Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 11:51
General
-
Target
2024-09-20_4e81d43ce919af2bf51037e6d4aa6d6d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4e81d43ce919af2bf51037e6d4aa6d6d
-
SHA1
9e71ec17be8c025e85ad295cc4712f4397b2ce0a
-
SHA256
343ea02fe60f690b2e0d1442bea96c14b2a9ec5ca24e59261cf65f1fb0923a06
-
SHA512
678ab6cf08cf51f36bf2ded3f5bfc8ed804cf3b568eeda38029870092bff1274fde132f3f7042d95420004913fe38e4f6a1d98abdc2158b26102f201fabf1d8a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_4e81d43ce919af2bf51037e6d4aa6d6d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_4e81d43ce919af2bf51037e6d4aa6d6d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\Jcqcvui.exeC:\Windows\System\Jcqcvui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmKcbZc.exeC:\Windows\System\mmKcbZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hARXmgw.exeC:\Windows\System\hARXmgw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVbWsDj.exeC:\Windows\System\IVbWsDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JCvlsku.exeC:\Windows\System\JCvlsku.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYALcHo.exeC:\Windows\System\MYALcHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QtDWYfo.exeC:\Windows\System\QtDWYfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvOFhzU.exeC:\Windows\System\LvOFhzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSzgpnz.exeC:\Windows\System\PSzgpnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UTfeqTZ.exeC:\Windows\System\UTfeqTZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VZjdSsD.exeC:\Windows\System\VZjdSsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOgUIyS.exeC:\Windows\System\qOgUIyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WkvdaZB.exeC:\Windows\System\WkvdaZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JOOUsZV.exeC:\Windows\System\JOOUsZV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\catOPSf.exeC:\Windows\System\catOPSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtHyPuM.exeC:\Windows\System\GtHyPuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wSetHda.exeC:\Windows\System\wSetHda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfeuXIC.exeC:\Windows\System\NfeuXIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuAGcal.exeC:\Windows\System\RuAGcal.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ppGBAUs.exeC:\Windows\System\ppGBAUs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWMLsfi.exeC:\Windows\System\vWMLsfi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c1a2ff793be5e7c6a2e061d763129415
SHA14d2fa4b2b8b23ce563a2cc870acefdd20a0d18a5
SHA256762bafc118aa13feff0436b5cffa356e33a2b139105598f1708abf35504a5fe1
SHA51219e513238a8e55b79e8513302138725b992ea152c278adb3809a6be9a707597031f51f07cbaa720844826e549b285fed086535ac511f2f898ca54805fc584d72
-
Filesize
5.2MB
MD56d1615e546a39a06e4ea31a3c3686cde
SHA1aa18d703f3e6c1056a18c7d9f976f9e48e22869d
SHA25654ff464145076dcd12d6f5b0c0c6d3a9b0648f3f8cedc4e0a5cc5444ab566efb
SHA512db3ad9d3fa51a3288a3b3daa07451bd2a293780e53cf7de970bced944e2722b79b7ead917f94a481628e759800a1d8b6b6c7272d22be59ccd1b775f973b35f30
-
Filesize
5.2MB
MD5a33890d133674bd0c5c8f2796f8ed15c
SHA1dbbe64f6a20f3673bb548d421d009b3975ed302d
SHA256dfc6c22aef52d1ba3c259d7c30774d58a4f9c8d66ab76386550290ca04fc0bc5
SHA512bbe723fcc98f9b7d8e23556cb0ca1e951846251b98b03badb251953fe851044c8d17c9c5ac29c1ec52ca9045d1253aab7712e9a4d27eafe7f11a2b607f93d7be
-
Filesize
5.2MB
MD5d981f91e5c86af760ce0009e44f82cf6
SHA17c3d618bcc40f118f3ba18f14200a48c24ff52ab
SHA25622f1ccc418f1dc23c36949dbdad636b5a4847f442c2aac6b6e1c5ac2b3021feb
SHA5127dcfb5565e425593ac1f97fdf8c79173fcb33720ec23ab38ebfcdc5b4df54a2c1f2427f04c63f8e015a54c8aeae73886195e5c31d3ab81e6594af66f47216506
-
Filesize
5.2MB
MD5322160b1cd93805b05fd5f71f0f0e87c
SHA19034ed47e93be2e5770c67a754986ba60efebd5c
SHA2569c61a9cfacaca304935d130c62ac669063d6b6a48fbe78bb503c468ca1437465
SHA512af6203360fd96c7ee17bb4dd92132221216ffd41af523e3fbff451a9ceb34be05ba486a88852d702c40acdc5ad163fe12d5fd7a3da63b5f0cd22e889f3477a59
-
Filesize
5.2MB
MD52c5afcd4d2bd61465bc6ca61f048bac2
SHA143658adc149c9c9a4e25f75b3fd464558fc084cb
SHA2564dd0b30d9b37380d4a503f7b2fc3440586ce3e3c24ee61ad8e32a87ae9df1952
SHA512c8c09a027561fff8f73b83bf3dc72fc4c5f48883c13a420254e6f98e2fcfc766274774968839e5b1d474222b3c9f3cd177e167a2fbd373bae256de05a903c2a9
-
Filesize
5.2MB
MD53b27714101cc281b7fd8c0d80ef1bae6
SHA15a279541abf9845cf3e2b1fe16db55b439668d63
SHA256bf17d3912fa7ed5949303f31f1015b1a2de275ce81a7bfde7b2fde0849a819bb
SHA512e7b4d5df786d06ac86bb17e55e069917ec4b53f6d55755f5e65dfdedeeca1a9f409244bd50d0f77a7ca333e11b8e240c03db34a12e6efa6bf60bc04679f91800
-
Filesize
5.2MB
MD5708e645bd102aaad8a30fcf98805f238
SHA186ea40c2407c10131d7c3c674941bca755531373
SHA2566eb9e7a8c1d1e054186452894f2be56f7880ff93bcf22bf66b608a44374b2747
SHA512c95acbcc2af46877de370a9a23f96f2167f86982a55af61da3fe29120d41f6be835be30467653177cf6be33183ad9aa1979c627bb1920b730c29bfc6a6c6133f
-
Filesize
5.2MB
MD5cd5287bb70ff35cc39ee8eaf98ab3783
SHA1a0796095bad45b8c990102c0236a9d1909919cc0
SHA25644a80dfa9d50b60597814b0e83fa1f9621ec98ec7eca28d87f3fb04f1463563a
SHA512d60c55873331f4e80df37e71e3e95b61632fb290be8301014c92f8255893d2c8c4a93982bff807366542f7b5f34c07722205ad749deb2d9e79787ae56ec9c2a0
-
Filesize
5.2MB
MD58aff1cd3e4cd9ff37c3597a76efadd36
SHA1588e73ad69a4215f873b5b30525c0474bc2ba2a8
SHA25662948ae79bbfb524b443f9f3380fd6129f7f51f867246b9c223cc077c10ebec2
SHA512b97db8139f602b56116779252388e115599ae522e9135d7d37370b4bc2353e6732476c22ed924b6d12eed3609812f69e11fe1acee174f2a1ccd8f4f5beae28e5
-
Filesize
5.2MB
MD53209940b891e760f491d730eaffa3944
SHA15543d91b7bfd0f925a3d2fc2d5a0522c57ab3a69
SHA25609bbe85a61d1489c2e73fe3cfc436ecb9e7fe4b6141d1c15ed6ef2fb4ac4213d
SHA5125ce907486bd898e72534f348122aecaff755aba1339ed2b2d6dc83b874364cc2fee8edf8ca22dec650c8f32a0ab75d01f74dea3a969d59d07a381e1ff7f01e95
-
Filesize
5.2MB
MD54a6d2fe354691d333d8cf47e3fb2e46d
SHA186a6e13c3b7993d860c53099839b990d79ab9f3e
SHA256d30f120be97e4856feeb54d9b524717d74c497eb7c5dbe9c5f67a17821c7c015
SHA51243e78e4dbed17517298e8998880e1e082bf777fb409962d786da0dfd26116cb73c7c6a1980a1e196f79ffa4fc2da914cd4cd04f3e291d69f61fb551980e09ea2
-
Filesize
5.2MB
MD54d3f2ac6da44ead00874cce9e191b7c0
SHA170669e056d991dac3ed5694f03f9a6f19cbd98e6
SHA25600dc579c19c42995a6d49a6f31782d724ef6e57366eb51057ca7ee9d24ea10f7
SHA51298defe4f7b82e7cb8c90a3422fac0735b7d90fa53e5be2f679afbf33f27eab13c06c5a69a2d03d2ec9daeeee2def78a7ef494b3d45ddcb7ca1ef4819b466f633
-
Filesize
5.2MB
MD52c4668635067369e12eba7b12d1c9b4c
SHA1185e9c1b2d65fa2e96ef0aa7d863d952fadfbbf7
SHA2566fd6661bb3ce236790ed25e71f1f0fcb5a3e0b78b247ad9a0ea55b91c43fce22
SHA512c3037f09a9381cba56a6e0fff3b4cc38ff2c6114ab8a155da28958185a9786eb32c0f029ea173e816e88b736e365d3fb7233e868bdfe331687cece03f3f019fe
-
Filesize
5.2MB
MD52968f990f74c0f9d2452efe80e8146ad
SHA113c8b595d9c626f17f4d64fe443c67821c3d230a
SHA256c459571d82e756eaa2a1362fef5dea2f42a13caa04be87ce8c47ce470fc978c0
SHA512aa255fc1891454c576498f7f2443ed4769beb30d971a16612a6aa37b117bb4e21267912658fb509d0e8c14e02b9767da9497476be8b998bf898a68b2f7758460
-
Filesize
5.2MB
MD5ac2347ad17742778f68590f11f53fc92
SHA13eec648715c84be99048ef04c712c664d0a659d1
SHA2564234b39c22d289fbf005275008834b384370d80d7a9cf27c504b9a67d8b556b7
SHA512dbc7859892d8720ff9ee84f45565607aea12d76a29d9d6869fc41c84a78acdfdaa169436457d14bb96b3762ededa8c4bc4305201b09aa0a7e6030c22ea5100c0
-
Filesize
5.2MB
MD52dc5a76a1c128845d58c734548a9f17f
SHA11a195460b7d2ffe1fefa634f1336430b2641a60b
SHA2565789ad5d435e9dfd5388e6034f949d444aca0fc4cb5fe70d4b014c79ad659a14
SHA512643b77d39b7d6a6b84e536bb1cc1e37ff08f33400a05df7ef0cc71b886d1a7840ef2d2c2db43f712407743cfad13143626e1a66b443f00cf1902725825f4ce54
-
Filesize
5.2MB
MD57db1635db3bbb460e51259fa9cd93308
SHA1bb1fde74c8b49ce5d6a90dacd4095543257fcbf8
SHA2567b1e6d64ce2115a3a314a2f08ada4223ffd1419cc1defdb9cd6c5bc06e89c6e1
SHA512369b3ce31a83195929f9070b0db3a47b0a40ad08042cdd2f6de7ffe2297fe1cd06f24530cf6aefe1669a0aab5bdd995f8c717ef18e919a0a7dab26bee71dc49c
-
Filesize
5.2MB
MD53583d17b42420c718452ccbd226e3011
SHA159d8584a364b166d150e7333073279f3f8e9bcf1
SHA256c9281ef0683872e72274a687d02001dfa0cf551872dabb72452177fb91decfb5
SHA5124d71997bfc75b84333e558c1fd278cefd0125bc6dcf81507632ad12d991e270b87461108fc02f088028b5f749020174fbd27d6d7c09124de65c8ed7b34765c11
-
Filesize
5.2MB
MD59e97748eb81a9411f1c081229e0740a1
SHA104a16e546e1b8bd6cb3c16e14b85b805e0628e85
SHA25692cdbba12159173ffcb37b266ffefc62e38a000d851b50d0c7652e3354b79d9a
SHA512cc21631712be27a888db51d5e67132b9f16344b33091032a2b0f33b21e27f6d822a75818fc1e92a9146a0008989390ac5d8880c8f3dd169aec45421502a4c802
-
Filesize
5.2MB
MD5c0e99205c548189357e1353c264d68e9
SHA12a0d208bdbe17b49e83ac896623797a40f5d3c98
SHA25630814ea61e2e6f59b58ddf39f9e9ade0752244ebac9c825a7d2419fcea50038d
SHA51287a939fe437b263ddcb3bdf050a87018afd21ad5841c818aa08c179cba7de14230b101768e65e241a5b4a71d8bf1c74aac1e34ee17ff73a36cf1b7d9f8a8e56f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB