Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 16:46
General
-
Target
2024-09-16_63604fdbe990b36cbc4405b6b04c626c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
63604fdbe990b36cbc4405b6b04c626c
-
SHA1
79f338dde435a015458b1382c797cd282b4e4cf8
-
SHA256
dcea5059a7f6c904d6a2e67a69cf15e8ac685f32b104908ce558db441052faaf
-
SHA512
6135da31b072c432a00dc83a33083b6e78b5ae29d46734528718c09f3e7ad6baf0d58547f9b593f6ad94ce53b3658d4469a18cfbcaa603ebf62988a6f4be351b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_63604fdbe990b36cbc4405b6b04c626c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_63604fdbe990b36cbc4405b6b04c626c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SdRmZsZ.exeC:\Windows\System\SdRmZsZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VtXnBWF.exeC:\Windows\System\VtXnBWF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiyeecU.exeC:\Windows\System\CiyeecU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uBQyycQ.exeC:\Windows\System\uBQyycQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LsAECEJ.exeC:\Windows\System\LsAECEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghzQRBe.exeC:\Windows\System\ghzQRBe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ogrTZEn.exeC:\Windows\System\ogrTZEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TCHwaYb.exeC:\Windows\System\TCHwaYb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTjDQIm.exeC:\Windows\System\BTjDQIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERaQLfZ.exeC:\Windows\System\ERaQLfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\geFEQaK.exeC:\Windows\System\geFEQaK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nMpfkuF.exeC:\Windows\System\nMpfkuF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEUvmpZ.exeC:\Windows\System\gEUvmpZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErZjUbE.exeC:\Windows\System\ErZjUbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ttophVM.exeC:\Windows\System\ttophVM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zzojtmE.exeC:\Windows\System\zzojtmE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lkkuUcH.exeC:\Windows\System\lkkuUcH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXFMYFZ.exeC:\Windows\System\QXFMYFZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gCEWxeW.exeC:\Windows\System\gCEWxeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOEOoRa.exeC:\Windows\System\pOEOoRa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjgDckm.exeC:\Windows\System\wjgDckm.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d404a0e859aeb32dddb132b39bead158
SHA19afa26224f4e08e6f18302a215872cedd7f2a4e9
SHA256970493ce7e8db3d054c4370545c6a84e5d283431f0fd43a2628b84e99fd25ef1
SHA512b77e072b1db55e54e8eedf9bf431353de3afdb5d09f40c614af3919fba9c99bfedaa55be4e5aaff86eaaeb4db8445af4c6472760943915de24739ee9c50a18dd
-
Filesize
5.2MB
MD5d913e1ca2484520e6786740ba01a448a
SHA1b1f80fe008ecca43e16bb395d0cfa61dcc7a6c34
SHA2568ae6a34e9d12b1be39db696b270e3800de9aa1822f13625c9da39f37886b2913
SHA51237ddde53ca51f7414a3cead34bdab7c6c2579261022ca1975fa10aa5fe9e75bfb8a15221e1bd020c4b9d5dfdf64af51b5c6632b20ca434469b477d2a0765eafa
-
Filesize
5.2MB
MD5484a029750d59b7a734bad1ae15c5df1
SHA11beda6a6f104aef4a7047a636cfd4dae3a30e31e
SHA256e1887644709e32c3a5768b72d02c2e0666e0df0a74e0b61ee008afbb539b0bf8
SHA512fdbba8397bc262d1327e6d94970b06e1cd2a28004e2bf3e42428f265cde36a94fc5961a774309ab51f5455383cc6746cf05b56722d9b7301c7e04080ca572f2f
-
Filesize
5.2MB
MD5e60b5fe8af039bd7cec2177ad42e012b
SHA123824901f3b654574a327fe33e9f01e236ee1583
SHA25691ba79e38d1822a3e9303189bf6f65f040f2984fd065135641f3477d983bfcf3
SHA5128d29058352bec43b12b147193ae073fe52cda6749bfa5684c3994a337517013161d1f474cececa52c7708552d29b927bf6ec26bb95cd6b67b90587227c0fd8c3
-
Filesize
5.2MB
MD5e87e1f3f5e400ab5c92257b7da6bd2ee
SHA1c50a2e220b245a6a0a550d5c822c45d4e21fb2e8
SHA256b94900ebe32c0f1116822ecff9187a1f77114caf9f2fbaf7d36fa90f456d3f72
SHA5122c4be84e906591688f3d6a28c8cd4117297a6e0e497b855831e3e8c69318de74564664149d222b4b3005bfbe7e989cabdd23dc7c81a8e0c157758fbfd6a091c7
-
Filesize
5.2MB
MD58f142501d1112c1ef5119eff2792daa8
SHA1312e6545621f9c5b4219e964aff8e6d187c6bcbc
SHA2562dcb2485b5d75e6c1320f126f35bbe8b12a3a5095983e1f53f05aa62d20a5616
SHA5124ddab9b8be2689a57f1f40b204c33e142769bea9013a818de3ddebe99b229ec2c650849016ab8087504a5a7b0a6e6b8e0d2db3e0dd8662bbc329f061412b88bf
-
Filesize
5.2MB
MD5ef2dc8834c2d40f29427dfe22731a3d0
SHA1d1a0284f85d3dda961151e921c127546778aa338
SHA256cbfe3999baab10c08ab4f4dff56979d72d309529a7dea9862222caf964dd8639
SHA512d2fbc13295e9cba3740a36807a62e5f9284af5501064d07a4c1276f0906b59df17cdd70f02e86539cb102e4d00912cb5c1c4ce6910c9fdcfab4b8553fefd5520
-
Filesize
5.2MB
MD56aeba52c66d1dfed97b4cb1a36171767
SHA11e80af01712cef26818e32c749c554e7b222cd1e
SHA25618ac6eac8db81414fe0da9b38eea879e0ce9de76110643e28ff9386e34120106
SHA512a0a8a7a4d3e4c6166c06a591df82927ae96c75b170d803215793875ea2512be350772026b78527144168dea5eac27a92e6b5d1195307ca8cf9fe6ebb7746cb0d
-
Filesize
5.2MB
MD5a4e6f99f4941b03d4827ac6e7f393ef1
SHA14efbbc00eaed113f456dfdc7ebac4f6c34b47367
SHA256d241f7512974842f91dc6f4603144e00bdd3afa8b000cf5d8ecc55d8cb0991f3
SHA512f2389ccec7cfb1a78e1d4eea670ee995bbf67060c88c4c92814b5bc6fb8911fbffc46dbe3a8f6ede18fae8a1fb0d2f13f390723e738e77edb5f0bf8459a8aca1
-
Filesize
5.2MB
MD50d0e1bce5c966cd658f011401973418d
SHA1dfdce231284ee0dccbf8a1c93bdbacf3fa70a91a
SHA256536f3883e7141a58ac6fa2e8533a9a3ba3663e8076886e6c0a74b059afaaf3e9
SHA51245670cdae1eeb9f8551592870928a10232bfc968fe8e6c02f02fdac32c703676f9aa2807a500134021beb405a1f90e7acf121633656feedab0efbd91727f8cc3
-
Filesize
5.2MB
MD5c5dd45277a75e179135cc9cb26cd2152
SHA1eeb90b1d9a25f16127c5faafad8b1891bd3e5b1b
SHA2568a55264e8adde04b4aaad56e6c7aacf5289166d8d5ab9a1edf4d439c31b11914
SHA512d3817876aba5e9932b1bd11b51765d4f188512ccdfcb082a743a602b0a78dd84cee05a089f2a77884b687190207465ce3c761250b82a9fb219607408d9b8b06b
-
Filesize
5.2MB
MD525c80dcb9c4305fcf863a72f93c01a9b
SHA116e9c182a084ae6dae7847adea464b1c60929ab1
SHA256a6315c3c6c3704afbba59664b15a1e84a635e0c8d1476b5da1bcadadd8d663c0
SHA5127a0fbd631dabd00a8fd284f2170506ae12a6885b9f31da474c106daa7ea9743673f7fe001c64d0cb12ca4f5fd86ddf27f02543d2d8e084a5d4796b2fec51f63c
-
Filesize
5.2MB
MD54606396ee60deeb813d4ec77ec5cbbfc
SHA1ea843b44777ad5349723a749bf29462469d4c513
SHA25654465449c6349131b7236168872053a53667647a0b476714bd53edf7e952ac44
SHA512535e6cbb16105d12bbf54c4e6c8898dc0aea4c6208668106aa16ed6a97167c748f1fee0adcc7c6e68368b7e54fb66d7cee7f8b2f8488466ec573b2c3de88da4a
-
Filesize
5.2MB
MD5a3b5b119b6c3f913d213a1c79e00392d
SHA1eba757aa0848ffa6c47b9cd28fb711db3ed245a5
SHA25613ced65238524edf49cd5080a756ffbdb167c4e5b26b5982d3a383a6533bf44b
SHA5126430b0c85093e4c13227c33b67cf83af9ee5d7b36ca9f325ccd96253f6f6c7ca5500bf0df6e0a4287b6b5e08456aa8657b416b77794baf77cb4ba3d6686a31db
-
Filesize
5.2MB
MD5fc330ac62601259393b8e2236cd774f6
SHA1315da3e27397f747061ef3d5d56a1a7542b22f1d
SHA256472ac2545bb5a858953ccf7da2f8dc7aeb8a16766c86cdf1ff651bd37e76e92c
SHA512f8bcc44bd40e26b1a30917e34ac1a6b3bc575f6447cc34a40a4e657a1b1616188458ede7b1dfb69c0ddfe5be7cb7518d8e289b59bba36028cde7a60faff9722c
-
Filesize
5.2MB
MD5afa2a20b5e09cd2a0583b0d22c351d67
SHA12242dde696640dcd5ab973fa361a519f22374e02
SHA2567e0985b0ff86acb2d5125483aea9d77ed80186fe78d1b8e0dc7a12322a768f8f
SHA5123c6839a4394feb99ecd73b014e0d48386121c2c0ea6d8d29fffbce1d56633ec259bd3f66eb4f5d71f96af3f31710b1dc7541d19dbf07fcedf4697d8f7fd1ddf2
-
Filesize
5.2MB
MD564667cb277af6d6baf6c8ebdb511c3e3
SHA1bb36ed0cab7a7020d868dcf23421a2cc48d90674
SHA2568cbcb88b0b181e53300be81db6ab67d21ecade5c57e9bf78e96bef41a821b3e7
SHA512b662a577838681c4b2460906efd94b472ffc1678816bc81540caf2e5496ba65f75aa5facbbf4af523fdde4229ee8481d42cf6b9b5ae2991c9c86d6377ad3a0ab
-
Filesize
5.2MB
MD5a44e94748289b5388ff784cefa1f4f7e
SHA12021dbeeeb429520db017a0ca461d97553c3cf8c
SHA256335e3e2479e3d23a6322c94a7a933700829d20251092cd757c604ff7b37f278c
SHA512a2fc2ec23039bd577295640b0394b44804ed66aa6df9dcbb5c7c61a8dc9703373383c64fa710495dc7458ea971ada70b85f00d8d7c0e1dccf0e93c92ec604132
-
Filesize
5.2MB
MD5d14f73473d5e0375a8e3cdd182f478b6
SHA15cb632012b9774f5da7d18cd6fb0bf7fdccebcb5
SHA256464c9c3939295ee24cffc9705697c833138f695aeebfdd592e274b44a535a7e0
SHA5122cb849b46fdf5dc0537749bdd16d06875d98ade66e38375e3b258c207ea0aa410b3d17beee72b561f9e6ac402b32fce1f58428ce18fb5bc8c20acd1b9a020ef4
-
Filesize
5.2MB
MD543cb555144136aff0d6591000f7703ba
SHA1ad71be0c7ff7c4668a68b7a1b034694c8c2efd43
SHA256fe133b535cb0a89e373d3c5fb52baf560bae5688a9eafdc9f399edf2a99149a6
SHA512f5a6899cb47ff17525a8089c1df646ce500dfdf3b2e7ac1d4bef211326ca14face296fd6186d3b33bf4a5b233cf7933d17d95f61469b8e0786797fdbbc7c1808
-
Filesize
5.2MB
MD5b196f86f80f6408d1eead803587adfb6
SHA1d207ba0a88496e51e85940b4b6550e84d9414142
SHA256637ca4bded81cf872e754c5c1c5931a55231ad59b3cfae5ff6c8b0e7e0b483b9
SHA512322cb75fae28d5c726d6b5ae7e0382552ca61113814e850ceda64d419f9db7579b11fb126e2f53a621da49254b232c9b67b19056b5820fa7762ba1860021d728
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB