Analysis
-
max time kernel
141s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
21-09-2024 09:30
General
-
Target
2024-09-21_6ede795bb8a8967ae138ed90e19cb752_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6ede795bb8a8967ae138ed90e19cb752
-
SHA1
9904588db0c1a3666fa13e8d847f574c1e8365b0
-
SHA256
e924b9fdc84a4bddc9c5662fd8e4604759ef61b79b59669205fcea6852287afb
-
SHA512
3ba5e68f1bc3c53d270bf76ac0ff4143604f9bbbaf58e3616397cff2c22f1c6eb998a110fea67561014723735e7f5cffbf4333ed1693647c1c34b2ede829ac52
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUH:T+o56utgpPF8u/7H
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_6ede795bb8a8967ae138ed90e19cb752_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_6ede795bb8a8967ae138ed90e19cb752_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JWEmnwS.exeC:\Windows\System\JWEmnwS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DDsjZLk.exeC:\Windows\System\DDsjZLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXMkOzM.exeC:\Windows\System\aXMkOzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LwRGofZ.exeC:\Windows\System\LwRGofZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmsFTWH.exeC:\Windows\System\dmsFTWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPHPSme.exeC:\Windows\System\zPHPSme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghjLlkM.exeC:\Windows\System\ghjLlkM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qaqXbep.exeC:\Windows\System\qaqXbep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UqknOhE.exeC:\Windows\System\UqknOhE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhKSmWr.exeC:\Windows\System\xhKSmWr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FlJhzTa.exeC:\Windows\System\FlJhzTa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEyXZLi.exeC:\Windows\System\LEyXZLi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEaOybe.exeC:\Windows\System\eEaOybe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qNbuJBz.exeC:\Windows\System\qNbuJBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LShHYPs.exeC:\Windows\System\LShHYPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iWagfZp.exeC:\Windows\System\iWagfZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CkmOuzK.exeC:\Windows\System\CkmOuzK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kCELeCq.exeC:\Windows\System\kCELeCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdXRnFL.exeC:\Windows\System\WdXRnFL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzWuigw.exeC:\Windows\System\kzWuigw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYKIppi.exeC:\Windows\System\KYKIppi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56303a1258bfabfc197790373d7831457
SHA127760b0eef96d0039307e55bce3275af7efc997f
SHA256b416817eeb6150462dbdb99f64766521db035c3c06a9159926898017511f670f
SHA512259c5c7414613c5639bec456371f425da9482e593827d7cea2907a89d202856c8fd6d2601c04148bdcd640441f35f7fa3fd735262f24609988116e6e514671ca
-
Filesize
5.9MB
MD5f29a46d698229e43ca4b79d72352dc2a
SHA1e0f774371288f9c849d410a86cf4224336166117
SHA2566dcb1dd86e85b5a404a11479a2a2badf32ed985a506d7e0a19c058aa4f9d86b8
SHA512ce972745a65346356e41bb988555fa012a13d3899827b0a28456b5ad8efaa9f86674c9291dd6bd24a4e1e80c7a6a750d356bc9e18b44680199055fce17bedfcb
-
Filesize
5.9MB
MD52bb0de9729a9254e07b77e42d0e5503d
SHA1b2d8ed50a50f0ffaee7517c9c61f878ae47c5d45
SHA2569286d9a3625390c9925e6774fbdd0acfbba31b69ac2557e2388738de9a7b2af9
SHA512d548029a78842ef8692c22db526a67c2df0ff376230905f1ac1870d95693232dcfdd4f37c0a84a58d88c66a4f6e487d92713771b37de3917b358012e27ac017d
-
Filesize
5.9MB
MD50fde54e944949921ca2f7788bc2db0b4
SHA1b27956b1efe63032cf58edd331f32080cea529b7
SHA256404edf93c23ae2be9e91a3d30a4fa7f0144a22a55a4c5adf7fee507a58606a1e
SHA512783d7a3e1e59fa3bd1256e8c82e63c16bb260b0f2f09151dd136676deb872f55e23bb9ee349d6825ace615e1200d782690dd9225ee0221021dbfdcb8d4a8c109
-
Filesize
5.9MB
MD5b7d82a5c1bc2d533b40c262770f57ace
SHA1ec39a5d92a545bb4ad72c59f0cf0b9b07207a907
SHA256f8b22181d00f8707b5f633b183e36f52bb7584fdeaf2e27423ecf5b560b1eb9a
SHA512489ebfb23b496b7d5eb04f1500829fcc1dbbb88ec2bbae22f5e302e3d58cbd126776478fa64aff40778392dd79b521d59906be8af8f89948d57b331f0e883d9b
-
Filesize
5.9MB
MD5a78640f74b8f8ca036e71c351b6258ea
SHA1f6d689f24d17de788aef274adaccb3c05f8e3ace
SHA256294e679496ccba6ee18494b7b2edb25857770c2d327c77b8237b7729f218f14f
SHA5125b20456d2eeda7bcf8ef7201995265632c3e7849850cabdfee25d5b0cfad7d0176bca672fa684b53e43622c9af21718f359d923a0020b1b90a1760af5374e544
-
Filesize
5.9MB
MD569a5b1e412c6162bf0da13a681fea9dc
SHA1f26fd6ac5b2c3c72e4495fc9f3c70e4468baaf03
SHA2562aea316d6c428a49f0d680eee7665074ba72a0c6525ecffa5e6729ed9c5e492d
SHA51278c99a6ef5ba9450d950ccc34bdf952a6afda41e6455043bc922a94413cb675308b5fc8508ef110aa51f5dcc5ad8c4b434cfb1f557f103c7cdabf759c03bc7b1
-
Filesize
5.9MB
MD52158a02034591b0b0d9eea0f9d36b4f1
SHA13819bc80adc1cf84f06616b8527ccdb8c8233849
SHA256aadd4825732a6f42d7d429db622c635861637193deb3493f20727b377ee5c65e
SHA512964adc816ffced4eb2877fcd98c05cf32b889d934fd2fffc3904d6830a98ab010ef274c18586ee9d513154e7c9b058bab72609c141d1da8ad55718c534bab48f
-
Filesize
5.9MB
MD56667cc38c290a7ae46f6fe0ccd4188e8
SHA1f5fd1f2c87cd070d36c4fc78927a1c8f53cd4b82
SHA256d358f7cb975f8537eb5260ae5e8884174f9f480289dcbe189853c2783d85771a
SHA51213438853d20549073b1c61011e89ced916e3d1a6f649ab7f60b1af629211000a615813d49c8d6c54e2315392e63f039f0d257fb39b5cadb4272f5c616f8bd604
-
Filesize
5.9MB
MD5b1c3100dc419884c8902af3446d02612
SHA16e748d200ce334221e797a512b6d6098f41bc82e
SHA256199dc034ad7605b0e3db324bf64ddb6b9bf685310db54e49690fbd2bd4f78ac1
SHA5122663a293580e47e8016248eeafe402bb142e134782fb5b6f2194f15d8da02982878e66692019105a0aea7517f6200d460bc9a2a3f7c316919c50a712c3cfeb79
-
Filesize
5.9MB
MD51ff014a680178a35685533e8cf0f9a7e
SHA1b198055d79cddb93f94952c6e24a7757226fa3ac
SHA2562c450f98b9cd0cad3f68de7ee5354dc25f0c0b4b3dd0b8628a935a21a3888fdf
SHA51244e0151bb1057e6b1a801e0c32eef567c482a4c4a06e152f2ef44aedfede7bb57a086126025d7c8a1da7879154184a39ee4e34a9fcfd2ae2b089c533bbcbcb93
-
Filesize
5.9MB
MD57ebbca2c62757fbeacb6b8e9b9741deb
SHA13991ba5e94a15ce16f8e2abc0d7a107dfec53ead
SHA25639d7e919e08b875a61edcf1d573006b734861f4d294e1b0fc84eabb0f7f29fe1
SHA512b65fe5b98cf2fa2d36514fbadd68cc87ec6460f4697e8b8097b293a85e8667aed0b43e36f93c46106bdddb06c0f1ab19e7d15923c3aef78ba602cb29bc2e5266
-
Filesize
5.9MB
MD557f57aef708e61c512b3444b3bab5a7d
SHA186d2f5bd78ed78e6a6320c96067c387f3597660e
SHA2560c994e8ade8a56013e1a543ffe2cba03115082558b75504fee10b756cc7af7db
SHA51298657aeb7f8fd35b9e89f87df258d536b6b64859984b90e985706b6cb7db897d20cfdbc885a2cead799f8c5d6679663a19241225a5fc6d3e98c74cd24b028e09
-
Filesize
5.9MB
MD5aa63aa99dbef0f9072e4c401447a3373
SHA14d21862e2a7c45e3f88c45fd02bff275aa2f3b0b
SHA2561b870fac53188ca52ac81dd80d39befc32dede98b7440b4c388b05d9d33cbd6e
SHA5126a7a87e87b95dd4956ee133675e001073c0e6c10b70c2ca648071bb8ae1ac27f2783b2a2b8560055cc5460aaf405462709ce091b7e0fd92981bafd85641ba27b
-
Filesize
5.9MB
MD59b9786de6a6919e678730265c77e23cd
SHA127f3fc261e81408f613d3c9b8307c035ba9fc6f5
SHA2563dbb70455d5c3b92ff58ce4331da686a6e9b023219d704aff610914ba8e1e6b2
SHA512ca26b2618210e0ac6aa32f41a2411a48f961ceecf36b4aa444c493cd2670aafc5ead69fffb61007db212fc4ac8b0af3b99bf087ef378a30d9ab809ab89b14e97
-
Filesize
5.9MB
MD5ebe48957ba1409fbee3bb70df73621cd
SHA1ecd79d73b6d91797cd5c7394d459420b91f3e0c1
SHA25683385bb033a57473691e3fc8ec6009d539976c49ca660fb0e62f9421ee7055cd
SHA5129c9380be74e2a351f76332fe0b07d8c6052e72e86716302c2f7c731c49d10232d6f0b7ec66a1e81b17a920fd08a2da5fa7b13521558ce49f0abb80999e60ed7a
-
Filesize
5.9MB
MD5cad0890e1f5623d5e21d30ffbe5f9713
SHA18efde0ab03f6281378f2c94cb9a92df009f05db0
SHA2562b3b0b7e2e1d797e7f87beebdd74bcd8cd23a68e6088a8c234295f3f044a684a
SHA5121c09c00220302f8da3f334cf6d3235945451a427745f5ee474561f25055c6394b776f9cb7743ebf9f58b3fb88e8c3d16f20b10d2b50cbc808d14a352def512b2
-
Filesize
5.9MB
MD5efcae44d7e20558748da87dd0dd76391
SHA1e9d1c9c7074b99bd2153082f686a37dc123dd57e
SHA25611a4991bd31302140d4d6f8e72c91986eb78b1ef01dd99091c686a5eabc477bd
SHA5126261280941a6d8355a50dcadba177c0a5404dd672cb312c7c6401d46a27badccad1c300c1bff420564a8e27a69eea4b46b122ea3459311d4fca18e2d261d118d
-
Filesize
5.9MB
MD56b9c50b08c8295e455fbd7e544ccab1d
SHA159c6992774a743d0a2f6a467c08c7b864847e465
SHA256c1f7cd19db69e6dadf888d8ff10570f2bcbefbf120cc03d832cc5e71b4dbe557
SHA5125d9fb2ffa824f63dbf151d1f43e961a46f755c43ec568d190da8a8c62fdb53555541a6977708197cb8380f6859022b13ad6e9c3de77c7903ca45df102e1fa03b
-
Filesize
5.9MB
MD5ccb91007374a3939e2b65ccc511ea65e
SHA1d7e2f1f4689f6fff76bfa099c9d65bf661823f16
SHA25639c16ef72e6b1b01eb266aecc457ebccbcc225dd4f13bbd73758969dd8a6e176
SHA5123bf5ef84da2a3a1c5a6d813570c5580537faea5fd994ad0aded9f1a1be4ca4dbc0569ecc938f69aaa6e065c23627ab68b2bca8e765025c134b573c37e50f4c8b
-
Filesize
5.9MB
MD557f08553c7cefd8e31a5e50b881b5817
SHA1c514bec489deb31a0b029e1563c5dc617f95271d
SHA25699605cf9beb0b4f3af450cba5a9ac792b89a7ef51335a91017cc8a9adadd6516
SHA512cf78e8bc843a74e0316558e3308207a7a3e586f674df83dd3bf6b307abd4037f2190bb49d86359df09c18384a01f8a4ccb26993f1dc9520fcd14091ef949141f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB