Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 07:37
General
-
Target
2024-11-25_51408545cb7a2f1ca02b0c0a81aac8db_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
51408545cb7a2f1ca02b0c0a81aac8db
-
SHA1
c5e01bb25724faa16e45c73faa4261d3c25fb459
-
SHA256
01e1c33d380a47326bcfb9e6ebc1d56e0c344691da7aa40c82cd9ba4fff9668b
-
SHA512
adc1e705915ab2c57be15909b42d1e25f22b0cf22695658080b35c3ebc429a46cbf4e3c178fe7b01f731ebbc0daf0d3c71bb135d0197f0fc7e7bfc087e014d95
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_51408545cb7a2f1ca02b0c0a81aac8db_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_51408545cb7a2f1ca02b0c0a81aac8db_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\anUpxrk.exeC:\Windows\System\anUpxrk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwySdcA.exeC:\Windows\System\GwySdcA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uetSGKl.exeC:\Windows\System\uetSGKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjNvujX.exeC:\Windows\System\gjNvujX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PXAZtLi.exeC:\Windows\System\PXAZtLi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWdRWyN.exeC:\Windows\System\mWdRWyN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCZyGDH.exeC:\Windows\System\wCZyGDH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MDiISbx.exeC:\Windows\System\MDiISbx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBdqBqn.exeC:\Windows\System\YBdqBqn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llIgBIg.exeC:\Windows\System\llIgBIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\draKHgW.exeC:\Windows\System\draKHgW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQjsqpF.exeC:\Windows\System\JQjsqpF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRfZVnB.exeC:\Windows\System\nRfZVnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FvnkcEj.exeC:\Windows\System\FvnkcEj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xvmGlNf.exeC:\Windows\System\xvmGlNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhnSzDA.exeC:\Windows\System\GhnSzDA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IOqypiW.exeC:\Windows\System\IOqypiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZiHrudC.exeC:\Windows\System\ZiHrudC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\guRqYHf.exeC:\Windows\System\guRqYHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmyZfqy.exeC:\Windows\System\hmyZfqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lcEehDT.exeC:\Windows\System\lcEehDT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f13c347e98fb44300ed3db4958abb3be
SHA18c8b9f3f2a3d795142b77f1eada9fa4447dfd607
SHA256042fe179a967ad64dcfbc596d7983988e89ebc801f6a4f9653ea9e55e1788d37
SHA512a5a1d4d46f75ca5ddfeab28d681cc85f740a19f70af6c98665243f0f8631fe612fd1eb486e63c8a32ffe912f2dfb94a50503532613cdf7f8db9815367717d1ce
-
Filesize
5.2MB
MD5481d857e6bc42eca807195c92078c469
SHA1ac3f78fac6b4b3f12c5ece4a994971320571defe
SHA256a68fb6d2ef52d88ed08738d951882e53924dfe5cff9374b77f65ddb2864af332
SHA51292bdaf0b7ed773cf6f868c8793af08b4988b59ad37044bd2bd0d422157faf54d134a5fde5445a9d3cd66b956627c7f673d0acddb8ca3b6a8aa8caff5db70a676
-
Filesize
5.2MB
MD5b429fbcb02e194bcde4d853023b86a14
SHA1451a65b29c6d2ba67de267dc192d647cf5fc277f
SHA256676d2f9b13fc86e0505eaf823dd26c29b1d2a070c65abf1c716f6126da09aeb2
SHA5123b1a3a3fdf270acc45eb658de42d46f2bd17c7cc549f48caa4ef0c0e2a97d36e14114fbcbfa12ba4c18d3ecb0c9c16e95819369203dc05876430f54330c1a57b
-
Filesize
5.2MB
MD592a8587fb313ffa378906ed7918dabd0
SHA1e37a2c37d152720b0efabdce6b77ebb3ab88df7b
SHA25662d60159be258c589ef655cef987ec6231a611f4c03bf22c3a14b85e46846fc2
SHA51278d366da8e2ef52c52742a376aeb14e9b4ee8c0eddb1b3ee3c10ba20644b92e2f920b72072c84163a6b950886af34b2ed9ccfd5731a708d70ec9f2b2a150d53c
-
Filesize
5.2MB
MD543fd5709ebe0114a11612e52eb220148
SHA13d813ebacbf631f85d359d4ddce1439a7c5a9668
SHA2565751911cd5f413e4167720e99e7b17e80671dacea3c654aafc357c08344a093c
SHA512c4f2ea6769502898e48408c6a7635ed2284898ba4aa85807811450cac3ea98b96fad597924a0216759b58818a098e20dceff59f4d06e349ec6fde9bcaaa2cf7a
-
Filesize
5.2MB
MD5cca1a7f664dd6dc5e5b84bd18d13d38b
SHA1a5a2e4f9aac63f3378af2355c77ad7daa9df7e2d
SHA256b3abdc64895e99d651e6891cb4530c59bb77eb3f0265bdd7271fa57c65dbc040
SHA512ef5c424db451ba718cfd36af82176b3a106c5269d07e91ff086f6c8c2621bae3d938875d73a54bd56180fc7032b32f310e013efa96f9bd37e13bec73a6fe83aa
-
Filesize
5.2MB
MD5e2f0ba24d3a5ce488a1c50432aef104a
SHA116b7dbf1cb759a0ac67140adceb7946c98686d64
SHA256799fc64013d0c12a08d81544058f2372cc50a0aacf347314985ce73485c45a30
SHA512b1d568f072b38492891e20f1cf5c8e1fa843fed3435f794a17229fb2a8f45d4f7cfcbb5335744b75c1ef22915f85e051cc94e626a9201467ed041dd9aae97516
-
Filesize
5.2MB
MD5cca86dfa05dbd5c88653aec7ae5780f9
SHA17a23d32bfde044ff3b59efbfdf5ae5625ab08361
SHA256e2f70762ba898f799a4d1386eeec87b1f48e97dfb53eb10fe81be42c71161b03
SHA512c46987dd3c4bf6ce720c8deefcd0a0208fb604b5d3890d16cfee1d1a3f54f606bd9794c1f55019841843dcd6469a85ea40aa9bffcc473c0478be420a5c015115
-
Filesize
5.2MB
MD566d03fa9d318e63db62ef32f8ba28d08
SHA10e61c65cec7513146a653962c7fd3cae90f64193
SHA256ebb6d7f035a47afa33dc1e2d62c0b2d04acb7cdaca19df421f62ed92974a50c6
SHA51243838149fff692cbf8fa32a03e3a03931c0be898b000eea9b3d9009f632ce6b3a61f2fba3cb3c809cdf21a289915e4c0889d96415a75418eb8ecb79731ff8851
-
Filesize
5.2MB
MD5bcb426405212900f365ea014a48e781f
SHA1ec6d0e84accdff88611381cf215963d83eb219d7
SHA256586b8481607b9051dab12758f6c5ad0f0660dd3d91bb05674dac1887afc437e1
SHA512b9fa207eb6333da93711f275d3044ea5321b59614a3ffc55d8a8ec154a1d82f4573d18e32a40ed1d9471c8a0515bd1846a5753a6eeb5fa20a2052d4c6be33491
-
Filesize
5.2MB
MD56c0cd55ebc3019eba1e1bf0c356a9c85
SHA14858045e49c2ff0b59e355d628fefe1adff48589
SHA2562cb2f3701353a3cd4ff0e6ad0f6c020f07053a0019369cf8510deb7fe4e02e73
SHA512e749d21af62ceabbd1396dedcd770d6a16bd534b3ca623151f1d62bd0125be400c51b3f3ccc627e12a0fdc7e37098201e776400e6fb48f2df327cb501398cda3
-
Filesize
5.2MB
MD58f5de3c0dd7a8ee2f6a3ef2f5c937b88
SHA1bbc6678efe1ba77b059dd5ac15bd0bebe4c43f77
SHA256115cf23d100ab2c1ccf4734643002603f4320c3fff7c54b39f3a96948e1a904c
SHA5125d98c132b4ac20cb9294dbf83e332cf63f821a5bc0239ea7403ac986d023a31b6344398b81bea33875ae8bad7fa0ff59a6966672e762a7ffa191b7f66815f6f8
-
Filesize
5.2MB
MD5decea35ff54c6d086e5c66f467532b84
SHA192129c9e9eaad2db8aaaac664ce347cff7607178
SHA256dd46edf33dc06fae9a9381d4a20dbdde110573e9c3d795f26fd1465ad2e2253e
SHA512e1acfe6e7e76d495f36943d3795a1c85b46eb2e937c2ce36756e30b3d3db1c2b63f772a49024a5e003b424ddb69d9de88c388175bc5c692d28292efed20e65a1
-
Filesize
5.2MB
MD5c9d2cc6ad497265642774955a21e4ed1
SHA1d612fbaea985537b09811e9e84f9904315122fd7
SHA2563f788ec620b78839e693e3d8e7be68107786159c6779a2a30c40ed279a2dba33
SHA5124e02693a060c2b6fc824879eec8698a57fc0fa5511fea033e7c5807f44b049e069e6692340c043d930370bd074736e6bafd76c34a6a9db232a9d0f0a5a63a266
-
Filesize
5.2MB
MD5c8ab743cd1339832b928b7c26b373e10
SHA123a7d67ac2dc302eea0cae34317be11db606da75
SHA256aa42c2df31e450bbd629d8d2fced29620b0eac64bc7d6628b030f586d1bb2e18
SHA512b1abaab7f7acd733812b4b78840e73a6f83dc743b5c6220a7b71a2bd57b9d706e77e24559efacd921441d8f93c7633e3917f142f65a596e5e4f59adaba03ef1b
-
Filesize
5.2MB
MD532794f6dc3d6c9d2c36ec0d4213d330e
SHA1598fddbced64f2349751a51ddb8990bbb4cd0462
SHA2564646036ef6b9debb30b1a9be21120cb6f72736339c0f03991de9bb7d23bc8b98
SHA5123f0ccf36f6fa5ef7f36c7eaa25cec681b1cf2ce11d7f1afa9a957432666ccb4fa8d25ab25b39a605c7d7b0c92ea1639daa0571fa13fde8599f23e3f1308a4b13
-
Filesize
5.2MB
MD51cd17e2cf6916fffabf2990bde9f57b6
SHA10e30d20e85464c8c06b74411b210d7e672c10efc
SHA2561006d46989402dbd6eb57d8b6994b9c9bbaabb7732566bca4a31286fa6161b3d
SHA51227700fa77ca5ba7d06e18cdda8def44f9b662aa3ab8163133349806ad1c97dce3dcf3536ce721a0aff0fb60c17bd07c96985ffeb5a28c039be0da9722b5e93a9
-
Filesize
5.2MB
MD51353341a53c8152d210c9d5a51ad0118
SHA144dc8c2d06b1d4b9fc138473a11fb8cd7846959b
SHA2561cc354f8973e88c466d5427838f2ca28b7a3f73f4b7d62646d3018976a6140f0
SHA512eaa3f192139c96f82305b104d9cbedb06d6c4b7c8f66c82a3c85c7d3462b64e2f58c80b64776aba9a0a44a804f20e3d0b45b2899c88f232cd0191f334a52cb63
-
Filesize
5.2MB
MD5f8c52d01ced4066c2a4323a750574a01
SHA11362ca6b8dcd8f612b51124ce9c7b1943b4620ff
SHA256c3091d13931ac888c48ac8f0e6189ba469efc0bde8be26548168326f8b68e6e1
SHA512b19deb0c88abadbc8ecbf376cc94f6f4d575193cf0c5f011a2fa0fbcd223e32f9b989c25fbb02aceb2abe37528cc673b3f82db87eccae8cf86150898174dfcae
-
Filesize
5.2MB
MD56fea86e06fa5a53f1f24334ada9b6449
SHA12f13049a9f7660cd62d61412bfca745e12000052
SHA2569d2700136018f4355958bb8a808989911055fc0b8d115bf14a6a281da8f5a468
SHA512aeef50d420cad6a839fb60ce32579aff0b41276ee4a999605c4e257747130de0ae02ee15d6ffa84c19b6bdf2dce55c81d92a9de00282c37111c7a66647b1709d
-
Filesize
5.2MB
MD51af771a4e41035c9de9de5f725ab8766
SHA186fe843f8277893872c616cb43808b10d12a7534
SHA2568f3784360b17e1fd97d6f1bfb08942a1745a0be76186f9a53f5cb03ce791ce67
SHA512e2f283c148c2b9b70d24ea8f0b600598f34804ded9f029e983063148e11d23d7ca2c25ac74ea5e09aeb00c1996f634401376c6e1c66d5543a0129232b62167a3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB