Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25/11/2024, 10:04
General
-
Target
2024-11-25_01d67b8fc67892470bb0a2fd602310cc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
01d67b8fc67892470bb0a2fd602310cc
-
SHA1
e0dcfaf5effbad19944442483f5f2dc7e8dad369
-
SHA256
50d8caf4913b2bae990f4c22523f585704b8112a8ba312fa55b2e4a4d43003a1
-
SHA512
a94c6f3a989e51ee66b2a09550e1f2b5685f4ab882d2f1ac1af18938c699a439e53f513a38287542758b9bf361be5dd8f4b123321ecf3d4e65d16f867082d1f8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_01d67b8fc67892470bb0a2fd602310cc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_01d67b8fc67892470bb0a2fd602310cc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gLTLOJx.exeC:\Windows\System\gLTLOJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QeIcwQy.exeC:\Windows\System\QeIcwQy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPeZgiD.exeC:\Windows\System\mPeZgiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbIyQct.exeC:\Windows\System\XbIyQct.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ColwVix.exeC:\Windows\System\ColwVix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEyhlrZ.exeC:\Windows\System\jEyhlrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cohlijq.exeC:\Windows\System\cohlijq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QTHVsOR.exeC:\Windows\System\QTHVsOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WPCAfwC.exeC:\Windows\System\WPCAfwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXwDZhj.exeC:\Windows\System\vXwDZhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtHRuoj.exeC:\Windows\System\CtHRuoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Enmxzfa.exeC:\Windows\System\Enmxzfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ustVjDA.exeC:\Windows\System\ustVjDA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\StSssTa.exeC:\Windows\System\StSssTa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDYZbwn.exeC:\Windows\System\qDYZbwn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dZVOwaN.exeC:\Windows\System\dZVOwaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zRPxxbA.exeC:\Windows\System\zRPxxbA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WuSOXOY.exeC:\Windows\System\WuSOXOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dRyHGTj.exeC:\Windows\System\dRyHGTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qaitxcv.exeC:\Windows\System\qaitxcv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIRrXiN.exeC:\Windows\System\kIRrXiN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59e1d426aa9cd748cde21e961b3922048
SHA1a1be33dfc1db8f280f8861febfa8ca4d044a0782
SHA256e9eb84e76d90034d8412c476887ce89ba9af6b09fe74e5e08e7cd8b2b7cf17c1
SHA512d33281366d0bc574a7d63ed6a2c3958be47f55320ac92c5bc2bfba3e42b291cbd1357c87798f9dfb1ab44fde70f3fbcc21023c1b48b205ca4f4b129c9a9bf267
-
Filesize
5.2MB
MD544cf98e88ac40521df0711069a74097e
SHA19afe3c6f4c7a21c0c3996aa4b49dd9fa95257dc0
SHA256ec9f90783235e00e68aaa2bc238fec59d8d2ae44e33f2dfc37c19acb1bf78536
SHA512ff72ba907ed3fe5c04fd6daf893050a3dba45c233ec96b3a4bdef48f353db66f3c2c5c5d21f366fb45c29bedfc69b53b9fe5eefe0de3cd6cc40ebcb9536a2a78
-
Filesize
5.2MB
MD5e5b2dd7751589f4cd78b5d14a66b7207
SHA18f7aa1cce7a7280211f82a5ce87b67dafa6cf63c
SHA256d3136237932aca173ae30cfef601d3d9babbdd5a30e0170f3fce035a527e4a58
SHA512f75741e88562cf58c5b88a0f37318328c73ae04e91c3f10adcfaf50c0f5b951658d3936000915adf91b3f329248dd28cf6364f23edfe0a48837a19b82410dd9d
-
Filesize
5.2MB
MD5964f736eb5ea610f658d7a0e02e0d628
SHA106a6f9c3c3e7afa75e942c0f768b84d506e6fe30
SHA2569dc69c42c82490d7dcdba418bf3afd46bb6088a9c9ef5dde5af1fae7a621bc92
SHA512c5a658ba50f7f9244f800a9a0735fc1b2dc29f3284381fb15724c8f3b288a2042962b22db06192c946c72d6d35d686d08e74a753a13864c6f17b9de4cbd51e5f
-
Filesize
5.2MB
MD59404b9c67ff7142145e525885c82e2c3
SHA1d196728dac2b06a30d336b32e35feca25aed703a
SHA256cb7fe75fb7d39ec84abe5e126e2516ddd753d124d6f3791973101cbe5084b27d
SHA5121a0a966446856fc51efbe10ea6ca66897d2bbe9af176bede84ba43790a6b3ace5a9adc4748013fcd99b50929deae7595e9729759ad1c501fde18dc2a4b664323
-
Filesize
5.2MB
MD5ad85a70200eb2c61f19e462c6f7c0ba1
SHA141ea9c26411e1050bda04025e36a82eca161c350
SHA2564f72d2940dbb16a6f414188fdb083c1ef31e5d5e1aba7f19721442c4dcbf5352
SHA51283ea157ccb8b20e65b5a1bcabc724e2b5908806baf549af9d79ec9d2821de62802b5294bef1f9de2fc83e982b4aee550916489e1339d477a3f38d9cecc3e67ee
-
Filesize
5.2MB
MD54d733b4e666e9634533f4cf885218f16
SHA19e305e5a64415a3c165bcbc9207900304d706222
SHA2561f2432e13eae595b4e4a3a4164910c04c471c662529b804cbf3e04a758d57f47
SHA512130448e08ce28b1a9cd03e38e8ea90806a6cc4a29a671909b2e0de37a084d0f0c896661cbaa744d19667f9610d15a9c7da4add2c50ee60f9bc68c87b0521ec91
-
Filesize
5.2MB
MD5a2ad40ed4cdb0b967f323e2d19d2738a
SHA10a7e18cb3dc5b02caf2a894e69d97d3bf33d2fc2
SHA2567bd829c5ec55a5a013a5c7b8d1276e11b0a2b58e3671b3dc41da8f546b8fcec7
SHA512292628eb7543258db76b601fa60d69873ee8923ae5b9d6b5574734f0ce0227efc119dff222fbc32b637193610088f645b2d75de00485653c1f8a286824161d75
-
Filesize
5.2MB
MD51978ee1f97054d8acb4c9d90518cffa7
SHA189547e7b2d2c7c5ec72c273f4264be5ac2368432
SHA256297f79a72f3328533f082a49acc75501993918aab0b20cea2bb6736ab0e9f941
SHA512dd69821f07ff8bbdf5d57c4ff59f1fd92ad6c2f4d2d4753960e4a403dc53eceb11cc54206a6130f5fb80eb6066cf132270ac76942a3fa095a1fa51036d804c1e
-
Filesize
5.2MB
MD54ae8b4cab9989f96fbc9d71b64e23300
SHA10c823a152e678a057207d203d513e0c59cc1bab8
SHA2561a3aaed4eda166e311d59f77a3c57206fb513260a0a59372439e2ab04eee42ad
SHA512d6fd6e8186c6a077aeac45013161398bb60f025bc5d30a322f21b793a74e8983b7a684ea67d11411a394bfd1f785e7f9180a51147f4a4f31fb8034840a508886
-
Filesize
5.2MB
MD546b7f1755c872ee5996de66121af9953
SHA11173b4205df2cdaeb95d786947cc4d3f31236487
SHA2569a18273f134dc2361c1689cc4675fd218961a8b44af80a5ddf5242db7f1b1f6c
SHA512714c41c94ef7b2b2a834401fb4e261bc2d4f4735e27c7d505b10d94da13c47170e1401dd4e29f7ef1b1a3ae07a5ed09e87ba6209a4e8ba01c0928222007f7709
-
Filesize
5.2MB
MD53f32b8925627293104d6f010c5c2060e
SHA1bdd5d4ba425314519cd40fc55072de66f5a63cea
SHA256ebafc963025bf60b2e3309adc783c6fddb7dc4ad7a8d630d85ddb95b92dd6819
SHA5129cbe26c871175e0d223456cc7cc83facb04ece9d0fa1b67bd0bc9dfb258f654aafb78f1e24d1ac23cbf2de02da8974c6d40b39167113871a29314ac9ead510cf
-
Filesize
5.2MB
MD5f5061d49219193993245879dcdbd1d49
SHA1d2158bfec5ccf674ceb9e20518249a189dbbf844
SHA2566220ada958ed138c251ad36c2f40a25d66901e3b652671603c76dea89d83809b
SHA51267c1962d39e0b6bafbc39f9cb9ced3485ca76e48608a949347ff3c18fee39d64a17cd3b30d1a129087ac8a1b5255298bd599a2b6a43031314542c7c9b3c7958a
-
Filesize
5.2MB
MD528f38b68d2c046e869de88107ccec6fc
SHA126c143f483e1fe80bd98f42c5f50fdc715d97a8e
SHA2562dc931866ab105c8a51b7b29f73b0319488bb6076c53a6b8584dc0bacefc832c
SHA5129de80270f73400803bc988a8fd56e10261a6c5eb90dd2690053bbbbfdc0299ce234ed2454fcae9b953043f7931c52e73459e80f5177ad02b25385ea6d7677364
-
Filesize
5.2MB
MD53995ea8908e04a32dac4838f1d9c3345
SHA1cb5170f13f6416074d6eaabe3255659a2c42af0e
SHA2569732a629f7715dd3fe7d6bbc169d184de98d4f60f7582a8ab2a4d9757cc41072
SHA51230acf49ecc842c5ee153b8dd7b1b267e8c08bbabb7d16349b63b449158daba3e156fb987aa9431a301673a9bac5c49aad6657e3da1174b2de80898b7f3973507
-
Filesize
5.2MB
MD534cc43b115594b9c44ca8b1fe8bb079e
SHA17a9b295687e76447e7c05c911630ad50016d569a
SHA256c55fd5690bf81c6e3228a98c366f927b3019aa704ac77fae00b4a7009d2bb3fc
SHA5123921278a7b3fa8e039b5f01742ce756a60daa11144cc5b5a3d3a6d8387b8e859f001f99b87b5c8042869e6bf18e9c4450b9c9035401fbb376104a540452ac3ee
-
Filesize
5.2MB
MD59485cc351a09391ea4b7bd5385253986
SHA18831fb9a45d00474e9dae21f998fcf9b78dc6f59
SHA25676a25396b1ea2fadc84ff08be50b5437f7acc5ff599c2e7aa78b69ec8c5c69fd
SHA512bf05e47a949ed98944ac47ee5ba6d47800b6501dbf527060b676f38add234a6c8813f2778c603e119cffec683fb40ee1e5a262777453f6bd6c467010450fc469
-
Filesize
5.2MB
MD5571b7e50eff342e65ba4aa1b098aa2fe
SHA1c6bf5a6d28a9536626f8fe70bf5607531aa26972
SHA256b1e6a25feeb56fabd025cb9d0787dff87c5ca012584f43e510ca65b11d1ad3a6
SHA512ab0e3964d1f3f37f7c2da1f20728b22c24bad27f71b7d727cd591ae84a80491b99d0b2eeae2fab7cb44c9e7cb3147eb40e5f7bdbb5dca6577f1a4f20b43f5c7f
-
Filesize
5.2MB
MD54bf09ca2170f3ebd9352913546ba0dc1
SHA13935ddd709be0b04671f69f1a9cd4eecc7caa5d8
SHA256a88e8a560c9d4417597c9f41f5b9446bb66e18936ec4f1f0105926a47e295838
SHA5121d37fdad9e37fe64a63b82ab6eda817d394e0aea0f9bffc8ad56d82d06dd69fb8912736a1c17848b9197cb922f9e21975f482b666e8600952c9707ce495dee88
-
Filesize
5.2MB
MD5a61611c50949fe735e721e5a6d940282
SHA1d845c8277c5c4fc71f1f165427aa1562e34d7d35
SHA2561402fd464094c79654089d8e78bc68af3b818bbfde0706cbd18d3191b9170fb5
SHA512fa1db1fc7b57c12a530a37597b5a60702cac5b1ec6b0c912359bb4f2b0e59df99cf7f37196a47d94507727e10c9b2e5232961fca6a73df2d1d5a87d868137c91
-
Filesize
5.2MB
MD5a855a6d5d2e32ec9ae4fef09fe9cd948
SHA131a6898126ef5964e4f8f8bd7587dc35100215ef
SHA256579820fd249140989168cf34a06dc6f79e644bb7af940fe92944e4e4a47db1a1
SHA5122a458b5a2d62009045ce7aa582091ccf4aa4a982a22acd945b27729773f47cfb3f65b59719e1d0e56468613865c7ddc278b74ea63e4268b96ee11d46a9077eb3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB