Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 09:35
General
-
Target
2024-09-14_be5df2582264ed7682534c3cf46cfb85_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
be5df2582264ed7682534c3cf46cfb85
-
SHA1
db1d9f693cca0c4569e4a369fdbf4543e41cf417
-
SHA256
5fd0661a97763a341dff9992adab2a0bbea0dfb0ba125395fce21e0867936e97
-
SHA512
504c205a9340282581209ac48ceb69791135ed1b17d25c02d63a002e0c92482e836321d71c1c5d76ee92d906cc1a8ddf23fa5eb24c3f1b0db6d57fcdf6e6738d
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_be5df2582264ed7682534c3cf46cfb85_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_be5df2582264ed7682534c3cf46cfb85_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jFUqWnT.exeC:\Windows\System\jFUqWnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qRRbqxR.exeC:\Windows\System\qRRbqxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CresACF.exeC:\Windows\System\CresACF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OHfvhCZ.exeC:\Windows\System\OHfvhCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psihegZ.exeC:\Windows\System\psihegZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZTaVyi.exeC:\Windows\System\rZTaVyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DAspioL.exeC:\Windows\System\DAspioL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EhUcyxR.exeC:\Windows\System\EhUcyxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnysjrC.exeC:\Windows\System\DnysjrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HqlkvnO.exeC:\Windows\System\HqlkvnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJgNgUQ.exeC:\Windows\System\GJgNgUQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PscEkWD.exeC:\Windows\System\PscEkWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykZlafA.exeC:\Windows\System\ykZlafA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KHMMbEd.exeC:\Windows\System\KHMMbEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YByTGfm.exeC:\Windows\System\YByTGfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLjSnuv.exeC:\Windows\System\sLjSnuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swXhNuS.exeC:\Windows\System\swXhNuS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHexVSN.exeC:\Windows\System\NHexVSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKVCuYJ.exeC:\Windows\System\hKVCuYJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyiJAAN.exeC:\Windows\System\eyiJAAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SBcYtHN.exeC:\Windows\System\SBcYtHN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD587f25cc4dc666781949f64e2b393036b
SHA1a42eca212df8ddd313b6b24a6c674da42975b79e
SHA256ccf9db8c0aae58511ebcc0547cfa1f8b095a559cf4f9db7a1d0d87f4a29e6382
SHA5124a91c1fcb112a26d35f335956853932bc68218ef4b189fad4ea92bf83af1f414f9d405390f9622f453853ef82a46cf10d331ce663b3fce00944d4f9c3624c1d9
-
Filesize
5.9MB
MD5ac0add0272f13ca75940006fe475395d
SHA1b612967308ad5de875c270d525e802860ae6b80a
SHA25617c6c49bd0ca02ee4455673465ffad5414ac0713b698ddb1264b931694650cd9
SHA5123f2787054b2a08662140658ec50382b0e298d91503d38a4fdbea7756eb575baefd82e7b3234f4f5396b3cd45a480e17a06dd435e8b65313973272c9e7f29636a
-
Filesize
5.9MB
MD5daa29ff40bc845f0b68e005349b2f14d
SHA1ef6dfed95ab0e9c7509a8e0ace5a4889951a2739
SHA25695ddaa3368886bc1001cd872d593ff77898bb35b17e40bf868e301215b37b6a0
SHA512f2fbc21f53bae1e1a1452205327d1ace5aea471db629c804a29c7d55bfeae2b6b228c0df9970fed5af4b3e5e7d2a0a1388dc664537c836308f69a0a5d83c2607
-
Filesize
5.9MB
MD55884430e46d8828660e375f74cb163de
SHA1a098c9b70e6a0dd7b87295eddbb615f6a4582b3a
SHA2567dc029d737f90ca0f0b97b4d073a9e565435403bc79573218548b68ea967ebcf
SHA51216f46a3a11000c8790a364a5d078c9ef068b7f4f80cbc9910d7aead5c57503bf307ec53c78544f3917b50dc1e2b73bb2617ee01c2f4f3593967ef98c028c8b6c
-
Filesize
5.9MB
MD50e35d6b691d8970e875e92bdcdcdf359
SHA1a3ad2cc6d0382fd1fea4e63ef58b08733c35b54b
SHA256cb0903d237b3a7bbbe7feefcc15e85e79230f7138f8192b9b871ec17de84e852
SHA51261ee710540f3230b4c4d6964d3f91aa5ac8ca06a3f974f61a99ff832a54835b096410c0f1071f259b1e611738c0f4f749f90bec05629d9c67583e823af4f1f04
-
Filesize
5.9MB
MD5dca35b0c842a64622a4538b2ed35b0bb
SHA15146e5f108318cca05dd4240215d2c13afacf78b
SHA256bd2f95aa82756a915ef2c17c47acaf467e6b5060555c497680423810537fc3f7
SHA51204066c85dd136d95fe747c356e10ddc0e4cd34254401b486a9d508963ec375eecfad519557f8ab58876b4d13976f91086444200df280938c4d4e47ca0ab413ec
-
Filesize
5.9MB
MD5a7a12d0c518d726c572f5bf52ad21e74
SHA1ffb95b47a86eb0ce8599a0e95cf99ca44131c5dc
SHA256d7e40b5deff04683adf23058d6482b95372ef0bc5112bdc3eaa9f5a2ca5f65ec
SHA5126839ff6336480064ee7d70456a7a89ef141cc661f6c232d67cf9616f5529fd74dcc27659b0b61866c58423a36bbff71c1877e650e0ad0209a7e8a29d77bf3067
-
Filesize
5.9MB
MD57090563fc6ebe86b1affabe5f1d8b552
SHA15af78aefa71ad2b85af1dff218b9608f39d02b6d
SHA256228b3e5ab806c8041f829d704abe6e269cb814b128e070369d90fb90390abdf2
SHA512e7198675a06db25f32d439af6999fb34f1c4e1888f6d064e92e096eb520077b18c2aa9d2a964eadf4cc157cc56830e36766b1ae03eba5e61282217faea087516
-
Filesize
5.9MB
MD51665e69f09218a04ad1194f83d55131d
SHA177259e1b81c9b1fff7b93aeeb49f96e2994bd9c8
SHA25632ea79aa1e6441f113f2961c2387dce45c6273fafa0882323a551efb7520daa3
SHA5122af4eb84213d68e8eb98ddc846553dd4c3b810acdb278f0efa645a5d69d2fe5d097ae91101f91c049ccb33e3a2a1b2a6bc4705c6a14472605b597d4d59262a27
-
Filesize
5.9MB
MD588a52646e2207296d40bedc5e2ceba3c
SHA14ee41f91c5b00cb0c68296bcb2ff9260718ad129
SHA256c5b8279884a301e47c5b282299c1bebbbc1438bab9e5ffe454c791edb8c0ced2
SHA512edfd755bbc4ba0c4e7155ee99ca0defad3b37262fcb45d466e59f0f5f685288d78bfa49af587159a79a0f1e3056ac8fc5e825375adb280d5819b5a823a54cd8b
-
Filesize
5.9MB
MD5cc17488fb4eeacf4958c32fb4bc689d5
SHA1fa2cd7effd41e80c8dc2af52cff6a5beec5c52dc
SHA256b87210a472a231a39c4aea2d525d23ea3302591933eaf79d11a6f2afbf0aab4d
SHA5120864289fbe543b016f6c8d9926bf6dd0bae7aefec73f977c242a8f1211b690a2a94a51e21fbcb87426cecffae127a154372985cd9a255f865c4bdd228f0801c8
-
Filesize
5.9MB
MD5cb98e6e0b68ee3065e737f66ea82be3f
SHA1481fb1cc309d8caaa3c60bd8ef0a2190631c0d48
SHA25629d98e86339e689d4ab1f349ce281c65b380df6179c3b42546cf75cd1d72347d
SHA512919003091ccce24a6b1178033396e776939514649b1b7810762ab6468556262603ec8eb92652cec83c27c12a7746e1ba47a9e15d9dca38547e30a1c4343776d2
-
Filesize
5.9MB
MD59ad5b890c950d56ea9471d86e69b0243
SHA11abc211cc1bca337e6410bc3aa06b25198f43ec7
SHA25602430cd5cc294979b8746d22b55a4347f68ca31c934f4ccbb90f49d197418619
SHA5125adeb060d287784094a8564ff7ba33a76196d739faeb462f5e3b790dd515a8859e656c3ca87e2dc4760372652e84b05dc3999dce835b4e89f759e2aac6bbd61a
-
Filesize
5.9MB
MD523999518a3219d1460fda951ed1c43ea
SHA1aca26e0b1e382fa3721254abb6ea566d37d6fd2e
SHA256d74e2ba70349998b035a5716d87810bdab38fcf886222787c220585141e47cda
SHA5121869bb1d1a690155bfcf436acb19ba718b8f43f269a67a22ca933dd0185437aa4aeb93fbe6129527ac347b913fdca888ae8488121184036164b1ca7ffb9e8e66
-
Filesize
5.9MB
MD5ca3a97802f7c478d07a69c912122f449
SHA1e46b0192dd36635f1229b63d5623889a3620351c
SHA256fba9be1372bd15d412cf1f13c8430e769af2bf3bf89e1d98c3a00adcda7bdbdd
SHA512684dfc05918ae1ed2abdd93de0c4dfac2aaac80910ff1265f1d13c79a0ad7dc4c1755b78e856f3f9fece609cc411113ef57f87fe8ead969e777e3f5e79d2f123
-
Filesize
5.9MB
MD5b36ecd36536caccd03fdda002b8f5e4a
SHA17d0e5c10409ee32b7fa800658f175d3c1e502d30
SHA2561da6b071eeb1189bd6f84e0b4b716fe75e293edd66bf4601e47257501690cc87
SHA512191b3576ed13f3ffdd6adb03dfefde8ecaf8866e0a92000622d9128b45e3dba814f1870e557be9de4b382812a50070b1c2cf6e93b3ec7115962de58fa0988eb1
-
Filesize
5.9MB
MD5e426f889793db751db1171c44f46b921
SHA141f50f3e790c01048099a1cf6871638f7acfddc8
SHA256fec57e10937f7320b989cb10d580e1ec5091d26dad864e0fed777429ad1c5840
SHA5123ac7979256a9abb26eaa231f0292f878b16f855eba707944e8244694d956af12ae300e6e0dd36800371e1b6e5a2276d85897da84f8cc64b81fc743689f6ef7f1
-
Filesize
5.9MB
MD5a5d65c11cf6f2de7d848908b8a832ede
SHA16914636edd2a1ff2d901384c0bd6eeccf733da88
SHA2568e71b406a9252e5a31d83368705154727ba7418f60ca27dfdb97aecb01417cc0
SHA512883b608fd62d934fed9b8029d073e8c67e9377ae48b253dac00f08c634b4eaf635177015262850e0dfc355bd0084c0885a7248b79b7c5089dcb7d5cec1043346
-
Filesize
5.9MB
MD58fd58cb59cdb4bbb05ca890f8603b757
SHA12d7636f2ae8c6c7ee3a406a52a4da2a63adb81d7
SHA2562a43dec4b24d80006a8df913825d332df7d6d57d19e01e629a71e9b828849ba7
SHA5122941511a268a4698de71c2bff94f7c9802395ea77021fce210316f2007547afd1bbb0391f9db68e461d1bad69a59f34b767c5c8427e9d6d76e129e5a9bb83592
-
Filesize
5.9MB
MD59d8a03921caa06b9f1c4a79bd75ddab8
SHA1e03ec0499c4bdef2ed0b7ee58dbd0e0605c961d7
SHA256d8f34e157017778fbb1d2e3f9b55cfc4dddabe3c872d172110cce686fe2c3651
SHA512cd5940bad1536ea0fb8bc10cf3177393737ddc51983741ada81655f77c5e1e25e1d986cbfcdf3282ef284ce5ceacda994a2a645776430069e0b1da3dea28b24e
-
Filesize
5.9MB
MD51af8cc8060364e19c101388a47ef5cdd
SHA1abf864f386624e98f3e523cc983e6ba548026a24
SHA256ef42244f2f2927fb27210da9a59e785fc384d73c5ea8f394116cfea495a68f41
SHA512eb3a406294155fd5a221a6094d5f8f3d1e54ac019fd1a85c092649019e7a32cd204db502ad66e3bc33844a4307a86aead2a5e558f51f9d59dbf53e3155487c94
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB