Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 09:43
General
-
Target
2024-11-25_00e16d028b70b0edcb364f22daac49ce_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
00e16d028b70b0edcb364f22daac49ce
-
SHA1
d94901a7a206f36d63e67b51ed355279071bdc1c
-
SHA256
d89ab30cdd35bcc4b58dde7b38a1a3dc90b083df909c329e4a86c9604f329893
-
SHA512
1548895ba74257987fd1e7fb1e7c1b7a768fce9c84170192bfe6e1b5ddb10774ead537af67314626a3b74b28453b40cc71d7821f8e34c83abf38ea76e4cb2b47
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_00e16d028b70b0edcb364f22daac49ce_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_00e16d028b70b0edcb364f22daac49ce_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JVKnhID.exeC:\Windows\System\JVKnhID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDFOAJT.exeC:\Windows\System\CDFOAJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hIkBAhV.exeC:\Windows\System\hIkBAhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJzKexO.exeC:\Windows\System\yJzKexO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FqKMfdR.exeC:\Windows\System\FqKMfdR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfjmDks.exeC:\Windows\System\XfjmDks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ToPXKfR.exeC:\Windows\System\ToPXKfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eHgGTsT.exeC:\Windows\System\eHgGTsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ibUwICc.exeC:\Windows\System\ibUwICc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DriqeJp.exeC:\Windows\System\DriqeJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLCxprt.exeC:\Windows\System\CLCxprt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QqdAtPv.exeC:\Windows\System\QqdAtPv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIMPyze.exeC:\Windows\System\MIMPyze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OaMIOST.exeC:\Windows\System\OaMIOST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgUEQBM.exeC:\Windows\System\CgUEQBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXXkBMO.exeC:\Windows\System\WXXkBMO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQaAumy.exeC:\Windows\System\eQaAumy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eeWIGKW.exeC:\Windows\System\eeWIGKW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhZCOQx.exeC:\Windows\System\VhZCOQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXCcWvR.exeC:\Windows\System\YXCcWvR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmfqtaX.exeC:\Windows\System\cmfqtaX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e571a0c08c9473971374194f1fb71028
SHA10c6c4b095a3232d043eb528863ade1fec4e070ad
SHA2563f0614e002e38cd529cf7c6f5b9622cd53930176e83291ae3c322e0c0eebe8c6
SHA51222e6060b747812e3c0495f281026e9d9a4d071204d32bd1f0e9a3683184f01f181214a68be34f83f455d2ed4b263717153448dd944ec9ca39fdd67e476098fec
-
Filesize
5.2MB
MD5841fd9e7a8f8a37c626637247b1591c6
SHA16b59e3b945c82f7d3ff7711d33c5eed10de9012b
SHA2567102a22c8ec2b03044a635fe0b83fb018afdae9b982bb999f222fc1db45432d5
SHA512babee6414fc6892c45d02fcc956f84098e74b529f0efbbf870a7407ffb50805ff01b0901de4a245188e88784b86f67561467ef31b3eb7cc0a5741ac5e09561d0
-
Filesize
5.2MB
MD575abe23e0d70d06cd1c0e06e64af27e0
SHA194b73de638d936503c4d140a32bbc7a3f29d2a10
SHA2564af23243319d44e7800749b76e17ee7c505d3877b48aefbce67761c381e8e012
SHA512eafa14084a2045cd896b41ba49f6e850ff26b5dfd61f4ffddfb62ad37c4685e190dadedee70f0d6585de8c0d30a734a9449e9c77259cd2c6602f61b9daa60599
-
Filesize
5.2MB
MD5bfb8130bd3e6006c9ef7f7d5bba8623e
SHA14a23cbe80852d474e9feb7e94be0bee98d48a972
SHA2564046d8edb25ecad6061197ca7ab3ced88c8c023fec9f2fd29e95fea176f2e837
SHA5125a505de04d2ed6819f8b3ca9029a45d216680119508e4d90dd20cac9d2f3fba3b0e83b01e6f1d16aee6bbc9098c9e1a187f8ae050647d29073d2e3944c232815
-
Filesize
5.2MB
MD58a56017e9187ee8f82705547490ce5f4
SHA1f50682578271554c4a77c70878e30e93b2955f5d
SHA2565a390db63e310385881aac08248c6e19249a427db8c59cf34fb38f3ddc56d722
SHA51287faffff3661232a62daf5a03c367fa8e677f7337504db0db123e6ed1a47db58fcf6fdcb769292bf5af80f7f3b3b94c01cda14ef86f4fc6a22e9a1e32e7f128e
-
Filesize
5.2MB
MD5a05554c9339d470af595fa2e98166b41
SHA17e71a0db760258e71c69828f87502e2e8f9b33e6
SHA256c772aa0ab94e777eff7071e11a9ecf4f9e9a9cd80f20a906688f96e7400cadce
SHA512c5603db3fc24d9bc710b380aa4672bc0201678e620bbc3601a4f782bb2ce2f5830bfa124e4a12f83620da47be9f0ac9060d21ab57cf7ff83ca107807d3a0a1f0
-
Filesize
5.2MB
MD5978ed07b57691028d237c75f087d394c
SHA1a99384cf09c650cea65a09a72739a479e9797abf
SHA25658156f8b7f88fb5b94e9600bcb1d2a68eb987c38dd1ac7cd7fc8eac3cdf4b50b
SHA5124595a074835c3e064189dea84247edfed5ab23ccad3c5e7e7f4efa1d4060b2bf7d0826699d31b88e0a792a2249db8e5473e91f36aab75514a0597799604300c1
-
Filesize
5.2MB
MD5908b72797c4a570364774bd54db8104a
SHA15e520d0d4d6c061ba937d80b6ee6ce6e50e58a32
SHA25695671423475a5f01e7a8d68b08a3bafe9f37d562b6b7f7fdbd317b551c6340a8
SHA5126a8bf4584a105dd1042788194579cdff9e97ee1915bdbb67877bc850e90e96e838529b789a07224d5ae9c1b8b07fc42bc4d9dd53805d14ea532f1ea16f46f5af
-
Filesize
5.2MB
MD536f868b6c5e73b629e09088fa7802bf9
SHA1748ee72f915f489f99a91437f7a7b53295afd296
SHA25678c98464af72df1063ce5c949bfe876e596a483e63d9097721da7d46f70e2de9
SHA512a23b5ace56918503413d775b0e2ccdf00a587ae259021290a77a83ecf9dd74dd199e67efde8b427957412619d07f3ee560beb4337d20d3299d9e288967d06871
-
Filesize
5.2MB
MD507f07fb82fa362cc4f41472b7ee04e89
SHA1dc716e765d065a144f471d0bde512abc27b93c0a
SHA256bfeca008eeb4e516e772a09b7cefe09ff4cc8a7ad9b8fa688acbd54a4f9d0725
SHA512f9233c9f4a7fef34cbca1346963d7fafdea46ac39ae45d3a19b4932d44e0b143116d6403a6a5b974446c2d35a556e2c319abc63baeb6e84f04b72d00e25ef813
-
Filesize
5.2MB
MD54bd440ff2e12184fac81c5dd2c62ae04
SHA15300224b0568835f4f9c506ab66b5faa320aabc1
SHA256103bdf2c1e1ab962a4a03de3a410fd96c750082ce796619abdfe0a99482a09ae
SHA5124d0f785249625d30fb13496134fc5d81889179688550791e8806e4dfbb18f7ad7b4e7097bbe9e8ed049ce73af8f5622a5d0eeada0b39474b4fbeeecabfbcc9dd
-
Filesize
5.2MB
MD5a8119b7577890c071a13ede045a78762
SHA19ca46f450a2f0869373294cba6f1354f69a3712f
SHA256dee7b009316a363a8997c0a5a166cdfb77862c213995381c7815f32cb352f159
SHA5123b3a2eb30cfe0d9ea485db6baaf0f4952f707ba2f2631d1d0cef2a36143b592c4d3c6fb2fa516d21a2ecfe956bfb145566f9051c62a86fe1fa2722538f65dff0
-
Filesize
5.2MB
MD56ad15ca58d0a7288a19f28f0f29e6875
SHA116855e12f891c50f894c6d9aee752a822412a2d1
SHA256d42ace5086142f4e1e503292456a21e29473976c1491389b4cf32f007ede6b16
SHA512b8a6255501d83115ab0d2eeaa68aa47ad730b0ab0d66c50d76dec224bd23f98a2016a38f985e9ebbfec38debdcc014a8e6df9976d4e524423795660aa679e7f3
-
Filesize
5.2MB
MD58727d6fcfde1cd9ba6d47a1b2c878faf
SHA14b4ea95ac3a96fd462c31729a80dae48fbd8a47e
SHA2561c400dcb69e110e5e4fe1d964e0b657b6e97c6c8796445758887db1a6c3b7e71
SHA5124519436496eecfc289532b3b3e1c6e9c00ead4b7e7dd32e996dbb5adc20f3a645fa11b9282b1cca84c7feae082360388f304aa8a02bd06ddd6ca46579ce4a207
-
Filesize
5.2MB
MD5571786eed8c31c37fdbd9c96e0917247
SHA1b5da6e9d1b587f7e0b0cee0c407b0c3d7681f02e
SHA256836d628541fccfd832f962bb06d323e6a28694463571bab9319b6fa310a78d88
SHA512143707527d0327d31f6ff7601086312b115a480abb5f91766c14c53b7829f600a6a08e175854a95d93679e4c75dc5c848ef61883a3abc6570b145ffee09af987
-
Filesize
5.2MB
MD57b31688a8ce0559bb4ff64a245c1589f
SHA163bc014a33dea7d652100d5b670cae28b99d0452
SHA256660660c81b98d4f14680dd61222060c18b815234f01a059e0aedab7848dea71b
SHA512de0d9e094f875e108e51ba618d903e3400f6b6d6946750a553b7d27c26f5cee9766828b7b85a28629adda897ae95319319156166475f6fe96c18deca8e929dcd
-
Filesize
5.2MB
MD5825953ee42b5e9a5b1f26f68c9e40b96
SHA1ad5f6ba5ee1d67c2db8af4f6ec0f41515b97d028
SHA25610c54a11de8b1728cbd7213feb514afa6ce2737634281ba461fb1f2cf56e25f8
SHA512704ed10ff15f3b7ab4219dbf3228638bc7da04ccffcd5b0475772b154110e1d69bbcadd42e88a688f581c464f27e64cb6b8e8a411c82a52fdcd6f61245d958ee
-
Filesize
5.2MB
MD5116830505985c367907c2ae9f2a790f7
SHA11715b404f10033d5c7c25500841621f490a68e79
SHA256972387355111f4648ccaeaa823032ff6baa705474917495168a31d851b443828
SHA512a525379260b404d652c2adae03ac8c12f23023cb2b3b331e184ba214343d8cdf2eea056408b31168501cb2199e51a7d6651faa2bfd84f0a9fad5377a68e45b03
-
Filesize
5.2MB
MD5852beb7f48891db1989e6a61fb5cc5b2
SHA1eec7ca67d4bb15480ff917f9236809e77706b3ca
SHA25699b6c9b8c0ebd00441da4c1fc27627f0a9efcc072c2a2090116db90ea89a0c13
SHA512fbe530131c761ab137c73a064d706c1f51e5536b49b4b60d321e65d61303e3c8db980c12d8913ee39612f5143ccbeffb7b7ea2afe5480b0c3ee257a067168993
-
Filesize
5.2MB
MD548e743e32ca586fcfa234cf6de101073
SHA1d027b55214c8c675114eaf1c8ff928846c3824f3
SHA256e77ca99dbcf2213c13957f84483f9c33ae369f47d2e2d37d300a4e46d6e00116
SHA512b2d148fe14b3ae469d51c74a401f772b1c752289356994ab3e22a2574386b046e94f4501b3e8049cc2a32b623566fdba418b929e1f9ef96ff3027ef2ee4e28b3
-
Filesize
5.2MB
MD57b2faf35e65b7cd657f673dc08579cfb
SHA1ebd955381f1369b58ecba80b40da3edd51d37672
SHA256dcc3e29bb8f728a6c26a8c148be99d889d124cfedd359c82910aa0dc824d9a6d
SHA512ee91336a515eb53e8b4e788dad04af3de315b2ea54070d8624de86d744acd7c42afdfa274e0fb95c0fcb4de274d9a1397650dad24b160753102c14a7531da092
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB