Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 04:08
General
-
Target
2024-09-13_948e83230eaf0a826a040cf130417f70_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
948e83230eaf0a826a040cf130417f70
-
SHA1
8024415cc6a9dc123193654898edcab6231469b2
-
SHA256
c98e38671207ed64c795f6b83fee0b14163b804d42520e08dd240b555d70dc20
-
SHA512
bd6a5578bef13b1f5153edc7967648341290087e6905644e4b47ea1f0ca1be4a43ce88fdb127f99d0e2a4d048ced877de01dc0589f96129ee6ec3271692eb8e7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_948e83230eaf0a826a040cf130417f70_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_948e83230eaf0a826a040cf130417f70_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pUINfpP.exeC:\Windows\System\pUINfpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohoJNPq.exeC:\Windows\System\ohoJNPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kETGNsB.exeC:\Windows\System\kETGNsB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MygKcFo.exeC:\Windows\System\MygKcFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rmUVeZF.exeC:\Windows\System\rmUVeZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMqLOJT.exeC:\Windows\System\aMqLOJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYsKRqn.exeC:\Windows\System\uYsKRqn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlpqCPu.exeC:\Windows\System\NlpqCPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OndAhHT.exeC:\Windows\System\OndAhHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\flkHNpb.exeC:\Windows\System\flkHNpb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fOoyXhA.exeC:\Windows\System\fOoyXhA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tnlxaNz.exeC:\Windows\System\tnlxaNz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAfMACx.exeC:\Windows\System\NAfMACx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVcdYJF.exeC:\Windows\System\wVcdYJF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iJRjHRv.exeC:\Windows\System\iJRjHRv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzfrWHC.exeC:\Windows\System\AzfrWHC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRxONUa.exeC:\Windows\System\rRxONUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SRqPWac.exeC:\Windows\System\SRqPWac.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIQbkYk.exeC:\Windows\System\pIQbkYk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMFCqzr.exeC:\Windows\System\CMFCqzr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHxLAXL.exeC:\Windows\System\zHxLAXL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD562f866c08c658d07497587d4b35dbda7
SHA15be69f689b40be61db557d90f0c8c09111f29731
SHA256f3eaba14f0b56c781cfc9dc096a2a24d9ed7edae49f4161e2101041ff3c781f3
SHA512b3dc88a741f47e24f35eaf2d6bfdf5700562a50d3091631fa70aee138d5aaef6340820f2fa21da61995a159359cf93eea4a747b8d180d19dfbe91e7a08e70a8c
-
Filesize
5.2MB
MD51ed76fcbf9a8c546d78d2e625b355057
SHA1df207ecb910eb5222ec0c47b47ee21a8316b9e79
SHA256c6c32ac0ade63d3fc6fb6a4b125cb16d17c823ece4d775a487637f6b75745543
SHA512909fd4e4d7b43ecb4f7a13ab967579c03643cf1aa18c7db64a35356434e77b0599656c849d23234aa546e9e5ba1aa7cb60dc5a92352c21fe2a30d53458e5865c
-
Filesize
5.2MB
MD527e0b970202fb567c93d93ec3e072872
SHA1895d5802eb6465e8440fd7126c39a24446c5c87a
SHA25662a5e58c10fbeac17ac0929cb8da55be79881abe5a68732019e8bd62d15119ba
SHA512e21b615a65d4f3f85e1e15049a2fae7f2afd9575ce05c288bd80e214d63185fa6f8b3a408191109385944a7abbc9178e6fdc42e8b21741a72819bbd0c52f17cd
-
Filesize
5.2MB
MD5d8f8c056377c08bbb927a3bdcf0a891b
SHA131aa792f83d1d5216deec3f6c62f6688a2f0ae3e
SHA2562eef9df923c58d1daeeb29d0eef96ef41616933e34134f2f88a5b615955697cd
SHA5129713681d2335ca3540f6419aba20f7edb813dbdba434cbce3878ed68978e1d8c087715d546025c6bdf7f2530302a125c16df35efdc08e0f0679b82f6467ec21e
-
Filesize
5.2MB
MD56fc3c2ec18242dabca622bc767c2c85b
SHA154490bd4bceb8b62e6d282ddf66a05288af63ec0
SHA256a5401f9018a7fb5808f5f4214e8054b0db6bfc2f5976ca10ccab10037dc9cf10
SHA5121da5ca80d6861ad2fd62b579a09a83a01e2479cd0ed71cf30283ca5e41e4c89e2d3732fcb72fcaededde6345ae705f821e9cabdeaec2a23ec515cbeb1afd5166
-
Filesize
5.2MB
MD52d37fd86631b50d987c6ebc4356f9a55
SHA1648534172e05c478ea766bfe66de0390f95903b1
SHA2560d75baad551e3e52d666edfc592663816c88dc8ac65c7678fd4081f5b8b5e929
SHA512303829f9681c330b0cb32b177104e2c11c57f3ff0e0ffe1089cccdf0464a4a6c676d945c4c70df5c7d4657555903fd151bbf46e230493e3b40909b2fdc57793c
-
Filesize
5.2MB
MD59aad5e379e52db8be362bd5266bbcec2
SHA102553ffc604226775c7af55573700e39a9117cae
SHA25696f0ed63ddbfbbe41e245418991fccff60e1bdb54092cbcd6c89b4711ccd875e
SHA5129162e6f7119984e4ba8653f8066e5674f31813b99d0173cef0d5b981d4e5569ac03a0e85aed59940ae7534de669d24d6f83bfd32022638fc4a6deca2e174b5c4
-
Filesize
5.2MB
MD5888372b5cc4c2a7cecbc87fd4b8fdfd3
SHA18519ecde018ba4a0f98727057ff72b9e13f0e9d7
SHA256009be1f022dd9276207c121809df0290c115ec1d5c588b804a10c4a4db6e3a16
SHA5125345cb0d3464dd66c4d0c6c39e7cee90783307ffe47fc2b2de8dcca3490547dd07540be9deb4bb653f110cce5bd895b7c7e2fd3b9c80fa22835f8e7943bffa42
-
Filesize
5.2MB
MD57510dc53ea7194747fac62bb526f2573
SHA1f003957c9530902d4ff7ad464df405adf55a2671
SHA2568b352f112dd16a3cdedd2673eb1c7e7206eedf66baab77b41c70f6dfdba9a03b
SHA512b63eaac9d9b2ce71655cc27321931ea288f12060211b96dddf22f037d0421006ca4b651adaaee3a1106f87a19e3a33ddd74faf923b203354d3ed2fb53924c630
-
Filesize
5.2MB
MD50b3d2dfb721ecbfc6e082cb8f049092c
SHA1e7456ee546e80b56895c1c9aa96787a99998ec81
SHA256aa2e3cbcb25642a1f33564c42d53ff069e2fbebf41a1f1eb54b0d4d4d4e3406a
SHA5125275397124572b4cfd56f5ecd33b1ca7067554c8e04f5b5660fad29b243c971c30caa7c238a47fc0ac6c7f0ef30c5862e4722e7371e2661604fa58312508dde7
-
Filesize
5.2MB
MD5b588998d7e8e80fc37ba56b85554f2ba
SHA10bed02deeaddd0962ee118602482866200756289
SHA256a3354d5bd29dbff1c0719e1e4f919b8b63d43f208392bdfdc9d5e50afef4ea13
SHA512e339acac2391356e4148acbcfe37c3b95a1024198ee11edd0883f7f461d82f8c98c5155a7781aceb270c01877b774483897f3d29b7cb891fa2bbbfadb9c4d66f
-
Filesize
5.2MB
MD5e19cab698d4cf2ece5ea51e2ba39a86d
SHA110fb591e13ff104f0650db628ae506da8daa0386
SHA25605db537c5eed23cd58cffe03bcf125f670324e6ff51cdca4926cb7dc4f62e654
SHA512ac3693e9fd91b1ee961f5550d8317f9433623a3c99e54aae82ce71eb53678b2ddbac77cc3138fbdd247ed7b6694a392a7cf5ff6ac79b2ad6cacff3813ae5eabf
-
Filesize
5.2MB
MD5f443262547ea20469f201d0c2da7fed5
SHA108ccdd3d6338519f59742d7cf414e352c884da23
SHA25650fccc901b156996666c5cc77f9047544550bfc8fc0ba8225dd9b6c45331d82b
SHA512c2ee4fd1413e23278189e8b4951803a802b4d51800e605116d2e66ea3f1dfa80cf7bcef1e13fee7172b4f5dc3fb7c6a44cef5dad5f55a95a17ee9d149d00f905
-
Filesize
5.2MB
MD592d88a68f298d55903ac1947fbcd1edd
SHA1714b3621c77e01be54b22a2654387d99fc2687c9
SHA2569c3a601efce207eec7f26ed2ee7c49b0291ca65a119bd0a43ee3c44966cea1b6
SHA5120123e5277221ea0460723959b4c158cd847c2ecc93a97f926de8c29f91c12925fc14bbaac6e0d2a1d07414a918034965c6fc16c5b80b4fb9aa3aa449cf6c87e3
-
Filesize
5.2MB
MD5626ba8ac2df3dec5262c9019693c2bb0
SHA17ab81012b7f1b07b63b852c45e05f473e93b3e4f
SHA2569726ec4bb99fcfa14077f6d9197ea803c14983ffcab2a4a46fba9113bf1c1c11
SHA51245b2f2547ae8099ef31c30db87c45c12b643d50729b13dda880079a9986c04f5d160681a8b2d1716f09f4fe445d7389c1bd32fa41a1d597b491424bc4d401deb
-
Filesize
5.2MB
MD5cdfbe1995685a688f653613a450d7441
SHA1187ade4c8d22387109a94826c69d5b9b029b6a82
SHA256c013743697d119e079050fe79baaa65051ac981acdc3a02d6285d8c1d5c2df81
SHA512c9c9641c96e31518924753a9c664dd8d17cd1250ddfb5e56138384f3d94d8eb0d0b8e39d92804e3aca75b75373fe3f15b043b261180246b496f7e51589bceb80
-
Filesize
5.2MB
MD5e8e9eb1d6ce14814b5c5e8a0694129d2
SHA12ead0b0dd5e13cc4e1c994ff561442188884e93c
SHA256e8e443d8c010320199fe648db8fda1228bd8528d10a631c4454922fc9a4b5d33
SHA51214db6156dcd9b0684d9fd7c327c68296879ac18c1e2ae47d6defc9f6c9583d5cdd6b84c2cdbc9ff0e6f232724b3984b4cc50b337a1a341cdfc98a48fe0702369
-
Filesize
5.2MB
MD59ecf6b55bb4afcb6adb55ceaf09d6c36
SHA15ac2a211d95c5eac985fc465bdcbeb0256e16d56
SHA256b9a68af9de64aa8831d8eacbadd6b3dcd4cf58ab997007478c01c492f861570e
SHA5126e4b3b092c322907276a35ace6380f1498815a1c07eebc7ec95eeed861f8817ad1c7392b329826dbfc88dc5e09ca08212f7cf456c8ec4f11cd0112a2f07e9b2c
-
Filesize
5.2MB
MD55c7829b28dd2342922fcb139f93a8207
SHA19ac967032fb58a7eccee2c4fee206a742ed74faf
SHA256e57a7363d86fde770b1c28508dcd8247dc8b230d7010fa543f110fee91a3a54c
SHA51288fc70c7c81ac46e1238034e74601efd053f08aea1a74e76d3413c24785d12ec8e2cc59eba7b35ab376361972bc3e6b4c2e9519d5bfecb576f735c1e665100a6
-
Filesize
5.2MB
MD53ca29796fd15e16b8d3ef6ccd7d01437
SHA1495a504496fa39ec7ce56569d8a448bdb5de41b7
SHA256e25223165812c0944bc1780a5529fda11c5f856d0e3ad029b4dde7ff6f59461a
SHA512a6686648faa6d46b835d54161da9068817875d1b09890b154fd986fc9093a18b4a2ecb336ebcfab8be5ecab9484816e6bbfd8f64ae6df476dc6128f14476d317
-
Filesize
5.2MB
MD5df70a80e76c51eb50970fb520c4fb60f
SHA13c422fc20b0812b9081943e5ad310d7997a24dee
SHA2563bedc879d686c275d7d60967a4c730fef33fc5ed97ca8a718c09a2f18e77e485
SHA51201aa27c9957f504da43c4cf62d8b0f38bcac82cfb4fa6ce7124675e5e6a2ae996b86fa4b7ccbfc14eaeea77dc4ee89fa78920fdb500ba6a85943bc45a5856045
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB