Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 04:06
General
-
Target
2024-09-13_57923ceb7635bf48ac49bc31c0594da0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
57923ceb7635bf48ac49bc31c0594da0
-
SHA1
8f20403595715c756523db9adf2c36310686cee9
-
SHA256
c0455cd80d89f5c56b3e0191f32039387e29b83a13743f23cc3e72deeba9811d
-
SHA512
38186127faeb539b7318323061e18cd5c55afd79b34cc40810a4a08f84570523f0fafed2433920daab20452671bb437e64327ba13a8383be4bbc72fdc9b80ecd
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_57923ceb7635bf48ac49bc31c0594da0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_57923ceb7635bf48ac49bc31c0594da0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wJvvxsP.exeC:\Windows\System\wJvvxsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LKFOdXI.exeC:\Windows\System\LKFOdXI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KvJzlix.exeC:\Windows\System\KvJzlix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xdjCyCD.exeC:\Windows\System\xdjCyCD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CbyrpaX.exeC:\Windows\System\CbyrpaX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDaCbzh.exeC:\Windows\System\LDaCbzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qkwLNqS.exeC:\Windows\System\qkwLNqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcdELdk.exeC:\Windows\System\fcdELdk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlrwvEN.exeC:\Windows\System\TlrwvEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPZfzNr.exeC:\Windows\System\zPZfzNr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwjOYNg.exeC:\Windows\System\YwjOYNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnQOtVp.exeC:\Windows\System\VnQOtVp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pCUNQHt.exeC:\Windows\System\pCUNQHt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\noGDscd.exeC:\Windows\System\noGDscd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkIFYcX.exeC:\Windows\System\nkIFYcX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeUjghK.exeC:\Windows\System\xeUjghK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsJKFzG.exeC:\Windows\System\IsJKFzG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vAnbxlA.exeC:\Windows\System\vAnbxlA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nchqZwp.exeC:\Windows\System\nchqZwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMQxGTZ.exeC:\Windows\System\hMQxGTZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\McPTpDm.exeC:\Windows\System\McPTpDm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51999f4faf568c85a8fb648dadf468348
SHA129dd8baf6f4f709acae840c709b0bd0b85934120
SHA256125805d109dff4c5bcc50b8261059ac115bea2eb9e7fba293a2ddbb764b419dc
SHA5122612ba4119e6bfc7ed32d6cb8d407aa5f1f3721b7011a3ab4698247921ae3903049e14b6270a73e4d49ff77f8d8ccd2e71cdb33432c2ca46c2e175d0f19ed4d1
-
Filesize
5.2MB
MD56d18647bc2c3bd1987931f5c4b0a72ed
SHA1647824745b490eeb445b2421449743ee54f5716d
SHA2563784efa694086476a41707cdb6c102743ed818f5793824351136ba9a45da485d
SHA5126d7f7d08d8a060ed12a1c17b0b3547b311d86023871614b9ce91f5f4554127c9c0d8240d938f6556d43d0bda8f3af62eac30877f6a176fdb4849cb1dc23de111
-
Filesize
5.2MB
MD568e44cbc6aef709699ff783898cf317c
SHA197af42a0401753b946b582e56dbc5a39a8f5a1ee
SHA25601944513c8a6f961c0a3fb21eeafbf76e1fd5f7354378c243080af3e22d960f4
SHA5127740714f38005d40fd17ef720133971caabbcbc97bdada6e659c6059f031e5ec9150510931b9558f450764523fdf51c7b28d3a869f469b5d3ef14e5b8f4b6d9e
-
Filesize
5.2MB
MD5c93b1c2105e3061664986f0c2de40150
SHA1b02056adad42f5c56d25eaf641467a8b22e1c7f5
SHA256ffb3f1947b440835c95f858a7accbf560c36ec02abd59ea2296a291978179d7e
SHA512e0bc92fd134d70a3fec245f883e82f73cfad00a73b82e37625f76d32a9cbfa29441b3df69998c6c8dfbab98b5d5121ebcace87abeda954e86434b014201e82b5
-
Filesize
5.2MB
MD57126c21a793b2854a27c1b480dc9841b
SHA1bf583ac6f8cfeee7bb478b573c28286b94ff3683
SHA256824feaf5b75da1c7bfe0d9c23aa8ad72a1c7b0fef62d75103ea29772433234f2
SHA512db75a6fe712ec439aedf0ba569be4af43d95de747ef48c29cc8e9e3ec83628091a9c55034d687c98ff019e10295aa398cee5306f49b68ff966196ccabdc4424a
-
Filesize
5.2MB
MD5c39459ea77b7f8573e6e8c8ac3912ecc
SHA17f690230b32590a8ac25306f55c7e542130e3097
SHA25641f42f2a91e8fb14859818e23e8fe260812dabd6fc9b123042fbc128c92496cf
SHA512e458e39110462d492a715a8a2fda8da8ab50c1b13508d8d5c49011d427ff46e979ec088d5374e65ca6f9a54355afdfd6b784288b0b54a4130b11e5d215182c07
-
Filesize
5.2MB
MD5651c2c34763377b57adef2a5b2e29d10
SHA17d64a7c2450299338b04c3f0db540b48286876fd
SHA256312e33b120ab98d0e9697fb6db27f29ea98dd64a42449023fd2b854b64fed866
SHA5124c9d5c0d7047eebf7c598b1deaed52f60d47e3a16d2a105a6d415b44fbfea448c473a6dfe77eaf07cdfa23e8acdf5a2da8bf77ea18457567ab5fceaaa5e8bc0b
-
Filesize
5.2MB
MD5820a64843e42fc6f8348db075e9b807b
SHA12c1fa56551b60ba064d4f17e744365b620c975c7
SHA256291a63e43c7b1228e003220d26a2d5f1cd6ba7fdcd5e3ef685376a96edcd779c
SHA5122f47a1a49a2effb4c3817ac556150783272e41ef223c40fd503809ba6b2de213921b45c3f9e397c85b2ac41b87057a8070ada7ea75c64eeee5ab573393e2ec7e
-
Filesize
5.2MB
MD5fe5a1d8bd69754dbc747ff729df12992
SHA11f4105a2415e5251871e81dc3f2f8e7ab36d44c3
SHA25620e0626cb4195483f60c051d92da391686eb9ff62988f5e1b5daeecf74dc8655
SHA512a74b6b2a476a843146130f35fa064905cc7ca644dadeb3b64ab2565e4a415e7bb060bec355784aa3d9b0977a54750fbc3935eeba37f0d640030ee053a8ee47fa
-
Filesize
5.2MB
MD5d66d5c736257b0b939a2c2b307ec5955
SHA1b4f9047a245422e8559dab9f166bb0b80dfb5852
SHA25628d2ff8187c9bc64cbbc4b4348d7f63dc6af8415431341a858439ad7edeb74a7
SHA5128eb81993c1f02b460092ac9ecfcc9a06a9ecffb8f8ae4b85085857a2d9291a4e7c76f4a43549f88bc9e294586f59a8ea8cd6cc2fed1b613ba8a3d64f8ac053d4
-
Filesize
5.2MB
MD54b88b90aa5db8a5e60398b8797af198c
SHA144180e3a0316133c7568a5f67ac019eab2b3019d
SHA256b35c10a189027528eb0ab17055a28664d2f7e1881f4151bdb6f518189828bd7b
SHA512da0726ea57b3647facb19a8d0c12a26f94feb6c1476eef0b25f10a64670ee9d8c20d96f6b3b20cb27912ea46cdcf4ba0812d29fa31df13264006603c7209e34c
-
Filesize
5.2MB
MD5f27cc458e115c9cf5bd1c4292d9b77ed
SHA1643a8179cc86700ba182b7006025620a3edc9704
SHA25601f7dd1c14db280cda942377e218956fbcd681bb8f0bb5cb1ec7607b778ec8f9
SHA5122918252fc10c0e080c5f9fea70acc52efe7e902355ca95b6441e26cb2d00d37851095a5d9534a2671bb001f6f3b8048c213a649bb61395293f212fe86c80789d
-
Filesize
5.2MB
MD5148b0cdddb02e9e67c16d624715885fa
SHA1fe66c3ea0587f7d84a43c500b8a4eaa559d50538
SHA256dbe7ecb8ffdd7798eb830be9245940d1c5a403424bcbad7f763e5abff6073e0c
SHA512595181a983cc02dc9ebdb77037eff4e629462e0f71fae3c5ccf15f05b408e0d19340ad67d7fd6b1eb278674052f65382c3b5b375691a07875e166df62ebf1bf9
-
Filesize
5.2MB
MD52992e6c35ece36688905255fd201b4d4
SHA121510662739c65b7b88afcfb90d71ffb4f901a9f
SHA25601d1405a08b0e598c70a0d13ca696ab5508b906d38a0f08c26e8dbfe8de3ba22
SHA512dd256a410cc60b55231c89c033dc62f17bf0ae9dfc957cd64e246d59c1e37d2dae958aac7e886780dbf78c20776082ea7b6eae988affef47dfe27c374b960564
-
Filesize
5.2MB
MD51eeb50cdd72829d771c1119760e53435
SHA1010cea1d5633972bddb82544c78f8bf3254a5a8e
SHA2560d1b6f23857ceb309a5280cfcbf325bf1a3c32305074b79825d6dca71155bad1
SHA51268ef9833c0cc9b598fed392489c3be745f0e53e6a9e0cbaef3b4abed892af981f89ceed61796cc515e9ed8f0ad34400eb40c68ca037901ad733133df2d1162ac
-
Filesize
5.2MB
MD599af2083b50e9ab363dbebf14bfc28a5
SHA15dd2b6b5039b1defbf4431a47506a517bee24882
SHA256f73b1c4bedc0e68a4c9730bda1c894e76abdbfd3e41ad0428a6eb89f50407558
SHA512ede6960cdf02027e51e61bb55b783c17e3c138e1f054fd652ac8483c59b9e57d3c13b23e21779f9e93bb6cb5692cccade44ff2de28a47a6b9354a365702bb399
-
Filesize
5.2MB
MD581fbdfea9da4bbc0440a8761c41f55e7
SHA195ec61901c06e7d285f9c1a2be3f5553fc554f59
SHA2567e0a36d9759ec5870da4c8a5391b1c0a46a0dfcf7d4ca3886752d641a4326901
SHA51264a4fe3574c2a2daa80c06c543fe8bcdcf2684624255cc79322621f93b332214d9f9d619d619b402d2aed2ec08f9eb5ce35c1af945a2f93545f75ad3a4d899dc
-
Filesize
5.2MB
MD5475288d32f0b77501741a38facdbed36
SHA160bdbab79655ade77bde23ef9e9be4d7634a3798
SHA256571134a401c2b6282dfe1487678420d53bfc690c2ee52ae066a2debba2e727be
SHA512f903c52e4ef1bb5502e19d51268b687fa503d22af8f41b2d6771db733cbd57900f48439ed6c9b505d23f217c3ca9a33ecd0982ab0852d300968dd04088168018
-
Filesize
5.2MB
MD51e8119c65daba89d8cb2cddf70a73077
SHA1ca0cf86b4a6915e2879d08648dfc0ee4c3443f18
SHA256ecd624a28d9e7a9ccf08dddd621137f5fee9bd25828db845e58fe10775f6ee19
SHA5124b0c9755d4e585d19418469db9f390bfd58dcee5bc939c14cb997587c8dff5c532d05379d9782d7c92496a0438d75099dab0bc313f79bd2f3d89bd696488c983
-
Filesize
5.2MB
MD58e22e2c40e68cfa7530bf02426a4f51e
SHA1b6bfc20e589b0cf3dbbdf64ff63316ec584d253f
SHA256938e6fe9b54b82fc5745a86a25b68ad8142eac4403c645848501d35601ac55bd
SHA51230d47930698c670b14ba32a6aa979cdc1abad0a27772d00003c541bad2a1ac55b677c20c92eefc36c7c5a0957028d4179f9f1eb286a0ec48f8daa37691eb8a3e
-
Filesize
5.2MB
MD55a482614079c19d4e4a5f94401200ca3
SHA1e554f26d3fb8590b499901c533fdb58044754803
SHA2562ff8d60057039f239466b43ea8d16d859a0825d5793b0b93b5cb4f02def605d2
SHA5129eba19af7c429ad0ec318ffc1bb80a9ad396a7290071ebc64e37dba17f522e568f91eb6b4f4662a92eba22f691a6991f82cb0adbad973639ec90bb759c0d7306
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB