Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 21:56
General
-
Target
2024-09-20_70e83a3c25aef9bf2daa6c76152c4b6d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
70e83a3c25aef9bf2daa6c76152c4b6d
-
SHA1
8ffe056daf426a9153f074067a6958331649ce7b
-
SHA256
3afd814a252b8666a87c7f0fba8e9d7dbec5d171c2402964c89cb067d18d2380
-
SHA512
e8ba6a4202a60814b352748af444c7a958450caf35300e4a8d6293442bb893fdd2de6f57fdf8092d08ff3d3060a3928937ddd4bb0243952448b3e0a0b0cc9c3f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_70e83a3c25aef9bf2daa6c76152c4b6d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_70e83a3c25aef9bf2daa6c76152c4b6d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qkkqdIq.exeC:\Windows\System\qkkqdIq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLlYDrA.exeC:\Windows\System\FLlYDrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bcugwsl.exeC:\Windows\System\bcugwsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aACBvUx.exeC:\Windows\System\aACBvUx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKiFMko.exeC:\Windows\System\sKiFMko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hibUyOR.exeC:\Windows\System\hibUyOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcxYpId.exeC:\Windows\System\CcxYpId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNhEaei.exeC:\Windows\System\NNhEaei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGjQjkB.exeC:\Windows\System\NGjQjkB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJLVdHF.exeC:\Windows\System\SJLVdHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXZvJOO.exeC:\Windows\System\BXZvJOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iQBLXwX.exeC:\Windows\System\iQBLXwX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MewVfDu.exeC:\Windows\System\MewVfDu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oItnnQH.exeC:\Windows\System\oItnnQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpQkruk.exeC:\Windows\System\FpQkruk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kRmTmfD.exeC:\Windows\System\kRmTmfD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UQxfrur.exeC:\Windows\System\UQxfrur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzgywTP.exeC:\Windows\System\IzgywTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixkTtwU.exeC:\Windows\System\ixkTtwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aFSMqwm.exeC:\Windows\System\aFSMqwm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyRmPpU.exeC:\Windows\System\wyRmPpU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5bf01edd930d6dfc81a5792f90b39084f
SHA147eab10e51796d2c2e94a4c07217d291be9568b4
SHA256464fa9fade6ab1dd04bdab8e2ea3c2e267f1dac6952d9073938237eda980e425
SHA5128b59fa89018fd84036b7e8637c0556bc6bc6e525c3d936f7caf09b200ddfc68a50ae081f0c5cfe511cd93df497fb6ac3c7ee31bb73df11f8833cbbfde0ed6ff3
-
Filesize
5.2MB
MD521b81a60c8702317b184883ede103f0d
SHA1fc4e022af79e84b90f8fe89d4a6e66902195f45a
SHA256b9893b6c50ea598ea343c39cdea7d0d765643fbfa0ad354bbd1ae665ddb19e44
SHA5129be208d6b589c27239e6e2c7aee99a429d2b6cd008d20e92f4d241fccabe731b749072af160cfa9d9cacd07415adbc1ea9ba1d768826788fef3978a853b17b29
-
Filesize
5.2MB
MD5ca6791ded59d6ee9afea38fccd680691
SHA12c9369321500d6790cc6d9d7bfc10b4b1f6de6ef
SHA2568a02799515f960d8730207f272700c083f2e219fbcc97273a25b61fedec9a3d5
SHA512e781d91900cf10d8c19720053393d2dbedc9bc663a4c29f00eb204da544b11772a7a4aa9398faa7add34e7c57952f47356f4910ba3de253e8f991b9866928c82
-
Filesize
5.2MB
MD5d5e2d77fde999bc65b187e26a53a62c3
SHA1f1de9623837fda5edb7a0f9d51943738cce2b17b
SHA256a911a4e332e12ec303c8a59b87e0c286805c878bd0b29ef7c26b095013b19914
SHA51296b9eadd9c53023f7a27e989a036cba3ab3c520371504e01b88b88ef4b0475358fe5f3e7726b2f612f94a7328f29f0e59b2251a61e4ba53c028d49705e6af408
-
Filesize
5.2MB
MD5d49d5d28c12305940ca793d8b424ddeb
SHA1292e0bb450836f65bb2d100b1f03dbb69dc3db7f
SHA2569609e0b6395c7cb6790aa81616f55aee2e468d28b30f0840ca0310c51313088a
SHA5128a5fa1defa9a0bce6199ce54b651bd24a04d90b206684944e91acf2b786bfce66094229f84c7ad38a8b9cce91e30c39cfba5253dfc8cc167f86fafe4fe5ce9ff
-
Filesize
5.2MB
MD5a16241482aad1212c3d73d9579cefb92
SHA1c319ba49703c421a26add0f41a9256119720eb16
SHA25658e27d04c46d2e241416f3946bd3b4146623c84324373a9b249846ed8d179a2b
SHA51299615168c8253f69656f9f9646d3592a23673a446ce415704b5b6f46a3ab15c741e340d43c8ce6e2ddda761d9b6daabf96fc5a01f8ec219743f417520a296286
-
Filesize
5.2MB
MD5a91c179acc01fd77d74547337f82136f
SHA180322a8d3a6c95a0d19927fa662251bc028b4fd4
SHA256867b12390981ca3643b5c1ec818996202247689f48d3db3a6740417e9c734261
SHA5126f36349e637cdd1c973d9cf8d1be774ebef1fb8bd2597587b70e2d9d6c88c8f0185d5f6dd72eef80d6f49a1f962aaca22fefbe8efbfcb5deef0026a57bc277db
-
Filesize
5.2MB
MD5028a913c997587866d3e875c18155360
SHA1ec76d97a5396e75336c7fafc6c8eb59065d82e8e
SHA2562170e909ebd51a26e37cce461c5b4eda3e056fc1f5c2713c8872d0b392f39c19
SHA51270556763eda1d1f04187b270a69ddfacabafd85990bac3252cf9170ae96d1dcc2b84f1ae95836610babd3ee01466c3d0a328ca5e2110a5693db0ab3d381c995e
-
Filesize
5.2MB
MD537dbb3ab2d2b58229196d2a84242be02
SHA1397962a7e061efe2b6c95d74304214cadc196e16
SHA256a563fd863aefb42f7e9d91ad5044b9c8164f3ed48debef10022c5f4b3f60ef6a
SHA512f96f81fad66ae24a673bea84ac7d276ee909fe69834a4821e75675cc92c8970c1459c45aa9e789b9276374a056340b1a45bacf84bb7ca6723ad4d2168b85fd57
-
Filesize
5.2MB
MD508092785c94451c0c9fb2435aa65b399
SHA1d359a6e47f376a1eb8dd1ae148508a94872ee2b1
SHA2562bd14f6a887778548965e3e583dceac126f965b8c0ca7dfcd77e63c48d1e5738
SHA51201a21867130265b56a16fec5827c799f78f209e76f5c190c9bde5113f2a4eaecc63164aa564654b292d3c55d2c658d8b046fc9e91f4d399035e57a1993e2d621
-
Filesize
5.2MB
MD54d62b24dd5c70072ba762bbf26cd7df8
SHA11dfb7816914696ce2421ff610e80c51ce23e546c
SHA2562c4377547319b6e5f0e9d280a6cb5d7854c7db08426a7921cd5e293ac559a342
SHA5125908a10e1db5948158c0c2feaa4c4c1242fff939c5ff9d602f3468d12a5ab50aa8dd3aebf2b9175296743d60811634f2845368d0b2725224868a5cb994eb309e
-
Filesize
5.2MB
MD507c46c2d715344c1b8764724411df990
SHA156bd9fbea9de5e7e9f4dc0a36e37d3e674ba0377
SHA2565e4bbbb099eee36bf752db5516b92f01f2f8bc446ab4e0084a032c6e3dd5f5ea
SHA512fa7a9cd093ce8729261c97c0f8a1c06b4b176ee90c7ef093349bcafc9a3a04c41b73a130c37eaa88098ac3320df346c099b933622333d11a96079c51037ce4a7
-
Filesize
5.2MB
MD512c86e1be6029ed4afe1a900f7506455
SHA1eb142fb2e27129ad542b0f3ae26d805795b21ce1
SHA256ce5aa60d9ff2b4131b321cb8ba338e40b29453837be77251beec87b4475facf0
SHA512f94c48aa93eabec0e9106818836b81e8e255e29c1be91200a352e9556e5db0b7589ef402e0149cbfbbcad26c715e39fe6793a2f791214a0aa8b966a8cdc8332d
-
Filesize
5.2MB
MD51af0af6cb00ca43f817a23766d6398b5
SHA1587dbf0be357f347646d52fb962bf31a0237de1a
SHA2561376165be53da3ab2e2b69ce20992750682f4c3c0e416d7ff5ddddc79dcac69b
SHA51214be8be96c302dc7f4670ff2d9b7c34c49691050f9e7735b3e979fd278ed1b60bda4a3a6b9a6a62ad89333753e9a3077df580078f642ab2f842905d100f28123
-
Filesize
5.2MB
MD536d1a36eedd4f723edb0f2b74e213619
SHA11f11bfcbb2ddc17e8783c70a9cec79429368f134
SHA25607759bc3e1f704983f62d2f1810986c51bf3ac609929ac69e1dae859f41c8b9c
SHA512a8626cf7179a06329ee326fe8d8e192f59201237d66a01a6a2ad7e6d308d2ed40dce3c39495433bcd091d260eac584c9504c34e9dc1574b48e75646ed2b7299f
-
Filesize
5.2MB
MD5fc4d5a285039a66c810571988406d33e
SHA13cce30697844b027cb44def32224e432a57d3746
SHA25646d972d68dfd2cf7fb032e5c4b1dc43eed24c0a6bd8971575b511bc8a194747e
SHA51247d23c15ffe6cd58884128bd6279a5b6a093547edbee30ca44e9458cd302c29dda380d9bc3558c650b3334054d96d348cd223c442f34734769554403bf56798d
-
Filesize
5.2MB
MD535b794b9ed458dadd71e10adffaa3f23
SHA1f193b1891820edc306ef27b87b91bd66298beb33
SHA25697c017918f79d054d73ea6da7adbda9f4282793505bc4638f0fd130befa7c332
SHA512cde9ee702fc9a59921c177719270fec3edf8deafa011effae67d64ee446a7a1b8dbc2c279063982cb13f2b9a5e0e5fcca0e8e2a595fe3bed22eb03ad2d9ce6f1
-
Filesize
5.2MB
MD5187cb3fc765bfc4ab0019d1feb5b0039
SHA11370409945590af42c3c539e7d5e0addb7427384
SHA256d51057bdd92813c6c83fc8fd8a7d1ffe9d945cad3a21cf46e4ccd5a23d495ec3
SHA512511d7469e8da2e21b3dc6b62936f470bed523d914684a35b25528fddc3bd733df3bd233ab03deed50e18ffd75977a2c821459d4253d28522f17fc5d8516e9c18
-
Filesize
5.2MB
MD5b378c096b07448087f3aa90b074f73b4
SHA1aa1bf5637673e254fc93e5b4f55137d54f942bda
SHA2565cc00c3ae79901484b0049a2435755344c6de043ea5cb2b13aca85a0dddeffb8
SHA512c5ed3dff3b1dac4ca9ff67ed75adcfc452556b4a6b2f44241e76fe6af4344cc4b1818f0a323837f1e9df44835cefa5985d4c8a72857cdfaa21b4e7bebf8c1a1b
-
Filesize
5.2MB
MD558998851a63e1a6873ec3fb9d4a6a240
SHA1910636f24eca8252aa75a2b780c92f1b32405974
SHA25667421b59d8ec4fa5c08e39426563bdb048e1c453d840f2b77d98382a6563ad88
SHA5123d388425eb52a927c919029ba40bcc5cc903d20f6d6602dcd39fd25813a1bea70a96903e2254f4eb0e15864014e5daa784957908153ad1beccca0d9e245ddf85
-
Filesize
5.2MB
MD58066e9e73134eac9461d2094ac9a6b51
SHA1750496668235e507f669223f68dd6b9c9e69b11a
SHA256de9d4e8da8dd059ab23964cb300d8037594ff7892b92211b885e21523a8b37e8
SHA512fde6b2b0d422ff597418a1b928b3a40c0f6bd2dc3eadcf8397195a3ebf04290427547314e29eeab5567e1953c4b7ab17f60e16f7382c4d2fb387602541685010
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB