910109f022
-
Filesize
5.2MB
MD5522c0ac4face6e37909cd1553cf9449e
SHA15b36dd9b3ff2c921457472748e3f282acbdfa556
SHA256a06a748dc6810870d610613b938de090cb58a7885e2ef89be5fefa5f658f946b
SHA51261122f7440a612a1a9db62f53ac8a084dd893e602feada1f874fbe9eba93d994bc95ab9e93a3c69b6ab01826dbb8460cfab2828714dcdb1f21744ad08bae0943
-
Filesize
5.2MB
MD5a4d590c8aeda25dd708a4acccf7969c6
SHA1e6f4ae9225e0ae4e165a1f3fc01df5873b1a1e1d
SHA256b9bc6c84ca0f0b0dbcff009098b68438b7e24fd96ac1d7b0b08d3f3c5b996d32
SHA512a5214c8850bba9ed151bd064679e616ca15cc64c30c808abb787a741780c7d4c0970d1fdd27150c1e1b645bd935daa1b86b4f5f5cdc2f9bd13603ee20cabe468
-
Filesize
5.2MB
MD5b845648afdcbba6d0b96ed551e4700d0
SHA1569833492aa2aeed7b768cffa59ac845462121d2
SHA25661f9174b9e29f8a2ac54caa34b742090157f4240246806e5f04b820b461393e3
SHA512d1e8d2b3ab6372e56afe18b64f6f3bf534b663aff99e2e593c2eb3b71b0370564c497bafac74083eb43fc358c942324ea81583eaa4a6882d82cef7e4abfdb00c
-
Filesize
5.2MB
MD599f13e9c9dbcd3dbdcc2e9d43c490890
SHA1502cf1a43cfde3b451ec9d97470c3fdde8e86f36
SHA25654743f3f52cfc5b68a3fc837cd832a6158e8b03dcb980cec4f4a47acdc7846a7
SHA512ccef160b2790dd4c2cef3ea0f4f886600d30a9e73bb911f934a44d8f32b68da195161c38e89ebc97dc9d4162d6a38e2ab0b330a71163a361cbec2e772db7d1e2
-
Filesize
5.2MB
MD5888465e7edfd5b17ff53cd8df7790343
SHA1d8004860e6252b3be14cefd7c2878fe093b18132
SHA256cc162f4af441251bec1d9cf03d6a54b8c4b85786d0678e5d0c73cb311d07158f
SHA51271d4a975ece51bed86fe64d28a60516e7f4c2b83ff4a66f0da372ff73892667dd08a9421524b603d082a139193b455f21ad4975cdb6ad8adfe10c20154da6200
-
Filesize
5.2MB
MD5e5655df6d9a9b70d6fd0e0d728c4a21d
SHA1aec126287d6d388c493e306ebacb4c05f49c4028
SHA25659b752453d129a060de6561ee14c3cec0995e18f0b08b3c41cd471fa8f0f9030
SHA512c2b57557f5945dbb742145eadc6d46d84dd737c488ff04d91d77156d21409e2c283de742ca8fb4985612e81e46dff1dd12233fd5b38e300cf74b6261db0ef9d5
-
Filesize
5.2MB
MD54e2a3a9d7e23fbc8eaca14b9e6691597
SHA189bb3b8d23b957c44efefad621ffccbbfeaebaeb
SHA256664184297b64727f2af589434fdf7ea4de5d06f3005211ca5b5ea0dfec3c8343
SHA512ded0e07b208958444767011fa7e872df98ba6403200332b31eb882c3007a7ed913e0024f98070beb2f7d5d6ae9e434bce5c14610d0664280f1e51fc1163b5acb
-
Filesize
5.2MB
MD53015e782c8bb88d8d230a15b8af64cd3
SHA1d732e35721d4115dc57f9df135f9b0c2858ff300
SHA256dbe932dda623266e49027ee76468258c65cf130bf2493b62d488689ab6775ac1
SHA512210e12c51381e5a092258cf95ea7e055203c005d23200a7fc3e33c4f35fa8b7419704e8a9207c306eb469977e2a72c55c90524929665c02d64d5c03a838130b5
-
Filesize
5.2MB
MD5a4196a3ae4c51bc63cc6f3d54d6f0793
SHA1ad89cb975fb90ebbaf13cfebab5fadad780364c0
SHA256afa9e14b08901617016ceb9b6f81df107468b20e8b2b84230713af29789f4ad8
SHA512e565ac3d04dc23dd396f84195d58042a6c9da273af7b9f53e19b54cbc99a060a461da3c127441121ac1c3ed7f045cd230d41b24e2a25221b59c7ab5fd041e656
-
Filesize
5.2MB
MD50fea2551f184948195287e4d47520ff0
SHA1b0e749a99e7a8d3bbc3fbffa5327fcfee2307db8
SHA256cf1b83293f1ed81bd80723a7ea88099129027ccca4ac7531267a12ef493b4293
SHA5124673fb592eadf478969ada2379ad10495eca93afe82eb978f7dc8746af93aff4678bbc6942e9d97d8339864400ffe0c04375e27e17110888b54efe26c5bb1248
-
Filesize
5.2MB
MD51625b8c3af771f94b8baeb69e228ec6a
SHA1b0b094d2d2927f3d18b43ed660b6f25a29c901d3
SHA256e1450223c4d2d54ecd899c7558f66ce604dc3e1e925bb00e56eb16c4e9050960
SHA51214a99a326c6b3e4159e3303804159a5e9897085f0b753fe53835b70d6bf7cdfab8e04244848cc98536a19eb456392795f4db7988315d24cc2483560734482e7e
-
Filesize
5.2MB
MD5f576cfb8329a928f20a5f9a949dcf01d
SHA16c0a684fdbae3f1688188b610d6931812538f911
SHA25621956d683c474d79bcfee8461e61fc01c50fd8611def4647579d9512a6168275
SHA51206f0e83a1e8f5ebd3753b9a69597d97f81a41ba410a41d946da20b35b2edbb016828bf9aba85928d114bd67cd6d404bd120c0a5c0619fc1364d0038431ea2119
-
Filesize
5.2MB
MD5a7f4a8186c6490a90f02078c03743d43
SHA183f178fece66128dbfd01f997b38c9707b243e14
SHA25654696d6e5b25d9e2afb5adc33c278d77795b839c364ce3a8f95fc1971a8500c6
SHA51298bf7d17fdedee8ff3f6458c76e62cd993478898ed395be76a2c33610283bf0e724b6db50d2cc069129ada822208c5d21d252d8771854fcae053866eb04aed11
-
Filesize
5.2MB
MD5b1099d7b2546b1fa09014e2416ea4ca4
SHA1d441eea1eafadcbe006b1c771366ea3364a54fb3
SHA2568bc5d79f0775d9c3fdfb08013d6b2446c872b1a0db8ec3611a0077a4548f35ee
SHA5120ef1a1c5f05db0f9b1d7dce6e6cd5dc163778cd21caab8ecce8ce0da2b7a04276dca84ed7848728b03bf6f086735db7ef2744102982c401932ab64654d9f52a8
-
Filesize
5.2MB
MD594d48fa98fa1d4090194f5dee6fbc010
SHA1847c00b7686a35dd7dcbae0fa2d6fba5fe8b4b8c
SHA2562887d129cfb9bd05e204577c592d136535bb71506ea8afb77d5294bf126d8558
SHA512718c987eb033e2f13f47fe5d695ad12b4bb66635436c7e458f76246b51e154625f5fafd9bf5be865e1b9381d351b64ec5cf2d80935cf5675270c8b997385861e
-
Filesize
5.2MB
MD58e691b0ce30175ef90f42f0ee0ecd612
SHA1c78e0bfff210e7b918912e4f78816621bc558497
SHA2563dad8546dd3fad5432264403ea55d034acb78509cd608c8275170fe892e9a388
SHA51298ae01aeaa4f0e384646b21ad68ee4e730fd24962696ac6e9044ff612ec4127da4cc993c78927e9cecf4b595a28ff0959440c855ecb5f649217c79a827f9c0b5
-
Filesize
5.2MB
MD560bd26d74ad478471925e3d7c16fafbe
SHA150956f43bde80f3e5bfb5e03bd9430cc28875179
SHA2560dbcaa7a8d2d1bac1addc9e552d9fcc0796ee0c539119d06ed113d2625b23cbb
SHA512dbc628da833c1e2122b05e4367890085bd617e60c95e91b552faa2c3cfe32b339315cb13601ba32f43ff9115fbb2e1e42597d565b0604e36ed28360aba8b527d
-
Filesize
5.2MB
MD59cc4acc589727393c895384d170ea16b
SHA13bc5e67a7507f2f5fd57bfa7d00c9a6f2027d28f
SHA2567022007a552c0f5de0578397188e92793a1856d658eab8a868a43165409fc2a8
SHA512cfc1f52c630e5adf6fb175905db519942826b6d13a20c3aeb53b1bebe96eb8c4bbdc634795c50825ab7e00bb2592857264a7e3bd23d4786589d097c78ad6e381
-
Filesize
5.2MB
MD5040967063e969db316e8936c61aed3c5
SHA10f1598a2516171a6a264c1ee81e362d6694ba9bf
SHA256fde4635de193fbf91e1cda7c3d0a6b8e5eb775c688f10d2880605aa18b928190
SHA51260201b019c3174e9f58892772ee0beb7a69cf71612036b9930d00da4e82022ea4c424ed1b78356d8939fb25c7708d7efed0d7ae6870b48e4796d3156cb1abbd2
-
Filesize
5.2MB
MD50dfe2c88724c8478c3833c83fa2cf739
SHA1d87bd91383ffb497ffae4781cf22f446ff80477f
SHA256b5136cd6e3b5985689ff2c29c938583b9453a0e87510f317af9fe5a7fa8b4ffa
SHA512410915f5d0da7db1fcbc2523c80f0d466879568311866b7d399add1754fec1311e30922f9b0a1bda5c6f3c5af5b5d17f1966afe09b09d75984f4453fab54b8d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB