Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28/11/2024, 02:53
General
-
Target
2024-11-28_2ba4231eed5377cd8e45a86fa7636aee_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2ba4231eed5377cd8e45a86fa7636aee
-
SHA1
489281ba612c709d404900d043fec4eef2541065
-
SHA256
65ace0cf8021d667fb9a5c17d61c220ae4d1d2d340c725d29668adcad432959a
-
SHA512
8ae0db5492c00445cf00ec8d47e7763f12a07c0958a152515a986f0c26bbe55abbf332e766603bf1d47541e35c87a1a9ae82db552f79980f7546519bed26783b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibd56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-28_2ba4231eed5377cd8e45a86fa7636aee_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-28_2ba4231eed5377cd8e45a86fa7636aee_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jGMGCzm.exeC:\Windows\System\jGMGCzm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ECyRTGN.exeC:\Windows\System\ECyRTGN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXgXpAk.exeC:\Windows\System\WXgXpAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUxawVA.exeC:\Windows\System\wUxawVA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WMXlgVv.exeC:\Windows\System\WMXlgVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDFoDAS.exeC:\Windows\System\uDFoDAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNNAMOW.exeC:\Windows\System\eNNAMOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLISbBn.exeC:\Windows\System\GLISbBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FYzvqEr.exeC:\Windows\System\FYzvqEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ccrHmbt.exeC:\Windows\System\ccrHmbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nLwghVa.exeC:\Windows\System\nLwghVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xZyWYZI.exeC:\Windows\System\xZyWYZI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSPQuYC.exeC:\Windows\System\GSPQuYC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nknaXRI.exeC:\Windows\System\nknaXRI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SVnCixz.exeC:\Windows\System\SVnCixz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuMOJkf.exeC:\Windows\System\CuMOJkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edbPDCQ.exeC:\Windows\System\edbPDCQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jmAdbsr.exeC:\Windows\System\jmAdbsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNtbNnb.exeC:\Windows\System\sNtbNnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlJvpUp.exeC:\Windows\System\HlJvpUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpjsIMh.exeC:\Windows\System\cpjsIMh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59e55dba0f0c0323769c8fe20e90dbf25
SHA12bef189266d5132325ce7c65c84cf144c734ebf9
SHA25691abde6a2b5ed0ec99efacb762bf183a80de1edf7556606b54af0320f24782b5
SHA5124dc1408091f6cfc06c58bb54863cfff6dcd158b6173cfaae3063e436e04ef9f0a672e8ffed56e3975ce482a7a8981002325c93f4ebe2e0fbae41a2817417a267
-
Filesize
5.2MB
MD5307c6f77d3910713b8b21d540cad17d7
SHA1d3c807b67abe2a69d1042f3d82edb41fb917c790
SHA256b77a28e04a2c48b76e2cec1b12accc4f12cc45c2c5d1556ed10e9d7d5c30077b
SHA5123083eeaee5fe35fdab94d2d800c90dfcb1850dcd470f06aa5ef514f6a5545f0e0469de36771d73ac79144a0b7628b6f400152ec4e84a74ce946624d8773ec038
-
Filesize
5.2MB
MD5aee2d8d10fc6c5007b3b2f5214af3e9c
SHA1632f1a9a3f7c13f514810930e1b332fa656108ef
SHA256703921dd0507829215a72a584f1aeb0bc94587fdac7975c12357ea9245c9eb1e
SHA512415dc1de08fd42700cd4bb02e82872fc57fe4ddd63132df3ca18222a1f1f222d00814fd1d1dcf2436bc4da593c283c7af5542ea4ab6fb73dc06a33ad25836d01
-
Filesize
5.2MB
MD5015cf7d7a6a3a01cec274f839ab247dd
SHA17f423599bfe23f9d48fd20423a8c7b7187573c7b
SHA256041600c2e68b4599da8f8dbd5b22aa92fefa28d938d2810d525a5708c8296885
SHA512f284943576fe91f56be5dc97e109b6e05b52ae677945c9ce4f3405459a54540ef1749ee65905a4f281cb9ab36d6a8ed5a01ddd3f240ac08d89e0119744f9086e
-
Filesize
5.2MB
MD5989b161cf8943a0cdcac509480d265fe
SHA124fbe887f17ec102ecd8657e1ac5c78725f31890
SHA256e72af758d7723050e419649881ecc909873148c9d46ddcdd6c6317a08d9d597c
SHA512e9cf750df559259548096cc9fcc526fd668426444b75d58ab0658988aee588d71b568b8d2015b29f984d504c60f845a62c65e5c625e456fde4e600816b84fdc4
-
Filesize
5.2MB
MD58c6b5fbc6bb7dfce52b4259dc146e72c
SHA12e720078bf4ab52012a5259a422e47b3506e6726
SHA256c2addf6c5b057b53cd05bab06ba27fa724b03bb37987f6c6b6e70284afb07f78
SHA5125c16e06003eeb934b4faf1077a4adbc0401eb291c4d6a56d9c713069118eb96b409d75fc5aee0073c73be092719854d425b39861e7d7d4648fd4b5dcc88fd7ee
-
Filesize
5.2MB
MD5015a5faeaa96eeb1119a57b544b9ff1d
SHA1f41e363cccb6aba22274137caeb3837a482a42de
SHA2562618cb8c9a9678cd9a402da3d6f89f37526599648f6c91e719e949a22b9f8b9b
SHA512cb13ee65972fad90000b6747932449f9f67c61c1b4c729f061757dbaf04ed127f31c246e885998f4bfc3a8f240f8ac0474bdc2d90552b88cfad9e9082f2c4bf3
-
Filesize
5.2MB
MD532096db81f8b6b79f1f9efcd958c8163
SHA1a1e0ba1288ba35e1c824e7c867c97c13eaf59226
SHA2568b2421fc4d557bfca9cb6ae70d789dc78bbdcffadebd415312c5725a19628f04
SHA512a1fb1049ac55e1fa2b0ccd01d4d736242a5d70eee00aa1cef1d7a248310dea7dd16707a03e64b9cfbdb17f53393137d3df5ec0650a3828627c354101ce128cb7
-
Filesize
5.2MB
MD5f5f433a805605b8d92090fdb1296d552
SHA1f3a955e3d22a7d09ecf49205194d52c4486cb4ae
SHA2565d77fb6de3de3c1a90e3979fcd36f5673ad30cc151e689dace47478dfeab7a6a
SHA512b221b6adfefcbcd85bae7f0012be26849c8354957627a8b748fc55e1fff22bf11b60fd7ca7120f84acdc70cc7336d334cffd2f6ffc3441a3890062b26a52ec3d
-
Filesize
5.2MB
MD58d5c9ab4c2e8625a6d87aa3bb21d1b60
SHA194aa195e8249c703407ae20846909bf5ec003ecd
SHA256c05ee5303edf11508bf7f0f3e092c9b01c392040e948d444ae4f53b1fec569cc
SHA512b78ca7f32e5f54e5c775b04bdfe67cab939789c6b4e632d0d5aac772f178ad911c3e03a0a724fda773c2bfc2a8ac59f085e4cb488328da3eabee1fd1005d593f
-
Filesize
5.2MB
MD550b87448e46fca1a270a75058a075c9e
SHA1dbbc5f89a0d42923e1e4ac9431760a95a9b3ad85
SHA256697fd2f848d3e67b83b0132d5da41b0ca2efefe0d4b6ac2b3f3ca0f7b78e9a10
SHA512615b2fb455d6fc26991a20264315659e1e8a85ca628e98083ef2b3d93f49d9eff0fd93992c99794a29674502da6d21bd70aa7b78a952a8e20b663e712cb51c2a
-
Filesize
5.2MB
MD5ca89eb4f39b893a4deaf6a4915d74fbb
SHA160a0e5edc52f05bb03a764dd64e346314a387507
SHA256e91f711058ed4ce654a21dcadf6d62b31476c48e2a942517d3b3b1703a0d5ba6
SHA512bc2827f499d9ca6823a92bc290efea743aaf476227dc07058a27de24021a231dbda7abc20dbe9cd6d4965a9f9cc0bb2411eefac0f3fde7fd7f677a722fd14d12
-
Filesize
5.2MB
MD563fe3f886e7de420a439fc1e28fa0318
SHA12b190364db7a6072d07f4ad88e0786c301f7f6c5
SHA2568a230c8f26d3a09ed000dfbd6da91c6315fb436ec30597da5d49fbf33dcc4a9d
SHA51237f72f00adbfb2bb1355de7c8e1eb3a770d892babdd3fafbe82147fcce06c93c4d8569de0bdeeec4e8fb987960ab8463ecbaa73b998929fb4b998605fbc3c6c8
-
Filesize
5.2MB
MD5ddf5b24fc0f561b0d775673a2ad53079
SHA1fda9ddc92eae70b55649bebf5d059d66bd5a63c2
SHA25658fefbc5d3d244252fcfd9c1d5f9be9f38b8a39a37cdc962b29a00a3188871ac
SHA512300247793fb7fb796a89f2c6480e67ba64c41bf329597cf7656b65a0d4746bdbe159e72d5f2ba267b9227532332174a330f02977315f49358e809526b5055c06
-
Filesize
5.2MB
MD5f8ee0832268ff267a69b4a6ec8362a79
SHA13cfde28543e2786ea52a3cb71c248a9e3956854b
SHA256551a13391336712df88043985884fd70e5de4fce7eb88ffca33d3044e17fa915
SHA512bda170a198b2c429e5501e8b549902f5163149c73f391b5f040c6136dbf273e75957e49dbabb2177e701e61f9d4469932dcdfa262d036e9a6d5fb488b8705b99
-
Filesize
5.2MB
MD5472d791b664aec8e3d2a3b18f0136fa8
SHA1a9d619ea916a9c7d2ef44d978ddaee5fd1097461
SHA256b6ebc7758865148c0b06a49c8092525e4d5aca2b7a46e5c6c4aa329f83449eb8
SHA5129383b7aea142b7723e798062ff0f7494f544865f9bec76b1239c606086483a6ca745f8c12c9ebaf262efc9bd2213a3d86e0a40de57f3bbba394a71b46ffbad66
-
Filesize
5.2MB
MD56e38b6caff3c1024ea15f7835c1b5b9f
SHA16432c39f873b3f0fddefc9338367a434e1ca6b2a
SHA25623dad737b7b566a6cda31b0d61787ed8b7eb18fa0ff6954cb6ac7612b2d31581
SHA51288f21d8fbc88773dcf4fa25bd83af8d48c578937ede0ce5267d1e771bd49bc7c8f4c8c28304759dc311699581b41934d5127ec3401ac009590b8edec8139ef31
-
Filesize
5.2MB
MD5b835a3fd0fc76e3801bff4651569114b
SHA1dfb86212a6c1ba74793b70cd3de402f320823d37
SHA2562309f2ec74aa0013a881c8274f06e6cee4003a20052941f5285351c442fc4f27
SHA512a384d01363fbf633151c27c1459d969928fd53bda305ed22adc2d7f656a701d2feb3ec2e0cdd4e820539064792ba4f53e9ff732beb5fb0bce12e6c0f674afde4
-
Filesize
5.2MB
MD5a1cf61285bebbb7a93939e2849bff44a
SHA139b9f9557d6e17c1e44b3375d2a53e6aabafc7ef
SHA2561c0992ce60030fe475f28cd47cb4fe39d5c0d7a4db49d87f40a8aaa759d6ceb9
SHA512c285ae22e30a9ec2c1079cfdcd1e000fbc5bbffc0787044a0f274ccf10eec099b0fcfc7e4b0acd3642151041ebcb6a3f4f354b9bb6a11f738f2fd43580abffcc
-
Filesize
5.2MB
MD5d5613c678b843545510066eb793f0b37
SHA1a72b46abf4578f6f6b85e7aeeba2004e35d10373
SHA2563f52c311c43f417d3f1d3b11f3711c1a708cbfccfb9d54f237b3653f272ab6f1
SHA512558ce6a1cd5bb6b2f5c089ec5952bb0e5d9103f1e296dda2099b5f99b9d8c4fbaa998503f437716656de5f1a9ea73f114416cc19ff1cb3ecfe29f62a6734013b
-
Filesize
5.2MB
MD51921d792f019e6eb3a6f12a918197a4e
SHA1a5867026e2c9cb039e2c21791e0d7654a20d0a10
SHA25655d176a6c969be4fe1eb7583ab19fac2143bafebd14740e4069fa3d64fc8fc79
SHA512188d939c134f64b9db29f4ce596e3eaaffa07a96961ad45c09ab05da078468e2dc9979cc916ea04f494f87ff6e61a8b10b7378ef65b665e2117b2ec9b28836d7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB