Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 06:45
General
-
Target
2024-09-19_124b1788266d35a995f0a06870a95865_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
124b1788266d35a995f0a06870a95865
-
SHA1
9f2e6b7b308030c3561d7b1245b6abdf4191650b
-
SHA256
dd2bc2af7a7a1ecb699a0d88682af2397d7fee798ad67631deed8f51b2551d1d
-
SHA512
7fa05ee6b938de206c05261ae5847def74424306be2337bff85a3e9c72f50366e7d9f105b8f46f90a512009c3141a7d31c6e020d75563e2417ba14118e06d90a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lUn
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_124b1788266d35a995f0a06870a95865_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_124b1788266d35a995f0a06870a95865_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uOXtHPH.exeC:\Windows\System\uOXtHPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzwbwOR.exeC:\Windows\System\IzwbwOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emLkeIN.exeC:\Windows\System\emLkeIN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TYJqhKx.exeC:\Windows\System\TYJqhKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKYxyjC.exeC:\Windows\System\HKYxyjC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCvCQoL.exeC:\Windows\System\iCvCQoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IlpgwRP.exeC:\Windows\System\IlpgwRP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJBhvRh.exeC:\Windows\System\xJBhvRh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RthnrXr.exeC:\Windows\System\RthnrXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BWDaXdO.exeC:\Windows\System\BWDaXdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGtfyhb.exeC:\Windows\System\aGtfyhb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bwxOLBv.exeC:\Windows\System\bwxOLBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agFEvlo.exeC:\Windows\System\agFEvlo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHUiPcd.exeC:\Windows\System\pHUiPcd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVUUPFE.exeC:\Windows\System\HVUUPFE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bhOHJuT.exeC:\Windows\System\bhOHJuT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzezHDw.exeC:\Windows\System\mzezHDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxMKjal.exeC:\Windows\System\rxMKjal.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vmjrndr.exeC:\Windows\System\Vmjrndr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCsNzlT.exeC:\Windows\System\NCsNzlT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AUMCelI.exeC:\Windows\System\AUMCelI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53dd945566cb321edbfd98612a499e3ea
SHA16dc09cd51455d30d17a140aeb59da6b2f4b8206f
SHA25649e67ee5eff146d5f406f925005c58b1718183f338cc1f032439ce85978c3669
SHA512815aecbce3cdd1fbfb54e71e94f26cf18e43d4cfd85edbcba2b9c4380bf151b5d4eea36f0713fc22d28c9371188a277c037a037d55fe3dd3f0cea06dcd3b322d
-
Filesize
5.2MB
MD57ff92a3802cd42832ede8129fd0b127d
SHA181ebf4e3a625d373a20d5886d1c37bbab5426a53
SHA25601802172263f123e2e5e8169141028b4a4cc8f5a683a5f0545ab189f6d6f9d04
SHA512777596d31cd58c74ae4798f3f1c131f8b4e72637cc33f35fb9e2a327d5d4412b7d9570e3b5d12ed140670e00eb24b1b72844691ef8cdab18c5840352ff768119
-
Filesize
5.2MB
MD524590230663ffa644c8b01a358955699
SHA1dda9a17064d4f982bb73e7eee790d00e814568f6
SHA256eacb99f8dd578385a88fe02e672311f5c11bea726cc73e25b577930aaff07107
SHA512a6a45c531647f4fc082d23dbb18f64f0bc55e73227c3f3d24d37fa5dd50c7e9e05e62dea2b8b2097fca468824f30fd0afc282748bbb552325eba9e7c224771d2
-
Filesize
5.2MB
MD59060dbf154a6cf109990825fc6c13096
SHA1764a5cfedd48147acbd99256a96fd99c5791e351
SHA256c924e27689526e3a3b55371dd7fd818a3610ad9848f0967831c177bb11d79292
SHA512c4f209b70c9cccf73e699a29bde3e41d566e1378ede420ab4e2977f51e78cd568003b8ab8e0768f727b14e6ad435ff24b2b0f62c1ce173da3b195204bfacf50d
-
Filesize
5.2MB
MD5fd212969577afd18a6b38b03a206844a
SHA1d069ccc7e62a93b45c39bb3f3f58a94d9c446976
SHA25647d8cad0fd8378b47a2e6aaa3f6368cf74bbb6c572f0c042571ff514a094a7d6
SHA512a9e8a86b7e525649b2970d705ce540efe6f68902a8916f8567a05d5f3c7b95c3aba5a7619c02cd1eb074b20157da3fd33ab6749528782777ce952ee35b5afbf5
-
Filesize
5.2MB
MD5ec10e04e5657776db0b1920e7d8115b6
SHA197ad095d99070cb8d444eab18556d4bbe3123411
SHA256b2c6d98c03ca4b902e81f52f0c8a225ab207d4b75dbd3e8b472adb7faba1f7a6
SHA51239d781ffea70f9fb6b2c76b29d33f5307aaacb36dec791d0f929f4527243f734c8454c7e28ad4b8cdbf2eacbe09f97af5c5b414fdce1ae723681640006fa2897
-
Filesize
5.2MB
MD56e906c25ac6b0fde88d15486af669ef5
SHA1c9e8b11e522a294cbc58935ec346d73fb033d444
SHA256f66574e04aca7dab86b6ce3e59b53c6082802033ca81e591d10d97cff6b45470
SHA512ee24dd244b8af560fd5b5a0d8e24c7a7d1c2541ad43631c2b00739bef47d4db4b03dd493dab6ae4c8cfa75eb35798564af7caae27b7ede43846f3112f4ebf824
-
Filesize
5.2MB
MD55d9ed563aaee16e59b3a9d024f4a5ca8
SHA190666cfb8b8482ea590d6eb3091ad7564accae8d
SHA2566dff58e33b9d00ba6582a7cc572d913692a0538a2c4f05a0c861597ad4c1abde
SHA51294a074d5371bfbdc876706c7f61e340778e1c8b0cd9a16651cd1d2f0e9e1e1bab1eb89d79730dafd310bd6399cf5298cd0fd858509b4ebd022fe0c695ffd61e9
-
Filesize
5.2MB
MD5f53c614b8c9d57b286998f8320c0af20
SHA1bd05cc370c2e2d4939996ab5920d0624a50a8cf3
SHA256dbae57cf9bc9ddfb859db0de0577f37245a98e8f065c285316cddd29c1c598f1
SHA51264526a91f317a02a2051130e3a9d95d6eb7e7a981e3244629a93eacb1df3d42927c7a34fbe73c27086346e380062631ac9db8149ef55d11f9db4993cad7e8878
-
Filesize
5.2MB
MD5b168333b52d5244667415cf30d4d73e3
SHA12d5dce24115071e27d2593b1357e9159284111f0
SHA2564c98bc9bafba37cfad3da26520f3db1fa260444589e2ca188fbcb931982b50e2
SHA5129d2206f8a4158e5b7ebe8f0f6049a345e1515dc4804f9d49d75b17006990ec5720656f70d4de2430ab0e0a3743a43c2011afcddcc8d02890eb01cd4c9054bccd
-
Filesize
5.2MB
MD5bf35be83bbf409a3e88b59f47c43a06f
SHA11f7cf8cd19d1b0e6be67ea729f15fcdd91d9a358
SHA25649c71e0a1a6a8dead0948c0f50f668334661011e1423aabad447df7bfb4fc3a5
SHA5122bd890df7228483062ed985ecbbdc759161fd5c1dcd56b589ff445bc06893b3f808cbd5941e17ed204d3dccbb7adba34e885d71d664d6329af6aac23cac2c6d6
-
Filesize
5.2MB
MD595320e94cd06e4894a83211129d1d603
SHA12caccb51f9460c8252d778bfa022538c6f7013a9
SHA256d17d66bbb415123621529ee6a482feb871acd2a52539719b815b66a9f4790cc5
SHA5128ae6b9f4820045be08104ab166ae6c8ec4c8ce28afd2d6d6c26ab5e5fbf991038f4c5c6165ba4ba8c237189dbaf3b8fa548b38192cc49bcaa7454815cc292b93
-
Filesize
5.2MB
MD5ea719b7d82c567842cb4cbade304f4cb
SHA1bcd975b5bd404fdc8395d5d19cc4e408c8ecf98d
SHA256a9dc0d469a35a0c8ac5d3019f1b90de2ca6c85ef6bd8f6ccacfb2639c2eda24f
SHA5123bb449327bcb6ad53e4dc2eba84b3836b5f178523a8430b9c630b8457715794edbbd3dce91ac1f0097c42f2d6a5c2a8a63c4619d297bd65df5c04aa6efb3b821
-
Filesize
5.2MB
MD51d309b0e416eaef45cafcd0980c88f6f
SHA194a93ff07ab5d397c0515cbdcb53ae5c49a088bf
SHA2563f6b4821dbbcb2dcea46933adf9e632ccc8da28298fbdb1c2bbd05055ea0c056
SHA5127bcbbb1574c4c7b1c7a8e4be5f63845204cfe41735912a4ba7adbf5e31e42d9a96fcae0444c98202b9b97c9b9efb46428c96b25f2ffe9c2aec049e2d117430fd
-
Filesize
5.2MB
MD5ee8a760fbe74441307e602bd67c9960a
SHA1da0e3cf61aeb0e276138719e168d71db9b9e5b2f
SHA256769949d314050f4232a1fb406a03ed73c8472974e82c44ef4789c2b5888bdf4d
SHA512b19ca078c8c75bcb613956043a53b663be25fd939b30bf282ef85a45d8fe5dbd9943b6be2ef150da8e703689d02006a352c96379adf8e712cc98bb6b25dfd532
-
Filesize
5.2MB
MD578e87eaf2d21ff51f55f768bf6de9460
SHA1078a7729de30add506c627c5a88f867e7e88cec1
SHA2560dc998aac83b18abf6682a8f30582e7793e6dd9852c01a71dd508f79ff4bdfdc
SHA512584dd517ca1a84b86f429ae3808f6d843dbca1a38c4b081427dda9d38e8741bd533f68002cf770b4981f8339e5a6d5fb68760731bb761fee10918f96d11e32b4
-
Filesize
5.2MB
MD5fc879e6c88fc18695280551210db7d6c
SHA182bf53751bba0168f7d02e01797901461567d026
SHA256c98aef70d4181e7170edafd10a400ab5bd2dd434e828e858011b6d8d2b438bc1
SHA51235d2b10d614e4750cea93ef7cbfc14c74d432b097b5578ac913865a3baa1274d5aa9d73d9a5f52fe67a12c12bfbaf19ffc41df8adf1b1617c750d77cd3f9c51c
-
Filesize
5.2MB
MD59c1fd2ad54d8f97ed9c9fd020f406655
SHA12bac343b6b935863f2902815a92899aba06c75ac
SHA25679c9ba03f17fded93e61803fada59c89b9749e7b4b2f356f6db402ea3a845284
SHA5120dc77456f7770f85cf51f90b9196d3f4b22c997f46ae7dfaa630b4ff2202b092e1340d47debf9d653c805eafdd5dc48a5a97c1b46e0455f60b6d86a497565eeb
-
Filesize
5.2MB
MD5febf6bf78e6379c4be2966c01e5468e6
SHA1fe83cebb378987d6449eb6626370cb4fd2b950f6
SHA2567aba7bc143bc707393f0649237fe4c428b1d685995f048b175191697895022f3
SHA5124159e10ce6bbb51d425e9e8bdb93c0a3a1beda552ed36fd854a30bc96cea234966b069f94c36191da69c85e147c7099ac51953726cdd56266c6c3ecaf0afab17
-
Filesize
5.2MB
MD58ba38a515af75d990833febe0dc04602
SHA120c5c46996022d60336c31379ca697b2af752fca
SHA25661b6ef0885a25c25ed20256b17c6fc237f3a70c1f8ad1cef416f2cbfc09a666a
SHA512c18a27439043487c81621425c4bb6ba901ca5be474b7b924ef7c8cf0b79def57a9c09d97ee1b19f537c8e52f187f0d783e9403a0bbf60b69dda1256ac88b1eb1
-
Filesize
5.2MB
MD588e84f4fc1ffcdd39ce3df205ffdfbc4
SHA18556bc953948358ac00f4e94b7a772a6c607ca46
SHA25688a994d189e7dd5f995e4169d77bf9f802bba328844beb8ce8bd10420f719c97
SHA512df30dfd8e19fb75b44274fbd0b007da0e2255a08e691fbe480a88bfcdaa3465b506ee35e94fdedd3c525517d9aba02d939b745d8786df810e689e91760ff57f7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB