Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 06:44
General
-
Target
2024-09-14_0d5b1a5547e152107e5e2ec63343fbbf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0d5b1a5547e152107e5e2ec63343fbbf
-
SHA1
a147dd2df2649038eb258c1dc38617dcec4ebe51
-
SHA256
d4459576d0974d44a93cbff1fc38e327adaf85af1c6803e67e69dbc054afb43b
-
SHA512
9dfd4c076610b9123065caab67680c3b86b2ddac211d2ca251f4e741b7aa269c9518d9887d9a3be4fc5988896774dc60a999991b7d7aece92db9eda22722de85
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_0d5b1a5547e152107e5e2ec63343fbbf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_0d5b1a5547e152107e5e2ec63343fbbf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jKXkXXu.exeC:\Windows\System\jKXkXXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFgaZGF.exeC:\Windows\System\sFgaZGF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaqOfvC.exeC:\Windows\System\xaqOfvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dRpfYGL.exeC:\Windows\System\dRpfYGL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qRErUNl.exeC:\Windows\System\qRErUNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUowHEH.exeC:\Windows\System\zUowHEH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGgKqjk.exeC:\Windows\System\LGgKqjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VBUZVxN.exeC:\Windows\System\VBUZVxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSoeaDI.exeC:\Windows\System\uSoeaDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddrjsMV.exeC:\Windows\System\ddrjsMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWbdxsO.exeC:\Windows\System\LWbdxsO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEUYmeO.exeC:\Windows\System\EEUYmeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHZPLIO.exeC:\Windows\System\VHZPLIO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\thyvEFS.exeC:\Windows\System\thyvEFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LgwBgta.exeC:\Windows\System\LgwBgta.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HnQCYcy.exeC:\Windows\System\HnQCYcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWAjnoP.exeC:\Windows\System\RWAjnoP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNNixyw.exeC:\Windows\System\iNNixyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euuctCI.exeC:\Windows\System\euuctCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGfhOea.exeC:\Windows\System\FGfhOea.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxIEBEB.exeC:\Windows\System\ZxIEBEB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54623232ee20ad694c64c5a34ac792d26
SHA1c75152173be80e336eb2c370f9a55a0e1b1fea24
SHA256108a8010a1a93b288037455d299df51f6806a694fc22fd9914ceb3d45ba63608
SHA5129a6c22f9803870e0491a52a20ecc4a2f1d10ecb7e15f31e27b0ee0386ca5cdcf88d012251c7aa423746638c18a57b0ac2bd172e196e09d88758ec86b37fe1cf2
-
Filesize
5.2MB
MD507bdd5932619bdff897690025b3e5ef4
SHA19395e92ef2e0679957893fd8ccc408a25b9cb9d5
SHA2560bd0ba5ab11dba7add5f074ca692d83df11b722d53a609e20c8ab4f8b12bf550
SHA512c3723f2e2bec63058b2f4646a825de99c26056a0dae60814bb83fcb676018e8c9c3353be78c2d5b371547e22552511ac9f6d4448c00c755c021e4cbee29fab70
-
Filesize
5.2MB
MD515ad4c2b823d217df443253cd9795bd9
SHA1ec06fd338ab123089c179ce510c8a579a8d5f9d9
SHA25613eecc2115690737144e2bbd73fbe57ebe4e76a1f7c8dc174e8be5e471ad232d
SHA5126791b65b4250d6c6ec1e418829e965a0a665c0c0729218ca59e562d5d11b1ddac8ab63854652b61a1269b167137191a70bc9fdd4ee04fce7def0b7f5f22d7e24
-
Filesize
5.2MB
MD584ec99a655b538bacf8d5c1d585a39d9
SHA1ce0ef7cac64897968d6085cc1ed503fc93fa0a9f
SHA25655c966dfdb65016cec5b6001ecb617c14e07cbae13c6150afdcf000d7c641ec1
SHA5129ccd978723f736ccbbf4833982445d909eb0691607fd0c29778ebab36c79f4362da780fc368af284359468427da488c6d5d9128c3ae44fe857d8a03a7ebbeaa6
-
Filesize
5.2MB
MD54cdd45f1796493b2d21e406e22195b3a
SHA1c65241b36a48cb65f3b89a928fb3ad3861732d34
SHA256b02b6331553f334161d515397247688a44c4890554153925140fa3ca400c4bc4
SHA5128f3150e68e8624ce31b2c41fc259e9b9b5f3a80dbb2c03041814b65feebf0f9fe69b0efaf45d78b3eeb3248031261fdd1686fef3ff79d20ef04b1c68eeb6e7d5
-
Filesize
5.2MB
MD5af8edcd55957cf9f0832b924dfded51b
SHA1bbb606b278b6d6f42501359f5d948906d99640a1
SHA256d60f59a9f405c02c38134a589dfaf86cb2316becbcff3e70ad2ef965c2609d8e
SHA5123192f272ab4432c9acdc3359361a49f5160242be70ba5ba868cefaa3c620df33a6ee84d1103fe67c69a30e1d1d2e67ed5884ba62f99bd0b3dbc89fb87847f709
-
Filesize
5.2MB
MD53b419bb60c26cee3f38d7b19f1d8d841
SHA1632c0e4e198208e4dbb6f442e0950edd8f454798
SHA256ba1fdfe5078d8ec45ac0c89c4acc73c3b5fab1713266de235a8703f84774223c
SHA51281151ddbc49e2a64e014e7f7e430b0f5cf1e7b11028de3f9597cc221dcf690329df6a4b5f6fe3aabce0130549eea7bd4c6154ebfb3af7dc070a7f21521422b49
-
Filesize
5.2MB
MD5ac95943b3aa2b067f2e0f19cc8afc396
SHA11a731b01a7704f944ebe906ed7f2faa90ca067a0
SHA256e37ddaeeeaf8ca1e186abdc04e5de7205d1092520ede1d311ca75c1c29ea2c60
SHA5120ea906ac5385cd3a65c245e292079b4f446067522bbd0f783d7e78709719df7542321a1ead5d0902e23514aafd2d5903c0615ff606e6332d3d8caff376bacdd9
-
Filesize
5.2MB
MD5d3233dbd649f91c665bce228a45b34d9
SHA1ec127e9b19727c14669f9ef715b094547f4a026f
SHA256df5bbf586d046be0ce1b90f8c9ce979ed5b5c4d2465551f0093450a850d1550b
SHA512dd2f8ea41973a21e385f8702f4069bf9fae35db13bb65722abfd5dbb6a9af8528d97ea82f164db17cd644c66d3d49c953af6e3fc74efb3f5e9ecce6de3f75d26
-
Filesize
5.2MB
MD541bb01fdd7b23836b97e488dbec2bb99
SHA1a93c9cb5383b963d008358f93ee847699a552950
SHA256ff7772a0b394670a1bf31ce169d8ec27a9075f6e80a8e1a0787c20e9bc09f22d
SHA5124c80babb97fe3f402325de5af7e492fd1abe2f090ca9bfd950a64510220629871c4153a96bbfabca7257a8a0cfad5163d45c1661639a591e38dbaff5cd422bef
-
Filesize
5.2MB
MD5d6cf7030759507016b5f87068e061c3b
SHA1ac178d52851cc5906f47f81de9a6b13fccbeb8ea
SHA256f379b4a8311b4d9092ddaef997747ff9bbbb438538fe87832c907da75ed5bd75
SHA512b0acfd84f2d21d79e11cd7e28bbb14ced11224ccfad15299df209d2422fa6cfe4423124f2ebb1046da1a4d9cc515da8f03ce05006c9b5bf5b6b30789d96bec14
-
Filesize
5.2MB
MD51c664e3014e51f74e022feb4ad00b714
SHA19d5e515e39ef666cfab628caa684d772afbfac06
SHA256fe17d2b05bb4c7e44520ad4ad540eaf0d77023f6f8bab978d7838cefdbbb3b00
SHA512ee39ae081690b3021fbfda1980d2c2646e86433647fb873231c0f923c6b0d072eaa305458e1b98cb4a978e1c301117d8982e18a5921c67fef32c1fd006e53f0e
-
Filesize
5.2MB
MD5e7ad9d219dccfece3c3371128d02d4a1
SHA1ba1f71b086276840ac6d934e18755e2465e3fe3b
SHA2564464a93b965036c6153cb9fb7f0a65e04e883d7f6a52277942b7b4bb378438a7
SHA5129450fe4e80509879725ad29dbbc8d1472b3c66150a5beb70588f06decd87eab0fac195dee476555871b7f5d537ba29722663062f7b561e9c7213a06d6fdf30ae
-
Filesize
5.2MB
MD59eececaeec2dbfd423ef9091eecd227a
SHA1d425e80ae11766b3c8098428c8c3b0902637fc2f
SHA256fe080b2202db0de5662a78b9a868d3a95178b78532825f4eb859118bb4d74d5f
SHA512b0e6171c24f7569ba06e5c3a940cb9b509dfeb6607133845fcc3b9fc64d41576fef604d626827f4cdb9acb06b26dd3034d7eca414d579882cb4e26addff8a81d
-
Filesize
5.2MB
MD59ea1bac723d96d10a35620c0f1eebb57
SHA13e3cf9a7225b5ec7ded542c6074a3740a80249f0
SHA256a11d999616528ba4ee2c6402d8ed76cd9f12996f49d9fd2528b987e6aef34f8f
SHA512d434516b46e99d80f96763d6d4f02753516ad5657de335a3f3a5aae45782812421f82a14b9ba874c8b585de22be6477ac38c036f6d6db5941e5593fc5dedcef0
-
Filesize
5.2MB
MD5db4be938a9082ebc5b9631792415ef13
SHA1ba71eeaf377ffdc0e063c6855627b1cf16d9824d
SHA25669277b3274bf1a88f5198b9a7b0c299304ded48aa196b7a8583408f998bfdad2
SHA51208588502cece1728385e49370ecdfb9ee7b04aabbe588fd484264bbab9e3ef0ba2cec02b2e11d9b500f91ff04b75a08eeef0f0849a4c560957fcc3bffd801075
-
Filesize
5.2MB
MD5d79bbeb0a9d42b9097e7c0168d0bb3f6
SHA1bbadb582b780a1b8fed620d068b4561ca894eed9
SHA2565c8b306d084be4cc292d5d59f4cd16046cdf4fc626698d545446c11e2725e891
SHA5128ef893d7d3b83a80d2ccbb48a14d48e220ebde175822b96695ba5909ddff46e7c786c00cda9fb6cd292b2eea0a2eefb4309ff9c2ad8f8698f834b0534bb719ad
-
Filesize
5.2MB
MD5a0b18e0b0b560dbc8c78f732cae0e2e5
SHA114b4343e9ca26e837734f7ee58d93cbf1de47db0
SHA25634d2aa11051147bc97fed37d13a8ebc2d0a637112ebcd4d61129890bc2eb439e
SHA512c33b2f6a8a7cca31964d8e948310f9f7f179c5eef5a3261f408feec8891ccacfbd30352cb2bc85344b9198b7278bf7f248f70e47101ace425fa73cfd3aff43bd
-
Filesize
5.2MB
MD5aef5dc0b4a3f57a2304fbb5404456827
SHA1cd2b9a59032c0e43fe701903b4968ca8bbe3533d
SHA256089a82f142717d5f4d851461069e768f1d79b3f804b0ba8a9eb77feb30b3656a
SHA51228a7406bcc80c22568093998de24122d99bf24db01d8f06579f90735fad440e4916f1babda28851ed127657b7108bc62d2b3e676aba2dd68fc6fd85def7c7846
-
Filesize
5.2MB
MD5159ce9a9026ad9f5e0ef9ff266cfd5c1
SHA102f2c0061ad796bcc1c2ea77625a512f45136700
SHA2560d8bd7875d19fcc689793d6e9a601b9d1f1aa9855957e41d720b37581fb6cf48
SHA51289b1d48ad4a50bd08fa86b6418ad568b4ab15114187e3078660d06eb7e02e5211bf8caaa8b0c9f09a414d3ed0355c3c6a01dc1b438ed61fa8012271dc7f4ddf7
-
Filesize
5.2MB
MD5a3f50c5a448090365b2c8efce34b221f
SHA1a9642f8bd6b8496938e97859c7ab9d8144d1bd74
SHA2565a60a9497dcb3bb125fa6402d746edf45e2d67cc7a4d9d1fe0ebec5938b807e9
SHA512f5f0e12dcbcc46467072c372981e82dcb0de8b276cb71d1ec4d50753e927682c030774e5ddf8fc9eabb8a59491bc18eadce11f2dd50f8990749266a329f145db
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB