Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 07:31
General
-
Target
2024-09-17_4e0a28e11daa4483b7ba685f90f6cd73_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4e0a28e11daa4483b7ba685f90f6cd73
-
SHA1
374ba5af997d283e1e12ba55e4af76fecccf27ac
-
SHA256
cb72dde034b9f405b43c16ea86bf9ce7200db338faeacd1020163ecb5f88eb93
-
SHA512
923ff0c924d68cc4e146179e26854f7ac28853dba8b35aa8a7ba4d194dbadf1ce132271968e3498fafd2d1e56613194535d003d5863952212853e64cbe2d867e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_4e0a28e11daa4483b7ba685f90f6cd73_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_4e0a28e11daa4483b7ba685f90f6cd73_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\herlywJ.exeC:\Windows\System\herlywJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\alBJjmb.exeC:\Windows\System\alBJjmb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQsMHLk.exeC:\Windows\System\JQsMHLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMECTBy.exeC:\Windows\System\ZMECTBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmWSgZP.exeC:\Windows\System\pmWSgZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IicQFos.exeC:\Windows\System\IicQFos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zMnDsoj.exeC:\Windows\System\zMnDsoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfBesuW.exeC:\Windows\System\WfBesuW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EsQvtwJ.exeC:\Windows\System\EsQvtwJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWWghox.exeC:\Windows\System\xWWghox.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jUDIyxn.exeC:\Windows\System\jUDIyxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GFREkfh.exeC:\Windows\System\GFREkfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zeEcunf.exeC:\Windows\System\zeEcunf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xFbiTZE.exeC:\Windows\System\xFbiTZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFAscpy.exeC:\Windows\System\FFAscpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGFyLrB.exeC:\Windows\System\OGFyLrB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uLjgrFk.exeC:\Windows\System\uLjgrFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCavcki.exeC:\Windows\System\qCavcki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ckcPUzC.exeC:\Windows\System\ckcPUzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDMBVgb.exeC:\Windows\System\PDMBVgb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZXbQfC.exeC:\Windows\System\UZXbQfC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e7ae9af9ceaaa8e81a2783db97f7ae15
SHA1e87dadc7ca90d083cfa1efc328d23bfd85f50529
SHA2569c58860a5ac6c9b5c69fe0f9c39d4ed1933a0710e79b0e6e4df1d53925d1b8ed
SHA512b38ad6f45c42d5b6dc16f174a5978c8cdf6318240acf0e375fbbdd2f50e49e6c36a88c345b6dd5b611e7fdead83ab5348847cfbc1769c687bbca33e33187e412
-
Filesize
5.2MB
MD58a2af216ef47c5b68e5a290cb915dfa0
SHA1c9842bb9e70dcd7f107fb8afeab03210996321e7
SHA25642ff83e73fbbbd7c4e7a802f0e16d040ed87b5e114613c830ec92f5064aa3ce6
SHA512e057f2df30eb6bd8c3beeb793eb93bff0068b48a1440b6048034a216380f47dcf33f10cd1fe790071ce20032a39ca518be1aba5bae6fb760fcc8aa4a1c439d2a
-
Filesize
5.2MB
MD514cb09f9453bb55b92c2eb9c9dd0dc2e
SHA1a314520db6440ae6fe9c412879d79e09b8f69353
SHA25610c50c3ab8a4cde18c42fbbe312e3333ebc6e423e798654414a3221720c9fb1d
SHA5124f2b2a352889c4329f3b5d29fb8d98f3219e188fa10ccf2ac2f0fd2f32bfccffd74123429105af0779379a6e96a8e0367fac5ae1f465590e1ed4abda66e997f0
-
Filesize
5.2MB
MD51525318e0c90b87816f7587f063c14b0
SHA17c700de51aa2f7153520ea8206c5568c37b47c36
SHA256de69d55beefc3920b30189a5666f0cdf3c8e5f3827fdaa51aeea6c732f2d7a4a
SHA512d9015cb8aef291ffd5527dc90e64a1ab2d82e47cae64e27a609d760471d8dfe6289b2ff67e3b51bc22bae671a0b8c0b295f7293ca1207488d81a2c84f4bea13a
-
Filesize
5.2MB
MD5a97766ed909f153f81309e05884fe19c
SHA1dca0182724c8cb62dbc2f37257dcded27e084f24
SHA2564b725ae584693169b2c7298ef5eb6821abf0424087219ce31a2552f95118e471
SHA5128bd31ae4882d9a76519f0ab5520f5cbe69a7ef9682b55005abe7564ab5a0fbc9d9a19798be37fdbfc4b6e9e1f1913d946731858d9fa5ed0360d728917033918f
-
Filesize
5.2MB
MD5043bce6e574283a5dce5b0914b3d115a
SHA124ee296e6b1ee1c51597d1154d1e56bc5ee088a3
SHA25618991890033fbe132f81df47a16f6a0ba180940bc470fe4f2cba327aaed338ae
SHA5126aaaded25a1b463f53a746ad97d3bae6ea4204553d514a8bae6aeb9861097549258c8e0fff488b7927e956f9c18084664401df6a352b3d7d62e044cf2a671010
-
Filesize
5.2MB
MD50716383c3c6d9c3aba1457b80096e8fd
SHA1279c0d19a70e392419bff8feb63981a806eff242
SHA25699c24b984526f2a379bc23bf22f17a6a39b88dfa4eab190724b589a71e394688
SHA512c1ea6b915de1fb865ac4c4972226727800f7a2566c436bf87d6168f5a802ab0c1bad3d1f43b8d56a9ad36640a4ddd66b87b81f612f13c14efbecdfdc9e57ea90
-
Filesize
5.2MB
MD5207b9ca4cb1ce748c85bfe01d0ddf8c7
SHA147290bbb51462a02cbae8f223707c659fb0c7a49
SHA256d2e66817fc9214b0611a0c3ecdda49e61cff65409dfff19ff48a9dc0538f7228
SHA512a9da4fe5dfae7ee9fed314c331ab1e22aba87cd3a97d40435c981362faa133c8dbe526d50c8ccf0b176f0dcb32825baff734d13dee9fb1bb28c0c92bff5da74f
-
Filesize
5.2MB
MD55520bc481dc76da5c80d2ee2f8fab8d3
SHA17ab6c1c1538f32bcbd6521222026aa9b84941a9d
SHA25692242aa8be926cea84825ddaf9a244a901820afe983cea864007eedbebe20188
SHA5124e06f88aec1057a292f64a90265b353582af2eee3258feafcc4e1b46e64b448c770b1708f4da5113212b1c0cd35217ae1f1a2718cd9883ddf49f441d1ca824f8
-
Filesize
5.2MB
MD5166352f47d3e9f65e79b022cda10cff7
SHA1674e588600413fde49864683788a7c3223884ba0
SHA2566b02a26ece26e2f15a332a9e52347e280421eef3e0b30ac86ecace2c919d4019
SHA512a9c1737a5c25e864174eb0edfccf05b406415be2fe72f8f397602a146d07fabbd92e38c5af4cdbfe83f1ad1165c34f2e4e7176d632b1ade63250b140a6e2b4c5
-
Filesize
5.2MB
MD553f778ace93f4e64597267e17e22d0c9
SHA11e4f0c0c61c1bf9df9e0f223c004ca64a9bb35e6
SHA256c482f0e430e255cb56c9b197703e0665b7db4fc25d1e192fdda9c1dca629b56c
SHA51247bff7e21ae33c7275b83d97148a6a9108f6ffbee29f326b0e2b355b2c58a9a3fb4ab71a117b3886e36618e229034978f0ea4a84b3c8105f668550d0ebfb8f50
-
Filesize
5.2MB
MD5eb07299180c769b2c3ce8bd9dc08d736
SHA1c637adddbb7198a05c9327cc9172377a4e878b56
SHA2567d0c0206e0fa64f73f1cc7f0c440baa4b31f8c447713d2a2eeefdd0a58a8ecf6
SHA512d3070b31211bfb4ec08dfed13fa69fe1f1b6ef6cb1c78ea2e663dff2360c0c91f37ab2c294e40bf95cec8d019b2d82fa6693199e7e1febead0562d36bde75005
-
Filesize
5.2MB
MD552b0e755386e0535dcc27af1037c1aa0
SHA1453e0dfd365f7b1b47e43aba2f32fd594e8d83c7
SHA25611e2118cb7f32702db2a41bbc85dc7687dcca4ce773d84d9d575f820d4eb8408
SHA51277e29dee7a9b75c58a66d216b0f24007ec70a0527d8a4b1e32c5650daaa912b1087c9ae99408159437c8d3fdcabd91b9d9ec695b70fed5e330773bc0de31756e
-
Filesize
5.2MB
MD5bf20037d6640431c691c20007fb8ac97
SHA1c503b5500220b1eada059a85772c1278fa39dfb0
SHA256feffcf8d06ed08c3578a11ddc06e3425cc8d42a6e67aa90e41118eb5e707d46a
SHA5129a3201573f20ab81bc39ad45a69e7a7ee66afe827eb96d72eae8617218ede39faae0237b1ec3ff25853767aee386cedf5f451758bc60114747f3a63fe1d8ab6e
-
Filesize
5.2MB
MD5317b61bf9e43754457f8a4ad41b916b2
SHA1d276bd32b27fb38dd1653d63898b5acb58376c38
SHA256e32b8136883647a24355efba283098296a05f2c2f392e60184b7b723f8b7ca34
SHA51277027f545b54339db94dae97e7efe358e5f0373df7bf5f6e38a3e9ff92e14bc5c29800ed55790af26bed60b7324ffd825d92a5a40f816a011e6b7bb527511e7a
-
Filesize
5.2MB
MD561de9763116ef357fa204b16dd8bc40d
SHA1cb45d3397ac8553565bfe9cdd38445e9de600fb8
SHA2566bf8bf5e480db6daec3e0c3e970e82603a34769529c87c24e44109fcb9a6602b
SHA5123c1144c7077fdbfd92e9e2ac8185b44cb15311e45b7fe216dabc3f19a832a177fcce319c880bee7258f7b71eb8380b687ed80f09fefee6aaa1f304a43c5bde53
-
Filesize
5.2MB
MD5e65e3692cd6add4c7a063b6828568729
SHA1c4e7906a37c7eae106966754cd3b9c230b394e34
SHA256f9e5d39d82aec69829308680197b2f08751991e61523b6b577dc0cf7acb24925
SHA512e8ddfbbe97d8b366f6937d2e976a5633eaaf9739c4a4849208499f74d67db78cd3d2fa53fa8c85a44a690cfce06b53e208fe6f321beefe8a89eed8f3a43b84dc
-
Filesize
5.2MB
MD55cb5238f911f8f7b7e6b9b8cedf4a3c6
SHA19ba99eff60286744d0ee62da42204c457a52c691
SHA2569c3a59721fdc42bcb8f0130c477538c35fd809ba3362c3d4568ba9b3824378d7
SHA512e913cffef3b7341162c29d484cdcdf97e56bb4830c2fc945aedd5233558c32de7fada091244af2c49ff063621e85958f6d6a8e8ac662f8b02ecdd769c4601199
-
Filesize
5.2MB
MD5c8d52539ba7d4272843a17edb207b82d
SHA157e00094ce34bc21d8c8fe0ecacdd164a63904ef
SHA256e880b31c8a65368c9cff21c47a6c624d2f317cb796bb1171864a35cdd8580e65
SHA512bdcf570779ef02b46262d15c05162983b02e6fe516f0f1132109b9e01cd64396cae82f8f18276b1a2a206ad2ddb8c5f0872d4a6da32e3dc758ab458e863e86ec
-
Filesize
5.2MB
MD5ccab8c2ceae8e74ee7754c9205efb557
SHA1e453b088397771f7ecf0c22b60eab83b1d9b1587
SHA2566523bc5262efe7c8bf8889b4660a075f47146135160bb90623a56e00ed37017c
SHA5124ef9ae9b4d0a71e23cd0b23949a2ba091048822880c4db85ea11da41d549dcd8d2ecfda0ee0d2e1c1147674fa221ebd92b07cb9702fee11e62748144f19b4e42
-
Filesize
5.2MB
MD591fdee7e166b684e6ae70e2b1ccfa01a
SHA1943ab7013888b4e2df5a3ba0bce8ef63e103ccc3
SHA25610ee2d1ca43ae380281779604ee8e2f6ca6f3e53f8e7470cd2bd8a3e66ec9a07
SHA512179f557e76d6a95f0116db4e1563a15387f4c3c2a6223d37f39276c6a56196e4a8acaceb7cef297ff8f0a6a01a16f4ea06cac12a4507159449236e728444fa38
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB