Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 11:45
General
-
Target
2024-09-20_113f0afa7543fedaf6d3caded1ec5e25_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
113f0afa7543fedaf6d3caded1ec5e25
-
SHA1
a505509ca766c49e73433f60b5f57460270a0680
-
SHA256
bd958eb8a8b4b1b8ae30c6867ad0aed5968a03f9b2fe87d5a6db805803531e8d
-
SHA512
bc31c9e2b289945adbf4bd495071619445ac5c4c8432ca5640a4a73316d61a62ea4230091a19f85a5f932259ee3235dded684ef7f93993ee5f60d5b073fc58f5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_113f0afa7543fedaf6d3caded1ec5e25_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_113f0afa7543fedaf6d3caded1ec5e25_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uOgdPxq.exeC:\Windows\System\uOgdPxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HtCXFiO.exeC:\Windows\System\HtCXFiO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KuTzXwj.exeC:\Windows\System\KuTzXwj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsEwpmU.exeC:\Windows\System\ZsEwpmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sEazqRE.exeC:\Windows\System\sEazqRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKRVbJY.exeC:\Windows\System\wKRVbJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxNJHPF.exeC:\Windows\System\PxNJHPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMGSjKo.exeC:\Windows\System\aMGSjKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gkzMjag.exeC:\Windows\System\gkzMjag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SDHPSsP.exeC:\Windows\System\SDHPSsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbKGwaM.exeC:\Windows\System\bbKGwaM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HIpkDgz.exeC:\Windows\System\HIpkDgz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxJNkbA.exeC:\Windows\System\cxJNkbA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDXqiLE.exeC:\Windows\System\gDXqiLE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HUfglrf.exeC:\Windows\System\HUfglrf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZaFDaW.exeC:\Windows\System\AZaFDaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zhFRLjm.exeC:\Windows\System\zhFRLjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cehiaoN.exeC:\Windows\System\cehiaoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XkBmngd.exeC:\Windows\System\XkBmngd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EiRLOSU.exeC:\Windows\System\EiRLOSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LgMFVql.exeC:\Windows\System\LgMFVql.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51fe9efcb686a306389b006456ab58ff6
SHA1598319b1b0a9fb9a0f5554944b7619a84c498dcc
SHA2565a5c646d6c22086e49fafc68ea3540b443a759f53123ddcc348b8bbcaf22f43b
SHA512aeaa7916877a0defb811004dbd15798eff61ed73cc0019cfe8e953d70a63bd442cbd6ca0536b01eb468f3605c9ebe5fc004f792c010f2248c5b12bbcdb7dc662
-
Filesize
5.2MB
MD5ded7dbf58a5bf722380567c778c4dfc5
SHA1be9005a52397a5cb9d9066cb1709785df037bdd7
SHA2567d0c261075ef31477e25beca11f6ed4c033e66c1511ba941ab75eab6a08018e2
SHA512f4f4c12b3e0090b105f0c38a508e987def213a10096a1e6e9881cdd4015c0df878b4b6e74650821d79e3c228ac6382b1c35ebb004e311c40fec20cbfa4581331
-
Filesize
5.2MB
MD5faf9ec362daf849e492a8c8143e7e57a
SHA1aad3f198d33ca927fc777e5fea01f86587563999
SHA2565f2a53e5fdb58e1fe7e8a0767b2d1dc2aba29d5425af38dafe0ebcf9a68c973c
SHA51283f6dc28a75bd08f77f78a99f8a48561ccaa25bf778bc748e948ba705d3936ceb2935a86551a18be56ccda662c77f09b5a71d371f818f666c113a0716cced54f
-
Filesize
5.2MB
MD58103c4841b0c895209726c6c216640da
SHA17d3084da1923c73599d345170044a55d929af5a0
SHA25694e1f5a9c0218f26c6e5649e3f565ac73f8c2fde9a0cbae177a7fd46bda25b22
SHA512bd66979f3086d3aed5cae44a566f3e0c94217136400541b70c3bcaf366420e28e2e7bb09bb8353324de41754e68196a5cee0a012a2ff53ce706d80cc7a07d695
-
Filesize
5.2MB
MD5058090eb28ec55e8ef3ec8231d08809e
SHA132a500f8b1a1ee1f70f91a726940bf449c8eb17f
SHA256076d2f4ca7fe52eeb39d4e9c2ea11f66bee9393a2a3d9163553496cb6cca310e
SHA512e64914ae97bfb45e7e68b25e90122a4ae0b3d348078b0c07e9ff9cf910a320e4e3f25748bf2e4cf4e5c488d0c48c4279ed3a6cfbde8ee303bc2d48209ecc1b28
-
Filesize
5.2MB
MD576371794a8718c5ce26828e422abed6a
SHA1865182b3e3e28d695d872186586e62d2baac2821
SHA2562c10b511e8ced589253a4861f3bdce9094484f7f77403056c9dacf308dc31175
SHA512535d5d8e642f04c2626797e486bb0e76660eac24c57d2e998280c97c5190ff7d451c718cb1aed2bea5a2ad0008b67bf19471f64dbefbe2e13473c5e4df2a507d
-
Filesize
5.2MB
MD5053a4ab771367c06848663301993e0c9
SHA17c893c123a423545fac892e1b7b815ed3d316731
SHA25609c143ea22474dadbc75b086a7a6a70316b6908da1828587e4a7cdf3bf808a32
SHA51260dab8af09527da4dabab73b43ee699b51be1f8dd39c2291d539c644073b91b880e38fa252b835cf99fbae7d2ba425dfed8ecbba094ecb3d0861c79113c9a040
-
Filesize
5.2MB
MD54bb31ec102a71bca7ae9a4b62b03d037
SHA14d6ae6b1beeb9532f29d7a54b554645ede56a4a7
SHA2563a3fba54a3fcae29b815cb40fc9afd0b9ecd4cfcf894f78e6c9c8ed1484e72b8
SHA512e82dfb194f3f79f113cfe78e3e42cb769eedb0d8eb21a6376b0733f62e6d9c640ebbec09616d6ce1f67a95a3a598d29877607fe05091447fa1ba17078ee794f2
-
Filesize
5.2MB
MD5bb12111f7f91eca03e12ac7d1cfbaa43
SHA167e3075eb9d8938d3ebe6700e7c5367348c9b2a8
SHA25637bd5a6a93940044708a95ae890bf708c52df810b899a46780209c3ae71b4bd3
SHA5127d5b54d7c12d4c992072da95c8ee91e126294a437bb0d0dc55a3d792aecaa8c100aaaf0e11d50c12c4ac2625890e2bc6054e1605114419bbeb46a32efb274c1e
-
Filesize
5.2MB
MD5b7de30241a1ac76104b35c021744f00e
SHA1c3565810d5776fc41481e8630111c1d4cc4f52d4
SHA2566dc0deef612e871db1daa46adb4df8a11dc2744b21817f4c9af5a9aec5b5c994
SHA512f7263bb31a9871db0fd0028591bbe3da552918953fd112c1546c1fb25c5a0c8f7d4d68d7c054a98cb9015a155f2e235fa89b22b7015a470b491b41019a1df255
-
Filesize
5.2MB
MD50a887c4dcbb2294081dd2d56d0c4a121
SHA158d9768f6b340374f7c1459e32e48a823849c504
SHA2563aa8b5bcf37dafff35a38284fde9eeaaf38421eaae9cdd2b64d9c574521a9f0b
SHA512dc5239b179f3ac56f883033bd6cf1f5ee9d3097b437002ef5d2b11dd49ec4f7a4d054b257f39efa68ae87cb7160623c62d11c09a2912f78bc2f4524db63417a4
-
Filesize
5.2MB
MD5517b02efcf9df3a6b0117db2bb92c226
SHA165f047cc9250d1a8e8f37dae8216692322e1b465
SHA2563fef88c0568a0b06d46131fc022928730d6bba9d513168b9128f1dbbe9111a14
SHA512491bbfb1b4dbbedfc647b266ab61511fa23316f89fcf282fbf2e0f8885d67bd2fe78433ca15621218f1f2639292d805f74b20912e8ddda506ec275af1bc2bf4a
-
Filesize
5.2MB
MD5fbe5f07df3728ffa907149603c9fc149
SHA1eafdc99b47936c1f73aca200e19e3cdcf7d54c0d
SHA2564a8e8857384e0a411620424a68ef51ed734d6a9529fd582f1f342a33b72badcc
SHA512005eb973c95b354b121d6a5234f850b750f06b58c46e4238549778ee2abd8ee96f03537534e39694784669b1ea56b8e3a653974ecaa5cb838f1e6f6ccb14145e
-
Filesize
5.2MB
MD58bc250fa3f9ae0a44aa0e3185fa5ec8c
SHA1064c59a5ea88e994f3a8fde36f3f89566676cfb2
SHA25628c962fa12f7f7a0be1785512f57aa9c4b13d9127cfb54339204b837583df091
SHA5123ef1dca8a81743e6a06750a5ea34b83eed8e90961e52da93efa9417775ddf8226d22da5dd9dfac1940319c8b0dd0058a61e3eb06b45c1d12f728e24137673199
-
Filesize
5.2MB
MD55e1520e36aea148ac23a5588e75734c5
SHA1dcd621d3a6c2fba6031c7e1886c0b2e5750ee085
SHA2560e82c7c9ceed3885252ba47fc29c26f46801071818e2718528bfc6dc66d3d1dd
SHA51205208a60250bda62831715320bb2c271804b858f618e0fd012564e56ecb7cb3f377086d339114486a6e2cf6aa4b749d6c203f6810e34122551fc78ba0714f0fb
-
Filesize
5.2MB
MD589943172f3eed384c3a35d487504e823
SHA103e2ec55c1ca7115aa1827a1b1d4bdb206a43011
SHA2566bb4f4b4b080db8aabce4859f74b893698824893602e37a0893e912491143701
SHA5128d34df84a29ac45d4253225be0e3bd98ee0de2869a60fa17654042e38a64066613a91f6a50a384d8fc024aa1d12b9b457d551ba72a3c64213954d5a6528b78b2
-
Filesize
5.2MB
MD57283965fcb91961c87c2f0fff24d1e83
SHA118d337b29886c86b0610c723e696f032f3b3cd95
SHA256a740a619a3e20fb3b1646f36cfcb2f9f257462ac7e5a1aac3c75a5efd3a9d8d2
SHA51241b62b7abd52d8f8157efa617d30a7bf84ad9daae9969f8f1e429f58953330c575d745b8b1289c5db26003dfca974bd294c63e04ebc6232b16bc0e9149c1fbbf
-
Filesize
5.2MB
MD505fd465a897dcdf428511e67f1c85711
SHA1d6f043c46902e9733538211414dccd48a3f564bb
SHA2563fc20edb6aeecb4e0085417392fe591f86f342bab82af3c088844783197d069c
SHA512bb0bb924c4d78e5d3b953caba7a577f24269da971ae7d4145a635b621349903efcb030394a8f446e5180ac105bfac0cd71ffbb125270518c5595a68b09225a14
-
Filesize
5.2MB
MD58dd73f6528ae3ee4d2ea1346144048cf
SHA1d8531137287e0827a279c03cc6528889d5783642
SHA256971fe9d191f94d886584bbb5c5eb4b6ede2f79130bd9cb902d4ab76a7259fe6a
SHA512456494cc7cc0cf7a2fd598f5cd46a684e2b5a389469aac07186ef68696c6d0d20772ceb0327f0718a11bc226acc5869b9ec3dfc33dddc1b9e9c8fdf6919e210c
-
Filesize
5.2MB
MD5d30d6cb7b32b94c4f8cb5bd3aeee2f25
SHA1e23c3c606abefce90fea4cf6810512ab83a0c200
SHA2568564b37a3de314bd72a8594e51763626f6dc1a026510c1f95f8f7b651f766398
SHA512ec82191a0be3cb7e9c1bc9be6954422c02de93d1e6f1a1bf517fa1561d533aa53702c164be13849167710315d99df33608adaa167c8b9b3fe8f23bca0954185b
-
Filesize
5.2MB
MD53807432c5f0469c95a36b7c1ae72fe2c
SHA1530fe8569f3fa8eaef0cd7002114c5e22d8cf57e
SHA2562b4f7a3b189b35eb03e543bc25488fac3c9df19ad5b83174ab9c3bcee5090e94
SHA51265c11dc919407e1827b9a5fbdbede0a7bf76556d5d7314a3631b0db27e0d6bb79c40cd9a64f3382644c0ad7c553505973b2a59ebf36190d4fb6171660272fdaf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB