Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 13:50
General
-
Target
2024-09-19_8c6ee039d92ed4292fdadc52d804fc92_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
8c6ee039d92ed4292fdadc52d804fc92
-
SHA1
9a1785145fb1fdd967e6ee537984d1843233d83b
-
SHA256
a8f197d180af1e68aa82caec4c148f78c4ecb5f145d48ef1d086c48afbc6f3e2
-
SHA512
5ddacec5d1ba0354f85b9fbb7ebceafd49f4d30f48bacafac4f05d614732fe51dcf31f708cfce26524e019ad98e3e586282f5529740c4421c66b29df90e5d59f
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_8c6ee039d92ed4292fdadc52d804fc92_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_8c6ee039d92ed4292fdadc52d804fc92_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EHUTFGB.exeC:\Windows\System\EHUTFGB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzgEaXe.exeC:\Windows\System\uzgEaXe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbHWxvD.exeC:\Windows\System\pbHWxvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTJDuUn.exeC:\Windows\System\DTJDuUn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLYOyEM.exeC:\Windows\System\iLYOyEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VyYkbZc.exeC:\Windows\System\VyYkbZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltsleWx.exeC:\Windows\System\ltsleWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUNlmpe.exeC:\Windows\System\zUNlmpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GmNpLIU.exeC:\Windows\System\GmNpLIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xyjjTvE.exeC:\Windows\System\xyjjTvE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilALtLI.exeC:\Windows\System\ilALtLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUFJkam.exeC:\Windows\System\FUFJkam.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PLzspMz.exeC:\Windows\System\PLzspMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KDvBrIK.exeC:\Windows\System\KDvBrIK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bcqCVBz.exeC:\Windows\System\bcqCVBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhULaQZ.exeC:\Windows\System\rhULaQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llnhHnl.exeC:\Windows\System\llnhHnl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aSCXoqd.exeC:\Windows\System\aSCXoqd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcxFQpY.exeC:\Windows\System\AcxFQpY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVVCTzU.exeC:\Windows\System\AVVCTzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhNtsGq.exeC:\Windows\System\ZhNtsGq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b465884c0ff3379003fb7b5ee066a788
SHA1f563681bb9f2226c450f019f9ccc6aef0ab120bb
SHA256e95e137d32dd6b52304ee90bf853d8235aaa287fecacdf1255d64e22474fd9fb
SHA5121217e23c4c17aa079b77a236e13096a33a7962e23de49ff2bd65d1c452c20affbf860e70ba281f436bd29b839694763fc4a4774cfd46a6d638594ec5f57a3f85
-
Filesize
5.9MB
MD521d0a29ae88cfa2c7d11282e4602d040
SHA1737fc6e1d6a04f4dabb85d040462c0e3dbdbe47b
SHA256b51bfa9c87ae931db48a565436ae335fa69b00d99982eaeec0677de3e14a8301
SHA5129a9792293acf2e4a14dbfeda240003b14b339ee8cdaa04ad72c5188843378451e20b8bbbfd47cf285f588b366f266e19221c7443a033d55ae7d299d2b9462fce
-
Filesize
5.9MB
MD5f09b5c11a01dca2db73bf91dc5ae8296
SHA164803c03d252f4b1562eebadb7636a3dc5259b85
SHA256496db4ccfb5a8c0ba5205659d48f4a1c8d7fc77ab01b468be95e6387d33a71e2
SHA512ccd1165f26aadef4ca0a7c46976a25ec9606449402fe124dde534b7a6a038d8ae310fecf330b35f8f633a62fec57afd8d68a5fa172a6f15354ffcc177072f3d9
-
Filesize
5.9MB
MD55979c32864889d0445c431745aab31bd
SHA1f699f940587d3c43e6d324c90bd5971c616fa75d
SHA256d50447f811232e93da1c6fbb3fa5f3326623390115bc1c6c9f621639ed431c2c
SHA512dac13d35eaf22310fd5bffe50d028c0be4109d152ecb91d516722805fb78413ba4a35eb45403ab1941972da672b65950524aa7dbdf830b06af85c2d4bffbe9fc
-
Filesize
5.9MB
MD5f6e1a6662e8b2789615f111e963563fc
SHA172f9f0e3e93641c991e5de9761b5c0809a742fdc
SHA2564ff098b915a097b5c596deea89bc365bda9cd2c3a975e1e245822797c19cba72
SHA512a08179146ab836868208471b37e5f3a6231508f4be1ed9d01cf1195eed2ad6b51481b04647f5783747a3556aae833a990550676db52ddac61591e2a0a2271a3e
-
Filesize
5.9MB
MD5a961e6909486cb09b8f4626d1c2f810b
SHA180848d978224ea0a34e2e51ed0f48911506727a0
SHA2567151f5ec70f0e551d253d9e10e0d32156e1868b181f6e8c44522978bd75a9e68
SHA512d8857562256bfc48ce6fb200e287b25f3389a81a7cf956faaded657e6b9117204d60015db6fcbca4dafa4b4b116e3e8a7b75c76bef47f5aad44fe0f8b19b04e0
-
Filesize
5.9MB
MD517c6c30920893c50e2ee69e14c3c6e44
SHA15b81ff138a4fa67cca3b77de55de012834082df5
SHA256bb5831399d136e4c21fe7da3d223c4f8c13cae549085620c321bf811d7a22d1c
SHA512280b538ed9c6066f377e3d75e01ac899e4c3caf0b8bcc3bf13afedf7349eeaf5c167177605953e56b15c20e4db5f6aece66ae0fcb87c2a6c5bea782529fe30c3
-
Filesize
5.9MB
MD50d4b43dd72c718564584b47b8393df52
SHA1a532b85f467154fdd55762777e6a44fb250f410a
SHA256dd3da42baaaffe712bfa2eed0198c5439d0894f1b37c644ab6b82a6ffac4cad4
SHA51251c50bc5633704085253959d9249aebe72301be5928139dda6db862ddfb39b7b8a4bb2963f7bd917b51253c00cad2fba82157b3e7d9d9ba0d0fc47ce5af20ad7
-
Filesize
5.9MB
MD57d1fd29998ffdc95e5048b8a6ad391db
SHA1c66733d18b0c1995a1ed4da84b24dbd888f78ae3
SHA2568eeb0c29a7f16704733ad2f1cbd5e1a1dd63c6fd1216d976d2169deb9a6eda1a
SHA512eed442d400645cf6e3055e78bbd55c8a25af10aaf384a45a81efacf6962b2c895456950574300b7ca03f26d1e263ba2483586127cd950aeebe12b28265ea8f11
-
Filesize
5.9MB
MD5488e52a2fead8261fb5fad99398b7426
SHA1b4b2cb61163347d604c6c8e08f9c986993b3b11c
SHA2567aae62f1eb1c605a9c8d1443b2cb92eae75dea8b31200e4072b406727fae753f
SHA512b72cbc24c68f3ff1a733d7d54585881980a4370a65aae639c7c1062d698d4892c74f01d0b9beb68820df7c86af28d86c4d1f0223b1996f42c833ee94b5bad970
-
Filesize
5.9MB
MD5de66181b033dc1e4f89ed0ac5bacac29
SHA141b76fce2f1a2e79600330c18e8af60f3972f7be
SHA256dccec6a2a7c9a393c7142ea29185542e892bac13fc5e5e79347508c71a80d87b
SHA512b04f5bb59d29a06ca9e53b034472eb24d72faf7c04eb9bbae78acf3c99abed20c79dcde864d3f62a9ec46ed9c52484643681336069f3910ea4d9d769f059a80e
-
Filesize
5.9MB
MD5a56fcab8634cb1861e38a1e4e2abda1a
SHA1e70e88bf84b36f4373e5a552037dae8ce6e17d08
SHA25635bd1d8d7e1b5aba7d798e68b7f65b3bc1198e6cc225075781575eb12ac4aac5
SHA512e0c055f32a2e09639f54b9a81a12a82f60ab12aab36e441e97e61407d4c91a3fb27466855891e7bc3b5bc52e428a18ca76e146c5aacb4a88ad7b85a76228a771
-
Filesize
5.9MB
MD5e0455168ebe45be6b4f02c8bc7638d12
SHA14a16abf28234bc4b1b46cc0457d59601e779d2fe
SHA2560c5a0a54e092d40579dfeabca2cafb7771b6a7ad7ff93d64bbb04a008885abce
SHA5125ba96ee99c90dc4d756d5faa1435d043e6aeb6294bfcd75d7c92a4509ad7e588d64fe9e063475e8647d89e6d6e2baba37af4ed3a51a2ca33e3b8f01902101d7b
-
Filesize
5.9MB
MD5c85edee51abec75bb62407aa0d4071da
SHA178bb1a8fab4a904df2e5e1630faf6e2c9e632651
SHA2569262c9542f5a4cc5f802f3bb30894d56787934532117aa028442e445985b1476
SHA5121ba8506e7251a9107705cd9a82b86b57a9cc968c784f1bb8dec810103c684ba6a6e6cdd143a771bf9a2baed4b0559cd959d3aee8b666784e340a75d44a6f7a33
-
Filesize
5.9MB
MD5c37de58514f848704b0553f6922153a9
SHA123136557455a4facf98fde468677b1e6c17531fe
SHA256a2ec56a56f8c04a9afdd71f201bfeb975bd9b55bdc2012f35fe07b6a035b3db5
SHA5128cc110507793f820d2defa7bdf287a52eb8304c4f36e607f8a90e358774ce9e53398407c69181bdd11b7ec1eefc37bd08b1776783c91fb1f6b6f6adfe5107246
-
Filesize
5.9MB
MD5a02982a1fb70208813a7c2a6bb1975d4
SHA1fc36efe391b7534600b17e12fa84dafce6487b83
SHA2563500390189c1682f72e7d1a5c0ae2fe29a4fe94358af8b1935578a7fe78f436d
SHA512ff5194b11da4a8b92c8d157ffeaa1dfcd8a2688f314e2e5d6a8e96509e880419a495ef9ca2b24d67ffec92b0b3d69cc2392e886b15bdfbd35a36ab6a2d103124
-
Filesize
5.9MB
MD5949018639d0a39cde8096f15e309b236
SHA10e9b05313690cce2cfab23e950c7f9a58822c005
SHA256080f798a1f5e90e16d7b9c2f934a2261ac21786d35425fcb11be6aff7b8f405a
SHA512f0be040a7e3c1061e6e5790f556129a2c5a605236fb7da5961f7a95d968be57f275993dac94bd4f004a1b0ae28ca8ae722c883851cee5d23a1876c93fc9806a5
-
Filesize
5.9MB
MD5d43d7b9330945eacb0653e5b5a93c94b
SHA13c1cfdf9c9957185fdb963df5383da780272271d
SHA256a0449f5a15120102c5db961cdaacad67f0e78496787095c58c1b91c080f5362b
SHA512636ca35cd85fe7b1bd0a85ebd49b14543f9a2ea146204bb1b68ca7c0a15954e15ecd30f96f69c2a88dad9c1db10837b75287bcd5c086b8e822bcfcbc9d4dd345
-
Filesize
5.9MB
MD5ef49e1eeffb7cef1219c3cd647aab1bf
SHA16a5e71a3e77d637dbb1592a8e34edeade10fe257
SHA2569a86a2bfefbc203f91533d23c66c6ad38a05590a241180cf99ac5c5c62fd1567
SHA5122b7a90679f801539884782c8c48bab01233682e17aa8097a0bdc9f2dccc73ac72d8c343b5ed74c7c9af855fa633ec83368aed3561ff6aabf4e8c5aa5c52e1c14
-
Filesize
5.9MB
MD5fc2c03c6217f0509b83f93fcbb14197c
SHA1981668aa1f4f6be084a1b2bac77fb50496836324
SHA25676718b67aaf364f17a19abcc3e1e46fabbe6814e071cb7317537108cc333940a
SHA512087194e28538285c41a71e8d57e859fc532b30a660fd8589e2ca16287e7d71266dd323337c18d7b33e9e33b68a1c8fc044e2d407c47aa5f7e7c7eb738b324341
-
Filesize
5.9MB
MD56628b35d6323bbb05928377746fca771
SHA13774c8b23bbe41b27cc483c7ebabdd9337f1cd50
SHA256962c3cb474cf8507d73d6929f8a082514fe0121236fc69b82544e4b856aad9d5
SHA51203f00d5d01656a62cce3cfb17533b18457335968c3b72baeb11578b160fc73a7debc315322e7ec4f2d0e56c86ac44b5ab512359247710ea82babe668c9baed91
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB