Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 22:01
General
-
Target
2024-09-20_db15583d1d14a37c4b3adb1413673bdd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
db15583d1d14a37c4b3adb1413673bdd
-
SHA1
f5104a8ac7c60d4f718cb554dc3f5a64b82fcc8e
-
SHA256
c75f244fc806c5b64083ce10e1f33e9f1e54435f9548677b9b07ade9bb8c5c21
-
SHA512
b99a32d3e929cc8a19e882632080bd16687b167b3adab031e4afacdfb4476fe846601e93c9bb2eb510d8a2f34da32208c21d458c5455819fa87d85b2594e963d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_db15583d1d14a37c4b3adb1413673bdd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_db15583d1d14a37c4b3adb1413673bdd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FbfcMSQ.exeC:\Windows\System\FbfcMSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Qtsxrfa.exeC:\Windows\System\Qtsxrfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASUcmsk.exeC:\Windows\System\ASUcmsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MzAjkno.exeC:\Windows\System\MzAjkno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ngYcArP.exeC:\Windows\System\ngYcArP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpopuKd.exeC:\Windows\System\gpopuKd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RXoJlVJ.exeC:\Windows\System\RXoJlVJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wplgnPf.exeC:\Windows\System\wplgnPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSZdVaU.exeC:\Windows\System\oSZdVaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hjGWbTd.exeC:\Windows\System\hjGWbTd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrypAMq.exeC:\Windows\System\mrypAMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isSfnSl.exeC:\Windows\System\isSfnSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuEpXCP.exeC:\Windows\System\fuEpXCP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xpktoXp.exeC:\Windows\System\xpktoXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVutqkm.exeC:\Windows\System\YVutqkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\malardo.exeC:\Windows\System\malardo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TJuWMnj.exeC:\Windows\System\TJuWMnj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqtZCtd.exeC:\Windows\System\OqtZCtd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmFAZoh.exeC:\Windows\System\ZmFAZoh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHmALvH.exeC:\Windows\System\tHmALvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NXMdHqU.exeC:\Windows\System\NXMdHqU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD574ec86854dbbb3c54acb4cbc5d2f8061
SHA154f4201502bc5da144e3d5eb77ca263d4da205b7
SHA25664a435c5ca33f68253290824f4dfc4f69068c0b048a075febbf3163cb19faf55
SHA512aa5e7889aa86e4fb017619329ab73357a0475d37361e1848782c49eb8329d8306a65498ca72f6d1f5e213c24f0acb563c3e7da8315a30167f4c11c8895c5b703
-
Filesize
5.2MB
MD5bdf23f5fa1b7da8cfac04d3183026eb0
SHA16e47eb9c4ea64bbc2234f2003800f163e6af950c
SHA2561ab628ef73ed9449960610ce83341dacf46208389ed59562a4cb3e4e43b2beff
SHA5129426cae55c827983d73a9ee162e864922915a5c28f7eda5191a3ae55820843a283d826deaa486c37fa06766561121eb71142f8168b9d3452553b1e8be10d7594
-
Filesize
5.2MB
MD5237ab097dab32fe0c6f87af28d04809f
SHA1b20fc4a337c70fa88e2ce04a8434f70543f2525c
SHA256e877027ce61d7563022098015d6ec4877e7bef61ec3da57626a7f0516943ae5d
SHA512d6488b18eaf7be750c94eda8fe9b9f46b57283fe066ccb7366d8b2640d56acb7d8bd94136497c4050f49757dd32242b993d94828ee2471bc634aa13cd17e37af
-
Filesize
5.2MB
MD5a0262029ddc2a6e951082b3744ab8d56
SHA17556496c2185afc21ccc73336b5222e117fa0bd6
SHA256b14804e7d7e5093858c517deba987533705a55ee68b8e63957fc0a1a36a1094d
SHA51280d06c94c33019f35d5b9c15b2ebac93d8dc994840ccb6bfb02755e254a8805bc358c33bd0f3aad4bdbeab66568f2ae842f56f6434f081422fbf972a8ed3df6d
-
Filesize
5.2MB
MD5f5118d58c5db2df346cb600ae4ca2c51
SHA1751fd5aebd468e4407ae02dde9236067b50ca665
SHA256eb7a24fc0f9aaee95f0791179e508d4e2a575a3092ce9b63e7228b1f007b3061
SHA5129858c37ce3dec29fe0e41a2ecb6a82f5782bcd7f23383804b6f39b4b506c39a73a78a4c4485200e43d1331a5170bad4e3487857648e20a39589090fb467413d6
-
Filesize
5.2MB
MD59219e088c0e430fd46fd79aa834ccbb0
SHA1273f11fe7d4edadc929c0f4a6e16423e0bc0dd41
SHA2560b7664033fc19228cd45c28e6a8b43aa4f174e3ee79c0f65a0c9209ddc3a5268
SHA5126aabaed92d4ee8e3b217354d5b4f365090a0ad3ee279a8e852c40e9d6055649acc7b28f4a421093c9f41d06555f0428061fc6aa187a1865b124ee0347950026a
-
Filesize
5.2MB
MD548e13f282bd100a1120603c9175057ee
SHA1958dd1b3924ba25533f56938faa4df2297ed3159
SHA256cc50106c86f71ed88c084c92d8bc109f6167458919e665b342599a66067e2ec2
SHA5129d3321c2ed304a306d300d9507def7fa5e75d690d2047e34a07db67d12f6865c265235dbd0f3ee01b854a6172c2ec4a4b4b9ac38858cf7192394486eea9b6aa3
-
Filesize
5.2MB
MD5bc611608352cdc1f7ac7ddffc71aa69c
SHA1c5617c96027254e3f17648cce704dc7be88255d5
SHA2566105ab2fe0ced6d6ce3643a8e9db026609bb947d6533ced9240a25453fe08274
SHA512607e3aff69aadc46ceca51d311d571506ecbd81a9563ecbc20938098df97767e7c1b5dcafe6bb779b228658469b5cfb94ff97786ae7aa8373b2377e8deb6bbfd
-
Filesize
5.2MB
MD57896fb166608bdcede4e6f8837022455
SHA1b6f8275aa86b4c5a60dbdb3b0ced812c9ae897bb
SHA256f58cefd93bf68d96b84c55c95e7ee9277a5dcc59a26cf5d9fb361ce5b3e96fd9
SHA51277b87acbc2668a7d7dfdb4ee0d651fa70307e4c37ef241305dbe503c8f81de00b12ddd2b91076871107d6303046b398981730f9ff73c33a9d324dd21ef7f5a5e
-
Filesize
5.2MB
MD5d318230d428a69b33d7bc46c74911fff
SHA14f6cb5a188527c22fda66dd6c248d64ffc2521c5
SHA25637b51eedfb827495988d99d63d091a23e39c507fe8d5c9b69ad97983d9dd1c37
SHA512a762d4f4bc9ce93fd01089cede5bc206dd4275b9aaa7565abb947bdcbe70f797e42d9ad49472b93da0a3c6883b08caddf040dc8827933bef5702cf8b1fd3fe17
-
Filesize
5.2MB
MD56f035d58eaeb50131d0ac38051a07979
SHA1b4f1d8055141a243af1a6ef2826b532e750ca139
SHA2569df9a896d70d13e63130f02084a8a547d67bcd8ee15a694cfd737ec9a1a5ae95
SHA512a87f321ad1d171dc0233808bd950bba66e1d14335425037daf62db566b6cf0df63bae19da40d43b4ffc70175720834e830be5dc69891a4ab369f1a8063b9b714
-
Filesize
5.2MB
MD5a4120fde3ccba8f3e39cfc608e57d4ba
SHA18eb7a2eaea76d506babe87a19730839d794db754
SHA256f4ac113d8170039d23dc977a6c7228661f90592dd24dfb3e323ad1374085d1f1
SHA5121be6166e8f4a0039b0f05ddfd9544db262a4be23021da02ec2d1b0539620cf7931d0393569301caacc057d7a428bdd37b4949be8f91d0683e12041aad3f812ab
-
Filesize
5.2MB
MD51b21a102721d5ea3b8740633bb528986
SHA18c3ef9e1d29f388b15e313a89d197a889e466f50
SHA256cc53047f6ad61ffaa7fc40e75aa0893370e0e7e412a05535d22fd4ace43f0b43
SHA512e16c3d5484297796d7e2e0b477bc31c2e357e6456d68955831a8dee522f8eec4e751eed08a440ccba8cda474e57c9e5a389466ac1865a7ea2e6ec73cd0055f89
-
Filesize
5.2MB
MD516f967be68fe34379e3c73b6f122810d
SHA14581054f2599162fef958548eb317bb037d65cb9
SHA2565a94b8f1b281f8a16fde62001af32763b2bbde2d3e7023b35ead69ba3c686a29
SHA5127e29a9457ead3335f9e74134f12ef7f249653c2c6f1602e0e552fd2339ee7f12d5807c9016c9edf6968bea6f77412a9b740228e75dd1e16ba2d977729ee544ca
-
Filesize
5.2MB
MD5bb698f8ab9f7db0827dfb5a78ae2d9e2
SHA16213ff191c1a111a79881e865772bf7592b11b94
SHA256c9f11e917d65dd19c232d2561dfd9099f95a6636c5564e05a4e7157d30839de1
SHA512dad4c0aae32b4f965baaa5fe9c7c62486b0714e7c9076bc7c807c935ca6121cc4199610bd94bba68e106bbc24972de78f6255aa64d8592fd8f40dbd63ac22d02
-
Filesize
5.2MB
MD56f908eec827fc1c89fca4b3a139f5800
SHA1546806fa8d36f5630a01846e5b65125cc8a7c208
SHA25649cff7f8d13f04c5a43d09f2820216f354eab366000a5315d02ffe176424abd6
SHA512d8df9edf9d9d8606b55acb6e9fe3603b516114eb286953e0546fcd964e65bc7aa054a2b74a1f89644e3bc73147ae2a23db69d88475f54768170f03727e6272b4
-
Filesize
5.2MB
MD56e3c296ecc2628c104de2c42992e68d4
SHA16bb67c95ae930f2199efc6fa37c47d10ab872d3d
SHA256a3dc86882036b84a8e4da4943eb5b9ff10052872441b7feb85bccb97969e8594
SHA512a177a990876ab73c0c1e6dd538535ba2d45be45f49d04ad2c87ae909e12a7a46010874a6b3cf512f73ea4d4cdaa8860bb2bbaca281feb6dad37ef4b32e560d32
-
Filesize
5.2MB
MD51ad8403929657b96ade5f4e058b82a78
SHA1c333e32a6a45c23508c34a4370e484a04836dd7d
SHA256b7115c44a4333058ec35660ae28f74f653c8d02e4c86830bded745a86e2a30a5
SHA512f8098b430a5ecdf796a4fdaba333b59f6017c0519eb5b3eeed2000a81251800dd00d223d16b1585900d1108a7bad81e523ef58152999bd9a7655bed481e3c344
-
Filesize
5.2MB
MD512a5b83e3e835e5401f6b946911daabf
SHA151d82e110a99dda07b3ff0beed5d8aef2f1f076b
SHA25601313bcfb867816eeff1e43dd7f291fe90b71a7f138eac87aa6ed4b15b1b43e5
SHA51224d3cead2f23335364ff56b4520283ae3289a285c3435b9e0ec1cc7d1893e1334cbf5f3b9c09af07d04a9b6c50cc267b6ba3a423e2f9d48f5a68d1a6197bbefb
-
Filesize
5.2MB
MD5f73cc479eaed2c989889fdb233d1c655
SHA16af6a837d32c68e2fb9500e630d6f81c9e5400e2
SHA2562907653c4502b98c2b8a903bca5a0d6b8df32a704823041f21f4092bb57fc335
SHA51220aaeb8970d7638c9db63778d14b5cfb12ec6d9a90e7f527e26e6888ad4839347298e96e165891eb8f45f798a69002d66b2099139cc6807a1ba87df5e08937ac
-
Filesize
5.2MB
MD58c801897bf6742971576a730e46771a0
SHA1ff20d7938491cac3fd7382686741c765bc13a7df
SHA256cbb92dd50d5a0dcd0e8028de87443151ce2f2eb6897240e374e54672a369130b
SHA512424e25dfb6501644b651287c9549c2e893af06c350cd7db7360535bcf578e68e9e01bbfc999c60f94bdb60150d6f01921a4a54c0f73e36ce4b665c66720be06e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB