Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 07:01
General
-
Target
2024-09-14_68b4132d1e2e2b98aed36809e0f11f63_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
68b4132d1e2e2b98aed36809e0f11f63
-
SHA1
f2683351d9f2106684633aad787d1db3373a49c6
-
SHA256
86655fdb9e86e0d5677265760f33a422ce714c702afd3f5060282dc4eea293a2
-
SHA512
163761685c43dd8cc51d98a52da47d66db6dbd0bcfd981737de7d635af0135fa71c57d1bcb3a3b5bd76ca27c9157a288bae8f383956c2b11000e85d2a549ae94
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_68b4132d1e2e2b98aed36809e0f11f63_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_68b4132d1e2e2b98aed36809e0f11f63_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cVmVcbx.exeC:\Windows\System\cVmVcbx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJLQNkJ.exeC:\Windows\System\FJLQNkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcMPJOc.exeC:\Windows\System\PcMPJOc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQYWTAi.exeC:\Windows\System\hQYWTAi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbslCGj.exeC:\Windows\System\bbslCGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\duRvEEA.exeC:\Windows\System\duRvEEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dslTVWi.exeC:\Windows\System\dslTVWi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bwpqmDO.exeC:\Windows\System\bwpqmDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBmnZNL.exeC:\Windows\System\fBmnZNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjxEubP.exeC:\Windows\System\vjxEubP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWpYxJh.exeC:\Windows\System\aWpYxJh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIMMCmX.exeC:\Windows\System\NIMMCmX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxwHawc.exeC:\Windows\System\dxwHawc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PkfJhoY.exeC:\Windows\System\PkfJhoY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRCStub.exeC:\Windows\System\MRCStub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eideCxG.exeC:\Windows\System\eideCxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CkvUBVi.exeC:\Windows\System\CkvUBVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWUinVv.exeC:\Windows\System\LWUinVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\REOxCjt.exeC:\Windows\System\REOxCjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXctGhb.exeC:\Windows\System\sXctGhb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Suwzeqm.exeC:\Windows\System\Suwzeqm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f7163ac4b6c8c415641194fcdbde79da
SHA1452421d8ed13271746898c49445c284b731adf18
SHA256c70662d8739248753b6e2543205b26f752b126a1c01b5f78e533a7d12c2f530d
SHA51246404e7017e491dda4f530e53a57b69618c50e341976b962c8b6dfe2ec3d1825f45397db13b12507771cd44893b5b20b2ac5c7d3fb991ec470536620952d30ed
-
Filesize
5.2MB
MD58cde486454a16922d315fdd9049f3267
SHA1330ad81e6b0ed0b92c0cfeb8d345f5f8e104f19d
SHA256b1ba2e468cc148b7e7de3ba3109d31abf31e447473cdfc09d8f6377b57dcbdee
SHA5124b0e73684774a2a4a25a15fdfeb88ce8fb437d054772986e46ea8dc7f6c9bf7b0fe600aea0a5207139f9dacdfddfce220908781e52ffff0b9acb6c7c90abedbd
-
Filesize
5.2MB
MD5b306b601b32e916adc561c7e450348ed
SHA15d33bb61115766f0382f38973e323403a5d1b719
SHA25670add9f4ee5f80cf6bba6da53b9823e82dfb263925c358d19bca305ed4795876
SHA512267be4d029c343b251701b9228d978c856d2366373ac1b11e6381caccd2aa680f3c7f18f000c866c53da22b5b8e93d6bdcc81ddf18802b1ab1d49bd62765de27
-
Filesize
5.2MB
MD5abf84cf112478f3640fed15c61830cef
SHA130909fc912a1f64af3d1b4e2c006541c32c01291
SHA2564253f37bf7046d1b1dae57a65b3623594126cd39da74ace0aee3ef12c6a735aa
SHA51294c6ac16f65582ee5a1865dc32e50a99ddca6a6de63911314b8b85ef742472bd457c67f33ae8f3afb09f1348d791d40704932b8db88b78ae255f3501d779e465
-
Filesize
5.2MB
MD5972cfd294ae04590b3d70e8584729e09
SHA16e4d2170266426e36e17d12c02678dc5453047c0
SHA25607db6b3f3afcafa5751493a919d4cdcc74b5af34d514b4ea53fee09ab707ed0c
SHA512260f0d9dc648b5f595dd073d953531c6bd9088e85081708de6b2045d008b86f32a4d001f6c9e016f6b87a40459c30ed55dcc2eddb2db429d5a927d59806a231f
-
Filesize
5.2MB
MD56e6e60cb537dab88dfc1c72f704bdede
SHA10865fa1e2386d05535f1e87202dc7a4cd84aca45
SHA2563176414eb6515688b8f7a467f4f000a03ccce24f3fb0d09c2511cf302182ce78
SHA512c877de101a8815095dd76b8614b79c1d45d9cb921a7747b2a3084a57263459eefa729323619dd82d085ebe3278a34fc3cc8bee5c7d5c13df75e7bd18c50076b1
-
Filesize
5.2MB
MD53b9a86fde77c0fc224e635954e99c4fa
SHA1ada51d87650e9e8fcff32a2d6591179593cb8df6
SHA256cd45420b3ebff5c0a8e60c6f4e778acd59ac426e490acc2ef226097151e8b346
SHA5122ac4dc0aa79951822e4b816e63168ad39b064d024ce6c3e8538ffaffd7ffeaf9c1aff009c390500d60a59277292c2a16406400e93301a8bb06b7344f49e4c64d
-
Filesize
5.2MB
MD569378a7d5333fd297563d82481c458f6
SHA1d897224abe88704a9120b2b7e3eb9aecdc7e2448
SHA256b12967ba8fdbd3b8e13dbabeecc5bb996f0fdb063356877a07d73d49a46c2810
SHA51275f0ffd9e0fa58925e989d7622a5064932b9399c35b4a8cca14a8fcb3778b7b5eee26bc0b1666c47c8c4b2f7fb493d79f6ce2d47ec5276dbe94ba29e968f0f6e
-
Filesize
5.2MB
MD5e120df20197cbde90015400f48e0e192
SHA1d37dc1bff5c83c0654b1a11189e8b3a3925ebbed
SHA256c3ad73f16dbf6f138f62bee4dbf7dab4e53fbc72fb19871da414d051a9961ea9
SHA512b9751c0045c6abc012103baecc3e3869410540524370a5f4fa08b87f630b7afdfd07e5568879b4efdcc79da03ee101d33957979e003788fb7cc2113904d8158d
-
Filesize
5.2MB
MD55678bbbeda81721e13c2c00871986cec
SHA15a2122cd80b6c9ab804887a876d8f7531d2ed9e4
SHA2561e89467a5f9ea0ba6f748c99c829f55f801a959e20b3ad11a1099c46c019642d
SHA512e1709db320992beb4443524fa8f24f50360ea58ec27c00a6eef9a2d3e058310dc4e552f6d4b44e386af1a7e6c4d9305a15709e17fb481021a291bc69366c12bf
-
Filesize
5.2MB
MD530414bdab5b7f86ff6ed5d11d177a398
SHA1e5e7afb74129402421ef7e255824dbac7002494d
SHA2566ea4337ebf5207ca238a255a448eb2d413d0d4f75d0ad6649df30cca0dee6aba
SHA512b6bcda1ccd2db1a9f98d1d65830fd1b396d4ca812400b7a93b9ab8670ebb2682b6241851db66ed555b404d07908db49c4eeeb180b5805feeef68ee56590b75b2
-
Filesize
5.2MB
MD50b48d873398eb5cb5a99abcb0a8bed4d
SHA1d653d6a48f4c878419b98f48d349d4f7257fecc1
SHA2566620ce52bf909d9c4129cd56f01e0227bd0c82ddced135677e89316201984a68
SHA51284d6b203613e26db6328e147a9f89eac6c677ede401ee4cef2c3204ed97fb43036ee2ea736ee36c5191eb6bf7bfa5ef1b0f1f740d9af8db2127ecfab35b26877
-
Filesize
5.2MB
MD585d0bae0985cbde60086ec9bf8742c65
SHA15f7ed95be291bf1f3d4ced63866709bbac087a36
SHA2566f023ee2630b5851dcff7d0fa785c3c0c014a342523e89ff771085bf05b9c5af
SHA512e60223e41d4953593a39d3631458255f4691a294dbd281b46f868eedb7de499e69f7f274253206bdd01b798dd31c30e594d48f34f1825508cf4154195c3b1a9d
-
Filesize
5.2MB
MD5f9beb160c455f2eb09ef728baba5811c
SHA1a4da597a6da576644e1afbc00113033ff6b516a8
SHA2567f748e2989539d1659406a5d65ee68a6c813e61c685c9e1072a33057d5ff91d7
SHA512fce03aa3acedf82d4cd3a85b23b2d6e291b18811e3365e29cd4110b7423db5310655cfb76dc423c88b887959a9ae11c3ed44800cdd7373d2e8ec8470691858e8
-
Filesize
5.2MB
MD5fcca37c472aed9b7028eef98ba101351
SHA18d5eec78a210fef87703f6bbbf3ea034486f930c
SHA2568aebf8b061ef10f34738f712d544ef144ee81d945ddde4fe95ad455710cc67c0
SHA512e47cde7e5688e75b8d4f77093a0dd232f115d8e350d982221eea979533d828924517c7535909402d37efabe057bff5484bb92d4bd08faea179a3b9193c912b96
-
Filesize
5.2MB
MD558cf24a7b741bf0ec1ad01f29d026ca8
SHA1a80c57e6e93e7201b5c1eb6faf9a3a85aaea2f38
SHA256bd1c0e01765afc27595d349383ae2e65bf833e84abb9c3f8770d981260b649ec
SHA512bfccd11cf2026a2bf088800fca99dec8d62b337f14d7fb93a3d676739ac6970f0abf60e0ccfee13fddf520c5e90e511a6fb5ed469314be867ad4a421e83c7c4e
-
Filesize
5.2MB
MD5fd3975d7862f5b99a9649268ef477922
SHA1c7c63332703c221fd32b33d04f156f2b04080aea
SHA25699bb5c83f0bddaf6c83b4120a90ede8e074b6b02e222bd69a3629a8f8b2b5f89
SHA5124656022de478ce8977f1b937c2bc34858eeb28783ce077e0176afb2332c78436465b0f1663c129f9191ff93ff64c9f0af27a6aedc7eb1c9547b00c1d473a5d42
-
Filesize
5.2MB
MD5096ddcd434bf034ced34842752ba3721
SHA10e64c5368773f88342c4dc4ad9d8cd2f956e4b86
SHA2565af9218baca9a0f4d6a79e55b951c276286eecf582709ab5d02944785d2c2db4
SHA5124d88ced49b16df4036a736befa1e958a39643d295250f825a059f7515a4c4045df56179b92f686c7fd00b3be36119c0c28fd2b90c595f4cdc94299ee1c8aec52
-
Filesize
5.2MB
MD57d64d7f193284e32616a0fb6c9b0ba03
SHA1f16a2148710fb12f4440e807673f5b4d316d5a65
SHA256da7a773f9aa9cc476b1dca9e97979573ec6ee695cb8774be2ec874b9a06d416f
SHA512c63351dd603211d32a1a9b04d642dacffa34768e5ab62fd5f2067b0280ca08aa5dd118c2811f2c223d7b7a91324aab058afa1987b53afc55b0f75bc488c27036
-
Filesize
5.2MB
MD539ed9ef3c8c6cc51d28fb69e29839504
SHA1380a7643a86914ad5ef4045240d5a182b9238e7e
SHA256e091f777b46ede9e6d6b3253ca10f7ff8574ac893c1d3c42faa589a1ef5809f0
SHA512ad06957c95da2e6d8d8b4358347a6a6fa20d2804e8850fa66b47e6ad91b28e4929f00079f0f6fe43fc8b664452b78532441cfcfff4fc0e293b1ccae765f1519f
-
Filesize
5.2MB
MD51d379143296d0fb62d148c3a27a4ff9f
SHA19dcba05da9005300bf28dde2b4047f86d499a5ed
SHA2562d8e71ee7afbb48b529f64ad05a7f3436bb85c438f91adb004dd4ba0604cfc37
SHA512b839d21fc15d44192d6ce54287e23135ffe49dada57c2d230dfadb0e1ed79527863fd582860992c0375f1be51bde30c935cd415a68f4021e153d8e03b469bc61
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB