Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 01:49
General
-
Target
2024-11-25_f26c21d5376082035012cf67fcced301_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f26c21d5376082035012cf67fcced301
-
SHA1
666960db694f6a246f7b48981f826c7466d7db93
-
SHA256
e38c6a508442c973f30458989b72b8e921a26d146774ff46a95c57b93e65e92d
-
SHA512
4c778b882b8d9bc8fa8884e109185e24ea3da07e0bbd8ea00aafb826d263c990fcc32d65cb81b0972f8d912b13efecf65b6ee5c513e0f2a761e47c7006015644
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_f26c21d5376082035012cf67fcced301_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_f26c21d5376082035012cf67fcced301_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tEFCQNN.exeC:\Windows\System\tEFCQNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhPinLQ.exeC:\Windows\System\xhPinLQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKLlrtx.exeC:\Windows\System\iKLlrtx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqMFcOh.exeC:\Windows\System\rqMFcOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVcuVin.exeC:\Windows\System\WVcuVin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVWKKNf.exeC:\Windows\System\ZVWKKNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcbAMNY.exeC:\Windows\System\xcbAMNY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkzrQEn.exeC:\Windows\System\vkzrQEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwtyNxl.exeC:\Windows\System\TwtyNxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XarWuXv.exeC:\Windows\System\XarWuXv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGyaJoT.exeC:\Windows\System\aGyaJoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUUgcsP.exeC:\Windows\System\wUUgcsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpWwaFh.exeC:\Windows\System\cpWwaFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKeLGig.exeC:\Windows\System\sKeLGig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVzBzXX.exeC:\Windows\System\dVzBzXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRlyIjM.exeC:\Windows\System\iRlyIjM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJQJmGk.exeC:\Windows\System\NJQJmGk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBJfmfQ.exeC:\Windows\System\ZBJfmfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEzleGB.exeC:\Windows\System\TEzleGB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSVRXLj.exeC:\Windows\System\tSVRXLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Shpqbqq.exeC:\Windows\System\Shpqbqq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ceae09d7437a082df2200e506753d7b1
SHA16eeb03a158c6fa34b5680e563ff539c0519f89d4
SHA256efc5fdb18fec69b0e00061a452382198df8c9f9005060a3283edf2ab3c2949d9
SHA512789406801103954743c061d747640356b6485dfe50d89d93e40b744963e28e16811ca7dc1c38c6c92bc01f6308460d0a4bddd2e555ec5a7431828d01cc5371d2
-
Filesize
5.2MB
MD5e67c5809a0abe0e1979121fa38e6349a
SHA1a6c771343d550dcc0d03de54704d334ee01a4438
SHA25613c2197a010af1b41d30831229d6fcb803c82ffcbbdc3504973b098fa1584a9e
SHA512bf818814fc463793a44924a7ba8b41b97dfc1d56201b6ece90b95b55256a7cb2daff61053ceb3264441c31a4f7f0125e91cbd802131e210bb1663ce271c03aca
-
Filesize
5.2MB
MD5b967b29795705d52638f0f160c0a38b8
SHA1ff44cfdfa3ad4a295966f56cf6a5567a6279ec25
SHA25672bba379e8fd896845b30c6ec6636042ce87ac27bc5b249e80ef0118ca73eaa4
SHA5123ef0eec7e2c1d829106e819f4581c724f7acc7d7fee1c84cd03302c33e8b0fa24d6f43d0e24fba3d6f113da8e85b15c7a2ef35fa852b45924229bcb7e1bc111c
-
Filesize
5.2MB
MD58ce9b4b1d8fe398b52f4e7d2b175129f
SHA19009c513390221b01305803fceac0d00269e1e82
SHA2563bb941e9c4a5e58f311dd85ea0a0d84467011c29c512bc3f870a3a80f7f101a7
SHA5124d02753d647c9f48eac44c85d79075860fa0ce779fd9e39acc9e4408996121fa2d489dfd10a91bc289fcf05b504325b5ee4a64177b2ad99c4375172d356c9b9f
-
Filesize
5.2MB
MD518e6be0a703746460d1d3710b88f9d69
SHA10b8ccefbc33adf92329fc57d7a022dcb3c3a5e22
SHA2569f2c9a8addea99b858909eed8e5f70733cf45032fee97297ba2c81fa68e60bba
SHA512efb56586fb09a009e79e293315db00f6cf58f25ee44b87ed35fe755f2b2b29e235fbab6e0f7165225f430f50947498e6472d796ddaef815657b3bc2d514b55fb
-
Filesize
5.2MB
MD51771aae06e59cc194b6f0fbd15eaacca
SHA1af6620bac90d5a9df5eacbb971505d4fd8a36bd3
SHA256d50ad7f59bd027b8b5cb080070f139455d8b958e9e48fc700510976bce3fe7f9
SHA512da554f638f7d39012c33b548c96e5a854ff9c54c09f6f0aa38c4973036a63a8f6e5c377efbac8b0183fb1762cb1a6b9a2e5ac98f22241235b63e50eae274efa7
-
Filesize
5.2MB
MD54187b9c7d0e2d2f505b08eb4a04dd674
SHA12014194d3fadcc30925996de8551cd2ff4274503
SHA2564b3588163e6c361d6d25e799bd53f1d91b4694bd07dcbc2e510b568972bf7218
SHA512e3eebe409798558c27858b0d96834500e90b7e1a83da53c402083a03c9adbbec7bd0e064eaab7f437f009537ccc89458a4f078ac6495d6b40a45042d012ede1d
-
Filesize
5.2MB
MD562d69d577d58c0a66df5f964b7315368
SHA1a4f764834bf86bce4906eb061ad2517a2c8cb046
SHA256c76ba6a555680fa8e31e300b7673eeff01ca046285ef2b1f0df994852ace3284
SHA512816382a701c8e598867beda2a747942bf7e9de9ac176579dd131174fe62af4faf1fd7f715cf2763b8d0899ea9ced469e50065361424e683c9b6e9cf741f83475
-
Filesize
5.2MB
MD594c729d83731713c8c4be76e67af2bd0
SHA1fcd6b005184a1ca53915f7f56acac4baa369e415
SHA256ee836d7352f990d2674497a1d79761526640f1f8c07fed6b78135d912358faea
SHA512a388a846e529440fa0144fe4e34eac9c22548839302785f4701d19b4be94fd06eb00dbf1e804e93bb47076ece07b810c8321aa80b959275d2b831253eab37e08
-
Filesize
5.2MB
MD5b8f78fde6513b0b196c5096e8bffdf62
SHA180e8a1543b0ba0db00bd745b0e7ac4472bd9335a
SHA25646d948860d40843a994c458a541b7dfc58f2d27a8dfca80f682d5ba30b2dec26
SHA51241edaa9661a1a025017b35b5f51951240706feb638b51e612582a62fe1cbdde9a82570b4ed3228e457117d79cd4c5c5b0b5d53253759af9ef21e837c36b656d9
-
Filesize
5.2MB
MD586adc3a88853fa19a1ca814ba8345c42
SHA10e0c8383c45451bfe73c9027137d27ea9f9c395e
SHA256a3ef6a24b904a1b7e7f63f3034847920655a63b21a94f6e400a13b6dbd34dce1
SHA512d57f662018bb6f915d90fa46549b5424b9e18dd51c3ca80e152dcbcbdfa901da2f77090fe284800b0b56d7e969e56da3e4ffff7e35cf9fd843854b542be12865
-
Filesize
5.2MB
MD557658663fd5bdf7b50573f1541ba01ee
SHA1c71e63cb9791a4ad4f2077eed4e263cc898eee6a
SHA25637a07bc0735b87c45010bec941fec757f36dd15fb4237db78b0a907fe458db50
SHA512ab95308ddf2aad7d430c8e862b1077ef96621f748897d9adc40e61e4424a3604e6e1dac023f366317b3fcb2f2e6b29946ccb981a8104dc6033094cf82d3030d6
-
Filesize
5.2MB
MD56a91b6c35d5eb6dad21cf6b6ca5ccc28
SHA1266539e1e73cfaa419cf5e590f93698b6dcd59ec
SHA256085a75246c2084f17a6f9e66478a4b47226a9b956f7c5315c7ad68d5eb7feaa9
SHA5124bd7d2e9dc7afd2c157159b959aa1e8fa1eeecac84f967ed94378afed9296a1d893a7c6dd6a066143a50d11973978f6e8e91b60ee10d7025d86a9b428a1d8a6f
-
Filesize
5.2MB
MD5fec0b4027f188365deed727b0087929a
SHA148946d032fd71c16e8be017edfafd37e38b13055
SHA256b6e6da6550af56ec24ea857ad68f524afad4a879e8e6ffbd3e093e8a1fa162e0
SHA512da9dd713da17c9db1dc3f1aebba59841493ada3c41036bf287dc32b48bcf6122002a4446a4317c2d241636481c1e54cf71422c7fdfbd0bb4ad25a8e476c7ceae
-
Filesize
5.2MB
MD5610d9f243f38dd52ceada57b065402d7
SHA17e21efe4a9fe43cb74dae782e5985481d105bb71
SHA2565032838a60a15dfe4be256420932b065bb3a6e476c61a287a2eda8d50c325c6f
SHA512e515cf3cc74e01764fc8cae2bda13a8e57551119f2958d6240fdee4e30a29906166d2932902c7dd484e59e1b07beefe638d421a39a5b46de937b2def0d416cef
-
Filesize
5.2MB
MD5494760163b172283f2ff2c779ecad0a4
SHA114d523f6103ded1bbf26746c5da279effbc1cf6f
SHA2568fb019a931dad2bcbcb77a690fe0d6ca634052065eb63156c8f4f7592d89bbdf
SHA5124830ae8db910f9ae8f75669a3e4718fde935b9868b42aa4031a17763080cbfd41e3d01eb8997aec0068db0cc100c38a99a7605e0dfc840ec262efdb1a32d8c60
-
Filesize
5.2MB
MD5e12bbe81b1d0384450d86b3272aa4417
SHA15c5563e3937d9d8eaa58d1aaecd7951c8dc0225a
SHA2562b33d025305cd0cce6bb0e44ea84745fd4624a9013eba4bbe4f5add03ebdeca3
SHA5129a9aeb6188ded1064893de8bc59a53e74d76f6152cb871e867e7bcf19af3d1af7cfe4ee3a18bf3fcc2430ca6def42fec481413e302f0ce5bdbde809a9905f4fc
-
Filesize
5.2MB
MD515ebb005ae1d568e96202291e0331ccc
SHA1923274da1cd3490bf12984bc81a952d744e87f19
SHA256c91c92ce0650efa84c3683e0a0ddec2bc709c47485e57791b76e645aac84cba5
SHA512b5b484450e3cb98ef20578ec6c721bd8b4073cfd23fca64e98e4dfaf386bb59ae7f23ed9c0ce5d71018e711c587af87776452298503e80284ad80a8d841d204b
-
Filesize
5.2MB
MD52c6bfddf6c3a64a0497b3312e14b0aa9
SHA1d3bd456598438b0506a3996a6162c6549d1821ee
SHA256d7242b05be50b78308ba836f6c079fe69c6f71d5a08de78dc82709c0eafaec75
SHA512d105e16970a6cdbaabf83e3c1bafce11713c012dcddc3d1be1901d5b7e5da65609e0e9218417fd1deee4a9ff18727dd838be77759965cffbccf1613b898c3b14
-
Filesize
5.2MB
MD52a89261f0a214fba64f0d0bc52d62030
SHA1f214b132046074e2258418b2950f473d78e47e11
SHA256ec012db8880df0ef4d5a58f4935ab79943cf011db6b08d9b899ad04fcb242ce3
SHA5128bece5c8e600cd198b2d0672de8e0808dd158f81f8e4659e8f87c6287f8de4fdd4ae6560ece9384502306921e555d02533d98454be17743ecda89547f3c3a6da
-
Filesize
5.2MB
MD5161f238cc4af84a5a80eb13822eb37de
SHA19e4c5997c1221e28984bfb8262ba43c0bf799f01
SHA256ffc8928a02ee27cd99a9202fe5c2ba4af6c7378e4a6facea32a262c2ca488e26
SHA512a7d8f4d0051afa9f5431545bd4dceb09bcc6f89867bddb1ba49d3739da1cf3ceb2ff3b4b5d7c51ecb6efba1b68e2a9c7bfece26586db2ce1b43dc81110eb79ca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB