Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 06:51
General
-
Target
2024-09-14_a9c31e43294603d4f85659ee5fbf1284_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a9c31e43294603d4f85659ee5fbf1284
-
SHA1
3f8f085f111bf003317c1f7a2576ec741a352408
-
SHA256
86867af2179ebe07fe20ad78fd72cc29f6f30feb8344448401304059039f63ae
-
SHA512
14cb9ff64813d4a951c80fc6e8d17ce3d65b30f8a9959d6f517fef0b759d04930d1b4ac40be347daa05b9898850c4817be2e7a90122d6fb91fc196a56bbcc21a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_a9c31e43294603d4f85659ee5fbf1284_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_a9c31e43294603d4f85659ee5fbf1284_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GPsKVMM.exeC:\Windows\System\GPsKVMM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xunwzeC.exeC:\Windows\System\xunwzeC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RDwViYc.exeC:\Windows\System\RDwViYc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjslQsd.exeC:\Windows\System\TjslQsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OtAaedz.exeC:\Windows\System\OtAaedz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EcEVcRd.exeC:\Windows\System\EcEVcRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJYgHEU.exeC:\Windows\System\BJYgHEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sarlMvD.exeC:\Windows\System\sarlMvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztMjMPc.exeC:\Windows\System\ztMjMPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgDXhMr.exeC:\Windows\System\WgDXhMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MtGWqMc.exeC:\Windows\System\MtGWqMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rbZgwTP.exeC:\Windows\System\rbZgwTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOYYPTx.exeC:\Windows\System\uOYYPTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nJBPEKk.exeC:\Windows\System\nJBPEKk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSgIAGV.exeC:\Windows\System\oSgIAGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ziLjvQd.exeC:\Windows\System\ziLjvQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ihZrUbf.exeC:\Windows\System\ihZrUbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zoiWmWA.exeC:\Windows\System\zoiWmWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LXDdoCH.exeC:\Windows\System\LXDdoCH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxgAxjI.exeC:\Windows\System\XxgAxjI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCtbspV.exeC:\Windows\System\nCtbspV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f8f112ced0a3479ba0ca45ff6ef50242
SHA19569c7f16417506de4008bb19ba7729f5d43a8b7
SHA2565c7d7b2e75cc09f5eb287b39a5803a95920e24d0cd37b4bd49c06e5aa0bfd181
SHA512030bbe4dcf0b1b778344304cc38b46b92e47a7fc019f90959250b508f9dbf492c901a350fb6056ef21e590acaedea1078d16900b7c919190beab39e05895063f
-
Filesize
5.2MB
MD55e1b0ca477c515f87197a5ce65bda334
SHA10fc704698340795e71ad5395e63e9042af1c868a
SHA256df0bb93b5208438583a4eaf9a7ed0407fadabd9f8a4a0099406170f84451738f
SHA512c019cfbccd63a12b51a550903ce7ba8d7162ad8089876c68fde8f82e68ba37e3cb0e28fa6fd62870f80ca2d36ff0dbabb16698483b13596bfba9901884e200dd
-
Filesize
5.2MB
MD5659238c62c7762e4af1db1d85a0f9b7e
SHA153dd42dbd64d4bfbd7e3e9a9f19bde6e7a3f2bf2
SHA2560188d0261ced97977be1f4f299aabb4f36e18ce35e1cce3472d6a8f418a40f6e
SHA5128208c1b317ab08a486a37758d3966f7d073803c6230958020459e19e4e555ed6eea81c75ec52aa8f1d32e0183a4f02a2c6bf83921a53b2e632d918230dc993d3
-
Filesize
5.2MB
MD5743afb99d34308399aba9e33938368f7
SHA164a792ae27a1ac2003aecc41c6490cbb58e128b0
SHA2567504743052e32398b6b2b2023f770276e96e0f25aff557200ad51c21874933d5
SHA512ce3029f4f5a77ddcd7daf93044562999dde1c643a8de9233aa078b67f33fc33531f7b3520f3c499cec205116393830dbadcdd95ccd687a6df53d23dfa8a8aaeb
-
Filesize
5.2MB
MD53ed1d418aff45bd74f4bbf2bb1e82350
SHA187fe960eaf8d0bd08024e7dea19f5807d66d49ee
SHA256ad7017759bfcd401e65716c91ac50f8120fed470f5cff03183d6ad04b76c61e5
SHA512051ee908db85008c90133482087499b79bf3b67e2480daddd3a3cf86b6d5b8829dc193e9c8d26836082344f141ea45ddb68a6e8fb06d23151d29696e0ece67e4
-
Filesize
5.2MB
MD5e73533eff126ae9fac9f74a6e141456a
SHA1f4e9b844fb2ef0f6d28de980a0f3610ae4038196
SHA256a4e8e8e60d7a8c7aa4f4ff8f0d19783ceab062010d44b677965eea7d3b2bf7c6
SHA51211abce79507b798e98c9bb03ec4324602d966b31f060024387de55bade5d884abe00ac8351b4ffd0e81e6f6ffdb0deb89b3a8caa96b7181c5e153782ef5853c4
-
Filesize
5.2MB
MD56c673b79846ffef65c98b3fef4be15a1
SHA10ba58f9a7966d993e07e51d079243d486388f3ed
SHA256ac2596b4fc4ae919d22a097f115bfecda70265d6046f9c984ff05f56380c1c74
SHA512fbcb2cf59a2e38e15fd7fe253c9de3b24badfb7e4689fb4bf63f535be656e86404765d9f4f6af11c0b250cff8f93d4763bd10d8ce1ec08258b674aa0cc7c0bfc
-
Filesize
5.2MB
MD5ea40a62e204d50f026f9dc1ce98a6b16
SHA1f23a953c2f48137ded133a3eb5cbebd0b83aa40f
SHA256d28b3c04e22886914aa6e255fc5343bb801272353560b19fc52861478fd0aa4c
SHA5129185dd75992bddac4a4c8ff37e23186d7f69424115819794b9b4a114a810e3571818d3682ee707bc3b8b7f0faeff2192193cb1075324673c77a3e1c6568cf65e
-
Filesize
5.2MB
MD51c73cd64023b91eddadebf7778c33ca6
SHA191e99800ec74fa1ad89df5400ad71392678eeb38
SHA256287b56ff669ac9f0366629786bbfbe85f45c96cd37a28620c9173e7e4236fff9
SHA5126a2aad5555e348150d6d2d91c098c27b9b31f9c24bf19de9b55e10dfb0e10af3306fd1e5b383a45f98dedde8842f5573c882d0c0eb993d2c53d8802044f87855
-
Filesize
5.2MB
MD52d3d419f4c187a343b8cc14ad838cdbb
SHA1e206e59b5e7e1ff128adb9b599d73e739edecfd2
SHA2560d99e7e4b4652499e9de6c51611a89d289422002bbdbc559ccdea55a7f005a05
SHA512fd94d89a6a463fd76562ac8aeb7aa446b318cb41e3bf94090237b41d307a61d7666cec3ff42c88aeee7e5f5f4c4a1088b093d9ba744cdd1907c3f5c35225a519
-
Filesize
5.2MB
MD508cf072851b9b9d72be6e69a6e03b4b9
SHA1ffaa3177a6ed698aa5ecd8b4e93bbf9194a6fb1b
SHA2569f1cc0ef5644510c0430d7ddf06e5ef063e388f19ccdd556d41a9607e10723d2
SHA5123c4f21d15706503cca76ad0680a32fc07f5aa6d4a63b10a2aae5b24f684401e5f8607ccba53f700428e03b4685fe5389a695c1147cb13d834c98755b83e330ea
-
Filesize
5.2MB
MD519ce1c1904174a5636defbfe82a5efba
SHA12ff2be03f587e4cd7184b2735e8b5f8900d82d21
SHA256df9e3b0e4ae6181712728437f18d88ee32789ba91f0e3ad26addaa674b4b5a0b
SHA51274c1cb6a2a0bfeabaf7147cddd7ded7cfdc3727b5f5c0d8e6c2f2c828cf5c9f70854a715eb2fcf7eabd81769b091c0e749ef17ddad4cd7fbc48f6495108c3924
-
Filesize
5.2MB
MD58f0963f358d54da30a8f3becea369e5c
SHA17552b74449850382b515741de81f0382caaf0b99
SHA25665340210ebf61d935981bde472c5ae49dfc04acfc134b4480de39b5899a80ccc
SHA5129c0cbd6b449c6f98b134adee66451c26c3c0eb288118f93ee0c411a0c4e17997c4e3704f178fd31e77f37d3f94c17e2c006177e114cbbf5a6f49287f5f3e3a8e
-
Filesize
5.2MB
MD5b38e865682528b38956e73ad80f8a302
SHA10703f6d764031d32ddeb06ef877c17f4a42182bc
SHA2566d8b7dbf5f5d02cb23344dce0028f6fddcb87fb48649d8c06a090585b16c1b64
SHA5121e564e79dcac06385e099fb9e69d01a1277b834274a381eaf846d1b59d01b56db5c4a7559d43dfbcd0892371f41c2ae943aae27460d6abe0a1416ad779785d75
-
Filesize
5.2MB
MD5583caa91137eec4291efbccddf23eea1
SHA1a289d3de77addd8de8eff938e9de4e3e2978a16e
SHA25617bff798ca8513b8ebc1dc93c9800e95b39d50ff1fab2e7454bd553b9d05fb08
SHA512016e7f55b03d08494d3c747bd7b8f59240f552e0a8c0a1bcc773822fa6491a254359667a18db108ba74a1bd7c45af0ab240425e0b9ede8d98d44de9d4b623134
-
Filesize
5.2MB
MD59b6038db581828eed0700fbad7428a77
SHA1e76aa38b781489a288532622e295023d3128c56b
SHA2562fe3ef164b1aa38657cc6d99641200ce75e3255ece184d92fa7e63ca4564173f
SHA512eba19e5f2375ac76a80b59e746d0e7f935010c550c3e31d76d5722f562e613b9d0e1fa4b2cccc745ab90f9f306f5daf177f13b205a9d35cfd0844c82b3178ff1
-
Filesize
5.2MB
MD564b13e16c6e8e04f700e3340c0b81755
SHA10da0e440944f04d93136cc6b0762f2457de2d7d1
SHA2569afd20a75ba70c2e92e9f5fe73ab237c1df744dfcf514aa8b6cdd18ffa234c1a
SHA5125dee48ff36b4c303c2f765bad1bfa45620ad58c7061cf0d6b089057f057cf5fbba1fb7e143f18b196bf1aba3724b3a0c3d7e079dcbc284a7a3434801608ba899
-
Filesize
5.2MB
MD55429e84b3dc239d7387dc88ba12cdc3f
SHA1625f3e7fcb7574a6cc4bb3e566a8a2ad7813b4a2
SHA256d470ff0b1d87a0a072913624f46c6d164df6bc7523bf66acde3ecc5435d4108d
SHA5128f126f3df62690611f685feb27bb29f579e6d228c0a2b7fe6beeeb74288c6adc1bd40980274ba60ce6bf192cd81a27b11562ca0a665d85fc5ccd4103b7ef8065
-
Filesize
5.2MB
MD5180d6338a992ce15468bf923c8a873a3
SHA1c18a59cfe70d4b9df2990712282620f487d5562d
SHA256acba0877928f45ba9d1a6e399efe87ba9f4074d8dd7bda3a34eaca5dcfac0b5c
SHA5123ffee060dd9501066bb69097a1b0455841dcb374b37c9cf91109de9978b6c9f36e985548afa76e4299d5b5e6ad1d6f8680bab235cdbfd35da922112c310a6ddc
-
Filesize
5.2MB
MD5dc914253b74dde9fa451a9e191ba44c0
SHA1c07b097ed7e304f25d2e4a10bd092dfc36601661
SHA25647a7c59d15ef35af5cc5340ee8fbc769187fe34f16e66900f8d9d2240c0fd1a5
SHA512e7428842c9a6a95c987f6e494ced0b94c170f0053751e6f0c4c1fc9559d3a98ddb31115b54b126423c0a55ddec88ff440a7a0ee8df7e638ffd791640cc9bf7c0
-
Filesize
5.2MB
MD53ea632644bde5f6ed521931d1e1bb939
SHA1032410241568e19d820e4cdc1cccfed4dc789446
SHA256b8b230bca1664fa66bc54c4c328b406b1fd114a3dcd602876c6943366310f889
SHA5125c461c9d57f30ad8f61d4381e6b3adf7939a9d0585b71de5b8eaf9698722c66854d705cf6141fba28403c21abfa05b3bae1958a3ca437f5eb0af98d86838e447
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB