Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 09:17
General
-
Target
2024-09-13_c6556d2b67e9dd88f46a3ac8d59ec3cd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c6556d2b67e9dd88f46a3ac8d59ec3cd
-
SHA1
68a8042ff29e3ddbfd7644f61839757b6bcfd3b2
-
SHA256
f4d4361d5079d72c44acfe4b5c81e263b83a88506e09cdb5930ad25488d77bb7
-
SHA512
b784697d5080ea02cd59fd06bea436c4cc3bd6fcf75615968d280d9c26551f80f577acd4c470b9c62b6cff30b61b15f207f9019d5ddd7a0b51856b012e67c820
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUl:Q+u56utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_c6556d2b67e9dd88f46a3ac8d59ec3cd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_c6556d2b67e9dd88f46a3ac8d59ec3cd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pdevKEU.exeC:\Windows\System\pdevKEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYaKtXn.exeC:\Windows\System\OYaKtXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hgWSNIJ.exeC:\Windows\System\hgWSNIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBDDmkk.exeC:\Windows\System\ZBDDmkk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MczMdfM.exeC:\Windows\System\MczMdfM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Cbxladh.exeC:\Windows\System\Cbxladh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uNIEATS.exeC:\Windows\System\uNIEATS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlvxOhu.exeC:\Windows\System\GlvxOhu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bxlHnDs.exeC:\Windows\System\bxlHnDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uuvwMRA.exeC:\Windows\System\uuvwMRA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GOqSeAS.exeC:\Windows\System\GOqSeAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glSzjGq.exeC:\Windows\System\glSzjGq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TXoNFGD.exeC:\Windows\System\TXoNFGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xRVwpTU.exeC:\Windows\System\xRVwpTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MuLbXUr.exeC:\Windows\System\MuLbXUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oisaHkh.exeC:\Windows\System\oisaHkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMxPUWW.exeC:\Windows\System\FMxPUWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVaYghI.exeC:\Windows\System\FVaYghI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WUZKkiD.exeC:\Windows\System\WUZKkiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jOITQDp.exeC:\Windows\System\jOITQDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwjmnZX.exeC:\Windows\System\YwjmnZX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e5b4e5421ef634d32b3d2368f5cb06a6
SHA1a866b45b4bd1220a6644af40cfe4cd9ffbe35b0f
SHA2563b212a1fff07ca17a778db4c769e1cb563ac8ab0f1b0bc322751ef2ae0d28499
SHA512ad48b087ea296cd9de84a097347174cba4c5cfbbe507fce26f0e9a2df9034b8967a8b846d6a50552b6cf83627c70427d6f18715835d2d33de3001a0aeeaf9165
-
Filesize
5.9MB
MD56aef7b7a37189a4ef15f160721e6da77
SHA1b3bd5521e193ccbfcc6011fde90441e20245b5c5
SHA2568efa704b4add1c64227037daeffeed5e87cc1e04401738207b70d08d909b5b9e
SHA5127a3e52f29cee1d660bc7604f968f5a5e56dac16e6c89c5d1c9dfeb954a59ca2747db518edb8a29dc13bae5e12fe4de1c40320b77651a7e1e2c6195bc15c31a56
-
Filesize
5.9MB
MD5de70fa313dfae9315a7ee9d5ccd69f5c
SHA1726bfccef3d74c6a220b9309ae6ef2a1cd38f526
SHA25619562998d1bca5b9e535ec4479f9af6d39884c3af592aabdb4386d195d7869d8
SHA512d6e06063c91b0dc2a1177bee6335f9e396f33fc1270a1c2d054baddf696893f8b4ce8463bfac9df33fef810293c3a6c7cd7120c3a71863e80eed6d853a2252eb
-
Filesize
5.9MB
MD5a8463da544755a17c1ad1568bf7d0a69
SHA1cf9379b867e4c9860788eb0dc24b8afa0abf7589
SHA2567ca4f8ee047998dbbd35666ad162ccdf0c1d94bb84c3d570b910b8cf31c99b2b
SHA5124b72a47147a0372651ada1acebec719f477fe4413d4b2bcbd04621abb30fee75763e6b9c13dadbd1b4fd4dd96d3ece0a404a06b9f97f7b868183a3e53d61d140
-
Filesize
5.9MB
MD555a582dfb0d39ab5c9dad2c50652a77c
SHA1682d0388926b3488ef85f340fc734d9c0bf9961d
SHA256c603ee9cb1eebdc559a5f714b067453066f2d63d3d287b97a38d341767f384d9
SHA5129fa21553a8b88df3f7819448aff61d876f97c84662ab62338328006e70df0d5e15e8a35ee519c1a84cc2cf9a06c5ea6a5d0184a098fa7691f5db529e172aaea7
-
Filesize
5.9MB
MD5944e088aded0ed3e88b09fa67fdab008
SHA14aea9f0bb917774114229c5c056679124c539f86
SHA256a7b191151230b817cb255f7147f2b9ac5f0020119fafc9134f8e638aeebb9e99
SHA5129e50101a90f865aeb95261472c00602438f33bd39a37dfbe88c3502dd2afd29f47de80b8831b08418616d3c1e513d80001b079c9bcec5ca93da947111fcf2957
-
Filesize
5.9MB
MD5df46fc0710988971210e0eb0a9a770b4
SHA180d3685d9237c36b06abf7a7c6eee93fc1a5f368
SHA2567e19a644ebfc9baa95f54a8276174eb5a36296af28546b85a996710155dd06ab
SHA5123123b3a7a416f779dd859643cadf38b4c48926cddc842a44ad3462a25592dc00014c2ce3af3278892fbaa1ff1a16da44f3353cfd1cde19930606995de607bd34
-
Filesize
5.9MB
MD5a48f526a3cb9332868c6f7cde9edafbb
SHA150e83958a041859528855d2f8e265a7530c3e6a5
SHA2565fd4fb095ca98f6d212756f76885e6bbe3f95f1a8e40825c7b00a89398771f22
SHA512679c9edfb07570e01709713ba2e259710d5be15f6c1a3c32aec868cc3be459b9b66882dee2f1f95f6e784a0612b785e66e978b25f71e48c37503a28315584860
-
Filesize
5.9MB
MD5968548b091accccb057f5969cc102684
SHA1218cdfa0f8b9b1763185fddb91db11988bf20f6b
SHA25632e9907c403325b24a86d6536a2cefa1a8db4c30de5ccf9238a6476437128dca
SHA512d5778f66cd07018c4e3237fce8cb5f0ec589637fd0c5f8b0a5e85a0abec55768ef566f72e5898b93e77bee164ece4e37f2579305174e456225eb4d4cb9ac1d87
-
Filesize
5.9MB
MD5ae4e0ac2d47cc3e36c421e527c0e28f8
SHA1d76080f918572ffe2561266f3ab4540a9af8d837
SHA256e8bb9ed090e6ad2fc284bf5e11b06db10672d8ac6868e6bd779c3c6a4811ebc9
SHA512f1d890f226f6955bdc72d7820d107bfa713b3fb8c1c1c6133e579bd7b94a4a1498af89fbdb5cf1302898719b5a7e1ac426801ba00b1de8342f179ffe7d92ab2c
-
Filesize
5.9MB
MD5151d80b05d425216527b51395feffe8b
SHA143f6dd8606d6b7810f8f1de172c41daf394f046a
SHA256d24b62d7192fbdbfbc670b99037dfe8461b124b86f076ca6d8313633115c67e2
SHA51286c25209176d1f1ce18d2d958881d81f4520cb086ffcc6eb34c6475fd5e3b7697030cf407a3bc72b15b554708c2c8c8e49368095e7205a228fc882edd4d12029
-
Filesize
5.9MB
MD57463c2271152915bc6c7aaddab226b55
SHA169968dea38e9b6844bf6faef580f0c16af96236f
SHA25614623554d2ea348837b26ebff80537abf2c3a5909c3d708ab314dd92ec566837
SHA51244148f43be3713a17cfd8661de831ef9e1d31d9cd32b7030f7652edfab3e91a193d91b907af938ecb983cacf535217e131581fcb1721fa6f9ef38428d5c3e095
-
Filesize
5.9MB
MD570cb9f30c60cb38816166ac7440cca1b
SHA18c6c5317844dca70fc814a31b27e53cced50aea5
SHA2563c6c78e8b30fc4c9c18c62da2dd7b0bb421778aa9997a6d9cf045cf323dce11c
SHA5123e0d4d466681cb53365748572d07e87658235fe65fef735592eaf2c981674a3faf4eeab2b6530c7bf9f6400b9063d0d2c96d50c072316f79f97801e9dbfdf2fc
-
Filesize
5.9MB
MD5156dfc3181946e40d6df73cf58213e9c
SHA1ed7c864b3698861f84b1e7030ce8096723eca405
SHA256ce561ad142496149f1139894cdcbdf4382f32dda5f739d3224d12015b787c155
SHA512eacc404c1d85afbd9fa01cec94ee8297d35073c8a00cd9258c2e8ef389264b154aaa91ea41f839e57387a43ebfd3c0a35d2fc2ec5fae108ce2a9d7f2c74be079
-
Filesize
5.9MB
MD5268f7b0157ad766540355be092d5ea30
SHA1743ba1fa1bdaac403ad2b994820a439ebc3542aa
SHA25656c61deea18d3f96bfd829d9ad702d66d337811f4bdb15ee4c85c3f9a1b11a9e
SHA51272aa5ab6ab050d02b608214a5706fd28d10ef76cea01cc1c891064f557dcb6ca58a4c59209d8d9fa3966cf2296dfd67278f8c2881d80aca59fa98dcd9ffaedac
-
Filesize
5.9MB
MD5a4b8bd2da9b81043742e65486b3cb2a6
SHA1549c57e392dbc5238ce9e17d83239899e80f9789
SHA25697aaf622bad389732b2b4ff5caefe327c0233d818b8297a1442fa25470960f21
SHA512462052357e3676fdd7d36fce9c672ea1bc69522b119ba3b5e7fba5402dfe902e68a3f419e1e4441b863bfd72ac8880369def16891f66e1d7cb80e6f287a07200
-
Filesize
5.9MB
MD55922882152c0317f6760fc554a9fe30d
SHA1794897345a5f616608e29691752417835704744f
SHA256d52f395b90ec014e4de1d20f8ceff80dcc15c104c8e1af7e2ecf8d1f26ce8501
SHA51227a3414b0011cb6c35cb992423b4f93848054fdfef7e5c82652ad8c2a57fb5d9fd608293d1bcac77e765955b5b959ea02258a2c9e3cd0a9dace8b7bd693d7481
-
Filesize
5.9MB
MD545264098dab918cac4d2c6811b210cd3
SHA180b688961b7498f035c1dffd26bfadff2a361c1a
SHA256e91ed1e37b2d77304a75dc20dbc4a2708f58f013f4f8118de9f6e03e5fb9b087
SHA51270d0346d2e7d62ade1923eb4e63f35f0d9c16fcadebd8b87ae56eb6a81144f891df4f5e2bb428c72c3725526a7fc263ba1b3b2bd7eb59629d33feaa050d1dfff
-
Filesize
5.9MB
MD57eade0be8db43cc2c22cf2acdb1bcd12
SHA1cd588f88811bf362ebd613e8d657701f4b0bf263
SHA2566b82f2cc6c154f72b40e239ed23ea9d77667c5bf737446da1755c62f3efb4477
SHA512940be885109aaf0f4842a10f087b26b9fe9613cfed0a9f1f86e942a78db1b1761e3bca4f6ee1e2b71639e24962141cf9e7f7855914089b38bb62ec2bc6852ade
-
Filesize
5.9MB
MD5633e155fee1a26ead218149050655cab
SHA14bf6fff5aae0d92904d1c46c9c5306068dfa5071
SHA2562039e2bd3044fbbb4e24e76640d6c49626d7393b9311fc0e85b4df801c8ed47d
SHA51249e2a12836789b231588282fd68b769c76f6e84af443f41b0a018eea122e79e49e16881d947645dc11152039d3050f89145233bf6421c9cb8b73e03434b5f51a
-
Filesize
5.9MB
MD5bb3a7abcebc426aaf2a23186ac407517
SHA1efbd721c2d04a2248e281d52af8d489a4ce014c9
SHA2562e8a2ed6e0cd53492001bff4a2ef1f1c3504537ac9f257748cda3fa43929fad8
SHA5128238be94832fc12313da112552bd7dee7ceb9c758e0ae4b095c9eb9e02f7e199e1e63044988fd8982c3f7342df5ba025a139c815de20dd312ec74c9953dd9caa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB