Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 15:26
General
-
Target
2024-09-20_1dae66fefaa0b63669daaa8bdf464b7f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1dae66fefaa0b63669daaa8bdf464b7f
-
SHA1
133ec975e2632e4a826e1c60adcde2eaefa51c73
-
SHA256
387a65c70cad23d651175c2cd70523c77c99d49a24ec29607c0aa7171afe83d3
-
SHA512
0deb26b07c14f43949d9c8b096d9de6d1b10239bdf3e3702a000b3b6c949db83bec9afa17ebbdb0c46b8630abb38e8a8db2d263ad124053b6a9b1d8a20ca1c1b
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibj56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_1dae66fefaa0b63669daaa8bdf464b7f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_1dae66fefaa0b63669daaa8bdf464b7f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CnCfUoR.exeC:\Windows\System\CnCfUoR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qKexNbz.exeC:\Windows\System\qKexNbz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kbEjNhV.exeC:\Windows\System\kbEjNhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPUmaTo.exeC:\Windows\System\RPUmaTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAVcjjv.exeC:\Windows\System\kAVcjjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqgEKjY.exeC:\Windows\System\hqgEKjY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xSranXU.exeC:\Windows\System\xSranXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BtnZWyn.exeC:\Windows\System\BtnZWyn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\osJILSs.exeC:\Windows\System\osJILSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTIEBIN.exeC:\Windows\System\HTIEBIN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ESHltEB.exeC:\Windows\System\ESHltEB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\symyJmg.exeC:\Windows\System\symyJmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtweVjW.exeC:\Windows\System\KtweVjW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzujefM.exeC:\Windows\System\hzujefM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dduIdRL.exeC:\Windows\System\dduIdRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yrAjEyN.exeC:\Windows\System\yrAjEyN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxzvZrZ.exeC:\Windows\System\dxzvZrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bAfKSho.exeC:\Windows\System\bAfKSho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYkFkVz.exeC:\Windows\System\MYkFkVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BapGKPK.exeC:\Windows\System\BapGKPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkzPfdu.exeC:\Windows\System\LkzPfdu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59b0176e15901304515447ab60102547c
SHA1e897c56ba948ea1efe82a5613f7a653a1ba80dfe
SHA2566a1371520a3ba2ade63b92485f7a9f68ff2ee33e0c79d9c8b933f2ce2fb7311f
SHA51251fdb4172cdf1042810bc71895766d6d138401bc155fdb5f5a4940109a4fdab245ffaa6b92a8ef42516d0e6e54e8f333212514e166770ba9456b2f3e76f58fe3
-
Filesize
5.2MB
MD514c3de67fa900958376a1d0cb1f70a54
SHA1c16b0a4c3381be60df79c964a527f2c26228ce81
SHA256919623fd1bd3ab709756f12bcc9e423b87a7550723fe0c3dbd2be08c7424b2f2
SHA512171390cea6cb70e5114ccb9aa889ccf572398b3cb35708e56bda2546d7b0e286d11d5cbdd4e61ee801aa286e66209bc589e1065ea93ce551690e632c7e9da327
-
Filesize
5.2MB
MD54d86f12db58c74fddde32a12ef493501
SHA1f88fc2e62eaeee94ca2a449a7249bb4536a96689
SHA256184f11f8d2c42a82c2a467108f34850ef375fd3e8c06e4c93e84e9b94500cd06
SHA512323e5f450241ff77089b1162df88103783f4b04592a2a3ad11fd94f8192816af31ed199dd34f447bac7326d26320fc86093b25d46a103856d71bdadb9b784d7f
-
Filesize
5.2MB
MD54d0d12b608df011f4ae6aa5d327ae3d1
SHA127c4029c7d71f3818b7860c0e1b89a1fec2ad224
SHA2561933bd85aebaed8150b56c08630e0ea431373b2670ec31bedf3f7c772c03f4df
SHA512c03e309345f5f54920e071ea4c95b8a4a6378376eed3fb091a9c64dbeedb5ebf76be3fd80d7d7cce2445c4ee7785ee773e12646ee00fae603639e6621e910935
-
Filesize
5.2MB
MD5d99a74fae5946c93ec59eeabbb7275a4
SHA1e30f6cdad7025efeee67e640790869ab76ac3818
SHA2566dd51f55bfb4571070b699a3274c59b340f0c2562ad7219254bb73cb49962736
SHA5128805966d476c4c8e8662c9d575cca9835b3ce336aa4e8e05500fca0a29e699310af920c3d49f4ce0ba2ca74dbf9e3eb9d9ef53ea58df995f6c71075632a28310
-
Filesize
5.2MB
MD56b3a9478738c21d66107b6149e59b97a
SHA1fdf177be0e8aa0c5ff9486497ca553bcc5eaba21
SHA2567b410847fcde4b1432bef2cf16b48a37ca2bf15883a42741362fc8671ca9e26e
SHA5126edb2a374e7fb1b0ff079e53acded18408f1a62f4557c560e73d8542a33d8fb5629825103566aebebb7e705fda7fd2526651bae9f22d86c003e2c43554a958a6
-
Filesize
5.2MB
MD5d5570a042ca525d3956923876dcc54a6
SHA1ddb9409c2468ab49efc16337a2bfc7b1718b6259
SHA256f31681f28b932a51762da01d6bee6c681838736ee4114dd0320ae8d11554a62c
SHA51297c4c18c56a07d156312da745950b3b41484b7fedf804e31838bed9bfe30f56e838ba1a14d1b883cf4bbbcab0e98750c30fa1a715597c91fd497e147d8829a65
-
Filesize
5.2MB
MD5299938d92f5be6135411092d835b500b
SHA15469b4adc67d5421cf63c1023fe9bd605f46bcba
SHA25645abe1bce197347e9207ddcd2e7125d3bed1176603398363de08bcfa6c78e1ef
SHA512eda43bf233e45e43bc4c9022c744cc56fc2f206de755e901fb544d14676718414314767afb1b393991e486b1e7857e942cec74d38dda7961f0c1771d91967702
-
Filesize
5.2MB
MD51bf9526ce6db0929c585da27e7c3c26f
SHA1c5e64d491dcb2379e4d0df688c36726fe6855531
SHA2564be151d59142e9671b4d192eb2f83cd9f9150b4915c178b5a54e218511a99288
SHA5120522dba404932bd0f61959067b24f0c041b5c6a0a8345929a42914d0db9362cb8763e6e4e2b92780bafa481ea82608ea6f451e68eb37beccc145bd69b69536c1
-
Filesize
5.2MB
MD5074ca8567e6271d7445dabe7da3c5f11
SHA15f297fa4d47fdb50590f8eb7fa1edd11ea51a749
SHA2569691dda90231a8ae55b521ef64228becbe4cc8445b0afba99c744d99bc5476fd
SHA51299c494d04e55367c87544a87c6246aeacb30792205621d5eb8bb1d43bd90aa75fa100059bb843bd46c445dded832dcbced6e62a4572724453377e5a5f8556616
-
Filesize
5.2MB
MD5b8c87222aba40cf4bce21f4d994ffc32
SHA138f6d10542443d7e8eac4bcf3a81415fe7bdfdc6
SHA25616982d6e1e8b22bca7c2e5e99ece8db1fa671318db98ff173594b875bba47323
SHA512b5219fbf3aa70ae5fdc11560cdd7d8d3f75c9538736c53d17e6e26a604fcaa48968a223e8d3dcfe2433ef4fac250aa779efa03315db75b36d13c4ddcb1fe8b63
-
Filesize
5.2MB
MD59f0803aea2e2009a8b6932e6e89bc830
SHA10d57dcfe5571cae9cb3878d16bdaef960a948278
SHA2565ff62dd70ff3d582109445bf19613895ab9884e612bda2c1db669f7c9bf8710f
SHA512f49d8942ff136ea98035bb9d18ea9e92db959a88bb7c48937c52d01643de6ddef1e6ce09898051968ceea26fa797df6ba1838d779e2f10714a26a4a40a5eda63
-
Filesize
5.2MB
MD5a18bc35783a23ce17f5faeb2db7ee125
SHA1d3b7964fa8db0c51b9230c5de1cdf9a9bfffeeb0
SHA256bfba4ccf4c45844b4fa5bba9d682dd9c5dbc0e2bb6c866e7a0720ce8f716261b
SHA5128162ba56d3fae6c384a541bc485081e9441efe080020d7a1bc5a4442f5b5fe86ed369b03f848c1f38e64a2e3902f2f7ef7b988986239524ddf137be2f14ccb28
-
Filesize
5.2MB
MD5b8d8854cee503aa13494c9921fd624d3
SHA1c8628836b214168dd5fd0c105beca415c0a7567c
SHA256076ffa4c2f960a036883f9a51537c1968cde419ae0e8e426a32ed95fbb077d92
SHA512987747c6236a6d02ec387e731506fa2c7828f984961279dfd817a0c0fa45d1137fb6ef134fcf76adc625a11bf239b636d60302a4a17dd47ce7ec9e9f6944b9bc
-
Filesize
5.2MB
MD5f1a2ba8760b691efa603b36776b00e5c
SHA1d3733e4d50157e1dc14e8107ce2b1996a524eec4
SHA256119fd37a61ee52cb56ced44f3834c05e4d45fcf76d53349be1cec5b5a8307d6c
SHA512d2b781de2dfdaedf5f6f4952dd7367466077be7c659869272749386ccbeb086a043f2b6fbf141524a8ba69c27cf0ed4b35c4b462aa8ff2d81262cac766b48e5c
-
Filesize
5.2MB
MD5742c985f0bdfc5919193d204d7d8eb23
SHA17de1346c2663d84a761f6cd9d7a2433d6dc9f621
SHA256aea15781066d2446510313b4160722dcba48547572f2abb1b93ba39102988cef
SHA512e721187ba638c10c15f3014f6a129ace8cc05a4841f374e54a7535fccaa3a35a5f3dfc100718b65d42562f63b99832d3ac96024886bd2fe9d2dfaf43bf89505e
-
Filesize
5.2MB
MD5464d1c238292d55c0516a0f0f9793a38
SHA1ec060735e4f9dd49b77d6ceb9d7cc62b720986e5
SHA256d43c1063c2d192d6bbf99d1e354a9c04f86475f1250b575cb7eb6c7a14822193
SHA51266d68df5e2df514655bb47fcd38426f9a75db3ec9ecc987aa392b1b29e044ae5e6968dbba6e778a685de2870f149446ee6156d5dd2ac17459eb595383d4d9b23
-
Filesize
5.2MB
MD59da4a1f3f12d58c08307e82e4743341c
SHA1bcbad4898c45cac5257ca333ad73d95794bc71b6
SHA256799a4e7b6d9baae1dcaef910ed97e691d31ad4bf028fa794adb5705f2753b3c4
SHA51299b05696d8fcb0b0accb680ca2aacaa75d06a82d9fb664cb9a6062d9af542345e162d8c845a7251c50c2f2c09c1849390c6738354e60ac2322eac2c55a4494ff
-
Filesize
5.2MB
MD51018f322993ac15b9e9eecb2fbeece94
SHA1999fa7542b1c1927b2cc49d4ecc8098f7bda45d9
SHA25624da5ef24ab64d79e9e32747b0993328c90bb3916306e1b2bb1c0ff140211e0b
SHA512d42f9ef9069c8f1586956459d2e0593f496d22bb99aacc980b7ccdb226aa32c8f4d8e621527f496191b6869b71bbea57c1e8a122a492ee0119cfaffbdd71ab1b
-
Filesize
5.2MB
MD5c10505c6f7d2dd11817f23dcec8a1b1f
SHA1b1c78488d44602cf097a0fb424cb132959d55662
SHA2561099a50e774b35b1bda8fb938afeba38741336df44f3eae928863cc0e260a576
SHA512dadda7a834c4f1cc0b544941a1e9b870408de66dc94536f9a27ce2f2dfbb3d9268e178a51a15c28e9046fbd549230c45c42d987c929215d3d08ec5c8a17f9439
-
Filesize
5.2MB
MD56be1576f524ff25f65b32c4000af96e3
SHA1fb2b9ffddd99bf4a4a89af133ea29da5a35a2028
SHA2565e6028753e560f6235dff9bcd94d9f8ff73b4f62ad92c7af280b322387db5739
SHA512437029b5a2b01983d3c754df60fa268c6086d881ac9d1fb33bef7c06ef2bea6c129d7f95e49dfeab0d8dd8b994f7bd45a5f11cfce69dcff6438dfbbff8cdf751
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB