Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 05:39
General
-
Target
2024-11-27_c7aa3bc583b413aacef9dfaddb577895_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c7aa3bc583b413aacef9dfaddb577895
-
SHA1
850958564cbd06bdbda2a3fb0e9e9583fd828268
-
SHA256
58c6a80cec0ec5d19dc3e168803dfb14c620faae018a5f183f5f3bc1222fba62
-
SHA512
ff0b0df34da90b160378d5b0850c6b75ad04a8fb7382c93d50cc9fc9264f8ea710bf87235b15f66799979e53027c87358be1160782c816a42685e4891d45af94
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_c7aa3bc583b413aacef9dfaddb577895_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_c7aa3bc583b413aacef9dfaddb577895_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PVtRHpr.exeC:\Windows\System\PVtRHpr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SXHQZgG.exeC:\Windows\System\SXHQZgG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FkMKOsr.exeC:\Windows\System\FkMKOsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\okfcqDd.exeC:\Windows\System\okfcqDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eabuBSl.exeC:\Windows\System\eabuBSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcDRQMF.exeC:\Windows\System\YcDRQMF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEQVaZZ.exeC:\Windows\System\pEQVaZZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UuZLxQo.exeC:\Windows\System\UuZLxQo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ayvGbja.exeC:\Windows\System\ayvGbja.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MUETlin.exeC:\Windows\System\MUETlin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eilFWfL.exeC:\Windows\System\eilFWfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnpNrWq.exeC:\Windows\System\VnpNrWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpdHvVL.exeC:\Windows\System\GpdHvVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWsRUhx.exeC:\Windows\System\OWsRUhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnQAPFR.exeC:\Windows\System\UnQAPFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cACuVUk.exeC:\Windows\System\cACuVUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGtRHoy.exeC:\Windows\System\OGtRHoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArsonuR.exeC:\Windows\System\ArsonuR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NELUyyO.exeC:\Windows\System\NELUyyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFPPXPO.exeC:\Windows\System\jFPPXPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjkXnzB.exeC:\Windows\System\gjkXnzB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5715a4d15e2ece05862b501e1ba067584
SHA16a995129ef5d1c25539cea1b5e83368f953691c5
SHA2561239da0bfb3bce6918de046b8331dbee264e7909de8d68d0dea570c398d2ccd2
SHA512d3594190e97ec4268dae87ef793f8d9418579d2bfeadd2ec7e0a83bc16b66fed7565e4028fa00ad8f7b3c1bfe795d7e2b9fb8ac659098221aaf8a171b9765824
-
Filesize
5.2MB
MD5a6ee8ab27301345884cb6fc6fe234266
SHA17bda4c29bc0e6d873e244f19ecccf47206677e9b
SHA2568bc1cc60533868b602b54cc74bb232000277294763fdf0b6a7665ecdb3f2fe3b
SHA5125a4a8123394a79b0aeba58f34ebdd895ef363cac96eab591e34a2209f851f5a79535a963fd091ade5237f9da8d6b791ffaffaf4fded2525deb813da4c280b373
-
Filesize
5.2MB
MD52cced7d42dee5b9831c5d5c9aa5a0865
SHA18c1c4d55275c7fe2b9adb42eb40072b0a904df93
SHA256d218ea52d317c76fdcf4d59c653eac1a77b498c6877fda8f8d1377e2c18f725a
SHA512bef954ccbc85f9ab2f4c63ac56547732b01b1eb05635ee8f5c532754b6c47c34675a16f8fe78a8056b6c6a6f34b3b2e754db78aa3a2fc93d17e1020628ce0e0f
-
Filesize
5.2MB
MD5f4e62a18f8bf6b9851476b852a833713
SHA106fd620889294de2fe0e88023eed6bd035e55902
SHA2563fba28618164be5d8818157c62f0d6eab9e5e77a911c78b352b297e2c7a1b6ae
SHA5124312445c7f3d357a4e108f02ce864c4890bd60b40330e0307a93949c80c894fe493c060be9b50aad5fcea845161c5d7716940f999e448d296d8a2d10a07359c3
-
Filesize
5.2MB
MD5eaaaa6f3c70ad18f2e2a407085739318
SHA1b2c4d177bf38ed3e9ed98db75b06a0cfcecebf6a
SHA256f095e57097d25bb45989b91e87fc800268c059991607fb7ed2378dd23bc79229
SHA512d9a1f254ad7f4e3a266f258d8d0a1d426ee5488a8760e913fe662f7708f31d2b450f5dc9674e4f3e1b226766f751d7bfedbd5cabad001fbcfb1a079464410e69
-
Filesize
5.2MB
MD5ad33da85c4d7d4810b314982396efd6b
SHA1ce4e4fd29c1fd6d739300ee49375223d1712459e
SHA25665a5ce0ff9339f291b590e518fbf9c56888a5dcfb68d2329323728b426381707
SHA512447536f28cc6521a8e80f726fd641e504e3f58902e7bc3463a77caf05879d3ceda38cb5b0ed73fad4a8e4ff6954f4c0c9b2b60a0f099ad89f9da24c883f13839
-
Filesize
5.2MB
MD5d887dc479fb7dabfe823b3c91a22b773
SHA1603145c4376f1a20ab9392c6c38d8e0ffc33af2b
SHA2560477822e3e1fa708b316a5e80b12e225b9027a0df640559b195728b519ddbe61
SHA512d2b9b0337454165250bb9ba32574975c3e5e6754e0523ea2a7adec985d7864981864a3d38f686d650fa9eded65fc87310d63f5815779b5457c64256a14e1ab4b
-
Filesize
5.2MB
MD5c907affed8ca98bbf8164e266283340a
SHA15048a62f1deb6acd73e75fd8a035a60dc6f7a252
SHA256642365947873cd7d74238dff8ebb74196669a3b9987369e665711d4ccf901e5f
SHA512e41b7b0383d0a0171fb79454ecf9a46904d76d70f696dc78258e5eac1f3e762f0aed9ffcc5243f513c1810bb101371f5bd8dd741fdbd9ccb127ac5bc1407d45a
-
Filesize
5.2MB
MD5e0869b11df66ea426b3331f17c81f244
SHA19bd8ad166ee08befb2e96e6178bc557f9c512a16
SHA256dc7e4aa79abfc525511a9d5d41707d73ce8a97136e49183f17232df40b5a41a8
SHA512b98dc29c5bab049f0364d45cfb282388f69b68ad035c5b5b2287e97873d09c09144647a1db36263b92dc19c45cd0e4f046d9b7f46cc5044906ec878a36d7bba8
-
Filesize
5.2MB
MD50ebd5957d9d29461fdaf2f78793648b8
SHA13b13f4587ec216bb67b8c0b568c6d1d33e74e178
SHA256305b66afdcf96e220dd2094d4c164e6e1ed56f53801c7e17027307fe56df7528
SHA512f7384b440f5dbce6c20b1bddd6155af3e251ac408b13be40e09db27cfe5f585eeea2b05482824f355c2b764e618abbd2b2aaf44d6470502cd2b740c062227082
-
Filesize
5.2MB
MD5180a54a6f3c36f0d2dcc6db3465da7b6
SHA1a099b7e92bf66c2e63cf3a447281acee04e7d4aa
SHA25635608b8ca871387f3764fce8ef806fda194d9bd0c7bfe71e75b37310f85234e3
SHA512243430684b8f6706a77323271f906147b29dc5a34390b53f5b7a3401e7e72d07e808fcfb1f3146fc9fea0e6c1d7bc0d2c941b591fc7fef0875dffdf315245f41
-
Filesize
5.2MB
MD564c798d5979dd0b4bc75385d4831350c
SHA1386f4293f2dbf3b01c6fb704778516e1f13fe1f1
SHA256a16321963b92b7bc09edbc05a5c148c6e1fd8eaed6cd677b77d8278aa0a8a9f1
SHA5120323e57f662b337ea7fa96b87c5d8274572e21a993fb53602b725e63b103f3a7681e8147e85e51983f877b8d05aa5ca5c77920d48468d825005a0011e5cec72a
-
Filesize
5.2MB
MD55750eb225457311cd4706255b018f589
SHA11a8c1b413b714e1563df02a40a6b521dfc912135
SHA2568c285a05465430a35ac6899dca4dec77a1d17d3f0a48004ad13f2842fb1c4ad2
SHA512111afb9392c8737d52649a5485c769666e43419089165f6406fb87833265d08468c3831749e3b14cfcce841c9d5d34affe208c5699dae23621b1ca9ed2eda92e
-
Filesize
5.2MB
MD5bcbbcf034612fed9080de003f388606e
SHA18240be1348c1bf839f6394caedb3a2c4febaed0d
SHA256e11e761eecd42829e1e3955e8777f6bdd89025f14d10f4f8829bc925103df731
SHA512378f7739122c4253d7c86aff5a9ac8c9511b204f94de30a01f8ee81bc5644910ca83ff730a43e38594971af23f97d16ee9d8c9a1b7ad274187de17645eaccad7
-
Filesize
5.2MB
MD5844949989984fd1ac6395ea49087b3f4
SHA1deb052d2c8b3b542394ef8d4f54c16f0b0fe5e63
SHA2569ac7ba2fcdb34fe1ea9b965084df65e6945903b9d1a0d24022e3a834f4ea9dd9
SHA5122ce2c77a95b7b7f0a48fd6992e28eea067864c8852f1a161c5b55f6fd619851fe34679ee887f791bb06040de8a98dcd18b10a411207e7e2d3e7b2d6cbaa8b662
-
Filesize
5.2MB
MD52808f22ddefe6c1026bcf3a5f4de9a1e
SHA1276b2db0c5c1c58036e73cd72594b277cc5b817e
SHA2561afaace3f6a047a0bb7f4497a30bd748102b4213e098ac5de2558c9b21b1cf2f
SHA5129496ee4d7ee854842207670c950b80799afde4c9f07916b4cd7706ff5a15b404e86df318ca69b5b8e5870dc203abfa09c8452799cb830ba4e1048a3b9462a467
-
Filesize
5.2MB
MD5129a117be22e2b77fb6cbf95e50144fb
SHA18456caee445cff029625e6a4154e4816a9946101
SHA256e41c7357bb6dfd6f243df035e1d3f3ae67daf7efdcfc5b86f18dd141d8d5d0b6
SHA5120d0560813a8023b3236d7ebc26ce5e48f988d16366547e3262e352d4c33b051854abb59db3dbf700a53e17e8fdf7190b85fa5a923da9e7df35cd314ac654fc79
-
Filesize
5.2MB
MD5c809a7f69969ad2b4d8bb61c3f0fe613
SHA135f3e8c80cd410ce48aeea62796e29ae6b47cfe1
SHA256e1ab53480ab82556b05355532f02d880a17fb6f9f785cabd790947184ff652f7
SHA512d8ce2403805fa502232f4d61908232336ba497625c03f01c037eba80d1eef3e453837cd92a50713006bbde7bb75804b7cbac19f470a01e6369cf211af9dce745
-
Filesize
5.2MB
MD54be429a1566d3415d87e19972bba14f8
SHA19ee0a852eda4bbb425be0c56df0bd73d14e9031e
SHA256e4815df7b26fbd4144046830d7c12f89a06b326950cf9e682e90a8d206a23862
SHA5124ab8ce8e8688b5b03cba483caaefa7895df0006c2833e5f576a3278e09c6c05f98d1bf8444920285d49d5c6d0d1939f039dade0ccd90edca642701719f03794e
-
Filesize
5.2MB
MD53c7759ec6d0b35cfefb9c4d2fc9e94eb
SHA11087c2472c5355045e544f9bb2204251e38472db
SHA2560a5eece9a0e9dda7b8a18f9bc103444f0cf602cfd3a22d413aa83f2eea371e1e
SHA512275d504b14dd3727817553efaa41c4fd5c5cc754d2738d833a1d1da9570d9b14d4b84aea1fb3555b2902b0ee3f28105797d7d405de08af4a90c63f2f41e0c287
-
Filesize
5.2MB
MD544e1034beea658700ea629cf0713312f
SHA121da48d4cf77577627dc39c18aa712eae4c89962
SHA256bb148cbc777e8b174f80a19faac7baed2c30034c7fd47b70af0841f8c900cb58
SHA51246b586aadb6ebf9bcae0591f175ad1d134010d33dc077c01ddc1b61afb014d98dfcaf179f311e4e8b90c64a1b24474227758dd7dc951f1d9ef2cc35d11ee7b2b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB