Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 13:07
General
-
Target
2024-09-14_87bc4af00864ad0fcef1f6ebf31c7094_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
87bc4af00864ad0fcef1f6ebf31c7094
-
SHA1
b9399f5eace3b1517176743c8ea78aa37ea91c2b
-
SHA256
4f1226493549e0ce0f1f0cdd610e10e23cc3567c4d288c3ded01b6d3bde03158
-
SHA512
f521c7afa9eb24009cae308d56f6c997750bbd6507d5acd02ad0c53a14afc39d726fa21c5301d10132ddbd5eeaf784880999df2e9365bbf91390d1fcac1cf64d
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_87bc4af00864ad0fcef1f6ebf31c7094_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_87bc4af00864ad0fcef1f6ebf31c7094_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xwskJmx.exeC:\Windows\System\xwskJmx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPuzwDf.exeC:\Windows\System\NPuzwDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vqcrMqZ.exeC:\Windows\System\vqcrMqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzSdaKt.exeC:\Windows\System\QzSdaKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oEsUxwy.exeC:\Windows\System\oEsUxwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bhUeRfW.exeC:\Windows\System\bhUeRfW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVzZVex.exeC:\Windows\System\WVzZVex.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaLmAaN.exeC:\Windows\System\xaLmAaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGouTMo.exeC:\Windows\System\KGouTMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iApyDlL.exeC:\Windows\System\iApyDlL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPYktbv.exeC:\Windows\System\NPYktbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDzYWUI.exeC:\Windows\System\hDzYWUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHXyzKm.exeC:\Windows\System\BHXyzKm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgodHzF.exeC:\Windows\System\JgodHzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzErsCm.exeC:\Windows\System\RzErsCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gTBPUiC.exeC:\Windows\System\gTBPUiC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmiydiq.exeC:\Windows\System\kmiydiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VXXFeun.exeC:\Windows\System\VXXFeun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vEFhHIS.exeC:\Windows\System\vEFhHIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nwDwGxN.exeC:\Windows\System\nwDwGxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCcrIZB.exeC:\Windows\System\SCcrIZB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b2b08dfc295418f74e99d4ea7f828c7b
SHA1f88e27b3c6da4ac575d29ff2aeab29b217ce9f74
SHA256d565b8504cff898a98e696a195a1ec529c2d3ee957ba969d7cd44f40c2f9ec37
SHA51279e7842b36f54c4570608343495d7e713c96632f018ec9bb509c64102c9ff0fe1330a4946ff23cbcc8c22a28e7f6f17b96332bf32e3041e70ccb338c42e178cb
-
Filesize
5.9MB
MD5a8b538583fe13d9a9dc284cfe226fa9c
SHA127306def583513d0ee77c47d0e05e5c6edf4b2e8
SHA256be0d60f90a63d284e6b4e5c7a8119a9c7073e5ae3de8e5a86d5835a8b5bd631a
SHA51265c77e2c9434650a55cde40feaf89b7e4af3966cdb98cd25d1cf360cbd43cfbf5559d6c37f6e5ebca53044208fb9985ca9a6aa93356c6b741d82c04bb7534edc
-
Filesize
5.9MB
MD5ed594760cc709a7e33d50f221f22fe89
SHA18e2138a9319aeca764b2d951451445614116cef1
SHA2563fe17d9f249786710109e22febf79f37e4c50d2fde440aaba1eaa51d5fd49439
SHA5128d22a4741ebf6659accb06001493e7a8995c22e2af681d322909a685647f6c3eb9570d31b56f3ccb3060e970e612e8d9d8226047f4fe22eb714c0ac8f629a4cb
-
Filesize
5.9MB
MD593da4890537f54580ee0e33c2c9f3651
SHA191b72c7e3261b08bab56806afb42b4e24f7cdbb8
SHA256c4b33b1f48bfb2ef4d19ee89cdb53a4aaa4fc82a0561527b6f694661f4eef012
SHA51209e05c50cb20412c6568d5c4bf9173bc144bcfa6195e1de328841837f1d0cbb9f3465ff308dc078e47413e9dc9c80142ee747e634a44a870f4c54bb62e81e411
-
Filesize
5.9MB
MD5e5e7cb9b11d0f6aaffeebe8c656d2e8c
SHA180ec1085ee46c3eb8f4ea23b5d96091f1f4134e9
SHA25608963f14fca688f983097850b6fa162f85f0d2b3842424e366c0f7040008b0c2
SHA512689d866b90a69f9b7c1b50385b64352a8ae6d7b0c93c539aabcc125670de9cb72872cce553a338222a95126cb877264a65cbabff796822abf538c6d7410eb63c
-
Filesize
5.9MB
MD535eff043b2a32136b02b660bc499e639
SHA11be52c17383154b69538bc1a25b39d30df07a0bd
SHA2565297be04a45e6a0f54dc691ea036db71e4abef3826edfb3166ebe74bf3a86356
SHA51212391d87b303d450fa2be0d2f198081048918d2bf2518f42a1fca1e46999b85c971453bf2d3146075d92972485ad11f45e5b37ea9433a3de18b855dc60c568c7
-
Filesize
5.9MB
MD567d789c000802e62a89c8f74e94ac0b1
SHA104fa3081110d20a779b8a03ab55d3d7385773f73
SHA256d9f72e6a4da769cb0456e4bf01af84b7d6adbf1df622863ee456c38f67c715ef
SHA512aa19c2e0f4f00d04d5d2ea75303f68c6f08cba90635c2498cdf2432e67d2e707e5688a5b2cb36a66cb765a08407cd8b023b7f7581680878375104dc092f1d49e
-
Filesize
5.9MB
MD5d7654008564584bba1355cc4c4c5cb50
SHA188777ff3d8daa01f95fd2a8c9727bb81d66a9208
SHA2568e81be28ca7f4ffbdcbb77448693da20102d680cf1164b66fa1a562e354fcc6e
SHA512787de2a90dfadffdd7911cd42aacd5c5f38a6c4baa79343b16810b0a6a1857e3ae40572562f586e9516b7d745924dfc34dc633050b02f262f4034889989215a8
-
Filesize
5.9MB
MD56b319993ca73d6de727ba56322332889
SHA19bd9a52a89bf646353fbdf17b6ddbbf960bf1409
SHA2565d95f1f5ecd53d37bb5ca869a6fc2ca6478987b641c243bcba2b93137731a8a2
SHA512b86a0334728cb031fca746338c76e4a8b61543189f3ed4c28e0399f888ca330d1fb202dbf42393f846b118a6cfae2acdc58ad74620e1a991316a441ed0e19b9d
-
Filesize
5.9MB
MD5756bbdcf7ed83923a5ef2714b5cec4e1
SHA1b13f520bc645aa6eccdcc565b99c1eb0592bf708
SHA256743f5fcde019b6643c3db037784a75063cf5d7e81c2a4b64f7dc04c3e968b7c8
SHA512a83a7d3b9597b2cae1010c8fbf87f1b697026af8b9b28b20dce88cfbf1528d6350956adf84762ac35e2b553c2a9d66abf7b800a818b99559eafe26697811512c
-
Filesize
5.9MB
MD53a92eda1ecbc4770ccfcedfdfdc5a589
SHA15c0359a3960c2d578250472f605eb82ef46acdfd
SHA25655a345904d433e023bc28acf82507dc395505a2dcd8f5014692b560917d95294
SHA512a2a03336828fe1f2144aae8f609b65788e652a47e4e5716b354d733edbac3dc301357b35656b2d9f62cf21c3e35270d0adc3354be273d43d731dbba6a6320c81
-
Filesize
5.9MB
MD558f5d06f5a49cc4c5ccc70b24f9c2309
SHA118f0b766ee804c5841b4e0a43529152bc4a8a4b1
SHA256192890811e14a3d23a7ecc8173796f77d76dfb98184e22e17722851946158c0f
SHA5125bba6dd466452ed10a050e9d67795b6c85b7fb387286966aa56fd0cdbf345db2b32bf0a14437d03d63c145e9b2840d1ae7b1560b018b3a5b72d27715867cdd0f
-
Filesize
5.9MB
MD55e34e50d32cea15e36cc7d66728ccd0d
SHA107ae83c16eee74a8d99df3fdc260b48e8fffbbc4
SHA256a1d83bba777d2d18082d59b38a3d23176a516b4964596ee3d23e64a6a28739ac
SHA51255d8a4444da3050239e4aeb351b98a50ffadadf41358b7715a96d243d2ee4d361df5baa3d9ad312e420527294617cd08606292ed2f15cfcddbab9854f2da3cac
-
Filesize
5.9MB
MD5a1206093b68c5bada07aa8b28d22ed80
SHA1db3cfcb6661a333bce328a7e5e8b04c3f679cd95
SHA256faf960b738089b472fde7ab9e6fa3d7532fe977c1c772ff348a9ceedf297067d
SHA512a6e29bb944bbcee7597ed57c4d85dbadbd55d33dc9aed139ef3228c972f5ae5a59150a7f489cdd0359fbeab5860b9aa07ebdeafb233558a4681e0105a0586970
-
Filesize
5.9MB
MD50e31372bba0abe12825430bcf425e0ac
SHA10f094f3c61b53e06b8a0f82bcbffdf5bec90b72a
SHA25658d5ddfbec3354c24130fcb3c03cf483fd81009f1d4c787de1c83f04792a7b25
SHA5128e0aef7a732075dcae9e045226e49dfbe5f33f4a3c6733fb4450ddcdce7e391c5810e4b28e014e94690369ec9ddfffd420291b91dbea63efe3b6d565cc0363e2
-
Filesize
5.9MB
MD55376cf0623e2316d805dd6f0b81622fd
SHA11c0c638e658996c30f7ba89e9b9bc659863897a6
SHA256fc9385529d766aec57268cf70359a3b62ffb71f0e1a129f7381937d3528eb56f
SHA512fe22de7b2bec3e517c7f571a5a86138a6d98555f1a1f660e93c8491d190767ad6e9e1a41e09b65b8fdc8f9cbd0ecf99bec7f69ce3157a9b5c81699397af8cc95
-
Filesize
5.9MB
MD554e18e145cd71b9f38f38deb514987f9
SHA1a15c019eb19a0273d478d21eebd7975f0a3820ed
SHA256980ee2e4bf1a30f3a8c40d6860ebfc297dfa3e582c1a4960760354d1013928a7
SHA512eeaa89f5142ce603f66503b94d57b500dc51a38e69fb1070056d2a48784242a584e65371f14f8afd2949e4e6246b2e7d1d7452f2d2bce4f6e9dd71dd11da89bf
-
Filesize
5.9MB
MD5ab2e0e70c87b7c34acc105b48ff52ca6
SHA1f85929da5558419560102bbb7c051eeb4773e0f5
SHA2565ee7ac9205ea52b2dc94cede6104a78fe5e74f55e4b3e123c85c84b98c5ec47b
SHA512ef76c2813d962d190506cdde1ba0a30e1dc41eca4500095843d72397e1ab7cdd50c6355a8db9a9ac284d5c77034b0142c97cc3c39c8cbbb28ad0c82008e4850d
-
Filesize
5.9MB
MD55ff7f8a4e7864b4adf4395304ca8658e
SHA11f272acecd89613d25bdff7093dac862cabb0875
SHA256b906f2c07759448bc6154984d521b1f3cd7a3a0be088ceecef38306fa91bd824
SHA51266246c3b4eda6e963c333c41526452014af205733715820b1d79477a8104d0a0ab3e961b2dd0e84f37446a89072605a648e1e64a0c483ff43062dc5ee366daea
-
Filesize
5.9MB
MD5cb232c8b1b4b87762be4bce0e788dc03
SHA1352fa79fd207e4594da55eaf239bb53b3471239f
SHA256ae3532435dabfe23693b3d63417f3ad8b7dcb33e0f0d856b875afd7f8614d976
SHA512b21062096e85a172c6fd6cad3be0fe9c65d13edeb2b92d5b43c7b99a3bcbce59bba9daa4b4164145d24d2dba0d6f139755756d2f32f8b2b3052c95ae83961df3
-
Filesize
5.9MB
MD512032823235ce7c3058943f4218a0b5a
SHA15733188e339a3447f51b0f088754f103bb0c7cca
SHA256b157ebb5221b8d18554f6a7087a32b8917e3a1d170b310b439acfa0a91ee854e
SHA512a589817fe77b8c9838beee43c356a5962bb2e2477081d22d21bb11b59fe6e321aa2d60849993639c9f53ca65c225d11172efc4e28845699ae210d83a6176d2cb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB