Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 13:14
General
-
Target
2024-09-14_f95478a31d097bd48b9124f49a728697_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f95478a31d097bd48b9124f49a728697
-
SHA1
49d47bd330851a4c66b2d5f40eac83703cdb5650
-
SHA256
9fecec887d72cc60993e002b5e39b57a72e3de75adcdcfbb74525d732cd31742
-
SHA512
dbe883ac01240e8d1e471d437f5c17524e99002a854df305a75f4422fc2ce1d4bf338c59797371f3421be8b0a53dbd4ae200b92f470622bc9dc2848f532d3ea6
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_f95478a31d097bd48b9124f49a728697_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_f95478a31d097bd48b9124f49a728697_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hxdBTaw.exeC:\Windows\System\hxdBTaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JHURWIZ.exeC:\Windows\System\JHURWIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pCaBFuj.exeC:\Windows\System\pCaBFuj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKRiwul.exeC:\Windows\System\VKRiwul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUAyKvW.exeC:\Windows\System\uUAyKvW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GFXbtQk.exeC:\Windows\System\GFXbtQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uHeEUhG.exeC:\Windows\System\uHeEUhG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tqWAXzc.exeC:\Windows\System\tqWAXzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVxfzgH.exeC:\Windows\System\ZVxfzgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDtquYn.exeC:\Windows\System\gDtquYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XTlBafM.exeC:\Windows\System\XTlBafM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxOAAXN.exeC:\Windows\System\mxOAAXN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJdqlAL.exeC:\Windows\System\hJdqlAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPNnofT.exeC:\Windows\System\gPNnofT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kdQOwGv.exeC:\Windows\System\kdQOwGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UoUHkMo.exeC:\Windows\System\UoUHkMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HzXjbDf.exeC:\Windows\System\HzXjbDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OCvdzGx.exeC:\Windows\System\OCvdzGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJmcoqk.exeC:\Windows\System\XJmcoqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqFfkrR.exeC:\Windows\System\YqFfkrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\krptBpq.exeC:\Windows\System\krptBpq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53c5253b55863cffb4d91c48d5662ffa1
SHA1c4d651f5c695fa7a6084a976f3a6af41384a9064
SHA256daa20a5c832510d51d4587092b4f5bd84be09b9b29163139c38f62b9a418b3b3
SHA5122281cd79d784a54727ed02c677e3d88fd89369cb0fad07e9f236aa3315fbfaff51d568ec1a84f145d50e4503ecb8dbcdbe307ccb01bacda97cc6e9db82389ec4
-
Filesize
5.2MB
MD5ae14ea3c413e93637efc61584a0459ad
SHA170a1683d49ffcade71c1c072959581df1ea22d03
SHA2569468b02c86b232b100ba3d5b2549c6eccb00adfe762777ee512bea2e1d09d893
SHA5124797d77de4a96067f1ae69343be453bb0232cefedd76a771c954bfda2bc1c0401282e958d5543bbcacbdb9f81a141300572b51ec877ea7658f367f8f642c3ef5
-
Filesize
5.2MB
MD5c822d463138a4885743ccf5796c8278b
SHA1ad1524e02b150cb53df9bb7ae8694dfb1a0829ed
SHA256c5758ee184871fd73724087cc3cf506353f8a1409facc1654e99e71af65f41b2
SHA5126f47e927da22e0bceba05ee4e9b7d8553101fb72369a0ad8fbfa31c556a3eb153dc835dd0585bfb198c357890d1a7c074fa5fce633e345d2ae34cbbc2db9daab
-
Filesize
5.2MB
MD5a9b4f77b57047a90963471b32f2e8dd5
SHA180b074ac339c0b00646d3c2efa38473b28181536
SHA25611d144ba69bfe1d37320730d2aad286577292c441e1d0724ad3e2c076cd8422d
SHA512617b00e7d91ba8d1817497e9a46af980a1572752cea673c550ebe5e906c76f563498d7ea5a0fb3d407246cf1729ce2b73bee3d63d13e60b25c0f373c248d4761
-
Filesize
5.2MB
MD50c9d49ca1a53d5da1bf7cb1e231e4600
SHA11866cea12994bb9423010a148f7408c0718f36c2
SHA2563515d3a5024dbe0b296b3bde3c685dae60727a5904e1927b93a0536d5f6c6489
SHA51217d16364e6ec428f4b6857ffa1e2c6a36adc2e95f7c665f663e505d9d6f6ab49a2cd9e902e5548072c546c21f5e5aaf41d34720d5b132ae0e6938175cef941a4
-
Filesize
5.2MB
MD5195aa1211c8a256cf9ba1a760c74e0a4
SHA11ab0ff3d76737a959a9417debf49b509ac9dd74f
SHA2560254ef546446d071246c551cab403405e72d4d66eff5acd912fae1d1188bdcc8
SHA512a3856b23161dd87df5602115e00e6d2c41d705e3faad0058fffe9ae720ff64f8d3698a2709a5fcd37816e0ece4aecdff15c26e791e870d1b4f5e1f1975e03b3f
-
Filesize
5.2MB
MD55b616bf9e88323cbac1584f12c0af69a
SHA126e9f788c9f57a72a7210ff9dec15c581a83ed49
SHA2565879a731ee698822ba12587fc98d677334bbb3ee517ba7775a34751fc41290dc
SHA512949facc8bf7bb9e8284d5adfc84b309dde2eba47106427f9f019591456f0eb7bdc67cf2c2ffe68855744e821f8187acfb0be65d748fd846bc36bae2f7bf68f51
-
Filesize
5.2MB
MD55d8c0d06368ec5bce540e0f47618b00d
SHA104fe25eaf4d713214737f95f38538cfb400e7a70
SHA25626e0a65a87de89826875fa2ee0edea23559c05fd6c57e320c00bdb31b9afeee8
SHA512de90c1babbd51a246fbdb30b4003370b7a607d8ff9d4ce7e7c3fddc64258f63ae9da42d6a1897488641105139dc5ff8ab98e4b6f4d87d379d6066e750c839dc0
-
Filesize
5.2MB
MD524c1cdb98d0d5bc530e9eef857e1f8e9
SHA149b9c30fc92a46f8f4c49507a8618699011e3a72
SHA25626452c6a9dff6ad3ce1f1f2486a39ef3a91ca2c71badd012eb227e8fe2f57da4
SHA512512e2fa13d5978eabb4b48c0fb065d926797f422c4aa8726804240c88f3456900929b51814ff3a0e2fd75fee3cf67ebabdadf0659e99f751e6b42b50a046dd75
-
Filesize
5.2MB
MD5ca68a2b1ecab849e24bb0cd00628574c
SHA1a5d84a2e85978815848c5e1dbcc8b82121e69cd5
SHA25619e8a442fe5c50645d63f515e09946cf78e23436623257b2a30cd31e7328d94a
SHA5120760577149cded90d6fd178da5a40b311cce8149462fad988ec0d7e1990fdcae636c48d87e3b4cff29b4c9500ecc425f54bcdb4901058b80a998376a49728afb
-
Filesize
5.2MB
MD5d046312f01d55ec194da7cf32305616d
SHA10055dd9ca32228161208f4d8b3fe2f36fa7fff69
SHA2569938b40148b09d59f7387dacfd4074b8139908ac1e72b0c5d1ff22abb42ca36b
SHA512ee5567fd41215012b0b74f569aa94d05a1fba3b2cda66b8bedb4d4aeee05857eb8c257cdf465f20d84ca63bd37d2c4344aa1a967e32d61bcc84e03c3973b5a75
-
Filesize
5.2MB
MD540e824d2d127257140817e66d6d33192
SHA180a7a53f391906f0b3703d7408a8899c8a25970a
SHA256f430c49e8f6ac868d2b6e99537ea3dc7d7f864bc30c9473ba05cd7e841aa25ca
SHA5123ffc7b07e3b0c123c1b0101043b8bda6685656bc2f454551ab303cc9cacbd3a2a246f0450d8d23da1edcddd36fb931517fa7b6f0a64d663eb49d2e9694915163
-
Filesize
5.2MB
MD57f2abf02ccdb263f00ed32688e188638
SHA1254b1a28ea9b1adf3dba21c1d525444e39624406
SHA2563ac5e7fadca4a81a4ae28fa0ddc11d544747dd175f7719b35d75ef0341b9a0ae
SHA5129e72890a1e05d73ef6e7e5aa52c366d427dfa85f09f0bf0b5cb33ece342cd3e5f96dbfcbc5817ccfbcd1666a05221249c065198449a2a971e64004fc2003b738
-
Filesize
5.2MB
MD5dd138feec2a7f70a85f33d9095621d3a
SHA11a9595e6d6540ace2b019c80ba7a3b32c6150239
SHA2567988fb5b5372fe6eb663274feeebc90d40f0e4dea5457e07ade7ddc4f7d2d13f
SHA5128929220a3f7edfe7552f14a75be121a98de0e01e5803ff09034c2f50d1c82b3f05d75ddc85b64f7a14f16b53996ffe35b948c8b9b3f3ecf5bbf6051f2d24416a
-
Filesize
5.2MB
MD54d292d1a1e31e34019bb640de18fd23b
SHA1ba35e955dc260ea4edaa554d317bfbf6e05ea449
SHA256a8af7b0526a0f0d28fcb2a0adc516b64da9388c0f7dba453e2580e17cda15274
SHA5123b0112d89b841a535500b2454f8f0e3b6f2c8e677706b4e8d3dfdc11f9b9b05877c4761364554e7679f87bd528cd0ddfb673c45448d10004c71e05256fda358d
-
Filesize
5.2MB
MD58ae69ad1cfbf0b59ac1d7a156f1c672a
SHA193d8b280606c6a8590266ea1516dcd9a763b83ae
SHA2567ee3a76c2e69708f61c591c9f0024eec4457a235e9c522f0b0b588ea9d5d0e8c
SHA5127e95c1d9a60c872dd045cc521ded1e0864f23fb300138edd9e5b3602ca12d203c90f32ca60caedd31e1872a886ca34bc6270b5e35657f8eaad8387d67daa1971
-
Filesize
5.2MB
MD5131683942bad5adb69b3448ed854e842
SHA12643ff93c6104885507fc2be1f4abf21b2283493
SHA256d374a1fae699f7862d3d074bd4ebbc092f3c1c2a83dfcf809c0bb64c4b7fa016
SHA512ef22559e3d3b4312c05dc133f738b46080dd8ff1a227ce53199bb08d47386954991584997f8234bed9c400c93c5056cb1fb0f082f7390db28aacc1626006e6bd
-
Filesize
5.2MB
MD594afa56848da0f2b0f4f6fb5c272e2d0
SHA178b209b30d33e3c30cb21c15dc9f2ff8b4d43aef
SHA256c0409e3abb992bfb5a5ead2abfbd134a0657212dc3757fdcf32c761142e3521c
SHA512c6e4615b92385aa19045ebd6af9ef8130ab1281d5c822027f6677b5f656dbbda1ff5fd20bb69f9332c5c7f7e895ce33b9513fcbbfde1ee3ce83627a1abff3083
-
Filesize
5.2MB
MD56fa3698acc05f04aa6677889fac9baa5
SHA1a490416c48b922005160b7acb9b4e8f4a0d44f35
SHA2561a514595fadcb52434fd83892ddbe972accf97a274c758ed4d826897117a1374
SHA512dc2e7122897e99b556dd16bc12014b4d7e29b266747d21b1893d2e27d7918e2eb210ea9792176e5f58486e97e167adfa29fa4a233482a231f5d2b5e4ed11b75c
-
Filesize
5.2MB
MD5e41c25ee98b89e559dafd837e71ce897
SHA154a758b96bb540e25be4f67449ea6974cda82bca
SHA256beaed99a362091ca49ac95933fdba101cb61df7cfb5bd2c311cb280327798dd6
SHA512a2afe05f7a72be571b04154e6bed7f362ff648c8a4b27c39c0f31afeac1b005ac18e6de7aea1b00fcd28139938363126e5c7eed6fd8c63248b2c531b4ae0120c
-
Filesize
5.2MB
MD5b6cd162b168fda1289425ac35010b9e2
SHA13b70bcbb0b79262e161f63a53c214f50561e6df7
SHA2567ae91d5085002bfa851e104c67fac7d5b4f7892d2c35275d8b9ca238b621f5ea
SHA512a0e8f19ad4a88366f53da2eb4a434e44e8fd2db3d2dbb2e9edcb761536f07a881f51f6b6301cbdd276d62d371edf2e964ce8b8bd816ec1470b192b7ebe3f25b1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB