Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 01:39
General
-
Target
2024-11-25_98e8cd35a89cfa35d476d0c6eb1bf290_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
98e8cd35a89cfa35d476d0c6eb1bf290
-
SHA1
6783c09d6dc4420a1555b537dcfb473764aafac8
-
SHA256
1c4a5d9d7fc7c4baacef4b115da79e906a81300315478b397cfed300d65970cb
-
SHA512
d0ea7d96b756008e49ad08a808d3a19c4abfc881bea66a76f17009b4eb30b31ce2ed13f894096b0fb4250771bbec72f788235bc7989132eb69299636e75d0bb7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_98e8cd35a89cfa35d476d0c6eb1bf290_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_98e8cd35a89cfa35d476d0c6eb1bf290_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KQSOEvH.exeC:\Windows\System\KQSOEvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TiQyQcu.exeC:\Windows\System\TiQyQcu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QabeQOl.exeC:\Windows\System\QabeQOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WAJOtra.exeC:\Windows\System\WAJOtra.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcEEYzQ.exeC:\Windows\System\xcEEYzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBqhWwM.exeC:\Windows\System\rBqhWwM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJhoeBi.exeC:\Windows\System\iJhoeBi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hdsuCXn.exeC:\Windows\System\hdsuCXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nHslbQu.exeC:\Windows\System\nHslbQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMvzEzU.exeC:\Windows\System\mMvzEzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SZjmuTj.exeC:\Windows\System\SZjmuTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ivyCjIR.exeC:\Windows\System\ivyCjIR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TafKfHq.exeC:\Windows\System\TafKfHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGfHFkO.exeC:\Windows\System\OGfHFkO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNtAJmt.exeC:\Windows\System\RNtAJmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSUgIQo.exeC:\Windows\System\KSUgIQo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evPgNQD.exeC:\Windows\System\evPgNQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QhDMwsr.exeC:\Windows\System\QhDMwsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LIvTuDr.exeC:\Windows\System\LIvTuDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XmvIkcE.exeC:\Windows\System\XmvIkcE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGPmSFB.exeC:\Windows\System\tGPmSFB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5aa94ec341dbc4f3523fb7ae031aca952
SHA12a53a674d534c33c709bf2f98d73daf7a7b1d962
SHA256d926d8b39b87a31166aa8b51e790fa8e9065659ff0a1e079854df05862602553
SHA5127c9ec7a269eea4c762dae9812a12fc10b441ce28eb63534523e4cbf22e0788a8f3895b0da599bb8fc36de1f83b577e68a438b0f3b7dac9cb2378ab45b1271fe0
-
Filesize
5.2MB
MD5161010beae7f046ec5398f2f41713c34
SHA19ff2bb7e545c762fba9017a6aa994172c39f378d
SHA256cbfe5cddcf39824ced2fb7eb598a531de762b6486ce848056a12ce466e4ceb0f
SHA51296e4bf4b1abb60d9bd119cf03cbef869e636d3ca9ed7ab86052770afe645ca48af4f4d80ed6d3bacc3cfb182c902f1cb1763e34f829cb550ab995bac805024ca
-
Filesize
5.2MB
MD5b450bccbb19a5d6cfecc80c97e2e2353
SHA1daedd0dcb5c8520d0366a8745a143dc50ea39320
SHA256a5476e72b837986b2e953d88e67afaeb54636862ebe4edf269b78502ac18a1c5
SHA512bd1ce35dd8a554d0e0cedfa703552be7b011e7bf696bf7d185125099e54d94bb02fbf0ab9bb6c12b169b50b4baed5d6bbe6649e262e0e21933d6e6f4aacae633
-
Filesize
5.2MB
MD567c7f1bffb10d74142d5ff596608ee7d
SHA18595cfe63a9ea87941e172d605dbd581364393af
SHA2567215ec0ef75c53b4655c57cb53754c459dff5fdff78aa33ff77c74dcf6ff398c
SHA5123d07cc36d88827dd8ac74e3d7e019b8282b4c6ceb4e130ec4e521f29dc99cefceba4364322c9f351cae60ce21b2616f25fa03999998102684c65655cd487cd69
-
Filesize
5.2MB
MD5dcd267945009139b92498f8e008b6451
SHA1ea11ad93dbd6932f20d9d7daf285b1f124980bf5
SHA256c96253220997f24aff8fe41ef6ae7cb25e442748cbfd43bd7b2b9ff32f3f29eb
SHA5128fedfa51643b7aea69a5da6c743461875e1c0488e202e49343815e6d9747edc7745265f6061ea7ac9055d0b3fbb5174e670859302e76e7e8dc3c8d84d545eb5b
-
Filesize
5.2MB
MD5c16d668fc0b3f7ff9e7b2b31faaeb82d
SHA13d2b8ceef20c730a7103f9399b3ecee9880f6696
SHA256a3838f360f72a0edbcd572f66572a67208c0f253e39f017505a4c4ea88c21304
SHA512be07d70251e81ad58ecce0227aa334f97d84378948ab469057813f7b614d166ce4313c138e20fb9843f9f07fe049035e1182d4d5ee99c13eb35ebacd5e58a818
-
Filesize
5.2MB
MD5b04f356fbd82d544ce54956778a53359
SHA1d96ccecd1b777b882302d372dba6c26798f0f2d4
SHA256a6cd3a5faffb04b56a494c7e939c584f67549caa568be0885748970511d913c1
SHA512809fd8755e1a881d38b17d7e97098617b235bd5e4d857159c58de9cce43736407367c57d3ea691de90ad2cf6d7a977dbc24ebf59091b33bf828540a1238116ff
-
Filesize
5.2MB
MD50987fbccb065d3b4fb406fed4529db0e
SHA160d3153800520d546d289adfff1d54a99de8b1a2
SHA256b76662c16b8c39aa345c1e982d143dc2e113bd817ead10701559280d2a4ffda6
SHA512a79cfc62c425fefaca0ee0569e595988624cfce2e8ca94a163a3ed5900eaa401af67f3d0c80ab93edda34ed438e0dda91cecbbbc447780e7ec2926319d071b96
-
Filesize
5.2MB
MD5e5da9dedc3c8556c5c65d3fc7d031c51
SHA1b01f07ac7cc09ddfa8e3a60cb5c1723e81a241e3
SHA2563eaf6fd4af39b13a34e6e23c0327c9a07ab6762a7c4df68dd74b612981372531
SHA512a7d303b65836351a2832447bfa2e7d956b9b3736998f14e8c5b08eff95548a87ffdbf1835d83a5d214ba02aee6f04fa02684c5d15a0edb6c9aaf6bfa68f689b2
-
Filesize
5.2MB
MD5ee289d748322796e2010086d96b20f19
SHA1ce7ad4781aeba035091b1b2685f7e47871125d23
SHA256836bc98ad9a241ec75c22661bdffd7a2f8ba60438a1143ae40b4f53ecf9d671e
SHA5127e3704e998adae9fd508a10937a1a365f2500379629caacd6acee2bfb8665ec47428bfa0c068cec0b432658da17bf346c13d78ba9210c548f85ab788f8961ced
-
Filesize
5.2MB
MD5fa3d5c99c093b4b1245bc77f6b95afd5
SHA133b9636cadc532a383e7c7bc4500482db1b33c50
SHA256aacf21d3af507730cf38fc133e886f3c8edab532be199ea9e8f5aa45a19533c6
SHA5125fb776d60517f90cc82b3e22da9a76a6fc1631fb1be67aa13e2c8fc775a8b96d9a64bc9f7019f0ee21146abfe9b35ee7e616353ac4c4159b1a02076cf07b1739
-
Filesize
5.2MB
MD590181d719b7452857f9ffb0ec18fba8f
SHA1e757c285bbd3cddbf7a36162fe703167363402f7
SHA256d9c348d8c9727c08c43f0da1546247a35b2475455ba374cc3259faa2a7a65454
SHA512aff27694d4d141b54575293bbb053f67bd31ea56cc1774bc59e83a0ab64cbb0a2a2cc1bf56c5163da62cdf2bd385578835f4c184e4740d06ce6f90e544c23166
-
Filesize
5.2MB
MD50d457f469b0169cc1830b1aebae2b625
SHA1477f76a3d3296b9a81135f1e0c4ddf595ba85a60
SHA256b0450067e8c9834c104376538f1552e2154acb131181aa4783cec5bd6fa23e99
SHA512f5744a4d3b67c3f61cceaa8b99bfda16625084dce145670cb485f26625a6c50c2bd63252eada5f1b13f6e6f8394cf8cc756e4e887fffbda0abcb6224cb8b2985
-
Filesize
5.2MB
MD5dc22362e0a3e3acc656b56a8abf1cb99
SHA120f7c6431bcbbf70bb27699074495cd3852da276
SHA256e8931c461f156ce6df0fbc492fa41d2e1c05b7993d9fbdb2f34e7a2adbfe9bdb
SHA5128e6bff8cec4c22b29ac7a887b1212aa73eb7a4583e03492131125333fd8df929a4f5eab354e674835911bd86845e42976748fca5d85951454f5ac762d1bc98cf
-
Filesize
5.2MB
MD535716c9e137aabbc222cd070a331ff80
SHA190d89f61b9d0f21e1303156645d71cf0beadb1a6
SHA2567ca1b7a08a5b18731ec39f38209a74b4439973e66cd5503a6885e4475a8ab1ee
SHA512a2224238dc7ef4d99af615cd200e924315858c27c722e731160b6cb813c2ae398a13a1a20299a754c4b82eb9628d9b628f622e8a4fe6b5d6eaa93a76aa2753b3
-
Filesize
5.2MB
MD5fb905bb25bee83b023ba3bbcd1f54db3
SHA1cfbf5a1de25f096ca1e1e14870b5c459b3756f5b
SHA256f91a0babb455e78558cd651ae6bfd327ba9660de88fe7529c38081cb155d3945
SHA512a00b6c9991d03478f6fad38810d11103b281f8ff975b575a759eed50e7f55d51b388926ecb930bd43767569490091cd46ad0f13844168e1c4eadcde9fa564340
-
Filesize
5.2MB
MD5967e7f622dc013c98e72d0c0d14e614f
SHA1d800c1cb8aeb8c841b3d7be5fb6b308bd043e57b
SHA256ee6aa5c8eb8b401708fb0d970520f628ef6cb3741261b235c42b58aee63f9f12
SHA51269c0d7250e4d216c070b748635c211c3c889120a7e02d794c67bd6ed3debbc338d27ee70cb612b708df98ca7e5e4cb1de3592252c7f2ea993e96c10940838131
-
Filesize
5.2MB
MD5096c34709939ef04dbd5589824fd55c7
SHA1e183fc7a869e1ef93e6907b9a622e969346f6dd3
SHA2565fa9d75865451afd724c1d227d627a69c809ff3a9dd0614433df50719ac37771
SHA5127e64ec04125b2d47ea5d2b1dfdf30ab0bbf6e96edb1a6a0a436c02bfaafb0bead4c8400af5bee411033471008ef84f62edda69c0ac9f60e7b8ae028bba337960
-
Filesize
5.2MB
MD53520fdcf99a04f09a4ee64d7ff40ea18
SHA1a3360d458bf45e09588c7d9a6e37381dfb908106
SHA256c3702232287bec41a2940604693c04082432b509bab78ac191348f1a7ca63c36
SHA5120addb1b0d4cfe4300eb3a297b9564d41fb90cb5cb368169c5f4505339f21032dc9135fcad5afefa8ee650f293816eb5bc5f614093f0b1716a4e6aa4145e4f263
-
Filesize
5.2MB
MD5e26170e28a5342584ed43745206f5e00
SHA17a49a0fedf6d0aa275e5bd4d052142adc13fd4b2
SHA25636704644744e5fce17b008442e13cf0157cfe9b40064c5c89b291be96cf65b28
SHA51274d7c7c15154448f1fcb5d1983b01010d55d50714fa8a6818022d5e11cb20e58f6b8f37d927b9c85f0f64a13c20232bc662113fb7000b8cdd0fba47dbd86f066
-
Filesize
5.2MB
MD5e29c8b376f4e4980ad8beec42c39acab
SHA1dca780770ffb6751dd5bc5bb32044f1510040281
SHA256e4b81d2ea5b946f57b14c80b6af31d37bd8332df662d25928542584550197ced
SHA51248aebaa990b4095649c9aef16553865d8e64a18cb8a0247ff519ee4043c0057c105ae5727167d803a5eb6d797a5cbf19e40258eec267afb353e638ec703269d9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB