Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 09:20
General
-
Target
2024-09-13_d18ddf08792d87c20b4cac5dd6891ff7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d18ddf08792d87c20b4cac5dd6891ff7
-
SHA1
6061264292066c8a28a3aa7f499592d890ddcaa0
-
SHA256
06d09ec1e99c4acb39c6d2af78e96f781a151396c3c128674f6419efc1e7f105
-
SHA512
ffc65d466c2a814f7727d7bf8119f342bb21666b3e950cee367d75284766c5f1a6697024caa5d993c57e2a23cca5714e38a7f2404ea3fc479cf380b74652559e
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibj56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_d18ddf08792d87c20b4cac5dd6891ff7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_d18ddf08792d87c20b4cac5dd6891ff7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YVqXdQg.exeC:\Windows\System\YVqXdQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jPgIWsH.exeC:\Windows\System\jPgIWsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRkAKLC.exeC:\Windows\System\BRkAKLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBnaNYc.exeC:\Windows\System\FBnaNYc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfTNgol.exeC:\Windows\System\QfTNgol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTznHrQ.exeC:\Windows\System\uTznHrQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoswsnK.exeC:\Windows\System\qoswsnK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljrLxKw.exeC:\Windows\System\ljrLxKw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcVSAvG.exeC:\Windows\System\qcVSAvG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKEzGwP.exeC:\Windows\System\uKEzGwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FppWpSi.exeC:\Windows\System\FppWpSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjVbSVQ.exeC:\Windows\System\YjVbSVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yITpzft.exeC:\Windows\System\yITpzft.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYTPgAO.exeC:\Windows\System\uYTPgAO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USVywiD.exeC:\Windows\System\USVywiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBmDzZa.exeC:\Windows\System\aBmDzZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lABJziJ.exeC:\Windows\System\lABJziJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GeCpDFG.exeC:\Windows\System\GeCpDFG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdZRiar.exeC:\Windows\System\KdZRiar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPoAPFB.exeC:\Windows\System\XPoAPFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPOIEuf.exeC:\Windows\System\kPOIEuf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55c0ecf5d3df7b649d2556f54ed13f74e
SHA1e45608a943a9f382e964796ba092892e7a33a816
SHA2568460a936a271c2af74984c1029d07ab5502315900a0718441d47a2bbe33ec4b1
SHA512662eacec2c962d2684dd01ca5acdbd749b84c788211f021befe935a97b725baa68b169c8dd52b7a54993470bcb7636c09da7e2731cd45ad7517d3341d70b2816
-
Filesize
5.2MB
MD56640f800769ccc40ba85f3c8f5fa949e
SHA1af2b449226f90dd67438cb7b0a5872145d17d06b
SHA256b5baf4bb781e5805916ba49a3c2a81240beb6e013595d8e48b723bb78b26abca
SHA512c68b33a6132d0c1baff00b52e35a52dbac363c62b318d2f84347a1a0c25bc667c62d7fbc7cd23f72f294f0b6aabb852db953f888b7d7c8d7806d1fe087e1ec5e
-
Filesize
5.2MB
MD59a1a9ff39fde22f2b05fd50f9fca2237
SHA13889e211895e27ce7d1b356cdcd30a1d41dea8fe
SHA25611923fb5e40780d9442c470b2108ca1798117981932be258d23b21066790350c
SHA51232e3bc83e23960d64323aa1941c6ea42a1e1d75cd937944d8c2f8dabefc61aad873c843d35b8b77b0c00cd51cb6fc1877300c77835b34ea45c8f4011ff866396
-
Filesize
5.2MB
MD5b368112a630d21acd5f63d82ef81db37
SHA14350dfbdaa8c62bd59dc727b1dce2b5e44d28d25
SHA25640967660ffb33efaa6996416e4d8cbcb722f8eac1d4953390d24376269ff0c78
SHA5128dd0250eb19f863ae0057b3de546bb6b7f7860991c0506ba438d5033c8675e8c53287a498d2168709bac42deed8f53ed8fe6cc6f12c0f04e480d7f16b89518ac
-
Filesize
5.2MB
MD5549e870f8502d0a7679f9a409089ba06
SHA1464f6518c8dc04ae5a95a5256fcb3917004499da
SHA2562c174ee961db3577a8ff20ed6285906f53102bf1ea5ad56862e728550a0390f5
SHA512dd5cf8629bfb32ab3a1fa7332b586aa1e032e5d06b7bcd8eede50525c4fe77a33dd04ca8df0d85853c13474b4a3add8316d04b98a9c02b9ad8aed8ecaf432313
-
Filesize
5.2MB
MD5a33c832fc2d6cef0bcfc2b58f2f7a1ed
SHA1a19b957fb1370fa80ab0bcf7711d6f4d000f6fc4
SHA2562ab76c506dc1b0cdced0fbc3d885c93d7c90fa011e7710bccbd743b6faab7003
SHA512d73c131f0d4e89c388f4ed4ced5029f96d9c55363417a8093ef3d058bb0fef45965b0896a7f756a9d7374da51ddaf6e0b2c126ddcbd734ad2a371da3a18fada9
-
Filesize
5.2MB
MD580729842065e00e117d0b4ee05948a8a
SHA15565b5cf843c6e12278303ee87aef21c57e78ae2
SHA2569ef4951f01231dbb8b88cc4d8614469324d64a31abf0374c45a08223221c8120
SHA512adc03cec839fe75af67e74bce9e4a6a26f0e5d03f3a86490d8fb905083380b8f818244a5723e0157f2a969ddbd07c2ab6daf3ac9bc685b6a6f785b2fb8c5df7a
-
Filesize
5.2MB
MD51df8093957f7434644762f2d763204bd
SHA1edd0a41642f4a9ade7194ae17f0f0e23d0d32677
SHA2563e33f02ed4588cab5bf8ff61f0328c2cc4214a4975a45bc9e37f31722abf809e
SHA512fdcc4a9fd78c133142392b0dceaa72397e42f944f179f816ced6bd408af229eea8bf96a13685f9b409bed8e12d1e6f94e1db9f0965b9a142af98910dcf8ca462
-
Filesize
5.2MB
MD55268a1aa8f5f20e4f7e2735aec8a74c6
SHA162967021a8a63572c5bcec93661cf9fbeccc038c
SHA256feb57e9a4f0c7c560758ae9c298eadbd5de79b9835ab9f6ff7ceac7fe9650e9c
SHA51201724a04fabaca54b15b8884e1a2345e7d874de172ec0b799047ca3cc789d642536ec8340eeb45f767a81591408440043b60f44f474843590c5c08fefa23f210
-
Filesize
5.2MB
MD52e354f4f21fd5fdc0ed4a822adea2532
SHA12d6febc99e350f0552000d920709fb1ebc1e655b
SHA256355f479ba67902e06476b0c18777d08499cd4754e1fdfb4ca3626af950a697a7
SHA512e77f04e35d0178009aaf221e533484e9de8f8a9dd58b57ca61a8d9fb01ff6d309c05a68960e23a57f1222d615a156019a59fd5f8c0dc7009d9141b8f08707849
-
Filesize
5.2MB
MD528c65087dd8d2414ae8db50a14104ede
SHA1484553bdd9c1b25b9eef898fdcee3a80f5d06fa6
SHA256a0470a114051403f4175e68a9117c68e50f82a5f3ed48188e9d004c1d3ac7628
SHA512e4e2e3dcce1bdd0453ec07bc8f7494f731b8679f869103e5713c7b565b3f49aeb62ed947d0c4c2e2042b4eaf70cf813873423c5f0b010f0ad1ae6d7998c2191a
-
Filesize
5.2MB
MD58547b565857fd2f6f5aa51fa77518620
SHA12b82fdf19d9a966a7e18a410ea1cb2ea836e493d
SHA2567936390c7c62196a5c8e1c3239aec3d451eb2f80b71118a3413827aab310af5b
SHA5126d9c43640caff3a75f732401f8b64f060ed3ee02b0add6136a63c3e75461178986862d07ec8d8ef9f3259c9263aa3d947775791bc8293f4a679df208ae582236
-
Filesize
5.2MB
MD51b2d3211f1462f9511ccefa27c024922
SHA103358939455bb1914a25fa27c4fe5e61eb864cc1
SHA25682e0b668c4dd4d09d23dd971cdd5230a394268bf1c18a82df24e521b3509f203
SHA512cbe9f2cac153a1c12cfb1de0928bfe5a144a416e6d050942680e9f29c49f704f20cd858337846d904478469a3191438f272bbad56ff645f7c399bb72ad7f3129
-
Filesize
5.2MB
MD5a975cf6fe6e3092119ce8abc7606156e
SHA1ac4d8a7bef81989da807bdbdf00e77230b54d10c
SHA256b041b8d45b1f9a7bc0f14f843bf4ecfe44e7b5858f1ddda19d856da13be2c7a2
SHA5126f543ea6279f9b172fe9b9a1897cd4c0e44969f7a53c93520e69b1578d9b247b83382b60eb4ddad20f7a3a29fc9b96225787a069b75669cdc1219f9338eea2cf
-
Filesize
5.2MB
MD5d3459bd12bcd2622ee9e8a11ac8ce5b1
SHA1718dd8e734bb9efc3ac54fb227889aa2154a935c
SHA256f8430d9a550b2a3d74bb78806093e2056d3ef74c548980d7ba1e7410ef69f49d
SHA5123a2e10ab95321e1dc9fefb75647c412a508f3f8a0433d905acff91b343ecd1faa639eeae45b7951db01740f8ec0776c5b2b99ff5872d2bfaf5f9bfe04e3399e3
-
Filesize
5.2MB
MD5249dce7046b62f15266b4732822f1f7e
SHA1faa4c28fa3f53ffcaf509958571bcb5f8d8458c2
SHA256c5afbd69794ec5d5f03daa37a41d59f9e8f054cc7565cd88790ff2d294232e2b
SHA512757bec156f0c77b51e352687b3bb6735c95ccbbf48d2199bc1e19bfac9210f5418e4210e801cc0a67388d45782920ed8f8660cf7d4c45bf7c7beddcaa6518fef
-
Filesize
5.2MB
MD5399902db98ca296c75c0178c70c2e8bf
SHA1433b1ada44bae36ab3c3e68aa5ec11e27e50d104
SHA256993597bc525e68e859be94db351a387151fd91910dc4facf56bc8bf287897c47
SHA5123a39508eebb71563c246abac02108134f1c4d775fe78bc97d8f0b0da05855f6c35f7052bb57515837a86db7ea066cb4a8a0e0a9bd351a2571e7a1023d2a15be7
-
Filesize
5.2MB
MD566dc53966f502e9242ebaf1b51136e83
SHA1593a38f6b842bd21c56242eebf4e88c96fcc0990
SHA256cb5fced8dc078727b9403191fa9e21be3e06ecbe3457f5f665f7c44a35a0c8b0
SHA512e1299519d29ef1b03732a5fd3804080f42059994dd6f5fd6de6bdee215dca544ba8e01b84a1edbc18f96fb95613cf5acf1731e2c73694518f62c408c005e81ea
-
Filesize
5.2MB
MD509d8a74cc0c01083343e7713ddfa5a1e
SHA1cd94f53522b980582d56a8856f50f702750ea8f7
SHA2569139de776370c590bee263f45635332f79ca43909aa7bda2b920508f436467c1
SHA5129f436df90bcb52ee4b71cf27e944b425ac4f353bc91f397559fc95d0d150e1f1d593709425caa2c67c29501782eda26aa18d1324e9110a8f9dddcb82c11cf233
-
Filesize
5.2MB
MD5f3483d14ed8c786e15ae4c0fd71495b7
SHA162af65fc8aad253d89836214ccce3724921b922d
SHA256685c21d6d01d7c609b8171ad57c76126caae6e962154ec2bdd083443c279d535
SHA512e45554294451d8c45e313a79ef55bda009c5342947e1aa8f4f7bd14d3f94d06eb6fedc4a752c7ce8d61698410abc9ac0b6033d7b2031fa2c495ee4db7ac81c15
-
Filesize
5.2MB
MD5c3619ae938c0d8e7389b37476ab0d693
SHA1304012e1a52b1739d545f735b290cfc89a267e58
SHA256512fd57839d0218a55cb821e8511eaffc9feb5ec5bb80d72ac52a0390e9c82ef
SHA512c7b948b915e5f99fd717788b2e3457513fc32465b6b43756ba3d99db5b226a145ef93972a3d2e3db02572bbec751de2c94303427b48bf28bd981a9398206dcf5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB