Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 05:45
General
-
Target
2024-11-27_ca69430f95b025473b8ac1a2a775a33f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ca69430f95b025473b8ac1a2a775a33f
-
SHA1
65194119da266097fa47377cb307f5cabb2d2137
-
SHA256
91f41182946b4722174a07d0ae28a6ae687b3186635bb7cd3597e691b0ad7e0d
-
SHA512
d22e5b7e4a2b7dba83fb22aa8189eb9e72542bdf0f73f410b094454fb84f76467019bfb3cf23e6b16da719cb93a81671af8a83339a290a7160f5e27f1604937f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_ca69430f95b025473b8ac1a2a775a33f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_ca69430f95b025473b8ac1a2a775a33f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rBhcwgA.exeC:\Windows\System\rBhcwgA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPzLmHF.exeC:\Windows\System\IPzLmHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lZZOteu.exeC:\Windows\System\lZZOteu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rllCmKd.exeC:\Windows\System\rllCmKd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYxpTYj.exeC:\Windows\System\yYxpTYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XFtsVlI.exeC:\Windows\System\XFtsVlI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SycJmbc.exeC:\Windows\System\SycJmbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjacNjT.exeC:\Windows\System\YjacNjT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Tvqcujr.exeC:\Windows\System\Tvqcujr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjNytEh.exeC:\Windows\System\FjNytEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qkkkdBd.exeC:\Windows\System\qkkkdBd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCaYCzq.exeC:\Windows\System\FCaYCzq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jkAuIzZ.exeC:\Windows\System\jkAuIzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hROAVcj.exeC:\Windows\System\hROAVcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLrnHJc.exeC:\Windows\System\iLrnHJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUAbqsV.exeC:\Windows\System\cUAbqsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PkSWnYQ.exeC:\Windows\System\PkSWnYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGlWNMn.exeC:\Windows\System\tGlWNMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMNMadz.exeC:\Windows\System\MMNMadz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVifTIC.exeC:\Windows\System\wVifTIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKbRjPQ.exeC:\Windows\System\nKbRjPQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5825a1b3954144125a595670b698dece8
SHA124ff3030f63c2c67fea8f5ba0bfa35e89fa3232c
SHA256d6cbc84ea1f2825f032310596f96880529f6e64d5b85dacd652e49b4e93cb36d
SHA512def42f0c134a57bd44ea71a07fe2c77c71e02a3ba6526436961b623e3eb96bd4dd9cde5d3feb844f6d5b6afb9d4e81c6d067d10619bf5bb221a82a5497241646
-
Filesize
5.2MB
MD5d1765cd5ec51a350c562f503c83d2eba
SHA1e599f2783a005606456e3424be7e4485098b1cba
SHA256fe36d51745eaab772121da869159ab4f38edbf77d0e9ad18cc16515b88da663a
SHA5128923701ebd24206f425f8f3afc7a68ee7ff3644113366fc448d43a47c298fdfd1ac293a9ec2f88fcfa0a0cb65585a979dd683c5eec8f2e906a257389cb2809bd
-
Filesize
5.2MB
MD55a1ebd84523cce5f5e34a6b80506d3e5
SHA18de09a8f752cfa404b0c8a9905bc1da8ba084675
SHA256eacc81c1a072859b366dab415f33cf434502118bdcda4406433a987a5c0685a2
SHA512b55a42cfc3e88fcaf77e30b16de49da6e1c4891ac9a1ccafbea8ef407fe69af33351af3e907c642df49c58e574b99dee27a73fea3c6a3e16a9aa1b9ac0699020
-
Filesize
5.2MB
MD5e9d4a5de72b64b8bf1e8a8514a81a102
SHA18cd509d94b2bc613b3238b8490d8562850cd98a5
SHA2569244636bde6745c7f572de6338b16aa0a2cdbd40954f171c31f128797e3b4156
SHA512e7462483869e74d983b92489f531467ef418da6d97b5e8fefc6c9af60bc7ab5c5257abba457103337ae556445175cef22dedc2ee50ce4ee0355c647cd75c1725
-
Filesize
5.2MB
MD5f4b405f5df432d480a17a83041afeb70
SHA1921d71ba765bd184a8d1a3465a6a471ee848251a
SHA25659c7988f3bd2612e492ef572b84c356739cec32bdbce4739a6dc0f9bba7eced3
SHA512a0d80231a116952c98a10b63553a46ef8cba9562a57eb2c4af3fe9a74c498efcee4dd5304639284ee16addb8be5e5985e02aa3187ad144afa9609b226d8366e3
-
Filesize
5.2MB
MD535e2f9f4cca596337748dc21fdc83bb9
SHA1f8a39dcc546e5e143df5bdf73b0ba44721c6b454
SHA2565038e5bd19cd6312a6be62c2a2cb644aa4c1c2b69a8e89dba9e49517c6bdf8c7
SHA51223aa5e03b441c2b9e6adfd6face63882e4c91860844e04b78fd702533dcfdeb18ccdb397b79f2f54e6940d061afc8b082e7fc08d571ef915ce552231a0ee5c06
-
Filesize
5.2MB
MD57c89c7391200d27593db07055a57b385
SHA13d9157e95b5d866a71b4561482c0b523f9b3321a
SHA25686fb4995cd5a7bc7c6ae67dd7b153a0d2dd411e2602cafb90227031965c59167
SHA5129b91de3a269eb53e363400c17973f990eaf7a6e319d38d91827784d9d7269a4a20b334d8840beb27890b27035bc3f82cefa118c9738555fab7247fcf58afe893
-
Filesize
5.2MB
MD5ab69e99c2cfca3858ecdda099ed5c62f
SHA127bd068c3706450b12e23dbe08d31a1b37131049
SHA2565d9381bc988fb277adf1a52a2aefd7209da1b1b5a6e8f5ba34330ca30d791e20
SHA512d10b43ce7148812e273dee99fd526540cc4ca837edb5ff85a199e61fa981c707d8f73fc7ac746c7c6ed1511779e1e8d07463fedeb41c7c54b887325b8b2a3159
-
Filesize
5.2MB
MD5971e3e4a21ae8b3b3f8f245ed99cd17a
SHA12cd0c5263e593cd3ee9374b3993dd5d0c70dab52
SHA2565b681808c32ccfe0e985ae312ad65b702a6da73f53be702ee7f6aeea942c2cc5
SHA51297ee07323962ce71bb079f7c1e967e4a7b1ca9dc0a75d6815fe49e259e4ad57eca450ca8d100e3dcaffe6ef27fd278f0f51942bff76c9ef1f6447468406da59d
-
Filesize
5.2MB
MD5f9cbb5f2dfe695e02cdbbc96a5901054
SHA1f1f8b5f63f6d1e323990697bfab67bdca9e1e4c1
SHA256593aa009e013aaa6dfeec08c7c244c65a14481abf0fffc55c65d0d6737984fab
SHA512d1c5b4bd73a4272858d24ac227938cb359dfbfa14d18cc37006d67e94022f22a1ba85540c617b3f6d04a848f86928f953638112bbb61126069be8f6bf32299c8
-
Filesize
5.2MB
MD507d7a5aeb96872c10ca2d3c8254515a7
SHA144c3991293af6f2f1067839716828d01207f1406
SHA256cb23c30427eb7f7a76243f5c640e49482ddb90905d1568cafe334dd0471818ea
SHA512cefebb09d5e3e3d5b1fa80f58973c259286166436ce3c599cc2a074c3b2a35dd405a2fca17153a31c5ae7a4b8040c7b2218ecc4f9448ed26cef92aa870cf0ef9
-
Filesize
5.2MB
MD5f756ccb4ab30f91412f333da2b466b42
SHA172dc4fbe8a884b4c7eadf48f0868af66d1f059b0
SHA2560f011bf9bca6b5971efe146e73317548f924a090c54cc36b02226d555ec5f3a1
SHA51202a3f261a620c647e50eb6458df311901324915cc92bbc92f36080cf2b32b297fab2dbfac6c0d0d0373296330282bc678fe0dcfea8b1fe871a683fe355135ab6
-
Filesize
5.2MB
MD500d8f40dee4842e5abecbf04351e1010
SHA18785d4c310b442d7ae3f18da8b800273063edd90
SHA256de0650359e4d5131839c384e270337c7b787bac07ff78a6cfb4d4279d590ed93
SHA51264627b62ba9bdf18b5e1bc400f87b6ed30496edcbdc8715546ecb010baeb2d96bd3b4f1ac0b2d570be2c20da968d321b2623d679d9fe751694ae726b26027050
-
Filesize
5.2MB
MD52f13ccd0f21f1d88d00d64ae6c53a35f
SHA112f7d316cd2627aa936f68dfab0aed5a9e0c5232
SHA256b5015350917491b839525e327748f8a7227067bd9a2fe4a7b342408bbadc29a2
SHA5123210d3c0b0e28418f894835e848dd74bc69e79e1f289ced877b3f13f4ac31d140fe0b6f0c2c5058b9b4b5a07266cd03bc98d09a8efc200923007a85a368d30a6
-
Filesize
5.2MB
MD524e37c3ed57afe33db98221129dd7d5a
SHA11b61195a82e70a0ccfbbe457a43a06eb9cfe5615
SHA256b539bb7262ccdc42aca23cc2af9884ae7915f66f1b9e09b23b6de3e047f25d7c
SHA5129b78adec47664eac6491eb46ec390bfe4bae6de6a730bd9a1fe4cbf77978b312c9702170019781ffb4b1b6fd0466d2dd07d3c160fd88bf7775bd2061f13d64ed
-
Filesize
5.2MB
MD5eca588fa1d3d9394209c1bacac5a4c85
SHA1d319aa7fc568d5568fe339026c4f2bdabf619f9e
SHA256a6881a472905d559ad41d3c8c4ce9f1f6444e664d5db570ead34f5ec64c8d70c
SHA512147ceb1334b44e25289847eb14d551ce700f61d6a4312e990b2dfd2ef4dc33d8e95175dfb354e4029fc11139900d69f69a55cef225de574e61a98c299ddd804b
-
Filesize
5.2MB
MD50aae6d915c9b4c2d3ef279a79b7e3b80
SHA119ff4d44faf86e5711611f0511f68f417b14fa87
SHA2563967ad0d7dfdc4f7ec7baec77e24b3bbdfdd66dffbf4597ef1a1eafcaa36084b
SHA5125878a09b6794df86dfc6be97a52bbb8afbd5f593e0ace0b9c7f910b438ecf0510de3bc9cf40fa4728b47086aebf03a4ff5ceea676c3af856022cb43f871cbcab
-
Filesize
5.2MB
MD5559b8d2b8d855171091232e0b5a0721d
SHA15bca2440aae38a64a12b39994bbc89759f612b71
SHA256ac6fc0f24c946eca4295396c8e75f7c0f3c5d6a8c026c75015ef4b3e28f51a4a
SHA512e86238d3f82e3f56baf84ec8aa9e3018dbc5d8c75ddd467da64cdd83bf9acaf2459b197a8cd739caf60ae19dae9a9f29104d3c838f8e0d0c19f7fb6ba0eaec0d
-
Filesize
5.2MB
MD54040d68ef5bbb0982df685ff0da2fc4f
SHA11418675fb808dc0c7c8c1bd5b55c5e81c5d7be9a
SHA2567ece4f64a179c60c0fa480bce880d5ceffaf604f7cfff44f184750754614e257
SHA512395580b4bf33605ec45ed0b643b8d96254178c438d9e805f5034fe9ff60a2c38fbd0dd1cffd42016f3f8e0ff0365938da790c5aed35bf60165baf2c62ab3c694
-
Filesize
5.2MB
MD5d9c2075e7dbc0d9b31042ba60cb12176
SHA1ef8c72b76811dda94dcc1ade5d9b721a80a92360
SHA2568c4d95f09bb217558d97eef374abad598a069a56f369d668db085800d091ae27
SHA5121d2f147dd1d019519a5949814e51776fed7200620e31fb4163cdbf4b231fb1721ae2e7948b68e9689992480a6ca0d90bf904001b288ada2e47d9b5f5f779959a
-
Filesize
5.2MB
MD53d551f6ef069292b8178d03e04b24c22
SHA1cc75ef2025f21a82595731a5035a17ea264947d3
SHA256ef5a807c8d05867b3331ddb6869ca5b97a3ef7c6d8576e5b89c6607804731d68
SHA512358b87519c8acfe04618003809b168755a968165c3140044aa6851eed93ed69f55e6b91048d9613b3d2f8de1fd1a1bc63d780aeb31a5590939b862cb5b1dcc79
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB