Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08/09/2024, 10:09
General
-
Target
2024-09-08_843044785e9efe7cb67431bd45bdece9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
843044785e9efe7cb67431bd45bdece9
-
SHA1
9023362478ab1551e62156375727153f0ee2eb57
-
SHA256
069790fc4b3a6021b36f184275207d6e47ae243acff760578fef178fd2df2b7b
-
SHA512
c970cb72f0c0878788a0dbd419821a376d69297ed666129641373330798ce542e00d8c17a41b7d2ecf426bf85b29c3dcb2925b57b4f8999c75e2dd50bb1883da
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_843044785e9efe7cb67431bd45bdece9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_843044785e9efe7cb67431bd45bdece9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XJlewno.exeC:\Windows\System\XJlewno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YeXTYqB.exeC:\Windows\System\YeXTYqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbcVHMq.exeC:\Windows\System\wbcVHMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGZxvxe.exeC:\Windows\System\DGZxvxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbwBqWV.exeC:\Windows\System\XbwBqWV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XLoHXqj.exeC:\Windows\System\XLoHXqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqbtuMI.exeC:\Windows\System\dqbtuMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcgcgZy.exeC:\Windows\System\mcgcgZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SImFXLo.exeC:\Windows\System\SImFXLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLsBhcF.exeC:\Windows\System\SLsBhcF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgHGjHY.exeC:\Windows\System\pgHGjHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXJZXzp.exeC:\Windows\System\CXJZXzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIMkjni.exeC:\Windows\System\RIMkjni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqObFLh.exeC:\Windows\System\sqObFLh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltDfSEq.exeC:\Windows\System\ltDfSEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aLehHSt.exeC:\Windows\System\aLehHSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMdRCeJ.exeC:\Windows\System\TMdRCeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYlEaEB.exeC:\Windows\System\EYlEaEB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfOqsNg.exeC:\Windows\System\XfOqsNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LZSxEbN.exeC:\Windows\System\LZSxEbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAqHPkL.exeC:\Windows\System\jAqHPkL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57e7cdd0b5f3900751761275b0fdfd0df
SHA1438194c4fbb3345aefc3f36ea41157bf243178d6
SHA256ab2b4079cd731135c9a5c8277d3d854b96d784a639452c1086048c2c0062d706
SHA51202c3df2e61f553bed3c0527af48c91290d87ebab1b48ecc73702a6379a42da5a18b063b8828175a3331e0927889c33097e86628b7229a3ed43cea6a9d85f0b14
-
Filesize
5.2MB
MD58720710ad3ca2b9088d30c684bce700b
SHA18e73b0cacc3c1e618eca854f258bec0a77de3269
SHA25692b0bba0bd6eafde3186077e6650c800ef6be1480ac96c2e7080ad4158175635
SHA51234e8110568853d29bf3c37f302d474a4a68558ee772e2a86aa6e29322e9eb8078d7f9e6907a1165906656f7809051036bab7fd6afe45489f13b4940b08002506
-
Filesize
5.2MB
MD533e21f2098ca6b07962bf66145c2caa4
SHA1e2618c61f74f6ba9ad7ebec0ebc8aa14de68df0a
SHA2560dda64dfa13ca0c59a19c78de5d75aa0ac1317c88eea93d611d241d508e7ba70
SHA512808fcf4a876cde683a66144e60de92c881a3f7113ec91b5d0cc50c767b00baaf3de9a923effce9f34a5cb04b389bd0f96e1d9ad94906bafc32820e0f13ac9830
-
Filesize
5.2MB
MD5075a674263650cb4308d6cfc04ed606d
SHA1ae56e9aab646db65482d2dadaf266eb10e056635
SHA256a7f492864fbddfc01c35aa0f7fc660eb1580127bcae466ce6a8161935d9e7423
SHA512544c5aa917b67a23b7fc11f7672e4ab4ae9a25d41a4258b02014de68fc10f393abb24470e002f362a8a8dea8f32b3db65900c5175c483ef7a9a13f9d2542e52c
-
Filesize
5.2MB
MD588b99f2e9272a7c7e0993b444547abc5
SHA132324d9e1cc4aaa2c6413ae45d6f2953ca436403
SHA25695b91d94971838cb67431153a1cf897ba5f743d595467487e618a62957890a25
SHA51216110576ba3d6d63f2ca0e0a7887204ca5f4d30ee578ec489854f4a551d7113641062df509950129cb4a3a08a8d631dbcf7149f18c5c63fe75f974dba3b46572
-
Filesize
5.2MB
MD55a8866d3156e43013159aee6ec50da54
SHA171f4475331d14a01e13615d3ea549dcee2b94c1b
SHA25630d3f7566baefdb52aead1f6b89da898fb5e12a22a38de3f136236c6937979da
SHA5126e1c87947cf466e79ff0e48fbcf2251116db24ddde0b5a3f1bd00a8eecad7bb22b7b847e721c4dfea682a0e5b146775b2220af602b01e21e82d9538fe65b20bf
-
Filesize
5.2MB
MD5ceca475a6fed46a40a32203bbcff474b
SHA1ab6362d62412654932a9496ecbaba95ebac48cdd
SHA256cbcf8b28dcd0c59c872e30807120c7b800ff02c8153e38290d116c164eda6c77
SHA5121149747d7f448a01283023eda6e9b09e19f9d8f63d14e9dd04248c0fa06914e44c75f69dae026c06699be6f20829928746319f3605b1003c5b4d8bbb1ce64d8a
-
Filesize
5.2MB
MD5f9cedba4cef086622ef940d2717651f2
SHA1f4228c1f1fb2ab79e0d186123c72f42ec484726a
SHA2563f2c0f130bb170e9ff896f79e3b47d484dba84c50b53f977a9ac6301abbcb1b8
SHA51260ac2b3ff945d718827a49a9333f3aa14c28d5a7903695054b28ab8152d97c6b81f88ac9749f5e998fa0ec0766892fa60598ad0132ad799263ee49fa75fc3caa
-
Filesize
5.2MB
MD54728f8170b7ffad404561b050d703fde
SHA1abf4f32a1f60cae44062f3cbd51582a7cce88bc2
SHA25633c11122d72e6cb89724ac20ed362a8d83c84c9131b7b3476c3d07aef16f0e9f
SHA5126abb07aecc27e04dc8b9c36a9a746c9094f476f908c29b1a98fc2f65adf14d77be2372aca5393a135c6f6451c71aae020d12ac28ac673ccf906e160668248503
-
Filesize
5.2MB
MD56c2c9d15a80abc744a77561e457850cc
SHA15a87722d2979fd76268d81692606017f1d99b04a
SHA256cdaf1679845b56189bf78ee0586bbc481e571d6a0ecb41d3942bb5f48b5d5f5a
SHA512f3df55c22f23980040dd17568869364dd67aaf8809bb85effc3a96230222961e365ce3c4833a5aa33a4aaa8e75b79019f4549b9ba1d544aaf78673f1767f2df6
-
Filesize
5.2MB
MD5d333db38b7eedea569c24ee62273a10e
SHA14eadea982f40baefdb0c85b2b491e5a31d39a645
SHA256dc15f3ae2c9aa2144c0dd09a980a3eaf5f3a92bcbcb4ea145a6d985954817c39
SHA512c0cb9e30eee84946c57f02eac3f3241b452fa5c4ce30b963f84dfd9057028211b74fb1d5184b75788ef56a8a4152c9d4c8f592592c3da89463768de1e9275ea2
-
Filesize
5.2MB
MD520bb74fdff20f31e05ad1ac4af827666
SHA13c500ddb6b5433b860044b44136d62d0023ceaea
SHA256e759e8d629acac370c923df3621a53e84bb31ad9cf56b6281e0916c8ec4b71c0
SHA5126e1b2afcf17cc32cf842c7b3aa69726d7b92f0fdfdbc78396a5b08c43cc820999dc8525bc6dc479e1a2153043c156a713b476e5faaff218a0c52a2374abf027a
-
Filesize
5.2MB
MD5563ec7c8076c2f1a8088773f1c8ba632
SHA1e4b571e566e407363ac7384fc3fdaa2cfa33d6fa
SHA256864ad41f67c9b3ac069e885776eea03ec562a792c15e792bf2b13ba9e18852f4
SHA512005edfe4d883ca6efc3d6e71cc6e4b9c5e127c8049b5c2f1c70110533daccc3f00e4e99bc785f8dd509e83c7691b711d03be51e29caccaf2ed0cdf19f313e982
-
Filesize
5.2MB
MD5d8358e4268b7a729fdf03623b5f4a376
SHA1ead7ba4ada9fdf34d9e5d190694a052a7203d17c
SHA25639cffda4703e6204fc82829d63e737e0ada967b60a49452e8b2031fc2cdf0af6
SHA51297eb699fb0ad71d3a2c0d723239a5495739e334a6a84ddc6f2c5a9e40b29cfc59371b43375a3c8f91e72b85913e65bb885765cb8414690eba95a446c362b2a24
-
Filesize
5.2MB
MD5d2bffc44dcbafbcd83940847b035b719
SHA12b650d0664f5e22f2d3468089c781e91bf77fb8e
SHA256b2f121c07bdd35e80e3cd47dde57c02303f64c4b6c42b8c3c6b715443a82f612
SHA512a0c0e1d7cb887872c31646c18855cffc4ddadf92e36e56b18954f80bafe1d1c20f88b24ab8119e4f4350875075f36557abef26ed02bf6bb468f8008648c23d3b
-
Filesize
5.2MB
MD5929dca5b8adae6892d3ad8292a471ab0
SHA1bc1c9a532780cc54d5a1bdd65c5b5ac78acdf63e
SHA25603b1627ad9892d343c93924593c617a56b917d645c35852fe44d3e71c0a4099d
SHA512741dce4b208caab00d3a5b5cf5da0c40cfb11687f44efbb23dda14cce416a0a4f79d66d59cc94d83bb4ade230e3c1beea05d3929531523d27a331c834b1ff2d0
-
Filesize
5.2MB
MD5d74bbea9e349399bfdcf33b01e4dc04f
SHA10f917b6caa9620a295ed271a0f2b1681320fff60
SHA256cead52178f1f9f51e84571d0bfe1251d4d830a435ded21e45dda7f6cba4469ac
SHA512167c896ee06c658363d9fe8df07ea8045dfba85c868027fcc74e0dca357836b464fcab45e3e587fec700d093949c7828b91cec525a642939f663cb2cdca175bd
-
Filesize
5.2MB
MD568bf47adb6c7fecf23e95e84947d3d6a
SHA17abf7c9aa2a93621a4f7f1a35dbbe133e317d53e
SHA2560021cbf3ca379a3e668954b45a423d3a3ec4feccd2babb916298e3f731b00d2b
SHA51201f44de49f57013cb39224e9a91428c9720e33eac8ff0b6d9816a276099513756fbf06eac596a0992f74f6cd87a8e08b9e9429865f0fd702180c4430cd99173e
-
Filesize
5.2MB
MD58aecf92c76e5159aa42ee24d8e5ae5ee
SHA13df1ff6375dfe584a99b0f9512b08ac45b789c6e
SHA2563ac7a55a8b66963f8e325eec1d0d28f4dc208d82451b7bacbec2f1b04e6b5d9f
SHA5128773d9c52999f41e2409a74da1dd8ef08d68abebfc1739f2b1e863b27887d7eee6b2530f724102dff23b67dbbec5f1dc681d91ce433f2399c937a6106972222e
-
Filesize
5.2MB
MD55f43e14da04132f0788bd332feed274a
SHA1083d6c4311566be3fe51dab706d898d26af02165
SHA2566a79c92081073d686890d42b164b9d18e40e338135b97806e7b4d23f67abd5f7
SHA512ff8ceb603050057aea7ae97a9025244f493942c56b2dc6f8ded9b4082506c0514b59cc7eeb74d0825d884c2fa8833afa1d73557565a10a8443c9a6b36a3ba52b
-
Filesize
5.2MB
MD535245bb178b89d80ac68cb3d2df55248
SHA1b577214a7a56070c9c0fe3faa2955b652ddfc14b
SHA2568baa3c2452a119e05866222d2a3c0fb5f044c74c6f251c88ca324a4ab707621b
SHA5129add261ba4104ba94756549455463cc49b3db81dfc3e307b9b9c1f76ef728cae6edb5a71399c74122adff1f3b7be22941a068b2fffa91568a8eedcb5d6466abd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB