Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/11/2024, 05:50
General
-
Target
2024-11-27_d31fb6c2cf82b4e857decd78bcef96d2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d31fb6c2cf82b4e857decd78bcef96d2
-
SHA1
184c68738f7fad8f8525ca08754d481ca506178d
-
SHA256
3af20af6b5aeca5f6458725934eced4bc92c875295ac4b71cd95f7b722365d4d
-
SHA512
e00b9ff7a147a30c775c3b941724a8cb11c04f8b457a696599dbf9c000324418137a45ae2207cc0337ce353c14a96845ed016cbf68f5d3d42fd685e0521285e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_d31fb6c2cf82b4e857decd78bcef96d2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_d31fb6c2cf82b4e857decd78bcef96d2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TaNjuln.exeC:\Windows\System\TaNjuln.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhhsiYn.exeC:\Windows\System\hhhsiYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\liUfrbO.exeC:\Windows\System\liUfrbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltyiHre.exeC:\Windows\System\ltyiHre.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OOajgtx.exeC:\Windows\System\OOajgtx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNYQlLS.exeC:\Windows\System\nNYQlLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVzbDkk.exeC:\Windows\System\NVzbDkk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwfnWtO.exeC:\Windows\System\mwfnWtO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\upHyOBS.exeC:\Windows\System\upHyOBS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gUShUhR.exeC:\Windows\System\gUShUhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIgJcOl.exeC:\Windows\System\MIgJcOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeSyyvm.exeC:\Windows\System\xeSyyvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UicRlTG.exeC:\Windows\System\UicRlTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycbZBxn.exeC:\Windows\System\ycbZBxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\osEXCxB.exeC:\Windows\System\osEXCxB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VboygTJ.exeC:\Windows\System\VboygTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VouFIyd.exeC:\Windows\System\VouFIyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqJEzSf.exeC:\Windows\System\wqJEzSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQaskrl.exeC:\Windows\System\EQaskrl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdhbSBj.exeC:\Windows\System\XdhbSBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yRtnxAn.exeC:\Windows\System\yRtnxAn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55c3cfb7515d5d1ce46f6a400d7181f7f
SHA1bc8bf039b60f686ecd986da9532dde53a8e0234e
SHA2563185fbafbc6d271f866fde83f637a1e35e5f14c2eba36f6b35db519f5ac30c45
SHA51284ae70e103f48a022da80409486e55163f030682619b74df2b2cae8a46ff3d177231917e83d0e4626e5ad862f08a98624af49bbc2b54bf5050c046d4c4263b42
-
Filesize
5.2MB
MD5da990872ff0b6889d46260d8a3372035
SHA114a858121ffb6ef1af38906d2f5f4a53c30c5f9c
SHA2567f26632b15408a540ef04788d7a2768463cc2b6784651d35fb9bcbc51de14990
SHA512ccbc333aae049a2c7c17c2e2f06ed89b91d65233ddca675fa4f453618a4044bc0b22e592b8f45ded864ac648894bf06adae13ae4a534df16995d0c63c5e74b6c
-
Filesize
5.2MB
MD591aa3f2c42d1a58c873c2908908aec4a
SHA18b7ca63baccab4722b2364020f9b6edc55d8e000
SHA25653706ec6564b6b30687693bb5c9a33f426d78baff72a606965010bdc9d863005
SHA512bb9e29a389244c797fc556b8549728fd5670d9e2f288419721a3820ba85131c164499b82b634256d38458e7aee91c5b4656cebdf783c1049aec5cabac9ec2202
-
Filesize
5.2MB
MD59f738b39b048d237a20584245ac56ca3
SHA1cb3016bf5a1f321aa77f72a8d7b896071dcd1551
SHA2566d03d9fe37f9df9f4d9948f899e9c852e6628b3afa0dd12e645802853d0ca5ea
SHA5120264fe5d51acb36b992ed4ae75184497577946e4ce40f5824dbb5328e7c518857d8d1c001e0c1eff92f03ae6c901c678503ab060207bae7b8636bd72fec1db66
-
Filesize
5.2MB
MD5c1d3a8c38b0ae51c1f8e58af49f7dca1
SHA14ac0bb9db281387e6fa2ebcf3ff674a699cbf1ec
SHA256de97737613062a3835e614621eab166e571e3f8cf2e6dd0e1d559be3cb9785dd
SHA5120c47aed4b64282d41cf27c69388b41798166e2295294cde038da808ac1431ae9476692e0b6d093162a9aa23c5a1c57381d46932094677028592330d4f109c36c
-
Filesize
5.2MB
MD59c8f4e4844c8a2d8096f27ed6abe6c51
SHA18b3350005b837a228753e6874a9ae47aa3c7c986
SHA2564377bd627aa4994075855c3428b38364178541d78df1172651eddda0eb0ebd86
SHA51273d277131ac4abd9dfd58b41345d1c8ed53814b41496a553cbaf325763fc75cd3ee0536dc46c99e10f126081f93787f893d2c87ebb5abc2cb33a8d5f2aeb64cd
-
Filesize
5.2MB
MD5dc40b36e00b9ce58ed1b210dd75cc78b
SHA12ecee91201cbdc438933a2c9209cee7ebd4b1175
SHA25652cb36de537f712ec3f33422476a1466b2c11526a05c02a125db06993205b919
SHA512cdadd1330970e51e5c70ce9744c7fc48105c7f2c4eb8217c1ba67d3d6c80ecf6998527c4fbbf70c73291a87e0d29e9ac2f9046a686604a0615caf61e303a1aec
-
Filesize
5.2MB
MD5a9c46edc2f9718b718626641b89fadb7
SHA1ff971eb33ae6cf2f98be25f791810e14da855464
SHA2561a83bc5005e74f76719531f0dd3d56a95c3f7898b6b05c7acc2c0d708c99d058
SHA51232f65b6663b75140703e842dd13d6c79c28ddaeaf09daa4c524646b525adb2e78677e9abea07178602220d1ef985ee79f838a5ba8b3ca01183934e5a21a2e4c4
-
Filesize
5.2MB
MD5e39505efcb343644ff76ce9e5e424733
SHA12e599d3d6893a65a431b23713336f08446045b14
SHA2564f547353b166c2308876b97de42ab354acd9f8f581ecd73f5cd31164a8f5013c
SHA5123336994838bbc8d562729289df6c240e3fe04fe6123d37bbcb6f9f6ebf82ec0c0af23cb759faf95f4b1dfff221481871ae9bb080b0df9ae56773055f0e9c79d4
-
Filesize
5.2MB
MD5fd126aea574ab7a2f2a615ace940cfe0
SHA1992cc67e143cff103208a0f85658b233c237ab2f
SHA25608abf408af1711423fe6938dabc1355a6856b889d47b9fa0f0d9f7aa761825f4
SHA5121b19c45bf6ca630ccf77d5d2e0dba0d17a9dc1846fbdc0ce513050ab3c828639553f6e3ec132140cf7f643ea0a178010b570cf06fbfe3b05e32936407ac33875
-
Filesize
5.2MB
MD5aeedf3fba457d369c0455301c64857d9
SHA1a58aa1cb7db5370a28b51cff85c9e5d1b0ab186a
SHA2561c12c2d9a2f083ffaad11bc98dba4d978d887c193618e29ba001623f3b006703
SHA512eb2932c87eb41c167baca3e50ace1955b082339972c514cfdc98f87fee82438466138cdc31201287d4c3ec45248b523bb1d5007ee578af96f27439c493a19696
-
Filesize
5.2MB
MD5ebbb6dcb4539d6b5f0ba1a504251a5e0
SHA18ed515fa2813f8a1534a6cf0b5a95c4401a020e9
SHA25610a14a2abfe2ef5b0e640659e23c69156647c2beba4f9ad4b9c20903a26fccf2
SHA5128bb46c89c220b17019899f32d0ceb47b22f2067726f305d92dd6ddf9b8bd207b207f53e7a8ca02f4585bd0ac56315e7fe95b024d5361c47c73bda9bfa037b611
-
Filesize
5.2MB
MD5b34a37f17e9b359b636363f3d68c3b77
SHA1d08214a084d2f9f70869a434355680baf45e898f
SHA25638202191bfee76a0fd0c7bf4483e08854ae922ebd656bcd1c5aab9b41fa1cfd3
SHA5126a39d98070e26b64bee5c3c93f4cec74af7bb2c4fb11a9ed77d7830b5ce26aec4d6341b220d8ca8a5136f6a89028ccc7eafa3683e04ce66cefe84e48c2318887
-
Filesize
5.2MB
MD5aa358783353d5719775c603e8db59508
SHA1ec8292b3e471afe151278c32c2f787e0edb77b0f
SHA256c2508c4e5f476496b788ddbda2fb26899bfd453d4bb85038e3e9cad65860ceeb
SHA51200183e8d912ad3a112c08e7b58c3f2e5a6ba55715af3a17768b247c4ac0d1ed0e3e058d55f1d1372dd2f880d781e30e3513d4de22da66a6d755407fe9c54bbba
-
Filesize
5.2MB
MD58009b7e29d03c0e679699d78e5bf2518
SHA15eaf26a85ee206cc773de336ab7a1fe1d246baaa
SHA256c4a2203996f5a7c7c222a793eccefdc95bedfdbe426ce7c54a3849b1894a8fdf
SHA512db1d12b10974596971c977fee6a3a23f1410379b0ee6bf1e26d66b65fbcfdd6b2c33c121e184a901a32642d202ba83a36572fb7db99814599f7ea05507cd43bf
-
Filesize
5.2MB
MD5b212dd58f1a50c9886ea35319f54409d
SHA13789ca30ae883670b463769618ceab4a2a84b67a
SHA256a5245089910adcfe292f8471be02a366bb40535c1ec1f59ec2a5c232e3d6a758
SHA5125a3bf6fc552091cd4c0121defa206fa9160e037a9fe77d41cd703e29ec72b70803a9ea7eb6a777c6835242a79c9397b9d2ada098e397f6635c015deeffc9597c
-
Filesize
5.2MB
MD5b427154c9b8979c4a183512e6c9604c1
SHA170ac288c2d0ff76b6971dca3054a7fe2e8e91a78
SHA256174c63480c9a57f8c8d08eebbcfaf51ea29e9a647a484e883e1ea021376b9570
SHA5128b632c388723e1a72f4252251663ce37785d3f93ba6731c63e9c30be8c7eac4a147a6b8f9ed17fcd0dca792bb3ef5e7f90fbdd14342a68a1276482c7fcab1b97
-
Filesize
5.2MB
MD54e17a06f043c8576be9b0d47b2b0dd32
SHA1cbb792a510865f19da288b070cec882fb08023d8
SHA256857b0577ca843d205420a400a6973b7f0487048cf4e4bef0e949c415758286dc
SHA5128fc5e3accf268a26d8fa157542e8c43a0bf55bddcdedc1031126b123aaa61e77823b2b928cacbe135189f4df52fa754b42c81922cf8eecede413bf1c973539ac
-
Filesize
5.2MB
MD5672a91677a6ee2a91e91292685311913
SHA1a5da9533d9cfef0d4153e092326ecab9d18674c4
SHA256f9e94b10662654583d14c676a62fd319a8505d47262b2f405d9f280d395dd5aa
SHA5121f1dcadbc2bafb155ee0ddb5cb0217578450663b74bc641fb7243eba1e50fa23e3b965b1de361ba8441bb1e23bb93b90eb1ed4e8abe7186e419cd169330c543d
-
Filesize
5.2MB
MD521c1fbaa3d3bc71da3765e44ac65699f
SHA1381a78f4c31509cf9b3f65b65713f9d5a116972a
SHA256988d103779d10e5ea9f7194270e25db5924450b178c19394161be657c583764f
SHA512d98ef1d861c2145b2d908243d26adeabc7e871e6f033182296edb080f4717381407b4dadfafc427c0c4b7a989cfa9974d1966ec1b0744ca3ca28c88e05cb029a
-
Filesize
5.2MB
MD576e764ed05828f5a0baa1f334e3b94f7
SHA187a18f18747200063767d5b654a54cfdabf76fd0
SHA25679c9bf023f0e519382f1ad98a38ecb5cea80db70585e4cb65b3dcf3edbd00425
SHA5128ded0eed444b0f0c0ef3908669b8d9c9ab79c6963969db7d4a023bc94438ac1d6320d1724766da6790c625159d79968455d073258b8a774ce3727350817f95ac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB