Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 21:59
General
-
Target
2024-09-20_a7628b0f3ebd0a8f8658d0645cd5b77f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a7628b0f3ebd0a8f8658d0645cd5b77f
-
SHA1
800397ca0f329277bcb529c00f25697798585ac1
-
SHA256
bf200d7974914ce2bf92f5cb0de600bd79b697512cb0d4bdc5b3dfa78bb6dad3
-
SHA512
cd5d5f424684f8476250525ee2b112220f60cade73ed269a2a58ed78aea9f6dc8b1bc1a82664b5c842bc3032604f2890be2e43a2b446833e2be3889d826a1c64
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_a7628b0f3ebd0a8f8658d0645cd5b77f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_a7628b0f3ebd0a8f8658d0645cd5b77f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qPuWfux.exeC:\Windows\System\qPuWfux.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naJqANV.exeC:\Windows\System\naJqANV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HHhkmUn.exeC:\Windows\System\HHhkmUn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zeHoAIU.exeC:\Windows\System\zeHoAIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvzSwcn.exeC:\Windows\System\TvzSwcn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmEABmO.exeC:\Windows\System\kmEABmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJVFgRD.exeC:\Windows\System\JJVFgRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEMnQec.exeC:\Windows\System\eEMnQec.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eZcspGJ.exeC:\Windows\System\eZcspGJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EUJJjsN.exeC:\Windows\System\EUJJjsN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAkSrfi.exeC:\Windows\System\yAkSrfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rvAMnWJ.exeC:\Windows\System\rvAMnWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojqQpLL.exeC:\Windows\System\ojqQpLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udboIiK.exeC:\Windows\System\udboIiK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTKGdcF.exeC:\Windows\System\xTKGdcF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDbuXLx.exeC:\Windows\System\TDbuXLx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYJXRIj.exeC:\Windows\System\hYJXRIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfGlZBf.exeC:\Windows\System\XfGlZBf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhHzDaE.exeC:\Windows\System\NhHzDaE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MrztzdU.exeC:\Windows\System\MrztzdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vbeofKc.exeC:\Windows\System\vbeofKc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b4055bbc76a1c7a76b41f940f40bbd6b
SHA12ddeb28f141b6b1b98792090714548f82c983ef4
SHA2564717c7e16c5a081c3d48b90771a17bfb5758aba707fb5b92765ad0d401b0776e
SHA5129c960b09f5e969d006a5d2c7d7052ecb5e5de6e793ce8800af2f9a3b1780668aa2b7c2de1b0072247f95d4236653afcbc925309d4986de1d532420bbcc6b28d6
-
Filesize
5.2MB
MD593adbe0ceff18057edf4caa56d2d847c
SHA10a926eb88288e66efe6ab029110d3495b2a5212f
SHA256240eb12dd4b270c4317c7118950daef940875a73a94acc9ca963147180900021
SHA5128f1f7fbebf4b8a3d67fec9f8fb005a40056e1c990c67ede0dab459a7d9343ac6b309db25b0cadd472388ccc7f6f97eb9fa8c3edde271e6c6d6b246c7d0d5672f
-
Filesize
5.2MB
MD52ab419c8d37733e3e16379d8ba453536
SHA1f606ea9e3c1d72b3d9dff2ad3ecf215cb2e43a2a
SHA256c50d9c3103bedb179eeed6b4bd553f5f8922e9804fa084d653bf53ad85f55377
SHA5129df851f4ce270654d74b6bb3e485179825cea2024fb5ab87a12540bbb4541368d05dc1db2a7481662ac5fab8e7ccbc9147cc16c814331d4419ce8aa7c82c30cc
-
Filesize
5.2MB
MD53ece0f09a330faf13798b4ff31ff9a4f
SHA1ce28cd228f4bbed08f93da70a20b313364bd0af6
SHA25639a00f4d953c90ea4244369877d22eeb847fc60ee74c07d0c9638135acb4f26f
SHA5129ccc2993cc8e41ffae0ead2865622f658620cd4ee52604f3568dd8c971320d71f98dc80d64183b2c0362feb338178117ed9e865504f756cabba79148d4d516d7
-
Filesize
5.2MB
MD585ed5201f500e38bd20a63a5fa1612ae
SHA18d1ff866596933c73f7331f965aefabdcac7808e
SHA256a983ff042fdc950e67cb9980e9e0bd0cf1943b64f132c72ea775d191e3b5655b
SHA512dd7b2c25aa4926d1a866ecec4865f274deb4012eb42dcd50ac11d5a025ed5c24d967846c5435190203694d64fb5e72db88df2f24084d678a14fb5387b6b97852
-
Filesize
5.2MB
MD585e35806f7d63c8d8244087628e691c3
SHA1a6261a82f5a39fd192d94084915225b23dafdb08
SHA2569e708d727a647b544b442956c20b04e32f51f00fdc79cf2e4116fce0e312e1b8
SHA51206ad6c677f09616f3f85521134b5f218976cadad94199da44a76f6fb71b6e49bac4ebf824d10ddf00e1617827688e7a1a56e1026010b3ea443f66ce3caf6ea41
-
Filesize
5.2MB
MD505cbbb86bb2377550b79f5f27ef51f8a
SHA1f12e601d31e93d8dd1340719e50408de6893b21e
SHA256d36e2711dfc472ddafad7ff2427501e8e6416359d071380134b97060a330e9db
SHA512344e62a371a8bc4d08633fca005d0c662e6d45d062cfa48736eacb4934be29d9bd66d3e568fb11356d44124ccc4b0b2d634dc7736441520157ce9d82b452d8a4
-
Filesize
5.2MB
MD549cddfcf0c33f38d00fa517506b922ec
SHA1a579792992b9fcab1bb4b731f5d04055ce69fd3c
SHA256ca1158192ae7eee6331d888a2468a9a15cdd350a2ac16e45ae8b5954c1e21325
SHA512c1f3d8f180ce745605ec80bccf0915083c1bf97128103c939d59ea783998f794b9636142e6605c75f3bb9cc77b5a3c41c75ec77f72e9dacbe938f726cd14403a
-
Filesize
5.2MB
MD5493ac12381d1ebbde46b2916050860d1
SHA1204701e81404b7844275376ea79e4e60e931ac5e
SHA2562cabb13c05c15f83618d4ff41af335113c1c57f6196da146441b440bf8205713
SHA512697809c559196fbdd95f36bc0959f5b3e5dde35bbd1dc492229c97a5fe94a6617248759efe45fe8910afee8fd5a606b6384780f6736a7d348d9624b07cf82ea4
-
Filesize
5.2MB
MD51c58d3c0ded9d89817537bebeee4d507
SHA10bed05874549d95e89cdd937b39b0f6aa2b924e1
SHA256ef4d0291c1baffbaae1745da734aab0181815a2bbcf8676927fddffeb7203733
SHA5123143db18f43caa305a703997bedd5322a13b145281f2d42b4754cc4dfa13f8fac4c972bb88b3bae3bf3c1b47358d979b7521ee4b8fdf69e91204cf197636833f
-
Filesize
5.2MB
MD5d770d841938021170225b77df1be0dbc
SHA1d8c60894fc9246268bbe036a7e50b5d9e03ef44a
SHA25695d2185f0ebbc5066600e1b2d9ea271b47ac8b408fdd2cc01fffcd333ad8998e
SHA512186da5c339d113d12116b471f01068c755453367b5843a6053a952bb36247f8949536b94987940dc856454f607d2916755e4e018440dbb175ee423b21605c02f
-
Filesize
5.2MB
MD53d16c036bda713c090af51087276f060
SHA1a791762ec2b38f03a639b4c539c61f1796b5926a
SHA256350b7fa6a61b477adfeb85b54ef80f740d238c9698bb54954326be72a78b2d42
SHA5127bdb55445458cc19fd294e96752d80ccc5dbe73d9ab35425bec7f13ba65b31ce70f06c70d5a0b9b8a38a21e1e7df05d3be3e14f18b640c465ae0f17a13d06731
-
Filesize
5.2MB
MD57d15a6272e428d832ac7348652d1e73d
SHA1a1e891158d4167210913528f716b5bcfcd97e251
SHA256674766d9dd15c2ab1a1b4284bd5a745b07db860a7b586b27f68b0604b3480cf4
SHA512be8e5875d6f5a8a7d5dd34989c0619b1b3789c1cc1f756fbe2f5b8ffc685ab023dcabc1f71c4c1a02d2a51f33d9ca0cc78bb29fb44e29b7fb418729d257d0636
-
Filesize
5.2MB
MD5b1de39cf128032cd13c9b37181590025
SHA1b1b5586ed4fedf69fcd25823e110c411f4a1a1ac
SHA2567ffb4a6b17d0515e3b8b4e026965bbe88f3aa4dde1fb92fb0e4d89cd0b0baa02
SHA51215ebb88d33c008bb6af1348e074c42de7b703f08684b9e0115ac90908905903c9987de44ae7163166be113f160ab66a46a8731a94ab77a744bf12925c99909b9
-
Filesize
5.2MB
MD51ed068507f65ca1951680390055bfb50
SHA1175702fcfe6717f06004735f8fb0f359b25afe8b
SHA2566e264100ab4c412970b149108d3cb08e815e74be9771e7eb7475e0bd76252ffe
SHA512fa413ade3a42bb91dea4646c74000b0f7c75f6bca46b7d88dcce44867198c10a5e08bc85c130e3d817e085799c92bdb60c7747d870313de977f2e048788729ae
-
Filesize
5.2MB
MD50bd0788c07e776ea2404324fe516d4fe
SHA13c19b00cb90762f45857840224e7242151151e05
SHA2569343e636b959d5be25681a6f5267d405c27554a48597edd6dbdb97c6b5689137
SHA51224595a351f644c96f82a689fa05e9de299e994287a1cd09037c9dbac7dda63f4468a21866175cccdb535c0441cced85d67a643d75ebae3987ea83ce192c01a8a
-
Filesize
5.2MB
MD53a03a396b5369cbd4ff14d1c0c0c0370
SHA1ddc7ab48dea54f128f3c16cf861d35da013c3ffb
SHA256fc04dd3d0ca18ae781c0d698995dca1017ba67ec3affb5ac04eceb3815dec2d4
SHA512667ea5833fb171c52e9f1cfcda3e7302f945644b9f431c2bb73827361a65bd04326fe8134510ba19c094dc58383afa475d078a971edef768f429d5e2a16251f7
-
Filesize
5.2MB
MD59821f341db9ee4051fdaf2c8ece3bcfc
SHA1c9bd1fdd14660b15bbc830b8307a1b5cd6795bfb
SHA2567daf942f684fb054b0ee299df85863a5437119a07a4d7f9852e502abf0ea4566
SHA512e70443342c7c309020fa030c87f2ae687472531a19d982208d28c2dc9ef19aaa7d74612ca29d4cce8d25c914cc1c3bce355b192d5aeb1ba4e0c403c407b0bc79
-
Filesize
5.2MB
MD5c17e77ce1f47daa52cd21fc9d4d3ab51
SHA11186a0e6dc1259c82ef57c048746e813d5d01aa8
SHA2568da6321bc45c8473215a181e15d7111c511153fa4dbb7d3a9f8833dc8fb2d36f
SHA51218ce05b3bc90459ac1dd15c1910d9dd007fcf4781f007c854653b052c890055a2ed26af836a829d66bb7d684d8076bcb2267a45fed7653b8b6304c9e22025fee
-
Filesize
5.2MB
MD57f865a6f7a84ffa51fe544defd740d4d
SHA1e9e64e40d9c3c3730f2271938caf6759de87593e
SHA25613f12404fcfa46ea6155d4d97da4ac4c2bdf2c81d0bec6afb96d0924bca47d3f
SHA5120e7896a2cb74e724942476d2efb9bf71b08e2af5b7463df401ebdc6a95866e4dc84cfe75dcc865a39ac46334969b3e740602f716d1282541f7f9751ea213905a
-
Filesize
5.2MB
MD5d8835803757ed2a77781df813c40b9f3
SHA1e3f1edff8b7b981ec6cae6bac319edea1a015e05
SHA2569f43e869938716e4a704789da72d4d81afc860983aa4e3262ed673f0c33551cf
SHA5120e432fce14ed42602760c6878cba61737e19408fbd0bfe3f364d03ed88c91f903aa405fd01316ccfcd24ed93fac2a3ad3aa2f222fd991653b72ceaa009bce798
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB