Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 22:02
General
-
Target
2024-09-20_ea4b36575c07cf71fa2bde1697216b6e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ea4b36575c07cf71fa2bde1697216b6e
-
SHA1
b1c6770dceea0412bcdddc8818880e844bc7b424
-
SHA256
dfa07a1e00b1cbf620cf5f14de35639f1c301050bd70762a1e08254d2e89aa50
-
SHA512
ea9bcfc80232947a1651e416fb8aea0f68d4c2ad600b94369d429d19ab068a411596404c9c9c251aa14a510edb8a63d78a2648d6611d38bd50fd1d0f964b5419
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUs
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_ea4b36575c07cf71fa2bde1697216b6e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_ea4b36575c07cf71fa2bde1697216b6e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MwcihGP.exeC:\Windows\System\MwcihGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OliMEJN.exeC:\Windows\System\OliMEJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhFaBJq.exeC:\Windows\System\GhFaBJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJAOKYa.exeC:\Windows\System\VJAOKYa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YyKKvjo.exeC:\Windows\System\YyKKvjo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkBTSXw.exeC:\Windows\System\UkBTSXw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQPzYeW.exeC:\Windows\System\MQPzYeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gYEVndP.exeC:\Windows\System\gYEVndP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JrnAptW.exeC:\Windows\System\JrnAptW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fXtjSdC.exeC:\Windows\System\fXtjSdC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cCLciCq.exeC:\Windows\System\cCLciCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfwpOIy.exeC:\Windows\System\LfwpOIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bJnlwOc.exeC:\Windows\System\bJnlwOc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClwUcJR.exeC:\Windows\System\ClwUcJR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dSectdj.exeC:\Windows\System\dSectdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SiPslkq.exeC:\Windows\System\SiPslkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\otKKfXy.exeC:\Windows\System\otKKfXy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONYYFnR.exeC:\Windows\System\ONYYFnR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CqlufqX.exeC:\Windows\System\CqlufqX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsVUtwX.exeC:\Windows\System\JsVUtwX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glsmEjC.exeC:\Windows\System\glsmEjC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e902921d82a6c1e83dd359090775a533
SHA166940e19a1eb6eeaafc9bfdb4656168c5456fbf8
SHA256de6b0b7cf4a90fbd018cc65ef82da617ef85a28c4076aebb3d1479fcb57c32e1
SHA51202d81c2a076fc501734ac1ed35a6783647319d369bd23608c276a094996dc231d2b5e074ec36d5d65785be40ac23bd5b8848cdd57edf9e3ed887f3459e3cadc6
-
Filesize
5.2MB
MD579902688c16326fd73d6e1193ed11f5b
SHA1dc822c16a1dffaede5fb6d32065eaa03fcb420c8
SHA256f8f2637f2e0045fb3743f6d031ea5e4bbec2269c3a72956f812a2a2d6be42734
SHA51256728d31c6a0d6a1eea39dfe82c2e5fe13c96940af33b3578bbf9bff2a523c064b9f7520179a49100e7f096dbc9485d8dd19a80a2d57877cfa49b73e6559c4cb
-
Filesize
5.2MB
MD5065c874768a7cb14624fe8b69482f5b6
SHA1e0d03eb1ebab80d3da0950ab8befa68a728e22c3
SHA256cf368f5efa506ac561447f1e584d891b917a1348f78dd623cdae5df7c1c37756
SHA5128ac6de2f3f9f0c2ed1ef0557481b6db2677939182ff10aecfdd4e3930371ffe537ae5badf04372ab72a799ff6d88569ca5cb5d894697b38ea4b636a39f8fc963
-
Filesize
5.2MB
MD5b9072ff28da34d65f8a1dc13a8e87c3a
SHA1120b44be9ec7438fd5df6eb661dfdda006b1fd5e
SHA25624ee46d2212b6232b71e293ecf8ffe858e6d5bcbd27e5027901a5c7386a45498
SHA512428a30a873bf0c0ec76e30c76033289f45fb44a76d711956f3f9991b0cc03bcdf3fb5667e5a16a4c05edc8504289e6f395f936b0e5f3b4604e30409c854e4219
-
Filesize
5.2MB
MD5bd4651f5e45478c152245d6295bfa290
SHA127d877f00617efec0b87ebe528efbb14c0980df4
SHA2561e8d4fd98aa34f78244063bc748cb4fccd0ca30c6becbc11be84003d35b3bf04
SHA512913a7767d9322dcc04cfadfe12a25a654cbb0b3e70ecb941da39ed524d28f8b42fc4955199f8a713158a76e84ef915b5741328646ab1084ecbee3e0cd644c6ff
-
Filesize
5.2MB
MD56a085ae4a0d84293330fbc2e5df3eb50
SHA16ab86a280834c1b65ad27ac5709b0ef0333c1247
SHA25610019855ab056aa3195f872fe0a29b880d22d47a79cf8c256338f3549ccf797e
SHA5125ef655133194a3c81b7213382e0ee1f9ff250c626da710903ea2d30c4ba1179f380834dc445842cf66309a2c3233486d8ee62b371f1b8e51944d19c715a0da05
-
Filesize
5.2MB
MD5767cb3014526dda6db7ae12b3b3e9f0a
SHA1dcad97e3e906c3345395ed48c896a508ee3862bd
SHA25604bb941aa5ce71909897649182b8c3e10a6275a7b8eead2eb63aeffc5694ad72
SHA512364d46222c4af2f919655a8d31cc9b2ad0565de9256a016d349b6d6f4d59dab030ff2ad428af9ae71002d5f9954a581f2dfcb07f7e67a0ea21f34122e2fac6ac
-
Filesize
5.2MB
MD5b53935eb109919c34f70a74875ce0613
SHA17dd6e7ac8421eecbe98a3f96be1d1e955ffd4592
SHA256516f31313ab6e2bf8ec42ff8eed52e3b4558b98179869f3dba15ea35f46f2816
SHA512dbccf17149ecf7e712dea50ab19024a3a0fbcb9a68ae76e82edfeb04e7a9af8334c4006926de1ea7899f692d32ac5cb89ba72c423c4d4e56578b8454283adc13
-
Filesize
5.2MB
MD5d430c1fa5bce21c28f10888ec7b5e180
SHA1e1a0335bb079e332da8d85170ee539a00845bd79
SHA256375c819383526ad5ca576a6f00d4850abfcd09aac20269437af8d688299e6557
SHA5128d1c727046fb3f9ac848ab406bf1eebd9fad7fed9f2baed8f8516194f200ebaf1c5f021b64f13653c4de5075df86476e7bab4ce7825c8f7aec0996697b37169e
-
Filesize
5.2MB
MD5e5087c50dfd76f9b001104cfdb99b725
SHA1ac74ed643c3eca2a28e156a4534e3d2ca418e60f
SHA25631fdab3dd2b89780398be666b032f17601e0de79b44807678f3ad6c8a14c5821
SHA51257b1584255d662653d7c1bde7fdc9ac06a60b60b5988b41b25c765485c0988fdd4e4e1f986f3a8f2a1178228f807ff65689096584fe4deba2857bebfe8ad7f2e
-
Filesize
5.2MB
MD56967580ba04f66d5953fb6c5e27df567
SHA1bd29e1317096bfab6ac2bacda31105f823d1f331
SHA256dc06af063b4c20eb82224ebcff17bd3a2a737e7ec24a06b4a907787320ad50b9
SHA512175a6ab95face855b5ebf1cc4ade601bb25f8626563f2cd8f37502c5504be82c778ac93edf48636d69d29c5dca7beaf521e472ad10a10a0b0c71bfe61f032118
-
Filesize
5.2MB
MD50df958308c4bc5efda1dc740f6db8106
SHA1f6d5af65d4e91009acc3d396897b35cab46d0a03
SHA256f82304cd2da4b9e73c52388166809c81172f9bcdb59c6264a93c8dbffe66f5f2
SHA512699a5e2946e71feb30c443df2fea9b1cb92d476c51416bd291817c84cb27a6ffa5f70ca632edc0857166c75db1b27c15154d76e85c0baaf8e0bd5d395e770d7a
-
Filesize
5.2MB
MD58ba74ec4df6d387c540049689291fa64
SHA1810af91b1a8521a4ffb3a6bca4aea6249423ebe4
SHA2568bd66e73a9a4d31cd439cb80c24c107651159d4970f455707839bb6fa0cfb97e
SHA512c95b308cbdd1c597c5b466e87bcc3ed493beed48e6118887ece095ff41cab3c09feb8d80c3805adf130dc21c07d69dd244bd2c5ccd93f13c0cb4f4078a5cec6a
-
Filesize
5.2MB
MD5527fb7cfa5beeb768b3d975459e93ab4
SHA131ecd533113051af8a486d1091058ce9f42ed8d0
SHA256c31cd7ee1bdf3d48ebb59ed11898d565b349c7dd24e41723877c175e156c4722
SHA5129ba11c3a291ad1d6aabf9c14ed2517fe67774c92f556745c3751e2caab786f79fb4594446770f61f84388f50112e580332145ca2bc29db71396cb595d82a24bf
-
Filesize
5.2MB
MD5f1d7e0a68a8854e2e78e750bd63f26dd
SHA1e9b650f31acd31bfdabaae3ac0b1ef60114df182
SHA256297989f4329d87af8dfc8bd04ce9edfb822712c70ee186220936b9c6bba1cc03
SHA5122ffe14cb54832b785dcae8136f88dc7a0216dd91c45f2d6fccabb6eb1e45f2b8f95c94ab10d38444e3592214cdb6c876e7fc66c7d5dd0ab11b3427cafb222b61
-
Filesize
5.2MB
MD5d8ecbe242173e1a228227b978c04a92d
SHA10b06f5f3e5a4fd16829bc87f2b8e1118009765e0
SHA25632a690b89365c3a125f8dd019108d2c68e088f4e4ac271afca2c0a2bed554aad
SHA51245a26670d772367d52fc56a9b4b296bb5ba2ba46244d135d09af9e1d1fb77e5133e28746698399df6c800d22818e55529d381e2c884b415c41e75fb1103d296a
-
Filesize
5.2MB
MD54d3e165ee5e53d43461ff4a357ece505
SHA13075d3365e2749a7b83961c0a7b4fccf2c148e89
SHA256b822b80dc3a23792fdd234dede9713163816959f70ad329cb6a431934db33cac
SHA512337e791f3d04945a189c32f25e861ea3349641a4cd1d8380b435a5dc97bb6c0e45f2f59a309e697f8dbdb62e2bc24e8bf1f53928349717012741eb0ed0ec14e8
-
Filesize
5.2MB
MD5ae8eb9bd78ba404ebf1ecd07de6af495
SHA19bf9e37da98b6ed6a9fefa36c336b9c95325a4a3
SHA256e8638a427ec69e48ddc547981cf5cf5c3f42e3e9b5ca8555b4976050fcbc87f0
SHA51220539131b78310ab150bf3eba1ecf7b475bcb17fae598f1cf82a4d6980e1c37a4f06ac56b651992ae9b6ba61433656584160b970feb95e14a249c0e9153a11ff
-
Filesize
5.2MB
MD5e6f6e18e6b733c6897a67e4b9bedd9d3
SHA1968cd748e817c3aca5d6e9d8ae40c56c06c880ca
SHA2563bdb897f31c3bd5b85aed3bb191c907ebef15014a2efa0c1c959b8afaca84058
SHA512eb2bf896090e27549e77523e8912db3c8243653e28e06b089084192a83267bdada389b90551e33a7d8d3a499cc136d6ff22a37b40ada8c2364938a32df6c0e04
-
Filesize
5.2MB
MD5151dd94f5422b78ba8e4b3a08be25c60
SHA1d5c98dde6fe979f2e62a9948cbd2b8ad420265a9
SHA2563064940d2e6f1b80eb4424cec41e56375312dc9f53b350d52adfe91ea9e05d14
SHA512e8818520633d2b1eec077861d27b16edfb98bd88d28d5decb5d4b47d6ba8427804fe99acadb470b149a76b2d7ed997b5d906a5f6a0ce30c0d3dec8c7a5fef391
-
Filesize
5.2MB
MD5122d0ac337f801733daff4cb8291a16f
SHA1799122e16fbd36449d516f6d2bfc5af1bed6afa2
SHA256a8b4dc3067b44c1949ef9c0f01300e95126ef9b36212662c9397f135cd821554
SHA512a2cce934d9066084c8686730a36873f234eb0dcba9c8797fc9a945ef5b86475faa6b70128ed53316613151be8a659820874c2db4021e03d2fed8fee61453b127
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB