Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 04:12
General
-
Target
2024-11-27_9e0f44f9fbedcb8050c0ae5706a870fc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9e0f44f9fbedcb8050c0ae5706a870fc
-
SHA1
1ead1571b3dce87f13ead28ae440046cdd899a66
-
SHA256
084ea53e2d6bec3e979a62e178a593434fd232c48f8a8a3f643a58af693a2a22
-
SHA512
456fd2f123309bb5aa2db05adf0dcc496600829b61d97dd39b2d6e1f96e8b22586eb0e9d85ac075a345bdffcad164f03af23dcfea3576e0f884252d72e6811b5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_9e0f44f9fbedcb8050c0ae5706a870fc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_9e0f44f9fbedcb8050c0ae5706a870fc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XDzMPGO.exeC:\Windows\System\XDzMPGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMfltId.exeC:\Windows\System\LMfltId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFughXR.exeC:\Windows\System\HFughXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rQciwHn.exeC:\Windows\System\rQciwHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rrVKjlE.exeC:\Windows\System\rrVKjlE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCTiSdW.exeC:\Windows\System\wCTiSdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQhpjyV.exeC:\Windows\System\jQhpjyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzMwFYy.exeC:\Windows\System\jzMwFYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YxcIsZa.exeC:\Windows\System\YxcIsZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aFyllon.exeC:\Windows\System\aFyllon.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrkRVSM.exeC:\Windows\System\mrkRVSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rmSIVcy.exeC:\Windows\System\rmSIVcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMRVUUo.exeC:\Windows\System\PMRVUUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDAZXYR.exeC:\Windows\System\HDAZXYR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdDXaKZ.exeC:\Windows\System\zdDXaKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMbwSon.exeC:\Windows\System\oMbwSon.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FykqefL.exeC:\Windows\System\FykqefL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjIFnVe.exeC:\Windows\System\SjIFnVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PNVhAwN.exeC:\Windows\System\PNVhAwN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VLiycpR.exeC:\Windows\System\VLiycpR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weUzbLH.exeC:\Windows\System\weUzbLH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e0f0a3ae853a4a657cd550a246a2343f
SHA12644062e69cb3753b5c2c9c3b14bfdbca1b26de3
SHA2569c6b38fa8c89a00e124fb8ee72ed31c448af16e7a278af6a69ece7ac4022c1f3
SHA512eb010eb6059ead7e1ed780acdd4715310ee9c5545668a4cfd244fc2a7f995ebba60bfc355f374036dd53b1183b0bfc6ccb6136a210b887026b2932bec871a360
-
Filesize
5.2MB
MD5ea0d6a8c7e34e867f65d953c7f06290d
SHA1537fc19b0a96d4712d14e8df15e5c53a5bb9da16
SHA2567a535bd3728c63738c09aee73aab0d66559804699dc135c9b049d7be39697d94
SHA5125f19b2c852774ec43a8064f133856a2cdec0c652b870d84f1f4909d8fcf6265c54cda5e538cc092160166de44e575cacfbcd2c4bef34735fd25321d65be1fc67
-
Filesize
5.2MB
MD56066f90fda27af71879063302a1353ce
SHA1da6a5e316a97f1f16a9c893cf2ebd478542ec66e
SHA256618160128480fc15720ef13645d674db0e7880298e61f24aebcc7b9f60522a5c
SHA5126780bee917cbd3382db29111208b351cf43f1e9e7a6bea735a263c9fe91a38c9094c0450026e700c35869e354925920544f1f90558bd7b971369df19fa60714e
-
Filesize
5.2MB
MD5e5322440ad885279db0bf661f17b7925
SHA12a234d5d5d2a0015744c2532b566be338d2a1e36
SHA2563cdc83c1d4246dfae7de348cc255f721c5ec75f7061aaf9de4cbb5072bac784d
SHA512812ac888ae1a5819504421be7a75e6eece94dac737db273026a86a9ee8d3d873ccc40d25f2f4a9b28ddc7d106fa87c540c461903d31fad32e212037e83c3dfcf
-
Filesize
5.2MB
MD5054a6d9eac0b744cc238d4b25c53ad57
SHA1ab75eda46b94c086f323cd3a11ae2c91021266ac
SHA25663c1d2058abd6f5dfe3893f067456e2a712fc661b88bca17a60483224ab495db
SHA512373cf7148f9e65e9f7f81052c20d9bc43132a243264785e9da0a0a5377c75a9c9e2bd8d484c96ed99222054c01cb9beea437c43e9aefd77f513b5a9becd8d46e
-
Filesize
5.2MB
MD59136a4498683ee8d4e3e30101fac8459
SHA1503126e257c84b52b06304af88760f4befbac26a
SHA256186e92ab0209f43ddd1890d7d5e3c64b7a7a78a0f8e78a751170b0fabb01f4bd
SHA512d313d962196a9b14d8b7d9e36182bc482b30fe1ae466d4e6a1460256d9f4974426c2824c449fbd6c8aafcc1361bb1e391be1296a3df4922cf402036e9f113e45
-
Filesize
5.2MB
MD5357c04f6bdcd9d15cca6c257ae264f5e
SHA1e8e18410375bde7ced88219f7166da06f4b30899
SHA25633f0ec204ea1f2e58d32aa206f6f37e3e5a254e219d55bc56abd70724023e743
SHA5120aeabce3aa6fb1a00b773814e553b166b0916a702f983851864e54ca9dbc764a4c17e40123487044b3b7a384e3b8152fd20cad83729bc22c610e8c1e45d51834
-
Filesize
5.2MB
MD5b487d824653d4f571b5f4a5ca5e98351
SHA1c249068da6060300fb593db27a825b1b9b2195a7
SHA256e3db4879c989c85fb6e22c3d44cd135cdf2f09cd58b92e1c119f10f1bca0f2a0
SHA512c6173bd569c53de22e6698e5dc7872cc55c85076e86b9fc48c9b302ae5995e2053d247e2638c5c4493a5484e7b1a7e5659e62eb19960cca34294c1d519f5ddf6
-
Filesize
5.2MB
MD5714ca91a464ea273f8ae8b91fb96418a
SHA16f2b04c01fce6282d893a1b0716307fc43cb03dc
SHA256e58c37cea8f069333b57a04b277c9ac1dfbfe52d0eb4b88d18b7cd3b682ef0cc
SHA512043e24ed421b2b5eebb80a6f88a07e38e0bfc2322e7b7f3c0c46f6c86adac1b2ad2e351b99c6898b61556b405075186cd7815017c5eede493d70975cee08cc42
-
Filesize
5.2MB
MD5e7bc76697a6b19b92be98bd1d1ac305c
SHA101efcbf1e9614ce607f731c19d5f28145edcb2c8
SHA256909d1e490432fd7af5020277590058a1e5ad1ed716b50835696b8d86d1651371
SHA512b8e576c3ac4cee8913fb8da71124fe755e61b6b57a1daf1b96d9d74f07c6214d42f3edc937bd2f66ec25d311ec6765c2bf3c736c3370802c02c27eb96ba4dc4f
-
Filesize
5.2MB
MD5cb701a8981085b3cbd91a03b3c405889
SHA19d1338b43e5198f7e742011759a20f88d536c17b
SHA2565da63da1f93edaef7eca29f86717fc410d7969d677a01030bd03c0ec542943bf
SHA512dcae1e2b721613c37fb645dbfebac16999c3b3a296a6ccd93b6b0ee7c25c3a61303921ab3ff9a75b8697030b81ff489fdebaff922560495943557881b0c292eb
-
Filesize
5.2MB
MD51c3945bdaadaed89194ff3881a991436
SHA181da25d6e93d06a4972d0bf52e956e1679a700fd
SHA256abdb812b16b1e988cc194c64b2e20d7c12a9d3c9c26693a9df81b65862f4bc5c
SHA5128bc9d8546a04c7bdb852989eb21182a71f150dac4b298f08a6584de609c917a90a6e5aaea8f150145fd6b09621b546e4c8b6b586e311de93c9c059bc23125402
-
Filesize
5.2MB
MD5a13562be687323ec6e087a9acb8b3fae
SHA18d3191685e8b3869cb9130da644e68cb7e2b4c42
SHA2567b717dd135e292cb3665e02872047dcfa30c5539eb8917e9a367f91b614b4dec
SHA512f2cfefaa335fe17d65245191d80832f61675e3d3b6fbf64b859135baee97f611564576ddbe1d85f330dbb3cee275e69b606e8d030ffdc38c8165b8b053d3a421
-
Filesize
5.2MB
MD53ff934da55a084ae2af6a31da61a0b77
SHA1e21c998db3475ec7686a4b6c54790d26b74f4d7e
SHA256dc3cfddcf632390d0adb19290f2bebea55a91ccc52322c6c445c12037fd2da9e
SHA512dc7e263a2eb46e44dd66a5e1e247d79632ed82ca24a41b6702af34738f8644d1ea57c31e5da094825d4f828cda5cb7cbc99841b42eb31cc5f17365227505c15f
-
Filesize
5.2MB
MD558dc7a6e987786562f538f8be7caed25
SHA1c21bfc9e088ed1402e22ed56cb44c3b7167d89ca
SHA256fdc19368019078c25b01ce3f8ecbae6acb140799fbff168b5c790a0d38f117c5
SHA5128e34a981e9f3e0c39307e838b3be23a1d017f7c80f19fadafe679edcde0bb7659b48780e075217d6e1f613b265123c1166255039d60b2f5793251e621056f663
-
Filesize
5.2MB
MD55073a2ad8a19ce5911503f476e80ffe2
SHA101f9d78b6a861c22ed11c14506b5fc5dd2bb685c
SHA25607466167729096733ddae340fc2c90a24fc1379185d18cc306b20d12c4707c9c
SHA51234fe79fe626bc578298689261dc37ff8c208d9761c8fe967fb0cceee2e1737a98b26dc94e3b4ab0871e656bb260d11ae6c44dd06e6c3b0d3d1f8b9d8b1a4a9e7
-
Filesize
5.2MB
MD54041c0176b724fd1b04d27a35f53254e
SHA1e9b54325c09986d3235ea5a328825443276f6373
SHA256e7d6ac4426372f6a194297756fd2669a5e726ca8322932c3224560d7fadfee35
SHA512b6c17dc717b06e7cea4ca2258cfca4fcd6f4ca24ca0b4993d6c5b526663330829a9759e5f262837288fc5fbeaf3d2009eb8137dce7680665595b35984d81b06d
-
Filesize
5.2MB
MD574064ccf60ef70a66ceb99f12fed1330
SHA17c260d9aaf0f3f5121b02969f1759e032d00afb3
SHA25676b8141bcd44e55e0f1426e08556a5bd1cc8d1e4d48f2d41498689d14a5997e4
SHA512b79b24b2537b942f41e4d58b367dcc7afedfa8c5e7d97d0c43172ed2eafa45d593db6b0d90ae43c0dc2e91421a091a8634151c699be29826a2cede083df81fd5
-
Filesize
5.2MB
MD59783cef33f929b0df144448b6f634195
SHA1499ff134e94d4a4516d2ca87cbe697fd477f0c1c
SHA2568b5b8a7dc6136652056f56beab1494c43123f16fcc1424f96ecafd27d1fba377
SHA5128e7f55b7825918c212f2253b3c4ab19c9cc51686ff136d54a68a666f55aeb4a3a5566c4d26695be070187ec3996843525d598b60092f331aeaf2297c86606892
-
Filesize
5.2MB
MD593085d3fa56c3ee74a69e132826a49a0
SHA1c3d991081b947a80f0cabf635821a2c9d8e4a062
SHA256165bf8f3545faeef73a44e40d862c26b2bf38047a79e3776c7f1b2d08e3b3c1c
SHA51216bee6abf9b20b10fb9f6f054c1c3517d90cd0845c7a5adff84b1b13be8b92b3f8bae60e3d5b853318f9689e10106451aa568c6b88d4e87b3152625cdef8fbb8
-
Filesize
5.2MB
MD5f73e2184854a1a653adb133a4c100919
SHA1092a4f5da1372720f02aa202c9f49ca0965bc6cb
SHA256f733f57904aad10d79fb05a3d0b7b6f37c4f6b155db34b5f8565da11d9ce8ea6
SHA512eeaac1e51a3f7139a1340f9133e459da2916f0aa7f810537c39d1f88ed73b53602723e8c94f60ae042223577ec6e308f896206b3202500d65f376903822017f7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB