Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 04:40
General
-
Target
2024-11-27_684e47edf22b7895a9a2ca8659902293_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
684e47edf22b7895a9a2ca8659902293
-
SHA1
ea99b73a4f2995ce7807fd2b1b44ff9898451db3
-
SHA256
329c2c3f27a66cc387aa3ca99e25606d89c2cc992403bce691e82628592bab66
-
SHA512
be5e1adf905c30bfef6a29e1cd3fa072756784fd476339db85d81a9f764f9b8ce33e2d058044f2331540a374034380ccc590441d66aa2768f420f2d43ad0a8a4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_684e47edf22b7895a9a2ca8659902293_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_684e47edf22b7895a9a2ca8659902293_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\egWnIkp.exeC:\Windows\System\egWnIkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BLIdYZE.exeC:\Windows\System\BLIdYZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IBPfYsC.exeC:\Windows\System\IBPfYsC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXDhxek.exeC:\Windows\System\WXDhxek.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmXHRVt.exeC:\Windows\System\gmXHRVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkQOgcW.exeC:\Windows\System\dkQOgcW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDfGkSP.exeC:\Windows\System\XDfGkSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HULzRQc.exeC:\Windows\System\HULzRQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SmAiiQU.exeC:\Windows\System\SmAiiQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrgUydW.exeC:\Windows\System\XrgUydW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gItJbGv.exeC:\Windows\System\gItJbGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RrPUaOc.exeC:\Windows\System\RrPUaOc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vkaVCOF.exeC:\Windows\System\vkaVCOF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkowhsL.exeC:\Windows\System\HkowhsL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wuapKYK.exeC:\Windows\System\wuapKYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQJgdTU.exeC:\Windows\System\XQJgdTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWlvNoF.exeC:\Windows\System\FWlvNoF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTkGibX.exeC:\Windows\System\YTkGibX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xoouRdY.exeC:\Windows\System\xoouRdY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GDvGIOx.exeC:\Windows\System\GDvGIOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYOvTgp.exeC:\Windows\System\LYOvTgp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51d1b683ebd290202791eb68d2fc96306
SHA112c3f7ed411b7721f28d70daa2fb6532aac99dda
SHA256306b80c7c2a0c4bd1090db6deee7ebb93007ee1290f69f3319fbdb2b54bee72d
SHA512d8be3ba4af166af4615b11ba4d9eab87c2cb531f55476e7fce0541485e8efe9febc2f15cae2a1a405cdf7d2084ccae5d963bc95c6b8f55fc2e3ec37cd3f778a3
-
Filesize
5.2MB
MD5ed72e028ef83f2794d02c798310b37e1
SHA1986f8e95708502e21371dad444ff8d6127edb08d
SHA2563d7bf37b0f5269b88ec2f98be861af7118c6c736830fce511660a0a5c7390fc8
SHA5122cdcfa9f9eb0fbbeef4fb2af0d2517eef5ad40dc162dfeb8f11c72b1e83987c1555dbd2c13b0968df7d975f88a3808b2ff813fb2e5faf3ec66c70399c85e8feb
-
Filesize
5.2MB
MD52b88023ad248e63af31e988fce9dc293
SHA1bc8ba6c22fed71e576753f2d2d74e72c3d85375f
SHA25696b0847454bd23d762cb90cdcaeb70a4cdbc92cbbf3a1a9f4e948c95a93cfd39
SHA5122279f59e76f713afa5e976490380b8e9fcecb449a970faf690aa30577bd4912e3815a19c594d37a60e9379c3d0c1ad33a5f72b75a714882fbb62e341652925b6
-
Filesize
5.2MB
MD5a1721c0eb915ad13e159dce85f161d7c
SHA1df13c644520b95fa5016141ab7dcda3f7576fb8f
SHA256a2228ff3bab1f06e0e3472e4f5ad2c4ab7213d6c47ee5e16b12380291d21e89b
SHA5125565e04184ce11b5233f4c41287fd96bff697d62a38842b6c44143f5e0241a49bab30a6e0fb64b023d8b1aecbbea9f0f77ddaf42f8d5f6c78ec4003755446f3c
-
Filesize
5.2MB
MD51b4a173c9ab5b73fd0cec904d50b6cc5
SHA1757db306a800ead88c96359147d5407d02f331b9
SHA25612cd401c9383de18c5e21ce831c19cd1e64875fe1b2e8a6a4e1bdedc2d1455c4
SHA512b05f8f6f707246b83c2477e385d1d2ef1ea302a4e5ab45fa4954ce31472e780c4efcd01b2c5bf3361439416d454ace0cf2f39b6fc20bc944fca2c8ebd856a807
-
Filesize
5.2MB
MD569840778c58c283416aa67f7c25f40ea
SHA13db5d61f212172b44e39ca2f8bf60e3e122c5f80
SHA2569b7bac3eb59dc78bd11e32062fb251f0d6a64a340de9d511b6f26ddfe20a94cf
SHA5129a61035ec4df8284819446c3e7b9328993ef78bde681c4a16221fa64a3251f007fd6f34f3454c71891798db2cfc605c452c92db8f46aa3d11d4c2d7dd89e5c7c
-
Filesize
5.2MB
MD54323c4788f06e21734e3904f5bc8f50b
SHA10b5087a760b5ff14f4c49f115b5b51bf37d7bd9e
SHA2564d375da335da6a56ac75c04d3238f168186f848685cfb3ce2c77bbd06610f2dd
SHA512f53957f1863441465acf5434f755af06622974dad6454a40691cdd1a9b5d5e6deda9efa9e4469b666cd9452820f56b32fd27c3fe004b7f1ead176e70549c11d9
-
Filesize
5.2MB
MD58630edbca755ae0ec8e917d8854e85e9
SHA152a3c7164fa17cb64c3ce5d846de29322317f2e7
SHA256c689acd3c4c3032df3900ce7c08dba18dfe4409ce83d996367d6c8c0eee11f42
SHA5129cf2f334bbd3ca9f24ba25bf50f64460768c360bbbd6b99a5120af0101730bfdca93ea927cf2d1baeb5044d5260ed4a5c3ac8b2e5a4ced767e315c592595a1bf
-
Filesize
5.2MB
MD540e35db41124f8fffa7ceab4c8e9b75f
SHA1e50f6d90f0582a09f7b8a9e9f994e1c913689124
SHA2563492e06a1aec4cbf383702ebe316a694710fe32b3f9cf9065bf81bac9d24a40c
SHA512708ce04f6cb90e88d73e265dc53f917c3a2cfaa84db7fa937a0891950d2136251715be5470311fd0c2c0eb0ddeab8ab4b3b572197e0d32820f372bfb127b5427
-
Filesize
5.2MB
MD591595cde3416599c3cce77ec4ef7118a
SHA12b3a79b143a7b7b01270c3a0df2d68dd3a262a40
SHA25654e447ac7742d8bb5af766f6c3169a06640b65f7a761789f9bd1e6a57a9db353
SHA5127288b02ae94782d97287f7e85b272bf85d905c62029b3808733c1577d01aa5fd4527eb3db1d0039b6e2a7eb0a787ba9fd30e45c1fb93feef30b53e3c83179110
-
Filesize
5.2MB
MD54ea94a1abca6c5b6f197db1e0f3b8588
SHA197ca430f8d5a0f1e7deda7a530c43f796447601d
SHA2566f6a2723e8b0c3cd1ef660b6290a97ee6e0778e613dceeeed6285e2dd5386976
SHA5128993a69f049c5a29e8a582627405b1453099103370cb83cab575f40d6893bd5e1dc18509e49c19f4f4069d4770a6d862632705ed0fcf368495fc521135d474f8
-
Filesize
5.2MB
MD5e710bae18d90d965032bdbc143285aa9
SHA142395bb81856ce0bd3006df0ae071781145c621c
SHA256711efdc4f15231419c54a2a5035ef8160b79227b63f369ca1be28c9a7139911f
SHA5129c2d5cc936a891bcc432e631ab74807115cdb059ec23ee3962d04712a9d93a51569b22408b44da8089097380bbc38cb6948a284abcd122b79ee6f3f41ac17fe7
-
Filesize
5.2MB
MD5bd7c6a369b29b009929e0288b8bd6f0c
SHA1ec31485bfebe0fcc5dc90a33df1c84e8d1c56fdd
SHA2562217289abe2221bce3525c0740ee77e042d923aa173a480fe3f13a25436dc90a
SHA512bfcd1f8bffe8bcea4273ee3f3f02f03a4909c79ae583fb8a6b493fb070310cd4bb729e0a71ca54cbdd4e127e7fbd10823ba5e4e0a04d82b53258d369876268bd
-
Filesize
5.2MB
MD5a38ba89329b43f215a8fea3407b9ed82
SHA11ff62e6137557ac1f3368cd7c056e040d35cdeaa
SHA256e7584218c8ef28101dc935ccc74bba785ee7b3f5a33b30ba92711e48ed5360d2
SHA51282bbf4b532970872a22f11984cc54a2a5abcbe10d7fbdf3375ea9a1a45857956e267e6c2660ff679ac468e2d3f4cdbbb25930d710e0ec1669019fadda999346b
-
Filesize
5.2MB
MD540e0e8f9a01f89808f25e969c3b346de
SHA188cd6606555f0acdeb78a4e22390e5f312f476b0
SHA256df7196cc71f74a34787a174578d9f5cdd2506324e8a4f269f44622ca5163db94
SHA512ce362410f2abb9dfad7d41e00e90c48e1d8e344d2d69a8d1bd833e596e9907bfc3ae37af9f1b0eb2256707cbfaec8feae92631a4c3376694970d381299e77dfe
-
Filesize
5.2MB
MD5dc7ae7fc79195f72745f9a81e561b03e
SHA1bde3c271534f8aeb3d422bd1b527b97de59d1a35
SHA256ed8d6ba3a73c9174f2e7055f6689dee5c7bb0103b4d379782e12df743f4b24a0
SHA512564a24d079a135b10ae442919fcbf3ba8d0daa60589a90f2d3918872736b86d657313dfddcfda2a9a4a72562baab7c214610053c413df2d6bfc1abb9836ec6cc
-
Filesize
5.2MB
MD5fa60ed2e42395fc1a54b49e61b8cd806
SHA11bcc10264a1be6e35e6896800c7cd3104528f63b
SHA2565789b898451f1abb50aaabba38c7c0c0a3f2914cd056817276d0e9623fa16289
SHA512af742b4c233900940355d8b05d683967cbf32fd9eee988fbd0d325c0ee1581365c42d44b542e2dd7dbfaf0e9d816be34a52c9d2cbf7674f89fab7feb99d016f1
-
Filesize
5.2MB
MD554cb0271334f83a63829cc1a126d00da
SHA1521430d80226784d018cce4293dda2e6e6fefa37
SHA2568feedadd9f0a5a61d28a940b1699d1417f5e5fab51c755d7fae4d52be8e08fc2
SHA51269cca155fb9cd8c30dd1c990ada2b1f99ab5705e9109748be04169c88ffab2620a523d36db803f70e01c2b20d0592b6f0da559207e0778c2d98e88ac3fdda39b
-
Filesize
5.2MB
MD5df032161262662836d20717f7d27a25e
SHA16aa3d2a9a5c73fc4fc0ba31bf808f1e7e8699245
SHA25600118b6164bcc69cdd5842ede6c5fc1a383d892109e4b1e0ab37c61096d0029f
SHA5120197d7bd935b00beccfa369e8450939a09c8bc5b00dab5f2107ea368f8561cf60cf80e8881476fb2256382e87f7d8a8dd00b25931be340f13fb7d0c6cc16297f
-
Filesize
5.2MB
MD50e18cfa920d10f91c1b92b5e04c3b9b1
SHA1dd2a59e645bb027dd24f439f47f1e5f930918359
SHA256d5b63a496d3d9d1154def43a9e27acaa1f5a5e8f4bd2b9c2898ab53b9853ef0b
SHA512ef48860d40513c430eb72203be9919a71d41782a125d365e9972e7f9e7474e68090515fe582bf2863de654045843db5a9a48f69bc9a6edf926ab53ba4fa0e70d
-
Filesize
5.2MB
MD5d29a3a73781a457cf5b0025c0bd46a8c
SHA191caffba8b139af6a9e16f831f94ba4f06464768
SHA256d0bde5f1051d3309b722f44483dcf7d933d5fab1d95d3f5db2eb1e7b41f0ab5d
SHA5129452a41850cff26f34abde13dbeba4fe0ef4cf5fe14322d3daa1fdac8df58d18f1adceebc28bf2539c8eabaf65a518f7df45bff5334c213e8267a138036de411
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB