Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 11:04
General
-
Target
2024-09-07_4e8f1b851141b339a884be815859d92d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4e8f1b851141b339a884be815859d92d
-
SHA1
c29b805b13ae6a14d265d7d5aca32e69fe74d472
-
SHA256
90aad10e5a2e0120be310078121a8d49a4b0a3b277b3291561cacb634f24c3c6
-
SHA512
b6ad78bb41831e600f733d4286bd655cdbc18f6e7440280843c0b1b4c504d792e53776c6733f2ca342d42557c945f88e20d5d46a96ecc56b2c942e0078b2268e
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUU:Q+u56utgpPF8u/7U
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_4e8f1b851141b339a884be815859d92d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_4e8f1b851141b339a884be815859d92d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SBWMszA.exeC:\Windows\System\SBWMszA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZpBFUd.exeC:\Windows\System\iZpBFUd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\beqewuR.exeC:\Windows\System\beqewuR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rcVXDll.exeC:\Windows\System\rcVXDll.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ocSCGGC.exeC:\Windows\System\ocSCGGC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyNyOJM.exeC:\Windows\System\QyNyOJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRFvvUK.exeC:\Windows\System\IRFvvUK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXrxVcr.exeC:\Windows\System\vXrxVcr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UtUNVji.exeC:\Windows\System\UtUNVji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fFjPHJR.exeC:\Windows\System\fFjPHJR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZBgViz.exeC:\Windows\System\BZBgViz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpqxeEZ.exeC:\Windows\System\FpqxeEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGRufIX.exeC:\Windows\System\RGRufIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\suglmaK.exeC:\Windows\System\suglmaK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zBphxAJ.exeC:\Windows\System\zBphxAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\caMBkvI.exeC:\Windows\System\caMBkvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eStymDQ.exeC:\Windows\System\eStymDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WcCDbAy.exeC:\Windows\System\WcCDbAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSRkNQc.exeC:\Windows\System\PSRkNQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VMnjVAw.exeC:\Windows\System\VMnjVAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVINmmp.exeC:\Windows\System\bVINmmp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD569088d6836af1476793273f65745cb36
SHA1e2241b81ed7fd90ffed0837834a6f747dc047f9e
SHA2567c290594e686eb87a66914d5b5e9595ae0adf74ce80fce4b7ef222d0da26fd43
SHA5120c5f495abce314790018b16dd1f195ce5a07602f7d7a06c3bfc36bfb135bf285a1dd5375077e705336a36061de5203e5dcc8794e485a0b7d66dcb5776860a52a
-
Filesize
5.9MB
MD5927f2c864149acaba57abc268ff2a445
SHA136c2793d54a6c7af22d971c82a7e2dc3a66d4ae7
SHA256ce7f4aa4c18ee7f56cacf3838d6603220b297bf176dce52eaca2e45b6f662579
SHA512a2660e4237d113159f501efe02e05cda36b7dab32dca679f8ca4778e2882077ca55b5c2655adf980d8bc745c276fd8b25929a85b14a4d27bd7a6c407634fa221
-
Filesize
5.9MB
MD5dd064c360cf79887effdd9c41cdc1d9a
SHA120ed839530697b749dda655cda113c22659a1d69
SHA25667f726abbfc776d2e70ae04515c990bfc29012b8c149e7f157fbc1a86b7b1523
SHA512320f651832b518927aa04fa70d247936f744a7eec95b595b06ae76d911ba4caad10bde2cf6304b52a7b16c5837fc4ab05b54453a75d3fcd3a20f4b5fd63216eb
-
Filesize
5.9MB
MD5a4ef9b4f8aba6dffeab487b44a5df18b
SHA1b28809cab55973011b0285121e3e136d58548380
SHA2562eb8ece46c56b2966d1f5c76a76d586096428ecebe2a3c6776713274f42f9617
SHA512a1903fa086cc0132119f437179a7af3cc3ccd25183abdb7e09083386f19e9126be705c1e334bca6cf181d74a2fe59753c225d11cdb2f0ccd9b96d3335e743585
-
Filesize
5.9MB
MD54a6e73ed2d8096d8ff0f0f9043ada867
SHA1a6f93804596a0b7373e4e53813fa719ba0ddc93e
SHA2569107fcac426e8074200ec5b553d3a4fcef21349104feca7df59ec5d4a286a783
SHA512534697ad4ce29092656d09b52b986eb7a04955212bd2d456db0226887d77aa18dcad01cf1a0a736f548b1c53a2a212a873e4ac4558607cf3578fdef5063d75f5
-
Filesize
5.9MB
MD5adf8497a8d7f9b03bba297c0050a1701
SHA156969d7f7360a768285a2e8f4e0e27fb190cb0f1
SHA256716d2e2ffc8962a2f3c28ba92ec39c0d3e1f95aca5065975115f0309de7258bc
SHA5124e76a673077cd62e51db04070e0addd0933d94d9902a29f89c6d3d7913998f520a5bbe87708548139a61712e7c1afd2fccf223afe2be11c73b6c69c75e8bcc03
-
Filesize
5.9MB
MD5cc6853a27bba756c06514a88d8fced2d
SHA1538d1e0d81ca9378007bfd4ea6575aa2bf75b372
SHA2569f15fbac4c47e5f509976573ecab95ca18073a4f2905af33e09fbf0194f8fbe6
SHA512ebb53683990bb138a12b349aede7931b6cc834badebaa848357f1d7ff2cec27c1be62e28f246b8a3875c554ba13b55bd1cefd6eab4b3a717c5d3aa46238bf0e6
-
Filesize
5.9MB
MD50834b9880ce8ad015a2672a65135fef9
SHA11519ff36b7d2e38397882cc486b14ca1d91351f1
SHA256ab0bf7b45b5657143bd74462da46fe1da157137859a0e00708ab03d755a47e5b
SHA512a648903036b71e130a403e766af84798ccd9a101c409e6b29797ef6cc1f56a4b46c895a171e5f7a3bbcacedd225d88cd9872ffdad30a0a5971cf1d49b0d0b6c6
-
Filesize
5.9MB
MD560ae74f726011ddbda14fe3bdda22cc1
SHA17202f0852d26774391e6057c440c2f38a9fcd9e2
SHA256921fcb5c91ce0555b7f6facdc79259a8d3689eeeca39756bfdf0edf4814ad478
SHA5122c755bdaa3aad08dfc9ae0a86ab93cab90bc9ff0a358461cf9e3915058306cf062e6335af4db5a7f96a982848470c54f1b755bf4e8e1d2ec3f679fadad4b3949
-
Filesize
5.9MB
MD5eb899c146ba4c2fe481d142380baf2b2
SHA1472b947ab6ceb1218f873b7082fc8b933eee577c
SHA25610e5a27e675cdbba71294ab4f9ce647ffb8ea5b82167cfe237b80139907ae9c1
SHA512935d8e162b2b3ba51cb9e1c3bb1c41ad8fa928cad9159f370bcd1b2bd63ab415295c37e6c7a9583dde6167c696b648232db3bc8a65f115cfa13af26f127aca1d
-
Filesize
5.9MB
MD5e7ce44be967364fa4e68c9e6d9cdc284
SHA114e7ae3e2ba0efd45a98be0ab318db3bc780897f
SHA25610d4507f93e08919a3063e322fdd7843a572ca6fe817023c1409c0d21fb2d481
SHA5128596d6a631f9dfe56a9252ba9ca3565d74415eb6c071cb051b2ebd741e0442d24a8fc254a1ee46e0f249363cda6c204354a2567039648c8b6ff707a20d3bfd56
-
Filesize
5.9MB
MD51e3ee3776f151f76c358959e88ab0336
SHA1c24610b8cfab6c7ccec116528524f30c82c0d257
SHA256d6e23ecb61b41613555aa9ddbd79df8d72f2eae9a2555194fc0c603e34ec069b
SHA512f0830aabc656c40525605474a7bff69c16b63f8dcdc0ab14dbd4a1d588c9a622bdce3001617a66774b836850ec7deeae0047ba4926039976e507277057dfc657
-
Filesize
5.9MB
MD51294710b3ca3525606a63793a407333d
SHA10f6b89865c59a6afae0ab6113493bfa0f96a3910
SHA2569c9d9b8cb19778c5a50cf05f393a02216095de222ce6102e14e17c9c555242dc
SHA512dc9d13d54106d333c7d9a23bd54dd6767e041fac43ad84460a2bef382a7213c410b81f22868bc7841dc0ca6b6cf4f387bda661addadfcaa0e49ae1274d942bfa
-
Filesize
5.9MB
MD5589df9bdb5b95afbe58159e7e27f41a2
SHA199d09a924fcfe8746e48bb948de77c0588ff181a
SHA256f1083f8e88daf583416e6f30a0778433ffcb562b97b7e360532a76cee32c88ac
SHA51232eef95686efb2af97db8b6ccd5d211e13e87cf87078c2155744a07cae000bd5dea6309af15f269a3777a648f2fcd1a1e59a8ea9d45ed9a4b08004134933ea4d
-
Filesize
5.9MB
MD5dcc85bfd2e7690fd8712294911b1a5b9
SHA19f2fd463e5a8b5a8098ffb0f1a1058ecf0f417d4
SHA2566c9d6de7d19ffe3fcfeaf7e6715829ff7f382dc9fa2aec465a360172592388b2
SHA51226a457f2eedadfff6b6ee10843792d4eb48a783baf92921963f88de6fe6a0e3fb2f8a55633f2efbdcd8e2c9023392f1045b7a70d6c7dad7defd5c9ec310a03e6
-
Filesize
5.9MB
MD53fb8936c8839a7c0bf31a985ecbbf619
SHA10e69b0aae83bdd69036e9f12454b45a5e63e0a87
SHA2563a7afc34be696da5ea7e93313bb937870a5c421ca4d40972876b789e712a3c09
SHA5123fe6ac5371aa262c818580f57cabde440630d1b291f835262fb235f4c845a753bd37690ed111abd8d689973bd60c30fb6dfdea39c774353bf77636917edbc635
-
Filesize
5.9MB
MD52a71a19cf971a0419a5dba53fa3f1506
SHA186133015566eca227bbec69e136b5c3c38a9570f
SHA2563fb5353e95dab8308f05f66f4f5f1282d0714353904dfd0dfa2361ec4a27833d
SHA512b8a485650d95ae91a54e7711789282280375e388dfdc9c539b4bd249fd7a7529152dbba2f5238a9d673bd29d4f16998ad745ab97374b217097fd0c43110c456f
-
Filesize
5.9MB
MD5ce42d6cb342fc0751b1842e1a7192af5
SHA1c646234e15ec7336b656da2efbe3c3943f3f61d5
SHA256842a104e7d6da5a934f05ef2fc3b1031983760cb6a01ea4a44e34370eaf6a229
SHA5122a8214ec88801e2a991f3c193094497c7c3989d61d529a2d9524c11c571eee2b8f747d1ea116938b9d37e8f4a2e5715db0150b88adb33eaf6c1e463649511f0f
-
Filesize
5.9MB
MD54fb74c61705b280c4c746119410a0dc0
SHA139b04f11b2470234fdc0531a80b53fef1e950105
SHA2567febcafe637eca6f8e39f4f92a4f8371ab7e3a0bb66282fc6964e0966fbd2a2b
SHA51213e43431644699baa1d53441d21b9454f8f7f6a6864e5e625b9df6db410d6e2f2ba1bb08413fb98ac97885a600251514e1df40c66f24f21dec19045d70189eae
-
Filesize
5.9MB
MD5eea4b5660b41502095ae25d7cc192949
SHA13b3013bfe1dbf1104ca2d7fac8cb32b17b64d0ef
SHA25685211dd608a4ddae2b5a1922f581d8dd04f3deb1d608b9490d82659aec18eefc
SHA512d2e4d4e1e72ac6c3619efcd30f9697eab8038f4924a91c84802b278e45542e0aa35635ee2a42c529e07eeb22386cc0fabf911c4b7cdebdcea2811f81f1e48f61
-
Filesize
5.9MB
MD58d52be220a874d72d59bfc6518d20ce7
SHA17a0a8e95f44dd480a23673d1ccb8dcf2d2672f54
SHA25603617a4c722be6538a2f33a0cfb0f52e1442249c6cef8361469af6993f2df2c1
SHA512a0bb68aae27dd1c3bc95e757f873bda93fcf075da94a3f76a5cd5baee9800687bf33b9b30864938abf8c622c0940d662e01bdcd0d08899e480b1fc6b9ee60529
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB