Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 01:38
General
-
Target
2024-11-25_879d999c337806bd29b7bbc0d5bbeffa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
879d999c337806bd29b7bbc0d5bbeffa
-
SHA1
4ade20fa079acadd0118cab11359b7c1c315e714
-
SHA256
905d69f19e0c2acef98b0a094bee101df191156204f41bd86d2bdb9dd9125999
-
SHA512
346dd7a59fdf963adb46462fddd0b00e89a02d37d9f04443437117e09b902b387be18ec8fd99f8f81631b7b4fa3ac32d9d78ade862d95e754ee25a8a1995aa0c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_879d999c337806bd29b7bbc0d5bbeffa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_879d999c337806bd29b7bbc0d5bbeffa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PkdEvKb.exeC:\Windows\System\PkdEvKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLrRmUn.exeC:\Windows\System\mLrRmUn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyQoEaW.exeC:\Windows\System\wyQoEaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZiLwdnJ.exeC:\Windows\System\ZiLwdnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ppdPTwQ.exeC:\Windows\System\ppdPTwQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCGfSJH.exeC:\Windows\System\CCGfSJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWEklwG.exeC:\Windows\System\uWEklwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSjKUjr.exeC:\Windows\System\gSjKUjr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IhlBAWt.exeC:\Windows\System\IhlBAWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MuoCyUa.exeC:\Windows\System\MuoCyUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naARANd.exeC:\Windows\System\naARANd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAlUUPM.exeC:\Windows\System\nAlUUPM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRzYDQg.exeC:\Windows\System\gRzYDQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwwEnzH.exeC:\Windows\System\lwwEnzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIWckNf.exeC:\Windows\System\uIWckNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NXWViMp.exeC:\Windows\System\NXWViMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\anSGCTA.exeC:\Windows\System\anSGCTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrHPtjf.exeC:\Windows\System\CrHPtjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjzxBRd.exeC:\Windows\System\fjzxBRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YDstIHv.exeC:\Windows\System\YDstIHv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIwthEw.exeC:\Windows\System\qIwthEw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cababa5f0b8e1c404b061288e7d6584d
SHA19eb271884e9418cd379ebd022792d4fdf7652fbf
SHA256fb7af4e46fcd26c287729d3371adc8c8168f83bb0b1b3e8c527aebca2fa0337c
SHA5120655a7e1cc078cfde8e8335596646c327b20a6fa0a833ee95a9090d0b66cfbeedc8fe2fd0eeada4655641907135c82db83ee52249e1dd6ce9db3639e9b165c2b
-
Filesize
5.2MB
MD57338e5b75d27607016d501415dc8598d
SHA15b9dc337ae16e425b30f1de55d451d2ccd0dc6f4
SHA256f4354f6af444a20ebc1295769e94961e85b55447c4a7d0a24e5444b9cc7fe37d
SHA51239e88e410eaf021a69edabb74bd3250ac1c67e45ec0f7dc288643e2716cabcf62af14b0aac2bf3a24856a73920a063d50212355e2fe4b281c8afe892bc8a225c
-
Filesize
5.2MB
MD5365fb04fc3e30101b61bba043bf0461a
SHA1f032db80206ebf4611399564a6db22eb724e5eb7
SHA256f68ee0a9d0c3f112a3bbfe3dee60731ea1919135259c3261f371a3cdc614bb8a
SHA51228f6e8aa1096a1499e1f5b1db97f4ede9d3965451e3f2a6876c7a7b8031825bb1c7e03c4fa3d93ceb12a074cecb68672f52bcf756a55cb484c7be98c0469fa20
-
Filesize
5.2MB
MD55d70cac634df933a0139bd34adc91174
SHA1e7de50f4f752daa562813b1f9eb79f8daf852c64
SHA256fbc1d3cd6d0b73fb4098b74b8b05c2c84cb10621607eccef299b1956036dc574
SHA5124de4063b613d125f2653d4f52a186ac743e4d969d6f440ba86f6ac8e90e2122698bef5f83b6fe7ab6e2028d3b2b9a5f455d39c9b44d199e0e45b26f245f26bc4
-
Filesize
5.2MB
MD5ab987ad6bef0d79a79e1d39f6dc6cb1a
SHA1d855622a9abcf7fa42453858b06ea49647b1c480
SHA2563f384ba365222ac33ad08abf0a2bccc204486d27de19b424aee5d258b5cb3498
SHA5121489c3a86a6a314a5dbc09cfb3b66484186818d6cb3ee5c25df4c7dc838d3d5fa670d5fdb3cc09936f423c087eab4bf56b2b73622b9c44a4c91db016ca61247a
-
Filesize
5.2MB
MD587a45da81ed9a60ac8ebe8b575dc32a7
SHA1bb4fe442d0b8e8ae56e68852cafb489134d108cd
SHA256d9f9b21066b1c6bcd5a9189c8f066b42ca605af6c89114747307f013d1f85f13
SHA51243b6f385e674a5aa704c93d9b8bfa48262e73708803aa111969ae7bc8664120caf60d28bb9166e9122a2d30509ee18fe3aca093bf5eebfd72c8f162070031b19
-
Filesize
5.2MB
MD5a7bff4533cb0f6ee960e7075f78cf6ee
SHA1d339161dbf9d937dee0d282b615b73530a18c5f6
SHA256031c1fe5c7c9f0145c152074763cb965df7280ac99327234b3e576d98300e94b
SHA512d9f06ca86be4027d2311c2439bea3d2d390c84a1d987e296c815e78ed568f8dc92ffdac3c1d437dadce553daf11b14dd5b5b708fcc1b9f82a3bb6b999dea5042
-
Filesize
5.2MB
MD5f4ef671910a9ce4668d7e43b5155c287
SHA1633e4e7bb04199793b7e48382442ed570d566875
SHA2567ece40e9da688d7e56168aaf1514f1830e46a4eeaa1ed2dbf9ef60ca0e9cb8cc
SHA512a65f9d6b703cd72c8dcf4aacf3081bc80003b9142a60e2cc67c9648c983adb1c4089dc779e606d676552c4754d41f2406d14d7e1976652ac155e023f2f8a85cc
-
Filesize
5.2MB
MD597ed628d0aed8bbd826045b4c49df589
SHA138c7cd0bc115f675c85854ce426098297d461aa5
SHA256ea4ad0fcf72cfeca98f0f58c9813ec396a0ad381aa2694becca8b542ded1e8b1
SHA512a85dd49e3d900392be460280cc2b4c22582cdd4cf19dcfba3afd44f97a3680394eda77be4d9a2807ae441c985a8a6980c85670e1ffe08533abe3926b945183e8
-
Filesize
5.2MB
MD5185bf739f95e9a2a98fdcbc8b1bf0beb
SHA18e3ffa28aae8755bbad317bc497d6fdfafc4f84b
SHA256bd7bdea532db31b50601d2b0f59efe1eee576252d89ddbe2166a999a0ac1d9f8
SHA51292dd21c86ca41086397b0acf4ef3ccb3995d907b3f880607ba59cdea80fb03c429b4d64494f70563207fb87649586350536d7c6d9c74c0d301c7d2b33f1a0f21
-
Filesize
5.2MB
MD5f44eb36d92fe8c4141951c626fa63acb
SHA198dc70808756007b70f34ef4c1ecc9611e741865
SHA2560cbbfd38438c7f182b3df677ac9e83cdbd833d1cc665abb6778b6ef8a98f846c
SHA5121c3e1d6ce2d5d44e3f1951db6998bf17786e5dc3880081bdeb26916f1df47de62e47dcd27db94e8d94533b4c708c1df299727fec987ee1f742027cc504fe6163
-
Filesize
5.2MB
MD5e57ecf6a192357244a3af6e9edd45e25
SHA1de5b35a56174c9e558d06cd79f0362927abeef87
SHA256fe1a8c6bd9aaf1ba3c2aa16a3d603fa42d9e86eae3c40e72b551176f896b67dd
SHA5125c40158b1b2494be947573eec848d98b1321eda7867a8b8e582c86ce716dd3a33e019cb65cabb16d904468d8da1be5e9139046ef1d4f62aa440675c3bc94de54
-
Filesize
5.2MB
MD5848e40603052404123a38627dd110571
SHA1d60626f65012b1f28ce6038caa191a0d6c1310d4
SHA256f133e2dec29d7d79772a42b61d3a2f5f03afd744e10948ee7fb6e7555629a1d9
SHA512799d7f27abc5b98a9f8f0c7e28e67959a64b960ca8bc0aad5979fbb3f028b99ffadf49ebb165d2cdc3faa2d96d951a9848c7d9aebc93625b3c0b4efa163cd14c
-
Filesize
5.2MB
MD556d826bd280e0f206b4faab6798b3f47
SHA139d068d2027d505dec02741adac660de1a9e043e
SHA25629e7640837acd8dd852166a8e631cb215e8d07c883e7e0968dde7a6257e2277d
SHA512657bdc60e4bbab2e9cc073ca681cce616a61e443c158c076633cf93a17a5e227ae17e8b10acac00e067edc7766c2d752fcb3f5a5b2f79990320ba64bc9971b20
-
Filesize
5.2MB
MD5d455e923635c5d06fb9caafb547b394a
SHA16ea5a03e31e47d49ac789f8dbda44415f4550872
SHA256334331395adf63a9b2c32fb9338627092caaddd222081752aa670c2a5cd50d43
SHA5123ddf46214186f17b23a0ef700f68edc296f6be9f6799af7be815c0c44e7c15f8e826aadefe2423e747750643d263e2fa47f8a5ce24ce9060b439a2021ddad1ab
-
Filesize
5.2MB
MD549916384d06c63cbc6a10431c6662a99
SHA11f065c778110a1fd40246f4185ff5d3a50efea90
SHA256523f4ae557140905ae5d85e0178ffed4eca5ac101ae49036a2b4592c7304d2c0
SHA5128900c948757692b047a2c918764f989fb9f33562bc1c9aaf0a36163df20a723fff2ded978d64481728ebf2f77f2bb0a1724ca4060c04f9aeefb23522eab37c65
-
Filesize
5.2MB
MD53efb9f28c89caeae98b166a13bb09291
SHA1266544315db9d35b80f20901da788c94b4f8a2bc
SHA256e6243c9e1e0a75ae76c32642ed8add05c51cea0570cbd8f61370c89a60193ce7
SHA5121e4a4eaabaf1ac455a2cdc8cde8c9fb958d7ca12d2ec94499d60bd9918b3b59352cc6129d577cf50b7f901a3a14f927607909ed221ed6128659482acf0cda2b1
-
Filesize
5.2MB
MD55174fff986e714c3fd99478c1a7f628a
SHA13418ee4bc4cbaa78444e8b16aaf016ad5249fdd2
SHA25636eb2952d99eaba8cc52141ea2d6a167e80b4e7712a92221ee6027ca23d66e40
SHA512cd41fac8008bb3dac3fe19566b44baea3c4998b544fd47da6a5958a00fb05bd9b8aa30cc972c37862e23db2cb0b2b4d6f58ebf51a68b2b368443de7e0b8bc4db
-
Filesize
5.2MB
MD5fc894acd01a47e81b5890529a5922e68
SHA165661c111f88b4d473d5d8c990847517ee38c030
SHA256d897aead5df3aa0c9a08e6af3247f0e2f3c8df1aacbe3eaf06f9d1a2eeb10ae4
SHA512d93da0a1825a489520a78b78507ea8380e31d2a1f89b308a696688936e796d40c6d5019f55ed4e053adad2f5f24af6a592ec8cc02a878dcce84eab838507acf4
-
Filesize
5.2MB
MD545020f648c0121be61a3ca1c321b0650
SHA1206e5dcdf2e6ab1d198404110836baf0245d5e7b
SHA256e25ed020eac55bc92ed0a9641350cd4eca36861497ca6cae08cf0fc71a0c4977
SHA512cd5165d1a59a9805483ff3e0e92277c6e4081ac128c6429ed5b5fa51fe63728ad9f69acad128adfbbc65003918af0ee605516aedd97ecfa93af19c01275b792a
-
Filesize
5.2MB
MD5b4cf9aebbc6095de66b6ce99ddd2262b
SHA1efdffc80b5ffe4058eed76eccab631676b8f55ba
SHA256d0e30d5fc977670908a8b7d2340d5a1937755073f799ece669eb4f74e981565b
SHA512c4879ea234f35de5fa312f328636113714e59dce51520791e8e2c9e5e72236ee127bfcf29fde85d48da4cc1624521a45fc56168e2f670531e6c47ecd14169025
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB