Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 21:57
General
-
Target
2024-09-20_95413702ac19c117e5288721001d8716_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
95413702ac19c117e5288721001d8716
-
SHA1
8693fcd8e13ee45c9326a38f4699753e71e64386
-
SHA256
94108ae141756c28184b6367a7da949ff3cfd5c83fba845cadedc56b1f2aa72b
-
SHA512
91d0c4b0b474ae92f04e032535283d88723a95361a0d20a4fd9b580af9ce8536080e621f9607f7391667ca79eb5ad30e9f0c1404aa974547c4111ee7505f446c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_95413702ac19c117e5288721001d8716_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_95413702ac19c117e5288721001d8716_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xEhvxxp.exeC:\Windows\System\xEhvxxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLbvQVm.exeC:\Windows\System\LLbvQVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\irfeKKr.exeC:\Windows\System\irfeKKr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kJCgNFj.exeC:\Windows\System\kJCgNFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcVoIdN.exeC:\Windows\System\dcVoIdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdorWbb.exeC:\Windows\System\WdorWbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcROURi.exeC:\Windows\System\xcROURi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xvsCasR.exeC:\Windows\System\xvsCasR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXxnDDD.exeC:\Windows\System\jXxnDDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YxGiMQd.exeC:\Windows\System\YxGiMQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AinhkEN.exeC:\Windows\System\AinhkEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvnUyds.exeC:\Windows\System\LvnUyds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IlgREYG.exeC:\Windows\System\IlgREYG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\twFObBj.exeC:\Windows\System\twFObBj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KuBbvni.exeC:\Windows\System\KuBbvni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QiQmhmE.exeC:\Windows\System\QiQmhmE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yzNTJeP.exeC:\Windows\System\yzNTJeP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IOLwzME.exeC:\Windows\System\IOLwzME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBYNzzJ.exeC:\Windows\System\KBYNzzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiCnXxC.exeC:\Windows\System\qiCnXxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HEwvMqC.exeC:\Windows\System\HEwvMqC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD576f35fff246cdd77b64d337775f2a135
SHA16e7334b1bd37312765370f698ef4522618463e32
SHA2560ac3c32ab2101f0b1bfd057c4751a64ef85ce33fd52f50763a80fe4377149a0f
SHA512b80404dfe73d3b10a0d92c34cb0193da5e4a7ebc9cb1365a204e8a66da419ef077685c7cec39a96e6dbffc9abd7f7b4c985b590872084d61f7e532c36868bd8f
-
Filesize
5.2MB
MD59263b90ac028baca0c28b70b2954046c
SHA1d454ec3fa43184835ce54824ffa6a01ccd627d57
SHA2568a8358fb194e37c60cdf0ff43b06af4b8df70650b42b142e5501155821610288
SHA512d41536be7e9a7659c93ab46e945282de815e1d5ac1b6daeb95238d1ad79e7d0d32d65dc871eb95ec668fe53d873b19809534e01cd88e60b1173f1cbfa34a4ded
-
Filesize
5.2MB
MD57a9182915a6fc3b22e89170714e71ce2
SHA19436c07217fe00ce191bad82cc68e1dadb8fb2f8
SHA25645f1ff28a9f7c773853137f911497300df8fed26f895bb737177f1d48838156a
SHA512e3c35bab16b89772eb711c61355394cf5585ff74f863ea1a543c63f89bf238ed9f09134825ae6a954f65f77751269e8e1798d095194dabf5abc70943de9ff956
-
Filesize
5.2MB
MD50d864da425a2aa42de10b6e6f073d535
SHA1b9187876afb9aaccd48b1f247ce1797b62220797
SHA256ea8388998a4d0849c4a9d78c04a8fb89857832d26e6630feb97d24b4ff3f3228
SHA5129f13dd543633ac943d8d6afbb3a11459e198e0ae9de849994c790e47cb8f80aae024acd569ef10cb6967721f4e0a17cff937ab799a968fb347a28df2351797d9
-
Filesize
5.2MB
MD504c09ced42fcffd6288cbdfb51f32620
SHA11ceea4ac5af4523de07a8f1f14e53ba3992a487a
SHA2560d23db0f3310b24063c68fddac67c96459de80e86cb8a90234dfd57b28b04dfa
SHA512302492a54280aff415ff1976bd46911dd37a5f5986070dbf9e1623729b29bee5a250fe6dfa49a02f99c4893c952d10151e85cab4b310ff87c95aeaae4a7e4ffd
-
Filesize
5.2MB
MD5da7075e07c9621b185e647f8fe78ccea
SHA1e5b94fb84028a08a580194dc84355a32f859c13f
SHA25618cd2a1d63bc301b3d48e12483301afe941032082f908f317e162a142267de42
SHA512cd02f5a2dde3468c47b0c946505746b82936f1735c312cfa32e6adaa16696b0a67356af9351589f33485ea198809e25fa32d9530aab42f4694e4ad835f00bef9
-
Filesize
5.2MB
MD5d91e4fac875e5c420aa25514c9111f3b
SHA1aac75daffddca6089f111465dcb6621916629ccb
SHA25658c4d0d78d6b91db4d0121c3ec2be6ce3537e918ef17ff9da1d71d879af70fb9
SHA51210bc664048c27f7121d72233f3a536330c6869d418db0c43463feeb9f8d06ab16bd274c7d03b473e3066fce492d0f9c3b58b414d5ec5762c75bb1f71d444d89c
-
Filesize
5.2MB
MD5d8f2a9de42bc461f1229dcc5501e7e66
SHA1044db1e9412fa468838076663c1032913015a5fc
SHA2568fc03fb238291e7b4ca9b6a3e240358210d5d50b5683bca06dd7d78ebfdf818b
SHA512e6562e09f31af91e3594bd467018ec5673ae07c8f9bf3b33f9fb48ac1f85a2983a0cb1eb93e8177ea1949a4c71f92b2928171a873057f8b01009a0e62585b973
-
Filesize
5.2MB
MD5f3cd63e1c1dd9f958f0debe4f8e7c897
SHA1cd90868a6b06fbd799095c8405da434f50528a7c
SHA2569e2448dfedddd87a4a5ff8d71183c3bf685c486f0d8e5164bb9bd28ccb600246
SHA512fac6ea4fe79916b58e64297efd21f0ca5e53a152a496e9914e2d770755ba2af88b2b78a79f99b69e8932e7876b53977e1ed40e00a52ffb9ed9924416aa21822a
-
Filesize
5.2MB
MD572ab8ef435a8aad4a593c6a9e684e26d
SHA18ea968c5f107f82d1009f9b0ee679498d71ba5df
SHA256b6bc6d8e6751b3e7ca9d938425fba9da9a496aff78b630b360ad0fb2623be56d
SHA512869b5262587e4359d1a7be56fad5264cc9a017aab0f7485d903c2e1fac25ad9ece6b2ea64107c8f6bcb6658c33872c0a694e560257e8c1c6a0e8c874348dae3c
-
Filesize
5.2MB
MD5658cc479710d03f6296f8d52f796cc24
SHA157858a82b62d570aedeb4a39a4d05ba39f87c5dc
SHA256b3b36900c47bc5de850798135d3e10d35bd45615c0d93f4fdb0e6c26f930138a
SHA5128e4c5ed57e9fdb149aa58e41dd29746c51a64e6185ab073aaa38d0f17b85fdd60e7993873f8b6790ef30b4b57942709ed39cf40857ccf9e6ed5d82f9a62b87df
-
Filesize
5.2MB
MD51b7f35c10684d22999115884962fb394
SHA19b6d63c4f51f3bb733fa4939eaec34c0e113b2ba
SHA2568bbffdf514d1ce923469e03fee2adb8aad44d5baa9c403fb852986e2e8ff3c9a
SHA51290e8ca2626c081edc150db18d079f745343b19b93517ec079af50b115e849a8e59972fc96cdd3d22cfd1c52acb183e20a9e80394ecc4151f1d77e19948a1e1c7
-
Filesize
5.2MB
MD5be13a08675c9d59a0d6821ee7ab3b159
SHA1d3433fb1cb15534b5078c1305b76e240a0137f99
SHA2568d2f639c9e3538b3831cd6ef5558a445d979031b88105c689485b19cee482269
SHA512f3b60e398dc558bacea827fdbc331159bdeec3671c396f35944f53cdf1afbed3507d6c4c7a6f46de5c58d970d618b8e52271aa327a505236d579efe769e3509e
-
Filesize
5.2MB
MD5a52800e321c135657ba9261a9aa5c460
SHA1ce75fa16bb08bfe14ada3652e0168a6ee0b947bc
SHA2564a27906b373ca6736d42d246ba385cd61a23b7e8261155bdcb2d9525e895da8b
SHA5125a5c0895ecb3b560857591392ccb64c96c681305cc2268ac2add061f127e3ed11a01302923cbdb379354662997cd1e09449d918ad253dc329f7b00a79df5c28e
-
Filesize
5.2MB
MD55e778ec8dacb7ee99ddd01be0a3dc796
SHA1223193839e1a77b2cd41210a533a6515922a6dd9
SHA2560d740d9834ad0154efed34d1fe84c95aedd9371d5741fdbaa354dce4fe5aa42a
SHA512de5ed8629218d565923a82b0d468da4c429a733539c034912c02d692322abb11194d4b2bfe77e237e53400ad23a4fabddbad513ec8fd0310932cf4d496039bb9
-
Filesize
5.2MB
MD525f3b4bc7d2a4805590fb425dd1b3966
SHA17a98c7b7dbcc56bd0f100b3e3aa2f41d458fbd1e
SHA256bb30b938324b31b72817e7f99de8bdbd9c10ff61de574ab884c792c1cf37788e
SHA51264feec0c961c858823008e54ba8a75c7439c6ecec950c950e75dcc5f125d9ce4f5449dabe60639a79b8bef53b2fef7957a5e3de68cf7e1ebd06ef130479fd551
-
Filesize
5.2MB
MD5f45ff35a5b2f6abc8fa119178c04de4a
SHA117c56a01fe401d8d8fcecfa7da877ac75ab020eb
SHA256c8129163b8a21dd1f39e86ea9abaff5ea46bfe180a6238462484911639bd9086
SHA5122ac55f866b09e8d8dc95b8722516586115193078f9d4187f2814986131ec04fd12bdbae524c3d30cc8ed9655bb6a62fc649c9ccda9454fd64a22a231b66a0d77
-
Filesize
5.2MB
MD57ee659ec26cbace67807a25f6de60cf4
SHA174a37caa27a0c619cacb6a2675b59aa972f28606
SHA256864dd088dc6c4366a91cb50d44fb64e510cfb1c333d49a927bb43d566b26bf79
SHA512bd24104ff62004078221d6e618ee6c127d1f6afa3b31288878547c946502cb86bf4a3f6a9082f83976e8e59adcbd30633eac5dfc83c52af83836bf9529bc9727
-
Filesize
5.2MB
MD5ec66053a5935e598038fc5fa83eeb270
SHA181cc7e954d130f260688b6383a7e122ff70cd262
SHA2565e6db0feefb24b8456cc2ce932166f116cf9090b2b7dbabcff5f5f5b077f46e9
SHA512582799d8859634053b5b674e50eb6c0a347434ef9c528741b15fdaddfb0b025f118b29cc8058e936628a7570d571a09dcddb0d99d2f7d94016928bf454fad27d
-
Filesize
5.2MB
MD5cbb5b34fa3dba05492673fad3901936d
SHA1684caec46ce4d9ee416b620fc15668d65f0dd307
SHA256693c5ebc46ff60b01d77680914673f418f05ac290cd69a7adcd57e3082030091
SHA5125150fbb134ee8d59f032d87f0ec0c041a00d369b007ce37a1df538ea0144336c7723fad8b3266b325eeedd019b8e951617afe6cfcc3a860e279cbc310932da25
-
Filesize
5.2MB
MD597cbb84ce5f132459d14e6a8916ccf0c
SHA1864045a0699f4ecc18ecc6cd3b0b354ca5247a41
SHA2564655af5d9248d4cb28d23b92707f2178bd357e2fb9b66918e21f93377cd09dfa
SHA512e4e2a0adeb584a446f71d21ea79510a964d9d078404479cdb430666b95830dbd1119f7472edad0c44bd81025e444fe78173354915ac5ec9bc399398db9cde6b7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB