Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/08/2024, 16:26
General
-
Target
2024-08-29_42caf276ea16047308a3ab558f2e3b63_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
42caf276ea16047308a3ab558f2e3b63
-
SHA1
71242578289d232270728ee988999a98c819e56f
-
SHA256
32015a889671dae053521b9c35923950c13038c742edbc940e3f94c30f4d0cd0
-
SHA512
bcee8e0e2592e22fc0c25879a090e75e2a13a4314ace257fe701e949712b79321cc85509c9520ad37b1060b1af96d024899edd7df70b46f027592ccaedd33033
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lU2:T+q56utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_42caf276ea16047308a3ab558f2e3b63_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_42caf276ea16047308a3ab558f2e3b63_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YiViXVR.exeC:\Windows\System\YiViXVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HURQCdt.exeC:\Windows\System\HURQCdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FiqCEvH.exeC:\Windows\System\FiqCEvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCTYmLj.exeC:\Windows\System\LCTYmLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MkFyZZQ.exeC:\Windows\System\MkFyZZQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SkFYGRk.exeC:\Windows\System\SkFYGRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piIJuPE.exeC:\Windows\System\piIJuPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMqpNjB.exeC:\Windows\System\FMqpNjB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUOkVCd.exeC:\Windows\System\DUOkVCd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HiGpkmR.exeC:\Windows\System\HiGpkmR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piIDQZe.exeC:\Windows\System\piIDQZe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sgNHtfE.exeC:\Windows\System\sgNHtfE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQPEZqa.exeC:\Windows\System\eQPEZqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pyADYyU.exeC:\Windows\System\pyADYyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ggxDPUj.exeC:\Windows\System\ggxDPUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yndTDFQ.exeC:\Windows\System\yndTDFQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uFbCqyH.exeC:\Windows\System\uFbCqyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjbuQgt.exeC:\Windows\System\LjbuQgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNmMWjp.exeC:\Windows\System\jNmMWjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zqNbBYY.exeC:\Windows\System\zqNbBYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnxaSQF.exeC:\Windows\System\MnxaSQF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD507ec56a0da8b28ce88588c822a8bac52
SHA166c4570c853e145806e55f93076750043aa3dd77
SHA256f0ee4a6361ec82f558a9c24f1fde723620f4e2000cabed7cdbb54e5fd8a9b17a
SHA5129bc02f2e1043470bb8961a72ee75aebab05637b492d87dcf1ad2996b7a4a1676dfe119486443558e84c58261024a168c4e283ce485d354f26b8511687b6cc863
-
Filesize
5.9MB
MD563550f5792eff71d7cac8e10c52f21fa
SHA13cf5b15298d6792ea11b6858be74e89c026ddff9
SHA2569034960557aaece35a43ee9335b71d987c4321fd70aaa2496bf5f7136ce8f1dc
SHA512c94db5d1002b24d725ae0a10abb1076885890effb5ae1785ccd3d56233c52af571e0ea3327273fe23825577697fbf26502374924eda6ccdc72b55cc529fe555f
-
Filesize
5.9MB
MD5142793c75391f5d23aac2b61564c1247
SHA1c2e4b2e0bf71dea4a60784fe39f2d90547989a85
SHA2561a7441a3e68ef0abdce658232bbf1af21332b21b7416f63006607a3df79ba173
SHA5120720606d3aa57922383bbba15219a9aeca9ebc30919b6473485073cb55b1dc9d9d5eae463adbedcd5310eefc735e6235d7edcc5fcf272d1f35812401434d435d
-
Filesize
5.9MB
MD554161e43f7c68e98bc6342e58a9a2a7c
SHA1e001477ba36ced8bec2d4a5a67a8f943adf8011e
SHA256f66ee24cb4196fec3a6be73befeb90a78e1a4f98aa28f22920f88d957fcc06d0
SHA512cffb387c2321deddc4c17b56b78dfffd87f60b9e09901e56ed550c82b3264111745e086e7066739fab7b743805e2dd80bb7c8184357f45568643683cd19eab90
-
Filesize
5.9MB
MD55f1ff8058644ff0393dfc048d5b991c6
SHA1bd30e771c5580e4d232986d83a394b1c4b530e08
SHA256654680da1fb8db56a3124528649dd12908c899622b1aca9042b59a8836dbc7fc
SHA5120d6e49cb142ac1fe374c4541a0c6348700736cc793d4915095df31b264e68cb4e4a81d9bbff906ad202f52a4d92a87dac804ead654e9e016f11e0899b7e905fb
-
Filesize
5.9MB
MD50d4cadfd8721f9e82d98ac645e5e8a48
SHA1c957be00a34ee881a4f9b3e14da7cfc4dd89e8c5
SHA256ae4a39c2093f1a3211030a6283a9648b95612bc65734bfe5fcb1cf3720eb1fb3
SHA51289c35069d033fd62325cf2d4ed7131c701eac3983c58f2d814992b3296eef99023bfd3093242f99bb7e490b3f32da154ac1aff61d33dcd7619001d8c21f4947a
-
Filesize
5.9MB
MD585765c06636636bd4964b500db47592d
SHA1ca38136d562fc09e97523f17b0e07fce87053976
SHA256475851c5605034d812abcf7f3cf6d2ad913aa4de724c044b5b2d54469aba9ac4
SHA51205a30adddc088414cf6e03257b55487d7bc2c37766bad2ea7196f85b96d6270d04a5320f26534f3b7f51ad8bc39cb76222f9e87f339c4e469287be80fca7feb3
-
Filesize
5.9MB
MD5f040454c566fa7a72d67e8dd5bd8e634
SHA13a32afacd68c6b32d9bc13c391a3e04dab61df0f
SHA2561dc521821a79f054731e65ccadf3306d224ab3d222f43bc93885a096070fcdc3
SHA5129196daf93c9062aef8fe63779dec87e650fe9875237f6ab5db0fc5b08e8d8dd5c6e64c876bdb9350ef345695eca419e2cfa74f3386d8791e3294980d1783af78
-
Filesize
5.9MB
MD5c0405689f253cee13d273df31dbb67b9
SHA19eb127868b44ca0d8f1d3e296a9154030264e0d8
SHA25670295bdd38c7717b8200530a102f75bccf8234607a3c16cb8883d6a15ef05f0a
SHA512ca4af7e66f7d25645904cd0d80d9b3fbfb4b17c6da1f0200ec20855e1c7fb2bb9dc8fbceb6c6459f9cba17ef90f1471bc137762a2f4feb43fa134cc4b8a5d2f4
-
Filesize
5.9MB
MD55ba8db69a3c9a292a7aadabdff289863
SHA1201e015d4cbc8d7ac1c01a74f92028ecb5d37f51
SHA2561ba9a63e78ade42c8d2bcfbde21b2bc247028aeb11eacf9df7422a29bb1113f0
SHA512ff2168f21cb101ee3cb8267425750888aa8040a836bd2e2ddfdb627aefdc7c659b7a4696a551e665e13ea77ba830b0d9467f70e8f0e2ba6d4d960054fed47893
-
Filesize
5.9MB
MD54eaa5f929f961237375e8ac3729bf2ae
SHA1c7c155e854feb84eff377481871c4bb9a1d20171
SHA256620d0403ba1969461ecce81f86dd0ca57f2752cbed57723bc52d8e98b2633c8b
SHA512e04679055d296fc7ee700c2676f1dc3d5b451a5359a4b1d5c8aa50d5d92ca551ed617be9e3459aca8406d38697156fe205cc4da4f42a8eacd1cadd65719313e4
-
Filesize
5.9MB
MD56a34ca5a77747becf2e8996955a02b9c
SHA11fbef9ab7c2f2326e8d1c1eedac27e1f3395cf71
SHA256a956a97a041d41ad7601e5c661d4f484fdb770d19483d8e3c79afc7d7ec3acd3
SHA512ccde7793627c1e05a2e33f593bfa04b6acd336b6a65598600a69d8167c469c6a4dc8c1bb3924fed8726f180aba7fabca78af0480b31ece24a495651889b2bded
-
Filesize
5.9MB
MD59ffd0fe84e71bc0c1b7264de7d4f6b86
SHA1eaa91166ca46749654b495f68a10f3a53dcdf19c
SHA256376541c071a93f4c6ecb6889d680688f90f0d9cfd334c20b75edc0725da50b2d
SHA512351d28843e27d0730e47a3af0229c86869cacdc8c706f632423a0df52b46cfb14afff205adf4195bd48538ad9ff6417be5fcc5ecc3c506fc50ade8c83bca1f50
-
Filesize
5.9MB
MD5c6c01302ef2233bdabce7893bafeb411
SHA1d8db2bf036b54b356729cd8f4e1b588aaa2adae1
SHA2561080ecca0e0414b58cca0365e4c5abccfdaac640ace20866e8f6557e772fd868
SHA5127af68acc27cf3dab8589840e0cb322339eb79863ec80e8d4a04ee2dc8e5ba6944005ad9c8eff1ab5fec77f2e5dc8480f5c20bddc0409fdaa21f06dd9282ad7a2
-
Filesize
5.9MB
MD5b4316c547939fc313f4e42f85934266b
SHA1ebf5a148333d008d365650708014d58fca5323ba
SHA256b557d8ff5f4020003906e3e7ac583459690ff613ede291dd19035a6da9b3ce54
SHA512f102ad1e1a9c4aff77487833329af2238d7344b878f2c2426a9508454e38600cbca10676a9b4fb06783c50d7b603273056e0f34e40d3473131352417f087a1fa
-
Filesize
5.9MB
MD569cb67883f6a0d6e45f22dd8aa3c0aa3
SHA1019071139169d9de1883093f29635006b727467a
SHA256d28642cf4127bac99ec42de15511286016a42e3cc98356f9598427b22a0a6f7a
SHA51280dc53b0e7d8b063009a9be5cfb59068020c1ca21fb6409d3924ed7b1267bdadd8a3c17505cfaf55d3c717ceac8aab96e3dcf01e191779136b48cd46522319b5
-
Filesize
5.9MB
MD5f0e61800f35217a6a7a988bfb16eca34
SHA1ff6ce31e0d08e1ad5344b5301275b75b39f1a1f7
SHA256d38e46b82fd4061ac3590791bbf40cb5026ce47a0ec09579b3160544cd9a1ca1
SHA5124c95bd580f89b4cb31d0c227aaa7d4d5da51f833f3220bdc725734107bd0bc12fbf589d138ac64f4404cdf387b48aec36420e87c7baffd53eed94d05a26a7b57
-
Filesize
5.9MB
MD507e5d2b37160783e627137e5c66b9971
SHA1b2c6f5d14ffe509ff06bbe56be1dbfb08165b795
SHA256ca54e04bf9669979fa1946b156ebe4fecc18d0b6831a25f114e462a17742234e
SHA512e82cfa1a1db4e4ce7a4932677177dc927a0a5312eb4caf8eb7b1e29b2859aa94d466c094b2bcd1f6c08dfae73cf5b636d9244bfdcb5b630a1599fa5d10663a5c
-
Filesize
5.9MB
MD5ce024aada92035ea995f8b92078d6d60
SHA1fe54394f5e90fc267274cba3d6a4e604c28e05f5
SHA2564eedce6f741236f55ee6a1e830c236cf2f0dc357ecdf46a6162f3c5fdc80bdf7
SHA51287fd5969554e027592e3b5cdaae899a1dd5af8150258be706f2b45e492749c3c0d87e6b471b05959b274d6ca499628aaded441d3b5f21d9895d95690c78df240
-
Filesize
5.9MB
MD5385389d5da3d42d83559b3e0778147db
SHA12c9820057f3bfef76bd9ffa0b0ae4414b71ef062
SHA25681c52b187b5cefb675ed432f70b89d113f1be51af184a42de41c0b4158c7a3b0
SHA5126359d2e7b836976e28b70aed7177c08faa3b22959adcca424072e8269a2fe14f198a432f09535289354be15cb1adf0c29e2dafc0e8e6307033d6f9500cc85f71
-
Filesize
5.9MB
MD5f173807fad2260fbc4a691fde71cffc2
SHA14e6461edf36c3227f431320d30ecbb38f70dd7cc
SHA2568cf9a1d5c33e0f6fa07fb52ba418ebd5f951c59d2a7406199be8c456947ae4a8
SHA512e63bf7f7b7f52f55c87ef83640aa5a9ff09cf94a5e20b70dadf65b4740632cb8698e99387092c54763a36ec2e7e138c8f557a96d783b790beff70048ea1956c3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB