Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 00:34
General
-
Target
2024-09-01_90b3bb47335961e8a536b53b3680a036_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
90b3bb47335961e8a536b53b3680a036
-
SHA1
4179f823c3c31b127a469249dbd2237cd3bb9bd8
-
SHA256
6bf733deece8372ee2ac329909be55e49907131549401627841690e811e369aa
-
SHA512
328cad8a5393e3faf379273221e0b9d8f916d9efd1a7c4324d5ad384fd890297a3e16aeb1a786baefebefc060a883e84dd5c649def500bf8fbcd84d27bff461d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_90b3bb47335961e8a536b53b3680a036_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_90b3bb47335961e8a536b53b3680a036_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GmWUNiO.exeC:\Windows\System\GmWUNiO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spGVbxI.exeC:\Windows\System\spGVbxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwLzsQT.exeC:\Windows\System\gwLzsQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SeWwwwU.exeC:\Windows\System\SeWwwwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sGphxvA.exeC:\Windows\System\sGphxvA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkQedUy.exeC:\Windows\System\NkQedUy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjWIutC.exeC:\Windows\System\rjWIutC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aCUwQSD.exeC:\Windows\System\aCUwQSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzoHwXS.exeC:\Windows\System\fzoHwXS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MSxkGTd.exeC:\Windows\System\MSxkGTd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zAjOqSG.exeC:\Windows\System\zAjOqSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HnWAjOl.exeC:\Windows\System\HnWAjOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtUCzRk.exeC:\Windows\System\KtUCzRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SgrWnnH.exeC:\Windows\System\SgrWnnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xukCJEu.exeC:\Windows\System\xukCJEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqFQjIu.exeC:\Windows\System\RqFQjIu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNjMyly.exeC:\Windows\System\jNjMyly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HiGXTeW.exeC:\Windows\System\HiGXTeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bSTXVTZ.exeC:\Windows\System\bSTXVTZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWWjsYL.exeC:\Windows\System\GWWjsYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzLwYIp.exeC:\Windows\System\UzLwYIp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a30ab631b8b9f181aa801ad660f7e03f
SHA1274522c62243e778db1905adb45d3a8055320aea
SHA256a13ebb2d0d3e091eeddc70bbe9ffa7b98b52c973ff5fedd9b9f6b7d9c8722227
SHA512ce53d5f7ca9103791340b63816b1a91d0cfd911d50726854775d75bb0cad72ca3845ba39d654e5840c39716d2a76813b03d9cd76b8fffeffc85777d13f6ba786
-
Filesize
5.2MB
MD5576c6ce98796397e5805ce2b46510620
SHA19298a0db7fec211b3768f59ca22eb2bf360bdb2b
SHA25606ecc4e2d9e252a9ed1dc4c77eaaf0097108f532bc31e55d970546f98b9f78e8
SHA512829d40acee5af37e2369615dbc8c2ba8233c7c4861d04e8ab5309835d3b08d963f2cbabc1ea0e1a1677f9fd4daa731791da500265032284e8d718d931af012ec
-
Filesize
5.2MB
MD5c11055acacee222e6ea391157c07fd5a
SHA1c84657a4126ca9cd61d741eb838b6c02531864e4
SHA25645ce98c12097ae03488cdb97217f8e2a7331ccdf58e330726a0478150aff194e
SHA512111f24891e7f92e0e44727a33922cb1092ee1937ca53b6135b599f98ca7eeeefe1d688eb2f01ffd9398bbb16525711fd10643000d99b50c1ee7a91e889955e42
-
Filesize
5.2MB
MD5f123902197438bd78d98a02360df40c3
SHA19e94b957b1265e10ac3523fa409ee89564a772ac
SHA256228da10bc82569eb7cf559c15ce75e97f2e91af88c4a385c4793c5a7f7301609
SHA512214d933b122b53c4848a15870057849aaffcbcf09921124c4b04825d6bbbb84b826633403010d1f7531cf35bc42a7c5dcb617f6157d289e225d8ddef1995caf1
-
Filesize
5.2MB
MD54158b106fcec137d1bbf4f6192696f66
SHA1403e7a6c3b1362f0cdeea3fdb2dd8e21428718fc
SHA25686a11cbfd0b13a79be72d9c692277d24faf44818fdabff1aad411276d63309c6
SHA512ec0023594128a51b8551a9c66cdc79be14d57487371461ba9c02b8761c28757021271cc51b125eec5950e3c84c04f151a1d9e128e5c288786a505066f2c1646e
-
Filesize
5.2MB
MD5cfaa845554a7d0d5fdee85566adfe69f
SHA195c41364cfe73fecc140c5af4a9147d19510b683
SHA2568a97e4c21ea56eabb987238370b51590a20b909eba999600e0521a396c5288e3
SHA5123a15ffd4bcde29f028ad7270ee549765a2217a76497c145602314ed17ed4a1bb67b7547cff28a53e872e9f0ae067d47466b387f4a9622c5e80c82321f9565dfc
-
Filesize
5.2MB
MD5315f79822c2d73177f50facab63885c8
SHA131b4241e2efcc8b552b7803b2b8c4203efe58698
SHA25601bc2910ec139657820c07b51c5bb35b0e0f50bfa14e2a3f4c8312f6e2ea0469
SHA512996fa9a1eae08e69583539e0f26c932e776c7e68f1627b1bc4e47081a952d987e9204c22f166c598ec48e444c69f241281c84bbc62ddb8bfc0b2d0b79d672eb2
-
Filesize
5.2MB
MD501256d6cf46870472af506043df98b69
SHA1c64763d2a8b0cb239e1c61ee07f0254e57326a81
SHA2568413b77a01023620fe5b198dbb8743b44d02b0a92207c3b235ff37ea7fae3db2
SHA512e167c543f7132904a3f1d6d8e78c02a45ab1c96879ccda2001592cb798fa757d992a5b3687b859770aa2f835cc61d31bb0304ba7d9923cc2bc7cf668d69b7c43
-
Filesize
5.2MB
MD5bdff8ff2c5926285819dcf6fb88e3b8c
SHA1adaa7ff73b8e31280011e699fcecadc368ef3b0b
SHA2567ff3a18cc806145ad7d3335913b42177948b3630cbad30d7f185bf1a2fc9a39e
SHA512d80091e8acdd577d2ab0776f887ed8970c36478c28f9701ca931573f5f65b1fe79074914df8f9ffb457066407d8cbf2a108c8600b9333f58aeb5fc53cbb57af8
-
Filesize
5.2MB
MD533a0b9c53fb1b2318514157ac973384f
SHA192ea8880e45974197a2719deceb0f9bf01112dfb
SHA25676e131a011ad1fe1fd7547e972cb34d9eec08f8738aba6068ef1e1e254257879
SHA512897356306a7e6541dd1b37ed7748e85c55e15643c5b61f7107bad53d49bdfdbb833a2717800e37225b5cb0ac6199575760993c8361d4fe36d69a21c848154455
-
Filesize
5.2MB
MD5e4140cad9a6abebda716abe59caf811c
SHA184b7c7506b9dffc6913479128523016b18f086d3
SHA25691f8e5f76a62956f9c16d61fd2de5056058cabd56ff944caa111e6882ba2341a
SHA5120243015ab6b5134fdd676ab6bbe03f9c8944d25a1aeab9ccf4357b549e658c2e3853865d9a0e77eb22229065980dafa5340799e93a574378884cb817a6e816b1
-
Filesize
5.2MB
MD59bf91f31ae889d98c36c8594767efd67
SHA1135382daba86b765936e964b1d4434ce80343675
SHA256fce6c7f545cd17ac46d1fa464cb94655f7cd218bb54856b6120856f304b7c661
SHA512122a6b74c6efd65852dd0f334267ff18c9aca1e2e0500023389ed60cb4915d46bc735f268acac392c5bce37b6a18281e6d204aa6e4894ecc39e65b385e2f1e07
-
Filesize
5.2MB
MD5c38522d689a976e512f2c6bebd2a4b40
SHA11bd376b3dc004dce38c8ccf7b0b1fd15d0301dd7
SHA25640b2f6ce0f949ecccb502b74b3cb684b28c9c86bfd1a46e550266739e51bc787
SHA512c9bbaf1a1d51abfb989c542a93e7236ffa7678c5fe93e520d7784167a1475dd0673dba4692c1521f05d9a951ebf140ee31457a142e008e64a465c2d5380aec75
-
Filesize
5.2MB
MD59935679e751a0ccbafd00952d2f7f9e0
SHA160804ee3d29d9556fc2f1cae509d3c2216c5baff
SHA2564fa3d72846e8e0f28ecb1a66160b185082fe1d0dc1ce73caa173e27c49fb2acd
SHA5127a8aa1903d5af9602cbfe3eac4be22e554281f238e0eba56541b7df55e5a02b4fcefb19589845bfdeb26fcb1a3d48137fee6ea334d44ee523b6c7a492348cdf3
-
Filesize
5.2MB
MD5754240c9751d845a9b8c0ca55bbbea74
SHA1089762f7325841152228fdd952cc5acb2461105f
SHA256a92ba1ec444dbe256aae889c1e2a2675395f1b610f5450b4c8c069ea7c87d3c0
SHA512957fb51696e0b192b295aa8b9d40ce3065923af931449bc94775fc1b54ac1272955ea9165bd7308706972a5bd66f4341f2497be4ed4c1b16090cca1c869d7203
-
Filesize
5.2MB
MD58c3471c2936e668f1a0e43705b83e506
SHA131a7c190a3d6e31dae67c3913cd4060898b82a50
SHA2569557f9098cefe253e93f717da7709184a9d891c5ee398677219a7514b086cf33
SHA512ee043b8d6c56c6648506074bd84273d7114082a04919ea34f08ab3b4744568405dfa80ea53f07e4cf191a1cce1d3a577219e2fac2e04112dcdc563fcf40d03f4
-
Filesize
5.2MB
MD5122b4b1614b50bc9fa9c901c7fdc72fe
SHA179a3c4512519497b0cd23adf1bbc90074cd8eed9
SHA256c56489bf34e10ad8dc478eae174eea48f7a0c8a0fa2b8c6ef2bf899b6a3c37a2
SHA512f9caf62d79c1cdace27ffab7e1e35c2426dffc5a3de1280856922b333a66f7cf69795d5435f3f6302763c4379356dd6d6201cac500470cb3f73d9d29f0e32ce5
-
Filesize
5.2MB
MD5a0a61f8d74ada550001413c672553d13
SHA111711d68fe8ecbbd5ea5395ed39d2319c356a4a9
SHA256bf2c2d9564f56ec92ebfbad9caf99540329183438c4c210410fb710e96c55fcc
SHA5127230a7859109a242cd940c014c7f3ed696a9545fd7ab0e5ea4bf62c1e0cc5dc9c790405f7a4eebda13f885c7ac460263c8b49c4ef47ffbd8e8da17d541f96327
-
Filesize
5.2MB
MD51325932adec1086d1f3d6992576fbaef
SHA1172f5ffaee2308c9c63a09abc1c55ed1c38a7397
SHA256580f0c810eef0b17092e0fd975cfdd05b47e16d67ccbb12c187176318ceb1994
SHA51200993651b29cd896a67f8d227ada500dad28413115283449f5b19c14f9f62968977be70731915f9f49f33505a812c005f7b764eb8d8445491d910d85656a6f53
-
Filesize
5.2MB
MD5d0169420c258ddf0d7674fb9c867bdec
SHA1d890fca96b8a1b9c6adb5edc51a19a722044f650
SHA256608dd4faa28a363e702e279b5a4b35c94f0ee7339363e9cb8a0cc8d1e7adecb9
SHA51245c8fdea4857bd5ddbae8c6c05af99e739c4cfe3b131d31c7f0ffe7622f55afa2a7179fb5fe4b9c228490d9ce0b803279f2947a61ada4d001d2c830ea99c82aa
-
Filesize
5.2MB
MD58c98c2adce29e5fffd223a2ab27f4223
SHA148b60c8b8ca2facd0b26a3444d066dfed39e4027
SHA256d20f5fa72d11a7cd0796d231390fdaf06cbd68ca8439490b0efd2e0ecd08990e
SHA512b54439af141917153469ec2eaf0192c2a5fbf42021a6cc3515b0c64da27383b88e6b31e25bb9e33b58c9c10268f5376ae7a732d5c7b40e3881eda4b429f4b583
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB