Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 23:02
General
-
Target
2024-09-08_22a78eabde98f942f0513bda3391a1d0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
22a78eabde98f942f0513bda3391a1d0
-
SHA1
1f38e94429c0aa20dba296540cd4e7921fb76cd6
-
SHA256
9896b3a2d7393ea7c53def66661b5045f1067ebf63c2e15843717e0ea2dbfcb2
-
SHA512
34edf4039016d79ba00b00a8e2bf896db02965a1e4e51b143f21ca104c7a33e0e94e797023cb790529ffbf77421daacd04708336214f806a892800a20cf2618e
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_22a78eabde98f942f0513bda3391a1d0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_22a78eabde98f942f0513bda3391a1d0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lZvmKqk.exeC:\Windows\System\lZvmKqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRJIVZP.exeC:\Windows\System\iRJIVZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PneDYwU.exeC:\Windows\System\PneDYwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VRvINbh.exeC:\Windows\System\VRvINbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEJJuEJ.exeC:\Windows\System\FEJJuEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMzaYOo.exeC:\Windows\System\pMzaYOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdHdFvA.exeC:\Windows\System\AdHdFvA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHSZiIi.exeC:\Windows\System\IHSZiIi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yuTRhTV.exeC:\Windows\System\yuTRhTV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtYGwma.exeC:\Windows\System\GtYGwma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HhCqrcT.exeC:\Windows\System\HhCqrcT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYTFqoq.exeC:\Windows\System\LYTFqoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqWcffo.exeC:\Windows\System\OqWcffo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sbYlfqc.exeC:\Windows\System\sbYlfqc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYnRPBD.exeC:\Windows\System\CYnRPBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmZuIzy.exeC:\Windows\System\TmZuIzy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uXcnBHe.exeC:\Windows\System\uXcnBHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CyXIudw.exeC:\Windows\System\CyXIudw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yuJibMn.exeC:\Windows\System\yuJibMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soIWhIs.exeC:\Windows\System\soIWhIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcpabaW.exeC:\Windows\System\VcpabaW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD586985e90dd1890d9f6fbb609fd1790d8
SHA140a3eb712578c07f6ac8805ee3c207b03ac6458b
SHA256834d04e8a782dcd5b2d6cb802be8eb21f9c84001a06b5365315b482267e6e6d8
SHA512ae48da38d15724cc53cd2107a967b55f7b9fc27b6e96ce31415dfb433d5cf8004bba35126918a57f2f8dbd63b6c400655add47daebef89cc5b5950b2b62be0c7
-
Filesize
5.9MB
MD59cfb00fbb57c064ffd5bdc2b26f08964
SHA1e27e8ddaf510eb945d1280d521f4ec9e27a3b865
SHA256a42ed2efeaaa0d93f0397939468fe6c2e92ef1f8cc05729b48f5eaa5b9bd7515
SHA51263e96aed156324f5c354d974c736f1c73d0d61ae66fd7e680d98b4aa57d7f57d7f9012f6c9d7699b3ac28f38e129f458313c9a4bc26041adf125d219c600046c
-
Filesize
5.9MB
MD51c041def9b7da3fb89b4d682a530590e
SHA12ee862a8451198b21af5d03692871f9d6f40010a
SHA25671afef544a595aea6238ab374f80588f62bf18086c5399c6c8573dfbcb22836d
SHA512c0ac26f00a11e30d04d64cb2a58aa2e985a92476ba4eba4b5e250d5f0645cad433f367a20fc0a3786c16148acfb8060a193fbd39a4358947270c39a40a75d96c
-
Filesize
5.9MB
MD511f27c4bbcf6386b74a21ed7faff7871
SHA152d4c503275c9b82e998aa92c8954519214a1cba
SHA256636799c5c0a08897e269676a079173cf6368e757cdf2314bdd77693350493c1b
SHA512e03c9e40e2655ccfce801216084035fa1871c5b51a935432040dd0fa42d3e4fdaf7f5bdb98392b6eb0443eb89ba49584fc2db80489bc404ef78d34b501872cb7
-
Filesize
5.9MB
MD5afa66e8fd433240e795916b994a07205
SHA15811cbaf414043312625a7e12b544be4059cb2e5
SHA256459be1aa9cfe5120b35216f543ec177ab88b0f385d2a634594d30a6946ab20d4
SHA5125cd1bb6fbced36b5b9d96782fa188466bb871a42fac2729fbd1fc9800bb3ca8dbe7d8cc63f625805a99e7a9b3c1185cc99f98f4754df5e5101f1aa9776fe6eef
-
Filesize
5.9MB
MD5a490cf707f7dd4a0af23472f5b03eccb
SHA10a7fa229842f6681d2288e113887d855df88577e
SHA256cbeb5d4d3740deb9ebe44bc6711a0317059ced7433aa794d3e3cf80220499ffc
SHA51279c7a2416ec16079e54fc3d2f4b4a8cf40aba9ddf084ef60614bc7ceac50f1f4f4f425c25ab69745740463d3fb9d35874afe5c76673b7ab2ef26ccc45af7e0ff
-
Filesize
5.9MB
MD5c26d1bc68e64db87f827a220caf28440
SHA10dcf194b23204cc53b6a67792423218bf6dcdb1d
SHA256acabb5d313d818050a356bf2589af9cbef0a49aa1c04ede81ff93f14fadbefb5
SHA51246d14dc23ce3903b1eec9b4d9c9c0b3b155ca68b2fcb2b4a04b062310fbe1665be03f9181f0a996ffe4b5cf30b1b07c29c067a2fe81a3719be3770b780c6ae34
-
Filesize
5.9MB
MD524ed48383d8c4432312931799724271e
SHA19f140f092ff06a61071bb03d751fa57d17c02204
SHA256db2174d1053b90639bc417694a9b976666945eed9800837a8ed034a38304beb0
SHA5129f7dd0a5fd3e05b6fdeeabd94510af491d8000e62fe3272b14ca666c55d5effee6f1d6759dac0d11f9935dbe19f68041ff3e84eb5b6e88f9de7ab0ddaafc9f79
-
Filesize
5.9MB
MD55406f7826244bd9c6943ca90a9b55343
SHA1a04df1382750055f2d2912e8f2537215df62c7a3
SHA25649f67aa9631f881fc05af11ddb19c12a37536cee355de0b992fd3ac43a4e0d11
SHA512be0533eebd5b2e3e84b80ba1d54997b097da461b7062840ad9f03b5ac2879c510d1a090b3b1cd0e9d54994371cad949f67883fc4da1f8551c283f216cfbd581b
-
Filesize
5.9MB
MD57da4640df37429d14c2043882404b2a1
SHA194df9ab5eb1c4bfa6e93164e312a7ca0a7584914
SHA2564bd84bf6ade27dbb579784ee8d792df6ffb2d9c899c83215edf1e9178a52628a
SHA51244b22804cd22f5fd758a99e9990d684c2862aefbfefbfaf43036dd21ac0ba70b10085dd77ba83361d4b9c185778f31ccc0f9fe1ca6f5d873c2126e6951c829c8
-
Filesize
5.9MB
MD59b0719949b564eef830a9c3f047e0cc4
SHA16ccec9f4764c0882922a24bf1280b7d8fb171df7
SHA256165f1645b41c4231e3008a19f714a40f26e80578bff2849b489feecd7a5b6cc4
SHA51221522c94173d7c1d66d1d1ccd6b601b21e0ba116f1a2951adf606d2a29162759276cb49b5304691083c85ec3d79d3a860a67e23c26416c1375bbefacec356b07
-
Filesize
5.9MB
MD5a9890cbbed234e593dfcc0ddbaac7bcb
SHA19d70766e67439592c58fd5ac3cb9b67fe203f4ef
SHA256d2cfdf5192a79a200e227b6fffecbe5f55377e3058ce11335f8920e66a4804d1
SHA512fec05608557fc5a3ca88e9092f8cfce4adb56486196b691547beae73833381eb0aba7297b1a693ce7b973aac920acc4afc2a0d78d3c1ac834eb21e9479ee077c
-
Filesize
5.9MB
MD5f3859181c46babc1d6277db0ee50bead
SHA16f924e48b1f07ed636136f19c3c636e3c7be84b8
SHA2565e0a3c207569906048a38629c1e45752ff279a47a382c068388fa49af257fbde
SHA5126a4f247525edf706493624c5ad592f83f0af9bf24035a1e07a7d717cfafb79f4bee94913440d5a721b2771d672118410d18ce27ffe8820217bfc0273a2a512b2
-
Filesize
5.9MB
MD5228447f0c7ab0bc4481aca45a5f16caa
SHA188df9bb38f0d210eb0723bc2098c211f5dde0a45
SHA25651002c1e4cf2cec21110c77b2b5c3df7a80230dcf003a602c92610ac2b51f053
SHA512a076c739e1990f1c773328d94cc1bf2c22f9a0cff7b547de9ae6be1875146e1e6093692ff46bd5cf246cd59d9216b164c17432fe872660c32907f3107518d451
-
Filesize
5.9MB
MD5e5773a2c2e4c38b503f2026025d87c12
SHA18cf865a7dc638d6aa5d86b4ebf41ee3c6618b99d
SHA256bb62a4cb156e725bc7cb43e7bbbcf6c71be63bb7cd87ba655027f60aac9171e1
SHA51219cb55e962f833c23729470651ecbf8a6f8ed4b52ea18a76019da33e512b1ab9c917ab55c9bd642916d482b702fa5236f3d0eb8adc7ab797fb15783ba227346f
-
Filesize
5.9MB
MD5bd4b69886fcab94b320acc4d7c6650a3
SHA152c92d71ebcad59dcc1039345bd51f3c47be3ea8
SHA256d4a5386adf88b69fe7dbc70eef590cbe93ede46e7197d9bf8e7653c75292539b
SHA51290eeee62bfd33e9586d338ae60c46dcdad083ec04caa2f05b1a4e21002eb310f6c53e2be5ca5c78382e24282990d19756b6467b82ff92b0eaeadfaade1015380
-
Filesize
5.9MB
MD5bdce7e8967929a52df63ac02a5ccba40
SHA1b052c0bd75310ecdf9573d3b1b28759d7ad592aa
SHA2567cdf90076fd421ca49edaed83ee63047e317f0a0be6eea204858058def07c316
SHA512f5ba665c2d578ee1900e740226030666aa918ea6053e2f32289a3e666c46eae6b671bad24e92943718b378b9b18b289e7b8bd8a4a05441d86d4c3b900bc41bc8
-
Filesize
5.9MB
MD59565fc2e85394c6f04436d63a2d788e0
SHA15f1b35c41dbfcb9cc93eb5ff42dd8f445131cebf
SHA256303f0345a64676d443a7f80ccec2a2088c97c8102af1abb5a3fcd9c8e9972471
SHA512ab9d1d8030bda51ce42e00f98aa7bece53ef06a7ef021d3f98468b21c6c7c95ded78baa5ea97b65fb7745db25d98441fb04cba26fa923cae4b52352bb5377239
-
Filesize
5.9MB
MD5bf0ddea5585a47e396f97afa1a4354d9
SHA139cf294fe0a48dd329bb11efb106437e879d6ba3
SHA2562ddfcb5fd398984e0ebc74c7dddc6fb017215cdae691dc617f27a6c0bc76e2b9
SHA512dd6e1f8812da6c5797258e7d1b4d3e7b42440f177087c3be0d8f71b20b8935aa8967b601418b6b20c099a489c67c1ec2d90415778a5f169f077591709abb66e4
-
Filesize
5.9MB
MD5dbc91342029a57fb9df2b2558ed31632
SHA1ddf85fe36fbb6124f5d1099bdaa61b3ee561c460
SHA256b178d2cd7ec3d91a73822abc7854bd38feab287833326f62e7fb69a4ada90d6b
SHA51254adbdc9a025110598cf0e08a5978f375e006098d7202ce9663ad8dba250057f3ae165623a7ab9b2130603f355fd08706d6c09f2882758451e573fb4b4fdcc12
-
Filesize
5.9MB
MD51b405dd41138b3a706f650a4ff16d4f0
SHA1c59e169e6df99c9c47305bd29624c3f7c3f69e34
SHA256438413bbd78372102e21de36bea0d2af0a2004f60378a1866bc03779342a23b8
SHA512b88acec53e9a1a2f71453385e9e1b5de451a9f75f73c06cdd8a66a1d33a88673cb755162eebb1f1913f867e9984b3e07784edd9a069034671cb5bf976ac7c63e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB