Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 04:53
General
-
Target
2024-11-27_77f0344636aaaaad40149411226fa028_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
77f0344636aaaaad40149411226fa028
-
SHA1
4ae78563edafb34ea825d1f09de94793c0dbea61
-
SHA256
18229fa1294fb1c583c70ec0eeb4aeb1bea5e8793a8734e6c87aed99bb4a1e41
-
SHA512
ddf2fc7fa2af323d33c6dbb092df91f506d6a3a1a45514f97bb6b25693eeaa09523bb2b2b8995d4133484b03403715edd875b878483cc89dc722f355ef3645ec
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUj
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_77f0344636aaaaad40149411226fa028_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_77f0344636aaaaad40149411226fa028_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GIlBsqk.exeC:\Windows\System\GIlBsqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ALlLeOG.exeC:\Windows\System\ALlLeOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxzQoGY.exeC:\Windows\System\uxzQoGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONbbJVH.exeC:\Windows\System\ONbbJVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbGkdJh.exeC:\Windows\System\WbGkdJh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShdIrEJ.exeC:\Windows\System\ShdIrEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ToBPmMJ.exeC:\Windows\System\ToBPmMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSXyVpG.exeC:\Windows\System\CSXyVpG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDUGZGO.exeC:\Windows\System\bDUGZGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AElcKAv.exeC:\Windows\System\AElcKAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APAQePh.exeC:\Windows\System\APAQePh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QhTpvEs.exeC:\Windows\System\QhTpvEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uvKbIJD.exeC:\Windows\System\uvKbIJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcDYsEV.exeC:\Windows\System\OcDYsEV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDwpUHu.exeC:\Windows\System\NDwpUHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HRcwHMt.exeC:\Windows\System\HRcwHMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JiHcfuQ.exeC:\Windows\System\JiHcfuQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlypaJU.exeC:\Windows\System\ZlypaJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjsGmdW.exeC:\Windows\System\HjsGmdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JxQpkpD.exeC:\Windows\System\JxQpkpD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxzWHTs.exeC:\Windows\System\XxzWHTs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD569808c40ebb46c5481da6af77503ca0e
SHA1f6ffe4c488c571543c0c954583f26bc35c4079e3
SHA256fed0b9fd032ba9f2bd8ae9767fa6698c92b24668b5db1ad30428cfbbd7758a72
SHA5126f84037029863d6febf8f7080042afb0967b48724c07c0cdf791ecd9dcee3b3b8529f825c45fe4b8a83e638f1e0cfca486a5e352a9e9135d750c492b4d8a9b69
-
Filesize
5.2MB
MD510cd0baaf680f9a41a0e62a7f077697d
SHA1c1f5afdb5403b9682e1c0304470077609a74683f
SHA2561cfbf4f6fa81e732c100d1bb50d09a9d984ea1b779053eba8354f43aa876b72d
SHA51294834a43a70e78da2bbd1fe2d0b36877b73a09b9fd483ed96951c98121098ed7c15380550880813286cb0a8f58793a4085732cccf88eb33f8c68d39d8d423953
-
Filesize
5.2MB
MD58bc28d2dcac17cec6ede2cf71e51afbb
SHA1e46f0ec7317d0ed19a03c754d1e0bc9208d0c05e
SHA256a91a197d7d6b3d5b26e14718b630b6197cee931d47cbfd74b184efa5530df5b4
SHA5122c9c2160ee790a9ca6dcae48aec12a368a37703350a7064cbcdd4c96df15fcd3ab8dc6fa65458a3c0111bb2afa5e4d1f5fad2f26a1509da246f6d4be392ebea7
-
Filesize
5.2MB
MD5ecc52d814808a5f26cabdfb970113d0c
SHA1d6692a0d6c56b254136280f8b6a2f72ea28de896
SHA25679e40bd81cddeb612479e91a8d076784af5a0defb3dd89b5853ab01fe1ebb93c
SHA512a0210862982f888c27199a702446d2316f637463eb79b2fba6b997126a5e2762856f76034ddf3daa9938bbf9914ff464b0b88ab02397a754047274e36c358be7
-
Filesize
5.2MB
MD5c617a210209b347a7ddbdc5808b51e40
SHA14df323e181d73594fc2ddbb2795073388da90a83
SHA256b24bfb9877e3836294d2f43cb5ac463ec4cf12ed5458bab7ff7c0d5cb0a8358a
SHA51296b0c0ed9ca3f8107da43e5135750c39e60e2340121b315cad1cdc26fd6bbd7df845f1ecdcb36ed13fee8d2396a042d02443bee4ca9e60e0812b89513cf70854
-
Filesize
5.2MB
MD593ff8443fc6234c339b6aef4a9d7fff1
SHA1f45f998e2138894f39a525a6dbb1a381e54e40b7
SHA256d550c4622b33578048e63aebf3c011fed8e8f77decd27d8dd9a1cecdccbc98cc
SHA51288ed347fbb5cc52569d288ba6a578062f5e81978f0dc9c4b15cd13f72d1192dcc5d1bc401bf01ea6dbbbd1937c03354576bf66c50830f7951b9d1d107473cce2
-
Filesize
5.2MB
MD51de1bc50d19f87d841f185751ff614af
SHA1374657e1cc132a201d8dc4ef8e1c2ca448f1715d
SHA25652ffd68f1e80cc4f72be437117f978f548c06f80fe98baa02f946ffd55e67cdf
SHA5129aa78596ecaef2d2c551d00f096f133d8cd6b1613d594251a89ee6d6994079c1922d1245b1ebde1749c253983c2acb056548646615b5d934694af386985b2b41
-
Filesize
5.2MB
MD586594eced3b6bc3b0e3c4da85012855c
SHA1b5354a5818c8c3f153c842c0c19a54791c2a3741
SHA25683c5ac2461ca27a184d6352d7ba3e14116e208d9d3f009d79fbeaa9b203953a5
SHA51290fa9c8323b9edd607d380657f234dcbf71601352c387273083b80a5fcbbdbdfcaf99080c1ffbea5b4876685ba9f336888a9d5fdc594e929befecf2d2db970d9
-
Filesize
5.2MB
MD59a59d56c2487e8abc5fc64e150bfa284
SHA1b82293fdba083751769b14ca612161ad6a337f06
SHA25641d8a220fcdfdb09cfa6f8100554aeb543bab990e9dc45a88313577ca85e87c7
SHA512153fdfd44e4c73a7d3096bf84db69aa69114127de64f1d7783f3b5f7bac63c26a7a27b69b276af3e30bd940f8c92b442ca9327c7bba4accc7cea0a49d442e4e5
-
Filesize
5.2MB
MD5e5d9a2d38d6f08b77ee33dfe74d1953d
SHA1ab1221ba5b042ae15b9d8845bbc996202ddbe367
SHA256c3cea6f1aa63fd2bcf313dbb513d76ba36a5f23187182d1b23dc9a2a3bc2e808
SHA5123bb77573d528ef9fd6f51eb0a88c515b04fa78583bbb914d49e7c2f8a0041bc48bda670ea49a05632aeb2c3f0144596aa8759b1976a0a978ce98670326834daf
-
Filesize
5.2MB
MD5e3bbeb9e286bad19e33b8e7292decc44
SHA13949f27ec5f6545b1247fb3b107bd332507194ec
SHA256fd185b9768c40fe1b03b07f81e001ff6821462f46456963a4708a7370a47ed7f
SHA51201255f46825f50410d98ffb921861114db32ae436b0305cbac5c052da5eb326e3c371ff9aebba40b42415f43d6b19a57948076562f68abaef0cbdf516b408ea7
-
Filesize
5.2MB
MD5ec8e476bb14856f58f7d9f2c55d2772c
SHA11d98db0366faad3ab54c437e1f2931e14086bc24
SHA256f1c5c293f8b0e7e3203bb7a332b49a4e477295b15e71bdf502e6af3299dd9217
SHA512f9ee0e6d3657170e1e961aafad8889396746a3f07b6c2599ff9b6fe31705cae8e7d8599abf984ce9642386f58d3448b7df03ceeaed87e8d85db46d52a00e8d3d
-
Filesize
5.2MB
MD50131c7d82c23cfdb0416eb90fa35fe7d
SHA1dd37af479af45099dc6fbfb54c09e5401ee41150
SHA25678af79d08b18a0b818f9622b11110f41dd813a145be27f9db9adf8226d2d19d9
SHA51230386650e96f9e4d1e7ab37884895c0ab7f0a59e51c1607ddad587a8dedf7773f808b7b27f6ef7ff0e1f2d823422eb3db8e1e925fd3d2bc918ada2c5593e1018
-
Filesize
5.2MB
MD5943a029b38cb855f4e4a0340f6a10c6f
SHA17ed38c2c64d5b7a5a3193c5380a0d4511f82810f
SHA256daec5fd7cd9e2c09dc967ed1950c5cc6e2675e958e04923e0a6bc3e263c80d4c
SHA512de7a60b48929229f915affca3cbd37342ba16b94948a6150f43897075ed6198b7e56364e05c89ed807abf1c53ba068b5eb12ab7ca9701f26d28f67ca9323ce25
-
Filesize
5.2MB
MD5a83773ae7dace6d8981086a3e97bbd25
SHA181b1f9ab531b5e27bbbdc5d8ca45a268f80fa1a0
SHA256a294300c6e964153820556853091e0ec2dd5145d542a6baf3e932554e69b8470
SHA5126ebd40ceca2919756c92bf1fc089d2d473173a95310453ac99dd7e1e142e95e9deb454e7a6ee8c922c3c48aab0cbb6d864b4499e93b4ae3f91085efdfad15d67
-
Filesize
5.2MB
MD5b4e748d7e5863a4ee2a981ee01e52c00
SHA121ea76eeadc273106f31d071ef236b5531b1f061
SHA256c9753a39b0ad6e71d1cc17cde5014446e95a24fb6976a958e0381ad533122703
SHA512c7c0fe191a05efe793ba5d68161518c09be526cf5db5d08f7e2f69fa4b03a361a88dbb7af2a47141cd323e163209902319133cd0f082baa157c139aab25e460e
-
Filesize
5.2MB
MD58930fc049b2faa597274185994eacd13
SHA1ec1870a3717e534734f1314bf1895de0e6e1d62d
SHA256f666c6183a1db3608f4223d76fe5ace86c6a0d4158406db3faaec718e1546e27
SHA512e11230a05a8d5890298983414584180b748d116da65de4755235353019f3e6191564f30634333168859a7fb9a668417db9ec98567b2385c2b29bb291d261e724
-
Filesize
5.2MB
MD53ebf61c921532b1c8a6db63029c54be6
SHA168ddf2222b5c2f509cfa85aab6fa8f5be9fb92f3
SHA256dfcd84a6d6185d282d2dcc9c890530a172122962417d1c1f986da699843f2faa
SHA51278ec61b50e2d63d960c7fd14225a6693d98dbbdaa08d79eb0f5bcbfc1644b22ec09ea6a57d15c87c4bb4ce58fc37c52ba4c051073a464682b9edd7c0c77ef35a
-
Filesize
5.2MB
MD5580dcebff6cd63ad1d4d5012151b8103
SHA176e5c9bf8fc22f652fb37f62e65f255e023f1a9d
SHA2564f267afdb23a2c31d13ec2dc7e5d49c8b2ca60faf542c5ca4b1aedef15d75750
SHA512e4ec681d4249c4daed05725e9311850cd1c89d58b8b2832b0bcf382e929fdebef0abed33389b9e50b9041ffc7705f5232dc5f7817e5947d4ceec236eb828012a
-
Filesize
5.2MB
MD5c3f261b8949be2c9618dd9cdc904ef93
SHA14f534c222f2b8960b8854571fa92ff2bd445aeb4
SHA256f7f2ea844cfd3eb2c53787d3d35a021d45e2629da8b621019dd3d7082d97d4f9
SHA5120fb19b205d2329c9d1bc1271c57031e2cbc8f73188051b687454ad902991e82007e686fb7a152a484962e506f433d4e1a98458a45bb3472cd9f4554208a497ab
-
Filesize
5.2MB
MD53266ddc87c7d9499dfeb2a5006435f2a
SHA17f527eebc5eac01d2db54b8943ff843b7a1d8458
SHA256ded5e2cb4ad12c515b81f3f79f5fd96237ed51f3456b0ab40d6d3598251bf035
SHA5121ecad6279cb20cbd49e870ac6b0e2f279a05951ae2196605ba635d7c747e9b43e2660829672f70c3137c20e03e25d07d653a407e7fdf9415f799f1893731b162
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB