Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 13:03
General
-
Target
2024-09-14_2591861871754df5b90ab3160c479b5c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2591861871754df5b90ab3160c479b5c
-
SHA1
1e1db059283f4173612b8b38c24978807ba3f88d
-
SHA256
d407236d347bf9f3081d0c497f6f8c4315ab52f26fff1ca84bc897d3cc6fe649
-
SHA512
e2e1c73da5cfeb4f49f4580cfe49a96718d765738e1522cb5c59b3fdcfbc4588730fbbef61928e952b73e99158ad90f5a79583e4b5804c38d57ffe3be1c5cfef
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_2591861871754df5b90ab3160c479b5c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_2591861871754df5b90ab3160c479b5c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uROeEnk.exeC:\Windows\System\uROeEnk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tyZSgnF.exeC:\Windows\System\tyZSgnF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AmoThHc.exeC:\Windows\System\AmoThHc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QTzeJWf.exeC:\Windows\System\QTzeJWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sjeUmtU.exeC:\Windows\System\sjeUmtU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mHJPvcT.exeC:\Windows\System\mHJPvcT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhGmrtT.exeC:\Windows\System\mhGmrtT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIqCyOO.exeC:\Windows\System\OIqCyOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZraLZyX.exeC:\Windows\System\ZraLZyX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KcUOWvH.exeC:\Windows\System\KcUOWvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwoyYPW.exeC:\Windows\System\vwoyYPW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vLKvTft.exeC:\Windows\System\vLKvTft.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvSTlnv.exeC:\Windows\System\jvSTlnv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aVHmNiF.exeC:\Windows\System\aVHmNiF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KxLcFiv.exeC:\Windows\System\KxLcFiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iEWixWR.exeC:\Windows\System\iEWixWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDLAOxO.exeC:\Windows\System\TDLAOxO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LPpTWqo.exeC:\Windows\System\LPpTWqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqDcpCK.exeC:\Windows\System\YqDcpCK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tRVZMET.exeC:\Windows\System\tRVZMET.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MwrvDOl.exeC:\Windows\System\MwrvDOl.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57dfa85f88e3d6ff00a859d94039faa2e
SHA17ef0b11e7b8ccb21d003b695fce4ac62e4597aa3
SHA256fa250c14c96f0596bbca94602f6636a116c6a9d1d2d3d736247b8fb7aa2f7f33
SHA512f7839d4fd2d114262a557cb85e12fdebf36535fde8aa2f66c7161d1906bd94e49248b05c75f0b682077da126ff1467343ee1ce27ca0a897c356cfa0cc5fbd8fb
-
Filesize
5.2MB
MD5d9ce00ba3a8d11a04e8846a79d548870
SHA12232aa99daf13e36deefa6a9d0e32fe1a6cf5bd2
SHA2560ff5657fe75cb881c3cc0359e3eec4a732f5623921db98bfa2708b417be4a87e
SHA5122aae2c9e9b64ab1fef8718f8dfb8b7aeeac975877cbcb04c6e7e2fb089be71b0ebe0a839bef9d17b6a1aacea1fb71b5498685299e418f4f57ccc5c3726ceb19c
-
Filesize
5.2MB
MD5b634e37fca93fe1131441153c6dea359
SHA1b6a56ca361ae206b3eefcef3ad32d78ca36e4c6f
SHA256c149d71410fc418bb8b7b14be634601954c88984d7a43132c4989ca981c943ba
SHA5127e394e48941f9a3ece472ce8a328886c2ad3708b9a4fb61d8a508615d71325659699cd7f11c4e2d8c934c24509c9c767d10327bc38e2136a639a0b55a2d2c502
-
Filesize
5.2MB
MD5c0dde4c6909dc514e8db68f2eda6af04
SHA14dc5b21654d42f42b83a6b21280eac1829df28e8
SHA25647624df5c7de53e7e681d0e05350292aaec81fae7210eb63c21968ec4177a1c8
SHA5120c34c12ec980153c4a924b8d2c3823588d9d5b858d5ed240e435f0c39548aae0ca47e98970caa358ef011c27bead00bbdf1a821e005443c71d78303468f5ba5c
-
Filesize
5.2MB
MD504719389bac8174edcc0f1a98b775d0b
SHA13d8d84f2f2d658501a13518f86c83b3fff8fc3dc
SHA2569c30422689eb9668afba2595a0e280f625098753f8a6e013a87d47fc8841c554
SHA512f58242b01992b5c7747dbc08a424467a7f7c35e7e7eb125508a9d7ac52bfb7a78432b7cce61b6075d47da67f7c134b93cddb13f7f99c363f0b2de385ca9c0b25
-
Filesize
5.2MB
MD5fb32c1d6e82f9537a2414e87fce8b266
SHA1a42d6ef7ca7e2dad9df55016182d911c8b40fb95
SHA256f147fac5f998697f392789c10a2786970b9f03e524ab392fca5f976780854f0a
SHA512f90170878344cfd803889497ee55f913bb65204adf66b055c32d48d0e1a9ed88cf6442e5018f5e77e17c6be4b0963d9a7798a4ff5d307c53b2c087bd15ab19b1
-
Filesize
5.2MB
MD5ad0df6a751a4492222e17dd05860c806
SHA12c8b2b60b0d5ba8de0cbc71e89d01197130f1df1
SHA256f5dc7a4c0c4ec6ef05cc954d4acf88f25073243ceee7ba854066cfd9e9f3a785
SHA512cbc877b5e4d39d4bacb503e4a02b767c55046048602261a36e506b5cec32640948eb32957fd5de879c8f93ae56cd5b94bb16a8a5f2e638bc68a5bae11a84a6a5
-
Filesize
5.2MB
MD5937241573fb8e2c926c7ebdc4f43d0dc
SHA1ec4bb1e5ff798aaa5e8eb7cb04df383971394522
SHA2564fe3b3f87e285c1bb18e1d91a35d9d0228f06df55b86a4e5a781a58c128eec28
SHA51277ff3105cb125d270b7258d5a8213fe0ca3b6101b90f8978bc4effd09f2a0e92306f43eddc164224c2c9dc150cd770c747bc1e82029e9119c9cb8f1d5e611b2a
-
Filesize
5.2MB
MD5cf650eeaf5c39900180a5c422b345ff0
SHA1051c11d60fee4a308602eafa193d16572b47c145
SHA25688d65154e2f7542a3b5fb66d0e9e78d2ddf547e73adb5c37f91cf119fc9de860
SHA5127d362113cabdc73b04db59fc7ca6290554045206f41b87996b53665941b6d8281e575591a90ac97974b27abcf96cd8c815b6323a4b33231d22ec87042ea8c049
-
Filesize
5.2MB
MD59694013f973374753c793c346ab5215e
SHA1a4a7169aee01f4240477e9bc99ff130172a3d626
SHA25679c81a06e606cf3e5c36169a0df87cc7b1350d9dc60f4c4bc1ed5c528be05e43
SHA512484f5fda06902be2d9314d317e7510190713d2a87063a0c4fc43a90d6252f0d190b460987634a5b899e4416048f4c9edf5ba3110eb4a11bd23388e854173a69f
-
Filesize
5.2MB
MD5b6a6e1eef5216f2646c17f4abbb4cc84
SHA1b267685280a953f6afe5968fbaf15a0706750e1c
SHA256f5d5db812392f669a1389fccb9aebcea03ffab50077663c0fda53a89aed31782
SHA5125c6f38646a6ca51ddff923eeb700366a5872b4993e620f2a3c24a5ec4712a16c44a87f91db656fa58e249e00c4e128463a29e315d54273c651f6291675cbbab9
-
Filesize
5.2MB
MD57102d5a347d2d6f6904963875f4d6514
SHA155fd4c1e510a01b1a7dcfae908bb1f83eea69936
SHA2566b54ce720ef07c44c30043ef60bea0bfcc7271c57ca0e990f4966b4b5c983aea
SHA51233691d019e1768edfefa6c45919c7d904fa433ec28e295718d7104e574535825aab0de0b8cddbf16a7c72ce12c01147d1f11850e7c1c6a942823af2e4b68801f
-
Filesize
5.2MB
MD52f87dda77b5945cc9c9e408f61df2641
SHA1863e8ade368f29a2c7ddcf9cd79e3acde9703bac
SHA2568e886c6251bf7efa559c08c712fe4a817b19cba088638187bcfdf8e40a308233
SHA512f32c5fa1da95ed5564ee85048a628eddab2399b1c63bd570e973f2500a5d73aa8ba9a6c1811f3409595cb8fae9cdb2207dc87f2698130401ce0ca390e31aa4e8
-
Filesize
5.2MB
MD5f43b8fe876855024f7d1ccace8df79e3
SHA17bc56fb041bdf4031180d466ff2186a38b81f0a6
SHA256660c6544c9ca961587a5ee85a05d1276697368e1ef29035f907768cf044e1a72
SHA51207a4662f3c7a25eca0baeac45d19ddc8e137db79e678a21cc280618b8e23c140a184a1b5b01b3bd3d5813b5924e09fcaa3723dc11c662e686630ff5bd6034116
-
Filesize
5.2MB
MD54aff91f45b102b128a040330afba594a
SHA17d3f1bac325c97712aa0b5b50d24effc00bc7a64
SHA256fa6bb80409a9240e5c94484fcca4cafeca4ade9c35fffe758513e1a7bf44b4ed
SHA5126bf6db6ed20236c62a8a949eb28b7789f4abfcba8614d41f1363bb3fe4fb0c702b610b1d577af868fca450d7cc208677b3146f41df4cb2c4928fa5b06f6d7605
-
Filesize
5.2MB
MD57755bee1b7ed2fe7454c0d4e16967991
SHA1873fba239fd842bab4289d866b19ed554d0b00cf
SHA2561a52cee3ba8616a7cea1d9e4e4a3f12c37a0354df4d09cf25803e8370bb2db0c
SHA512ec7e744e6301a8d79cd259eae2e56d0821c045dbf15330524ff483a926bd73b955083ca766ba3c31b524f6c37d30920154159776b4896fd1c4d383043f153eb2
-
Filesize
5.2MB
MD5b306394ebb659dc0f7e8b878c2e420a1
SHA1728a521a221e46da4fde5ad9fb9e61ef56e75b02
SHA2563e82a738ebdd2448c2b0c461afa9c1b46ebf41fd4454bc875d8ae4d66a99bf7c
SHA51270f740411e0318751cf75af92810b6edafb25f057423724dff8fe9b0090e87fd79e84bdec6d22b4a0b82f1877661a067d0dcb1ca69dfe7a82d2fa97ba6ab04ad
-
Filesize
5.2MB
MD501f49e8b26ce1e52b2136f1336bcdebf
SHA15e1e8a2b457ce289222405444cbf7a2346a246f7
SHA25646fdc12c8b0cead1f12cb01c3fb166684bd4b594cc7250e096bce6618031cb18
SHA512f19522de733e016ecd7d7fd101994ff5e432ca4e70bdb43ea3ba3b9b11533b5b60b8f0a8377c04ca01e1765245d20c9c7aeb477ae6041f6d7c706b828b8641a7
-
Filesize
5.2MB
MD5cf23cc06f21585c5be614afe1fb928a3
SHA14e12eb12b04d970c02aac4924ddbad88f1f5ce9b
SHA256303a478a3ef1ff27fb89fcad6a801c013bf14dbee810a6b2a087b62df5ed62bb
SHA512ee987d838c7858cc1170594147c3ed60d5ca00abf54f2ed97a6475a7fead33503fc60ae71b727f8a093ea8dd1e8437608a9f5ae6dec8d2b6045bcfd085dbd4a3
-
Filesize
5.2MB
MD57a579f6957cac473e5820862c3d5c670
SHA1fa2548c5f89410d67fda450ea6b9cdc6d899e832
SHA2565582ba869ce36a2e0643b0fae32f4d927a705fc722ab57e1a80c8bc2e16bdabe
SHA512bca62e4683a705cb7f577f4c5528322e578f81115c8529ab4b3a1270fecaf2a7f9c7235518bc2594c2bffa0da016499fc25e9e263c80a466e4f039233cd985b6
-
Filesize
5.2MB
MD54b447da174c97b5f15b1d07cc23cfc8d
SHA1e6224e85017dcfb97a14f5c306b25f0382486b8b
SHA2566ca01ae193b7e3449a628240b23d9d2fe6c41bd1ce0364678ad4eeae65acb9ba
SHA512186473fab68e710a351e9b344067f4bad59391e4c31798af7e83d4fa3ccb90be2fba6b7e94bd7475eb541c19e2ed58fdfa1e00706b201f2896542c765d06f331
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB