Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-12-2024 09:25
General
-
Target
2024-12-11_443eba04f8d72c279fcd832286d2328f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
443eba04f8d72c279fcd832286d2328f
-
SHA1
a3fd3ef189a4bdab648dde344ea5aa1ec17c8e86
-
SHA256
af13467ceb0e2c5443e4bf279eb8778f31729b5b2f252c94256bbb7d19ccaf43
-
SHA512
571f52eec047dc489e1d12b6d9f8679f722070872cbfa3da6fa51b37dcad2cac59be6f612b3625ddc039605339af58f792e0391665bedccf81e99e438ba30f5d
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:T+856utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-11_443eba04f8d72c279fcd832286d2328f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-11_443eba04f8d72c279fcd832286d2328f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SBTMewQ.exeC:\Windows\System\SBTMewQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWymGza.exeC:\Windows\System\JWymGza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncKmWSx.exeC:\Windows\System\ncKmWSx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vGFCywk.exeC:\Windows\System\vGFCywk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nECtItD.exeC:\Windows\System\nECtItD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvcBKDF.exeC:\Windows\System\MvcBKDF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXOJbdA.exeC:\Windows\System\zXOJbdA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cwMoEcm.exeC:\Windows\System\cwMoEcm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cGnTabG.exeC:\Windows\System\cGnTabG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVNtzEJ.exeC:\Windows\System\yVNtzEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhvhFsL.exeC:\Windows\System\rhvhFsL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVwbbcR.exeC:\Windows\System\DVwbbcR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCnMBEw.exeC:\Windows\System\yCnMBEw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnlcdkz.exeC:\Windows\System\xnlcdkz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVwHQFu.exeC:\Windows\System\yVwHQFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jqwyDpZ.exeC:\Windows\System\jqwyDpZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDvgadL.exeC:\Windows\System\dDvgadL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSdQZzx.exeC:\Windows\System\oSdQZzx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wDtHPYi.exeC:\Windows\System\wDtHPYi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRyCRVc.exeC:\Windows\System\jRyCRVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ODXYMQU.exeC:\Windows\System\ODXYMQU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e99252e87a1fa41b5fbfa04a9c8ddcec
SHA15eae561a36e9d5c290329318837f40afa666b3dc
SHA256c5c1627a4455771b88c5229a5bcce3a6c282c2389705e7310db973228e917a22
SHA512a0844a8d28f28847230daa3833e9541b182a24636e6586764ef68cc35dbd0cd1dc977f3cdfea670a01b88c95aaa039ed8461f8d4075592a1f738b430811f7fb6
-
Filesize
5.9MB
MD5653341bcb8f81d2dccc74ee1405b57ee
SHA16a8e07b381d06c3ccf289a91072aea3f9adc0e31
SHA256e5fddbca2b1c53b53f575d727389a5a49e32c715b51d9e1e208020c162f5a665
SHA51232863192c9764727ef513bd239caeda6fed6abe213cbf2eca7268daa02d4f047a22fc7dd2a8e71af5aa0e4905c1eba641be8976fbb4365e0a6e5fc3001f0cf22
-
Filesize
5.9MB
MD5dc7c5f3fa9f0605dfcba4de8b9a7d31a
SHA186f51bc0b3bade80cc3eda83f9d42370565d0d62
SHA25635e49454042b56cedc74992734d6a2b9139410e01662bb9694dad5564f26a66b
SHA5121ef2d26fb1da6bd2557c646db5044be031c97ec9d1596f8235a8351def8f7d704be45095f4df4b6afb1c3a48564ed0d656a16825673e1acccdf2211ada820771
-
Filesize
5.9MB
MD577caeaa01724689b2c861533804bf057
SHA1bb442c52ad34bf50335bcc65df39951a6fdf5c64
SHA2564f08b58571388b84e6f0675134a919e5df1e2718ee7f7696501043b073e71a3e
SHA5128f714e5bd8fc0271ac84df0e767338af67921321ab2d65406d7582ff61fa65c63d50122617bf667462ac8bcb0a5f1b0c5751de342adb746f659db6235ee1b7c2
-
Filesize
5.9MB
MD5d5dd3c6587b9d5715bb06e9880ceeae9
SHA160ac7fedcde6e069b1be898b9bf71196f904bb5f
SHA256a39e55d6a5927367fa7098bd23b5d8ba46a2f44977818d2adb0f6622ca8fe35f
SHA51249a56724bbe8382600958c5bfa8acd5c22d1d3993bfa935f78401e8a57ae2a17e50e7d69585adb62d6df86b72bb530822b62de1e5b232297633111fa358f67bb
-
Filesize
5.9MB
MD59a19ae7ad9aff8d5078a62877571986f
SHA183acca357504febf85c38681c46b2821e9a61a5d
SHA2564e2bc048fd1d33b82a039ee7a77b3d661f164b8ac1972930a4b62a286ff28e05
SHA512e5e7d0e45f9e6743b52c1d532b7b645fae0bd4a8ebf3727942ebbd76eb7e370fca3b80a85db1094b2ea4959ebb56c65b2746a2c3d8f3b0f21824d4e43c63add5
-
Filesize
5.9MB
MD56e2bd556c6b429e1aba77457b62bf9d9
SHA13a2d25e573db03064853da05922181ad309e14b1
SHA256316d2ea49d7f0e5acb51e71fbf4a84da5565a3c42e4a1310096230265db62e14
SHA512e229582ca70f02791ca93ac9a87d22af3ad24e3685f006066e6ae87258f09d851bce00cded4aff7613f3ceacb0161326bd158b0ee61fa4ad1dcfe4e7f6c89821
-
Filesize
5.9MB
MD5778e0f946f7be46797a10b6fb101c325
SHA1a4755284bcf42e7f0e4387da8e6ffb3d11c2ba88
SHA256fb9b3ebc8d6492e0e1912eea4c873d31a2acb715bbecac51baf2d53c0491fd8e
SHA512f5c2d4ef86ab3b7119eaf386033cda3b921578beca341be04a07d80404a4a0caff426587758b995fd4b29c8500342c570b580c8395cb2ce584e422fda4496146
-
Filesize
5.9MB
MD579517ab181fb39a05c1f3558934db531
SHA10143b595d446337d0223334f4780f41dd2687d20
SHA2562c15a927b19c4e5fa6bd33ce3182e9b5c214fae02b76dc70b96c751fb6fc84fc
SHA512c39bbb0dc5ce95666fa78db9dd3c8ba8957f2ab1efcfa925365626078ec5824882e4b05e9372da9c163bf608c8e33c840fd1541c39047390537e9a183c423959
-
Filesize
5.9MB
MD5fb095ead5ab4dda08fe475a1e0f01ed7
SHA1f0c369cddbd5d2c05eb8277313d65599b850ae72
SHA2563d4056f680f2cb19bda5999c77fac94fbe50eb45cff691924fb7260eaa0dad49
SHA51267a9aac967251379b5aa51ba13c475a6caf99f9d01b1e917c4bdf6001ba51cdf901c63aa05532ebc0563bc6c97a86b8f6df89bc4c63699773181f999c13e5682
-
Filesize
5.9MB
MD5088e464c91c903ca08dd9940924e4821
SHA17adbd84f1b7d1590078787428b8988f3442cccfa
SHA256f848724fec00f73521b44dafcbbbc1a101f891b819c93a2292fa4753a5a766af
SHA512752aafad2453011185173d5dd9aca9d7528ab733a7442f27356cc48aa5cf86f6dcdfc3640b5769caf24c861b7cccf4be6e360b92859a6db40e0b0f67e4f84127
-
Filesize
5.9MB
MD572ca7926ee3877911e2b88cee0e184ca
SHA1a95764cb2077ae028abbda3a65d505bf213c2b77
SHA25603e5f9baf520cf7715e734a6c04dcb1ab686dc7da05c32c689fb1ebf5f4f4848
SHA5125a18ccfc0d801ca037ee06fa9a205b4aeb39a42bec55cf2fee87fc7c8a74e2f54246a979c27b63a599c37294bbc3897075dfa437124de301cca2e01bb8744475
-
Filesize
5.9MB
MD5ddd8d1952f44c45a4b30ce7022d5c52b
SHA1301000e02857ccf9768b40359d090f7f6e85f3da
SHA256fd221442f14d7b80bcbf0c9f9257fe849d56f1cead66bfa6ede6cc90c0cb9b54
SHA51212f300cfa2ecf62a5a5693884fd3db914db7e6c251ef29d6f766e31b774fcbd4f0a4f8be2a31d12c8568772b286a2299d83a97e6732de88b6a885ccb90bd6032
-
Filesize
5.9MB
MD53c29dd8333ca015a1eb8a9ceaff381c0
SHA1025797f57088179981ac0304b3b421e1e72a2266
SHA256b375df0fda39983a2240a0b5739d0fe50aafd57011ade34f06e67dd73305cd49
SHA512f032cfb3891224660ec931032ebcaef91c6fc50b83dac5c17226bab1e79e3cce24e566e0b65c0d467e9fc9cc6626e7283ec73c2a88e3015c4aaedd4e415dcb92
-
Filesize
5.9MB
MD54d8e6e60136b8753af8a5d41ea1f26f7
SHA10d6c6f6a34675a6a100c871f3a1c42c1558e3daf
SHA2560c80affb8939827ead64d606491bb1696bf75841940e44b31e2c65c051300907
SHA512e2eb8ba91d53621577416075ad5530ccbfdb1f866eb5b71992ae5619fab3450da01eb092480c1687a44f0cff64643c46597eae43952142bed15fb7b5cb8be273
-
Filesize
5.9MB
MD573039bf07cd65e3193e90f109638d0d4
SHA1fc9a3bef8f965a01a018496f66718c9567dd5101
SHA2569d0e7cf0293e94c7229189450e9c1adb938266b17abf6b6226d72e86fe62c360
SHA51271b92a88613955e78d17dff583c555a2912e3664394ec0d257990e8d8174757e99a24e95be993dca748bed93a1ba82364b4a0779a13229b35e50098567bb45f8
-
Filesize
5.9MB
MD5ba4de429dcda073d912d0278cd4c4a12
SHA134c758f2914c129f045ff0c855d381f1aabac1c8
SHA25637bb8a775d0bb7200346eba5dd144011c30030afc3046b4ca9131f33325279d4
SHA5129eaefa8d96883fd5b81c3ca3aafa52a71008dc8b62ecc6e81d01d6b6df96d4f36c0f72d0d85206437ebea944de9cfc45ddec75eedfe85fa1c517f174a0c70ebb
-
Filesize
5.9MB
MD5b959d027843e44f40b89efefc4f49fae
SHA139ff5df96aac41a6a2e1be3e72fb8f7a13033385
SHA25621e066b85bac77c63410d8cc9bf93c5380a28a18b1b47b09edd3f08fd20a3834
SHA512111546c29bd3cd08867368a3154172a55f0979b9875f3bd4d25dc2cb41d110edf04cec49114fdcc6c02fea03e731b650d7b816cb482e913aa1b80ce5139c4bb0
-
Filesize
5.9MB
MD5f06f5561f4b3b86f46a4e62318a57fc5
SHA1236269f65f980820ae47270c5d88df20ae9e816c
SHA2561831d266d2ce04862c53dff8fb1e0ff231c931c10ef06ff86fd859d5410eec21
SHA51281e2fd8d775a1dad1ae3320ceb2440d51c50ecc41acac7f3ad65cddcbfb231a36e59a75f1bb8026246c8a202a894b9663968f200ac7e5c5b0750c73f94636ed1
-
Filesize
5.9MB
MD5d7118084605b601fa2e0fa497003dd01
SHA17eeae127860c51f810df64fbe2a2b995f5bb6473
SHA2564a109e1cad4144ee4d13a65646aad8fe082d02204d1750f10e9686d036e0fb69
SHA5120ee66fbafa26b753c872928d3a61297b8bfde2a97d6315c34bc5ad713a93ac92c2aebb08897595e39bb89fb9435889079988f5be0b7af1f4da1cf0ee935c18ea
-
Filesize
5.9MB
MD5de40c1cfaf594cde864f1765154e9f37
SHA1f29ee8c8365521916b210354719be618405f47a9
SHA256b8ff26eab99b65cecc97ff317cd72e3147ba9af242649f86c4c3f041509e4728
SHA51240543bb813aa7a297c0eb0fd8b96bdcab5242acce5393c6b463c7f3bf06098ff7ccdfe108bdd5f30eaed484358cb0e34bfdc68b0b65c429348dbb014a6fcb997
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB