Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 07:26
General
-
Target
2024-09-17_128edf3a01ef0dc158a59b2d4b121c9f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
128edf3a01ef0dc158a59b2d4b121c9f
-
SHA1
1ebdf3d4ed4c56a41313e8f3febbb2dc3e1c7090
-
SHA256
038cb944b6ea8603b4e4795b1f08c0c2ae08d4061f5bdf55a624e7bd036a327f
-
SHA512
9aaafc28d91861e5ee608629c4afc866e547404c2743b92d3f81da0d477cf65ffea9a0a5c0926aa9c8f6fe8035e4e9b88a64091f824a469998a27af499b8386c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_128edf3a01ef0dc158a59b2d4b121c9f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_128edf3a01ef0dc158a59b2d4b121c9f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vlYKHTZ.exeC:\Windows\System\vlYKHTZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHmgpQm.exeC:\Windows\System\XHmgpQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYoWjys.exeC:\Windows\System\aYoWjys.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sMahhxP.exeC:\Windows\System\sMahhxP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HreRtDv.exeC:\Windows\System\HreRtDv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ViwIDPv.exeC:\Windows\System\ViwIDPv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gqhNmXE.exeC:\Windows\System\gqhNmXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KakEHSg.exeC:\Windows\System\KakEHSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgHJNot.exeC:\Windows\System\WgHJNot.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kLqCFjs.exeC:\Windows\System\kLqCFjs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ajOkqmf.exeC:\Windows\System\ajOkqmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohDzAFQ.exeC:\Windows\System\ohDzAFQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MttiMuB.exeC:\Windows\System\MttiMuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mlpyLJT.exeC:\Windows\System\mlpyLJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFwrAXn.exeC:\Windows\System\HFwrAXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pFZdcJQ.exeC:\Windows\System\pFZdcJQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNxDqLW.exeC:\Windows\System\sNxDqLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTecTGh.exeC:\Windows\System\JTecTGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWjLWWG.exeC:\Windows\System\SWjLWWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lcuSYDe.exeC:\Windows\System\lcuSYDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JccwHac.exeC:\Windows\System\JccwHac.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3836,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50c38e82ff4f644f0f1ff3201a978ef60
SHA1c01664fd8d403a6d86998fc1d8b48b525ee04208
SHA256510c544548c8b0192658c6cc62fb39c57b67eedb1007f6e8aa44d9291003b8be
SHA5122f027394a58bd19c84e2a313a1d2e2063b4b637e819ea6c96b27a082d39d7e2bfc5990f2fe04e78b4011fb01bf156c6c43b759889f29fa2e868ea98dfc7889e2
-
Filesize
5.2MB
MD5622fed30bc323fd262e24d40f0fcf9b3
SHA19b2f782fd7c6da4aea7c316ee1f9197015047fd2
SHA25627ac69bff6456f14cd7a554151d298aab5e04854fe214cee57a3590f4951d9f5
SHA512a0873bc9d6c513734e6e25a5b8bbd8990b878b9b35f9d3c44fe05bf8446716e52a4c2f5719f21f761b8ecd78f26a09696ccd673493ee286c61c975c1387a2a8b
-
Filesize
5.2MB
MD574c76b98205001ae18ea88bbcffe10b0
SHA1d87af5cbedbe5a731c1c3f891a89e559f23e5b5a
SHA256b368d1eec89ef1f1f6c8bc040a9a48a5bde5fd4c3f14620fa30ceedabf90e564
SHA512fa47720530670fe524e2c49c4e22ed7cd154a7b19afbb1b567d789556469099618ce7d921edb2a02408e28722457e9b0954b427670b4d87c370aae665b15c7f2
-
Filesize
5.2MB
MD571a4e0b2bd9b8a3a4991fb848512705b
SHA13ebdfb0a14daba0df08c8735e93a3acb4bf9f39b
SHA2564c9067a1540e6b8cb4943a4e15e1a65243167f637f1e80edfbee2cd6519915a1
SHA5124f57b96c9a6ec6b93820a82948d3533796bfeb0491ee8921d8bab8b6e89d0edae4433157420e17495e48a41e9ab4f39bc6fb46acddce279dcd4880c5b4b5951c
-
Filesize
5.2MB
MD5251f66b8babc67c421cc3b436c4bd304
SHA10f2ba50413a8712ad1c49c6741bd7309cb6f30a5
SHA256038cb065bc569630450be09ec207a558a15a6b3b3da83a50c3aca64213155167
SHA5128fa920dacf077a6d28517bc96dffce5f50431abf5c47c4fa35158edc46d10782ca52cd2491fbc660578627b2063f21a8a9e88d66c20b86d1c1af61306c935edb
-
Filesize
5.2MB
MD5c079f9b3e5098fa35e17b22c3a1e757c
SHA1e4e9654f8a57bdbe070a62a47ac00af228cd2bdb
SHA256f8dd79dea276000ad548a52e0d71ecc375a0a68d2bc8e3f06f04db2c96af69c0
SHA512ba3450d519e3eed9efbee5a2d34b889be16003f64db252505302549f4c8e59d41381d4477a2c9e4df4a1176f5ee66502bb1eb76164781f7e9c54f7162577b659
-
Filesize
5.2MB
MD5c9bf1892f2ac5c7cd749767a3c6b7136
SHA13f1884dad9bc1b6b8346a4f10f5a1f69048d3d5b
SHA256a51b6a171faa3e87f53663a3d3b8700dbb1b5faa041596c43be0c394f11c4de1
SHA512cafffb67378c6219118581ec36750ef8a6400ab43e208510f5804d6cc7bf370af7ec5965ba99066c507bf6a8e5d83285beceff45cf11d594dd5c436e6023375f
-
Filesize
5.2MB
MD549e7b7f50375a3b93a97890c16404197
SHA135dda0af6dadab9997678d23a16202a508a1bfac
SHA256eacdca3ef40162fb9e6699a8a4b7985559ecbcbe8226e0da20f95c3fbf101ba3
SHA512b11ec10ceb6464b7e117ca929e630f07b38e84786003787a04acfb47f8c23a7a898e828351d820c69b47a84c81821397bba386652b168e100cff2692d58b47b4
-
Filesize
5.2MB
MD5a7cc096afbd71e1559ac7cb8873e74c0
SHA199f2bd0a918ad67b040940bb0f689298ed7372fc
SHA25640cb4dbc52f198d7a989ed52683a4b2c895bfce1c963cde9f8b36d4693b8928b
SHA512e737a4a0fa4a74783cde22dd3d7d02044484d4a2c7f6873074b830865de0a5da6e325068a7d53f4e2d6f0b9dd51605b5ac067c4238cdb8164ac65a50de36a603
-
Filesize
5.2MB
MD5e61764a3a21d570e42a9bac6887c550a
SHA150ca397b42baf702456d3b2da4303fba956766a1
SHA25615a4539d951ed8dabd8ea13d804cd013671beda0037d740662b06728f3471cbb
SHA512919fce482e8adb16eed5f67983b5d3058581b17c1a54694deac88835d195c82aaa11a1a05e78a851ba2337a940bb6e0c40504c2a10b88aa38998e9696600cddb
-
Filesize
5.2MB
MD50bb82a829563ce63b16e628b4f08c23e
SHA1fcc340dd88befc66533abfcc290a6bc18242cf64
SHA2567083adc37bbe411aff00cf31b4c3167b0a82ec37fa0fb3425753c06cf989f3d8
SHA512a9ed9f034b8596bd9569ae9a62ceeb5fe45194c36c53931716985d6849f2de09913b2d25b8ac73be3a11ae204956fade5a1b76e849b51f49aae6a673e8d97f40
-
Filesize
5.2MB
MD5d4cd1f719115e408a78e8a317770158d
SHA19a62f605ad1e3148c3e8d988e9c44cf911b981c0
SHA256af102e51071089b7d9f560175ddf08422f77c0575cd732f40d30abbbc2af4010
SHA5127bcf4c44886efcd4f84c1604965259a84a51efa471edcb891ff9922bbae3c9cd9a85c6e14b3a90d07a8320f5052e8a275e74780101eec14bd7abb0b7844f5b1a
-
Filesize
5.2MB
MD5dc2d6f12e750731d5be5dc2297227b63
SHA1384226c38d45ee4918240e6964bddee6eaaf591a
SHA2562704406e4122d46b7d214e7f76c727787f02cce668f6bd3d9d8db24d6f35c274
SHA5123effb40e5ed1dcbf7b766c2144fe29d06ca4c92bb38d74d4ecd8da4b301fe63f201ff2f22b447d6bf9440da772766bb478b1a6a6ea9c6985ff71f5da93935c96
-
Filesize
5.2MB
MD5f0a24bd5223f9a9248f2aef99a71fe33
SHA1d3731754ce9079ba884322c21f041bc7b5717c4f
SHA256a2c3a0179f800bdfe7c3e982f831ed1655302a105c9f9a6d689b2b074a4a6c13
SHA51249866583ce549e3b00c58caebc2d3b0f8d3bb83bc06b91943b0835caea2a0e08c0c761ff59dc05c95c4d2072609c09eb9f1258258e6b3176b6b9694de6e17b4e
-
Filesize
5.2MB
MD5fa9cb17c11d8150fcebe0731a42e9845
SHA1a196e9ad4b346de023b898295a0c02c469017567
SHA25673b35f42486b3c76c813e88e8e7c91becd2b242317d8e90359da72fe92e01dc5
SHA512fb98cc1f4d0b671a99aa6169f6f12373665b2cb4a61087a833b2ded2e49a05420c9571cff95f19770699a6d3f53f29130a5479600555dabcaa341d632793d8d5
-
Filesize
5.2MB
MD59ada7a78fa42b64cc9eba3e7a77ed49a
SHA15d10a47e46e7191f25b7677fb6a2a708fcd20dee
SHA25618b2e2af3fd99f430fe2102b7519d9cb285a0a4867a48bd49f5f599440be57bb
SHA5129613cf9a6e9318510b37840c8f624fc5f6cd1940f707b61dc3c9ff77c84444afc60095cbb8c0de908ba3685392c628468c95d299b4edf47031b153e3e1433d24
-
Filesize
5.2MB
MD51ca2b98eed20e38bdd4789653b904444
SHA19095c9b6059eb257a414ba988c1d7c24c0c96839
SHA2562b70fd5a714508c4f1197b76b12075b5ae959dc7935b60cb1bedd13c16a76f6b
SHA512a8fe93a3b718e29edd74cd052e2d826e9fcb4b5bad00366deffd2cdbf52ffe31a838e1d4d4cb3a456567849f1b9179761f35f5e1cf12c790f216076e3ee8851e
-
Filesize
5.2MB
MD50c83aed861fb5e6e219b615d1b9fdf05
SHA10516254b1ef94fad564a49f9fbee6d53ec1b2ebf
SHA2569421a716b25ba83eaf19f67b321dd711d48ea4218252a4d006d02dc5fc52fde0
SHA512bd22b28f8a5e337e62ddfa60b861323b467fcacba39c5f1eea85d9b3fdf085fcdafaa438722071ea1e07c0aa051cdad69e987a56f7721f18cb20757b4cbefafd
-
Filesize
5.2MB
MD59dac8b8625c8681f03be5f91a3a0cd70
SHA166c48d2ec92a78f7823013eaeb46c8f284932d05
SHA256d18a52d76420e3323e58f4aa499fbf69ea1155510018d71ff18b8e9ad9ea5c95
SHA512f4a80e2b16ebff42d80f57766e86b761bc572b59ebac0def7d4c64a8f612e56af3581ab60086085af0364ab21cf517f803c881dc34238bdb9a5959193bd5aa05
-
Filesize
5.2MB
MD5412cd45fcb8151ae3c5ec24e7255420e
SHA1cd05bb51f2499436a80604ac90d80bf2e9e5dd28
SHA256676239e2f0befe4c78d701f3a7df964f621fd649509ed01ae69778a23f3d2299
SHA512d799dd8c47ddb56f4453a24050f286619098413d895ffd35157deede72cacc3922a9067643b7c0dcf042d1b92afed8490118ce538dc57477304917bb85585084
-
Filesize
5.2MB
MD506b23ffe929bfa7541fc58542eee4886
SHA1717c1aebc3347cf399ca87e3324c352c4865aeca
SHA25656c796bd12c9b55003b6e94a0f0fe4220e2481cc28dd3f06bacd6f8b70546744
SHA51246f33240cbf574d9a2790c6bb16ce6155046677dc4cde7892fc53f88fbe1e287677c7b90bd011378d2b99b4402a37dba79b2b664f5bdf4d2f27e30fba57a2a15
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB