Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 15:26
General
-
Target
2024-09-20_2ea33fb1945ca6f96c734b3ba33a681a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2ea33fb1945ca6f96c734b3ba33a681a
-
SHA1
a67a9cb45233164337c41a98cb2c09e99511d241
-
SHA256
4e9bb03a72761969758d9d6b54080ff4545143e65806e7631ead2917b029453b
-
SHA512
671a40dc790a1052a34ef4ba3a18ce9ce55bcce0e1e25cbf753202ed3c726a6e498bf416e2b0e9bfea8a8e8de642f71d273ff70d511b7b0fdee723f7258ec523
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_2ea33fb1945ca6f96c734b3ba33a681a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_2ea33fb1945ca6f96c734b3ba33a681a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gYlyCEn.exeC:\Windows\System\gYlyCEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rsZwGXh.exeC:\Windows\System\rsZwGXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EUQVuAj.exeC:\Windows\System\EUQVuAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TBwCbzc.exeC:\Windows\System\TBwCbzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZvzMCSk.exeC:\Windows\System\ZvzMCSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lQdgwVd.exeC:\Windows\System\lQdgwVd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdratBa.exeC:\Windows\System\OdratBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsSrhEO.exeC:\Windows\System\RsSrhEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zaWilHB.exeC:\Windows\System\zaWilHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dEVTPgm.exeC:\Windows\System\dEVTPgm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utkoRTu.exeC:\Windows\System\utkoRTu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSLVcve.exeC:\Windows\System\lSLVcve.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsSYFqh.exeC:\Windows\System\RsSYFqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ATAuzEb.exeC:\Windows\System\ATAuzEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IkblsHe.exeC:\Windows\System\IkblsHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tOuANOG.exeC:\Windows\System\tOuANOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKrAesL.exeC:\Windows\System\MKrAesL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\koQnkcF.exeC:\Windows\System\koQnkcF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CJfxsvS.exeC:\Windows\System\CJfxsvS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYgSnwq.exeC:\Windows\System\sYgSnwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nwcxarB.exeC:\Windows\System\nwcxarB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5bd31602c9964a48921d4d7326c44a236
SHA1dcaf0382cd8829dcabcb53013f62e01db705067b
SHA256048bf44e94adf8ab6147acc51231cb23354caaa0d5a4f8ba2d93fb1aebfd73ca
SHA5123c12e6a8a3f7437103c2fab29d30051bf4a60976731b9989b6b84dba8b6dd8c663237b3098a5ecafceb70853b01a1dec8b73357a5120465c8a40639ee99fbbc4
-
Filesize
5.2MB
MD56559ff051969c2accf3b5e625c29942f
SHA1f85a2eb24e2eb4da30044b2277ad75adf8dbe14a
SHA25613a57bbb4cbc5f99d63c6fe08add4fa966ad0fcb07eae56b08255bba57e6ad4a
SHA5122c70a158cd22259a35e23f959b810ea302f827d75a98315dce13f5baa29a8794c45a4657198872f7deb3f5f8915d04ccbf2a12082599ecfb8bbd010e99d9a23e
-
Filesize
5.2MB
MD5a654fa4760035d8cb7629d8e55f093ea
SHA109eb4da20fa5a1ba72315a1f854a8e042eff426a
SHA256daa3ff2e97603f83fc790c27925bf5963bee88c6040791875436a86a02f1f7e7
SHA51253485ed37cca9899f841d294987c508feeeec3ba79897a61573b52ada0d751a684b677c1503bc89e8f18c1938101147843ee812e6f2be0ff28f1e815eb112c8f
-
Filesize
5.2MB
MD51c77bb3eaacc514b4d1c9d48e0667f2c
SHA1089e48bcbd66e2e1b121e6eb1b086bcda18eb8ce
SHA2568d3db6ed546f5779a19d9db40447c5bbd0146c11c3f665fe50f57bc28611b770
SHA512276448d667132fcee69bdfbb0a523a22188ccfeebb26c3daf43327fb52cffa00df41e063a706ebf690dc93de11343a71bd68e7546f2404facc278ae3628b0963
-
Filesize
5.2MB
MD500f5d2e5cbd0bd628392e110ef14164b
SHA1b65edaddb38169a23ab3597f3641767382eec5be
SHA2562116bbf5529b3d11af948d4ae645253d8661b050c310dd773e38de4b48b2be01
SHA51294fabb0e6c952948c7951f82483d896120487e384022b9fa14fc4a3e346d1e98e9de6780416cdbcd3c29b8a2a1683e3ad93ecca66560d7e05b8cb78f11578671
-
Filesize
5.2MB
MD5caf0cd0ff73c63e5db170505d54dd14e
SHA12289e6b9f99c7589e65a12a01f00d535b472d19f
SHA256332d1d8293c0f37c6cbf8808589b001ada5a62bae33fada31eef134124d5788b
SHA512d62b86e5cbca097ac2ed35fe5be0eadb207c94834b1eaca55f49a36015194cf8f2622f5ea9d8f1819b24cccc2ffcc02eb3904d0521fb066ff69dee2d37d2711f
-
Filesize
5.2MB
MD53c4b010fd6b3cb3fd7027f9ca22d5616
SHA19238904e485f0adbcd01f08893054dadb4562013
SHA2560766b1891e934de23da1635c3512f4ea4d59e78c322ed199998fe608b355d7ad
SHA512c969ac7580e91ee75ec72c57e572307bf8d7d8d728531606d7d84a0ae9012c998a872de04f0f5a4ac1f08f3c8d7cae6b71f72b793cae49ca394a0dad3c4c54aa
-
Filesize
5.2MB
MD515a24f6fa7180ecb87075f3398d956c7
SHA143d0d6399c4f840643408dceed21b342a5742caf
SHA256d529c6fa057a815ab5e7c7f8ad7012478d579f23b848036ebcc19f4620f7f276
SHA5125c58dc2e92f4f033d7293e4c8a766b832fedc366f9c0ab35d806d2208d44cd9ffec801b81e724df170f915524de73708bf5e0b2dae1244f887ded6e59f46e842
-
Filesize
5.2MB
MD52c67b60c2fd3a916fcd38aa65545a70e
SHA18ad278ab8b59144a5d87a6412b5c0b9c77f57c7c
SHA256ff7fa9b026524286ea4779cc825b4c64a7cf574816783691e714158129a378c7
SHA512c6a6f647c3abeff9dc4bc14a9383d8b3a8c05d24974d597e1517b94710f2a3bd9f37ee97892a4d790e23011c2d8d70b177a233102c271a35775df8d05cb5cf75
-
Filesize
5.2MB
MD5d95831de90a3063d1293e8a935768d6f
SHA1f3e8e9f2b9c362515055f403e28c47434ece027d
SHA256c921f2824785c3d551a06ef1857ef27d910a33a0455840791afbad441dded0bf
SHA512811c1533f0f4e4453a46e46e1fbddfb6bcde2ffa87f3d05a920af57089dcf268ba3ba4825dd2e71f65350d9dc23720f49ded978fc3925bf79ee617bde38dde0f
-
Filesize
5.2MB
MD537422ab2bc4aaa05de45bc28a3306944
SHA1a3216bd66dcde9371b04bf8c3413ce2d92b5fee0
SHA256d2b86a4f248788467ebf20ac19cba755cb4763a3482f412f218c6833f4685f47
SHA512e14c7b0654f3bd19a3a06690152ab786d5d3cc282d771da04edb79381cba408a8610c5f26ab2c147a0221400ae10faba6305598a1eb02912437c849f0220a724
-
Filesize
5.2MB
MD5a8113a3a45aabee7dd38d808c9709142
SHA16cc0bfc5b27374fa162732cb30eaf2248e232c38
SHA2567f17c03d5b58c4552084a95c6dee990d89096ed60c9798aeb02aadb17b758866
SHA512376fe567572d1ed89739bc7e6af3cee94f6ac5014f1d2f2c982a7b4b2902337217078a33c7d43e7c76d7b0f27ab0c89886e799c7ae19a6a89b1172ec7f15df13
-
Filesize
5.2MB
MD56b0e7c6575313edf527636a8e87cb2b5
SHA149929a83e0444369d45c24b90d5b2bcaf2aa41d5
SHA256a5741b234167bb3deaa31375fd2bfd1a7a46113a342ef53e2447621b0dcf0701
SHA51295b6b0e6e49db0973bd6f117c5a00debf0cf7b8c2bc38b532c9c6ece753606738da235064beeb439a670849f8e0166e330c782521ad8a4e193780ebe08566b42
-
Filesize
5.2MB
MD5396f5a33080ba43d4348b2589cf75375
SHA106efc474a9aa934b54be55682bd2954ad7398204
SHA2565c0cdee087c78607296d1711f0f07cc81d5dc1ba3d366f9cd2587a48872d2ec9
SHA512c7c4e36467a76d86bb5b6d9cd4349381956b41f55f4c600c1dad48f04842adeec7515530251107f0b41575cb8b75f7de9eee16fc578c28508fecc8cdf6687e08
-
Filesize
5.2MB
MD5b55c31d4710f03449a8a241ad5357765
SHA139b7ee347264ecf4d3301cbd9b4f212da4b9d330
SHA2567dd483aa92adebb7c1f6d61e898034cfbc0ab8318bbccfc3de7c316b3c4ab1a1
SHA5122233e6c381a44ea4d7bce91d20bd5483b8930aa047a73afd151dfe3b2a2f6a1c8072a4409966d1b0038c47835f1e4f986da88ccd75dc5b5feaae68fcb190e2d4
-
Filesize
5.2MB
MD5bdd7439da0d8f259faa0bcaf1d24bb71
SHA1a485b827495ebcf37ab1926e8ba888530b04f737
SHA256bae06b3f7e355e134f5ff67bb26ec92f00b84a3be8f4c9a66a887b303605267a
SHA512d0340e755c3e13fdbef2e1a07128eea7769813a59357448c126e05ef0bc424a8a57520ed2d00bc0207011430e12354ea7113ba6173b8d2020d03544b3caefc63
-
Filesize
5.2MB
MD54f0a688f00e504e764dc9e87aa28845c
SHA1873128088399e6ee44ed593633be0fada935ea75
SHA2560e857fcbfa424f51aa1b970f67c020ebf7f005578151996ba4be49db70dd1490
SHA5129b24ae036c82782248d13b83880199352aad90f52daa2bd235d8d6a5d67ff14fb3f07aeffc19974bd276dad0cca5b63251d522a22be6fe621f585ecbf49366bb
-
Filesize
5.2MB
MD5b624fb841509e5e39977f21baa043f47
SHA17aa379ccbf889b33e94f1a01b830afbb54250699
SHA256b6df33ded0f88f96231d6b7ecdf265bf65d567dbf5cbf8f0ad711715c5dfca6f
SHA5120d4a6cb8a6a0cd6687977ed309454e4e99d4af954572a22ecb750358e25800bfd09b4c4c9b8022fbc2bc9067d6958dd1d267ce826b20d622d77dc92c7bb3caca
-
Filesize
5.2MB
MD57daee9fe5beb38d17656b0a33693984e
SHA11ac4b250b287f6f00a294c21d05ad1c09608c150
SHA2569807cc8a349590d53742a685fa1146c040992d42b148a64a61cd984cc696475d
SHA5124e1907a373888ff15f479255404119f6a0ef7031f24ef6bb79068a90d2bbcd1178d5bdddd6fe20e22fc1e30c1ac67e911190c608f90222ddda835e461a37d594
-
Filesize
5.2MB
MD5d8ddef3c6f407eff5690361e15295249
SHA1ea06ae34f6d40aaf1e90c949ec12c9c6f95d8ceb
SHA256ad69b71a64c2e0c5bc6a3d6513acb5671ca22cbac904ed62d6be60fa41f1559e
SHA51235c9c897e0ff61a24beb8b2c68d4ff3d5c026a8a7b0febe7afe64cfcdf21c8425442f8c3148df8a2ca2a9deb691272510689053a97df0772a4b6e125f0fba5f2
-
Filesize
5.2MB
MD5d8e86318056798c45d45ebac89fe2de1
SHA128267566a7a1d619d95532f93a49b203086e025d
SHA256e57a6fa8c766ae3ad2bfd443c52b15867cb5b895ccd767f2669ed73bf872ba00
SHA5125e338df9f6def025bb57a51e9595c112d85602d20cd9053e99565346d32e5c80b44d7a908c4137c1dc60c1e1b4d1b5f1e63816f1afe645003c048845cc9a5a86
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB