Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 06:26
General
-
Target
2024-09-16_2f273e0ff73ff2f837e8f88becb5138f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2f273e0ff73ff2f837e8f88becb5138f
-
SHA1
543d30916a241f667992f377eaa18dcbff07145e
-
SHA256
66db3cd7af0658ab917154f0537914b2c24de4275a1c5b4687bc705c7504548e
-
SHA512
35a1edd1e6e4372aefba4893610a6ee394f277acb89c0b77dafb446f0125ebc37ad6968914f9bb3689fbd7e268a7fcbe612d1af89ef799a2582afa0376b7b483
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_2f273e0ff73ff2f837e8f88becb5138f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_2f273e0ff73ff2f837e8f88becb5138f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\etLVmNX.exeC:\Windows\System\etLVmNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcGXqPL.exeC:\Windows\System\YcGXqPL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRmdyGh.exeC:\Windows\System\DRmdyGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kBAJbqb.exeC:\Windows\System\kBAJbqb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYdQoUW.exeC:\Windows\System\kYdQoUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ImsXBuN.exeC:\Windows\System\ImsXBuN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsbgfIC.exeC:\Windows\System\CsbgfIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TqJUiLh.exeC:\Windows\System\TqJUiLh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\abINdIp.exeC:\Windows\System\abINdIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfuoahK.exeC:\Windows\System\cfuoahK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKXHbFF.exeC:\Windows\System\YKXHbFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXIxsBa.exeC:\Windows\System\UXIxsBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LnTXABs.exeC:\Windows\System\LnTXABs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vIYOjsT.exeC:\Windows\System\vIYOjsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JYUACjG.exeC:\Windows\System\JYUACjG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tkEmjVs.exeC:\Windows\System\tkEmjVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TeTWoTh.exeC:\Windows\System\TeTWoTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gvSMyaf.exeC:\Windows\System\gvSMyaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFzbuXL.exeC:\Windows\System\MFzbuXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIKrenk.exeC:\Windows\System\iIKrenk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMQDqkk.exeC:\Windows\System\wMQDqkk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d6e32ea86ecf6689476571a0eefd3849
SHA1645424508a3829d449fad3f4504ff7378a81eca6
SHA256844920fd353b0cb204b3c2e9a671635f2b9392bffc29371c1e475f2d39e92d2b
SHA512d69f9f4a189d98ed0f3e57a7f0e475a49c61183b7e0c4e70d5581907ffb343cc2a64a8862c49ebbe932449306ab6b35dcc44e1ca7a71777de94ed9ca3fff3f26
-
Filesize
5.2MB
MD5da71eebf2a137f30c9d6099997f5d7ba
SHA197f1e157295362eb2fd5e2e87b547c6af5bc749a
SHA25618e4be2681d67f162566f79f644dc9e497a4de4e90d7d61dd8b4bf56e02c797d
SHA51255bd624fa207bb6096287b8ee1b203cac786aab84e2f79642ec357130253c3ff058663dec95387220d9b64d65bee74191d8c9a805e287e7e93f4fec05df220d2
-
Filesize
5.2MB
MD56188cc5e76e1b786e3518020f4c22f0e
SHA1763bb0a0c98f663337fb5728826306f0c5b88c76
SHA256b157216f63a299c2f79dd7a40499cd7a8505bd591de5995ee5e197965bb4f908
SHA512c46231a13ea629f77e18f2e98bf783fe0a74d9373ff2963804dd4dd3799615022e4a42b891e94e0b3e01c45ad421ff465ef23cdac07138865cee5c772b2c4877
-
Filesize
5.2MB
MD5f33e5eae1ec025e49b823257de34fc69
SHA108f7b84f5564ca37357dd383278081ffd84f6d59
SHA256b1908922fae9c4223695ae93626b07826a42325d8d6c14050f0682e231253003
SHA512422c1aecb66cfb16eb7ac9ff1c575e1d7fb119f3a90c2df07f60441179ad3de0378dc725fb0241589c028255ebc5e5cdf837824bf3f0ff2e394f09f4affe17b1
-
Filesize
5.2MB
MD5bc58bf00ac7d7646af45255c901d96d3
SHA1f5b01171c779d9fbf595b8facfb601a163ee3c2c
SHA2565f5c61f687e66f1a9d71755368640260c9b23d4a51cea12f0719d5682fec5c58
SHA5128262cf8fe1d447c5b23c5ac036399d3e1c2c14b8105e8102274bdbab25c378af0707ce3ae0b03e4dc2437c8353c502731b612f52912efc3ca54b6ba66a33755a
-
Filesize
5.2MB
MD5d872fa1ea20c8d5211a8500262cf988d
SHA1b55c69121fb45ad2e1b181749ee3cee1ec192041
SHA2566f7d6561aa867711cc883675cfbd127d87777fb485ee204aeda8a84d3495f66e
SHA512d2fed9624ba01eb237be8a91a29526267640b4b9ad4ea75019e1eb2da434c7d0b10827b9c22613ecb417cb86a88456271112e30e45a68beae21598f861861bfc
-
Filesize
5.2MB
MD5bb327189979e7e63983b5b93577de839
SHA1286241b6c30869a6f277d55f9213158a25a77add
SHA256b667b5f795cd1b815b9d76bf880e4c5bd7fd14208d58ca650aa66fc0247de522
SHA512ee50676f0c0f9d5c958675a61c6529bb12d84ef825c8bf273b724b0bdbb29bd939176bdd162aa1f2ff3e6c7e929ad87f8752a1e702e28fca9189aa183e42ee0c
-
Filesize
5.2MB
MD5337ed187ed9243ca2e91ba35bd9fb1eb
SHA1dad456d9d1958e910161e5efb4adb114472329a5
SHA256f7ed6597bce96b89b0e5cc3363894ec00f1b42df7684d79199037bb42f77c994
SHA5120f196a60a2345eb29ff7c49afc712498724e1f03439e9f920c12136173b09043d368215969f3d1e1e7a66144078cd7ac55b04f0b9606437aef869936f028034c
-
Filesize
5.2MB
MD5804480961d257fb22d1471edc9e0c6ee
SHA1381645710b777716ace4f4991c2fea85e56a2e91
SHA25628fe47d92872d6bdd51765386aa6864c42d1caa24b6451d9465dd972e818bfd9
SHA5129f780fe55beb1641b1db82e00bc7e2bf5c3a9eed69649b5695f3d123a857ae95de5ee30b1172c0ba06f3d8ab133b727cbb5a704611a51953edcbbf1ed6b8b156
-
Filesize
5.2MB
MD57325a5966fd664e4eba0d5d76bd50548
SHA13c1194bc0b0f7e91fd4fb72bf36e14db639d2b0e
SHA256fe088caae860e3f565dfbfdb5953b5cbfcdb00764d6ab891423b07dc3b36696f
SHA512ef57f085cfe202c85551a45bff04c5c86fd9d7536515399f2110b4609a518610961e74f23e294ab8ae09898e6d863384ac4f48379f849f90cf4f3c7580638b11
-
Filesize
5.2MB
MD586e78f9a84a1f31473133f26cddb28c9
SHA17bba79ae85ba8d34f9609037613d1ae8eae2df58
SHA2565c9aeb33212c833a2179238415985948678b025a18b310fa6805c760bce52cb6
SHA5127de0887334fc036df9a4c0e0eecf0286c6b9d8ece2b6469c1bdd478abcda6c981a1f3d05c83efe73e35776735d8e4e84f30125da2256b97eac536ff3c0fcc1eb
-
Filesize
5.2MB
MD5149a6c3e042770d87c0f80e311445a7b
SHA167857d6893e8f45bfe09d5bef85f2371f6c1692c
SHA2567060d0e5c8686dffe6a5c2d93a578b0a6cb0c05772fd942b1f9ec910d40eb492
SHA5126b2365b6e9a763517a1a6fc3e00a0cb27b4d004c008e7794be2eb88b15ee4dd3dfd888ea383165aca8378597d4b8f85c65a853d50390d470752c5d9d9873882b
-
Filesize
5.2MB
MD53c3b7658bbd743b4c14bb47f47c18e44
SHA14dd6caf51d9f58f1b946f07bcdc1098668f46ccc
SHA2567b8c31e7975a46d560d08d624d2a180d29d78c1810e609dc4d9aa966a2caae2c
SHA512ad7427bf4b1319ebfccf8fc4bc5b6c2113b1a97d762552bdb1ad46e1fe0c53046ac4bcdb078f79d806c13949eb9c806575d2e1d24ca984b427593a44c11cdb44
-
Filesize
5.2MB
MD50c26afc0600e5433717b7adfe922c817
SHA116dff90e31bf7da639e202fd6e2626d372baa8d6
SHA256c51223bb579dce43530697791d90cb52bc681b6ad7650f65f433c7e85d7a43ff
SHA5122c762101f39557c3ce36f244a826465e065b7e284bb569a366c65780bf6280cdbadf8a433f68787e723f5f8141510cc6a2f97144fc686651d0fa4387a843177b
-
Filesize
5.2MB
MD5ec2b1ecdc18ddab0fdd6ddf9f806184e
SHA1be2e63bae26c4b05ff125f3acafeb2a7082dd56d
SHA25619b6408794c70ac0e5dad3836a80306e033464c31754a8bc3f467c3a415663bf
SHA51256f276df6554737e43ee78e88f4d9d8f1240b4acda09adc8c1676be154fb5a8a879bf806b3af3e021fdbc1199d3858e328263b18c47c0571971b579cde4c36ca
-
Filesize
5.2MB
MD513893811d7bac52381ca82b13c243067
SHA1a7ed9fb8d9b1db7baf76791d0b3d89682b1ef5fd
SHA2566e94fa528a057eac47bacc4bf7e7faf92df980c2a10145460fbaec7ee8ebf839
SHA51259d9d35b9cb6d33b704ed573ccbf943d60c26100d0bf890c724c66bb740ad99e09a04c0ee5ee934f5655c1ee58cf385441141bfd029c4b9e46d04fdc55dcbcaf
-
Filesize
5.2MB
MD5024b539fa40226eeb604221657ab98cd
SHA19f614011541fb6369420de25f41254822655e921
SHA2561fecb8eaee85b12e0d20d2419aebb90522e93c09efc1aeb260f8ae19ae258c10
SHA51263c3ce7244195968dd0c516eded8054751c4ef78f3c18d849e7d81fecaac05707572392a0662c75ea3a2d9c5de5af1eb8927befd8820608668f5933283105e17
-
Filesize
5.2MB
MD586549fd8d7aa995c5146eb5b265ef899
SHA140088a4bdfc55db386601d9d1e2fc97ab806cab1
SHA256a5d5cd5b2c25efef8103bb8ffdf21d51615da9dd57e2a59d02d20e38c9df30a6
SHA512b1d7a1d4d8993c557eca88b3badf19b33d85808ac589c1fca30af8a0036ded7697578ba58843dff8395eed923922fe0071c1bbe5c7863f8a344313af104bd872
-
Filesize
5.2MB
MD57a51613315b071a86760c783e5179f22
SHA119121d4b3d764da6ca426fd879d1c7dcfb371fd2
SHA256abba97e03453c6306c082d12ee73796f07016ea6a71862b7da481941f434ba63
SHA512077634b91d28f8fcf21f10cc511b479eba4111ac277c914e404d1a04c102a0b6e7f206dece974c4f0a04cbc5b12b158b26df98cef3197b3a607ea6a11bc3dba9
-
Filesize
5.2MB
MD59c54da09fafb40c6629a1d3aa20db5dc
SHA1a6ef704e1f0dd8a712ba516b27a65b0604966601
SHA25629b031fada59c8621a5fa4ebc58e5c0da2cac0292c31e0ec5fd256989f81e49d
SHA512612410c7d05b8db810cc9f30e8f30590e92852469e3b3b431a2b899ec7cbc0a1a5ac5f81a1176f3e1006cef3b0d069d8c4b6f70f188f5794adeba42651d45687
-
Filesize
5.2MB
MD5c05d5cc692f03c42a184ce967464a298
SHA135c46332dcd36a3cd41e11c72c66639e08454559
SHA25631e9527d66b49d20da333573e4743d77a2948afecba9092cacace95a683a606f
SHA51292f47a4fdb6838b5bdfebc7f8147c1c936fd48984335c63ba13649060ceddf7e6517525db6f0cf4176be0b7609e1a7fcf99b77d528ec4603f64524fb97e7de64
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB