Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 12:01
General
-
Target
2024-09-20_cba5aaa02c6e5775fda2c50dd9bcf413_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cba5aaa02c6e5775fda2c50dd9bcf413
-
SHA1
3830b17a10e84deceb155a1656356ef8c4052d0d
-
SHA256
4693247250cea4e4a253a5e206b07b42e7a678dabcdc3f32329bb9ad8306a4a5
-
SHA512
1770f6c56ce2396e114dc3dc354b749030ced278eeaa0bcb39ba2655251f6133f1fb10464f8491d8d4a9942ef7b6dd1c71501cf803cc54f6a9ad341f26312ecc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_cba5aaa02c6e5775fda2c50dd9bcf413_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_cba5aaa02c6e5775fda2c50dd9bcf413_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rWDJoNU.exeC:\Windows\System\rWDJoNU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tayvcZx.exeC:\Windows\System\tayvcZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrHICtA.exeC:\Windows\System\GrHICtA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiyknML.exeC:\Windows\System\qiyknML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtiuPHb.exeC:\Windows\System\GtiuPHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhXqkjX.exeC:\Windows\System\RhXqkjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\owaxQGo.exeC:\Windows\System\owaxQGo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GmkhTrd.exeC:\Windows\System\GmkhTrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKEJbPk.exeC:\Windows\System\IKEJbPk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXmBFlv.exeC:\Windows\System\QXmBFlv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmEUjbQ.exeC:\Windows\System\CmEUjbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwEApcP.exeC:\Windows\System\GwEApcP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BskXwkQ.exeC:\Windows\System\BskXwkQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YkacYuY.exeC:\Windows\System\YkacYuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEqRVLI.exeC:\Windows\System\qEqRVLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FhKpKxh.exeC:\Windows\System\FhKpKxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYTaYDa.exeC:\Windows\System\BYTaYDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMOaZwp.exeC:\Windows\System\jMOaZwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZNgRei.exeC:\Windows\System\yZNgRei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtvcEJk.exeC:\Windows\System\RtvcEJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MuNQKVG.exeC:\Windows\System\MuNQKVG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54542221fa5a872806cf2d1a067c9edd0
SHA101f58c62941676bfe0ed399a8378a299de8cfecc
SHA25609342d11ce767c02afa31d190e9e27daf0c6f19641e320f42b05736140e0fb1a
SHA5123202e1c81a7c0ef06858cb3b439de1cdda9737ea520805f8eec646460ca24153c7753435611680b700090f0ac0e5cc2b8c98f9ce6a8a84ef019fad1b61d485ee
-
Filesize
5.2MB
MD57ea3f4d6c54e23522515ba820ef8da3f
SHA19f76826d023c02031e4f3eb47e8aba5f77e0c3ff
SHA25679d9fa39c2980c6761ea6fd999706d0b7aff81db284d1695103266c80004ec9c
SHA5122fcc2bb4e12c3fc9547c83f42ab5a03241397efe70291666f823874e6546599b8cf386f5060bdf88661642b73028ab00269e4de2e06d4e1e1ad4b0ca152f7f71
-
Filesize
5.2MB
MD50842f7995fb39642d8b0577b787464ac
SHA1a240b705db047e18f4be5b9c68a360701606becf
SHA25668833ef41989d528fa3f385d9b09f4d072b5fc27384ad6cae6f4b8e0ef74bcc3
SHA5128f15aa2653c60df59b053d377aea053ed751a31614f772e8ce35f5a978357925ebfc8f4f21f1300f7b97e4faaf06059971a074cd04ca30836c998f5044e8949a
-
Filesize
5.2MB
MD5bdf93cad44a1dec0bf5fc4471427de8f
SHA18d570b1a550d4820ceb3f0ac89425bd40c206a9c
SHA25634f0062803076b245da0720b20a3bb1588d35abe3459f58b9825b97f44758f0c
SHA512f896a80c234cab8b18ed99fa5c0906cc903f1defadf9e0609652bfd005358af5c9fb100efebfcfe001e8b8b4380511d58adb04478ce887ce7a39cc8456ef84e9
-
Filesize
5.2MB
MD5da3bcedf7dea812da7846bd231112c0a
SHA16e1f4b4440167d3a8a027e33ca249d887d89e12a
SHA2563c8eeb6512902e725a5bc843cb8eb6b13b9eed09d14ca019777466369df1a3cd
SHA5123c813679ee7d4e6de794272e4425b0291324ff33cca35ec0a7585a31f3c2a6c5899bbdeb2dab512e6c114e083503ddbd6f9145e785c56918f7490100141f3113
-
Filesize
5.2MB
MD54ffd55cde034afe13541f9c58ab9ce9e
SHA16ebac2f661afca3c436ee433e8e75557c7f59343
SHA25634d8f8d5f198f83921a338b4217d08e710e6e9751118b815a090b36c38a702b1
SHA512c641de8e14d39d812999cc7a3577c547c1cf571ec36211a81621e73d93c291da28bbf45e6b44a2f1cfe1fcdbd1c9340decf33cb02eb5015cb50d06fdad9489e0
-
Filesize
5.2MB
MD531a68e1cadbc5bfc7b5996df0ece468a
SHA1bc22063f42b17324ffb6a03afb04f5c54d965912
SHA25621b8e6469a39073c6babca7a8b8cef7afb7f54f856473ff0bd92609a73a24730
SHA5129a967e0ba6a7b105a348fe97b7cbd399c796ab5e6e623e2a597336747575b9cdfe72d992fdbed988d3d51c753338a99fab6db562a0810abf48da2e89d2d13385
-
Filesize
5.2MB
MD568c843a7bebae63e68f1d67149632520
SHA121f97432931e18f3019c544c6afa5711f4c21816
SHA256c9a5b10a7d5a1ba14c588db1946ebf7a2f8adc23dfc7a4b032963170c6f3ff64
SHA51205b5e2928605c7ec776bed39737d4094e0d0b3849d384c25233b7b319fdc1dd603584ff5071c93ccc1d357e387a3cd1d86834d535c37b477a97a6ebdff7e22cf
-
Filesize
5.2MB
MD565d95524dc6a3c15eed219fe614207d7
SHA1d641b5cd34fd61a4a91ed76307a56beaeccc1467
SHA256e800dd16eca9e89c3f7199c684e41265d9a51b855eaf9b28502c1fc1e07df560
SHA512a1c68efde5207b8f7675c9bfa4348bafeadbbe42a775f0232e86439be1311fd64b9cc31b37f299c3c0ebf8d38526adcf27fe33c466fca09c2677db069c46854c
-
Filesize
5.2MB
MD5c7ea058899ac94e42903a723c8275944
SHA12fd6ff53eab47390eddfbf3836323757d4127060
SHA2568cd00551b9d0e56d592090f89bdbe284d712ee134836d81e7dc536f9b6e40bcc
SHA51297e60204283619a6102528ecca28760984da4acf4905823e955d3b67b84db7857b27ecd18c5274093abc4645771db524b86606ccfcafbecb39dda6ce1f00f658
-
Filesize
5.2MB
MD5b39b0b6e66a2a1f2009e603f41f71f88
SHA1d9bcc75804d70d9dffae893f89cdaa2fbbad1084
SHA256fc0206f99cef835ad5562c5bc88ae596d46483f1d0e82f3c0be489d0cbedafea
SHA5125383118a59c381297aa0006608a01fb7f93696bdc73c230f49021ffbf50f88974274ee6267a9e61d5d38ce9c9e5052a035137d0a4c355595488ac0188437e51c
-
Filesize
5.2MB
MD5bda7cd868ec8887f4b594eb8d0d88510
SHA10ae84c1cd2886dcbb099b4751725f2ec0a2f9cf1
SHA2562e99a48f2041338e5af32da83cf4e991b4d35c739a9e95cb012c922786b8e20f
SHA51269bc15d3f1d07ab8dab1564825fafb9c26d9079c0292b9436ca0a85a520e8a198ff6ad9900637c39f024aba0e95c65419424217f4e2607642d241942259217e8
-
Filesize
5.2MB
MD55876c8326355f0ccf9de735c52825fcf
SHA1bffdc998700bb8f95ea769266c4e2b003e66ec6a
SHA256430787a421460fe4677c517532d169f26d126d815a101f93b62cbd3b0fe59659
SHA5121944b1c5745467c43d3f514efe591f70879408c66b4850ea5d1c19da347c14585aa46b9bb76dcd558ea92fb5c560abcb67e42c12b46b265292fd20f0e2c0ddc3
-
Filesize
5.2MB
MD5b068c324d8ef87f2eff4782066b856a6
SHA1941199cdc015ee8e5da276ce28e9d842d4360750
SHA256a6e637e4684bcd194758a7b10d2c21584889b335bd73889899568ac67916fcad
SHA5122284401efe126635cba58de9226b5952208e00a8220f1d87db940bee0aa4b387f66b030576e6c2d16f257e6e07d6df66021bb14177b64a6033a7ef6e0117564e
-
Filesize
5.2MB
MD59cc3665a86e1a97c75ef830a94a984ff
SHA17d417ea9ff70fff85491330ba21105bebd85d5bb
SHA2566cb30a1f90c57a893fa27532a2a4dbeb5c05cc969f019966e4a2aad744e5e05e
SHA5123a79c17a276baed429f9cdc0c788fb970495f8ea3c10910653db2e29dac25227f0e264ac9cc8c7da9c008d3cc960c90193e281bedfbe0cf7259c317fdb7dab8c
-
Filesize
5.2MB
MD596efb5a147fd4b5a5184d20cb6b0e66a
SHA1a065b9a012db0033bd4ef917ac0a06002bfae4f9
SHA256eda1b72863a8572c28c61278a623c55054454f1dbbe8ac5a22ad74c4ee0ee4ec
SHA5120b77d18a917c50d32ecc5a92dc353516d1b1cf9c0ee9af6c487c66c1894daa6b6d751257b87c9c3c95001043940e3bab1d55a18add4b55e7f9301b7733f21bde
-
Filesize
5.2MB
MD52830fc7a5728ec0be51d5b36dd164841
SHA1bf63a72af400f1646c9ce18a2294551e68151e07
SHA25646ab9f62a397f66c6572bf0f4e75ca318554c118e13f73e49dbea3f320ef3366
SHA512e43fd43c322e9ecdbaeb5e0f7212cac967ae9eecfd6c96b0e0de67b39fddcb3b41db615810beea81fb1e8c1849b3c4b26daf288bf852f5456210ee24447a7ba9
-
Filesize
5.2MB
MD5e314abc011de136bf3fdc40756c3e20e
SHA1092190d01d895abcb5580bda8d13cb60079d271e
SHA25638b92bab1956d49040de209c6688f86da6852d2ef635db87d574aba6cc2165f6
SHA512dace5179a6a21ee40cd3ae56a63060c22e2bfc56c0729742b8fb505243b7869a07fa747208f178e8129e63ec971af41d4e48966a36a70dd0852ab0b6339f635c
-
Filesize
5.2MB
MD5ace20af44b2ee08ff6d4937e8ed674c5
SHA171d43f2a4774a3a41f37ac6ab60fb42ed5b5f372
SHA256d91ca93ab9fdb5f4f38d74c989092f7bb5ff55f251b6725bb4035ba9c3854e6d
SHA512ae1e7ce0b27c4edd51919cd83cbe4cada8db8e3657bc513baa212486cfa4c517b611fc28e45613c6e13819be00613385cecadc8e12b553dc60f29a3ade2213a2
-
Filesize
5.2MB
MD57e6d4fce98024de1ca8235fe9a43d048
SHA1058906670e3fd3199a8978e544fa99644c151d50
SHA256cac5ae0ae40055bd1c0de26f884e9b754c683fce114b2238be06e44958a433c4
SHA5128aafc0600fbd5144767b05f4d0afde177b9a62e3e4b2b71031cd4da908b5a5f811032b90b312830036aa38c830dbfcc9cded2acc38dd6b7d9b6964cc60075601
-
Filesize
5.2MB
MD56d2f9f3bff6708c663f61a9a955c519a
SHA12ba0d3133f131c398d99a6a361045053db63be17
SHA2566e4d123f581fc9bd64ea03577ea0743729a351722cd1fc788302e0d3c9bd7be8
SHA5129de3c8d321260f1b88507de3a0a0aa13b96c082070939fa760e638d44a98aa2d0d346291abd704c3e629ca22eddd882c500ebdb03a96ea5bb1946e35576b69e8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB