Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-08-2024 11:48
General
-
Target
2024-08-06_2f4f0bf5cf4ef0d9391ff33afe3acb85_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2f4f0bf5cf4ef0d9391ff33afe3acb85
-
SHA1
4af2c2f180562a58fd61f7d881c868fea3771d73
-
SHA256
7f7935b5ac5f0d8ed1a649042a7c3c6625bb9ddb648b4525ef29c42b32f87099
-
SHA512
8c281f16bd192dab308a2ee0ba6944a5decbf4abc2ea2ec7dc62fad567699c534d5a8de1afe7c97a5a5d9d2107d7d05c866d288572a7ec463f9f55621a243615
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_2f4f0bf5cf4ef0d9391ff33afe3acb85_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_2f4f0bf5cf4ef0d9391ff33afe3acb85_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KyOdqtl.exeC:\Windows\System\KyOdqtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpgHOws.exeC:\Windows\System\HpgHOws.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLbAAmu.exeC:\Windows\System\qLbAAmu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VVvLAwa.exeC:\Windows\System\VVvLAwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kXwqjdl.exeC:\Windows\System\kXwqjdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJdiWiH.exeC:\Windows\System\PJdiWiH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLJVjkH.exeC:\Windows\System\JLJVjkH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjAiVub.exeC:\Windows\System\fjAiVub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kwltqRu.exeC:\Windows\System\kwltqRu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgpjezL.exeC:\Windows\System\jgpjezL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JxgYNPu.exeC:\Windows\System\JxgYNPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjYkmmi.exeC:\Windows\System\yjYkmmi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvqLgLw.exeC:\Windows\System\pvqLgLw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqMXtzH.exeC:\Windows\System\VqMXtzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fXOLvYf.exeC:\Windows\System\fXOLvYf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjIjzVF.exeC:\Windows\System\PjIjzVF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcoYiFF.exeC:\Windows\System\xcoYiFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mErPEAh.exeC:\Windows\System\mErPEAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pWWRImQ.exeC:\Windows\System\pWWRImQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIMdmqg.exeC:\Windows\System\CIMdmqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRHbCdx.exeC:\Windows\System\WRHbCdx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56cec71ee69287080bd5913ea195eafe4
SHA1b82b5f4159fd28f38ca3687a2619a7c99c650638
SHA256c7d05af819075ec678d47ec14df782542a16c202fb9a4c4ba057f0579a0e5c91
SHA512fd7b4f0377167fb20588df697dcd5a88b2cd0badc2394e8debb5798e9020d85d30852d8880f53e969a2339b6ad3bb4cdc0c8a7a1f1c507cf34bca86d98f82597
-
Filesize
5.2MB
MD5ebfe0f9a69db3f2130654b38cffced3a
SHA1638484ae47c74f7ede8b774a22e8b644c4df3827
SHA2568f01f2f7cbaeff75aa3ff5a3807a0fad783a5732a577a2c0f1c31c0a978d1db5
SHA5124f2b6912a9aa1b6ddf1467b18345cd6621e0e966b1ca34d974445c56060233e44e9973956634daf700baf506c1386fee92aa4b7bb6f4187482fe23a92775872c
-
Filesize
5.2MB
MD5c17d14e0a68fa356a85bf61179ed5c0c
SHA1fe1153b42e7a7d92ac18e6641c86ed4ff6e24466
SHA25677b9d0f52917141c0d21719f688addf81d78c4962b21cbbfa732e5a11e8a609b
SHA512dc2e7c8c599d3e09220185868540d673d719db0a0ef6d5488aeed466cd86ad98a6d5cd49e2aa38b63cc1b402becbd0359bbeaff1d2e3ab61b1058ee5ffa1fd51
-
Filesize
5.2MB
MD54708234acee6aa7f41a524ca9f530d6d
SHA1a8fb267dddce6d63403063ea2267f567d3eabe07
SHA2561596f5e7fab511f7348d68a2aaf9d47bdc1eecbe7ba6758e8e329ef2481a6334
SHA512fdc6fb53ae51f191245fdc588fcda18c822295bd1cb274db3a08229bf80b6f61ccafa5f840c1d57c92f2b33e643a070d6e97464a52cd1e9fa180eef9bb8b2576
-
Filesize
5.2MB
MD5bc37172b174b78f647f2bd01772fac08
SHA157a2780c5cac5a940dbb99ff5d263c6dd5916964
SHA25620a5311c9d6ffa3505f888934e2a1fc00fc4e2829cbcf411e5e25401cef5a6b8
SHA512bd3e1347334af29952c4deb0df9348aa312147b4c33563197918583fb91c446bda25789fa99c06a433831bc6e9583dbc23a26ae006547e8dcb7f674317115bb7
-
Filesize
5.2MB
MD5a0ac01548be1258a9713dd41253b51ab
SHA1a8af64b93e3739065ba32107cb09bb04b657acfc
SHA2565067afc8bbd84283385667d8b1140c9c077d852c783086d36e99a65205eb5476
SHA512118e3fbe437e654282a27432838997a537f46781314559c9cac5ab18f2ccf002a627ec9914a297e781e5b4bec5a65247542dc6ae8fbecc7a1ef51c5801689f8e
-
Filesize
5.2MB
MD5b8304d59024dcc007f20b8d13e879cd5
SHA1d09a2e5b626c8b4507346071feff9a0774b6b212
SHA256ef8a23210536333c03a8b7e36933fbb570d562944f8100edc636d720e5dcf065
SHA5126a81acc7dbd0aff03c8a45f76a2a827dd7d41f28426631796c59b00200c03d4cca6a707699c706ed29d618a05560cff4a4558bc96baa568e9daca801349df039
-
Filesize
5.2MB
MD52df0e936be2cfd00cf1f3eba68649630
SHA1b36d5f6a3e4770458713dedd0cafd4c6585c162c
SHA256e396620e9e5f56316f804f19cc63b819fa3a2c5dba311e8f38f333ef2c715fb7
SHA51281f01263b627885153818e317e294429148f9d7679ce798d6e3d6379cba596c8c59d7b718fb790739014b320fce00ac15e3407e1b84f664404851d2abb2d2efd
-
Filesize
5.2MB
MD528d28222c44bd0354f270daf7838c1ca
SHA11a65bb24e1d270627aeda07f06a95c13aab9307b
SHA256972e32d9efa231770c3b4e185da0cf4e61359ca2cbc202e712d5821140f04983
SHA51251632abd24ec098ed428d2455c0670306e1f03ef78cd6fc31e6cded2dc53d5a81a0d1b01418789ea5b65b9f7a33c5fb5556d546947f95cf2612fba9c847a5828
-
Filesize
5.2MB
MD50094ce5e31057948e0794154c5941a11
SHA13454dd8227838b219f78f0f2e9c09078bbfce98d
SHA25680d55f9880aa1731742895ffd0241f65077e5706f678364796cac1ef2f6c6b38
SHA51250a181a132922f2abdbd492698b5ee65c12f4d80b68b7255fb864209b8108a0a5ba33cd9da3362be9563e85e11aa685629bb1be5b6290e522f0ab7a29043f0cb
-
Filesize
5.2MB
MD5020497ab51cf1f0586729c9dae3ce919
SHA1c893633b06f0f1c3fdf963ff903d25a4c151177e
SHA256757de446b886ae1c1c4d535d5313d346d1a63b1b513792619eff7409df43430a
SHA512ed698d4e0ea2c3997e89a7b8cdaed24bbfb04ddbeddf9c8f61e89a095e7a72ed6181fa80e25f0a69c5ae0d069fb3ae0df2937635e69a03267215be225d3981bb
-
Filesize
5.2MB
MD57e33fe5e86767452d205bb39e901a250
SHA1d5b11edfe089e2beb2761424897f4b2ee30789e7
SHA256fc8f073222ea566a3cc5ddef11973908e8e52f374eb78f3cae4ac163a954aa67
SHA5124ab3a24a4069f03483b6e040c011b0aa19baeec8a8e839794e11f406943a5a281fa799e5cc09a4a9ca49a3fce2140eda09ef498b75289d21eb413b2d0c8b5bc7
-
Filesize
5.2MB
MD59b01942f047f23f4cb9a8cd9fe2f5e11
SHA13a22c68ed19106372a668d587e556c31b1f96486
SHA25683d292ff7d17d2078b72afa7f5b401a9eb0048eeef402087099a946ab6c1b7d5
SHA512548efc52e6495d1069f67a4e2241e00797517be50857809db2a47ae9f1d00984188fc76470c415adc60e99082624506bc107aba9368962df21f6373001b1d0b5
-
Filesize
5.2MB
MD517405e66388c4aa4b5a0e7813befc1a8
SHA1c15ef83e45d8fc3108bf6b816de1894f4c4e0b61
SHA256443254e0860f60e3e12068b91e674bbdf0bfffb1194074efdc6b732ec7aa04e6
SHA512e5fb3eef5e73e274cc86fe670887cec85d81c792f9f74c933a11e47673b16c8a3f784b95e9ae51d766f0f98c856c32590eba176983c71700c3426b9878c05f31
-
Filesize
5.2MB
MD58fd26746bbf05f5c5b0538a20d043a2b
SHA14aa965925d054648c028788294ca59076e660252
SHA256e57291001d76766c90514655aff0478cd8f6aa32daaa2b12b38caa3c2e95d725
SHA512766411e3a2b9547d8caf10c2935ae201f8849904daade52f5a539bc6ca12c0f7aa536c49642041af7e06da593b14a70ddce96c0b202113ff3a5be4dda612076f
-
Filesize
5.2MB
MD5ecf2302123d2f5b2f2cbea1908dbe828
SHA153e9967e6bda011479d218b0991372a95fe3b9f3
SHA256e7c949e08b7d6e1cdb5ea29bef420c67aca68841fa93feda577ea2ffed7fc647
SHA51203aaac9cdfa3dd8bf2cc6b5e2733e3009f8dd9dfa01d901d3dc80fd788be54eff88328559c2bea1501daa28db440ca4c97a07b586efd52fa6322deb117b03973
-
Filesize
5.2MB
MD55be6bdf75b39246a1dcf2b01994ee6fd
SHA13f544b61a0e9dea18744d1872e078ab3b9f9cec7
SHA256741eb649f286b2d5004c62db4626956473db976d7b9e72846e29883c3df65853
SHA512f862cdd33bcac9419847daf01482ae084943d26ab5f235d4881458e6c896d621044badb9046ae679cd8b2ac4431bca5727492b6a6f9b2b9e61fc13d1ab9c4cd0
-
Filesize
5.2MB
MD534fb22467fda120edc2cdd929af906ab
SHA126428a802ac98503fd58a65b3c4c79c9d522908e
SHA25661bf7e4fc1b848a1048489dd76de99c30e117e33295b8ef293abf289971e3347
SHA5127087ec97af6f6a10f1d9ac2a2a3ffa2baf506c50e438c6cf836e34d36e504fe3ade47a40c654cfec976956421236ce9d374334d05112fb1d3d650e10b1b5c82d
-
Filesize
5.2MB
MD5a270e975ee6905dd7cba70815591b011
SHA15aa2bacba1207d7a06f8b8da038f7170f83f759a
SHA256679a0265a7927a6809c10bfeb5e6c69c7f064e05a15f6b45dbff62548b918314
SHA512b9828ab08eaa2aca9af0bd9e259e24a7d4f82bd1e02cbda4c676df28558194bf0421da4fa1b3e674220403ad39d5d7566d558357dbceaeed8c9c8346e2ea6a63
-
Filesize
5.2MB
MD5f2798c1b401f05a9eea9c712ceda60c8
SHA1ea42a77fec2e5beb98d242e0003b7e047fd494a2
SHA2564ef500a2da652b5696b86966c6604ef70502c2507ed0d32688af932e05be4226
SHA512954aa80327e4fd9a95ec9aa83444b4c943a3f4e558265dc8324985c8da5790c93d0bb32d6d614263f8e6416c0819f34fa0c60f3c1d0d878434e453a1cd32a41f
-
Filesize
5.2MB
MD51c1b40ff38b54c18e22c635ba9457c01
SHA16ec318458094f7062b2a6a31a0b6b886f53b1269
SHA256f128cf2ab7013ad7527fc0ea0b10ee88e7ef624e3b0b7d8bd0d1fe9217cbdabf
SHA5124b7f8ffb854911ca71722c1a32cbeb0511c0a9854c865e5d7af292c0568707b810bc0a7ea6beabd057bd9b129db2aa0c22440d40df4ef0eb7ea71083edf332ac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB