Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 09:28
General
-
Target
2024-09-21_4c4c8a66a204dbedf869a0e01ece4561_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4c4c8a66a204dbedf869a0e01ece4561
-
SHA1
93f8c9d51f7a0eadd83ab66c277832d6450b192e
-
SHA256
a9e8f70212f7f0e9cd682977de9f1e8ad25c33998bcf79834cb5f8a2f6cd0706
-
SHA512
540dc2e0ba2a63e06009677e2d83b08bb0dfc676dbff91ed72d222acc8493fa496ea599bd33173c3eb26cc32298e33727c9523978fbd5270f75f0a08e0c46b23
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUP:T+o56utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_4c4c8a66a204dbedf869a0e01ece4561_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_4c4c8a66a204dbedf869a0e01ece4561_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HHDwMWj.exeC:\Windows\System\HHDwMWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDeGIgL.exeC:\Windows\System\NDeGIgL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xMTACOU.exeC:\Windows\System\xMTACOU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsgLTgN.exeC:\Windows\System\IsgLTgN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWzUJHC.exeC:\Windows\System\aWzUJHC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaBZhix.exeC:\Windows\System\oaBZhix.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fYeKvUX.exeC:\Windows\System\fYeKvUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuGUObU.exeC:\Windows\System\tuGUObU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khrLHXz.exeC:\Windows\System\khrLHXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xPkrnUG.exeC:\Windows\System\xPkrnUG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RcNuzDH.exeC:\Windows\System\RcNuzDH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xmRuDNr.exeC:\Windows\System\xmRuDNr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DIcRkQS.exeC:\Windows\System\DIcRkQS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIhSVzZ.exeC:\Windows\System\pIhSVzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oZDPOUU.exeC:\Windows\System\oZDPOUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OMQUcpx.exeC:\Windows\System\OMQUcpx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkleJLB.exeC:\Windows\System\TkleJLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oAFdMus.exeC:\Windows\System\oAFdMus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkFcFfO.exeC:\Windows\System\JkFcFfO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpbOxQj.exeC:\Windows\System\FpbOxQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdXOSXF.exeC:\Windows\System\RdXOSXF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c14a296804604bdcac366441285fddde
SHA1b4225ce0437c351102b6d49066d8a2f755aed9dc
SHA2568a51fbe3dad2a6ecf74def776db63346ca7a4be8e4e099397071b73adaebe50d
SHA51216b1bca1f1ca24860045af04ef46148a734993cdba2a388e24153eb08f43f91c0c06df2ae53d091860da85a20691a669db0a0ee95784ce8a946c3641099a7194
-
Filesize
5.9MB
MD5fcd4f931c46c2431b2d0d56c22f7e302
SHA1d9712350037968dcee579a20d84e81e7ab621484
SHA256d0e97f9d1bf28ccdb630a1d8eaed2999da4c673bb70df24b1e2eecbf1436a992
SHA51254e84ec9ac2602a7b216c8e4e58b7cadfa9bc618ac6a5f3cb13408fba71aad4ad9aaffd9ac0e89c9c6f1d3db50223333341048fefc403b0661068708601f2024
-
Filesize
5.9MB
MD5fdf866cde015ece289c31b70a6f0864d
SHA1324ebccaee66f133c70463bc151f4f8e1e7bdf68
SHA25685500b98eaad73f50446c41296a53640dd76973866bcb50fa6228c203b9a5c13
SHA5120ffb5036006b13b75c50e06562e3d7884ab94cf5b33a1a6a2155bde460ee6782e1306640038bdcc650a159b2ec0f6ed4667a5c56d29c49ec6c029bd301b7c4ae
-
Filesize
5.9MB
MD518e16af408165156ff9dbbd22e2b6625
SHA1f6087d5a75034e84717c2b3b10955b6a07a9d041
SHA25648b4e5cbeb35ce826410311965e8105588b60e80cfd8fb22718dac19208254e4
SHA512780f1648fda766cf4b1ca6477a3bce7aff9e24a074b6d1a5ee67c723b5cff07f11ea5cd0132b0fb47490873b9a5b753d5e8570067db9634bb33469a87f81bbd9
-
Filesize
5.9MB
MD54305068127658e751703a10013062630
SHA1a1368958bd92e3f20b2df69f8042414005caf544
SHA25659d63e2b06a4bedd344bd53bdbde16072266920b000ab9fba665573a61f5b948
SHA512fd856e2c51f1e2c6437091033b7701cff9b2f3235207e0af0d20ffc0b917d23cb63fff3973df2fd01086d8ce8d0da1f28360936cf4d7583835abd295a55c99d0
-
Filesize
5.9MB
MD5fe8fecd147e48e4699ea79674315afe0
SHA12485b1a50ff113b7d7d1c7352eb2998d7db8f63d
SHA256ca276c7dd783a612c9a7fe61ad2d3cf26a55f71ff360bd740b4c0787b1114c31
SHA5122c2c5493372d999a4f065c04b857c9f7cf2278bd33393c500b23a4ab195a26419c3948b796b652e310d1b3007895dee8ae2142dd8b8fc371e4708ec028b2431f
-
Filesize
5.9MB
MD5ebdf8043840df8f5962e8c105f13fabb
SHA1e86fac6da88f847e43c9c6932e6107606950c213
SHA25688799cd7b5613a208fdd29f196964bb41051fb51b19b17189d48dbaeb129bf2d
SHA512a67db2259e6e5e8a305a6342d150e93afede92231db7cd0e97343d51c6f6de24ac489c69e83811a080c20103bf07371fbf8468a07187828de35642fbc6adeede
-
Filesize
5.9MB
MD5fc51f641ce8dcf66db444f2ff1e7e267
SHA1c0689db47aa3d87b61f35bdcf41a9e7b34a0331b
SHA256cd3a9dd41aead359eb57ce57c74529ddd2fbe2fadebf274b79659e8d2dd807cc
SHA5129994072f39170970b60678fce3a9e590d7a0679c03cf6dbd3f2e577a89ca02a26db8c14caaf3572055c48428535353dfc9c25058863cfe95a1a30ed1374d51e2
-
Filesize
5.9MB
MD516c9576ff6da0b8ff2e808e88b7b0e19
SHA1f114566fdfe7728ff6f0e118840b8cacbcfaff80
SHA2568c38dbdb0825755212eb9d8cd74515e7986bf646fcb29a682959a42b9c15986b
SHA512bb0968b137f0bf2c37111024b37bcfdc97cdc11c588299453566c7632c672548ac764611538c4b8fdc6f15202f9a875036c73899cc4399fbf3cf23e32ecc318f
-
Filesize
5.9MB
MD56caabb066b14d48d32f304765033e192
SHA1742b779087080dab1bc9393510c91b9cf5c7e9c7
SHA25675044d6fc3aa831b1462798a2f19cec76fcbda4f3e309703346655cd423246af
SHA512581753e30d977e9117b7c5df157954b3ba047102c3e27661c1e00c0a6dcd4a5c87d59b0919619e0a02809b5d03de73dc20c88922fd2e3a1f5a82e8604db98ba5
-
Filesize
5.9MB
MD53f7cfe38c9971ab75728dc2561d7d99c
SHA1e8c8676b7aadc439d768c9fd223fcd4d27fe982f
SHA2563edfd01f9800e015b85201292ed4e3a957572ee96a33fa67326e12cc94a2c9a5
SHA512eb0cb5738e7dd981c21d25362562cdb9bce37b698b017dc22ae51556a5623e8e1ba857e667dce308e315d92799f89fb38d6d0ddf4b06b7e009d6665607e2ddb4
-
Filesize
5.9MB
MD5cd13cf20abac916e1e6df62188d1e0de
SHA16067c8847b559e1223582da7a56a2db7573a78c7
SHA256a5c75457c37b67f48ef9bc2bbb18bcc8f3c7cf63bb87222b958b80499867071a
SHA51268dc80a62c14849f5549a4a9f1a3405f9218e3114b91928d64246a63de41937c16f131a30fd8e5a03815d456361191de3e1d3da646362ceea8f1ec179f93cf8a
-
Filesize
5.9MB
MD541ce85b49b0f390b33f19209a04f2653
SHA1af7586d73943448e35b26a8dac8c9c6bb5a2742f
SHA2563542c8f5ff73e2c9c9715c3c8f1943227f0bace8d7afe672ad4ab2a439ae85c5
SHA51202364b8523787565f75ab91ce7690c772a9157d929314d445d4e78a1e2295c21da9644ccedc9f11cf468e82c2b738185f9b9d5caed1542976bd273b30780373a
-
Filesize
5.9MB
MD521497ec1569581d40d6266c9c012bff0
SHA17fd8593601357f7e43ac0652fd7bf1b36387ac7e
SHA2561d9adddc35782d248b0ccebad4296aaac8c93ea2b31511136490c7000e4ab699
SHA512a2d67483bd8eda555c57fc5baeee00de8f854c5ad04e797dd7a629e0a28bad017227bcb01fcc4c2007844b8fbfeb40db2358831f3013612d9b8c1e05f83d0297
-
Filesize
5.9MB
MD5b2976acba33840f10b38c24ea07091bb
SHA17e26a65d7aef758ca60d7ccab9727334165e539a
SHA2569fb7773e87159eb03af17750ef877e2e3efbe3858b4b54e5ea20db5f3711e1bb
SHA5129084a8c831acbbffd205daa069304091ad077c689a9bbdda02774d28d961faa15ce48657967e7bed380817fb5d552ef8cf1b2240d7e163886ab66577b9e02384
-
Filesize
5.9MB
MD5fe5cf3ee559d63fba57aa007a9eb4813
SHA1971bdcaad58abd191038db297cfe813be592c6ee
SHA256625b01a88cfc589511a0cd70a3464f266ded766d5a50a98e121224f6a5dd2a8f
SHA512f9cffdaa388dd39d84c0e9ff58a5ddbfd81c7aee7922e3dda839bb418a8f95198d0ce2ffaae3b1499a86f1e5d6e309084b9eba98ace12e8b60e5178f434e6a24
-
Filesize
5.9MB
MD5a398b9fd07e0d273125bb4d692bcc209
SHA181b859c7dc51a9f118e4869862b5de14ce61cad0
SHA256157cfa67d55641f712bacfdb677fe241f287e019d3dad2e9b74ff5607bb5a0b5
SHA512aab5cd6797b35b525f171adadd2570d4f9b000f5819b53c53bbc9975f0fcf7adf68251d96b1708304ef66c8fec8fb886f26352bfaeaf027bbbe3aa4bfe0b908d
-
Filesize
5.9MB
MD58302d1a1fafabf3e2a5ec6aca6c1f703
SHA1bb5ad14590a96041c78fd39677e08489c575d4ed
SHA256148f381c32f75164af166e66b6b2fc058904c321af38dceeadcdc0487f2a3aac
SHA512f78d3043a823228bfd0e794af0d181437b69ad32fac7caccb4414155c1433b9882d409f1b254c8de6cdaf15c4b1ef6e0d1c843100ff1bbb9c87f348982325938
-
Filesize
5.9MB
MD50bdaa01babf272fad2612e603347ec00
SHA13f6130048a1922168e14f15395c82947ca2b1b48
SHA256085e2d1e47c1209024e714c8e1f630fb9647ae28230e934f4baf9d23b868f9a6
SHA5127590e18dd2a085373e9672f247cf8561c007bb2a1711bc23f3c86cfcc062d1908d794df5a189617453b9f8f675cc87af40beaa1aae7761f2d2d2e85d0cd1dab9
-
Filesize
5.9MB
MD566a56d08269af46e35e53b90a7abae7a
SHA12a4cde5e774f8ec1c2281966c5ba9c4fcc02bc02
SHA25646c1e91a75d0a7e2fedda3acd58876ce9f3da33e6375a4d07ac593a2fe037893
SHA51297e03e80e07750fe311f7d0354f7479827a909b6af821dbce6c102bbe7ef91b5681bbe515436ac4853b1c1a5d54ce89fb998faeaafe3921b6b3dec1aeb5b7840
-
Filesize
5.9MB
MD563e8ae672cef60b159cd17aeba66446f
SHA1d2cb952c84a84e69410f8b61ef7e2d6b2b82e7ac
SHA256cc60562f4ea5fe1d0a757119d881e5c91a3bcdf9f034eea260af0403e3181ba0
SHA51292225ed5d967df1eeadc8e60867cc4b6f74831ba0894dab901c0a9cd7aaf6fbedc13bfba409903450f0a8ff779c6c069a83fc17c9f69f289bbe518ebcd71dab5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB