Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 12:15
General
-
Target
2024-09-14_4fb53bf9172786f06fd13971bbbf3e80_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4fb53bf9172786f06fd13971bbbf3e80
-
SHA1
c7c2a49e473b7f365389e00b7ffefa6c0fc2b66a
-
SHA256
71a347e7d06668540a220cfc058a0f3a16013e8001f50fa649675674f978fd95
-
SHA512
2629093fd0a503142e2697754d6cf67383f02a1d1df04abf181e09c3ec2c99dbcd8f2cd3472658f0f5b962e56570f97eaf59885e6a67e8d3ad1889c45c3ea8f7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_4fb53bf9172786f06fd13971bbbf3e80_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_4fb53bf9172786f06fd13971bbbf3e80_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bpkLUbm.exeC:\Windows\System\bpkLUbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwknmZv.exeC:\Windows\System\gwknmZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbOxAsw.exeC:\Windows\System\bbOxAsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaNoKZJ.exeC:\Windows\System\iaNoKZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tYwJJKV.exeC:\Windows\System\tYwJJKV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bybmxOW.exeC:\Windows\System\bybmxOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHPGbgT.exeC:\Windows\System\IHPGbgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FSYSiVQ.exeC:\Windows\System\FSYSiVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zBPNlaB.exeC:\Windows\System\zBPNlaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbkbgYm.exeC:\Windows\System\AbkbgYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpTFDud.exeC:\Windows\System\GpTFDud.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsDXbFa.exeC:\Windows\System\hsDXbFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oopZNGj.exeC:\Windows\System\oopZNGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsfNKID.exeC:\Windows\System\jsfNKID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UKNxUwb.exeC:\Windows\System\UKNxUwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WLTEkyd.exeC:\Windows\System\WLTEkyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWPkpMJ.exeC:\Windows\System\uWPkpMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fYraYxW.exeC:\Windows\System\fYraYxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CvVWUlY.exeC:\Windows\System\CvVWUlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnPwLzc.exeC:\Windows\System\KnPwLzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AflWzCM.exeC:\Windows\System\AflWzCM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5995971628da282cc17229e89ba4146dd
SHA18723903cec0f9d9bf3b10bef795de3d34fde4a07
SHA2560d0cd82a0c74ce49a0e32a6b647cd5675c69bdf4d421d1656d60e472b6e56e04
SHA5127d6172b2fb09afc04374bd44c4d7d116575544611f5ad23b9a3d191ee3e07b81f3a8a7419a18cb43065169212ed18ae8bc48e793412c8b4133d3a660f21d4a49
-
Filesize
5.2MB
MD5f9ffa5817a2084026a3dd25163de781f
SHA1af5f42cfbc866f2d553fc91f137a11cfb4a5e0bc
SHA256f46727c3664b882e40e18386e192c01c18fc5a57d9ecae1e1af455b74fe56809
SHA512234a85ca1e70963091e8f08379d158afd0b585d93d33ecc13fdcf4dd86f1cffb7855b05c1be551015450f145ecd8a544a15906460b1df89ed0bdf40d9060fc4c
-
Filesize
5.2MB
MD576d8ede9656dcdcda153df19504d05f6
SHA115455c40cd3eadb099e2e5f6b3a7cef146272c21
SHA25687164ab88c7d0e6b639bd11c689d3ca6f71556701f18723673df0108305cf4b5
SHA5128065571ce0ec2e80ad94b2b64227eea72aca2866f8d424cbd16f481057ce3f5399690a8241689144c97d71440e4b4d9c688b54e93e65241856d336dbcf2760be
-
Filesize
5.2MB
MD56985faee962ffa9eac39d6c79faf518a
SHA1213734e365da99e8935fb17d2a92b2dd3fd2972d
SHA2561a040c51a7f859567435867474f8055396494cfd91593b62f41d3bceffcfec85
SHA5122c5f05bac43318d32a93a52555f760f63097dde4ab6460c5c7c80937071d12da69f37ff4abea2697324b60711f01848790af4b8f5ac2d76e74ae2d565b9d8b23
-
Filesize
5.2MB
MD554d9d0c2afaa679f708935ab74d71a60
SHA1926b7f4b955cd40c381e02e747c130c6bca6cb89
SHA25698a0391580d6fffe53389e2358d52129a05cfe78509e1b8fb817c474913a4fcf
SHA512ad20889fd767cc2da7846fef1aed7a5398fe5980b91989a84c6513cf940c239670f1476af57ca9794f7a2b036ecf2a1de281cdb299c70236ec58daabaf1d3030
-
Filesize
5.2MB
MD5ede24784608eb4672f00dca796305514
SHA1ebd35130c999047bd9417e017f52126665b9aa8d
SHA256014bbb3e2d73d42985941937d8e8f2fd561e5adbcb90b20d3e1650a662f9c1a3
SHA512a53842ced3357a1ee3903816e561f73c497ba194320bd2c858ae3e97244d6fbf38ae0a9165c87cb4b8526c3563c89f373b1b41d76c15f568d850c39371300d70
-
Filesize
5.2MB
MD577e0a8d8a0afda833c7807f68808eb0c
SHA12c4fd71301c6162cde196806f5b21dcba0678d41
SHA256269d4c077f23f31d1661e673b8d0d50c4f2c10123896b157c62b50398b80f17c
SHA51268c25e97b964105d56b404d9b9dfe5c8d98ff06891f44cda78887cae7c77b7edd7d3dd72ebb8370bd873d1ec70c44b865ee6d85ffeca6393e1d593e20a440408
-
Filesize
5.2MB
MD5309ad780391aed3cd7e01dc7930e8e0f
SHA1f467a1610295f3a001ce431e722058b855f962de
SHA256355c85fcbb9ce4adeffbda9f2c33271003e26a10d94762dc3999796d53b9018a
SHA512e443c407f3c7b69573c8fffc569a71f874564ea9ef0295c06bf26f92335edbd7c73cefc1e7472f841fb6c5055e5e2a0181c1656c2e1fd64b3958b67a43d8a2e1
-
Filesize
5.2MB
MD5508f47229367babb3c165c11dfaf67be
SHA13624748b5237f6e8b2097bd4888a0d9e1456f870
SHA256dc1eb90c9dcce0986237ca88d3f4b5a06dfb5ecb660b33ac288cf0bfe2e347aa
SHA512e47d7b48657d6d30fa0bf9cab0a7fded56b56f173e17c91f2df4a3e191aba886cf797f0d3510e98596d7dbfd91852da9494016d5c9415ae1254a29a63e777394
-
Filesize
5.2MB
MD5d47211d6bfc6c6b43e2814566f1cdcc7
SHA13aadaf11c3da85c125e17ceffa3b3cc83e3cbcab
SHA256705323e5ec46c38605a49a41411036aeefe4cd27d8dc5073a950fe5f0c098fb3
SHA512c5e7f2901865f19eacfcb190e85158bd4c7e8d2b6db7bc507e700244f2446ca3d21d62144ad152ca77594555c373b48c5612f49e55d039c81be4355db3adf443
-
Filesize
5.2MB
MD52334a0d57cf494be8e5091906a016ec9
SHA1a141869b5cdb06c5af95847616a522e2050a7ee8
SHA25639c907a379687a33e2519f649c7bb2aabd4dc208905e0d5ee6c7d81b0fc035f1
SHA5121a195e403eef486e1f14e9dc6280d859dc448439b714244eac33621423b332999469ed5b06286d64fb4131bc3d728ecd9453a19944d3e55b870de549e01e94af
-
Filesize
5.2MB
MD5fba9904e0ea3e5cc50b227b758f6343c
SHA1d8dd52025ab615f1b9d1ce94d10f3f617c02c40d
SHA256a4702cdf0a9586f78023e116947ea4186828b820776c8aafd7c4ecb8f7cd09e6
SHA5121779367dc420f11e510343b0564d1cf1cd93598d2d912bac2b7b02c2c8d6619b39793d3f0f4236e17474cbc27dabf5f1e5e89f264b0a616bfba3b50bb6e4ecac
-
Filesize
5.2MB
MD54e52843ed795af5d58657b663b29b58e
SHA137491bdc899f72caceefbcebccd610144563dc7f
SHA256a69523c01ce8afc5c04b8cc6f5947cb404f1d18ff4926ab08b57410d92f58da3
SHA512f85c12a6e4ba206c3510d7b672b37d8dbe1ff1f7951d726c9c8283047b910b2f41cedefbdb2468061e20f471bb1ceaf02321dda25ce9a1ab2c7ad16085b4c09d
-
Filesize
5.2MB
MD543d160355a612a8951355850abf491bb
SHA1ceb9249e783968e5bc051de4c273a3ffc0bb1dfe
SHA2567a4516b4d2ababbbc16addd05a80dbeb740249b6f3de0909878974303a4efeb5
SHA51225157906654ebee0ddd69a7193e25b85faf096f1c5aa743f0daf44077c678b75159a8a9ba2892dcb8b7b73ae215b5673ffbe2bcc4611ebf6ce6983b2c8e90596
-
Filesize
5.2MB
MD5b7dfa8d9083132eaef53972d06b97c07
SHA1a5362b0425583738b815b1f63968d62a045c1d57
SHA2562fca0274634be81f54d6d67e5938b22ffba16b0beb3bbcbdb2516f8c59bd2e7f
SHA512d2cab738c81c789b0b0d4b548cfb639c48d18ee366a92639a5a743a5600852967a240f3ad3d4ee3975e1df8388fdbba26c590dfc309ac74ec08a550fcde0ed86
-
Filesize
5.2MB
MD5235e184ed22b3cbbf1177a048f91e972
SHA19e8f241da2a18a67e6d5757f856a343fb7f6a3cb
SHA256a138af9c6833e12caded7da5b679c907b197eeb3a325f3524e9457802597c2fe
SHA51232e234707b2c6e85b79e733c490e12dabbd8c152dd3d0b323859f8caa93d65f89e2e2a705f242688e7dbfb251a0a43e45106102f312d2be18dafc8b3094cc2b3
-
Filesize
5.2MB
MD5e750136ecd22ad812326dbeb9d37bdb6
SHA1964df49d1413c1e40f6455d0a4e2017a96f313a4
SHA256abb2a5d75c7539a51ba03b0eab9cf2acff9cf7aaf51c19018958408049b33735
SHA5127de18333a9c7cd9bb97984a69ad1f5eaef6afbccdab2a36781358b08f0916188f980332aced8ca947973f4e497834c678d76704b6499eb4962b3f8027d4894ed
-
Filesize
5.2MB
MD558a45be52b76a3d693956334d04b23d7
SHA1fcad0c86d4e8b844fd8cf6065467c3e2f9088e43
SHA256fff52a1da0dde3e7eb2061fda159286a71e3e0a19b33878261233d469082e7ee
SHA51258fa5ff226a7e388928c8400cbf1f52265620a8ca3c84640fe34e5d505e3982ab89087092412d5565f19eabc81442af3ecd2d8defec1fe6a9da928d19fc1bb02
-
Filesize
5.2MB
MD5543648cf888bbe2a861027e6fdb0b246
SHA117ed9854fff70826ed27aaa74229e2726bc6ac6d
SHA2565b2ed793ab1355216bed162883ca69e8a718b8e951bd822e00b0f6812b231b38
SHA5127fe8bb7c6ce0e4acfe579ff79490c28c01feda81b1de50ee2fd2b38c145d8354e7f1d4d1fa9fc8274df70c89c3f7a0fed2da8b64fd16d2fd372398420f6c1065
-
Filesize
5.2MB
MD54f23744ae3a7abe5293b962ba4ff5bd6
SHA10f9c0072b27e1f654a053b11b1b3eebe0353c1cd
SHA256a8875df25d4419f8f473d0d546faadd96339b22e99fe7aaf2133a7de46f4ffea
SHA51229d1a2a7907eb08bb63c617254ea63705a97b3b5ca1cbb5ffd7ce2902e3d48d844bce34199b5296b3ce5e1c33d33ac37601d9c54e9ebaa635ed17000016bc629
-
Filesize
5.2MB
MD546a0f795bdb2c9e5bd21dd6321a832e5
SHA1fbe730de610bf85bfffffb0e4b25be780be323cf
SHA256a016ea08a74e11a2aa279298cee850e7ae5c607c0e3e06ee37db63df9ee86b70
SHA51262331ed2cc3254acaaa2f43d31ca7eb706b471d4e532b04fc98e3b1a0d00520929eb4b03badf9610da548f7a41bf4622b2c3e0dd2c6d012d8296450d953ef600
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB