Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 12:29
General
-
Target
2024-09-13_095a2ddda2f001900c22a50e695fb267_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
095a2ddda2f001900c22a50e695fb267
-
SHA1
5cd8bea21ee12887f23674870104430f022e288c
-
SHA256
8cddde4d830aaefb56bcab67aabf1f3879cfe8e6a90cd06396929a9dceddb83d
-
SHA512
d06f382a4c0b7e2751df88806c4e8f091a7b960a8187932ae1cc5559c2d5bf03d00372f755d05f16c77e8958e457b3aa985b19a063b66c1ca775c3bbedbd5c3c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_095a2ddda2f001900c22a50e695fb267_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_095a2ddda2f001900c22a50e695fb267_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ePonnbs.exeC:\Windows\System\ePonnbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pxSOtKv.exeC:\Windows\System\pxSOtKv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjpmxQs.exeC:\Windows\System\gjpmxQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHUhYvL.exeC:\Windows\System\MHUhYvL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsSdKHu.exeC:\Windows\System\RsSdKHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTlPRVK.exeC:\Windows\System\JTlPRVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OiXonEN.exeC:\Windows\System\OiXonEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\neBUlqj.exeC:\Windows\System\neBUlqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSiygKI.exeC:\Windows\System\LSiygKI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTRzOLo.exeC:\Windows\System\bTRzOLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSsmfrt.exeC:\Windows\System\GSsmfrt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VyGecTq.exeC:\Windows\System\VyGecTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGOerWl.exeC:\Windows\System\zGOerWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHefPWl.exeC:\Windows\System\sHefPWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lhkTmyR.exeC:\Windows\System\lhkTmyR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ggIdJcm.exeC:\Windows\System\ggIdJcm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zZnzvvO.exeC:\Windows\System\zZnzvvO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JxOuumW.exeC:\Windows\System\JxOuumW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGBngRB.exeC:\Windows\System\AGBngRB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efwZLpX.exeC:\Windows\System\efwZLpX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKJKlGs.exeC:\Windows\System\EKJKlGs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52ad2d05ce5eca47ce4732e276a8b8a5e
SHA1ad685132efa0d6fe3548e4f6a3a2dacba63d5816
SHA2565f788264f4ef218fb28943e9af123cf25f49f325ebca4db41fd6249e03f231a5
SHA512eb68a13a23811fde706e1435a914fe28cfc7134b0650d3ce37e917b322517a9ff20a06b2f39de7570b2dceeade69e6ad268d6d7d8eba222315ddc86be7605e18
-
Filesize
5.2MB
MD56390da5392da6da3c8a2e514efe6da7d
SHA1e55f0aba15e52d90b553d0bccdc36a18f5eaf350
SHA256cb05d5f666ce3764c7126e6e9c71c15cd79e58572635ff75bb6f257be0bd49f8
SHA512a5d60b88d88442153a10e41fdc009985563a823b671d8937fa326f5317dba0a4c908b1e5092ccd24f07f9939306d5069677f5018222d4cad25fa1611ecd91d92
-
Filesize
5.2MB
MD5ab74bf609b21d02cd8fcfb10b5397cf3
SHA1cdbe05900c72b8d1d0004db14a556fba4b31d028
SHA25629a0a38ca4311d527491e43173ac70c305f8f8cd80fb56d36463d9e7b910e89e
SHA512778a37aa48bd07c877f429ae0d6597ff78f23062be36631e767385b34b56c61b63551644597806ca328eca072777b3eeebaf8720b10e21dfabdce9f2404b6e16
-
Filesize
5.2MB
MD52c7cbfe37bce720ffab63d7bc06e57d0
SHA10b693fbc8a8e951298a92a28f565d871f78e27ab
SHA256a4499f6a8d9e9e76e4ec108dc88650b4ecc67fdcdbc831dab278f1932fec187d
SHA5124ebcd52b646aa4e3e3c056258241b9369cbc417135071974c968f93c7cecfa63f815206de5b0632373cd6ef0a1477b58ce499075360f3c13eefc481485bd061b
-
Filesize
5.2MB
MD5cf089caeaabb77572895da08337143c3
SHA1864e19fa62f835a4da649387ccf7a98d5c74e847
SHA256eeb8ed9b583cee88be0f187bbf5c6dbbacf93d254eb3625bab94f0790cac9b76
SHA512a1707a0534fba6645996c138e370d31716b4262dcc598ec7c78819fbe64b598ecae12c5d97865f03a9e37c29e108e7b2dfac4590e26b4cbb9b9cf5b04ba10d69
-
Filesize
5.2MB
MD5f44a4933c253e8afbed5d29e8f23d551
SHA147289267307f639dfd6ade871255eabe1d04ddbd
SHA256454379a4b94b3136e691d0832b270ff67f3ee0f1f2a601ef0ba64e1da269b815
SHA512e47661a0db0141c555e4c607f7bf99adafe369e1165b0caea4cd555544ae88b2184c50910428d98f7dc647b40d471d4d3fe84db9a08312ad348d45f2a64847ff
-
Filesize
5.2MB
MD5ff689de94bcca692866c5c9176aaa45a
SHA105578ce23c38db5f61d486fd46b5a16414b2dc61
SHA256d2bddd7e366676da00aacc271af7eff73f7e6ec44eba03b18b1b17502ad421a5
SHA51286165e78e2156d9cf24ae9b4cec983bd574ece45c73d272e6600932d0ed9fb1ce6a3b168c153a8f3521986604e4308e3d47f51c614148e691fdd240bce12517b
-
Filesize
5.2MB
MD55799fb669e86ed483848ddefe52519c6
SHA12cafba3fae3488332d7d6f04601adc7c5da70454
SHA256daa0e37493e5e024f4ed71b8450bd6d4eb5f661a12b9611881e86a828b340011
SHA5120a1d7fa11e7219d5970f02c88ce610ed93d2a2751f47cfe12294e84e55f67490abff30e706789571c5a581426433553dac806a15e48f275d5b3354c737b6ed3f
-
Filesize
5.2MB
MD541a9a6f3e5c2bf36487bfd266f991920
SHA1281bbf0e2e8892bfca2c1c3d20c3cec3daeb4f0e
SHA2568fc5dd05727f757c956438aac1e858452ac146e47cc59082f61379d10cd9692d
SHA5121ec0b24897ddaf617fdcafc41e68fb9e8e58ae40d5f064656b00eef5b973c3631a23bde3293d09571b1d1d81c557f34033654448f23ffba45ca32c11dba4e7cb
-
Filesize
5.2MB
MD58f11b15f4f2509804880275089109c30
SHA17991a932deb74301bbeb1de8699d7127456a8c85
SHA256b9c00e1d98df9b0d89e01f125f7dca1c939aed3709a342ee577fa04504911a1b
SHA512776364bc640a1181ba1ae689b655fb09e2b7629e8189543a2d64e7a29b51694761e0ed115a286ebde3b7c166eaca5ddc99194214c251bf8932ec1fbdb79558f4
-
Filesize
5.2MB
MD5979a7851f13b89c5a4bc3ad5137231f6
SHA183294376b29e4ad057d8c490ac6dbf1ecd8dcc28
SHA2563c67a1362b4b5e9c8f60aa4e7909c58d007b114402bb5faebe46c12b040288da
SHA512cefb6be5aceed6a9f6f58af055dc7ed1380aa8f2c99cfaa028f19bbe068bc859f0a82becc3451c6f0330e04785b4ac284938d1a3d12b79696d42f9619abc927f
-
Filesize
5.2MB
MD5a35cd53754b6b93a03ee9ab49ac17993
SHA189c2aaf5e3a58368fc21de3a823aa1b3821ce0bb
SHA2569d4b7c734dfffccc15adffa94ec0cecef11066faa1bf66bd38b89e0383ae6661
SHA512dd018261a9e2459126c4edbe7247fb3308429421f90d1d2c44918896262976deec7c183dd44797c159508dd053015fd1d7547b5f183a9e67ec6db719636e75c1
-
Filesize
5.2MB
MD55142024d31002414870f1423c94f1a4e
SHA146ed80df3bf8fd761435008cb8198766bbabe18b
SHA256d647c0b2b914151a9d2bef6a1fe4eb18d79db3c2339001d7b77dc9f3e037df7c
SHA512fee341e43bd409bc20f501bfe71075ee9347df25b93084766657285f28adde243612b99335c7fcd58d4240b112a815ffb17ac5716df570fd60d5d8932b79ae2b
-
Filesize
5.2MB
MD5dcc46d59d8e49824951b5cc45a97711a
SHA129e198f106f1b93f16f351cf1ebf860576764deb
SHA2568ef53ecadc81ab4c684ea0f6fd69945628b69561833b0137f4b259012515f958
SHA512d0d8b80154cad0b9949216527dcfbab1e5d79bb1a00955140fa5898870065f2163a07d6aa0492c73b995fc07bc1dafb167ee77e5a336ea8868f7a1d653e74207
-
Filesize
5.2MB
MD50b8db1dd6f06c240bb479f111a0b1dee
SHA18a80f6e1d3d3d8af2f7f909412b8225327968fb8
SHA256076f7b356e0b1febb8a7c78c2b44d13d6e4ff3f8b47f5f7116af54a208bf0447
SHA5125470aebee6a6039af93c420ca94919b0b435d8701cceb0f94be5f7fedf2568001bd3ce1bfb08e029af961e871bda8d8e9aafa8ce29d43be80cbc46b0567e6c32
-
Filesize
5.2MB
MD52b7f1dd8dfcc040f25ed69314dd58f0e
SHA1d127602a2bb398ad7f4550571f0d182a425010ed
SHA256ef8155f83c321c5a098a903c780c975dfefab79aa7df269f7ea2c638aa206d2a
SHA51277c8b51019dfbb5a7e8d9da404efc8e4593fce3f0d6559f1ee98921136d0a78286deb09d54710598239e0d3200c816813a6cf659b22e7df06e6b6aec516f1193
-
Filesize
5.2MB
MD53bebafa2bf67c0bd904b254c0b87f888
SHA1158a074dd79247c219a40d16634404da4a28c020
SHA2560b7407be69ad16d1098a92831b2228f4488bec0ab73ae04eeff15f19f906fa68
SHA5121da47e57073bb02033343f06e2ed037abdf320b884c93ceae3890ea66f09970f3c939e0af2fd1de42e7e15c69ef87510f616c9c1a82c8e6d5b5e26723b635402
-
Filesize
5.2MB
MD53dba4f1f72e92842891c57ab1bc4edfe
SHA1134b5e25daf47a61ea75036540e0fd103e0df220
SHA2560f214883779dcbc60e02808f9faf25971354290a3a392649d079d33b761b6103
SHA5121b30571e3d45b815fe1c0f58fccb3ab6193ba57bb7168d4f4b9b2061f8076456d0464f8676d7bb9de67ea33f82eb548ca88cd7ecc633861834d4438d5e92f433
-
Filesize
5.2MB
MD5de5eecab51bd9209052e55a0b0d9cf6a
SHA18036c6e33c807b0ba52e919c313e423657f0795e
SHA25658baae171c7f07e3405b435f9b2c8a0e91115e288b4230d67a6035b2b0346323
SHA512f4f9943a58ea60a55e9b63bb0670fb47ca6ecaf0d89141516127ed45fbdcf1926ccd9d2a4d399ca73e1a33957b2f0ae32cb016caa8becf28ad0a56c5ca027bec
-
Filesize
5.2MB
MD57648f960db6378be0ad68004351efd37
SHA191c55eff3f6addce98325d94886866a5fb63e141
SHA2565990c266487e399aa93a2676b49ba0da3ad9c44ef081b9a523d56244d0ad3207
SHA5126204f2ba345144f446c55db12b7d0521b31d21fb897c94002983ae8a46012415c419aaa3458c819cb54080d0f72cfa5da59ec63997795c92a1857a6863fcfd0f
-
Filesize
5.2MB
MD5a438fa58c7d2f4c3c7f47f4eb8b7d7fd
SHA18b86d1d898dfcbf8332893fb5cce55a193ee2b8a
SHA25668d2c11b1d4007e7baaa35c83eb868ce00272e6f843cd2ab88ed8d932cb1f717
SHA51210f3e704bc8feae1e2b5261bfa8bb68a23701ee01889eed0c8b2fcd24e9dcbec1733d7af82e5bdabc627355449dee06e530eb47c8346e5c3d0cc91f374e45009
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB