Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 12:04
General
-
Target
2024-09-14_0b7fa775d690756e95f59dc09444e521_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0b7fa775d690756e95f59dc09444e521
-
SHA1
8250fd3fe1cf79bf12830e11bbb2d5f6f1b94e11
-
SHA256
2c23c98ac83c66ea7ad7c2ce191c37026c2f7c6ce0880045a964db7be2856bbe
-
SHA512
5b07bcb2a20a4ff19c84ea816717c5c882d697bff07683c104140049cd10238a60f2da46180f02b67e9f5abcf0dc00cdf1e5256c6f8bf0dc502a5d930b3168ef
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_0b7fa775d690756e95f59dc09444e521_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_0b7fa775d690756e95f59dc09444e521_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NQGDatJ.exeC:\Windows\System\NQGDatJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHqNWtr.exeC:\Windows\System\BHqNWtr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iySEtuW.exeC:\Windows\System\iySEtuW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqhoaWO.exeC:\Windows\System\KqhoaWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fbujstA.exeC:\Windows\System\fbujstA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvqhXSy.exeC:\Windows\System\qvqhXSy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blUBnqf.exeC:\Windows\System\blUBnqf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFmDBhp.exeC:\Windows\System\jFmDBhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IeuSZDS.exeC:\Windows\System\IeuSZDS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BccfVde.exeC:\Windows\System\BccfVde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYbVRSz.exeC:\Windows\System\IYbVRSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\azJeOLm.exeC:\Windows\System\azJeOLm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhTApBq.exeC:\Windows\System\hhTApBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vNYqotg.exeC:\Windows\System\vNYqotg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwacXVX.exeC:\Windows\System\dwacXVX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MpIUbPE.exeC:\Windows\System\MpIUbPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cvWCLdq.exeC:\Windows\System\cvWCLdq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NQIeJIf.exeC:\Windows\System\NQIeJIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EFXUVzv.exeC:\Windows\System\EFXUVzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRqUvjJ.exeC:\Windows\System\oRqUvjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAhbvvK.exeC:\Windows\System\HAhbvvK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57e85bc98e7cf6fabe55ce9f881db42d3
SHA1d64bde3ba83e5c6fc16a2323a0e2232e97d12e18
SHA256c682337ca6e6e55b7c98c7df8495c45d3b39d0209854a2abb2edfc114d4d89f9
SHA512301db612e6813dede668bbed30ccd9f5c73e2f19f9024b5b407d349f939b76d0a1cf1c07820d70a6a67cb926fa0b6b14b4290fa84a4444bfdce6386063b2cbef
-
Filesize
5.2MB
MD589cf62731d8a8977a0e21c96b04f86ea
SHA1b028ed498da9de5e1078193e3e378979f1ecb26d
SHA256fb9a8eea5304906270cc952739804d7b672cce6f8738fb2dde9ce787d188b870
SHA512a96936edaf382bef685433dc8eab7369d2b383f42882b57625e1612c1f08171d52f72222d44b270a2462bcebc06bbe646bb68cd5d377162eccf32497cc9fdc47
-
Filesize
5.2MB
MD587b02ffaf469c81fc6f395e57c5aab04
SHA1e185f1392382b1713ea669a9a8021de272aa8121
SHA2563688d03581636afbbeea8bc2c6796cd6b9f037cdb24126c2384f6440d57e1b10
SHA51267543c1759258dc7bab98a87a0ae079d95bd818f920afb27242e514cc37a6231e37c629f2e9b42c351b350bd35dfad8411cbbbf0441b6351b9e877479a09e647
-
Filesize
5.2MB
MD52dffa3b71e16fc49cccbcd0bb0635ed0
SHA1b181b959cf14928ee1a5b50baca4ca99a0b24d50
SHA256ad360e75f6f6f0eae809e6887202c123f6fda21923e09ca841f6b8b79ba6a58f
SHA5126567c5c1d4c42642e4a3a39156d821ee6aec98b5c270d42103622a597d774b80d12a4ddf2e7d16af7855f0a9e34d981fe6af432ff7793830040c2c330ca761ca
-
Filesize
5.2MB
MD594a7b4f57c186d24fbc0964198151be9
SHA1fac4cbc322a29c8e3f3a2fdfc24b469816825b1c
SHA25631dd5ce1002227a7d47ef3232fda069f10125637bf32cc86c6d3a29ae6d6d921
SHA5129c645617e4a1df7ef40dcf5f5809d843dc84d9eaade16aa155306fdba8edeec46a99379a291428570b0eadf014156f1e2137e9721eae473a33fd11b0189ed3bd
-
Filesize
5.2MB
MD50389abcea7c2f11273efbd82eb769ff0
SHA188a8065b5ef24cacdeac41edc9c0cb6fc99eb1ce
SHA2565dafa57254f3c3e94d8dc30b2a1c3e7912684a97fe70b982173702c840bc20a3
SHA512cc24f90eaad411f01331ad5b3ab14ed19960028987e8c2e106671f2ef7a9f83bf43f4a3c4144e840f0b717e9df68deca1067c742261cc1ccec51686f0f57c859
-
Filesize
5.2MB
MD5d6271314b19d21a9650f02efd7963406
SHA1ad287b5ac55a9bf5f040f3512bd63479851a7e87
SHA25697e88566a26274d81f42fee349fcc3a3e382e753b104d6c6d4a7a51d503fd9fe
SHA512d648b11e68b665187a4b9267c5a4480fbfd08100ab777e3885614566ab6b618a960635fd7488b6c319714b6a5ca9733715ae0016f0f1d94e3be59e6758879d84
-
Filesize
5.2MB
MD5ab8d50870d3b9d91f21e65d11baed544
SHA124023d560610d6d91e9edc9ff6d27fcc4c908bac
SHA2561ee4827e43830e9490b0f02c6cb696080d4518d53df4cd884a889636658061d0
SHA5124396613012b77adedb485c9d62a7203e90feae5b1b3bb69ced5f8c72af4a8b4a0553afa19e6be3c366fec0f35899cb6d2f27696ab1dc0c0a24f08bbcd53c45c4
-
Filesize
5.2MB
MD58d5e8d6ed39a47987f2c23d6f5f5d6c5
SHA1c1a8e776a21fc98b7ce91ce916391b75f221273a
SHA256471943a4c5e42c7be758b6db0511d6af1e2adad583f0c264b10bb5e92c4adf2b
SHA5121001852d690e4c94403feed1a3e7d6facdb208100ce8ba9d5a7bad46a9b9be25938a9fd3987d0a4dbfac24a26a1402eb3afcffd9dce2c3c8e15e29e57be3e13d
-
Filesize
5.2MB
MD5f7ce9e01bd374014c0ec5e6f452a1bde
SHA1111a99298a0570dd5b3f72be954581b3869c8c91
SHA25669bb4e51626059bbf8fd6e71e10ae3b43210473825c55e3cfdb2b286a7da4b31
SHA51216c1d8678e8f6d1a651f8b71d8471c94e56282e3189cd8e7913b5b0cf2bd26c09db39d25afd8f20b4c8d2ba7c5dc72d7ea83c9504d6201a3b6474c3ffac79118
-
Filesize
5.2MB
MD5bd566f2b8c3e2a797272de1208856c66
SHA12c702728a811ac98408be2a418c6a81ab317e88a
SHA256d3921c06171b6cbd3fa98138ff904418f8e0c408e61ce013266d0239709666cf
SHA512c06c3d0ebac0026dc18be48b8c845d5874b55231f77b15241e8e185a56b316eed60d05b487a7e2c4e553c5d3a3b74925ad5c79a49b601e80b9fee3ec2757a2a4
-
Filesize
5.2MB
MD571dae1ca306ef729e4df316e45915a1e
SHA15e11016c5144f05baacab95f06c1456299c35a8f
SHA2560e3485e3621edae6fc3761b704f096393db8f30925e9912b4e6341df97719a24
SHA51202b07d15729eed09b4b46c8c06893a7e18ea3388cf2ad53e2744725fdc3b69a66be4e740d1e5a089ef2224945d9b1d6fb8effd62e3d5695818b093d3ef9ca5ea
-
Filesize
5.2MB
MD58343c7b8698f9a24c2d5dfa3b0d4a741
SHA13776a7d2383ef1fed969c35fb574dcf439d16b3f
SHA256e18830d870e6a0e4a9359e6fd06e7254f6ab8c23ab82c5d46962ca2880b562e4
SHA512d6e67abef93734fc927de4e83843924abafcae763007b23dbeb785068864d185cb201db8116e2bd8fc396e099f568bcbea5e4d85fc625af461a234b2b31cb24f
-
Filesize
5.2MB
MD59ac1ccb77e997014fe503e0fa503b95b
SHA16590dcc5f249d62eb9b3d7aa7327b5c26ada0c78
SHA2561abcdeabce8e896d5ad85f4dab2faba1dfe4f569512640d71ee9d72f6f9a6ac3
SHA51218557a9494d0b9157fa5a36fb2d23bffcb171236935b2c18b113fe8cb68074d00531a51cf76fc7be0a285d74869dae0087a69593dadf245b1120b0ddbc25a610
-
Filesize
5.2MB
MD5bb366a6a7438602f4c1042b35058f580
SHA1bb014a31e4c9392d960c71736cdc4718911c8f06
SHA256b7a600fa97b945e7954b30dd9e90104f3b512887d260bd31352a56c7c0d105f5
SHA512b14440fc486d9f46e1e54226eae109a41e5ac64859a79c751b9dc39000fc2a558c333f686769aae3c82dca0fc18347d4589567c3257d5d300c5e7c7f8df9c04a
-
Filesize
5.2MB
MD5ff01e7498fdb028081b0563e712a40d0
SHA1ff892fa1c6cfc80502b03a8f6aabd5c7b07d246b
SHA256b072c358d226767deef49ee4ea642cb3a43e34169b3716bb1fee15e1e1b322eb
SHA512e789ca1da2f9121fef1e6c9710fed1aab6c610c3b01de75ed9056c899e14e7ee2bbd2ac5a9b5c9caa3ea7f6c50f1344d355885406493bfb8e9ae09991eff4a07
-
Filesize
5.2MB
MD5d5e20d87b31ef4b5ac5e7d68c3294841
SHA1c02595d89052b95ef2976acacbecb49e05f0cf1e
SHA2568cdaa0657ad33c0829232b877690f29ad1112268de2fb57cc7320210dede88c4
SHA5124492a16cc910e7a2c091512afea4fe8ec4520a9f349619fe8d46a35fa50e3a192d2a14a35c8dda9d91ec7fa34a5074df8bc4d29a61e02a9d82ae109643fa5e99
-
Filesize
5.2MB
MD50161c03fde3aec449a6a221f1d0cecfe
SHA16e7eaa30c6a038ec110a5e19e3a699f8dff485b8
SHA2564e6ea31da5d2d5d2db07af80fad9a4516656cef376114bec484cb53d99910695
SHA512e138addb49a414a2749bead2cbd524323572e592dbecc9e588f65b74ca9a41c539333e2a686037928efdec5462391011742d0b253e8f663d593f380c914e815c
-
Filesize
5.2MB
MD51c75a3106eb9138368dc09023ad69fb5
SHA10fa272bd1e1b7a9b97af3c9fe10f019fe720833e
SHA2560b830233c6d306554dec9a4ad593dfed3d6508fe7ac45393cae0d852d113e12c
SHA51263af188994078ecbc64df31a3a653714ce37f1203b9750ae686876b4fb0b2fd992897f31a00ae3f2457cd35792645303a3718f6d3cbf45588b2bbbc18d7312c2
-
Filesize
5.2MB
MD510d17e1ddfa933b9642d632bf06a58d1
SHA174396487ddf70619932ba66560de78a7104d1055
SHA2568b092bc1f60f6965d22b5465410ca59eb7667d9c0737cb82531664a028c514fd
SHA512379e4f5e9bf69e226dab233ef70fd532ea290fe063a70c7be95f2006f3400b8ea5fd67138b35a7fd8fb8c63b8fee5e6403b01762c0041507d156c453625c78f1
-
Filesize
5.2MB
MD5e2881e883d210c7afa223befa62460a2
SHA1b61d9cb9243ecd27b9ecb98d1a0aba4b07baa9b0
SHA256c5620212fdae16ad1f9cc6e8bd08626fcb242693b994ee6847cba1955964b674
SHA512b8a5a0056c1b1d01006724b885e57f5e7149c27421151876044605f0b801e30f9b8f1ade9331ba297b9dbdb982abb95ead553dd71636cef78aea95ef2c0b6393
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB