Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 15:32
General
-
Target
2024-09-20_536ff31738e85fbd02e84535ab98df14_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
536ff31738e85fbd02e84535ab98df14
-
SHA1
ca4ce3d547e981e0c3b3256e16fa685da186c67e
-
SHA256
6a00e53e100e655065599860e712560d3398058bd10c306e2a0c3cb57dfbdc05
-
SHA512
fbb7ebf6281708a4fcc195990624a32203fc72ba9487c1f17964806122f096e8f42f4230d8b74fd2eff25f703d1e33e4935fb848f3df97976af43f7c46418e23
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_536ff31738e85fbd02e84535ab98df14_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_536ff31738e85fbd02e84535ab98df14_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bVApCKG.exeC:\Windows\System\bVApCKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQTxgYV.exeC:\Windows\System\zQTxgYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rQLgChH.exeC:\Windows\System\rQLgChH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oeIJuHl.exeC:\Windows\System\oeIJuHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvONKDj.exeC:\Windows\System\TvONKDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VuPWEfU.exeC:\Windows\System\VuPWEfU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbHKtoS.exeC:\Windows\System\WbHKtoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kNzbEEO.exeC:\Windows\System\kNzbEEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsCteVP.exeC:\Windows\System\WsCteVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKQFSLB.exeC:\Windows\System\CKQFSLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leZGZLB.exeC:\Windows\System\leZGZLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tABLskU.exeC:\Windows\System\tABLskU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSRRRzL.exeC:\Windows\System\GSRRRzL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DEKYPpC.exeC:\Windows\System\DEKYPpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvAQvVw.exeC:\Windows\System\pvAQvVw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNZSCQz.exeC:\Windows\System\sNZSCQz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjiRQFH.exeC:\Windows\System\PjiRQFH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIIHlZc.exeC:\Windows\System\rIIHlZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcHGNWR.exeC:\Windows\System\PcHGNWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oAFjlJq.exeC:\Windows\System\oAFjlJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIcdomn.exeC:\Windows\System\wIcdomn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD521a10744641fce96c1bb839c1bb68914
SHA1e0de15f635a432bd4078ae73cad2a0256a514df9
SHA256f64806fe5a9ddf174097362cfc4c4446e2ce331df39c6aa731113255edddff4d
SHA512598a42ea452ac3393cbbc9c5609fe03e50106a80848380a9648e0b601a3d44aca5343751cab48c5558b7936623e9a4f5a9cb83d70b29cb3d24e3aaf3bd6fe282
-
Filesize
5.2MB
MD5e166343765c2c5a4690e4eb4bf9ae5b1
SHA1997a7378709a7d273a13707c76f6d07432b57fda
SHA2563dcdfe45b0ade0324502325bac5f1d465d6e2dba16e426bfde01bcef55fcfaf7
SHA512100f27b3dc4beaf32faad46a2ead06cdd4d3490756604fce34b915f81e68781e8de134bfc7ec9a790b7655c79b2e4a389a9d41dd9d00381a67ba8a645a1f646a
-
Filesize
5.2MB
MD52e8d2d5a42c5a52673b5e400593d3f2b
SHA1e7c9f0a6b80f834180dde989f2bf990c8e866b6f
SHA25634a93b4f193d57cf069f939e95352f1e3091647b2b5f5b801214dc1abf35f968
SHA512c395c38149080fca9c39de2a6c0f7692a5dc244469460684697e8c7196de5ddbf8fc5c57b0956e0ccc166f83f98723d0bac4ce7621cad54150a25a2b097273b0
-
Filesize
5.2MB
MD5b383ef21c0fddebbe91c866ef9a87597
SHA1c560609658ccfcbd2311a0ba1789a58e20e9029d
SHA2562ad0fb19a52d3287c54c3e177600fbc51ff3897edfbd40984bd5603ec3241b69
SHA512f4c72c9cdb05d3a6044097f01d488e4123126efb8cd55120cb2faed06f47751d344adc8e1dd6f3281bc3c6eb89a93c8c541fcc2b3c731b6b0f1c0f1d71e947ec
-
Filesize
5.2MB
MD59c8833e222db6e32a7fe6be7f38db472
SHA1ec244fc66c041be845437e395be8898e8ff5cc1e
SHA25606e264266416c82cecc1cd15097b28565d56ff8fd91015e063939280bd28efe9
SHA512471a3cfb7a5a58f8c4624f58d2106f6f8e4d2e3f34017fe00517c3984a5a88f05792c92556a243e2d859373b30b939a5e19cd318d248abc57896b22cf4edfd28
-
Filesize
5.2MB
MD5ccd6fe31a1b4099602c6ed5a76362f7a
SHA1ce1eb82453c112a5543e930ec8b1265ad89e389a
SHA256d2a3b42c8a534fe253b10625c51488d653cf4d4ad8a47b736da2cc092f6d7931
SHA512aa60a2c10042cd89d163a4f006894a752db1f4d67e2b977733f5852279400d50f947e2d267ce9d2fe073d6e12ed32705275e70d75090d678db573d00366dc847
-
Filesize
5.2MB
MD50b4e92e4956e512ac0844ab5edb98d06
SHA1743f285916578ae75b5ce81f1264700b62e79d33
SHA2565fb071e8593cea94aa12e081492b44faf3e6584df4ac9bc7f8e0001cc915f349
SHA5120b68b3e906b242dca029801709410b100a8f28c07db49507e1157781e8f90bfe87133daf0a52273fbb261953d330032ce140f2b53c5437ab57b4fda2fcb3b516
-
Filesize
5.2MB
MD599a584ec68888e8b273eed94ae0e89d1
SHA165deb4a611e881669ced3ade7e9366944664eada
SHA2563fe3e4469f476ee5cd060101aba692095e7d5284789759a2d7f67b989ba17f0a
SHA512a1ddb336a06f4e30c7c45dc595b718265feb3085dfbe09bda755da6e62f22e336eb4a3d023af5d87b7735650f7ecafc2a27c46ee9dc30e10e632bf910888e8ab
-
Filesize
5.2MB
MD5306339562210669f7750224bfa45d592
SHA1364f2460f50f5f69dc3143ee44b3231a55555fa6
SHA2561d576a198dc02ad202820d4db64cb934f540f9e08fce98a2125ee2164208467c
SHA5124b279a3f7f6ac00c15fed933d31c6b604f15febf1bd5225c4e39577086d7524296a465363d4a798a97fdab7b6bc9d8a64264f56aba7944bd3a96a96db036001e
-
Filesize
5.2MB
MD551af008bb09186fdf40f4179197be476
SHA172ec67a57ae4d1c1aa6a8e5c0fe9105e07f22bf0
SHA256f9af047c68d98645d867e355d0609241080f764d9ea22c78ead805cc7c875490
SHA512dc48d3c97dc8de630d4ad3f730e1660aa5a2beb5dc0b33af4de7c3dfe65b28b1821666538c007bbb53a6ae80f12334024d647b4603abbc905f96d01635c3ad59
-
Filesize
5.2MB
MD59b37bd6bb0dbd9cc9871970f08d35e00
SHA196e3518ca331ac2894aee2d740ce683e79b34d12
SHA2567f4980081538a1ff6801c9240dc96b32b279d0e04c191d0631f9dba8acefc532
SHA512fa2ffc2c27918e2917d218f81cd87f92efbd177e93e6d175dd71f88b224d33f943ae97ca98819d287a07cc5c74bfff35e77790ea9ec6d450b7bae88e589942db
-
Filesize
5.2MB
MD502222b9100802fc6cf01a0ee335170e8
SHA173dc000067a396c292352ad83ca8f853ef2b1ca6
SHA2565f54577c4c8b64476be3e27b092b62ee4673da81160d91db52c1785537b733b3
SHA512f442fe683bf12b15a3060d7d64b62037f6550889dbecd09afe34ffbe80739d0235f577e1e07c6ebbe973354e443720f96cf1f3c8e57b65df910b4b4ae56dfcf2
-
Filesize
5.2MB
MD5aa248fde79124f2c39fd1c8b6389d9c8
SHA1602f893c213325f0a66eb1cfcbc1646fdbeff623
SHA256730cf234a3661866197d0f0ded482f04adfd670c4d7798dcca02a40a744a3c43
SHA512dc67e531bfc3396fce0127ba47f5c57a092d14b25f950c77a30c8957b66f48c7fdfd4680d343bc70298991ffea0a49955d7859d0b317882447e44ce2295fa6a0
-
Filesize
5.2MB
MD5435f3a5a9ca0acc4e0568980e075f4d7
SHA14cada51f21ba4de9117408eec88714b5da89033a
SHA256035c6d248f239e52e793066a5b8f5d59c6b0d8f24eca1eb103917a717e450285
SHA512b55f8bdb408b1cbb03986adaf1beb2d580aad25c0374f0eff601f011d156613e1e7286c57bb7b0cb08dba3b3ec8d526b7a820cfed241d4cd1c3f279d28fed5e5
-
Filesize
5.2MB
MD51a9fb233ac2a08e90b26a8f7ce2429f6
SHA1c3e04ba33f045910d17bd9b5641a1001db7acfe4
SHA256ddd447468dcf9b110ecacb11ad5fd1b7ef7bbc06e1fd94389175fc00237fa344
SHA5126f7738289a7f2ea6d590ce83b4a701f72707d49c43dc16a10100297bcd4947f9b8080fa0bb3339c88dbc3c8c2e0d2d1ea2607810153a533f9dc432c0164a9192
-
Filesize
5.2MB
MD5190079710c1f6fd27652432912cfcb26
SHA129698b47e1f3c6385c7e1fdba8deca5831dfca12
SHA2565f4b92c4cb8187088d7b98eff769e1d8682b51582e0cab91a0a4b3f5d80afb37
SHA5126d8a3c1d96906e72ac5594f5fd4cef6bdaeddb06e6b40a83ac83b7e2a64c6edb1331c197b7b79351a2c891b6a787908297f9b06f14321484c956e51399729ad3
-
Filesize
5.2MB
MD5df10e15053fc9c1d96e63bec0c71a5ad
SHA17160ad63e79ff748a65fb2d8567deef045f07b8a
SHA256533e018b49ca5ea3e6af618e0ea0055709da9f17dc926786c169db0869ff4139
SHA512841435d4b822ac261124a7a52e21995521e3e611b9cf38e664fa62164a727fa431f6e89d16e7954face95bd3857fb168280ca7a7546f483e23ec90ef23aebd69
-
Filesize
5.2MB
MD57c17096edc351e4a25d7a9ac10b21914
SHA15a9507344c7c3e041c24fbcae11ec4ee8364d207
SHA25652ca3fd9919537bae8499f5f378c50a57ecdc2d83bc78ea5c32e28b4f8e63c34
SHA5127a848b8e70c8f200d39353f8bb7fa1f7b381018d9ec56d5ed8e3f8d066b14121312d9f682a689b0f5105e64db6f096da7b2802eea8e20f7d4eed229c1e399b55
-
Filesize
5.2MB
MD57770e53903b358d22b5f6ddb241e4e8a
SHA1cb50266979d7e094a9576b706b7d9e19618e151d
SHA256fee96ab2f2732438274b86efd19f20171db90237015a47567f860b4694ba4936
SHA512e52e668a206cfb5fb167a4e726dbd561eb90e910fd92292e8c92c632cf3b2a33cab36377d04c6bd5e22954f507a1ef4f800af5bb359b375ac5825fad14933341
-
Filesize
5.2MB
MD5ebbfa4a1916264e40636cd65a6072347
SHA13c73f20326aa2d84144d1744d59f2eadf43d8d19
SHA2564300e8e30d31cf41a591c6894b5c60e419fe977406db6ddb50beda17bc89ff0e
SHA512d5dc07ca5dadb7c4295d9ea7b9d2a831fef6956eb0140cd40ae9af2c063a034db5e1df9e21ef5b9bae116fc1e5bb0e731185c7ef45de21db2ccca9a2ef7ef888
-
Filesize
5.2MB
MD5d9bfa7f110ee9ce1088fd2f4afef04b0
SHA110970e7738f14a3b9ce71fc6cb40a812c7ce3c49
SHA25650d36f4802933ed69dcd9e9460349432c3f27cd8e82ddce4f6dd4e5db42fc062
SHA512288e7db042043909001a6ebb7612a1c499c346f3b7361388b981d0e014b4593fb0ebc68970653405f92f13b90a938a5ca138cf27df82b91af7f5c5569a7c5551
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB