Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 22:00
General
-
Target
2024-09-20_b2a46e0e8b49270dd16c3a0e5e9e084e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b2a46e0e8b49270dd16c3a0e5e9e084e
-
SHA1
815f7f3161bc331b4e4cc0e8565f0615f14c1cce
-
SHA256
3b3c7cebe77af74c7644cdec1d13f54980a12490178ffb59a21ba8ca4b582c15
-
SHA512
62283d2d05e6d27d8f25c6a074986fbc4ceea5c66aea7c399102d3b6947ef253a77d39e617790b5cf932daca6c9a5c71791ce2d1426fe326495a4fc42d49d467
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_b2a46e0e8b49270dd16c3a0e5e9e084e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_b2a46e0e8b49270dd16c3a0e5e9e084e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TAdqNKU.exeC:\Windows\System\TAdqNKU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHFpuJK.exeC:\Windows\System\pHFpuJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jBBPSnJ.exeC:\Windows\System\jBBPSnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRjwBnz.exeC:\Windows\System\CRjwBnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zyUCQLl.exeC:\Windows\System\zyUCQLl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNCcnQT.exeC:\Windows\System\nNCcnQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMdymvC.exeC:\Windows\System\TMdymvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCsFjsC.exeC:\Windows\System\uCsFjsC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xypSPvJ.exeC:\Windows\System\xypSPvJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMOZwPl.exeC:\Windows\System\TMOZwPl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obNWOmb.exeC:\Windows\System\obNWOmb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPYbGfG.exeC:\Windows\System\kPYbGfG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uaMKZaW.exeC:\Windows\System\uaMKZaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFZzdHY.exeC:\Windows\System\NFZzdHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lbrjsSY.exeC:\Windows\System\lbrjsSY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObeMgkx.exeC:\Windows\System\ObeMgkx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QlBcWBV.exeC:\Windows\System\QlBcWBV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hcsVrvw.exeC:\Windows\System\hcsVrvw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DbBjKBX.exeC:\Windows\System\DbBjKBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LhqEkKB.exeC:\Windows\System\LhqEkKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Pvzebgi.exeC:\Windows\System\Pvzebgi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58885c5661f8767f629ae7cc95d09336a
SHA17c18ff42ec959c8fdf13bcdedc0174d048a8106d
SHA25651e727aa6ff8f8feaf57efb42a7f52f1ced77d21b504f9668bb14d0b5ce1f07d
SHA512e83c8933434ea821c2c674a51efcef11c627d72e403188c18059eeee6f5bef3515d6eaab61c6638dce8cc032a48cebef77ed763087cb546251ae7f9b4eccfcb8
-
Filesize
5.2MB
MD52619ce162f9d36d07483cbe47675323b
SHA1e0c1ed4d4ab0d0af13e35edcc080db8ec8882e9b
SHA2569d016729ea68abef58bd0b0378c289cf20ebba1799eab7714facecb82d52d670
SHA5127d33f5ebb04d2b5785f44d326b1805e2eec9e702803df24e61ebcb2c6484119a7a5066f161010c062d0ca75af59aee76dc748bacb46775c2407ee9b13d02f74d
-
Filesize
5.2MB
MD59c0ccadc5a89e3697c574c64e2e2b4db
SHA1493e7fce67fce3db0e8ad312e21191f370e27fbb
SHA2566cd54c53615339cae1f3efad7670693d2914b5262ae2f2daea0ab49c1894f59d
SHA51239d5a1a115040283ceeb91e2b262541ad3a1839a7f322f5b7a8cd9e142ece505fdcd8db0c3f40899f5a3f65458c7fdf0e01f07bd6bcc7207596b9a1e584165cc
-
Filesize
5.2MB
MD570cf0983147120ba66214709ef48167d
SHA185f425e9d8dd3fd5b484e9d7bccb38ae4d6386d5
SHA2560f4d99dcbd04d3b4c241d63d934d0304f0a438ca7e924de03c1e2b69e9031005
SHA51221ef2e467d68ba600812d2b0007484848a63b55490f88f48c8428317a188fbc22e0ca6c8eb97a1a95b113f629be248f32adf92e1ad1cca7a2b77f06cc9be3197
-
Filesize
5.2MB
MD5f92d76e2f763ab61f34362fbd756b286
SHA1aa04d14e41b0e3011c319b9a27eed001fe0678f8
SHA256910e972b283111b733c1d9e184f1904f4c91e9f7b1eefeec51523bf951786bd9
SHA512f45c074c76b3df946de837593f250e2e583d5e970bb8e5cf0b06852a5f2aaefde2cd1961eeb30a3794a4c3c1dc4db38ecbd9865b7656f6981225facd668e17d0
-
Filesize
5.2MB
MD5d2d164307c63f84808d7200e7fdf3ed8
SHA175970fc28a37ebb4095a4acdd14278d2dcd9abd7
SHA25619d2be30e2b4c37c8be37687ce9986c230b1f60790444b111937abf96a870250
SHA512151193f0d763f6ef60bcf30745d8dcb9669ba93dccc805e0f9560ff22a4f1a37b70dbb0f04a9b759df257df3cf114debd2b689efe9914ef00eefcac6a233bdb0
-
Filesize
5.2MB
MD56b55850d572228e8d6af8f778662ad5d
SHA18fbc6d75ed615fe4e8ddb0821fbeb188e3bf49e2
SHA2567c095fd1c97b4fc870c30b9bde3024c6cd236a333873be62f9c59d3223e1a609
SHA512a5b2fdf25e29b776c2c3eb3a11ccdacfb1a0093d22d552ee36f9ea243972741fa483e236b46c56b1dc698a7322ebdeadc32d90bf471d52350efc1a4ab8da12b6
-
Filesize
5.2MB
MD562f70c32755809f8184c8e349e2dd994
SHA17853836f0d3b7e36415443edddd38ae5f6c7091b
SHA256b256d97e8311e2bd8ba41cca2a49434e820202b450594a9abaaac73c85d03396
SHA512847eb1ffac125985d438714cb78c2862e13bf8fc7df488b863a19aae2d5d920dd1ef15acc9cf1ef13a86791a648c03f68849f3ae724a6070461f676ba88c2b13
-
Filesize
5.2MB
MD5073d3287ed4b3b2674faefb05238145f
SHA1509f83fc24af6c20e83809f27f9834056fa1de6d
SHA256b5dd1f776fceb8c98c28813bbf419090624f08dc2237627f61f0b6cd386e3339
SHA5127d97ef20134cbb240135e3d9b5744e8ba252ef4de4ee6e6e7e02a5419f7581d4c31048ada891f1ff5fc0dad1625b893a54d4c9a1e4271183a84196fc6b95a3cf
-
Filesize
5.2MB
MD50073d6a1586fa7b7df97e14b3fe0dd3b
SHA19baeebd472fcf4b7033e62c3acabd16c045fcf23
SHA256b439897454f45499c637847ff0daafc70be0a280e9cf77b2c74415a490449ea9
SHA512c15d244603d0d435cf76fb15c7f5af15a2c5eb9701bbdf7f585840e7638ced2e5bf64d7fba621ea84365e2a7d1681fd98661f70c80ecd537cf051cb37c8defac
-
Filesize
5.2MB
MD528eeb51cf076729183e9d80cf58a4564
SHA1b4116c5f7c4c3f7b562aee2c986b1f0f1bbf3600
SHA2566b2c4300f0e3c7b804a95e7aff15371583849f19007a5b5bfee80b50191fe96f
SHA512627e745464a9656a165873f6ce9ab5afeeeaec560ec779445083b81f4a23a236680828302b3810ca48288a55dc6fef49d174b96800e476b6694b524022bf9ecd
-
Filesize
5.2MB
MD5078e97b581fa0a8b5e0cfc6819b8bd59
SHA16a4128adb2349872d14cbfea7476379d65787e3a
SHA25631c6c5e6525097b444faa597e7aa74ff75062ee379b9d581913bbb172e57e3b7
SHA512b48ad8c4fe4194be0e79f4b0210f185d7675c375a235ac0673b01ba35dff1e3f79f9d4bc2af2bb9f41e77374d1a25896e6621cbb5a691ca10bac1bd8a170024a
-
Filesize
5.2MB
MD504493ff4636ffc676968777294068c21
SHA1c4690f35a55484090535702efc225f71287b02fa
SHA256771f26f8d386dc90aee4ab7d19c3a5a0a00fc49e41e0fd80dab44f6785d5f62f
SHA5126604073d506c2c07df500c755d5e73e8b037f76ac6f9a4eeb134f7ea47593ea1e2fa4bc4a7822b680c2110138bf87baf87368c14e3062cee65ae72d1a3f068a5
-
Filesize
5.2MB
MD5e3c36197fb63ccf4498b77e4ec51dea5
SHA1cbeac42428a1de9321af35a9c8473655e4a2ae61
SHA2567ad172958d7e1c3392575863eef1257ff8ee160ad3cf5169bce35a2d993058d1
SHA512c9c0f41fd9a9743d5184e241bd00dd72de164b445cf16f7709c453581af33529c44789eea69664323797b4ffe41ce832473368147d2ad97f23fb6264f6a3fa9a
-
Filesize
5.2MB
MD50e7c4cda8780fad25d5766e2ecd2a3c2
SHA1281e43d70798d86f04f5b481196041faee25e273
SHA256ff5822a85248ce106c746530599e7e23c93ad517bebfe3462cb97499f3f31762
SHA5120c8566012778bdb5952db6e71f500386153d7a437933ee796580fb54ccb59c179de414283bffc28439742894df9b729c5ef5f15a8cc078b9632160b37e69177a
-
Filesize
5.2MB
MD5179f797bf0573a64bc0e940136b40e4c
SHA1a4c33261486a9dee17757493d5125a028ae11032
SHA25610837d925c611e51a45cf6c6b81ec57e76358d064023d614275b559873c8449e
SHA5127689c3b68790a9dcf554537f76f4e53aab825558813da05a0df9b25913480a16fd92c206a59f8e367f9a35a8fb75f15b2c1d680a76f25d9090be8fbdc84a2bef
-
Filesize
5.2MB
MD5a4f3cc089c8de549bee63868cc9c0c3a
SHA13012a7591728871b3d6ac2dd60e0fcf05aeb4cb8
SHA256df24da9209026430e5d9733d9be4beff9510f1657634bc117eba66bf43e5ea02
SHA512632ebe36e82b093b8a800c3e207ab6c8d01f58ab77d697696c46f1b140690293bbc392a019955f91ac53dc0522cf32ba5f454f59dc834983db285f48a59ea000
-
Filesize
5.2MB
MD5bdb2127610a8f14469da608ab194fec4
SHA1719a33bcf0175ac963727aeec249455ac38564e5
SHA2567bf2b931aec737b04f37d837c05f9c119e4d2c19502c86769977c5fa7e8853fc
SHA512e6c2031550fb39d2aa40802da5615e686ddebf7131f209183225eadad1b183b73350bb4dc715c99e82a440ce78f29f9085b9351029078749d3e0342f031f80fb
-
Filesize
5.2MB
MD5524425a5c1ac10c8543013b447da812e
SHA146456987a28db40fc7c826b5341abd0b35a1f5d7
SHA2566ce61eaeb9f35c4435966990b2b6a38e00f3a6e4bb3b67e44734fc630b941b7f
SHA512e473e8be7ad50c3c32c0a29fe503fba604ff26d63474b7d68d54e8e0774c015682f1e21b2e1113c57834dcf5f59f63dbbbd6ddc94bbda37a042c6a91245cf533
-
Filesize
5.2MB
MD5c6e50b629d28d744907705b61af07abc
SHA1026f694e6f6f5b0b02151b6f43ab0164e23b5f60
SHA256de360e88cafd14af35b29f79d60d559f6a741f54f870693e4417912eb6e11f93
SHA5128b45b7cdb2f1bf45816bc9d59378d928c8be5d9383e07ee9e5b49d363ebadf7b0a766e34b9e0440a069c67b31b13a87a4f22ead7472472c592f5af012e53d3d2
-
Filesize
5.2MB
MD55808d2ab02fd361c7765781845b8f0fc
SHA1243c4bfbcc9cea86d380fdc3a7c84d65169efd84
SHA256d5c153259d10cd15131741f6b764a04819681e45d84403e0b1f016523405c20e
SHA512be2c76cc73c8f9bc7ec4575a5e504824111132dd939458a630b482cd5df31763146b911a4c8aed8178e25f42ff676c6f80a83d5f1ce0a872f030c18beeaebb43
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB