Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-08-2024 09:42
General
-
Target
2024-08-05_131568df16bb60335a521a2966c31765_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
131568df16bb60335a521a2966c31765
-
SHA1
e5acf8fad4648435358d44b2702a18198b343716
-
SHA256
d3b9b662a77b876b5ead611b557944d56e057079cf5f0a040f27c88350e7d76b
-
SHA512
fd312ed8a1c87a5d05c841f4a371bef3a28b47f2f1b2a1410b2fccd5ecb4926e27772c1fadb0f4a6baa379c5070598a51f72949ce34c36b0a53973daa2d2db4c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_131568df16bb60335a521a2966c31765_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_131568df16bb60335a521a2966c31765_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DwtIKQW.exeC:\Windows\System\DwtIKQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\osprojR.exeC:\Windows\System\osprojR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJTZKUA.exeC:\Windows\System\eJTZKUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbHgICc.exeC:\Windows\System\bbHgICc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDXthua.exeC:\Windows\System\XDXthua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aclkENp.exeC:\Windows\System\aclkENp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFjRLTM.exeC:\Windows\System\oFjRLTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PpzXOls.exeC:\Windows\System\PpzXOls.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLcQhIL.exeC:\Windows\System\qLcQhIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfKwBYU.exeC:\Windows\System\QfKwBYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhaeaFa.exeC:\Windows\System\qhaeaFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaUztdK.exeC:\Windows\System\KaUztdK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NpMHWgk.exeC:\Windows\System\NpMHWgk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lAuJfST.exeC:\Windows\System\lAuJfST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\skBKIrb.exeC:\Windows\System\skBKIrb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eftiaHz.exeC:\Windows\System\eftiaHz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rcleDBE.exeC:\Windows\System\rcleDBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLSJsws.exeC:\Windows\System\GLSJsws.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwYHevf.exeC:\Windows\System\hwYHevf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aglYRap.exeC:\Windows\System\aglYRap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzLBfCs.exeC:\Windows\System\WzLBfCs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d064ed0fc4efa41c0b4675ea35e17b09
SHA15676a70c1788f70e31e1ffd58c473fec26156a2f
SHA25602622b43b24b4bf7a2d63b2a7cc94a933935e17287c02fc09c5195aba518e342
SHA512ccbef0265de41d5b34aa35d7d993726940f7df600a73263c1dd1f40ab01f9349703f557a98ea404ef32e1ce6369eba5ae8ed776071eaa44885a7930b21634210
-
Filesize
5.2MB
MD5d7fed680c013c09172c4e034e6e4ddb2
SHA12063cf3d10664f528f9f3685bfedaa19ed1642a2
SHA25679e240e9be761d61b7ab0cfebefeefdfb91a38880365fe582a632978cc1e429d
SHA5129c36073185c38352c86cd3706ac299252501a3cc5f04e945bd56f119e9b748cc59b4df3d6ad4558d16299adb2b6d6be03a57be112e46d218e1527a73732ca844
-
Filesize
5.2MB
MD5b5831ff291f86657b0b193b0a4e7e55e
SHA1252e54e44127b5102efcd14ce9aa6fa266219fff
SHA2561c3a1e688b5e3daf4a1bfc1ff1dff6deb760a93f5e6834bd9c04a71e4eb3b542
SHA5120b3e0512ce0d818965c9e185f5becea6132410cbba7ab3cfe62f615a3ff404dcaebe5846935c139b4ea28be5705f0eb3fac7db6a04e09e3454024d8a5f0222e7
-
Filesize
5.2MB
MD5eb551efa2c2b1dcb3e9d39a1baecc850
SHA19596e64e12a8e63bf2138faffacd57637f1de4b7
SHA25621fbf6324adf820ca0b069b621701cbb1f4a1318e54d88fc9352d4d4c2bf8209
SHA51264d4b9bf0eccf941d097f8a743d0c5c62e35fed1bddfce0660aeb35a3e276d332d5b0a12b5328ec9c6bc79039b985bfb99310f067fdad692de44fd34e3625d91
-
Filesize
5.2MB
MD5f2392b61f1d559c280b7005a941562fb
SHA15ea3431c6119fff5ef2b0979f7d358abdafa6d93
SHA2567c86982f0eaf87a3a3a43ef887fb425759159ad5b387521cc5b97bd8316fe95b
SHA5128374cd5fa07618824c03562fb2999860ca1e13cefaa18ead8f2ec1941b7e64b4e8d0567904a2b5a3bd29972bf41cc4b3a3e97d48ace94cdfee7638b90f34d001
-
Filesize
5.2MB
MD50222a06bf7657585695f1e2cbd3d820a
SHA13ddcb0315519bcbf62b737ac078150849d00eb86
SHA2567d8a498a97c3e713b3e0155442ecffb7a7cdbfc4c8cc692cf0cfa8796e412644
SHA512cf5356c422f584aeb49625f0d8fc18edc90566465245415b028cb480097059a7eeb182b67712beff5d379b97025b2562634104d97065890ce638e14b76d85c6e
-
Filesize
5.2MB
MD5e48b4365db86e91f88fd88a674687229
SHA1783b57dab0e977f77e8e6ab1afb4e26aed7cd0ee
SHA25653566d6f8075edffd894e8956d1a5f098b3bbe31bb415bd66624f4cfe45c0576
SHA5121d6691b834dad452f6bd13880b10615b2872f43bf512c0a81f34d7c5b13d4b62f91a1fa9077dccec75c4fc78c2afac7b0efaaf556af546ff8a52703853103579
-
Filesize
5.2MB
MD5e9c2fda695559a5caff19118460199f7
SHA133e2d5fde0e8798c812db631d9ad7aa4e2fd4f5b
SHA256790ba0fc81c0c899fd6b4db10ac935d5effaf0d45a06b3cd2bcbc043f349f2e0
SHA512e32e10c822e9a7abdab517683a35e225927cbecce9549b7577e25613557d717e119404b055d79bb60f1eac57b1316351c42e1378b9a15f8af85722c741f049de
-
Filesize
5.2MB
MD523cc1d6b214177d9bffb5aea7d84a09e
SHA15b501d6b6d8e0bc46e65dc7d577850e03f4dbbe9
SHA2568bd25b1f83b4ec40f0131dcef2315a5ea792f9d90f4b7a427c8acc819da0d4fe
SHA51210790fbe7cef487b8d80456580b4bfda14b4ab48437f5691256b0ede67727cc9649a7b04f60624a5974a324b949eed381160f9fdbc32f4b725cf77f55e13ff56
-
Filesize
5.2MB
MD56e3bd4b80510755709c3638bbd9f4238
SHA12f200d7016b6c069fbed917a205a67e9285bdc38
SHA2560b06eaf1b0333afa1f6d17d992e2c603d743a2b6259a771a7ac8ebc67582dcfd
SHA51271edcac9d3fa840ba7689edddb6c510cb6b80103f90eeaaa653675ded8ae25b6508be1ddfa13fbe07a541c84a71cdca7b5d62060d5ef76da1af806e5d5317b0c
-
Filesize
5.2MB
MD578f72e71cc9b79b55b706b3d89ccdbcf
SHA1d84959c6240fb4bcd469d6140e2f9fd913ed386d
SHA25696f0decdd9721304b9d1d7629731952311960eb521a8e778199e3ea3c972e0da
SHA51293dec7ae3469df90eb075d4a20eff59cad1e7fdbe64cc43acc67ea76e2bbc6cef9f3e7f6eb329aee9778707e2693d88cdf833f2065f5e64def15509cf62b2841
-
Filesize
5.2MB
MD5f393a40e01dd7424782e7c2274c011dd
SHA1827a0e5278583fa51de41cfea69b4e4574a306ad
SHA256ea1e4564f9fef695f95c693eb811c59a9facf63c36aaa9aab674561e34290770
SHA5127bd08d8ce9a81850138817d771969d64a89d16aa38d14ca89e4fa397930964b5e1fb9661b7bef66d111af9d6c11adb8d9e46c67fcce1543a92da64db128c7aa7
-
Filesize
5.2MB
MD525410d7a8841d1a826fca4aaf7d19b6d
SHA1426c06911e0f4eb59e954808cbd7a1951721b7be
SHA256c3c3e2d9772cd58664676d82a71f005680949d2ca10c38852b5e488aef3334e7
SHA512ef6323ad2efe1d9e3ae517b245360eb2dc53eea5872cc7a1f9f01cb0105f23d5bdd351e07fc9cb3d69d30c5222d603ab12a041dea7f4eb668c2c5e962168b7b2
-
Filesize
5.2MB
MD592ce01e98675dd1381f188e1986ef6ae
SHA193e3e0fbea87635992959bf71bcd3058ce432829
SHA256bcd69ee9c4236e54f9ae51b0118b61dc349df8214070243a5e320ae9e22f8b96
SHA5124fa383377c6bb7e0e91a011306872cfe26cbba678a95ec16b9be51b49935b2de0e5a586be67cc69db30a1a60f29cbdc3a35befea9e10611be7b9de2c51a06dc2
-
Filesize
5.2MB
MD5592ec735b7e0a980f8627b524a5a34b4
SHA1ef82e54201a5f92e420c9b9595e98240a3e666b4
SHA25691ba23ef273c97ab1a7667b7e6aa0a3f3467ee6be2c23bd7ece9290fe4de9212
SHA512d1d03631f22e414b44f20c904ca8dd322cc59d6e824fba5fc0ac774d02fea159fb85d642bfcd61ea67334f19e915df528bce3e15a5fad08937acb2abfb88f3a1
-
Filesize
5.2MB
MD5347d621c37a1691eeb3d3d9b822566c5
SHA1da05057e55e2834a5be46fdf4d057bcba42367f3
SHA256daf3cfe0ce56dc13956de8b7ae2a64a991aa955e000da22d2a06ebee25519143
SHA512d9ef644b9d808fb07f1cdf5fd2ba930fb7fd906ad7eb84030488197f68bbc4ecb2b5f15831e69dc046fa2d64571f640b55997c789b8a4f7a27619c9361401e79
-
Filesize
5.2MB
MD5e55aa369c3e09dc62a65111229a8b019
SHA1f7abab7357cbfaa9d8bb977c480bcf11fadaf825
SHA256606f3f053ef98ea91c9ccb58b14f954cc39e1393d90c39039f788c6854b5c487
SHA512680d9616b73f08ccf173b0737587026ffdc76539eeeb7096a7900a596e780f9332ab4d244f1ae462285c1a5d094d18162c0b3c0f1a0765f7684a59805e012ad0
-
Filesize
5.2MB
MD555d79823a990306327e5e039db84069d
SHA1a4bad9a0e0a6e831e2f3bea83e528cd5ff57753b
SHA2561ee41e98aae622448952177d3443592f630de41d46b48f63986079dd8cde8b0e
SHA512e7ca288eeb14a45929a90446fa5855a8a6010ae07e974b84eb8985db0518a875d8398e13e560400da7c1dfc576e6b63d635cc337c7453e1fbf3e4fe862fb0b2e
-
Filesize
5.2MB
MD585170fe162e3624d2e458d3d78f3f2e3
SHA1cbc24c43e8de2eee18cd6a604adec27d1abfa964
SHA2567685339ddaad451f1c115c2f38a4a253d00fae4eaf6a21be41b83493c71190d7
SHA512a99777de6b9435ecb1cb7b8f7ad352ba4088c038cbccd06907f1c052dc497d9c62d005946392d6c9cb999cfd5f3101843160db79270654dedf54c68bb1317910
-
Filesize
5.2MB
MD5e1238d34696ca8189fbb714b7f2dd8c6
SHA1bd7f3eccdcbca1299aaa08a3faea8c16bf5b6ab1
SHA2564687167f120dd2faf14b07694db5e7f00e56d5f0b042e95440495e5e19fef1b3
SHA512f2fa04c0f08a0ae5cfc5721fa9f368e08d0952ae7040f0bc0b48e25648ff23f5e0e3b44db19f60d079dd759397776be1ddd1c70e23c0efe6bbe89196eec51a1c
-
Filesize
5.2MB
MD53f2801a44ebb830493018a37a74f39b7
SHA15eb1f458e1c4cf6000fddcf9112348a86eedf142
SHA2566763610e49a08b67b34a26181711a0ae5ad88a921b9e3bfbdcb72dc2ce1e2fd4
SHA512aba79fc1392fa3ff74b9cd58f961f0c446465be516df1d44bff9cf6b52f108cc0ed7ac3e75c7aba2d64d2ae373790d226718648edb422d659b1c0e060f46d399
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB