Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 09:50
General
-
Target
2024-11-25_8c25628119774509ffcbf6bedbc7bd34_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8c25628119774509ffcbf6bedbc7bd34
-
SHA1
0959b1d94cd15a7e8e427df4839a167d3aae020f
-
SHA256
bd49895f9b6bc3c2c3024915d989bd974f54e8e06c61d38d831c2e4aeb360f09
-
SHA512
2baad64370891799962521bbbbaec757a6b8e4e02eae791870227858a28703e8b165c867599d73868aac2a2a1168a0e0017b30eb2a255191f0e721ada4988962
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_8c25628119774509ffcbf6bedbc7bd34_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_8c25628119774509ffcbf6bedbc7bd34_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gxCSdtp.exeC:\Windows\System\gxCSdtp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cENQJtF.exeC:\Windows\System\cENQJtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztOrluK.exeC:\Windows\System\ztOrluK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mMjRdax.exeC:\Windows\System\mMjRdax.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rmmKTNu.exeC:\Windows\System\rmmKTNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uBUZcyK.exeC:\Windows\System\uBUZcyK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyGVpvF.exeC:\Windows\System\wyGVpvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vnzdvtk.exeC:\Windows\System\vnzdvtk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pQCQOlE.exeC:\Windows\System\pQCQOlE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qkejtgF.exeC:\Windows\System\qkejtgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMjUOff.exeC:\Windows\System\TMjUOff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\drRXrAJ.exeC:\Windows\System\drRXrAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlqMzLs.exeC:\Windows\System\TlqMzLs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfIAWmM.exeC:\Windows\System\lfIAWmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iBxBXPF.exeC:\Windows\System\iBxBXPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\StBDgNy.exeC:\Windows\System\StBDgNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKktsRK.exeC:\Windows\System\uKktsRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXjYmbC.exeC:\Windows\System\iXjYmbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EWVqKTy.exeC:\Windows\System\EWVqKTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMZwNLJ.exeC:\Windows\System\IMZwNLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAVMPHo.exeC:\Windows\System\IAVMPHo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57028b0b3b9545a72e30b266c4fa5f168
SHA1657e077036d8bdf5624c4a6c55abb73c89796d0f
SHA256a7c7d7c9ff735a8346e4d24ae34f21b118b20dba157d8809673b8a6509a2a8dd
SHA512ffc8a25ffaf58ff4c58c137679535d72f74fe408467dec330d31e001a2b1d6f937314540e530668d6508555b7adb1794edc77cea207704cb7c2ae9d506f200b6
-
Filesize
5.2MB
MD5b88ac8e579680d8f69730683f43bc147
SHA13a958f3f8da5223c98077d7a5f919070405032fe
SHA25690a7a81b572bd3128346d7393c82019be9a62e11ea870473806d6c09567587f4
SHA512310225633e9ab8a5607561fb05b8117926474faf97701d7cdc06a3a43378febbd554ad604fe337d18bebc332fb38b9fffccf9c193841829d01aada75f684bb4c
-
Filesize
5.2MB
MD535d3881896837630eb9bb6079ceb3402
SHA1e8a8096e8c41a03488436759453793a18554afcc
SHA2561e185a276755689a8e1a2ba838f7f62c3c3de50562478cdb7ad00d934e383085
SHA512f990f684d29d85500fd48c749f19f4eea3bcc49ef432e60451a717a188053e7744a5e78c50a71f7951c38a64aa4991cb17293c74537769736d4b45b241dcf503
-
Filesize
5.2MB
MD5c45b7f5a9e71858f7a569d88d97ff8e1
SHA1fed54a4dfe604aef2e647dfba62f98775c751b1d
SHA25607a44bf8b48a190984ddc0b58a0b458490fac689804050a4854663065f90602a
SHA5124b8687f5ecd7847b1977e277096d4ad636d98b72f6cef26e57b4e8d5348f1cd233b086407f5946aabf996b8ed7a5e54fc805699fbca44847591e629fecd6c730
-
Filesize
5.2MB
MD5608ccd97691d09489565988e77e45034
SHA1c9f32839192bee9402271cae9e118670ce589fce
SHA256f0f559fd20c22e6d97036ed5d1a6c39b2d7b8aed06144e190be10959b9b3c4e3
SHA512b6006d10a5bb769c82e2ea73bc5bd75aa69942977742bd082da832b5559459dde489d57355a0ba1c7e302d5fbeb8e198e03b3ba369df67e1b19f6cc668d89eba
-
Filesize
5.2MB
MD541b75c6af7bcac68289b03779c44a9b1
SHA184669ba50fea9698ea9d984268cf494466ef8944
SHA2563b8153636d803ff7bd63723218d463e40ddd60bf1cb878068e48c9ec30500740
SHA512554fbca826a58040cfab2254f8c01fcd84adc3a515b5daa45c82eb974a29b6e9c2a5adf3aa425b68fa67c71c1062a7d0f4575d0d4df6063f9df416cfa1db230e
-
Filesize
5.2MB
MD59b53ea24cf305cc964297ce48210dd29
SHA1c204a86657e79ac05d6a8a532f8037ada8c447df
SHA25620c6e48b2cf509fef190df4772ee6a620584b9b66dbd79c35785f7d8f634cb71
SHA512440464d45d8a4597b199acf1e0870667b6b35bfe6e6936c2de4372bf36e4985516b298b3baf4d8dcc4e197e49cab6df8c276f386c36d586ee3c1dc619a6b30f4
-
Filesize
5.2MB
MD5ee6312f74a74c45151816c4b19233111
SHA130f52981e0e319ab319d25a5373df3a0b6112bc4
SHA25649268fd2c2ae607c84c551e7ccd741537e9e8e91f6a0ffeb753e572106d3e662
SHA512b45f0a149047d1fd62220ea5767132f1f3924903491b9a80672923bf40cf44e545b72979ea0df4d1c5c25c539ca301fa2102e6aab74aed48b8cdce1778591c17
-
Filesize
5.2MB
MD5136274fd97a0785acf1b118face0e674
SHA1452d2ff3fcac4d3f01477b1d6fdedc9369ef785e
SHA256367e847cf0343bea7d56dbd3e6e210b62d915f93455d1d512dcf2aef713c0912
SHA512d6ab85766227b4d91c361cb5b18caae6c7e9b337fdb7009fbfa1f01097f0ee189fcbb6043ca256a52d044339b63451650f4a17b25a6118cadd154d93bebd02e5
-
Filesize
5.2MB
MD5cca7894b83edac914f2934de006e231d
SHA16c1b5f21be626aac8b865fee976a844af7b58500
SHA256b025c6626c6ebbb9666398266d508e021fc3100cf12dd5f79731de6549270dbf
SHA512d5f34808098fbfdf2e89676b5f0714b12f56eaecb3909d11be9e6b749ebba638f2a9922357758126d9e4f929cb911a30ad7ff447a831cd6307608f456f52e3b1
-
Filesize
5.2MB
MD512ce97e792ddcc37e65d8221dad5450c
SHA14b95fc0cecef1eac1837678b65cad7ba96bc5239
SHA256da3e7c1c828f0607bb79b903c562cc6faa5bf71a54829e0d5d83a0500c8cae54
SHA512eb814d8ec29572f4aab46032d2866c93037e2df1da4faa35e524fcde9952860182f5b995ecba8ba8ddbba5833b4f6234a95ab708a6f5813c5fec1a3f04d0a2b9
-
Filesize
5.2MB
MD5a257e992c70f866247b8ddf87957bd45
SHA1472cc09aac77e520f6273eae282e8d032b25ee7e
SHA256087e7c3500d4b3b3c9fee909de6f68436d04c5e951e24ea99d3143eb63bf68d2
SHA512d8c78efeabb640395ceb51e65d039be7aa7f0fa5763cdffba84d52d53782930659625009a02b9283d07a804a9a343d256bf8e373ffa4d877b4d5589c837dad2c
-
Filesize
5.2MB
MD5d2a27523ccc375bc62631e5be2af5ea7
SHA16d812605ac1397022e65f3337354570d1ab97201
SHA25613b6f13377f0fe1d13e5742d5c515cb0b54e3967459f6f096752a4d7491b76ab
SHA51264980e8b982f76c0001db4d13d4e8f2d545b15d04fb30711a62c50c77e7b49bc248664dc1b4b4dfb4083da254befc096752985d6b9cef6825f7db8480accbed3
-
Filesize
5.2MB
MD53b04eebcb313d866b270f01346115e06
SHA13d05a1581111a8ecfd28484f4822b3a060054b4d
SHA2561ceeaf376cc39ffc6355a7d23aa068c2f233d62c3e3f69c93cbd18b634243144
SHA5128bd41e1c8987dbf04103977f4e3222deb654aff49808c62cc7493fcc4e00670a67baaeff073857807e0c20f404c92de7ecf479363c2b4ccb50352141290d6267
-
Filesize
5.2MB
MD5f0e2caa19daa71bde9a8079ce82af179
SHA18cf0292a6af53744fb51ad55d5dbf84569ae0a2c
SHA25688d3fd113880099d28299b0fe45de77852e3e4c420a1a6a02a5d0281c09cf421
SHA512dafcb51946d72527166995c00fd95940ed96819ba9de5ae78b902088e557229bb10ba58ac8cd9af029c112ab5f1c64ac4e0461bb9767a50a0d5681f63e6a5706
-
Filesize
5.2MB
MD5267639981865bc2e560e705a379b67df
SHA1abd73880f093585402f115332ce2026e23754b05
SHA256513ea9b75bd3070dbec66b745503701404e6102b6801620c2086a6cc386c08e9
SHA51229915ae4cd7f730e361991e666dc45069446d210a76a8b8957276b34cd955e2476159997059fae84b9fa26c5c779fc712c871e4b441c8ccdd33b5e296ff40091
-
Filesize
5.2MB
MD5bcc30ad17cf154aac45b1efa1972668e
SHA16184d5c8465e750b35a610ff4fee44e849fce452
SHA25627a10c666ca6a3f2bcbdf3a7bb4995755c9bfab3fe3aa077bd6de728e7147d81
SHA5124a9407cacd51d197e45d94edb2d92f9647dc13217655bb6f1f3a68ba97e013ff6656946f6d76ce361b8baee9fc748356a3b3cc7bcf972ad2e11c0796f8927eff
-
Filesize
5.2MB
MD5e8794fc7d892ddaa6d11452dba2ff1b0
SHA12958ec6c0ed97da150f9017287e5046d457dfc32
SHA2561186c1853c213fc14852f512fc504a32050bc0e90d30cd97e72c11e7298f0ad4
SHA512f2db6dc9cac43f2568d9e4bc19f1fab94dad7d06a50976c6bb51a36dcfeb2ba684aeaa84fe5ae2705d6fe2ad18362818f80a77f22253baf46a1b57054567779c
-
Filesize
5.2MB
MD5d33b54f182162fed75dc03a9d40cf0ab
SHA1d90398d468751b03884bc021ce801a4223fb81fa
SHA256e0aa11f874ea0c9e1182f68ba44c4a8c4e841741879397782da47bf3a1d1163c
SHA5126744a4dfdb941a3abd8583496eaaedd8c26736eb6ec3bdae3094e2d69157007f118af9c2f65e43334f2f4a429fd846006c4e2ccec1c91dc7f17f877bfe3873c5
-
Filesize
5.2MB
MD5e5dcc005f04c90464dddf5ac0b897f68
SHA1f61593882c1eb13d9ad647cacc97a7cfd1615635
SHA256f9530e2a89dd29e4b7dde5452c6a17cde2f37bfa2eb49725a980f79531383f3e
SHA512c4b21a68a3a8a4849ddd258669fbd94a049ac3e150274e02e2cdcb70dac70e06776bcc9e254bf8636d6a392c98ce66fab1f2d6552565859a1de566314b08d1d2
-
Filesize
5.2MB
MD517f0b363a79c08e55837dea8b046cbf1
SHA13b61273eb9c7f47618663d84fff59bdc9ff4bc36
SHA2564a8fcb9a919d95e7034805f043693f65f2e1da0f03acba417cac4d5e86916b23
SHA51218ae16a83a11eeafa85111baf350fa42eadb348d2a5a0ebfb9e34cdf04875724965e9a55b7b60971771cd935bee2e6a8efa67c80d1be592f95e24922f94ac174
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB