Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04/09/2024, 15:41
General
-
Target
2024-09-04_170e8e11adbf6e99f7d77b7433e347ef_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
170e8e11adbf6e99f7d77b7433e347ef
-
SHA1
abb4ce815a248af4b9cb294b01894798d3d2d95b
-
SHA256
ceca52b85e07b4cb0cb04a8a32f471553d9680124f27518b5f510d0c9a7bfddf
-
SHA512
fb0749947ccdfc667be047105921516a0aee47f0a22dfbdb2f73766ef113aab104fc0a811b371c1cc08cfd61ed8603505a210dd73c80d9477b110846e53ace70
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_170e8e11adbf6e99f7d77b7433e347ef_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_170e8e11adbf6e99f7d77b7433e347ef_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jJDPcrA.exeC:\Windows\System\jJDPcrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XgnEMTJ.exeC:\Windows\System\XgnEMTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkbclNL.exeC:\Windows\System\HkbclNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HurbcLP.exeC:\Windows\System\HurbcLP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvqjvhD.exeC:\Windows\System\BvqjvhD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aeBhGIa.exeC:\Windows\System\aeBhGIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CEnjyPw.exeC:\Windows\System\CEnjyPw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWJBDof.exeC:\Windows\System\fWJBDof.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OjGtapC.exeC:\Windows\System\OjGtapC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wwvSZtQ.exeC:\Windows\System\wwvSZtQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nFSfvxA.exeC:\Windows\System\nFSfvxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djGrXME.exeC:\Windows\System\djGrXME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DOtHvFj.exeC:\Windows\System\DOtHvFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQeCTzw.exeC:\Windows\System\zQeCTzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yzpRKLW.exeC:\Windows\System\yzpRKLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzlwfRE.exeC:\Windows\System\fzlwfRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dIRUeZS.exeC:\Windows\System\dIRUeZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eYhXHux.exeC:\Windows\System\eYhXHux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHXEdTU.exeC:\Windows\System\wHXEdTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjuFzPH.exeC:\Windows\System\tjuFzPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pziGuym.exeC:\Windows\System\pziGuym.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c798ae11df1b4f6b15159f4d4cefcd54
SHA1ece45065d87225b56d9d7c54b846d6046fc645be
SHA256ebb07f264a66c72ec10ad77cb94e554bdf115931f53f58dab8121f544775e0a1
SHA512c9e47f9196765a23230ab4fd26374d2b29237580f3a0163ce53d683b2ea350968e522b930777ac3ec69bcb545c4120419e117570c2f83a5bbdedeecd475738ec
-
Filesize
5.2MB
MD5163f1aca576c2cfac51a022304e9f8ce
SHA1ebda5c3407398db0685af4f1cde7b62611dcd228
SHA2569d8e93bc17a0f869ecc43977c9580a26a5d60254779847e2f8ad2cd6e087d10c
SHA512b2cb2bb130f9a3053fabae545a6b3068c5017edcc50016df0e2c6fc78bdd92f72a3ff0a9fcf113a7500111be8f82d1751731ac617bd219b2aa7b31e3fd5419fa
-
Filesize
5.2MB
MD5f0939ba4f5f357f6cbbd1e415ea65dac
SHA1c3eeed31bd84463c8f8409c6112874ea27b77735
SHA256f7e042558edacb964d8b270dbc7cae0972da6af3b578a274d0b7384c5c6d46b2
SHA512fc7c76c587ccc0e6d0676358576c117c0b865208346c9ebb8dba169b6a6a294b98e65147390d214f58a97f578630d717b8d21c209e72605e0661c406a09ae1da
-
Filesize
5.2MB
MD56209614412315bf10902f545ed354f33
SHA10715249077404b76b423e8dc4e388bea542b4caa
SHA25663745f9217b051d2d47a0442c96fe1ab9dab8222f226b8fb88ccde9c95a73763
SHA51274cd599108463e863c17d53cca346f6f449248e285b9fe454b97fee6b9d396352f3c016d100b23c71160203ef3b85ae2b064d8cbb6375c8616ac7ad55fd4e135
-
Filesize
5.2MB
MD5608bf8113444ac720dbbc550201295d3
SHA1b6b2ae64140409cb0a92194fb73036170bdd4d47
SHA256ff20d3102fca238bcafd26ab9885bc3d4894b41c289e90a6d32b3906a7cdc5e8
SHA5126d975dafe85f8109158ad564d7dc8bb97771e51c6f1cbda841ebe17741f29b97e1594f56877b29d83dae5233b6717e0058b322b8c2b7fddd5a6e89e87d0d84e7
-
Filesize
5.2MB
MD550f072da4197c8ad152f9cf421b97829
SHA19b78cedc2f9d85af165dcde88873e6c425a53834
SHA2567cbe150169f30a35b4f47ff814a9d78d5a289926451c6497e55463b6066cc070
SHA5125db5205bb5567cb6398c70014b68bc350be5ed6698b5dcdef85ad1e3add76fa4c03c9d609439bc8f14a640db5d40b81939e5ffe34de0dd56e8cbc86606ea9a76
-
Filesize
5.2MB
MD5979816ce98d923419d68a187eddaa42f
SHA1a425072162ad7321fd97b988f2e3dfd73c1384ca
SHA256fd295842f018842acd222e27eff67673175bd3d5f723572bbedbbb01897bb791
SHA512c24e126161ac7ab23843bb7d8d2c78c0e3d0f1ac9f1910e08a393583f3d06325fc674e6102ccf2974389f7b7eac6d37b6e348333efa72a9dc7690952d03b180d
-
Filesize
5.2MB
MD59866a64eebf91ed14435e1bdefda2cef
SHA11701bc866beaa6fe17a9a04afb7211660bf57918
SHA2565c2eccd1547c4b3d9978202f129551c8e377ac09efa583970f2139ea096e9159
SHA5127eb1388d66adfd70bd4f4f4ecc43c14f9cb88d898805f2c26cd6984daba3ef2936141832270c099589e51e02e60fc8f8c5930291c05e18c4664a5ce5527e13bd
-
Filesize
5.2MB
MD5819028282258a0a92d4f1ee972f557f2
SHA1520082edbaf672054d8ea3a67c137b53e0fb6c0c
SHA25695a8a83c065f3593db36951b4673f0d149642f7cd0efdd2f06f3d54d22430931
SHA512d6e7da5d7998fb205bae0dc923095f6506338727a698a96e3a499fd6a5263125adcc76cec1b258ff69f4608be91254fb8494d5b5372f2f760988eab791d476aa
-
Filesize
5.2MB
MD50215c5f6717ebbca017dbbf44234b775
SHA16939803e089f29754fa98211c292164cf997b688
SHA256907d2f7427cbc98f701128ff95f4b857a01ec664f76b67cae0ed4ef219af7494
SHA512886d4e7bcc106872665f059a04d46fe27da194ac0947a70e67e3fab89bf7ca23e5b1c5e501fe283c64f7ec458caabbc539c7f0216d20d367d574f74d52fb3a92
-
Filesize
5.2MB
MD50920d8454a654ea344eefecc1380ff1b
SHA18cad47cba8a9c675b96a2ae5673a0e52e50ed86f
SHA2567bdf6b79a93c836b3a6f3b6ab404782b4a290a1439ddd6efeffbc0fa3e03a203
SHA51273382aa530527844714a79ae92e3cec201e7bca11699a72d552ec657f13f90bcce6241379a4837508f7856fb0ff437539cea0bc7339ca825f9382400757eb853
-
Filesize
5.2MB
MD5a9d1a0667cc1d218d7f253d20b7c0b7a
SHA132124c73ee6a59e9826ef05ff4b22bf7ccb54063
SHA2560944d2105658f3d49d1080b3c04d1b76a012f0d8e77c84187e8b5f0bbddfd82e
SHA512b9ae68e6d3190dc431e48acad3a8ada089acfa66ceaa48063be20e631f39b0ad4f236d9bf693635e6066f820709b67f3dc8e92bb52d435a6f1b5a67e539e501f
-
Filesize
5.2MB
MD5cef72c45a8a1d54b4fccaa00fbcf6efe
SHA1d0a9830adad647802a1723dc76491b6d37953da3
SHA2569cb33b7d1955a1b6fd5e4978e4cae82232ea578b0150616b7a5e2f6638c771ac
SHA512142e59a8ac3e559fa341f1e18bb3f9b0887843039ffa33c9759006bf9ec1cefddb965ef49bdc9ea4071356d29f800aab83e722951ba439070759aa62c40ef3a9
-
Filesize
5.2MB
MD569caa1daae598042c1016a528c446da3
SHA10b741561d9c2d65ee455c9ac2d991718442f0bf4
SHA256f33263926e325e5064556b13f938170075c7568f3d9b890fbbbc2ae1325bf6cd
SHA512af49f512e44c91fa3d65808ed7ddd575e7e6f0ec16d498e3d60865dd996ee99f32372e78278cf246c8496da21575f57f95f3e0078b09f897e8a02f2abbe8b736
-
Filesize
5.2MB
MD5a8319c985bd8ff2284b19d5e49b52383
SHA100e00da8ee60c9801bf578f5f5f07a1c915efc01
SHA2568be278adc31683d1bd9e464687e7829e9cfc8e32f218cf08a04ef46d5d8de475
SHA512464fe7429e233fb66b7af807cb5fd7728fba7e0d4daf3e1a310f62e9854f278a4852749420564866cb3a41e4b25cf5f11d20571d229f9c88e0d94851423b3d3d
-
Filesize
5.2MB
MD5f3d97cfd0cfc0afc879a2209b161bde0
SHA1f7ad722772c7185c201cc7a33a60f259b3a53289
SHA256db303dcf7db2b51d74d01defd1ed84ad4ecae223906ea608814c72dcb8e7eadd
SHA512ed8183870743e92d8c338334e866c90e28131c98b7f3e127a4cd4b82e9d68ff379be7c301d79aed75771903890c2e92c179f3ee09ac6c6736a8a22f04a90dfd8
-
Filesize
5.2MB
MD5090df9015965e07d92a60718d61efb44
SHA1665f0220d11a91d5d5db1700cd834194017b6857
SHA256ba21a0e0db5bcf571e883bc43b1679b98b41f410043a4c56fbf52c8e36f7307d
SHA512285a445df7e527170a270f8dc0e0473c78369910353f63ee61522d1fd9d489e4323c094925e305ba31df0752be52b477eb44f7db3fa0192383a2dd414aff4f54
-
Filesize
5.2MB
MD5b76d4305f822cfd1a6cdc88b90b1904d
SHA1f4e14b77be8d1a5e05ad7b22fc98c8ef2a3d9e74
SHA2561228428097dee49f8cb8246cfc7f78b0dfe878b3efabea20abc6add7780cb901
SHA512cd143e914bfe7d809c59b2321d29ee442382f340cc90b8b0b68fb8be8c8f98ebf9cf194899c6a4eb8f804bf5d49b01d6a43ac97d49b4dc40078bc92dc2f83b32
-
Filesize
5.2MB
MD5b19245a8dfddeeb70cc11dd61d95b874
SHA10b40ad98d2c56db6427126e6f1ee375fe146e5df
SHA2562c9e342bf28147b0ff6ff77d8102a6b7a7252ae349573baf807abcc37d739501
SHA5126910ad3c680b09d97af56d6ba6ca875a55de40502c3771da3e571056b96a064701ee3dedf451941a763582441ad954bdb299c409729581b186881eed3cb31717
-
Filesize
5.2MB
MD510bd0ccdf5921ec3ba10a95aed94bd71
SHA18856ecad1c413f01c82be32451844a3d029f0e31
SHA256c48162108f2ae5f6809c34b9e32754dec90ab1f51bc9f9cdf0c46bb88914a203
SHA512aea12d5c9ffc7e4f39d651b1fc02a8e06a93cc5977fe24479e9e948a7011cd8201a2217ee38e323fd9c22816275a8741b3c58c04d80c92d7b9e1ab9b0a2b7344
-
Filesize
5.2MB
MD5762f46637738e0eaf21ac77f93d7be6a
SHA1e36761007ca14770d0f56743c702f830a2557734
SHA25684a487ca2edfcbcdb0ce79a4358221fe129ed3f9c11f4fec906617f2c1d796ee
SHA512493b660d9e3a7b2e6d087f4e1dba89d89e8f6332c8757eff6c9940ab48f3cd58cdebbe7b19b66434e47ed8005ce1336e35d6c24c9c061bef26bac3b9b2bec822
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB