Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 01:33
General
-
Target
2024-11-25_7a2568097d97419cca5c8717daac618a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7a2568097d97419cca5c8717daac618a
-
SHA1
81f4fa03a3ffbce688c39a6ce0ff33742fe1f4e1
-
SHA256
a3dc2e80939fd6b64879409263fbdea86f57d16b8601086bf8f19147d2551824
-
SHA512
fe9882ebef4ad7c694b420654e057a5d46855ec3f793908b5aae23aac27e82d7c6cccd6a74da0ce163027a284c40ade74d945f10fd9de82c6003dc69121f4101
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_7a2568097d97419cca5c8717daac618a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_7a2568097d97419cca5c8717daac618a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RLCVcZm.exeC:\Windows\System\RLCVcZm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jeGWSwa.exeC:\Windows\System\jeGWSwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyMfTfn.exeC:\Windows\System\PyMfTfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gAPYRkM.exeC:\Windows\System\gAPYRkM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXRMvOz.exeC:\Windows\System\bXRMvOz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ybtxkPq.exeC:\Windows\System\ybtxkPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZZmoFA.exeC:\Windows\System\vZZmoFA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kCFUHiy.exeC:\Windows\System\kCFUHiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BirMbRb.exeC:\Windows\System\BirMbRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAhvKmJ.exeC:\Windows\System\CAhvKmJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QIaYEil.exeC:\Windows\System\QIaYEil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QWtYfRa.exeC:\Windows\System\QWtYfRa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bggkAKp.exeC:\Windows\System\bggkAKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zbiNlSs.exeC:\Windows\System\zbiNlSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRbEizX.exeC:\Windows\System\eRbEizX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SGLuCPx.exeC:\Windows\System\SGLuCPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\voSVMee.exeC:\Windows\System\voSVMee.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFFlPYf.exeC:\Windows\System\oFFlPYf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fnKpHoN.exeC:\Windows\System\fnKpHoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrFJCyF.exeC:\Windows\System\OrFJCyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWENCdl.exeC:\Windows\System\SWENCdl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD568b0e1ba9b0c59c9dec68a668b88a05c
SHA103459022466d88336e843787adc411bbe0a33ad1
SHA256155e97ad728b29e35c4df4912ac9708d955b9938331529f4435c842ec558f364
SHA51279a75e239aa5f037ec6f4d2b60e56c955296a259449971d0b68a044e0c88b1323bd9657336fa8b0380b8263910000e247ca1a7efe28a254bc4e5c7ac8bfa68e5
-
Filesize
5.2MB
MD5899121f52f98f7c65685bf919cce2c7a
SHA161535818f6a3477983fdc2c473dfda32893e7dd7
SHA256f2d96b02182eaafd5c79de7e8ec05890722cfea9ed42c87555e56961a28641c4
SHA512dee6a9d145bf7e5ae58abcf09d75746181a0985d61361799f548ffa6dccb45a19c330e832e480a6e7ae0739565661d1608a08576c72b771e5acf7f1f909c4a47
-
Filesize
5.2MB
MD50978a9de15db85f2f321de03f2847966
SHA158d6659b093c593e40aabd3d11054ccd3d761494
SHA256496d54c0295881a4056a6efa12f81aa49eb7246f8316312f18185a85f2aefb8c
SHA5128fa7004210b7b93f51d51114023e086e4c8b07e8bd88c21ac2df6299570a779b2cdba707324804fca5b66ca961eb7ad0cae9fb1031f9187c3cbc2d6355e0765c
-
Filesize
5.2MB
MD513a29028115fe95fce53e1b2ec1bcbe5
SHA1b4e04762169c83f770246eefb141adee6d6e7db3
SHA256fc8a815895ee25a89c5de7e275a673540bc4c3f9866d3b78efc20a7168ded6ba
SHA51220ee5b892c76b8ca9970313ba2453fb5a35e8934d154943cbc0ee66187c1898f73054a17b44be8558de3c51873471ebd7759212c970f1c9a73d62073792d6cda
-
Filesize
5.2MB
MD51a0af304bc412669a91e731f228c6518
SHA1b82634d6c77ce2227d87011166e9d1c63df02b2a
SHA256cf45a16b4fa0f086d7a19c0d0021d9c184b65cafc07f450872472af28b9bb10f
SHA5128d39dffa9d4c6107922388b5672b4dce34fa5f9195d7f2ba90ef8a914b3482c6db452f06e1000d508f5ff2a8ada3c7ebd11ef34d865ffe5ff0aa5443af11a2ea
-
Filesize
5.2MB
MD581e3e778e393dd0480526168a6dc7b9e
SHA18c1b4b65f18655fd1cdf5b22013478855cd3221b
SHA256c292be9f08997101195a64e5a22a203d50e5a376d89919bc07df41b84cd2201f
SHA512060c9768e3e7b289596738100d92b16f62e90e9d767c9666a489c0e02b9e8102cfa0beed2abe4bbf5af57563068a8880c607ab0859dad3f36a08d355fce3d2ae
-
Filesize
5.2MB
MD5d6e5f7e3b3998422b30ddccffd18c0df
SHA1fc9b49e4613a4325998c2bbb86cc800a3302280a
SHA25650272e2d7e06418051b451fe803dc5980254e44e70045230828968709249f65b
SHA512739a157603d33db32b005f7575daed2542817486a4024466d681da459f7d6080d0218e349bd1c0a69b3aeeec0935dff14e0d94b5179942b8bd3ce98ebfc119c3
-
Filesize
5.2MB
MD5915cb081c7c13bc50f7d450888e52c16
SHA1500b89d7f2d400deb73c3ec234c8649fbd2279e3
SHA25616b913c4f486329120a759ca6cc19b2d791eb04733aa9873c2cef0e40b2c2668
SHA512eec3923c91b2cab569e90e60234fba20a9bac3950a1d2fcc5870e1bb2b9caa1e73de908a6d0370c336393682a06c64bec7766abad2d9187fb55367cede85777d
-
Filesize
5.2MB
MD557adf2b600f25b10898d9c0436796477
SHA12b0e32aaa09acf3b899d8def2336e6d2e43623f4
SHA25613868c1bd308c6dece6da1e576c87f7b49d2fedd8452f404f8bf23fdea2f2fa6
SHA512a8b89e3c8358312f3cae2333a589e0b4aa60c6225403b023c518dd5c75a44e718f648c40f3dd855e5cab31354fc5af886a875492e8d8e3ab68c7b9fe6cb6d42a
-
Filesize
5.2MB
MD544078aca3349c4df673f4101b3fc88db
SHA1a4cf7a8b5b6d81461ec77fa7210dfefeab77e242
SHA2562993aaa9fd4016f46dcc2b1ac185f8398b3254ca6505aec146417a9b21bce66b
SHA5127f11e2cee33e282eb12774cd886a8e5bfd3b71816df22d6931f09aaa192794d97642973c738924a12dbcd0c9bb34f8e4b52768aa6c27ce042aa973361ffe9049
-
Filesize
5.2MB
MD50ec212e3472ae30525339d8530b082ed
SHA16ff9abbdc06459672e0496008087fb9cd82f42eb
SHA25611644660ec871865d809a01ee4b77bf93b8d48a91f9e02524b140f407e7faf59
SHA51254cb755f5179dd4dc88d3962c99f4de1f1f5ca1736fc571265dcbe0a8211ace2aabcd0a959e701f4b8894a0b19dc1c7fee1cb3f4733e82e193ac481e3be4a86c
-
Filesize
5.2MB
MD553bed6c6385b054607c9517b05ba6701
SHA1e904225b066aae6db8843895429bda958c294e94
SHA256db1491cecf33fad7927e7a9271e2c4a52e5460729fdd16cde48337951e898e8b
SHA51229a2d5d86a3b04166b2e404eadfe8b85fc9a67d52d291cc8b6f861d460995de87aa79b4799e195a854ebe7eecf0680682769e40cfa4dddd96081dd526268f1ba
-
Filesize
5.2MB
MD5b44c95edaccee98861e5626701f4516f
SHA17424f233c48e1ac246a33db1054a07b44f711dec
SHA256207fc2ecfd0df9facccc534b34615bc61bf597463bcf86fb79586b5006e17136
SHA512aa4ce18a4b04a6f690da6f0f46e653663a21efd4ca763e581abf8cfd827165a5336d70d4b5fdc23230ebf2ea95ed6747b0b3c2af9e42a988338c3418f15eb33e
-
Filesize
5.2MB
MD59ded5e64dbb3707732c09ba9ded46f8b
SHA1dac4c25291cd33511082872251ee28646faf23ad
SHA256083ce8305f088bad95688018f56b0ce3b5a8487260545b1d8edfc23decc6f71e
SHA5127268173d4839b1710331db6c9df11a94437d0a83cdee0ac8fd53df46550fb182677a8022c6043d21fabc517ef03c7296df2ce217dd5a0bc090c2e9ddcf52290d
-
Filesize
5.2MB
MD5e2b38f2cc40ad63bf674c427d1063939
SHA157657f7153c30373df758deb960f74da6ebb8f07
SHA256c921460b11a78b995a26dbdf18c5767109d3d7d31da6de4fdfec908f94863cc9
SHA512d698a5ae796e1e38807a00a3f80449e27a10532a72cdd6052ba652256823ce2008d783afcaf2b35134e1b3715f4b0a5b635f1965e7e43b7c7522994ec9d9ccdc
-
Filesize
5.2MB
MD5a7d6d1bd24855b7c19777cfc07511de4
SHA1c8047c339ea9c290d39a9d83d02b081de15ed789
SHA2564848c41b2d2df39fdf956022e4f993786dc2851b266e415a30b47443790630a6
SHA5123a4c47eb07af78236788a60d067bdb5b07b5cce7c7a276cc71d9d9c8a37c676bfe9c600a7a591bcb979a1480aa30d6d9708f3231655a8b8285998e89ab39daa2
-
Filesize
5.2MB
MD506c33a3fa2ff8cba94cf6fd7e9d782c4
SHA197b5d668c383d602fc9470998c58e894f82d6f68
SHA2569d4bac980262078e15405a2c414ee528ff32ce279008e4f560efef8013a8d272
SHA5121ba79d59f17a352092a93e5d7502b98c463e670995571eabe51eaf3b5bf203799f4776fca448192976768975654b4dbcef67976c1104631d7a9636a91d3ba28a
-
Filesize
5.2MB
MD51e18bd5e8ca1465da8125959673cc8c1
SHA1b97a8fa24e421c1666df480eeacf73d9d367a8ba
SHA2566886e0fd8dc5d9a1c1eca22ddcffcdc3492e4449c38c3e3f0f0f49758ded0d90
SHA512ca230fa1fae227b8bc60465b6cebcd0350d35cbeb2fdd9888f74740ad21dc1ed3861fa7b9f954d7e565f727fcb611d2e4cd5142d57ab96da35e6055f46eddf44
-
Filesize
5.2MB
MD51eca0c2e4c408c941b7d7049f5efd6ee
SHA1b454ec09e1e119677c02118817e0f6de634ab438
SHA256509cd6909b5b8a701ed60756416b704889d7b1e8aa0e9bc6438234a8f081eeca
SHA512c01c89803bdaa530fbd30d16804231c23ba778df874f944925f8cc5a16930d95665ac36ffcf23e6829e5ee17ccdc5a34fe4f8ffc531007e5541a3e308e74bfee
-
Filesize
5.2MB
MD51dde6c13226a050404123ba4c8949119
SHA177d85df5f52d9da72f1b5a5d1f623ce2cf27b5e3
SHA2563d0ad4264dab741fbbbde7b4715854cc332c13539af3335793a3de19dbd7c721
SHA512db7203c520c24ac3482cbc1a47858d9ecea3f5034f01070f034e766701df6e7eb850fbffd646b942f46af9fdde0f4e2a1138ca29c14da441776994764b60d48d
-
Filesize
5.2MB
MD59bb1fed73c9f381e86ec7be300680d9b
SHA117ac07b05a6284cb4c9bc591a38e0d620a1ba1cd
SHA256d985dcfd072b66d88115269072db09d9b5a8a269169a441fc42303a04fdf8a5e
SHA512362ec44fda3e179d3debb962a15d9b227d1eaf5fe7cc8f8c9c1887396be7b23179cebc711b470a348c6659241b0b087aaea87697aefc982ed16c4c18c63196ce
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB