Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 11:01
General
-
Target
2024-09-07_41eed92c8f49d1f95bce5e8d2bd6be1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
41eed92c8f49d1f95bce5e8d2bd6be1b
-
SHA1
bc73ca31586ed05d7934a055ede6149ef3a27e37
-
SHA256
1bcf1fd648833fe8a1b58152244e7dd91fc647407a79f3aff42687d2c545bca7
-
SHA512
5d707fe2b13c7b202dca7fe6ade749d1db8d426b733342be864c6b31fae17d968e134160e57bea2bd7cfde15838313b0662e0de3c3df3fe41e04d4175d0282c2
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUf:Q+u56utgpPF8u/7f
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_41eed92c8f49d1f95bce5e8d2bd6be1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_41eed92c8f49d1f95bce5e8d2bd6be1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dEOMghR.exeC:\Windows\System\dEOMghR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yizRoHv.exeC:\Windows\System\yizRoHv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\epsaETJ.exeC:\Windows\System\epsaETJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EWWYfTU.exeC:\Windows\System\EWWYfTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXEwRcI.exeC:\Windows\System\sXEwRcI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzFIteq.exeC:\Windows\System\uzFIteq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGIFWOv.exeC:\Windows\System\TGIFWOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePLozob.exeC:\Windows\System\ePLozob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGXJvbW.exeC:\Windows\System\LGXJvbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLFrUPY.exeC:\Windows\System\RLFrUPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApkkUiD.exeC:\Windows\System\ApkkUiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Gmphqxd.exeC:\Windows\System\Gmphqxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCtTRSZ.exeC:\Windows\System\RCtTRSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zwPSCKP.exeC:\Windows\System\zwPSCKP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZXSeoX.exeC:\Windows\System\IZXSeoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJyTtsP.exeC:\Windows\System\eJyTtsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDjAZuW.exeC:\Windows\System\NDjAZuW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxllTjJ.exeC:\Windows\System\RxllTjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EywZzEE.exeC:\Windows\System\EywZzEE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wzDGSNh.exeC:\Windows\System\wzDGSNh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojckvhj.exeC:\Windows\System\ojckvhj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5cb585b17590d58411ad4f27006f20a78
SHA1e907d1fb32c2951ad4334b0e4f9259bc0d680623
SHA256e53082e6d7d15e621aa7840087eb3bc1a7090e1672503f9b6a32c63e19d5f6e4
SHA512f0eb9328bc2ca19ff7fd3ff1aa4d97fc0bbe2b0d40d3d5719d104fc33446cd128b8a10fd7dd62f755a4b7dcb00e6a785da6f2d30c45d095444bb309b21ff4703
-
Filesize
5.9MB
MD550f1d114f7f20dfe57679348bdfee3f9
SHA103505a0194d794ec10ca9e24abaadb9749e516dd
SHA256626343f30e462c4ff8284548d687e2ae36c2686541289933472484f46f7ffb34
SHA512d0110304a5968fa5aa3c09b1ac3976e6d691910c864cd4aadd93636bcbc0a5146418071f89e45690278fe6c066933c0393337d416bbf92253856d9321f1fe8ef
-
Filesize
5.9MB
MD50aa41a93c75ef8d0fa71758d8c4f502c
SHA150b4a2228f232d91b2c6ec153e4e540285870017
SHA256aa5eddbeb04b047d5bc5c79d93cadc3972f5b1e2f331e22772be1b7c37754adc
SHA51244893056b3c337f55ec9607da25c9e52290e3f1d9aa3d80bba90e32f65178bd1fa37053e2ffdd288c328ef48f37ddaf9a61858b1780b3f91e7be37d5c5f2a180
-
Filesize
5.9MB
MD5e86e566b9a69bd7da99b09222172f87a
SHA1c4eabdec65a92fd677e516060d09f9dbda312d4e
SHA2567571951bac3ee9e9eca74c0a3d69f8fcf21354d735f2ff2402ebd2d3cf636097
SHA512362acea80f63036ca85a3d9ac01d35dacd594df144df8d167c3cb2abc2871160edbe481a4bbcfb35d327878bec26ed83e0d33fff0190ee11d764f70d8d341081
-
Filesize
5.9MB
MD5424a1fd27d4ea8658a928722fd373ca9
SHA15773e4fb806ad9f81ea77c92564296543af279c5
SHA256a08bc08966d199788d3f91b1ea147b67ece7c07e764ea9e04fb0003961a66f01
SHA51221c98dadfd6f682fde9227d302f6cab1da9ab12d94c635d1cb7d0f8e94d91d85291d41729f71a61f121ce02171a32b597c3c48a3df9fcd4f180b52ce800c9303
-
Filesize
5.9MB
MD5d0fdfc85aca1487092a93035fb9965f8
SHA14aaf13cd0368f94f70c843b78ea4fde40abfa693
SHA256170c5920b36de4dae19436be9aa347b3cea1efe4c0b2980598a120651d5b1788
SHA5124445f92ec4c72ae53611be405bea861d5b91d95287e0ae82fa0da763fb86f246ddf257fe5842a1d34e95b9b39cef8320e546a6c8954e5dc6742f2bfc6fc44a50
-
Filesize
5.9MB
MD5f04a41416d254851ae908c35e2dd7804
SHA170bf4b09b8098d070dd57ae72244abdb8f8a9def
SHA25604c99ddd25fc0ae6e65487d9119fb77629f63a814b6959221f5bec1e16c7aab9
SHA512a78416ddb565385dbade477dbdce4f8bb9e7a4a20a8986b352e5b2aa5bcb9f193889f084caef0468168612d13ae185d38b97ac2e0f43382675dba9b3da3635f5
-
Filesize
5.9MB
MD5f28f8b64f98f8ee1d466fe7f85dd3fec
SHA195a6e8c59207bfad6380b52590dd539bc4dd208a
SHA256bcae983412a8e8b30be7742638d82d99b6578fc19052b4ba8e83402ce1be1a71
SHA512bc73dfd0a08f6f9a7a5e4795729b4b671c0adca035553246e3a132af6a4d99ee68072cfa8411ec867129fdaec291df5a07b417292fc5cb1e57f53e4df2ec3aab
-
Filesize
5.9MB
MD53f4f24fdec1fc2f7e33d50e7dd061453
SHA13093568661d63bc7038ff8f16dc8bc4022afae95
SHA256ef285a47697d35b49086c14edd761b1a994c255c30327b4fc4e27e08a3797ebd
SHA51233317bbdde35d8251ffd0fe2cfaed4e654a98a35ca093f31d916fe2684dbd0dc96dd5673ac2d51116e427e2893c5ba3c1d0782be6f51391be4d86b6f9dd995f1
-
Filesize
5.9MB
MD5952740280696d8a0528a4a3260460d59
SHA119654cecf39b97ae6be27bfdd5149ced240ed056
SHA256e02b29f77096a201658f279f9bc2f08e2ddd49e0753a6e4fce3e8c704f3dfc86
SHA5124546364795b88f207ce05040e3a915365d97078d419814b0d5ea628d98c7501736609a45a53d255543af40f7a77df34ec758f8e4a04b8527aca9ff90035efec4
-
Filesize
5.9MB
MD5d5ec012887fdadfe348ac1d4eb7f43e1
SHA1a69f4af85d3c743ceb1c1df340344e05ab764f9a
SHA2566f8c129d3671ebb22425c1eb7be04536fec9900e12e0f67bd99ff70316ca5cf7
SHA512f8c63553ecd21f0b0bc88e2a8f7d2c7c1f686b2874c5a033db4de7bc64523303353732d95fdb0c0476678976da84614e883ee963aced56c49bcb7c8b407b09d0
-
Filesize
5.9MB
MD5a316b02ba2d4f46190c481ee5fbf1527
SHA1d50bab99c10cfbd3c158f2916f9a10714280e55a
SHA2561e87b8cd13058eccbe7b49093a4c164b907fbc592475432cf5ca0356302221db
SHA512f66092004dffe682e53cdcd17e064d3b9157cdf4a83b51ab843f66cd5164b6e589ca8f9d0745bbda20855d0bc87e433c48a4a43dab9386596b4ea4daa26146da
-
Filesize
5.9MB
MD54a4df9bfc5ff58bf1e6507f3515fa37a
SHA1e3a16174e449fe781344022559018d24e01a8e84
SHA25672b10cd1afade7b790788157758ebc9550200b04e7964b76bf77684bc6ff7ada
SHA512d85506c4998c6d072b126457ab23976bf64d19262308acf49dd157d38df934d2f293eb3389754ab84a57d284f63918c3c304852788995ac52ae961840084d4e1
-
Filesize
5.9MB
MD54d8d726f136b7c758f2bedd60cba1229
SHA1bf3d9dcc4a8be5e42ab015f4c337a37a6845042a
SHA25636665677f2afda241c3cd3dcd3109843637013e60fc07759a411f3f49920bd38
SHA5121acaea09db9925966083b0550657a5e17724c05b97bc73518da936b2dfd0d8aa08052a3cf239682ac2c5e6f82acb7cfec5fcb89b076485c0c4187342428c1d48
-
Filesize
5.9MB
MD5e2d83aa84e033848e120528ce3285e32
SHA1c3862b7ba5ddd8fe3c4937f65fd918a45cb97413
SHA2563319fbfb1a96839933e39b95dac740a628a4730d055c5ec6f568923a9c80bb0d
SHA512290fe4339a0cad2b0d65ed5bdb381b0e370e549074a665b250076b0b2175680cc3b77365c5d3ae4c7de1aa4f5a5e97473d3bf9c7609dfc53342183a6a74c8ad0
-
Filesize
5.9MB
MD50960d20a82fc19fad1d50573d94148ae
SHA1e50aa6c2bd91f3a922700aca06c1d58d29250618
SHA256a7c4c5b2e3be9461d0e4e01c5e0a439663fede9aa9aa1548a40ffb4580d160c1
SHA5120d3e0dbae7377f03c1463ddf9f5115f8ca25651a2fd1e6512735088a261b3278123348da1fcb077df6ebc386f99d1ef6741d1b0927b216bf7dedcb060c8046d6
-
Filesize
5.9MB
MD5da55c7a8481b412327f8d69162b79ce8
SHA1d851787159d46cd6b26faa89bc0e045aff50f00b
SHA2561cfdb0761f06f0a1073e14ba91319681b87e0bdf6535515b742d4d06e927bb99
SHA512211277a049a9acf27b4f9fab7289ff2ea7bf0747121dac917ceb522d8c501afd6d1954f39c3ec9c96da6b6aaf59abc6ef57b4839ee24d59c244bcfbb8dc6241f
-
Filesize
5.9MB
MD5d4aec796ccfe0c1f548529a94a01c5f8
SHA140c4370a59074ca55949fb2832c4bfa6d3e41aa3
SHA256fbe9081efbeb14e0b2ebf146d793890b32d868d806ee91f341dbc17c6296278f
SHA512812a1e156a66fb5c2a4e6b7cd14cffebfab113af151c6fc063bee078c4a014031afcc71aaa5d1ac5c71794ed521d009d0055141af2fa3a654765100fe2072c60
-
Filesize
5.9MB
MD5e1f840281e0fd2d3eedd5b24f112a7f3
SHA1037778828faf8a3c234e64fd93ee8ef26e629270
SHA25646f4c5fb0ebb077fcaaba9bb61480cf0c3705f7a3527be311495afca71930cbf
SHA512bbee0471a23f3bf951dd26391930a7d08144d783ff5d22e4b7c376cfc7cd5de5da1f9e3c8672d517a4a68a31ce89214c6b8020ecf11105b7af72823415bc3fb0
-
Filesize
5.9MB
MD5dd643a5ea59228fa190ae8864ba7165e
SHA1aaa243d4d3d2f22e6c18583aaa9a94e440063566
SHA256648def2425efb4d24ac516a4519aa4bc66bba4c42aab264d810e226ea549cb83
SHA5120da1866cdfda8267e39592e88300921b856f8115949676e1c8e48090b13afd885df1e23d286653995c2eee98517cae2c8bb2f0f99730197cf78aba69cdc0ec80
-
Filesize
5.9MB
MD5613e0e87574cbf393832457a347d4564
SHA17c8fd476de377565cc2883def6fd3c52a085a24b
SHA256ad9d03c75140291ffd574bbc61faf1175ec302292bdd6f9abf5a2e67e33f52ac
SHA5127b9a0611c18e624adf71d6aa6c11f1a368c59497a6ee770cb5330a0d70cd248676886c38f7b82ec6ce8d3541fe333d7e5208afd78f41b9320da0b4035a3ee506
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB