Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 11:47
General
-
Target
2024-09-20_343782730c7876569d2e942dbf286dfb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
343782730c7876569d2e942dbf286dfb
-
SHA1
25bd21c49ad574a5239dedb94cff65141e52dd32
-
SHA256
936caf2da6a9066a7cfcfde51cdde1f7e8ac263aa2c0e6f08388ce4f959325ff
-
SHA512
e6ad87dc3832f4f794cbbf61ffeda18e330455d4de7251045718c8e8a300ffb05a367dae015b8d04e68ecfe9ce8bc3d9552ef5cd7a0d726f49ff3070bcec3d17
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_343782730c7876569d2e942dbf286dfb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_343782730c7876569d2e942dbf286dfb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZOQffvv.exeC:\Windows\System\ZOQffvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pjDzPAU.exeC:\Windows\System\pjDzPAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHYNPAg.exeC:\Windows\System\PHYNPAg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejKzLYT.exeC:\Windows\System\ejKzLYT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXwVTPG.exeC:\Windows\System\bXwVTPG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KZdoyrJ.exeC:\Windows\System\KZdoyrJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aKcuMQA.exeC:\Windows\System\aKcuMQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njVfObj.exeC:\Windows\System\njVfObj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jaFPIQm.exeC:\Windows\System\jaFPIQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hFmOeZh.exeC:\Windows\System\hFmOeZh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GUkxTxY.exeC:\Windows\System\GUkxTxY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XuClsnn.exeC:\Windows\System\XuClsnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JleFhsY.exeC:\Windows\System\JleFhsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdPVzmt.exeC:\Windows\System\AdPVzmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JbpJKTV.exeC:\Windows\System\JbpJKTV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHebPrQ.exeC:\Windows\System\PHebPrQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnyGCYq.exeC:\Windows\System\SnyGCYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUJAKjd.exeC:\Windows\System\hUJAKjd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TXWMdot.exeC:\Windows\System\TXWMdot.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jiwCcPV.exeC:\Windows\System\jiwCcPV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QmUhwOk.exeC:\Windows\System\QmUhwOk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57a98525e5bdbf905a00f14e96a58aa22
SHA1c61f4985cd0fe0783493ddac5856c81a55353346
SHA25655ff9bfcd78499dfc5ae9c1db03202c259a79cf7e74f3b044937401100cad991
SHA512cfd5360ce0e9727a30d1170063344e242950196237c2707429cdc8738bae14715efd8856d8b7b8aa652f31b5d0088006fd8b152703cd18bb2f0b4c2e67cf7efd
-
Filesize
5.2MB
MD5a4fb08d313ea1f700bd168848d5be97e
SHA187b241fa8626a591f1994bb1aa2a81180774a6a3
SHA256dbd3c42c9267a7c790b12f4a6a08bc4ee682174611f71a37a22296aa07ccce8b
SHA51268c5093db41d9665f595a519924d45c9017d8a2de6f8e20420fd627c11ebd60572e7187370c2bb222ba066df5d77e174481c2379e8faafc9faf89cb5077aa4a1
-
Filesize
5.2MB
MD5cf2b5accdc48c15a9fbd78eeb38ef7a5
SHA196a2c39ba2288028e650bced9eff46bb0656c26b
SHA256228f22787e949663f0780a0380ca6de02d102c9014eab2f65e540a764f8a1d8b
SHA51278f066ed869c8370c5b2800dc2393767855c8f35f99fa9806c4d3f1dacf8a1cc1ec1134a9f0382cd09246ab4bba98c2bf42a39375a58326a26e81f275a3204b8
-
Filesize
5.2MB
MD511bdac8c0bd09c0bdd02cba68ae3dd83
SHA19db50cf6035d1d0cd6697b13fa927b86ed316b7e
SHA256622ad5759326f66c6213d3909eb176f33084339a9c287d65fa2c1dbc34eb5df0
SHA512fc7e4773dbc0dce63f4ed58674f74da7a25f679ebfc1f21891fe48ab781904c6addbfcc0f766a157f887b0c9904ef2f6e48ddccb733024ca721678214092e1d1
-
Filesize
5.2MB
MD59185ebe8045f41ed3662ea6567f0c796
SHA196efe813d14a8e3f0d6b6b9a2b78326b93b987b9
SHA256bb39356b80c833c6856d442cfafc7ce9a2882b9c4b74a9c6cb8b097ce50fb72f
SHA512103cb79994441ba6711741288db67e8776a7d95632f4636737704fa8f411df13ebeb1bdf76c5c7777408d74d1ad41d608620a89f6958e4c6ef567141c7163c4e
-
Filesize
5.2MB
MD5545801e7683ea0b26b0e0cc5ed1bfb1c
SHA17152514c7225dffe8bb1d9910d84ee3a88191603
SHA25686e136736c91c7b1e5d59e27f8376b92b6ccb56e2b920b1b618cd857300a5f9b
SHA51216341053f325a9be263b295c22c9f3d34d30e58d1521259132fe82c70033574fda1b7fd0c53f25a489f2487ba3ce95182bf1238da98295f5b71f41f676a26814
-
Filesize
5.2MB
MD531f69ba92e924abdc97d8a576ea4b158
SHA1fabd3372e85460e389eb4d8c104940f673c78f26
SHA2569b8a541c7c7c1e7c9c17506a75e67d309348c23ac3cd1afc6977bc7ddc940816
SHA512bdcd547ac69df79a7184ab5b229e76e0a6e6fb91ae3fea55755e0fe85e7df451d162de26530f37dbe6aa8d5f0c0b931aa9b2ba5f41a20287988df801d216d2d8
-
Filesize
5.2MB
MD5142c495bdb77d0a0f7cfc309ea94201b
SHA1837c587f99e69df013b16d1686dc9edb00100d31
SHA2569eba5c133a9ac52faf8286882d5f144f71f30cdfb1e271209407195d9364d8a0
SHA512329c067f55ce9d9a57ab7085263a77d8ddc6d8887ac9278c5474fc7471ca5e05d36d72f72ebc9f21b04c6ecd33983b1e75db3b3b6b526ecfed53ddc7ae6fbc6a
-
Filesize
5.2MB
MD5b3295792ba5ce5356e0b827ab57efd71
SHA172520074663775aa1b75e26ea79b11a757b20f98
SHA256e8dbfa0512e7a6ea1bebcacc8f01ad4a0bcd2350bdd7c73e8476f11bac5f40d1
SHA5127d911de08c183a486a7960835b2f006660fa277da4d0d277dfa6b092ab8974f912ec48ac71896db4f99100dc91a558dc459e1f55dd5cff548020bc4d6c2d52c4
-
Filesize
5.2MB
MD5d2cb5c95b4bd68849cb7bc24672091ae
SHA1b5beafd79972429cbc8f52e383a0e24df3d650d5
SHA2566d2278448ed1f68aafcd70e78f56f57fcf58024dcf9bfff7d65351e1c33b3eed
SHA5129f1c39a44794995cc2307f59802b6e3c9981ee528a1713d67a8e48aa9ebff2bec97b219402f8d2b9cd98e67f754e95781a03fa7b990a9b63746ce9998d0d152f
-
Filesize
5.2MB
MD51f18e9dec9afede0b86fac420557f9f7
SHA1bc07e3ed08d5a1500f3e0f0ffef6e8ed020e422d
SHA256428cc23f91d35969681cf687eaa9d1fb2c9f211e330a32fc7846d6fd63fe0296
SHA512c5b011c3ed4af5dcadbedf01d5091b25492680883f2bb007dd0da9911fd94321ab8f6712c0bd60a5106d09c1bf9efc3cc8f6e0f4cbff6f62ccec0fcaad534b23
-
Filesize
5.2MB
MD5183126edb1b9ddfb58a964ac4267e87b
SHA199d7a43ed32ae70007752ef23ef935b0ad529f6f
SHA2560b9343196efca1b02318e110c35993c14cb1530e30e5465637f212e73cdaef70
SHA512adf3d0eb6e5f0b7898ac4a7c0eaf35da9c91860af104512fc49ba9cc68c47d77e2b34309cdfbc1f56010392e1e7204216477caaad1c5bd5552aef76f65056f40
-
Filesize
5.2MB
MD55aa88f7d0635ca917b82eec3f75958ea
SHA15efabe70d3f2e05bebcbbfe234d14bff1ca93d54
SHA256a7718e790d07be0dcdb9e0080392f3d41dbf6385da4770a874b22382c72e0ea5
SHA512084e8c7876865271de98077e810c82f520326c176f9fd23f89e1e91d2641854ed3846edde870187ee70adb656c7db4da006cb9548513461ac4967dc6cd36e438
-
Filesize
5.2MB
MD58291310874124727da6d0035db93a84b
SHA17a2074f84bc63220ab039eed5881a4d608540b6e
SHA256378e519c0c0aaebf6c3d394ea6eebcf02715eb1bf9e297be84c058ca63a1fb6b
SHA5127ef0ff63ec8c36fa9843bfbb4f0f5b15c9acd32512a23558a6ea22babeeee1db48513f623f72ed0dff7b4d66a21b359372c2bcec363dbfa6a250f6e685bc6348
-
Filesize
5.2MB
MD53ecf5d02c3f39910022c25b04c29bef2
SHA15b8ce8afd1e50a73c782c4fe8225ada3f034aae0
SHA2561015369b17f6733a342d721723370131e66016b261e849995614e603d454d17c
SHA512830416d0ce71f8c026ccc1d2bb763bb5729a4be39161daced309401f51d3426d4b75bb31bae575af15c0a790af187761283ecf32618887a17ef0cdd9f1d4282d
-
Filesize
5.2MB
MD532e36a52d2004767378409c39488c122
SHA1183facc12db060015e277c0518b578b680e74dcb
SHA2567ad3227e5def9d930ec3149129457ec4b50edadbe98de5e0594956f2a72e3b8f
SHA512c8892933e4079e6eef50b123a5dd554db82ab93af9052a35cd11108194f4b3ce7ee07a2baaf1af02f71584877f82aac38ec13ce51c369b09b66818eb5357d814
-
Filesize
5.2MB
MD5939d3f695b5a4f423793f13487cc2b04
SHA15ee356d771b250abd1df34f59a15ac9d0fa4c5d7
SHA256bcc62f3a31d4e643a761a4734b05773932e171fa650a41e443fee01400cd3792
SHA51273880c77ae0690e97b5f84fecc55dbab808a11a5a2b6643c0ac6f8ebb1858eaac52d2b9c8e14fdc7c99cda757d684a87b937ff0c62344e73652b09e1fea3e2eb
-
Filesize
5.2MB
MD5f31916e8df779b713bdb4d7390e8c289
SHA1bb9de61ce72e8d0a384035c3d58825cc78eba5fe
SHA2564d2f8b5c272d419c807c91377ad86d7f3661ef951569c14c26f93ed989a6bb3f
SHA512e9fe0ff094ceb9531b2fac019ce7a6dc9b23c1334b78720c4fce73f98f15aa587e7d61b8baea2726a478d3f60adf70c5d4027f7ff058ff744e57ac4154e7f856
-
Filesize
5.2MB
MD5a1ee46e0a774aa886501f5c9d4e57f0a
SHA1f57996f2a739a5bd8540de59caee92e66e08161c
SHA2563ff6aaf9c1a813584fc3c8eda760759b442b7e311d827a18de489fb01207112c
SHA51222c07de914bc807d0191262b5dca786579666893cc2980bf98bb2c09d61d30ed930cef69f8f5e86c9dcb812b864ecb7ce2c512bb96cc11eaa7cc8f5ad66f8c12
-
Filesize
5.2MB
MD54df1b07e03a29cfab1cea1e9602d6843
SHA19a38fc901c2fbce1e8458f29316ac2e792954ddc
SHA256a850d2f0bd65e45657a5e3f2d4464cbea9acf4d372c59bbd456c1a8663b36f28
SHA512d3f21339909d795dd10c88524f6c911873352cbf84999f9b16b9378c972497f62288baeb2c7095c860d0f6720c00b87abf1bb6c273d3063ce899d0e04855cd7d
-
Filesize
5.2MB
MD5b9c632b3491b5fbe0164035eb5e61397
SHA13d9d2ee00544cca88fcbfdfbed4e6ea59df541a5
SHA2565d0e69295cf031fc91209aa5a964f2d16ee2d1ffe291bf70b62dbd2b569058b0
SHA512190ef97dcf7514bbaef91af9c9a453c9dc576e1c0abc0577aedabf040b449e1259e54a6c223450ffa196548618820fb14d4d30e7dba91a67ef01bacce9e1361f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB