Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 06:00
General
-
Target
2024-09-16_eabd878d23e3cfc8ace84db6f6f164df_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eabd878d23e3cfc8ace84db6f6f164df
-
SHA1
e049e08d8c1ac3a55f51dc4e62a076695474fe72
-
SHA256
eacfabc4033cf437190dd4749f25f8fd22cff273445c5b3e5a6c0bacda0b1ae5
-
SHA512
c9960c0c4490a36f55d48edc5a9b56566499fd5d47ddc52078381eeb736a8441550348bc01f5f444bcdddc4d5eb8e857da0e58d48b6dd3c0171d93b734d2906a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_eabd878d23e3cfc8ace84db6f6f164df_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_eabd878d23e3cfc8ace84db6f6f164df_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PUtRbtj.exeC:\Windows\System\PUtRbtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vJKUoft.exeC:\Windows\System\vJKUoft.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vqAivGI.exeC:\Windows\System\vqAivGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMlYdoI.exeC:\Windows\System\LMlYdoI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nowMiHn.exeC:\Windows\System\nowMiHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OtBFdIG.exeC:\Windows\System\OtBFdIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AQIsmDq.exeC:\Windows\System\AQIsmDq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRjFzEW.exeC:\Windows\System\eRjFzEW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KbjIZmv.exeC:\Windows\System\KbjIZmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ldBlKLk.exeC:\Windows\System\ldBlKLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhJLVjh.exeC:\Windows\System\nhJLVjh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pnelOiR.exeC:\Windows\System\pnelOiR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LPZoRtr.exeC:\Windows\System\LPZoRtr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgOHlWR.exeC:\Windows\System\vgOHlWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cosQvnz.exeC:\Windows\System\cosQvnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zwgJqLH.exeC:\Windows\System\zwgJqLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFKzCmK.exeC:\Windows\System\NFKzCmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rERIrwk.exeC:\Windows\System\rERIrwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZOcfYJx.exeC:\Windows\System\ZOcfYJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hISdlmI.exeC:\Windows\System\hISdlmI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXhkbFi.exeC:\Windows\System\YXhkbFi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD535f50db2c84ba67170f62db898c72cbb
SHA1187c7dc2fc0810225d5a3fc8bbce6ec2de6224f4
SHA2564158bed4e3a0e5c1346189a60f15c87e23ed027f0d62b205a4b075dca66c854b
SHA5120edd4158170a0c4b4c6921a0c0d105dc731afcfa0c0b18fe5bf54515634016c9de0f83add44e636e3de6ef14b53c904793ee1dbb19267c2c7df5fb72ff030356
-
Filesize
5.2MB
MD50371fb8c0d461372aea91012ff638cf7
SHA1ed2c61c2c21ccdedcea8c363abd5dc8f6c8dfc54
SHA256dbe2ccad2e6bc29857378e80d6fa0eddc639cf8a35c66c71a3d1e0f8e826bc20
SHA512726dcbe30c2613720bc5c35565f3a25a82d0f118d1f90f6c8f8fb6d90b3067581d3ae38f0f85e0a027f07bb03f08fd275c0da39f8ef9b83f0715d9ab9e5d6c22
-
Filesize
5.2MB
MD59301e706f2c25d3a5b568d152c4e3792
SHA13115a7ad6d101e1df797d8699bc509dea23b71bb
SHA25622788fadd2a78a7b7582b62d7d26dd47804b99782f57a62b2395d484193bbb42
SHA512781960331875c71554a72b318a73dcf5d7b60269d3355043e05e3c365c0cb3c3cdc198b4a27858facba32afd14c16b9e89358b1dbd0b552500c3bfc785587077
-
Filesize
5.2MB
MD5f4712b72b9b96c694ab572040308483b
SHA168f96f5d820998f029f43aed3ef6ee4e91c46d70
SHA256b370d1cb638d82da742e0b9063efbe1a490d2ea2c282f930bb033d8358b3088a
SHA512a23d2d478dc51a03f3971fa26df7a56eb00756b9e985e2293ad8768b51809a2772f6bc415bb36b1f5e7656b55c6e9bcfc268d4dcc58b84f61aea656f52d6113c
-
Filesize
5.2MB
MD58838b2b9e2371b4523a77c15ec082e4f
SHA1da12770d4f010c635b1bed6c91bdf541c2b199df
SHA256fdc6649aef096629ea3e63b095071c2ffaec84bc4d78d6d70ebbc93fc244674f
SHA5126a1b51c8040711e3a6f8ea5c8bea8fa37c7b03eadd89e25ddd10701d343661356cae5025130b5b5542a2cb85c5d8b561a9b6a7da9d0a6142c519dedcbc5d36d5
-
Filesize
5.2MB
MD52f9bc7eecf5d4d17b2b51bb6349ae928
SHA11be31d63dc4054f043c9c039988a7895bc03734d
SHA2562bdcc2a0b8b9f2593b83b8015ca0385fd0bdb70c0f88471376a25e56f1b7528f
SHA512750b3a75be6c9130f16b7b8c15da18e2433d6fcc1d22cf78aa3a05bf6b2436aeac0f70f005e835bfa1f275aa598b29930fbe7e8c6a8aa81cc7400c86452549c9
-
Filesize
5.2MB
MD5b899faa2dff52a0cb841a96a9e89c618
SHA16f4f1f4fb292038aad524cabea727a097f36a2d3
SHA256a58e88864387408a8ff7c105b389062e5d1cf34bcc07353df8d9b816fbef7ac9
SHA512f3f09a896f61189588c4b2fd0940416ab7ac07881df971c9dd6bf3e67b700af28edd4764bc581246835b4c25b94237598c536ecf9ecc6b40cbe963a849ca86ab
-
Filesize
5.2MB
MD584f29b7245582a7e77d9b5618f8f822c
SHA1410900a393dc745d3c7784a34fd3d03eae1613a0
SHA256c9f20d9cf8469659b09f472d3cfa17584980cf35d185e1aedf95a85e5b3f5b00
SHA512c9d668f56cf6c085f88c19562aeecfc398299c743212ca555b7a9694aff379fbd812a99e77e9811386ca9b7f14640fcb6ff90d44db4166213c6d2ecdc03a6c30
-
Filesize
5.2MB
MD596dd9e2895b072a25aff8df1d682bbad
SHA19cf4afa1e5c505ebee4f71348b7e9b99e8357506
SHA25632dfb258f09885fe7b820ac33e1b02686aa8ed6eb19a10448b84abe908b85845
SHA512f7a1abec0e59462f97c2f9741676db87b6e7816d2fc2c56ec6a08318539046960feb34e3368cb6f37c7f46611eee6e1e470c3ad7dd072c9304d785aed81cb299
-
Filesize
5.2MB
MD5a233e270ba1b27f244a30d728155d636
SHA13ceba4a96ed30f46453ddaa19be07ad9c382bc9d
SHA2562dad3d36f3f4b2caf0f82cef505868a92a7859f03e27bd7815ac8cb5c10d728c
SHA512c5a07f7156c833953008ae6f4e33498bff76cbe669b4d619bd029ddfebe80cef99c68937e898a2b6018b23d8c2a7450cdaac997859a49643ac6c45cb6b5d6a04
-
Filesize
5.2MB
MD51f454946d9d9c6eb1ee8a91cf5faf9e8
SHA167aa8634de138096253aa49c74e53c605595069b
SHA2560590dff032d2421e716e9473e64b34599ffcb359f2a91f7939bcc0fe8b8dab2a
SHA5124764d1e694a6af9c1c4d129f49ec4406f7fe2301908cb79bcae239bf123b889e98594e7b9bba02f718547b1b31bbb2c2f42e45869a475cc7e18502377fc561fe
-
Filesize
5.2MB
MD5d3a8fb49362d1b341f35c88919edbc21
SHA1ea252f6478a7dd9974e25af144782f26feeef9b5
SHA2561aeba1b94d0f02dcae3bf74f213fd8dd46b5f0e52197b73c15dd07e722bd29cb
SHA512a015a0ba8450ebfc5ccff3c1a026f66ccfad8f76f39e007a7d3e547009aff09dcb288c161c29ec5debca0063c738493ed106815a209798d73a353366ca0cabba
-
Filesize
5.2MB
MD5649888b7bf8b2376d22f29b3ff6cacb5
SHA11a005d5f769d7be8cbab647f3213133999d66286
SHA25681523bb4422f203a3d94e26164e7aa8147822fbbc26a4d94f5da47ed0c2bda84
SHA512616160cd4e29b9ddff558d44ca0044ff6c442fc169e0483b58ce1a97b23a368509a70e61fabc6e3d9787cda383b03e2534c9d31aad77f9da661b9f262d338185
-
Filesize
5.2MB
MD55614301799467e5544470acb4bd40d0f
SHA11831ad2f72949d4b31ecc428ae7f2475d5f938d8
SHA256a126da2b5f53cdbe86d7a617de70f2d33453dd8930c41c19e37004d6c6f18b13
SHA512e0759cc9a06a757a5e8ffcc924392e5359f845d9929889e35caadacedf3ce21981314d82293995c3f68a3874a43707e37223d2c7bef4bdd26b149a1fccad0f5a
-
Filesize
5.2MB
MD51bee44b2d29e8c33bd794ba36b26b32e
SHA17a6a3cc7ba9491a52e7a7fd63ada0632d7d512f4
SHA25651573c492929b65aaace136883f5341b54efd318f55338a602fe899c50d9b787
SHA51212d9ea08fecb4e8a8845b1295a630b20ec38b45334696ef59ea74477cd59865e8a1841ed1c0813c8497c890a49e3adbf07b1ac1074ff896e818a605f09aecce2
-
Filesize
5.2MB
MD582f1657dcf14e8f90d482f4c0213c825
SHA18783079119b61709c4b9989c83979427f7dbdcbe
SHA2563dc8fc108a95c3e69155070c3a4cae68547ce8ea2716dd2a6952de1d1e4c691b
SHA51231589b9bfe6fac2ebd51ef4058f5208018125e92ef604791459f82ba5b3f49cbbee89cd1271104433241b3b0af4ba2bb9372a5a3e46ff2ddd2a18ec50c53bb4c
-
Filesize
5.2MB
MD5931b56ebeada2ec212bb4f6aff3cafc8
SHA1c47b42177bcd8a4d749b5be01716ca695f497d11
SHA256c9f477b0e81119b8da71e2c0b5279a3c3be0db1b70e559fde28ab3e9a7bdcff5
SHA512852526ee1b4f2efd8b15bee2f694ecb84facbe4947c5723d6911b6382ad989e3aeaf7ffa4dcddbc524f8f50b995c3696305b124c3678bedbb5b6838a0e9ad7a2
-
Filesize
5.2MB
MD55f500d53181d184c91ca34c66a54c17b
SHA1c7bbcd6afe6c3cc66555f61a7ae6593a5c56c177
SHA256e0fa07a33b097fbfce2432dea4bedf72f90c7efc919328156978149e6074e447
SHA5122aeeabd9b6dce87b6022de8a0fce4b01f548db17566d0466b98615e383d55cdff867203776deff6b674445246d44d0a90fd70b5e0d0c00b7858e4e52594d50a1
-
Filesize
5.2MB
MD57eca851e1437a477ec76a7ead0bb64c5
SHA107ba90b7751c758b51e3691d64ef602086d7a7d8
SHA2560c60593661d9e355a125d34b9cf82e9a35d1d2ca71448764a3232440158f4057
SHA5120a3322c8e7f96e7522ea414128c15e213a328a9c73fedde6c433b594f1a1748c81ea58a6b6c88ec8ae59378a53cfcae5a9978f493b0373e91a88aae70aff6041
-
Filesize
5.2MB
MD50e7b2ccad5eb4974092f98fd91606d7b
SHA1f5d65ccd6bf37ba0c69371dd1bd1f981f92c7e2b
SHA25668aeea76475bf6e97d0a26b577d8b5c621ff5066109fd8fbda2182556d901dfc
SHA51214033f764f170263791eb8a29ad12c163f06e9af3b70db30df3e6f5b06ee481b5baf6cebc5f5fa5dfb77e1105f82af6418da35630279a4a270bd36af56d230a0
-
Filesize
5.2MB
MD5728bb2b12869e3daadb6652d2b638db5
SHA1a09567459d179cfea052581a6bbac25ae44371fa
SHA25646cf68a75c87a76a7fb0c39b3cec032ed9331f57dfd0c0f603624b2a707c357d
SHA512ddaca3d4890b0e858715fbda1d188b39a68dd5143c1ca9408cdae1bf348d2569aae7aff4fa38bbd1927171e8691fb827a7738d2160adf87bb53e0dda7dd45aed
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB