Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 09:28
General
-
Target
2024-09-13_ed163bc56dcc77599c78594129115d33_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ed163bc56dcc77599c78594129115d33
-
SHA1
6c7234c71f146b32add9fa74aa0751993c9fdd3c
-
SHA256
690812c8848e079500575ec4acc036f7e31182cc5cfe82eb28eab1fc5f616d7f
-
SHA512
a3ff89f39440c899433087395842765c69cb67c015a8286e8141cee4a8476dfd95237760cd5e02bf0b75290b9c76496c85a27b5039e0adc4256457c3a365a1b3
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_ed163bc56dcc77599c78594129115d33_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_ed163bc56dcc77599c78594129115d33_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GBywMJJ.exeC:\Windows\System\GBywMJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzYguhU.exeC:\Windows\System\jzYguhU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARZTStB.exeC:\Windows\System\ARZTStB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dPBNyGh.exeC:\Windows\System\dPBNyGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Mcepdri.exeC:\Windows\System\Mcepdri.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HtisKBE.exeC:\Windows\System\HtisKBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fczVCuM.exeC:\Windows\System\fczVCuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xMObdaZ.exeC:\Windows\System\xMObdaZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSJYzXd.exeC:\Windows\System\cSJYzXd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSENGog.exeC:\Windows\System\zSENGog.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rMHLjrG.exeC:\Windows\System\rMHLjrG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WiryXWh.exeC:\Windows\System\WiryXWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAEuuSN.exeC:\Windows\System\HAEuuSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXhNbcx.exeC:\Windows\System\pXhNbcx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQTbCvN.exeC:\Windows\System\EQTbCvN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MDatgQN.exeC:\Windows\System\MDatgQN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nfghucY.exeC:\Windows\System\nfghucY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AjZEuof.exeC:\Windows\System\AjZEuof.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFBUiyz.exeC:\Windows\System\HFBUiyz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\makakTP.exeC:\Windows\System\makakTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndrDfnw.exeC:\Windows\System\ndrDfnw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a08a4a5938d0d84656f4625ae0a59a34
SHA1901c19927b6039e588a24b1f094e59f4bf1c3e90
SHA2565ad199bb3fc326d125ab5d8bfec848ad4082ce07b51f3e848d2769b057686658
SHA512b86a882582b1e0c679518325160b22a37832b3ea9d245e636c65fb8e6ee536986068562c9d2caad8ea307b9de4c3426fec953302fa7526622f2b085803af1f0e
-
Filesize
5.2MB
MD53b038bde7ded089d14a4f65a9b3fae93
SHA145c8ef0adf9f1aa51b7d073e9e088e4b026e30b1
SHA256aedfed3210011befa4e1f285a1107f06e60b64ad63b329f9286b1ad2910473f7
SHA51258772f234fb4370d2ab0d2116ec49a21bafa75729dee45e7d22e6409e30d1e38e09cdcbbd46cf526fa3cc0f29fb6c598d8f4cc21b005be1c0780edb808163846
-
Filesize
5.2MB
MD53b92a0faf774c68804383f52f2df888d
SHA14e3cd845d67a4c1a5ca3a26c34b331b3fdc784b2
SHA256d9746a16dbe6603f96141c9c294b222e320217460de131aace0e7cf5c73b80e5
SHA51236ba0e356ebb99e06ee4a63b0ef7aec56e48dc8e42eeb7517984bf52589ee0fc0db90f2ebbadfee19962134f4a3ec84771855df6d32311727449ba96165797d2
-
Filesize
5.2MB
MD570f89868161cdff59592072f29166640
SHA1c4789fa4a786875d2e4aa0a814e3c23666e0ac80
SHA25658d70ff28ff7b4bd9803a049aff4b049eb6ed9baccc1f9d7f5414a21ce5ea935
SHA51232fce844927967612198ad4df45410d99546222cc5e2d605bdf612f2dc8123ea97eaa2b1244617990b97512bcfd96a669b182b513bb087bed30eae6bb311d197
-
Filesize
5.2MB
MD5c881297fc129d5f1ebb97325f1428e8e
SHA1fbe1979ef83c8328ce845126b6bb8cb55c753b23
SHA25608e4cd67f330cdd70f97c960e0e84de71261bc7f5c288dbfcb4353784c52cb77
SHA512feb29b566cfe25ec1f81ce20b086e28a56fd818deb346d08cf619b7980fca32af7cf4e63bef7f7733c41f0c58e45581bc3ddc6d985b41d16eb440ae47a8f98bd
-
Filesize
5.2MB
MD517ab47370984de7225e73e14e12c72ab
SHA1bc31a4e508c1e8af69f9b78a96402696756e0442
SHA256d6fa7e2f0911645273163c98e4f0f6385478b50d97f507dbac68c7b2bd7c89b6
SHA51218ff655b907db54dcb51b3d3c44f584a32d2b13056fccb23a4a7b5e9ac8b2084f7ab3890a951ef1810e319ae205e43cdbed16bb5c07f525cdde4ccb2c31d6516
-
Filesize
5.2MB
MD585ab880710f68951a089d6e48bf2e81a
SHA12db0ea3a236488213ec5bb27eecc24ded9758b3b
SHA2567b02ad440c71f57a2dc979fe93ac195ac144b8ced0526dd6f83bc23abc89ff4b
SHA5128b2c2aea580f2ad243892a60de94b0bffbe0fc8f2d61ac7bccd7f55cd738ae05e197b69932bf63d9d6950e14b0a87812644ca504e98858f012deb912cf216adb
-
Filesize
5.2MB
MD5fe8f93727d10883515c9c4ac3e09eb9f
SHA10a35d554ec481815889f6ea196aa295e488b2f7b
SHA256d531dc7144267098cf2a3a5a4d9f83f1f1bc2b5bb1991391c5aa978d9b9cc55e
SHA512cf28dcf9f710e4c5570e1193a2cf34cf7d106ba32747cd12921f205b51c29238f314c9862a8eef6ea7f016291889c866fb74b3af7f31d08fabe1e555500fd0f1
-
Filesize
5.2MB
MD5d75f01a958b39776e48d94917dc87923
SHA1821162a84da80025fe8b595125d33516dd455a9c
SHA2562c025cb6aab92b3d720b3dddc814e0498f3c4fc32ae4b534758f32e014b60bdb
SHA512fa95728c845ec1e3c7cdafcf32cab8c125828faed5fb963d785e3652ac070e22cf4c69f14e279c13cfc666cc4eae13383a4f6955d77a51828ac50f19a2b7b725
-
Filesize
5.2MB
MD5efd4cb7b938fb358b8fc2f75b70e8e89
SHA14ad61dba204389ad36e74984cc28d12193d5c383
SHA2569ec75c10fc245de01004920a2c8a3487d49b702eeea5eb3a32203cdef900eb13
SHA51212ae74f0a92cf8f5f817f7311feebf5f6e3ee548709b843a731aa706de7dfa44c5536291a29c6265face69c6161b3ef0218541b35ed9ce9409f8d9520b019f91
-
Filesize
5.2MB
MD55df4e2a66d64463199e6d5c20d74ff81
SHA1fe2c37d52f7422c1978c795e249026fd4111fd11
SHA2562a4aec96c6248a04f70e78ffcda8ebe28d31b63b444b4a9a993bbea156c80c5a
SHA51201b1a87611f8dc4b95acc1911a5283bf2398f7ff5621ca8fc755f42e8b387868b8de606af141630e337ec91abddd71ae50d302a91bf8c5ec21ef0c173c672a3f
-
Filesize
5.2MB
MD5560cd486fd856dc3be3eba7fcf0cc6e1
SHA1f1571c9c524e5ae99c9082740861063dc4cff916
SHA2560d905f9f9383faed9535779b91efcedf097b13ea221993e8f5dc9833e50c03d5
SHA5121d91531ab92183f42396ab20b86d243de2d250668a227385a368041c2c189983b112c5bc4ac82a16d904d04b4faa8a77b73d4b4876a546cc84809cf6013f2df3
-
Filesize
5.2MB
MD552f526e00985982c64249430b23d1cda
SHA189e5a434a986b6d5195f6955a95456e15e794227
SHA256a024c9c1772a981a8d07990059dfdfc82621c5ee5af5025be7a768a18bc7abcb
SHA51264a3db8cc3bfef36e67ae0e10480fbc22eea09d6a675d6c6acda666127ebb2d1023ac143734cda919b1288d94c9ffdccfe3fad6de2d862827add7dfec1fbd5ff
-
Filesize
5.2MB
MD524781a03dc4262289f99cf14102451c5
SHA19551fa71b73a8cd897bed2ca87fc146e2c251892
SHA256a333106088244475b76e9a5327fd5691dd086630df75aa47995046d4681550ce
SHA512e6a1dca47321fd9ea063edb365fe055367987b91219bb8a079794c6f392e50db01d5bf39493ab256be2f4fb6efd2dfd56143826691ed7f05ee3c9c9b21303b4e
-
Filesize
5.2MB
MD5202ef065053a242d87f188943fd0ddb9
SHA1298908b5ef80cfa5d668b5996cb6c36b7e608e6f
SHA25615076f145a5d3a5e12c5876d28231d6398b62c68c88f74224add4d51434be06c
SHA512f3baefc1234e3cbc5b359f5ebb95f080a59dc1fe026cc0d70e167e8ea3918aa0bac733e37265d2a4c687a0eb3f54330d9fdccb93511c007580c6f9ea9b99e776
-
Filesize
5.2MB
MD59f325b366eb1c50e2c9b2eea01189e2c
SHA18a48bf5f9b61bce8c3b23e1f96a183390f5ecd36
SHA25603e70267ba6619f493c04fed646c01e55f86215e28b863ce36db8420a5df672c
SHA512c37f464a4d1f0f50845cd1ed1ab695922f5d6f251782afa7f2dfdcc58c4c54a21341d968aab685db9ccfbac0258d3ae654c53757e0cec72b1d01f6b189e96668
-
Filesize
5.2MB
MD556c2928829507cfb0ab18c6b5a028f7c
SHA1af4a259aea0db3805a6ff5c1d2decff8b7e7803f
SHA2560c8fb546ddd8357b718f4dd351006925bc70c8597b6b7f49902d085061567a0a
SHA51289e451e13a56cde61cea24585b2fd80fa7d77bcaa35faa03996b2b99e6ba6a145c7ca68422acd0ae7b1f0c482cb9262499a21f631df06cb5bec009fdbd5533d1
-
Filesize
5.2MB
MD5a4d1eecc3932460efe99be3cd7ca15ba
SHA1ddb1c3f560c1a4efd5bd779df354c7cbdb2e782d
SHA2568cc636318e2644359dcd92c40523b8a390cd06eafdc3de4688d468653dcbec31
SHA5122ee579778b2381da0d910020eb2e8bc27e0fbfd77e7114b81cff6d76e3bf95967d9d710012b76ae386b5c0dd5cc743a8a15fa15e0181c3b2c5c64affa02d7d8b
-
Filesize
5.2MB
MD5812004b4276ae36803fa1a6f04525c71
SHA14cb7f1bf6fd6744201894f6632684cefad60a2df
SHA256fef07028d501d70bc8207ac81cc3298fbb7378b5526575ad0fb065d60bcdc0d5
SHA512598a7d6a12f0cde3e33605a65cbdc2b4fa1b9751ec3b8f339ff3d604694221bb910212ca9995c3a91690ec2759386dc3183ef36cc77a60705043dfbf0ce3e7a5
-
Filesize
5.2MB
MD5e42b2b93fc4a86c4d92850224831399e
SHA1b3ca42478188ae8e1843892243d04c6b44c4c91c
SHA256a7719adef6ea544e65b7130c7628159ccbdcb6ba073a0cad171a88c5f54bd5d1
SHA512675d7ea1312e88eef64e3a26c5c5a2e05fcf6a660b316bc68695444e94deb44548e1d307025d2b1952967f707bb619a04e9146013a19c55323eaa88d9ab95937
-
Filesize
5.2MB
MD58efb760fbe2bf2d6c0a76e6819f04b60
SHA1b3000d9d5b1e6a2d5e85f59682126f1e7e73223b
SHA256128f95759a40141372625a858239a82a7b5dff4b56fa1c0ef202801319feb247
SHA512d98c56b5b548f171f381b5188efe4b24950028759c8fb80c9435f11076fae3a9bac598deb6862f7090425fe8d9115a0b66818ef709189d4e1d2cef1f68cf1e02
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB