Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 07:44
General
-
Target
2024-11-25_8a6f6296116b50c1f23c162b292a4c9b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8a6f6296116b50c1f23c162b292a4c9b
-
SHA1
90b3522fa704b9e6a4a6e968a86ceb8e5c1d4d88
-
SHA256
03878e6ecb183f0a426ac92b425b3166af70a286f2edab7681a38bf20605c58a
-
SHA512
19587fb5459bd5dfa477a66c4fefa2b40aefa54bd0e01842c2363e8f0dd39035742ea9e4f2bfe830c8eea3d24c008665b837cb978628916124ac1ce74c072484
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_8a6f6296116b50c1f23c162b292a4c9b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_8a6f6296116b50c1f23c162b292a4c9b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rQfeNWM.exeC:\Windows\System\rQfeNWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bqMHZxw.exeC:\Windows\System\bqMHZxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvraqfi.exeC:\Windows\System\tvraqfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRNYSAz.exeC:\Windows\System\RRNYSAz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\idXwEBc.exeC:\Windows\System\idXwEBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQSxHAC.exeC:\Windows\System\EQSxHAC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNMDOjg.exeC:\Windows\System\HNMDOjg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nTbGkSq.exeC:\Windows\System\nTbGkSq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzenHOS.exeC:\Windows\System\rzenHOS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTOVYuc.exeC:\Windows\System\eTOVYuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TqvbmFo.exeC:\Windows\System\TqvbmFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwHFIGX.exeC:\Windows\System\GwHFIGX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrPnYxW.exeC:\Windows\System\QrPnYxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLYphTR.exeC:\Windows\System\jLYphTR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pumphjC.exeC:\Windows\System\pumphjC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTWPPHi.exeC:\Windows\System\pTWPPHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hyQCWXb.exeC:\Windows\System\hyQCWXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkLlAFp.exeC:\Windows\System\GkLlAFp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrrzvjt.exeC:\Windows\System\nrrzvjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wEbvBRj.exeC:\Windows\System\wEbvBRj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NEsXbJs.exeC:\Windows\System\NEsXbJs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a7824b83927c3270c7c2a41aba4e2197
SHA14d69211750d93a4504b82adaf00da16dfb30bd22
SHA25689ebc05ba13fc947a1e5feec064958afeabcf198f2b5458f5cacb3f684075dc6
SHA512ede58901ec0f78a1a1ef7f6c29111712333aefc47fbe775d8a566bd8a0427e8eabd65448bf532d646443f59f3dd1d1d348e052d71507b3fc2cbfd761ac9c3acc
-
Filesize
5.2MB
MD5774f19ddfc28bf45309b3fd8f23bcd80
SHA105f5539b8938495f5d0385e0172a9cae55d9e239
SHA25620088c21f76c4ef774185db63ac07f66731264d249831673efec9739a4306366
SHA512c6499ffd68ca9aa008994ed1ed770f4f683002bde2b2725f2b7758cd1f59fba25136c226a15958411bd235ea4a69cfdc2740e050df81932fe186185cb16730bf
-
Filesize
5.2MB
MD58c05d1e62485c1e2c9d31ce2d1a1ec54
SHA1fb940ce94f57a33ccc8df50a2e262971f3734051
SHA25644796ce1e4cf77116bd2f55eb68031cdad4743b0738ffd55a55e0e316861ba06
SHA512ded12fa6a8c2817f0c1bfc5c412614a30d3c2ae35b2469462e304ea4f909fc026c59c7207736cf6cf4b0c328f9118facead86b68bb3bc3c287e32710e2387940
-
Filesize
5.2MB
MD51c9c1c58f9d1d25953fe19030041215b
SHA12ce0331e5f7a4d21bd9648e1446f1fcc6e327c5f
SHA256a3d671465a6febf5dadf1d0867b281bf5fe64efe37108fcbce90de44dc707d11
SHA512bbe71cc646d19a80d3ca5790257687abeb9ae1ec60b8dfbd7d44f2818e5c9aad4b77cf694ce195a2a3909a4a38d579ab8e15893dba872bb7fd3f9b5f0dc172d2
-
Filesize
5.2MB
MD50ef0cb476a2342407fa33bde57f1c99f
SHA19de2045ccf04630d90be3fb2fb0ac47493a76f6f
SHA2563697271c3482ebe5f551b16afcef6e5c745db0f264f92ba83fb23e3ecbf95226
SHA5120810cd64397c66913fa76a3b275725e5fbdef90017446f90a5e84c931e15632c6d361a422ae79381279395287d946c977df73c49b1fc6072733f0130ca23dc8e
-
Filesize
5.2MB
MD53712c6f9bca1e00adc393055ee81311f
SHA1898d0068cc89dce50069613ecec21ba5f40024b0
SHA256ce712c7ef2fed2c51db442a8f66f4635e509ea99041226d004e9f2355b384808
SHA51223063b0633da1356516784d3bf074dea1d56256c37bcaca52fc76ead1c9dd0f1c7a9ba0624ac128e77822ef35d199ea81001b58c3fa6fd4d9567a70f5971246e
-
Filesize
5.2MB
MD566fa22c55bdd732d42c513e042b94283
SHA1dfcd35397982801498ae632797727370a50886be
SHA2560a827485d6a300051f80c57ec1ab13f66573ef5dec28363e543251aef3ac7eef
SHA5124d831205167a85f9d526456ce2122822b340ba3bb23005a3a6d081f549814afca5c86c2a741a5b5f18806ec0d90982f1ec0638f2edcda4c91122321950b2aa15
-
Filesize
5.2MB
MD5f0e7ae8eb278f54b5c1acb83269a62a0
SHA140dbb2c99c175329ffc0bea46e02b255dc0fa5bb
SHA256d408fb4dc68124a47544cb5497ae01e0f4e707df643df1f9d70241878e4a9c69
SHA512972ef1363bc26fcace8aa12711625fb539cbd10aade54e8dbc1092c36f285174393c0f09fdae5af68daf5b314002b5808f98465d30487cb0733e62ed9972bb31
-
Filesize
5.2MB
MD5dfdecb7c191dc2906e1291cdb4dea0c1
SHA140ac386b4aa385e8c6773093336f564be7969ba9
SHA25625fa8e12598542e7c5553471867b882e245eda27554192167b947ea664cf4b4a
SHA512119ee048de93f0ff2758d9892baaf7f65b4901232802c7eee575be412ae5e9f85c4b8442a7d9a8e0e31198418f131da5c70099871ad5f653d208d505ce4b3470
-
Filesize
5.2MB
MD5b277ab8e98a686fde7edf43979538acd
SHA19537182e68d6438f33a81d5b98a6640c4e1cacaf
SHA256a8cc95cf909cde9ccc2496ab755be7412fff608ca97141f95ad569dcbfc5f554
SHA5122b62f32fdb038bef6ca13c8f6ebb05d1165e55fab042b884866954334a369cfdeb35d2f7b62e92ff2550c230b6ba6868ce8b0b6973430dadfabc4eb5f62f51de
-
Filesize
5.2MB
MD55a093825d4fb4afd5d5d4c0d4bf2229b
SHA1954f9063a8d76f0e20c554d76b42822d129c2969
SHA2566c9549976eadb13744944d95e20ad9a35bd1a4d9bdbef020f627a378ede5b306
SHA512dc8495bb407c226424223e109062a111d1bb4c1d145dd33b45b659a295393c8c69d434deee19962266ad8a2cbda1b6e0a0ea5764d9feef8f4d764503c29dcf82
-
Filesize
5.2MB
MD5ac0df5a48ad1db2a8af8db3e3ebee3b2
SHA1c627fc496e7b5bf6d0b0df04c412d00d24bf223d
SHA256aa9597ee9fc604ee983a53c2357a2ec061ffc90a0ec989ba0db88fbc4140a190
SHA5128dc3e8e62371de94b2cc72f99355e9fb952c7894ef5bec47daadd72058e6c1bf9ab21806c5168f568c47786e2dbf4810434e3abc46da63dc8d0fedf7659f3cb5
-
Filesize
5.2MB
MD58b36ee81e546cd025cb6297801836cce
SHA145a960f42dd3b67b0edf602f708379db5332a60b
SHA2567869fcb56eff94664bb5f7a64a1baa8eeed786dad299bbaf736a096271cbd36c
SHA512cb31594701d2b89f3f95418ca7e0da35ff720c8aa211b59c776ef01aa206765b72f7873255f4c5a1e11b3f02c56fd2064e8a0bf603cb4771f7706ef2492a1232
-
Filesize
5.2MB
MD550812867412b64d8783f1a24c4c42fdb
SHA1f82a1e6e86220fe89949aa8769392fb0ac9ec2dd
SHA256689c02d7f1f93dd61349570138c52f0e8a3327032c91da25593c033a25856bb9
SHA51215372991b584224ae81f5d36c9cb72a3a2db694043873d5e7e51909b2d6752cb24689b7dca3d79c6679c602b3a91d6930d112b31a3935ce80e571b94133e619c
-
Filesize
5.2MB
MD5902d8f66587bea682d1399f08c775e18
SHA150ac20481bc6f9946fd6f6a2a04e74ca72f58df9
SHA256dd70a66cc61cc29886b94f8e5d318292f6d84244122ee104e68e1705fd1bfa11
SHA512ecaeaf4a4d2da02be9c25f6408cf735ae310b6ad2d5eaa52e3b3ce505d931f3285b23f28709e471416af947a3badccf25ddb35f6a42fce0b5f05b2b0522017a9
-
Filesize
5.2MB
MD530a9294de0abc443ccaacf5f95749736
SHA18477377d19bdcbc5a7a92c10ba191448549a8bb3
SHA2565a969064329fdcc1a135c64d8b54fd57676c8e82fdc09ce3c34ac0ff7fbd624d
SHA512fd774612c0c5fa843f637c6de6ec224a5eba21e3be6b8fbfd4573a6f9fa7f4ce6946deaf5f9a00c2530ebbf3b79c745a9c00ea3976f8adda5ad65b8acd34a2ab
-
Filesize
5.2MB
MD52e365abc2f7aaa877c437c7276011630
SHA1ae647e165c120d5a4143a1e40d2598023d56f05e
SHA25651512918275e0375b2060bf62c6daf4326feda90e16e285b1c4ed55aa2fd1546
SHA5127e9b21c332ecdddc06faf0a4729256ea77cc84b7f2bf1e1f591722914e209ef4b66b9c99f9891cc15f4347b24f7bc5b09099589212893f6f63c2965b503be4dc
-
Filesize
5.2MB
MD5fc4766fa04b635d78507a98a770e694d
SHA1d5b060f0beed72a8c22efe3fc5820890b74f12ce
SHA256ffda09039a244d5f713d9a43c63dda3aee9e64a543854b8d4e42a745c3718e4d
SHA512c65e59001964c10891b9464d641b279505e94b159c83c04eb10937ac43bc812d33d815ae9edc77209bf55b3787dee3bc90c28a98f1deb51993b5474338321a2d
-
Filesize
5.2MB
MD50bbe75ea85a199635cd50d90982183e7
SHA125cb31f6fc64c5df532b34a32583c24e8905bbfe
SHA256ca1550384631cb15aafc7e3213db26b8ef4e64cf0c368584895719b8ce975c10
SHA512b46baedd100438cdf77ed1ffbf270850b46873efaaae40d6a789b9747d6acd03da2ddb22f800f9c919b48913c3f9cfc4e16c314ee2578fdf2421941070c2ff57
-
Filesize
5.2MB
MD596d1ba646646a820f68bd343f12e8513
SHA15eace1d8133c601fa6f5338a41f26b2527affaf9
SHA256c40e8b7f98253246473aef78163c6bfffddc53415d1450cd2c2e6f7ac4328c8d
SHA512692f9925a6cb065b7f4ee47e96d305b39c64b28c7b42ddfa406068a8d16fd0f0d021f0619510360aa401b86f5eb1fd3d3535c7a2d5f0790b4a6f8013c863f9a2
-
Filesize
5.2MB
MD56c90d6c01eda03d1e835054d009f48eb
SHA1c89d28d0b8d7905f1ef5ee4c9441b56278861bda
SHA2562a9c04577d2e4259d232332ed6d97429ea4be915d16e57f6ef0536d715ae7650
SHA51273b96307d0fc6a455db3c73f9fb410408c238921bcbe63e836a4a96aa07d2fc00bdccf0569bbae1b249788dc67d9449ea81e8488b4f53093b1d4b10d754be507
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB