Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 11:46
General
-
Target
2024-09-20_1c7015d9f60c0915225ed021f53d66a7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1c7015d9f60c0915225ed021f53d66a7
-
SHA1
6b2f6b5cc71e87e76da68894727d7070f1584ae6
-
SHA256
59c374befe40652df52b85b2aa3b0fc4a59cc234542e9b99a88162615d99131d
-
SHA512
6337b5d92aa295632fd440407f7a6f81b9cd97cf80e8908bf5c30bdaeb8f1b7e2d8e2367048cb40da5db0088ad44f98c1cf3843bb66269203a6c4d5cf92fbd26
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_1c7015d9f60c0915225ed021f53d66a7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_1c7015d9f60c0915225ed021f53d66a7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VlKWbiv.exeC:\Windows\System\VlKWbiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDFBfzu.exeC:\Windows\System\HDFBfzu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMbaThI.exeC:\Windows\System\CMbaThI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AJjulhm.exeC:\Windows\System\AJjulhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAmDKfN.exeC:\Windows\System\eAmDKfN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GiFfwIM.exeC:\Windows\System\GiFfwIM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgQtjyF.exeC:\Windows\System\JgQtjyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZCwziRU.exeC:\Windows\System\ZCwziRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GDXewMn.exeC:\Windows\System\GDXewMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLnrEiF.exeC:\Windows\System\HLnrEiF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVIOMOZ.exeC:\Windows\System\EVIOMOZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgtgeDb.exeC:\Windows\System\kgtgeDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCukpkw.exeC:\Windows\System\LCukpkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rnQmGLn.exeC:\Windows\System\rnQmGLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlMtkDM.exeC:\Windows\System\xlMtkDM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsWFMdZ.exeC:\Windows\System\qsWFMdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdcgVIx.exeC:\Windows\System\QdcgVIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UgYviLA.exeC:\Windows\System\UgYviLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRhxFyZ.exeC:\Windows\System\fRhxFyZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zlwBLFF.exeC:\Windows\System\zlwBLFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eImgxpg.exeC:\Windows\System\eImgxpg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5af384929e720b5f1bf1125a8409cf0b3
SHA1d0dea7d0f6cbd5be2f9c12e2a55b194eb2822daa
SHA2569213accb4c9654fa3f701f031c29cd852631d2b529d9a01f2a33aefc20f99fee
SHA51253bb8e41c0c422b3f7b1d21d22682ebd1182568ecebb0cef18a5d74dca9c0a4f566182f187c356e7ff65642936ebde6a1569195531e4c9d89d15793ae497ee3d
-
Filesize
5.2MB
MD550f5d822b21a1782bcea97709094bd9a
SHA1de53cf843fbbd6f2c3f695d691d546d6d41709db
SHA25695e8b19d7043f49ec1e5e2808853eda46c53331f4709d32a1d96255890f6d007
SHA5126525f02ff8b128d87f78a66e0e3596b197d1750b15f0d37e3b643c567b4da7b486c3cb02542328d7237c27ce8a28f221e0c62056bd12b0c7362f834aa5c5bbda
-
Filesize
5.2MB
MD5085f1bedef4f65963c40856b86a3a0cc
SHA1bdab6226454928eea903727e49b46904ee0dd8ac
SHA256addf8148220a2e483d15d004393c5ab100cd24b00284e5279697aa4a4e1a2a82
SHA512bd854a5933f4dea844101c5862b9041103e1a195ed251bf67cff1b8235a1cec6d641c2ab393100aa8bc0149cd70079ee35e0e2bc2d0bca418e8c8c79b074a40d
-
Filesize
5.2MB
MD5e2ca1a533a014e88dae2d27549a0cd2d
SHA1a4d1e65503e121b3e648cd4dd3cdc5677320b76c
SHA256aff8ea38455ae5bf3a11a77cc8f64440d4eb4056bc9b27a4d00db50c9b87a187
SHA5129ee15901c59f5d1f6b4f30a903efb131a6d599b0c1f9094f7031cec226f650d3e17b3dfdb016a4b0efecc427e95c38816055c2e735d2c89e7c426602d2368e6a
-
Filesize
5.2MB
MD5f5fddee2c6c73959209470c2ca102b18
SHA137eb9978d37ca3f33e3f8555180111cf426c774a
SHA256a22d3673098da4cc600bef9c97f8dcd2430649b5b679fa402a973b6f224440ce
SHA512e1967ad2136679507c02edbbdb1629cdfb13e74915832d1ea315c04c8279ec0f5b8d8d32aa4f246ce066f98323369ff4deed05dce9d8ddd7944fbaeaf4510f9d
-
Filesize
5.2MB
MD557195add54a53ae6e658bf1a80aff66c
SHA1c16332dcd5fb2d4e78958280b04bcee442d4defe
SHA25630050506ad028907364a6bf7f030e7334a299e91894a190f22bf7911531bc81d
SHA512953dbbd0f40615a7e537827667f11a7adb714ab8fef72a14d892aa852a2dc9e810a61682058d77bcc0b83ef9731ae42211ba2e4025bc17ab88d37572362c26ef
-
Filesize
5.2MB
MD59d485b0ddbbdb1c2167b1f750e16e9ad
SHA19df81fcdd3d7d8247ec6c605bb34f1c82849ad20
SHA25659b7bbe5c7ad07df75ec55e36c17b2bbda489d1341321d07f9a24f5bcffda34b
SHA5129013cd820f2eec3255d815157a3e79ef3517b1e10eec250a5ba6bbb36e2b78014dc04499fb44b831da587a77aa227d78b0f5fd5ffce04b1e44eda6edc2890056
-
Filesize
5.2MB
MD597a21de32a88dc16dfafcbda3dfbbf2c
SHA133846e367d0c26e7a84e9dc21b46a7e459c34018
SHA256493eee251e93ad06a4f44ba71390aae0c964f2e16bf221a45149c7ce43300d37
SHA5129b25647f8be6657eca4e0537aecfb1ce29e17822028016330b7484988b903378a92f4c949ee2715d71c6bc54105dcaa77ce02bd10736871775f908da1c6606e9
-
Filesize
5.2MB
MD52200ee3c2fc805c52012b7d5eb584926
SHA18566949d49a3caaaad19b8019edbec1694b85532
SHA2569b89672f5907efb4d85dd45d57c60b956f7fa401336a0076269d3aa94d0becd2
SHA51210c0dc527454ca9d37ebd8ef82f6f7f58706b4b5929875a8e7c445b5823dab789377c15ba554d0b1925c326b1a5d5eae5a1b1d82dd56485f94bfb98ab5914a14
-
Filesize
5.2MB
MD5218595237e3a140cd2ef175010e5d86f
SHA1a5df2874cd7a21017828918f38143930c009121f
SHA2566a771e08527f39ad7275d5928f5bea0fa360247eba1fc88f7a68f5dc71328511
SHA51227f2a9a2de2607cf51f588775a674af124053611c9996d14c7130637e06723242205a992fb0c4d43cd9c8db2389f8d0654df6ddbbc422145fd77c277bddfb570
-
Filesize
5.2MB
MD5fab20d8c95045235ae010ac75cbe9c68
SHA1ab5d26e1a7abc43a274624b2b3b7724ce9bcb073
SHA25655ed22638f1c477407f84ab326964b3a6ab13bdfc0a0ae5ebd30f7ca2535612d
SHA512813713fc8f5b80e15625c0efd1c4dcdfe02a2e39631e65271b1a6ad18f11b6782df62de17d048c44aef0794f968806405b8c44da6163ff3d2df18848822f92ad
-
Filesize
5.2MB
MD5da79a02c2a38cb37d647042e4e4f94b1
SHA15cf959bc7054739a31b0df33609b8636b3d3c713
SHA256416c2f2151b066cd0c7b2fa7ffe35c51a0d29b05b63047249c97267b040fde0c
SHA512163ff8c74d1b1bdb4429cbdbc15e31c5fca0315be3d1a2ea382262b01adbc4d4bd06a78423abbd06468548ab7233ed04c4bf5870f966f82fdcd8361abf525247
-
Filesize
5.2MB
MD53b0ab497607b2f0d14de3765611bb9fc
SHA1dca7ddd571031d8b2a0af3a1a42eaf19e5c7d615
SHA2562a93a8bf24fc84cfc4f60b2e1158ce5fd10798182c35f0391408b6cda530fc17
SHA512618c99c5037a9fb2b55af4dad669a61bb8ef905b5de2ec4018ad50821e2159358ddc26eda74efa7f96f0f9ec65e98810aea4c115fb05af0222abede7f36f7ee3
-
Filesize
5.2MB
MD5f8409051016cf3ef813560a49e6cb0a0
SHA10528cc51429fe9222ed3ccb31dac1de8b00defb5
SHA25678d5025cad796dfa4915f61ec023e81862a9c4024bf97c8a2bc79dadabd279fb
SHA512731632bf6903fec6a767d24622e21d66406345e001cd672def724e69d7f196db8c2570b9d89a9e3b70e497c548a74d8574acfa39bdf9b789d462fa8d25d73389
-
Filesize
5.2MB
MD582fcbd91144433ff8a32dc54a2b32856
SHA1087cf032b793cad0602e20a88708e29f39f140d3
SHA256d54fa993bb294b245edadc4e56ea697f8528cecaef483a6182f6dfcf8561e93b
SHA512d0737db08a3d3cde48cb5fe0a1812eff05177e024f853670a677e45be4495c9114841d0c81ccd4c37772747c216d4fe38fff90d2a66fce80c6abf984bc1ee852
-
Filesize
5.2MB
MD5652bb26bf718639e7532281650c3e949
SHA12769a2555c0e3e21210841a89b714d443fb266dc
SHA256abea4e170fb1d52c49e54bb076ce5c5baee392d9a600cc48ce3df3aef18d9f6c
SHA51233bff2487740301537ae3f362b0331f1a7f5b18ecec2b945ebde67802885d0dba8c56a3d0ed9197d7a4472112e6494d653e8fc19122c8b2a5073731621582e49
-
Filesize
5.2MB
MD591f7879d1e8009ba5a5a33345745a922
SHA195580757235de87e0b901f88879a1b889bc89b20
SHA256389b448f94779895bccfe137380bd963a452167a1848d6a7447a7aa4ad13f6a1
SHA5120464e589062f5f093b10de114be0a562c0f9c83976a6924a3bad5b9f91877b4e53cc5921df5f9f62cf28c856707334c4dd8ee7196fc7f673de228e94d69fbf30
-
Filesize
5.2MB
MD5310c7f454675fe1e8964c5fa625dcdbc
SHA1266e6995f59e18fb36230f383500f9fa2316aabc
SHA2560ae2c51335982e1910542bccab13b04e39a51a75d25632496c4fa5af33e50986
SHA51242ed2ba3935ac49a0646a490edde4427c6bc05057f2c64c96ace62141e8112c974cf3b2916f2dd3a4e5e8acf460816b14ee35c5e200358f9c1935f2d29d812b1
-
Filesize
5.2MB
MD5cf651e88100c0e7e026cde8810360c45
SHA1029acdc22fc47a3ba0c0df825976d5c251f5672c
SHA256578ae4d918053dd18934c4a10c004ff10c3418f7e93149c573d3325d9f8c4d9a
SHA5123d3aaf11ad76fd17b9cc4125d996740fb0b27cef4b3cd2b4fb3d5700b7d27f231195a489fa830d613be051d8a9848d5211210430ad39258dcbaad33c2d83562c
-
Filesize
5.2MB
MD55a7463d86b81192e9217ac05636a7245
SHA1eb0c62181bd91853d3896957b41f59274a27afae
SHA25647e405d7d3d81b4324bf699fe7afb3972ca83971a644d4d50de10767e7438a89
SHA51279206d3b217d6d628cd326c53ee5653ef583e7794a60a875d040cb7ac7cd5fac26d134451f9f6fef8fb1bf8ee8dfb06a00861399b5bb1e78199bb561be77c159
-
Filesize
5.2MB
MD5d1126e7681a3ddf8df32157570d129af
SHA1d00bb32ad72bb27faf16234affaf1e60b74b974e
SHA2568c1b410fe195c9a633c253d991f194663eb46a42c4727a1f34e86655ef54994f
SHA51299f12be475cbd3534b7646ab1832b08cd3b7a578f98f8f5fc1a7cde64400b5696760bf9664328d4cad7ac8aff71fd1712807933f2ac5c947bc558123f938d58c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB