Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 04:27
General
-
Target
2024-09-13_d5094982bc8de82fd5c3b394c5704daa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d5094982bc8de82fd5c3b394c5704daa
-
SHA1
b13023d30bb50fd1fe271a8d8c5e968c76b2a921
-
SHA256
41f7635af1e0bda8a4521d45f8908268dd5d47ab69cb592081cf0375463b57e7
-
SHA512
3d0dbaf875a870ef2b6961e3a53b76df777af6365b17b48504008b346c1c8f3a2ac6646451008b4965a3995200912e57910cf877e13dc70d89c5519395bf3b0b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_d5094982bc8de82fd5c3b394c5704daa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_d5094982bc8de82fd5c3b394c5704daa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PVJgjDw.exeC:\Windows\System\PVJgjDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjECAVD.exeC:\Windows\System\qjECAVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKhOhzL.exeC:\Windows\System\pKhOhzL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yTaBZzQ.exeC:\Windows\System\yTaBZzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zohykdT.exeC:\Windows\System\zohykdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryJaPsQ.exeC:\Windows\System\ryJaPsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qslELSz.exeC:\Windows\System\qslELSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBpuKHN.exeC:\Windows\System\gBpuKHN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SAlklco.exeC:\Windows\System\SAlklco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKhjDUu.exeC:\Windows\System\rKhjDUu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cyVLkmC.exeC:\Windows\System\cyVLkmC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDoXHEl.exeC:\Windows\System\LDoXHEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWqPRZK.exeC:\Windows\System\mWqPRZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUTEnVP.exeC:\Windows\System\sUTEnVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\foSlFPO.exeC:\Windows\System\foSlFPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WyYhGNM.exeC:\Windows\System\WyYhGNM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\idYbfCw.exeC:\Windows\System\idYbfCw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DaqvKIK.exeC:\Windows\System\DaqvKIK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kWHpYfy.exeC:\Windows\System\kWHpYfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLdKKvM.exeC:\Windows\System\qLdKKvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JCbHdFo.exeC:\Windows\System\JCbHdFo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51837cf883564c9ba450774f0863e5a2a
SHA19f3c8f5251f4d826d7de15efa0511834eff6ce94
SHA256b31bdc54b5723173162ef6fb56301a3e7a73e322bf5922361f233716f560a145
SHA512d0fe428fe860c9add19ff4c0fcf08666a912ab87d5922db3aeba0d40b2fe75a67d1c8818fe1cdfca12a0cdeca8c5c3f98cb76233211d05dcca971ed792e13c91
-
Filesize
5.2MB
MD58c54ce7f7c113011e9ed709962a5c986
SHA134d18bc0affe25366bfa2d6110bd75cb6c8be208
SHA25608121c1f6404ccd8924e5920cf5755d5f4d9d8fbad9ed0327753cb92705808f3
SHA5128dee501bf6c232f80975a95c67807f585898b2c0855438350a61d7601ff8872ef97f6bc7b583c18556772b3184c4ff8757fe1e68c50a3ebe4f58028fd0047135
-
Filesize
5.2MB
MD54fbe47d07d5271128f0fc03179b24619
SHA1178c4d004b7c7de90122d3d1f2c0bfce14e97af5
SHA2568a27734877020ef12a8e1ace6968a67941c59042676ac3f78f3dde9d6f1b3f9f
SHA512ba7cc6d311e73c804b18a45174dc89f3ab8bcd0839f48de171e4bc562910106f37392ea98cf9c42e49e0bdd78e52cf340764ddb532a9a4bc21a7bc264cf8cfe4
-
Filesize
5.2MB
MD5dea0bde5795f2db70d95328eebf54e85
SHA143cedb115f8fdac10c2fc96f8c691aad0df5f52a
SHA25656acc2d233f0de14318fd0076c20bf79d14d5603b4c9e8ab00a970f5341277f3
SHA512ab31b753acb9ba64cd17f7fe7a481d369d0a13dfa6d1501d9f64cba525db8fb7cfc4d1c3ea78bf7125a8beb34207bea417ed9e51abdff6cda6c39d52d4048fca
-
Filesize
5.2MB
MD52f251d1de0ee9a4d42b0b661e91aee1b
SHA17fa81e42c36d876bb5588f28d171efa5d1978fb6
SHA25691f873ba706882cab9a8685d1032ed2c355b19843cca13df44285435b6e0f038
SHA512c2a77388e74541c142a84990ac7c742e8baaf8f93b283083abf99cbee16d2950c109a0f0051b880e5b510f1e0cfce159154d2d6292f0669fc7bd768e8de6ccab
-
Filesize
5.2MB
MD5317bbde83728b1b8e76aa50b307f5773
SHA1fd2925076c1ce388f94f3448185e047cfd88d4e2
SHA2568cf851f1071ec351dc84c12b0b645dd7340bcccb592cdac04e688b2a9e18a501
SHA512688402020af765bd0f5de4dbba4969bfe9c1973975e7264b9e746c5b424c570a88b0d6212e76f0a9cbf0a89cf7d9af08dbb8626559d10d7b6d7dcfcdb6a2a886
-
Filesize
5.2MB
MD54c7d429a5bb3c75144e3a0d44fab7aac
SHA1743b2ce337d4970c7accb1686a2e4910accd6663
SHA256e8f2e8af22483846c4fe2245da5dc9981415a006cbad6ae2b167b017c48983a4
SHA5126cce50d0ef00cedf45ca110d966749705c19d13c863fe3301f0706a8af4abab523c288749f5809ea6c5813269520822f507e8efe9e3f1d5a80e36e0174ff007f
-
Filesize
5.2MB
MD5ecd0ef515e520c4e5c67346cb69a8953
SHA13d21770cb0ace9319518558ac9cc6cd870df2d96
SHA2562bac7797e07e11e1c0ec596dfdb220f4d793ab9330faed110154d503cb261fb6
SHA512e235fde768a0ba9e6f557bb3bc92ad10babc5feea8fee35bc8912f80335de9fea698cadf95c172a59ee1035d502d4635824e2ac267cdec215b1de7fb575e79e1
-
Filesize
5.2MB
MD529100975cd4c33aa1ee081b2ffc43b6c
SHA14cdfe6b0ee71f8e81ec02eb91b65b2df1b4f1a39
SHA256a513af847c062a54429abaa3594de7e83b536e2c7a4e89eb476d5a65ceb2d731
SHA5125d35c249b91a94cd7970902b985d470756358e2897aaf11d049bb13f2a83f97535d831a6add912fb6d8d5da7fa72ab7a4e81f0181575281a1f768f242ae2d96d
-
Filesize
5.2MB
MD5acef707839c5d2ae5f653282f106e45e
SHA1640343600059e2c12e40ee2acf3ec2ec7119e6e9
SHA2560ec9e1edf890a491e1e6533a0d6ad3cb5d2cda296cf781dd9520a0a1ab27fd9b
SHA512232d41a0a5e8ff73ad5cdd4d016bca8833a7453e89f7246c709591ef0f0f7af1705f4adfa331d7344053d3821095a8a5ee97684e7847248648aae4254c132ee3
-
Filesize
5.2MB
MD5225f2be03bc09ce481cc6a79cda67685
SHA14dcacc9a616899098ac1710408b20bd1f0889a8a
SHA2569b088925d27bc71dd7404f04f70c4705ebff040419b1aafc89d7f4385cd6eac8
SHA512ca9a4e8ca0bf21929753df7108ac3075c3ed7977c2683ad6287d164abf551e80e17cfc1763042f0173a211bd6e8f887311f307fe093c58ebe3a0c1f3e369dab4
-
Filesize
5.2MB
MD509213d6f2dcb198fc06d1962f3c62bab
SHA1bc83b598b61d9959035cbc5aacfc2108ceda1ece
SHA2569e28f954848148cb4e00dcdf36258a493d1e15ad9787642426961084c59bfbcc
SHA512ad0454c66466e706f2da82bf365a7a317f39678726036c181aabfa042d70730cc7592a1762b411403249ae7afea052efb309f626ad02782567439f243b51e578
-
Filesize
5.2MB
MD59887b2ff1c3efb79eae2203dbbc3a9e3
SHA1ec01e93f7f1ff9c6ea344d009b28365088b4be79
SHA2569e2b3b1b6ed615ce6461ac58c95c7d8599cc8d824f2fba3a91f1726f9850e152
SHA512fabc910ce39b0d71572f7a7703bbba42ef4ccb88f32982942d402b46f462a4c112d2a6eaf83b9b31b42da345d6e41308b7a65e5a08a3a6e097623c7f4b2b4321
-
Filesize
5.2MB
MD5068ea1580fe798b28bcea8b82a090624
SHA1580e7020ab54c000f0998dfa77a012a20e87f434
SHA256c94646548e1eb7b5f9b4706f536327b29bb69d4765a0aa95b0ab43e4d724b6e8
SHA512d93f41b48573e4bd1c228f7efc023dc84daf59c1653686d9ab4d5cf4540e673daae250297ad5a20d171598c7d294162a659c649a10170ae19a952f3133f12fd9
-
Filesize
5.2MB
MD53467d0bceee5de63ddd4443444a076aa
SHA1bcb0fd836fd50db8b9c9b957eb2929392a0d3f6f
SHA2564251d3255fae1a0d91a0b8c4e6502ec6e97842cb789c879951fd103cc1eb2cd5
SHA512f54be8867c38346e5729c39cd7abc56d67c9ae59d367ecf49655c4f88e1b09741c55d52faff572517be01feb043d65dd2444c209ddb5b448a0f1617f6873296f
-
Filesize
5.2MB
MD535cc0d78153771a54920bcb657a21b58
SHA1f3e6059a2d92e73314a285543bd4227097bba99e
SHA25654e23a2023814f32a17489d663acf34cce94efa4492241dd85875e32e156e4f1
SHA512527c4435232dab4be72e87295ea1f4e66b8d07f2fc15cd2b83e4ba8b90ec3a3526843bd22c605b4f0252cf8d9e7a564e2bbc55e695f85bfe308c60fdec0a4970
-
Filesize
5.2MB
MD594ab56eb01889aff792e155d9098ea10
SHA189bf972d7a3078415ef3c387f7a030e01209b518
SHA256366e7c0136dc0e19bf7ad845dd71b15d3c79027fcabcfef2e6ac2f5d2e762f59
SHA512db194e5767ebf200c6ed75f080f16b58462460039412d6febee9c41478b1b922921bb1a617fd9a093e4472a5ab1d4ee5facbc78febec60eaafa612bbaf931d75
-
Filesize
5.2MB
MD5527a36b5ef3349c6fe361b80d8887f11
SHA1c270f2aafa2ae72a690120239e75430ef07aa953
SHA256e92d26a96af75f926a8eb0e26b238380a65c5358b519db8197ef125c93ea2777
SHA512d91093a7d4d6313368d67b4babbae2fea2254d6d07f771c39f9cb5cf00fa39d446c9af1b78d5c633cbc31400a963328dce51924810c8c0adaa8eba59d91a357a
-
Filesize
5.2MB
MD5b40402c16f3e046162bccb0cbd93c05b
SHA11bda5af66905d95c5d4c3bff6af7cf957a40ab0f
SHA2563eb712b39b9ab06bc17728ade143049c8e38b2f22f2b9e816cc73863033f01f2
SHA5124ac62f91abbd6152ba42714a123614efb84cb731999e781f93d8cb7c83ca35be010a6caef7dbed723f3c44d45428017be7f62b833ac0726033060a24733bd5da
-
Filesize
5.2MB
MD5f49ef0ef9567d77839c4520e1074f424
SHA103ff277848e85a77fec7b9247b175ac15b78921b
SHA2566264c7db6e6472c0445fb5003ef29cccd7cbf7d47f7629dab82d2123da3ad782
SHA512cb11770fb0b62d5aeaacbf711d83afa0fe83b206691ac1340fed340426837ce0f3b17c30f4b3ff141617d9bcd593ae510ae1af1d6546d706ce534cfdd894d839
-
Filesize
5.2MB
MD5e46e714982cdd1727417a6b56d820eb4
SHA1e1e47e3e4751038bdfb7fe5bac0b623f7dd2171f
SHA25647c72cdd9b14954cedcc11841e39a796bf5750a95fdb1382bf5feac892af4202
SHA51204b34947ec7d4af1762d25b9f2f44d67965d58db1cda8cbef08208aa26b9556d831e4af0eaf1ae45ebe1413f52c90f0e9ef628f6f91beaabcae72e0418beca0f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB