Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 05:50
General
-
Target
2024-09-16_71c8a21978a34460b8a88115cc51580f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
71c8a21978a34460b8a88115cc51580f
-
SHA1
5d17784826e7de1f1c10ae8f18be5573cc179fe4
-
SHA256
f0059a632d878ed9c678630d002269e1e8b184680b04fedcf1ead4d4184a9790
-
SHA512
551b2d44b8148cab190a1371b8fd08f81fd1ba434f69fb5d9f45f8214e5101bbad33b3cceac617b7221a324dd02e9ce397acc24119e8b6b2d338079fc4d235c2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_71c8a21978a34460b8a88115cc51580f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_71c8a21978a34460b8a88115cc51580f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XrqaKmN.exeC:\Windows\System\XrqaKmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjiqTWV.exeC:\Windows\System\gjiqTWV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTEaJke.exeC:\Windows\System\YTEaJke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZhvTTj.exeC:\Windows\System\JZhvTTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKhdlNA.exeC:\Windows\System\HKhdlNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ABtIoAw.exeC:\Windows\System\ABtIoAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icvFXPb.exeC:\Windows\System\icvFXPb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MlISsKl.exeC:\Windows\System\MlISsKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yteeuVN.exeC:\Windows\System\yteeuVN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jKTbKbt.exeC:\Windows\System\jKTbKbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnEFlBV.exeC:\Windows\System\GnEFlBV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MbPdbgP.exeC:\Windows\System\MbPdbgP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgYrqfY.exeC:\Windows\System\jgYrqfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhqZmSj.exeC:\Windows\System\uhqZmSj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEDjQpU.exeC:\Windows\System\jEDjQpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PTQgkDe.exeC:\Windows\System\PTQgkDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHgaadk.exeC:\Windows\System\dHgaadk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTIgHrP.exeC:\Windows\System\pTIgHrP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KZMvRKm.exeC:\Windows\System\KZMvRKm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYGuFOV.exeC:\Windows\System\LYGuFOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NryulSY.exeC:\Windows\System\NryulSY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD568ed8618174f31ba8e10bb9af75d3ca8
SHA11e5606509461b4a6808c61ec83469634558b58ce
SHA256d14a849aa6a374730960515f35b1c67810821fb5137b346dd8541081513eeaa1
SHA5126413c07dc9dfc07d569af353b7ff820bc914d08e5d391df1794f76cf84821f89c13cafa47e12a3626c992a40e4cd123bae339588339a37bcbbfe9152bf19d82c
-
Filesize
5.2MB
MD56d02fae7c3f1c50aae86cd2b98f2deb5
SHA1dc1c31a7f55d0064cbc620d7469d98dd2e4b5b51
SHA2566a6801ff21ea23c2fcbaf9f2ef50d4b5659ad82fb515b2ddd10683287294c8d2
SHA51274f182c184206baa355ebba43f8127a0c9078c8e6d3add4c319dc091388b06b5ef5cbe3fbcef648e0e772821c328af86c1500794374c94684ae733b9b1d0af24
-
Filesize
5.2MB
MD5d6bef0494008a9651c5d6f86fc724ceb
SHA17c0c516369fbfed6c61b93ba38966e0517cd93a8
SHA256e1c4a4d13d4f2bfec48323a6e7f1b6248f33260200b0b424574bf363c39adc4a
SHA5129c67f800f1180a03b0543560fd6c7b3aed3af299a7015deeb8a477e9e96477aa131b6bf5200b56fa30fff997db07e482c07955758d0bad9f623ec22936bd489c
-
Filesize
5.2MB
MD52cf767d6d8c8761207998fe1288097b8
SHA13b6e9acedccf85fa98b9362ce2a949302e1a4ed1
SHA2561318867f5a1e15e8f21c8e5a59d6a0a4c19c12dff69bc340efce3ecf315dfda1
SHA5128fcf7a6c6f4ad75fa612c9157d82420d6af639f02531664d8c64ddb1b445d7cfd313dea981c5f0f987c2c3d34e2d1b71996708fbb44bf4d67b62819f5270d88e
-
Filesize
5.2MB
MD50858022374d5d2ae197853a7fbcd99cd
SHA1cb46c074c8d4fb9142b37e96ee9eee8d83c9b26d
SHA256d66c4af38c1076b6783eeb584ffec131ca65c114a81aa25f46dcd44e069304e6
SHA5126a94f7c6b94392d029b63a500492a0316c80f9e73b033985a0ea5ccc0a7938cfc514a30dcd363909744d745eda87d2d35bdef530366da7a9d3d0c9c2f9b72ff2
-
Filesize
5.2MB
MD53abfe4cd6264b40b8271a1ec565086cc
SHA1dc924bc21a4fe946332eef48d92585b96b964916
SHA25699dd6b294210552867bd121e397a5c99f67c321d9b413257706ae8feab3c5531
SHA512ca7ec5a1a593a72118d3091c3037d0e2c8b083d2fdd9297330f21ff0c1cf2324dc9fa48b46e84ed65b353179a3782915cb24c3d3cefc1382ff695cc66940bb05
-
Filesize
5.2MB
MD50ff772237fb0318aa69117f40a6e21af
SHA173f0ff86f1d6f1a03245524cef1bc6e9f7d5a496
SHA2563b1e16fcc00372ae7e598ce5ed4ca1a5bcf4a29c1b7516d8f53e7ac27af588b3
SHA512f25d55af432f3b087bb79b9633a90e00fb7dc4a6f77817775bed1dc1be0d4ce74b32f614d5f5b9bbdbb25b3748530f677663aa695ba63e11855914c4d1509ce4
-
Filesize
5.2MB
MD5e1036e0cacb529bcf8ff2772e4536123
SHA1cb72e046baaf3880949154ab73c1e3bf4abb5a33
SHA2569c28cf529f4c1fab6911cc378114fa960a87223ff26925be9f8a233871740987
SHA5122de1a3a38fa13d177bbd32c22749beb7b42e4ee594032e7c60e3920840172977864249e40d585e1ab7502f73bc8749d0298f87d5a7fea8a66a88ee2b73e14265
-
Filesize
5.2MB
MD56a15cb10a9ca9b95428d1f1fd8bb0ac6
SHA1e2a22f3295a1d0f54026cf5451edb22a3250d22a
SHA256312182e5bf41f93c76879862a1bab751bcfd4d177b78c872158a0d250606b6a7
SHA512183e19c0e330f644da9c666d149c7b118dffd277713b17fa2ff22755b345cb5e343a068c4223398655c803aba49540f3cd491241464e7257889262c3852c8699
-
Filesize
5.2MB
MD52a74ccbe6eabcb60ef123f531143f397
SHA1c977b3ed9da629a10df0a7900ac4ee9d8a8de561
SHA2564f8c77e085a8310aa30eb695e8fb1a67b7b860e92307d0c43a60779b67de5b34
SHA512fa722a4ffc847edf35bfa82c3df00679023e54a65f7a66aeac9b28abd0720c8b71a195f952c526e5d62fdd039dce53c87244c8cba09c66836d36c2fe289a90b5
-
Filesize
5.2MB
MD535c0e100fd1a03431818b2fbfb0c945a
SHA182d43fa4d47ffde9846fbf355ebb099a36f6ee96
SHA2569edd92bb8fd0ff7348380fb46625d846c50571f5c8665808086d5ee9c6f79db3
SHA5129b446e2b24d55aef5b88404d0f60f670eff39c190b15c7260f698970b87d4b93c78f29e5f0e730e642717fc9c494fd9c3191aafb5e9ab2aaddc435bfe098f83c
-
Filesize
5.2MB
MD5772cad51ec05e927bf9b049416b23550
SHA1d25ed973eb0bc03fc6eebc3ccc8ed94a6737acfb
SHA256b887300e4898ff3c6357ab2e0dd534d40d3493b261b4b0da3978e9fe63aca471
SHA512923bb89f7e216b576e58c16a371f03ec46aebfb336a734caeb8901b415b32d2201844b7e899306a6f2f3ae9236018bde60683c6aa5d4902390a161cfdbd43a91
-
Filesize
5.2MB
MD502069f67866cb4cb176896353fbee007
SHA124e49ff608b850754143d5f1080e29b180a8d21b
SHA2561b85c4365c8d45145923132c292bd8f13ec7e94657d4d0ce4e58788075984e9b
SHA512a88ad4018be643c2fea24abe640d78f8cbe44644fe98205aa99b64989a056e4a1bd59ee7bcd155d183b211dc2a7d2a410eda04495be91aa54c17aebde4196a20
-
Filesize
5.2MB
MD500838edf0cfe0fcdff8fac1102dd0997
SHA170d2ff2816e34977e08f965aa9697833ae7b6985
SHA25698c5156cbf5a3fdd43ad8f025616b556c9769b6cd10fd206539477695377e3a0
SHA51235b1097b751d2c07c49f9af98185592023c7be693f5725c31c4901e6a5e84d6cae7618927278b678cf568e44c3846b16140d8f73f59078e7cbeb1691f16a9722
-
Filesize
5.2MB
MD5d6bf9c540c34bb34be0ba3fbd9a9f83e
SHA18f148a005e15b9a0e94ccc9f43773166620c8133
SHA2562000b597c486be8745c76ba088e6b235a371ce86cdda12e5fa4e1ec975c3de2d
SHA5124a6f803711be19050ae9d6e8422add7db67a72cd7ddc7a0e4d9f6aa22a63a955d68ddea4fac49189c9d38daf84b6081cc29aa10b423dd12a61fd9a12c146fe73
-
Filesize
5.2MB
MD517d9259d08ce5f0293635ac7847ac40d
SHA1d64512bb2260b3fb9a1fe98a0cd959a4cd4576d1
SHA256f315e382fb40442fb311ddaee5f3803af2fc27e1fd0e1b2215a7be34d7e0140f
SHA512dbd3da53a35e55b52704043f056dda04c707e78a5e1fa84ad1c0614f60e3904eab0c59263f5cc9d482df40fc0b4a2513ce0a5d715caf42627ed5886036591f72
-
Filesize
5.2MB
MD51c8992abd6e13e2d49c5b7a560a33536
SHA1a2c0ff18a24120104c702220bdd6de2321944ca6
SHA256146742cc9b2ff4d25d3f594a7e65411ffef181cff30727d20a681c1a9623825c
SHA51209453e3b30894febbfe8989fd708e7d97d9393953f49a2898a8dcc6141dbabb961b36f892c4ea5027934153c0debe1eb1301946251bea920e5365a55a3842b92
-
Filesize
5.2MB
MD5bdb998456a34f4ee19f5a3d32d4afbe2
SHA1da75d15ade4a28fbcffb55fa3211dbd80ddbf06d
SHA25641182429f778ed7b9242399ac996fdeec583ff1755bf29d3427b4ccf35f0aeab
SHA512a6b33ec5cbe7201c0f2740630f0b83a0ad9179396f8d58f6eb67e81f1e10bfbe23678c07b5b9bda89eee7e51daabac9c26354252042b8e697be580e1f1afb346
-
Filesize
5.2MB
MD5bbebc25f07276c3f01ecd28cec1d1ef0
SHA1df3347f6d65fe18991b169e15067ed00d13fae7a
SHA256ef4f2a89680d26a00dda65ca77c3cc8375198346266eb330d4c99691c7ce66bb
SHA51281c42ba113fa9b3474fa9cf416a75754449d6fcbf8a58bf4cd8dd7eaacab348f162b6f6cea618e1db855ec89db10824af8e01b0db02b3ca7963901258d2e5bd1
-
Filesize
5.2MB
MD588ec1c3cf19fea7749c3c8408aa0320c
SHA1c261c5ae3f450b525c1ccf020947ce0478eb5b1d
SHA25675b7b6fda88a0320e60f0ed3a215e4f5c176f1d9192cc587194201bca7dbcce5
SHA512d877403cc85315dee8ca870ee3f4f8e2c375c195bddfe3f084b68da373d02022f695e94eaa01fdc2ad3118cda72a18c23b2faff8968c91a7f2c8971efbe849ed
-
Filesize
5.2MB
MD5426b040bb3e013599dad356b24c5ae8c
SHA188117162cc48b3eb41aae845ec9e19b48c7f64f4
SHA256a4b417f403497cb7cab06063bd838f2ebe29c6ec0aa3d2f0b55fb05e02fe2a0a
SHA512ce362467a1cd3e452b540a1c1fce707c01f100cfe186f26c3502b9f30d6c837b2317d5b1ee0fb277ce86559453d182ca5c817e2f5dc7eca93d8d7b4143d46c21
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB