Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 06:50
General
-
Target
2024-09-14_9ac743513a75acbb7722e97395762eb4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9ac743513a75acbb7722e97395762eb4
-
SHA1
1a0443a607d6bd9e0356352e626ba773a64b1050
-
SHA256
b293c76cf1a8b59efb8425375644c914386146120fda119cb8586c36369dc72d
-
SHA512
1ff625c501344d7526640d42679d57c33eb5416fff5155a2bff414496b685fb813bdb2cdde5f26b8b06985d4db8a24a39f3e813309a0dade62ff58c7bba99e7f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_9ac743513a75acbb7722e97395762eb4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_9ac743513a75acbb7722e97395762eb4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fPdVHPa.exeC:\Windows\System\fPdVHPa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvlyIRC.exeC:\Windows\System\RvlyIRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBMVTYS.exeC:\Windows\System\YBMVTYS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEufjoj.exeC:\Windows\System\rEufjoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZMlocE.exeC:\Windows\System\qZMlocE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLdhMMt.exeC:\Windows\System\LLdhMMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiUXlQf.exeC:\Windows\System\uiUXlQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjxPyzG.exeC:\Windows\System\vjxPyzG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwrgbsd.exeC:\Windows\System\iwrgbsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TOIIVtv.exeC:\Windows\System\TOIIVtv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdJrGse.exeC:\Windows\System\AdJrGse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xiwzJsI.exeC:\Windows\System\xiwzJsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYSpHSg.exeC:\Windows\System\uYSpHSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvAjoQk.exeC:\Windows\System\wvAjoQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ijjdofe.exeC:\Windows\System\Ijjdofe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NixWtbf.exeC:\Windows\System\NixWtbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdvVsEY.exeC:\Windows\System\QdvVsEY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vxjudsp.exeC:\Windows\System\vxjudsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLJGfvF.exeC:\Windows\System\FLJGfvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrXKJyZ.exeC:\Windows\System\mrXKJyZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejgIweg.exeC:\Windows\System\ejgIweg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD544a422f1fb258b4d98bd55944e821042
SHA11a1d76a154fa8724224ee66bdb3c2055766a3c7b
SHA256f2f8b3f933c3a31eb0509d8fe07ef082e9cf213ba0b210eb3f583a57ce13cbe4
SHA5120197b6918294222159ac31bbbc507655b9b6dc7a7eb739fcd989a87d41d9d72fa0528a529a9eecab9283fdeffb538294a42e3e8d3b11d3eedf98ccb83db52cff
-
Filesize
5.2MB
MD5f797943e1bf2a2c7812589974372cf43
SHA1c800cef8e86868a84011f33e19cc835df739cbcb
SHA25670e4975e28b89e172a4f5a05924e8bf588c4953de05ac7c91865b69ec4e32790
SHA512c64f1d830b8e1ceba473c8395406a9667675fc6e6e2fa52cacd2f6c77c2faf7eebbbb50b3d852e6bc829456ce1bdbbb12b8491ce4199cd53ef44618a4503eda0
-
Filesize
5.2MB
MD5074e0ef3ea3448fe622848cb36fa5f63
SHA1db1fbfe35e7655ca8cabeb09199d78d9dd199c7d
SHA2560d25c6561a7b92be957aeee6ad59e2f85cee24dc7af18c01ac819c01ba2fb354
SHA5121aa8a22bd33762c26b331f83fd19af4d540b428aa70dd2605f48938c3db1967fa171afe7c6db7ffdb42eab2fdb6a5a2bfe641db628058f70eb73f36f2fc16124
-
Filesize
5.2MB
MD568e9d988bf81433f519df8ac161f1a9a
SHA17a5932353c6d017849e1e84bbad85ab502dc893e
SHA256ed051e9c262ba75f49c678fa10c25e94e8e5a117664d161cad6eb11407e374ec
SHA5120869540e151e22fc7948caba8336f2983bba715bff30066f7b82607b5ec2b67d8c7c02eccdeba879c768b69098d4d800ec03a41cdc654f5c3b61652edc2d8881
-
Filesize
5.2MB
MD56c0f0dee63e0ebd37edb576e70ffb9b8
SHA1cd73bccf09dd9766bf0bd807c7c1b5e08cdc0177
SHA2564675cffe0bfac80acd58df5bda06c83412e2691b6bd15b73db2a586152dee9f2
SHA512faae50099f41d45f811324aa0189a7fce57a0ebfe209bba99c8b37ac752dcddd7c77b514ee06e8806d93ee3716e2fa4b2f1839a237153135c825a11a3d1c27a9
-
Filesize
5.2MB
MD59c8abc5db49db7e4d3266c74f430545f
SHA17109b1494071fe01fab40db904cc19c82cd666d6
SHA2567e850b9c1c1284e80e0f49419ec60fb30d3a8f24b590716965f4be0dc54065ca
SHA5120bd470e7c44140977af3a1790d65e58bca492d7977d3219af0a03f9beb4fdec3831c77f29dd220a4f26cd0a220c68060dd69cb5f82f20484ac5f3da06568ba82
-
Filesize
5.2MB
MD5283eac693ff35a5e914c4de74b71120f
SHA1e95ff73ef288a5aa4a3733445dd6ffd6c4497c12
SHA2561d4dd5246252841503e02b1a786a5d029ff8a43f613ea8e89540199b24bf09e8
SHA512819fe673c60a15dd5be148cea8a310dcd2498d56512fd5c72afa7781186395729bdedaf26161bbe59829f73ef81d5ee38b94fac717bc853b55a23726351b0202
-
Filesize
5.2MB
MD56977257c26698f52297ea5cc9edfff5d
SHA1fd143778be9854251edba93fbf8f3bbd4a511990
SHA2560ba1ae1267123d64dca972f5c071d4cc253129b2086ab7c6ebfad98e299adc51
SHA512f9bdd87158f89b796d14677c531a8bbc8a7e06b0622711a22ecb8e25788b23e5da793737a6557efd15551b1a79378fbec4deecba1ed132c9988074303eb01055
-
Filesize
5.2MB
MD55d834d26c9fd96f20f4c9a2f75cf7238
SHA1f982fa825a07223b429eb36d56b6578db524bfdc
SHA256b403ff563e5ebff9bdeacf1215d453e47dae9f585278d9185d43f65221329a58
SHA51231c78d4984ec928711bf43f0429334e3a8cba132ceb9ea73fb31acd9c6a1db4fba46e895ebf880fa1457f2f9d091fcce16daa3ad991e68c5d9513f95d86fb75b
-
Filesize
5.2MB
MD529b5fa2ec1cc52ff03c176e0559cbc5e
SHA165592028a263b95289a2afde9122adf6eeeb06b8
SHA256fe564b10e2de775b9e840eec6263e6ce1366fb2fde1e7977066db915d625faed
SHA51226c4077f2318e100d1986d22af55e9b326fba480143ca0db25b19a71e544ea236f4b6cb7f51af42ba0907aa283c012edb23009cd8af132fca9ab765eb6f97bce
-
Filesize
5.2MB
MD57119ea8305134cf641f42cc6b38b26ee
SHA176569f06f2820ad122b22acc57def7d98d5a736b
SHA2567ea5ed1eac8522e59b0d9ce0bae9b4942215adffa33abb3585f912f35f72bd99
SHA51225e72062d809bb6c388d12e3e0816e2fb2f3d45693b892781e16b32fe5707637d237bde87a7df9e7da5cf55e0a8c723629f3bb57466c9f5058800380187f2146
-
Filesize
5.2MB
MD54f05c3277ecd0978ff020eaa4003f984
SHA1bbe2fc3a2f0d970cf138147af904069e4d9a2fc9
SHA25608f844a3d8fd82b093d2dce84eaa7b750d78378f2bb74fc0c1225f442746c91d
SHA5120b6a9700a75c744d04d0a3f3e65a77f2a0c41799d378de16fe7494125f39a10c7b1e93c777d453c2d3de11bee40bd4979d416e6112acd516242c65cd312e026b
-
Filesize
5.2MB
MD5ac256b8c9b2c30f9701f845844d7c545
SHA11e6da3339b1aa5d17bcfe7a8d891ba530f5db97f
SHA256e8269d3dc8f573dc921972161fa071117af7401ec12eb5cf67665aff46dc145d
SHA512f27fd874df3a7c5d788a8f424d417efdafdc4c639898e4c02c54f16444a83993b2de64e2d7f8b8cf14657395e69075c0757e34a88acff0f60fd6b219339a31da
-
Filesize
5.2MB
MD5c0b4f356ff0a4e2ff449bfac7db3bc4d
SHA1292bfcf879c10f7b69dd79c7a3ce087569f4e6c4
SHA2568a65bedf4f15a8ad982f96264caf3fe69fbd3bffbea10b2dabf9f88841df0261
SHA5125754075df4b8915efad4bca64ce9cd25634491588c2ab6e37499a7441f0bd4d9f54108d244914de540056ad33169a45858833eb900cf60bfdb3395cd76867b30
-
Filesize
5.2MB
MD537bf5223e57f0efc57c45dbf0685aef9
SHA1d85a1f5dcda17f1e9ba1dd0166a4bbbbb5da53f7
SHA25614b4bca279ebfd52c48888b316c53f06ebd10832a4413fd33814c443ae5cbdc8
SHA5120d8440167d0d2f405eb7dba9633fd2ae3f27f2e69649c24fb5ddb0125d057505cde2d36a9821c157f6eb8bc387a3f85988d074018cc3253f5ef10a5372682f6b
-
Filesize
5.2MB
MD5fa2ca72fb50db4f7b36a8b725a2ef61b
SHA13ddca7964670ff0c67163d677fe36b3e5ce8f21d
SHA2569abaf905eafc41ae3aeacbd4ec3a39c530484a8a317c4bc7b06ecae5c58f8b8a
SHA51202ae826bc344206d20390afee6e20cf591e9abf6852ad23204ee3721bd648d0c155bce3cb5125f8c887875beebdba71735ccb0957eeee439776572256a41ef96
-
Filesize
5.2MB
MD5b13210e223868fd66f028ebcc7d45b31
SHA1eb47f4c951c6ef1a20e7cfa893dad67f9b6bfc67
SHA256493639311a36fd8b24adf7ad89254e0942488221448696283e342a8e13647880
SHA5122e853b69f3868cc17be1f674840fe6522a4375142b6759e9c1cb7405e31a371d8e47a58c525e7376352a69a01ad55779cc0ceea80bccd7af3152e1fce5ec7ae1
-
Filesize
5.2MB
MD5ad3b0a94dc9d4f11ab87a4ac31a3054d
SHA14543c8c6fe8df4105823c34b7d3ee3371bd62d6b
SHA256ab161c0a73164d1993c5421a0df03d1ffcd3a6740997db98a11e90f7c0390da8
SHA51267bf3fa63b8d7358656c147d503fbf10a4216fe8b1b91835d44692dad412666d159d6bbad9df8f8899139fb4f5f00f1a7fa0e0e50e3388ac0fd570730acdfb89
-
Filesize
5.2MB
MD54f26672176a558a91266582b355736bb
SHA1bfa11ad4ed4ae3c807a677c40032e01ab87a728f
SHA2567fb79f48a4d844a1bef4a23ee10a5abade5b202dde4f90739c296368275962c0
SHA5125726e9b5c129e15e11c154ffa555b30524d142a3f2ceed597d156d86d2154f416cc1c26714b9ff6c6877fc1ef3d1a7efd6a09c31fb34bef1d4ea71ba157458df
-
Filesize
5.2MB
MD5a824070359da8e302854e50c68bc9a1f
SHA121358ff0a8bb69a668be31de5d3e4e4430d11d23
SHA25676be129cdd9613ef139e16dd2c10bb2c657e6169502f54dc9a336d074ae22fc2
SHA512c8aa97b9be17d1e781b52369983df655ead1a3e0e13332d87b0e6178984861c95023705f91a4e2713f43e835877882a6c8592080296894e49d8f9e10cacf1021
-
Filesize
5.2MB
MD5c1ed53e6b55cee7bcbcb81eae72159a2
SHA15665708f9fd685f4a636b48dfba3f5edc5db11ef
SHA256eca32454efc5ee4a2c4fdaf5f1479e94c1ab9b58991b8fe866a43f2aff52b757
SHA5129c082412b82c8f4e7ab3e9e60c4e2c1ffe792d24466c10a2cdc5cd9c5c1cafd9f36fa92645e29bf54756dff833bcf8b16e53c48be1fb5f53a89161ab33ed9566
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB