Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 12:49
General
-
Target
2024-07-23_2474cdf052cc6f0ad3a8e107e8233d31_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2474cdf052cc6f0ad3a8e107e8233d31
-
SHA1
865afb1d8545d0c67c84a25bfced9d1df7888e38
-
SHA256
84fdd07395cb37b6ccb8d408c8d9e515954bf4feb53f5e2680a14b5ce1cd8109
-
SHA512
8f86ee8a4020530d1151533214635d9610ac5e79266bbaa6798c3479cc35142867f3d8a2499831398e759508d5fb4b128947c92bf5ff974c09bb32e477b32358
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_2474cdf052cc6f0ad3a8e107e8233d31_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_2474cdf052cc6f0ad3a8e107e8233d31_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cfxfIla.exeC:\Windows\System\cfxfIla.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XlnAMnz.exeC:\Windows\System\XlnAMnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ymEisjt.exeC:\Windows\System\ymEisjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unaKsCW.exeC:\Windows\System\unaKsCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrHJXVm.exeC:\Windows\System\mrHJXVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cJLzGif.exeC:\Windows\System\cJLzGif.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvShzfs.exeC:\Windows\System\ZvShzfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUZrvLk.exeC:\Windows\System\uUZrvLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMiVvBG.exeC:\Windows\System\CMiVvBG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CqkgkAj.exeC:\Windows\System\CqkgkAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwSjKOr.exeC:\Windows\System\TwSjKOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVhJiGz.exeC:\Windows\System\hVhJiGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJrdeFZ.exeC:\Windows\System\sJrdeFZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzzmNnN.exeC:\Windows\System\gzzmNnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cffzuXr.exeC:\Windows\System\cffzuXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ytHdYrC.exeC:\Windows\System\ytHdYrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgtSPyG.exeC:\Windows\System\VgtSPyG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMJPvPf.exeC:\Windows\System\QMJPvPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tkTGjxl.exeC:\Windows\System\tkTGjxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKLdECN.exeC:\Windows\System\pKLdECN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhNMVwj.exeC:\Windows\System\fhNMVwj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e1d915167f9c0b835a20c373b8fa904d
SHA1d0eabce4fb45197ed447d7fdbaf1fdc7939015ee
SHA2562beeb193e0a9d6a5f42eaaf7c60c47b72f535da272a9177bb646cc326024a49c
SHA512b5d317c09eabd00b982ad49f64278ab27c7f5b954659fdbdfe45cea86d83eabc6419ae1d6787b173f7cbe79d7254dc3c6a21df25da065f8722b64868d18e9f18
-
Filesize
5.2MB
MD5ac5a7e38bc521f803155ed6572f66358
SHA124211915e029249509a7a1bcb332219d97cf635a
SHA2561a37d58950cc0d90e07ce1192ba490e15621b9c18a9aeaca10720c6aad25c39a
SHA5124a04339fc850d12fd46cfe11b99ecc9817e784e89e7f493b2ccbe773ebaa30c0585be56c771905d5b77700880f4971eab9ee461e3d115c1d365568d989f99d7d
-
Filesize
5.2MB
MD5dbd4e1df572996178be56de99cfc828c
SHA1bd66b9b392f9ec74c535022c3267f8dccf41acd4
SHA25671edc52e472f7aa9bf937df0651088be1cbc7efce69dbc56371cc0aacd379523
SHA512888087edee76d42dc92c5332090d7eca52de947eb3f8a904622965f377a905383a14470a71a4d74ac2cae70e826c87b5b1f3db87e78c6a6470444d49046ed55e
-
Filesize
5.2MB
MD59fad25ac61d11794c0a3d84fa6d94660
SHA13c84690b3949504d9e3d90c6da511be90cb41a64
SHA256277837099fad14a2ef8eb5bf57f7b5837cf1a0353936fc383136d7796e6fc1c4
SHA512e8e9a917c39c551783610ab1ef657c267cbdc6d5b78ffc179823272b37dd87a0dfa48d53124d18aeea106941112c19a0d5267096318a42d5a781ca853a4c70d2
-
Filesize
5.2MB
MD597f142583e745126d1fe997481ca70aa
SHA15c88ee743201b44f91e5d88feea232976cf20cb9
SHA256a397cc92f861ebb2c31f7536401a6b4ca390ed7bafb396909be15be1b6addb3f
SHA5121f8b1d4acd47847e33bff09768c1cb0faed07ace72acba1efda07ebf7e5a4d6072cadbb5939e8a0296cd594250a1fc6d576d8010501b544bdb30e1b97c97052c
-
Filesize
5.2MB
MD5bebc8a4d88e503160fc720b8272687ab
SHA1c3fd188bb43a4e4b6f54412417085306736543fe
SHA256246ebe86d35d469c3ccfe4e6122c4cf26098055762df8d2c31386d17c979cb67
SHA512b66af688fca3d22bd8434bf9e276e780546ded2f9fd3884dd3ed5b2a7df08c15f1a66f759970227107441612eb2bdec65bdba301cfdcaf8271a6a278962a5530
-
Filesize
5.2MB
MD58f93899e8311243843797e07ca34a101
SHA1f207ec5272dc28d198a60cbb1175bad87b64965e
SHA2567e004767f9a41dc92f9ae153e48d16a9ba8836a832b537dc0099601cc377d104
SHA512ebe7d726e38b8c66215a19a8f2bcc056345744355effc27d41cebddd51a7f54f4e2179d8ccc38861e2aab35b213392742e4ecf9bdf816c3b0ce2bb3fc2558f1d
-
Filesize
5.2MB
MD530c5977472d1eae505f28a05863d2cfa
SHA1ce458e32820f3b05576e035788d0bdf2a04e5e60
SHA256d83f5eaebe053f7bbdf1457f95d6f01bf391425df93ad490e1909eeaccf31ffa
SHA51258b185780de3c8f0f73b0ccafa52f9d67425444a5be40d7a4a57ac8d7a894f68904d64b162981176b521ce84da9a9fef67358404750a066b3a2d01343de31f94
-
Filesize
5.2MB
MD5883ce457b927a794dd5128c17b5ef2a5
SHA1f6901dca347ba5bbb77a7d45c43967f50b49a37b
SHA25622da9b0707dd3c973db96b73efd760aee2127350aa2f85bc2c6065a99b82a692
SHA512c90171ee65f1a1685e82ac174c18b12ce054861889662d6025aaa49166932ff34fb9bbe9bda4da49577f4c270d1b6a24a7ad01347ee457260183a16bea9c675c
-
Filesize
5.2MB
MD5e9199d8fbcbfdd71730a8d33a75d4634
SHA1dff319f96e4dad99aada558afcbe36280c47f72c
SHA25673a13ec1dc99d0c13f877c1d9a624126d2fe10fc60415fa2d535f54e55d14ed4
SHA51285022616cc2a9982d260564b07689ab05c1c6e0ee371ca2bea5b5450cf993961e1c290b12f2be95c8176320eb4b26a67cf3af34485dbc5261d39d0a16e13cc4e
-
Filesize
5.2MB
MD535693b40a14dd6de45cf8d40486d880f
SHA170636c7645fd928a01bcc8d523fbc9218bfa0a7d
SHA2569e42cb446c8e7bcf3330acd59a48ede47dddac2908223cd4e86ed2ef6f04584d
SHA5121649c4229fbe0ce69db37c5b3780ad4c11941413d41f41935e92a6215001e260901d12b1a6c898ff59df5fa016b6aca626171f01a19a87a5e99c817081c29f13
-
Filesize
5.2MB
MD5ffb08428b55099bb21a4447d9ffd7fb3
SHA1797f211ee1c58c592bf04ce4a2a949646ca08299
SHA256b0e4cc8fa83faab988ecd65469338befb82903d36800369d8ca8c60e1b0baad0
SHA512ab930cd064ddd5974a1f44d546c0eb4244e2628cff597923ce64085910174f3f890eff940bb782c87bce527c6407df1cc9e036d3e099da53e177b143ed16b894
-
Filesize
5.2MB
MD51c10f8f7c720c037f64c3dfd6daf0efb
SHA1b4181fa09118c3e657f25c5bee2dc99778e04ea3
SHA256128f0a7cb6373387d06d0762b54051768c7bd2b17dc30097197e2e04a4133db3
SHA512c337c70d58865d91e0c7f1431720dd1d6e07993cb06f291d0106316bcdcf62f492c2ef4a978c3210c3050fc21414245b7cbacd716ca5865e72191b11a2ccce4c
-
Filesize
5.2MB
MD5e1de8a04137465d442d863eb3788f356
SHA1bdfe78a8e434548c3b6d2b16b350f2b6899deda3
SHA2560777b3609e3df0d70107de18054ba2257d4b63cec6555fdc87fb69544bafea8b
SHA5129d1ad611f57735068106b6a65373739af438b9938948298418507d7a802a7b5d11019fa86f57d48a31570dae5f0bfcf90e8e09f882c06b3d95e4d75abb6157c1
-
Filesize
5.2MB
MD5c84f021b44f5c4e0c2d658dc045dccf3
SHA186609b786cf56cb0846a67a57359d19e6e4e8b5b
SHA25670e53b936512b7e8b71658c04e45a1cc4e10bd7a372a365806d1c8a5ebb92d8e
SHA512f8e72be81d8e9c2585d48c34049bf9ae83fa021617e583df6cc8b805dddf7e99c3d682c6952a08c80d90254964ef170526cbe494060c3559073afee467cadf70
-
Filesize
5.2MB
MD523a3f1e2dccf2e09bebf3f9832e32dec
SHA19aff7d2b53a26f607303dc25817757f49c1a42e5
SHA2561bfd838813610a3c8007614e7977fcaa952d9b4f338b4815fed22986970576fc
SHA5124b5fc68cb0ab83b479c004515dcf1912799ba2ba0b4c738dcf9e3778fd37104127b57a8085731892780bf6f847ddf1d805a04c5afe7748bcbeb2a687880a55a0
-
Filesize
5.2MB
MD5afd431cf99c0ba69460b2703f19e6878
SHA1e5a16689e2b6fd8e33dc5e86442c06c2e8f6de33
SHA256fb5921cec2d12278c97c30a40eceb9130773896480776e50aabb5eabdd60ec4e
SHA512ef9d219fd0fe64664af1899d66d70d3d55e8142f046ecb36a97ceeafd24c85c45c8aee6e57b04bdb16032392ee513fa757e681f35ae3b32da98aaf694878ce0d
-
Filesize
5.2MB
MD5567a262521d7004330f2e74db599832c
SHA1a76e453685f1be2dc02e1e2a4081d9d2075f41df
SHA256a8836d04a60e1f73b488326a629c7ac5a2cf5c094d36735c1bd12b2b0b01d597
SHA5123547d2c39304399d78cea93a427ca1fb90fe56bcc4fcdeadb0b4e118d9dbc8237257a3ba1b152786294a1b109dd6aaaec2691ade2ab6e1ec2d03dd0cc268116c
-
Filesize
5.2MB
MD5e4947d91d7bbbdf899ae4280122d4b92
SHA177036e69bc771725b31f20c0104868b7bf3642c5
SHA2569eeb9f101a4a566d740f299861d84e1e13b286a481c4b6678aea773c098ca71e
SHA5121e87772c26a7454db3ab42b60e1bf01b73cacda24ef18ebb955b7a8da16baceec8bff158b542df4d7dd74d2999521d1c41abf4e5b6b594c077b74ec84ee29241
-
Filesize
5.2MB
MD5187cc1e640254af0ecdd8e22e936ae42
SHA11b1857fd0e0d6cdc5fe447f21ad21e6c779c6521
SHA25689bffc27be74f8dd784289218bb728b0267df68b012246e5bcaccf98902e0d6d
SHA512f8136ba2620d5ba57a06c1f61a4fa299958ce682bf3b0749ab2b1bc1893c48b7601c63701cfe3a2b3786e74475dc3d9d4aac5c50cf2d2c6a720cf1078e56cf97
-
Filesize
5.2MB
MD5a896bde9655503f13bafd0ae9ff7cae6
SHA1def0304a8fe2a61270d067b2c8d38684a11353c7
SHA256379d63e626354ca7a1b0aacd90963a913920046d602e602b3bdbb818d1c3df85
SHA512e728358a080a9143bb7fa5783e098308cbff17c8cd48ca322f8a757175ee99d29343448361dac20e2baa5c075041b14b5105852f9e36692d4884f680496a7995
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB