Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
19-09-2024 06:47
General
-
Target
2024-09-19_1b150ab288b289beb6e1f41367116282_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1b150ab288b289beb6e1f41367116282
-
SHA1
1a3dbc4f8b46af4712c49b608fcf7b23b30f61b8
-
SHA256
21a4998cf5589ac985617c9a3809dbfdd0e81808e0d510f3f597464e006c5969
-
SHA512
903df31964b4db1711042f7f5995c001dedae2b69d6945653e673d5c13b128aab6151feaba03f93c0bb2097bb43f43e5373e5ba97c04e2cb24e5c5386ec656ae
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_1b150ab288b289beb6e1f41367116282_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_1b150ab288b289beb6e1f41367116282_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mZkMhMH.exeC:\Windows\System\mZkMhMH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNXXgGz.exeC:\Windows\System\tNXXgGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCVrFbQ.exeC:\Windows\System\LCVrFbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rsGzUNi.exeC:\Windows\System\rsGzUNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVCbnqk.exeC:\Windows\System\xVCbnqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wLMLDqx.exeC:\Windows\System\wLMLDqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VStfAKk.exeC:\Windows\System\VStfAKk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRVaeDr.exeC:\Windows\System\fRVaeDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvLsmSx.exeC:\Windows\System\UvLsmSx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\htGBmFy.exeC:\Windows\System\htGBmFy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gYpPGAv.exeC:\Windows\System\gYpPGAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDJFAtE.exeC:\Windows\System\HDJFAtE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HfPDgYt.exeC:\Windows\System\HfPDgYt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qpqRvKE.exeC:\Windows\System\qpqRvKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uvdqxmc.exeC:\Windows\System\uvdqxmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dCiYzUL.exeC:\Windows\System\dCiYzUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYTEPhZ.exeC:\Windows\System\VYTEPhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GWPGJPN.exeC:\Windows\System\GWPGJPN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSSUzEm.exeC:\Windows\System\PSSUzEm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jChTjSe.exeC:\Windows\System\jChTjSe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\grmDwNh.exeC:\Windows\System\grmDwNh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56fead01c67fc635a3ba4235a8dc9fc71
SHA14f02ecd5fbdc165d4d4a5ae4c0364ee2e15a00df
SHA25605c3343fe21091a8496a04b04179d591d84abf1aadda8be07b2dfb9a0bb08b40
SHA512679233a3f9f0f9b5444c4be77fd04323b8e479ca7aa96a23a5cfbd9bc74c31d059c512b38fe501a563f2315baa7b84d1da6a35f948e4f408c4571765f8056d37
-
Filesize
5.2MB
MD59d1d71b0824b67e55a3a9f5d11a74bbe
SHA101a469177fbf4ce03283ef0b19b7113e87fa44c6
SHA2564d489dc892edadc951851b2f76552e9e1beccb22fc8dae14ad78685b1e1cd28a
SHA5124e58f02afe0d670f4b1d8674a5c9266f2d0fed802377d5fd8fd59f02587cf02be6ae9f68efb3ea4edc26910651e89a6e84236a30d58d6db4cda7229f2759edd1
-
Filesize
5.2MB
MD5128bd3559bd579512927c11ac1495852
SHA1ebdb3862dc87c70a69a679afff8ea57aafebaa88
SHA2563c71d204bde2ce410372455973d8ce0db027f05b68c22c4dbee1047c4a26555c
SHA512ea9a9b7a52f5d358cb3442cbb34ec6d2f770b53eb833395368ea03076c15cfe34e542a8cac5818a0a0b77b884eb20e725d83b624863e8afb53181169b132ae69
-
Filesize
5.2MB
MD5eebc1cf60fc93a4baccbd99478d6f28a
SHA134230d21da457e8e8af064bd50e4e225af4bf4f8
SHA2560d50a3b2d1a16d03c6d91ebde1a9467b8cc03cdb08a15a915901fe54f6cdd22f
SHA5121de0f29c3c8baf15452083be755fa84bc31907a825d95af3f9088002cf0ede2cd99481b2dd11128cd78029850e9f828473903e3981b1186e9373dd870d6d8756
-
Filesize
5.2MB
MD551464d552a913719a42df38c69e6c25b
SHA15faa7ef37569d60cb960cbc2def52e1af0841b51
SHA256f93bce23bda3bef98e1bd93b219617fb6c45724265b64c125f7decea26cd14f5
SHA5121f961bcec6ad08c5721bdaae5e00031ee9f51dbc9713b359ea9708922f9986729e9d087e2d78afee5af71291e1ae8ce02a176105a4e48411d889adc141c088f9
-
Filesize
5.2MB
MD52342b6a71e3eaeacd27feb8c6985bfec
SHA1a5a082b32ea2e3c581a0ebf1f609b2d7dafb47da
SHA256c56120c7c33731dd638c1c2572f0d21c16bce70d54656d88d4844dd63da2b73a
SHA5128847e113870f00f8a97f4f6d6a623c2a100052c7c31ecf1a6078289f9789de3ed943505e866eb52c47f5cfa1a7a89c9ff66f310746c536ceed018abd6379510b
-
Filesize
5.2MB
MD55880ba464728f089e1d5fb6c60a1f8d5
SHA1f9a44a81fb6e9a42fad0a19aa6bc987e22ee0159
SHA2567f45c5f3a5f9e2e32b9e9f6222ab0006ecde3825e769c33beaf22f4798f3bd6e
SHA5128d877bcb7f5da7ea74891add06a2273f98b2298a87d150e7ea51ce9f50da8d1ef54577fa09336f410e9bc75980d118a1d2270b18eea95ee8013d04ce0f9308d1
-
Filesize
5.2MB
MD5d9e4b36ce6cb32cb1cf9731b1f488fb8
SHA14420f6471ae7b6d928f951b7eff866456700e2e8
SHA256f4ba27a1c640e84eb6034e03fdf3d7d5536438f9c4c27fc3ff9cd9251e8dd068
SHA512ba57b77467fea3e687fd5e5d59ca96419f907f1956b047d31292477381e2f3ba26089d77fa5872da292e4c298c0ea7b30946c78ed676d122e5fed80df23478e8
-
Filesize
5.2MB
MD538ed33d62243b4cc2c1e8683a71d8e6f
SHA1218c51f77aa95e0a995322156406d6360142423d
SHA2569b7374237a5cd419d30f3afbdbd2b6a000a0a0ea554fbb207359c543a6916e88
SHA5122f298e2a079832746dbdb800c7904c02848bc3b11bf77fa36ae6ce941c2471737dbc31aebee63b04ffbd267cfb50067dd4d8a11925a5259af972cd1ec60cc4a8
-
Filesize
5.2MB
MD527ae88a3c6d2a827c6e1bc25f4eee022
SHA1589a06970f6deb6d4b6b81b49c49261d5d150e29
SHA256a0631a655f16f899859061a26af9d8ba90cff23dcb0ca40a78c1a0de7faeb886
SHA512192ca4975a91158d0a87561085f97a49d48eedf16fc67fc9581ffb7170816f9aad35fb4957f30944dbcceb8628898912f6ffa54c03780cbeebeb64581e1c4e81
-
Filesize
5.2MB
MD5e3e348871a7c54768ebed7800e2cd8f1
SHA1e19b689cb0f5802c76b3825f1bb0fc3e85accf43
SHA256944cb473e52849a47521523f3b810892acc18120deea35e167f3a279b5b877d4
SHA512b66ec5fe133963a12b7380a8cc1c6023d8acb35274c71e85c0bf9844a4580197b64aca221a033b8b59955f756d5555a2bde069088f9af5043755cec6dac7c395
-
Filesize
5.2MB
MD533551db3e45bd0197dd9aba38f885bcc
SHA1f27dca558faa73657acd91e9143ebbd6898e6190
SHA2566736f8c5246f78153249f85bce92b5c9b0cb6250539e200ff59b6489429fdf8a
SHA5126743c1c6aa96bb82e17430002b024c56497da13af2b55645553d247bb4cc8f6113dbf84421bcf51950c58738a1d451ffddb57584a324a5a1d0c0e49ef48e0ded
-
Filesize
5.2MB
MD5b567bc2d9748acf09402636f77df78f6
SHA18063f21dba3d270c846fda85909f5b6742e9b5ef
SHA25698e69e8f4306dec61fa3791272131931d475ad310ddca29ab2f47c82eb87eb47
SHA51201e547ced2445456c9b27317d69e8c9367f7276a87dbbb651ce21046406b7ecd4f6cb4be78637eeea0100b1f557242bb3a8459e0102c7fa5adad7f3b35465f6a
-
Filesize
5.2MB
MD5d0a1f8da3d85948e0c7346d8c7b24d3e
SHA1e45a1fbb8f41cf3684f390689588bb29008af243
SHA2560b6cccdfaec44f0e0cc92d85dd644913e9a3a2b50ab454d4043eadc559883516
SHA512b4d1ecf5fa1d551258f9c45caff34b6429c17d7be77868dda2647f7a8b55898866aba48897f37fbb283840a8116262a7bc9aa0ae28351b61455b179476e05b85
-
Filesize
5.2MB
MD533f94069d51a1b2900fb572115737230
SHA16970c997898073abedd950e9c1ccecacb2dde25b
SHA25653192cb75a3b08a60430c593b26519589c95c2699ff88ecc6152368c887d4ea2
SHA512565eed3be0fb7305cbe07302cecdb41c621c3b325808670bf175e99a365f06882d97cf4e22b1683a7bf18e54c1f83f742cde188837b584d3a8fdb801954d0666
-
Filesize
5.2MB
MD5b093ce4a5d622a1b5dd45806205685a0
SHA1c626f6aa95ebd1db351b1798617db6802a718608
SHA256ad9103e4a2a4e0167acb6d1552c5b56df0614a79c94a41bfa803dbec5b1b318f
SHA5127056970340917017c78aa84d93b6fa05212ee9005d125ba9cae499570b6897c1f7b8d61c5a47901ce1822be7702db8d02a4ea262bbe94a2ec0521fd720feccd6
-
Filesize
5.2MB
MD5166b686082e58670962b33a18b5a679c
SHA150a0fa67042a76d87ef9f8f246d2452ee8fd6e82
SHA256ad9f538009d77d13e7216da971f9e787d9b648f6fb04f64153db65d07f8a8578
SHA512fc0415871a6c9705f83c4bf43fc9965cb8cf16ca67dfd88d1fcee35cb9e193f57f9bb17edb296cd8c4dcade72454fbff65c94f870cee9b2c8304441ac9949ba4
-
Filesize
5.2MB
MD5bbdcdc1270393f90008a2671be3b8033
SHA169f607dd513e53b4028257490bf0a6dbfebf0093
SHA256637bfb6462bc6344b441a34daed4f4a48ea6e31418eebf0c43971a2b387662d5
SHA51295b4091bfcdac26730081bc350d1d765c484e689193db7237f0283d0454f807ac7a565c4bfeeee6195247e155dabe66d8e54445db6c63c1087b97ba491f8e13e
-
Filesize
5.2MB
MD5c59802a40abbbb3f53e5ea0d207201fe
SHA1ece9ba8cd8d64b91697df408d1cc72b7cc44d001
SHA25607961483b5611bf3395021252184f5b4e8d3be14c6ef7711a8319345967e0832
SHA512be5b4cd2df43af11056b3a7a6e6edb9127e2a98a194dbc7a0a4e2d6deade696fd5f8dd5bd763736b52f6668596413f621782e576428866e09de90413e16ce8ce
-
Filesize
5.2MB
MD5bab12d34914e03e0bb58623191086321
SHA140b98ff3d4e9efcddad83485891f5568c83e9531
SHA2566cac6f2652246e1aa106ce9598db76c984e1222862da0e0b56328d182fb2949b
SHA5123641514ce4afe4d746274aa4ac81fc822cc8f5b764a52557859e6e5c04c6ccc783d9f8ba01601be59597f18a1fe01127213ca3c3a1d401c5d33c47ad3659db7e
-
Filesize
5.2MB
MD554f7d6ca9152146ffa329323e957301c
SHA1d76565f6f48a522d15241be5c7e4ae2d659d7494
SHA2565ac1a0d3dcb65826329de7f02b619eaec55a8cb06b7312ab07f0c08f549af706
SHA5120236d9f96c3531e6ee35ad0c1f2b04c44df0c5bdc7f16dd3c3e3bb56c833618ddcad4f2ea121f7186f05aeadcaafd90e1f1c859f6c1bc88962b3ee0e79d2fb8e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB