Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 21:48
General
-
Target
2024-09-20_48040e054888637f6be1718d1716ffdc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
48040e054888637f6be1718d1716ffdc
-
SHA1
971fa10a90d1d2a547af6107a23f578dcb728004
-
SHA256
0c4b6b73ece5c338036a6e2c5993ae9da1bc38f464079e542220b4cf74a29f40
-
SHA512
81a6a686e9222634a8c259b40d26037027e3c2e7873ab6c83b4389758c01dba92c5ddd45b85725ceb12c7ead6f737b6fab76ff02c93010d52931a9fd611e698b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_48040e054888637f6be1718d1716ffdc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_48040e054888637f6be1718d1716ffdc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fFWYyrl.exeC:\Windows\System\fFWYyrl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRHcvVa.exeC:\Windows\System\IRHcvVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xGouGMC.exeC:\Windows\System\xGouGMC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQZzdpu.exeC:\Windows\System\wQZzdpu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGGfnYP.exeC:\Windows\System\AGGfnYP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\svlVBWH.exeC:\Windows\System\svlVBWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sIYJOVU.exeC:\Windows\System\sIYJOVU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZzXJvxv.exeC:\Windows\System\ZzXJvxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRvFqeU.exeC:\Windows\System\gRvFqeU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fybRzln.exeC:\Windows\System\fybRzln.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZWWEWk.exeC:\Windows\System\OZWWEWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AyamSOj.exeC:\Windows\System\AyamSOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EWGGoLh.exeC:\Windows\System\EWGGoLh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OiahikT.exeC:\Windows\System\OiahikT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCXsxWn.exeC:\Windows\System\DCXsxWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlWkNyW.exeC:\Windows\System\NlWkNyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hPlfrBz.exeC:\Windows\System\hPlfrBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSRMckT.exeC:\Windows\System\fSRMckT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yLXOtEy.exeC:\Windows\System\yLXOtEy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHllQGE.exeC:\Windows\System\vHllQGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uheRvSs.exeC:\Windows\System\uheRvSs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5612ec05a4c2704d78a924cac5f789a12
SHA159cc3a5a756e9adcc3c11a82f15a02d269923949
SHA256387b849c72fc4544bb49b49f4315e9106a545a47904ddd6a7e2c1d4b16c069ac
SHA512237cc74fef368842da854b287df3c2a6cea6ebda6de7dc8305b7e7ee12b7fc1912b27e595ce2729161665245ea38859c17694b154ce3ee2c6219d10d89ff12bb
-
Filesize
5.2MB
MD51c476367fa282cdfaf4d24cd5f7cdf19
SHA1e0cbcdd8ffb81e256a1144fc55ea78e153fa9a8f
SHA2560aeaa15821c49163aa89b280e9faf1b8076657ce082631b48f30dd83916ca176
SHA512a665849ae89c2893a2ae8151730591c7a2f928ff1abe545202fcb885ba6f5f23ccbf1a41dba8c0da969d2a911f81d8beb184311b653756fe1a43f4549978433d
-
Filesize
5.2MB
MD59d883d3a22f0c749c00e93da97f09a3c
SHA177f3c4dd2f9852e8c19968069db5c30ba2ed7974
SHA256d7358ef647ad1e4af609b156bb8b29f1abc9243e39d07637dcdd0235bb849e2e
SHA512f8dc193c64030d76288f785f1ab8471fa2ccd01c421803fcd3363def16b8e3a23e128fa315706316d1c57affd9939b722bdc926293e264b410d46a75ef2f07b3
-
Filesize
5.2MB
MD55b7c7cd55cdbfd746ffb5af6c991a81d
SHA143867748ef8157a39f733068592d6d891d4b301b
SHA256960453508a6d6c343b1f2d6434c13ae42b4399d6fd2b36304112479816a9b8a3
SHA512950d2ba9422c581b3edeb5a4f8f6279393740616d0e15dee96bc4d9ae6241d33f95a7c05e5df08022e4eaf2fbbaeab2951af934bef38d39ed4412924fcf9d2f0
-
Filesize
5.2MB
MD5c09afcaa875ca593bb107ca27bf9e77e
SHA1de53ca65cc0823fecb104cf3461295057dddbf1d
SHA25604aa0b50b0695d1431a26ae6f85938c75c3043a890c287b1ee9c91e66a9a71a8
SHA512c26306820b710318e38429ae43e66fd0634254702bde6cf2a814df3b69f5e96d6eccc0656cc6b0b75b2463df9b19068af0d88fcbb8a45aca2e83c418290cf692
-
Filesize
5.2MB
MD5bad0df45114f086670f4c7e31a26e3b9
SHA13a067a1e2b4428dde7efe9f00217714525eda1ad
SHA256f96eda392f41827a7d8a757640a246e40cb4c3245f1d6d5e22f270dfef2b76c4
SHA512fa4aec1b43a7560d5825e6d48623dfaf25d7956e63942e16a0bdec7fe135eddd6af70adfaa566feaa3c6759df7a8903644f4eb8fe7ed792686776bcc1c16fbbe
-
Filesize
5.2MB
MD5b8ba52ba37d76cc39cd8732a55f0db79
SHA19b0a366640843a6e1bc557b0cc63880c0ee9500d
SHA25670d79cea2255de666598d8063f1af427dac95976c7f066c84e77b29e3f1dcc6a
SHA512a355497e0f88049905d96f15c3f056829f77d251e99f79703645a9d5df14cc1c5984401d58f210b550ab49c1f587c8b20e2af7c98aa35dabbcde806a7920cfe9
-
Filesize
5.2MB
MD5a1de3f6e156b2d25c60121be716a81ba
SHA1da7221b53c9d1e215395400df6533df9caa33030
SHA2568330b725d353381783630e6163a8c8f75486736da3e8d465f530c71618c30f86
SHA5122cdb7fb1ad57531c3d83a3d5105ff980eb3ba6fa291126f1308481b9b391b0533bb5dc9a9a9fa93d89e9b97c9dc54830e32408e9b2ee612c16daa66704e656f9
-
Filesize
5.2MB
MD5362bcce5dcf4935c7aac665cf25b3d5f
SHA158b2ce77f1207b018672c94a79b78bc689817516
SHA256e1b22695a29840542a5502fe1daa692f918777b7fbdb56dd7298dab8a4430ae2
SHA5120d44184472457300d217ed3b853c650abaa65b10f49d692642b256bca83e645ae965196712823c86bfbad25943fa8aa338ac9b023c84907ae17aa7641c91cf44
-
Filesize
5.2MB
MD5e180370add886fc258364446b0a7a8d5
SHA17d79bf6cbd51b24167690d82c71b5636856f4d06
SHA256750c3edfcd84e5a8a9f4d434cbb26aefd68e792be3955be28ee2f1ba5fcf08d7
SHA5120aa196896e5e2836657d59f8e9675558c0266607338850a73853b8aa3c36a7bd8a1166870b9c9c2a25e5768a4f48cd1a681a2149b6aad2077b82e2d75ab5008d
-
Filesize
5.2MB
MD58b473c836b4137494c5b660e6e618d10
SHA14bdeb4791cb523bba13e40a41f9acc08e56850f9
SHA256eab9622dae2458a24e8651beed5ea6321e9e42601b44d9ffc5c8a9530ef16262
SHA512be3c215d4b82d0ff05e8fb81622624db5224c36b343d55a7e9e6e2f7109256107c2dda91fc0a39c4bc42faaa1e5fc91c2a0ae9cb513f6c9dc6b3988a65930d0d
-
Filesize
5.2MB
MD564719e18178fe377fd22a2641bca02aa
SHA186241d126fb89f7c58411d69ba4f88c5922bffff
SHA2560ec4f2135e7b6774ef4a0b7238634312d12c6292380a9b0e39cf2214552404cb
SHA5125622ddfd80e35ebaf1b981660d72b90c12eb019565dbaa86dbeaa0d64714769d51c36e2eb0f99be0905e3cccfee76a1d6377d3cbb1c8e463629f23ad32c0f6e5
-
Filesize
5.2MB
MD5b7f1bedbee112b02e34ac696df8115b6
SHA14284505f28333d04985f390c8ac0191334e4beba
SHA2567ab429970f9773a5a8a092442dcf6277322b3ec0bb90518ef5a170793d2c4ba8
SHA512f01a42782f0d4b19ba320778cc45e5e2e2b6988503f8e910e3c9a49e8a9568aa08caeb2c6b8e4d81dcdb12f344f9d9aca0eb5b6f1ed1d21f4430d11e3d1d5295
-
Filesize
5.2MB
MD5c5f11d509b6123ed446f32787b7dd5f3
SHA1746893a6893d8bc937a5aed68a3d72ea17eabad7
SHA256c74048631779417bc07df0a5f8442dda2186b6f18ab0468522d932df4a9a159b
SHA5129802f1a52cff0220592c6c8490c242e8f3a1c8498b1b8acc8ffc82ddf631f0be83c0535724d7666f7cf1a93464cb280dbb77b93ceeff8879e15fb0c3c19c2fd3
-
Filesize
5.2MB
MD5c4f3592cad7903c45edc5dc718e6b94d
SHA113288cb11b2eeb439ad3bd859509b1416ee09c96
SHA256175c4b9996a93428a6215ea9746ccabc42f9f330a3dd7ebe2ac8353f6d8f6295
SHA51226ef0e21b22f4c075b4e7ea3378d8bcda448988e5ffeefa07bfd615f007147d8916cf8b51cd3d1715af18e0b5136462c5614b1e887a88d93070d59bfe99e44a1
-
Filesize
5.2MB
MD5e68ab6b43b0bddf33f8ac0b4afafc8db
SHA1e48b39850ebc3d69a3dbb826bbee7068e0110eb4
SHA2562141ba821e7d41f5ca7a7c9bb0aa40ae9c53ec23028c5951e18bd1f86f0959f2
SHA512def1879a9933d7f0e560d2fed03b3be3b927ea09f17f41bab67afaf3ee50b258f46c5109b1ba75b85074024ba29f35068d114f61ce43e681492cc74920df94c1
-
Filesize
5.2MB
MD513ed886ec5ff918b2b3039d34cfdcb77
SHA1946a0c93f91ff0cec7f7de579a9560691385b882
SHA2560e585260263933e5c280eff6656b26db419e6463f27e2b39650caeff7db6d2eb
SHA5121ce33adaeedd743f30f8247fc4cfd8cfe3701065fc6704e923fb94a9b33dbcc698a3968d0b6bbbf83c6f76e2a6e7ea31bd7e2944b5abc25c03625be9a783ffea
-
Filesize
5.2MB
MD5d039d8e83ffa7c3dde19d1d12a5b9c3e
SHA1071d33e002982e242cfb271393c0c66ba92f5605
SHA2561726e4efd3eb0ea90d45cb4374a5c94c35f9206194cb864d8fb4268c29b071a3
SHA5122faa35dadc3cb876086863bd7bda5f216a5449e951b558be4e3837c235da087182d9d2c4c6dbd67c8f6fc8a83de15e9af874a3d32dd9b19d34eaa9c600bbee08
-
Filesize
5.2MB
MD5ca7dd742b52e6ee4c0226041829ab333
SHA1f88416b72266d2815e6a6352c79112dc9fcc0712
SHA256726c796e051aa90e54cddf8bbfe1b92b98c21d5b08ae23bb6804582a1711de36
SHA512a50348b52ab7293f83d828fdde01f62046bcc52529a17ba6c2b70965421b86b8a9c1c4c66ddba164564ef85e9d39e419ca1aef0800609502a3981b6815f552e2
-
Filesize
5.2MB
MD56aeecc139c9484abe12a5651c2ccfaee
SHA18cd5d58cc3ee64210f5799fe4488a1d329fd4b8e
SHA25633514370453be8ed27ce620b25dc289bf84794b0da0aa2fea28cd524b56dc945
SHA51246888f3dd3884235eb66abd0cded1b69e9576d5977c32c1e8a0c53a87e199358d0516f3a7b05dc92e7795f6d20f7a78f6020dc5203e8feea7374bc93ee9514b5
-
Filesize
5.2MB
MD5c48838c0bd879bc33d562818e673036d
SHA175c52fb0407e22af12765bfb6ba6c03c59a34dd6
SHA25689f50f84d27d65395636c70657041320b1b374469ba5da192d51dfac19df45b9
SHA51253e6263b74ce645ff832dc4efc03f864a2d4338b5297db077c0ecd7e68764014847622d590bd3a47cda15142ee21a9b97ebfafd8ef2631b3de3d4827760e7b95
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB