Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 05:58
General
-
Target
2024-09-16_d4de50b4feb9105554913ec3e8189bb2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d4de50b4feb9105554913ec3e8189bb2
-
SHA1
20eea061a11ba30ec85ba5a211fcce739d0a6155
-
SHA256
3d8fdf94494b556fe48ff4bbf20a60c2d3cd148794dbccfb24003d490fb25392
-
SHA512
db472f0b3b5f32afbdb3676800ffcee7869754110bbb72e83f2353d6d2003cfb288ea44b589bbdb57ac9781dde9e28349d2f4e405978a4fb1f99c41c57c5595a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_d4de50b4feb9105554913ec3e8189bb2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_d4de50b4feb9105554913ec3e8189bb2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UKxCdNl.exeC:\Windows\System\UKxCdNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uasrTLy.exeC:\Windows\System\uasrTLy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cOSQJqe.exeC:\Windows\System\cOSQJqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZQPyysT.exeC:\Windows\System\ZQPyysT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RipIPrY.exeC:\Windows\System\RipIPrY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PowjdTG.exeC:\Windows\System\PowjdTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SVpMZLL.exeC:\Windows\System\SVpMZLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzVCpOz.exeC:\Windows\System\bzVCpOz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgaJmUm.exeC:\Windows\System\WgaJmUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZNKblRE.exeC:\Windows\System\ZNKblRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEiGvJE.exeC:\Windows\System\rEiGvJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bWghUsA.exeC:\Windows\System\bWghUsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsPOABL.exeC:\Windows\System\qsPOABL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztnpKfb.exeC:\Windows\System\ztnpKfb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzcDjWn.exeC:\Windows\System\DzcDjWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\phzMJmM.exeC:\Windows\System\phzMJmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LOUpIhL.exeC:\Windows\System\LOUpIhL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEcaxtG.exeC:\Windows\System\qEcaxtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjCOeUh.exeC:\Windows\System\qjCOeUh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTmElPx.exeC:\Windows\System\YTmElPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CQJcLKn.exeC:\Windows\System\CQJcLKn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD567ed38a17f9af49b14d13765bf0c618c
SHA1059b34e656bb3624f7dc3b5c0d0a7f607c260ac1
SHA256279cbbf96432cacd2316e5aaff5c5fd86ef24ebad9815dfd1f24c6fb8fe5d6e4
SHA51228ec6682576087b027fc4308ba888d735e2c629761ad56f866fc307a273f8c7577ac27fe03a7c7fc1c2bec6c4c9f677e0641e5d5ff9b3c77e7a2dddbbb68fd15
-
Filesize
5.2MB
MD5c1566535ef39e5b4d3e7cf4816a211f2
SHA1ca1b3b0a108f93cd7db280711bda6874a4eec5b6
SHA25614ef575867dc09da83c588c4de3d149311d09066ebc76c51ac511c0c185b1b24
SHA51279d99a42977cd8006023c4a4d7c1ef8489f24ac3745ea14bdadb55f617ab88043c79aa8ca90a6fea2af90796e8c57bba07daa245e00167baff2451d6dd4a9859
-
Filesize
5.2MB
MD55b8ca638ab4f19676c7a70ec9f298214
SHA17a29e04262e71d112c1ea43375726e4f94404ecb
SHA25656b6818b336e1c176b3569dd55d7acffdfc0cc0dc8084da3cd30cd0664e45399
SHA512ca1a2ec2e9b9a1285c488629991c31b428311e23b0287450bb15aa2332eb86721db4ef72bdca5fcd364f50433854512b746becf4bd8cd45d2644290506595ba1
-
Filesize
5.2MB
MD506d28cbfdfbe3f3d10d0d1230a255dde
SHA1d38a9bfda730d6d514476643be76751ff4541440
SHA2568bd25da20e7b8958d05a816c57de585b855ff61579a0d6d5317d4b6271eb9b69
SHA51260fac651ff84a8bde821864ab8a8b26047304a8c16b607dd94564e562a09ed8912d9a7b01456d7a0fe43fd4dde16cb24c0b4cc24dc3ba97082400490b8ec6199
-
Filesize
5.2MB
MD5c3ce98694903904ac2d07c22f6e4d01c
SHA19085a5872c7a7eb8785061310f5a91d7dbf7073a
SHA25600bf279a0616c24d7778f3ee876624fab0ffdc70950abe229c37fe3f76b3674f
SHA5126032e0ffc0c437bfb6d6ff531bd758b0936599ab72f75cc1452c09710f1a157ba07d7b37f1119dcc00a8d6647da231c9bf615b2baf5507e1e3016008ba6b18cc
-
Filesize
5.2MB
MD54438163c37992eccaa6d7165a8cb2e88
SHA168e6d5b71cedc0e3b3f595e0f5ab5db0cb3a9ed9
SHA256488aaca20082d1ec2401aeb7f7fc13ebc2528304a143aa38c78e886c94edddda
SHA5123f325b0e67b6df0975a036ca9b532f6fd7fa17154aecfa245062f56f858377c6772db78b1b87d50602742b3e5a6873664f100e3134c7bac0fd557ffc46335259
-
Filesize
5.2MB
MD5ddc89b75d4d9aee3d90427429f44f8fb
SHA12c49c4efd7f69bc552f2202c4fb238b41fd4a473
SHA256c21bb247e29a209a0c6e9023765512887761b919a37c40aafde5c9fabee978e6
SHA51203a99db559adfaccc276402b7dfe1c184651f5dd8eb5f3c4c1d89da3bd5c8bc7c64ca1b676a71fa57245ea46d295a41d1dc0356bcfb25c9b8133c8d56622a58c
-
Filesize
5.2MB
MD58a307c06df0596161daeb2688da3c1b7
SHA122c20735abca92278d657f654ca25d500363569b
SHA256206335f3c020e8eb978aacfbe0ba709446db71968a4f2a8ca5e26720ccaf8b1f
SHA5127220661688ae1d6e5c08fcc7bdd5acd2c5403695ca3480adfcf8c009af0227b07501db00f752c955602db34309d164e2822b311604d4a5d98f5892e21fe52fac
-
Filesize
5.2MB
MD5ef82e73e15a279ec473cf261a5c460a4
SHA1a947dc2b5197a33ffd8e706754c821d9dca69fff
SHA256ab7ca81bbf4d6f2536b584b948670dd3c80606da505289cc4fcadcf52a54bd48
SHA5127b4c4fee5790c4c4fcd38e78d6a7a3fe3d3466ebd80d11094abb669d3d134b2b9fd187c1fd66c00cb7dc16a7ee6d992d4cd0d2e1f83ceb6f43a6d39067603cb1
-
Filesize
5.2MB
MD53b3c16ea60165b3c32163fd7f12fa01e
SHA13d69e363171d67815bb909b0a6c0c845082e252b
SHA2567a881ed4c57b59c5265f73371556c4341df2a0661bfa6473ca97ff45f9477564
SHA51246ec3359c424c4752232d0c5ff7e327cf5c00a02917b75b344e1e88046f1efd401bbd61b589f4ca3bc37b9c99d0d1f83fbc94bb58a8f652b9cf078ad341ccead
-
Filesize
5.2MB
MD50e43414698a9bd97dd566f76d88d315f
SHA171be2155faa1c70462c5a1ee7a2943f9feaeb1ae
SHA256fce3101885255195b2c6208d4e6103ba76ae95ece25b4b6394ff8f1af9ccd33a
SHA512a6fd5eaf3673be68c6bc6c3bea19ec0e9fbd800d2588c0ade985831e9f137ebbbf6cdc7a258daba482111c7d28ac67a1add34dc86f9f0a96811c6cb9d261364e
-
Filesize
5.2MB
MD5b87ff013dde06d7588791e921b761932
SHA1dfa602294765ddd4b6521e3f4b26404f9570d2d5
SHA2561f995df60ff9c2959c00a39b32174638656728c8369d449fc87427392c5b89dd
SHA512dcbe6583ab289b09fc00634c1088ccf0761f175adcc99f69b30d3c54b1510a9d300f8c3091eacb05e197863b7c867f2c0d68d94302affd5109c25d547faaf9f3
-
Filesize
5.2MB
MD5e7ec459806633e73aa90c048be379eff
SHA102a7f926ca078056b9d10a2ea8c3c3694015dad8
SHA256242c4599f5927edb89a5f03a3a665b8d6d4a12711ffc46cb7223174a759af43e
SHA5120d284a54ff22c5628ab3af8ae53a91c8a4247681b7728f9557d3afb7dce38e9d696fc82fe82ad419920fc07cf1cccc1609691182f6973fcba03552042fd923c5
-
Filesize
5.2MB
MD504bdd7fa182f78643d32139cb6a51b76
SHA1a8cc0bd62b0667645017dcae08495e4655b519c3
SHA256467325710019f0b0fd25f17aa100c3b77ef59c10d27371ae77bdaf33d026556b
SHA512195bfb8de0220affbc52432792299f223f07d30623b1f055459e0aa0318c1166de08b25cf94d763611e3634151b082de17efa4b61bd7b8431b41a90ac96056ae
-
Filesize
5.2MB
MD536327df7934cb099117430ea03d95e58
SHA13fa33933bcafbf34ed2ba55e8243a5dd50e354e2
SHA2563fceef005ca195ff6506c69204b395c74741b9df39f3391d68da09cc3a66984e
SHA512ff83a0df6f0c345277e24b5a012c61de74b28c3cd6a0f1142eedcf2fe2bc3c9ee781e16b3f106ca791a8d242d4cbbfa00dc6d367e1c9f3c8a815912cce43ed55
-
Filesize
5.2MB
MD56fc2d0bc1fa67e8fd0ab2f4798879a02
SHA186251254993b49df37e57df82b98a46e7ab213d0
SHA25661d1fede62e03cdd4d675f112fc5b6341dafd9aacfaa626e17cb651b6e502679
SHA5129d363e11d39223c2ef1558064f263769d02bc34e49f65c0ccdc6a78bfb9e7d0618eefc4752051951174e04eaf9867f9f402e7df774f735a873d4ed683cfbbb41
-
Filesize
5.2MB
MD5ed796aa0a733d9247fe33424df11a7ca
SHA182c56c29f88a9ac703d00aff239f5ed029900f54
SHA256fa23a623501bf96ff05da0b1f33754bd9974f6ffc7c0461905e884f0299a6af1
SHA5126aa6c34ad879b57ab678e0f6b6e37c34f86ca91ec5e18815d79b3f50c83007996772709782c45e07d144524823a96736b14762f19d8601f369bc0ee0e26be1f4
-
Filesize
5.2MB
MD52dcc093692c6dfe98f014230e0d27ce3
SHA18f1dd0507776885cedc34b3e0714dc581838fa43
SHA256ed3277cf4dd93f287b0f5460fbae1a54be9e36457d396578c413183a5aca5c6f
SHA5121de4ee00905bef12cd39bec70f7de4a988fb3fd1a6a19735a48f4abf7fb33ccd689b353e02b1b44fd1da018913c65b6ce739994d830f853f87f6f1d2e9440c5c
-
Filesize
5.2MB
MD58dce01925b59a355dea198d97c61c94d
SHA15b6ca72d7af15d3ec296e105b925619efc9a65c0
SHA25658a2fc89f792b278f7e638b7e382beeb5c8264ea6cfc79950a72976c33a15cb4
SHA512f7163b03cfbacd61d2a5237f9609ca0ff2384af47ed5c3406ef81da73dd40aad58a1a22ac595330ff0a0a0c42791b743bfc9c3f1074727b519285ab916919958
-
Filesize
5.2MB
MD593de94d1cc63a51ab508d0f785522b0e
SHA1c54de1195896e313d9b7a517185417e768788376
SHA2569a91b27f22c695cdb499640510a2bd13f023c5ba31b9040fa497c93b0bea474d
SHA5124894c143c4d96bb5aee6b2a3891e669b969ee3e1817e585bca0d4f4f48055b48090e435f99b900041fade9cd8774ad6d769dec60a957670d531510d142a1354d
-
Filesize
5.2MB
MD5b37dc9ff20b0247baa42b9ddf4f6b42d
SHA17878ada08305dada44a3f845584741053f820b07
SHA256ded618e2be376eb76747e3067340f54ac93061ff39b61b1c9d778e54071da542
SHA5124dce3f393c322e3f5e9897a65187dc59d1772733b7ece4a757ef1e14b7632e13d3b70faa32d65aaf60445ab72f30bc3d2c922909c21ab1a6094df0f595ab30a4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB