Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 06:43
General
-
Target
2024-09-14_047ab1463a97645ec9edd9d42265cfc4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
047ab1463a97645ec9edd9d42265cfc4
-
SHA1
b2da9d36a760ba36603b6ae4cec19f3600e32e43
-
SHA256
907a43e91d9ed0b940329b3499a99ac8e3b350b371885c6260e19751bf7de1ae
-
SHA512
74af565ce535c6f1688919925aa15b045eeff30ac39cf8ab06acb875e8e8ddb7a45f6bf73adce7e9c077b94e5512d5d4d1b5e0998c8f0fef77a93a265a7e356c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_047ab1463a97645ec9edd9d42265cfc4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_047ab1463a97645ec9edd9d42265cfc4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GagQpHX.exeC:\Windows\System\GagQpHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYkbfJY.exeC:\Windows\System\rYkbfJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgXkzko.exeC:\Windows\System\dgXkzko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TeNPfag.exeC:\Windows\System\TeNPfag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KObHBen.exeC:\Windows\System\KObHBen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmjTdSD.exeC:\Windows\System\wmjTdSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuYRjNe.exeC:\Windows\System\tuYRjNe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FDpQKru.exeC:\Windows\System\FDpQKru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\asbEAOH.exeC:\Windows\System\asbEAOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtnTepo.exeC:\Windows\System\GtnTepo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnpZadV.exeC:\Windows\System\VnpZadV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkvALVR.exeC:\Windows\System\LkvALVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PIvdbtD.exeC:\Windows\System\PIvdbtD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGAkjgD.exeC:\Windows\System\aGAkjgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZPYREH.exeC:\Windows\System\gZPYREH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPWlPMx.exeC:\Windows\System\NPWlPMx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRHeivd.exeC:\Windows\System\iRHeivd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRkGXEf.exeC:\Windows\System\YRkGXEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nJzklcp.exeC:\Windows\System\nJzklcp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHoNlwm.exeC:\Windows\System\NHoNlwm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FknWxin.exeC:\Windows\System\FknWxin.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD571be12df9be67431ccee16f9cf373498
SHA1f1e22776234a14eb5cd6d31e835ac17d349d8b39
SHA2563af008d0230970283e84ec59382a65509006a762889005e8349714cc78d7431c
SHA5126a18835f129c5ad231114bcc7f50f61d486167e017d7c37e7c6a9f52dec807bed146caa72ec647a4b2ec986437af7fd7e5d4b2a3ae44665cd197504e3bb43271
-
Filesize
5.2MB
MD5518128c5cfba2cb297e9485ca291e1d9
SHA1df50a8ed1c95955d28c62fbc2c7f8a1e5d724aa0
SHA256aab9745331fae1e61b0087a5f20c2f54bd86b3dbd1f37e1084f24c9048e3c5f3
SHA51286f3ad5d1b0bcb7ed38584ee405981c6297d450b68d3165fe5eb4c450d0c2315e458aa11d3c3312d89731cd0f5792023a34a9dd04504c26758b6af72e7fa1db0
-
Filesize
5.2MB
MD510df618ab09c7f7ef32975eed5d0a7ef
SHA1ff95c01e5526871f34ab2c944fb3e12b677a9e8f
SHA256fcd59da005ddc0b3842ff58535badff13eaa0df50cf01f76ba6d1712c88e5b63
SHA5126d314f3c1dd651e5efd07cbf0001d48d1700d8f28ab60ecfc3a2c9921b9a6514202e132696d19b587ef65123eb610ad4b11555ae9c73c4bd41a23fa78c1f823b
-
Filesize
5.2MB
MD57b2887ab46652c1421e560aaf66dbaee
SHA16ed051d745935413cdba204dc81ad2bfa8865bc1
SHA2561cb67f05987c69f909be21938f1279edbda003b4d4fee2bfa5fca5273361c6a0
SHA5126aa97ea25c10712ea9214b48291cb65e140a8d470179fa62318acc3a80181ce28ecbc410950a57f091b7a628e2ec716493807ba10254f85fb81b03a513380201
-
Filesize
5.2MB
MD50b16afeb55b3dc291d02be2fc9f95e65
SHA1b740d5c93e8854ab25af2a69f0452f672eadafe5
SHA256cbbe70187270c86791fa9077eba40ba7b3118f557fa0736867213d48267dfc92
SHA512b8497fd84ebe74ac5482be9aec3fa43a0747e1096bf59aa26d2139afd1b32145aabd44a348c9930abf65feb847c47c12a5d8bfb6bf447369238a64bcdab197a5
-
Filesize
5.2MB
MD5cd663aa3a6a725e9191a51b01f9776b5
SHA1574120c3e04a304188f5fac80216755cbee32183
SHA256a629282e26d309dfcb335603d11a767c509b19f6b9c789d23b94cab776aa1a89
SHA5121a16c0c796a703a501c742dd36f74f0963da0342eda5a12de35738af00f0db7962bee0887f03f0cacd955fa87b3be1e3f951a2daf879c5ec87015c0a9c51b6ef
-
Filesize
5.2MB
MD53adf0e608f665b5203e45ee38121119d
SHA19f3ef5f9cde713e18ac8fea889e89102a76c715b
SHA2562cff1f0cb024db6de5c22ad62e07f3022b5c2d58ba42c471785d7bbc88669b46
SHA512743487333baa1cda24223b6236dd373738b3b22fb791127f6e09f8c56289c1e8d8eedef332a435daf1315633716c4907991a7df90a64ded04840025babd6d852
-
Filesize
5.2MB
MD5bd9bb2b5b34410fe1fb42c9443dc92fb
SHA190ac77ba9ee108f66cbfa1e7eb4277aa3bc0f7eb
SHA2568a99f7a7b453f2df56bfbf77024f1fe65d218d0bb230d792ea9312e4ecdb5968
SHA51271f3cd50c7f37e31ec3ad63ec1163d05f45e9722ae9de557f3df7bc538a8c648bdbe389c2868eb6d90c6cec10700a86229d633ff3788b51af3fbc64fbb20acbd
-
Filesize
5.2MB
MD55de8bef1226bb214ec7eb616c88f8a3b
SHA1ad832c62a4cd304a639daf33805ad4da06b20b0e
SHA25622ee8686eecbf8ce7e1e648a93d13841f1f5f3a2e88e096b6493771bbbd16914
SHA512f5f7f4ccb6f8524ab41dcea931bb30d50ceb09103fdf595c03051f62a19e992bf08c9fa9093a3447576f01c758a1c0e14199d48135c820f711c4f5f7bda88014
-
Filesize
5.2MB
MD527468e8078721367c345abd131906349
SHA130b85cd7e826a426d26cb0d49631e7efd56cec2c
SHA256e947a8cd50a3005c5c61be87a3c296b46fb645f27945a0fbea95ceba6984f944
SHA51288c777338e53b5ae453b16e4668e0315e2c2c15a329169fffc753ee63fd03d9095b78a4275950de4d91e23617bcb1bba2be9171649378d770f095140815a1687
-
Filesize
5.2MB
MD530a2424a7425f871b642ecd6f00d79b6
SHA14b013d2bdb8aed7663d8b9c09fb7a261749b2c27
SHA256bef235209dc979c0dbb84462b087f7b93362b55f4b2a17cb9543a34a6ee5f74a
SHA5122f292ec1f4538235e1344c12ea2076a73efc342d791a8fdb68c410b705dcaae821f79505987f5446469c89319e8c55ff79cbc3611e0b57ff4360496c701acf84
-
Filesize
5.2MB
MD5cc0f76e41c0db3daff9401c7738f7116
SHA1d6b078b730022a3819429151189a12b7e6dd82f0
SHA256bbf9d702be2429019eac55eea764f6e354b91584c00e7dd183dbab1e60d5a021
SHA512acd0611fe2c8745b0e3e495d3cac8e04cf22fe2b00d24b8ce4379249c5a245f73afc71861d7342ffe5e41807aba25e44ff40c67b173a7926791988b16650360e
-
Filesize
5.2MB
MD5ae7aafefa1607eeac27721de51d6797c
SHA12ed16a2659048d2386a4f0ac2dd66a34179c7dc0
SHA2566978c20eb7615740629f405361a7f3ff1732050265071ff5d238f76cdd997e18
SHA51299b063cb58123e92317e7b81d7053a51d985b6922e02fc206e29c2cd74eff2d926016342a18b6ab899659fa8c54a191e40a89e56f22d4df0f8c99b4d5aeb1c6a
-
Filesize
5.2MB
MD54153b0c31194a75d51e0f7eac362a49e
SHA104ed07278503adabca5ef1e146b7167042b7fd75
SHA256fb557f64cdda14843ce649d1835ed9220212edf486e08348f33394b73024c983
SHA512a484073fd01136133d98794ed6bcd2dd6a3a2446318af57a65fcd6ec52a9b586caf6355397e3985635a58bdf8b856fcc6360c83e5441752960c68019208f6e23
-
Filesize
5.2MB
MD56d38e641fe38a1da7fe31e928f75352c
SHA104d4d6134d98715ed64abe39f764dc09a1fc694f
SHA256175ebdeaf42fe773128c3cdcd57c1ee81d58d5a1602c40a6cb238c8137e467b2
SHA512968de881300479e79dfaf4c152e891aeb69515cef4d0b182e0ec4e99c29cd3c95602db48d66b3df464d6cc20c4efd54747851a5cf148d39538c35fa1050faa5d
-
Filesize
5.2MB
MD5600acbe265150ef4dd67ad0808142dc7
SHA1c0e3324a285b8403e247fc28b79990baa3f1c118
SHA256a06e956e17e6683f8b0f486d5a3785e336865c8939ca3b95fc28ad5f046967f6
SHA51229bc62fca22d966dab26108e40b0a8e03542a17ad613941e5dda1a548e28e7c0203aeab77f14acd56e73373ca7b239d56522f9f68bd6fffc6ef4cc4fc30ea4d1
-
Filesize
5.2MB
MD510424a5dbeffd8f54cb327746f4d46f1
SHA165550b3ec60a1890994415fcab8a53004a117899
SHA256befac4d71726cc0d4154674ea8d7fef405bb2faa1aec57b2957ef689157a98a6
SHA512b5adb06569f3683e22d0e864ecd16240e73894aa8be9d7152179baa178e9abae6ef7a986045887b4fd423b10a011cb77b07c25b8378bc4c0cf69239677e0e2e7
-
Filesize
5.2MB
MD5e210cb766c5dbf94ecf282e7d9d56b22
SHA11ed8de41dc201207ef2441d741055bcc838fe979
SHA256c732012692b203c159dd837d4f3e2c61431a18fbb05bd0bddbf995df4385cad8
SHA5127338998f8d9a3bc7fe7040217d20afde3e546680a1390cc12376311dea33129930ba80308d844f4b83750f5481ea52951285311a386cd982b518152dc15921cd
-
Filesize
5.2MB
MD5deaa69e5f76ac4ddfd03ff8a5ea51a66
SHA1fc5b1e9893dfa7fc75c0452031270f6fc79f7498
SHA2567b85c3f818990e5af8fb02ce6224eb084a77b0fb6988e471ed811a880a781a94
SHA51273334e795088ed6ee7c0f861b23ed671707f8a50997c6d1465e50dd720dd44123fab12471a0103e0f9861c3ec547d655aa180dfe36b44b41733250fbbb3e4c67
-
Filesize
5.2MB
MD5f003300009da98f42c2e73a470b42038
SHA1e814ccb79eee5e47c7e8297a0c0bdb73660acc4b
SHA2563691a380124b44935c77aef30217f2adaf19dfe5a13bf9eb7afcde69411af969
SHA512f773d3a302ba3d4d97d7350736fc718609b9ff2c1129f5c18255ed77f2c596247082dba01bff5b0391c5a0a7dcffa1bbbb2a81bb6af00f0333d221b0630619c4
-
Filesize
5.2MB
MD59e44c611467d952d1a4b4ee811627c6b
SHA1a6f665ec7c6fecec6ec2dd05770c6bc3612d7ea7
SHA256c67063beead59a4af3b7b87692949e8241d9624542aed5cbd3ae22f9a5a1eda3
SHA5122420493b8d3204fcdf93902effae6abe9d455d4e84c913c9e6193812ee07186f2cb30f1e0a5239395aaa8176194381c0a0da5e39ef4d1d36cb233e08a2dae30d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB