Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 16:27
General
-
Target
2024-09-21_7d1c6c7f51525b57ab6dbf2ec2f9607d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7d1c6c7f51525b57ab6dbf2ec2f9607d
-
SHA1
908db1a86d5cfc8deceeb56189f615bd54ced83b
-
SHA256
9b68da3e301dbefcd1766d96a446bd30b752737f477c07dfeee524dfb0219812
-
SHA512
144ef0734c33013fc8ed104299776c31d09df8ad472e0d48f391c0a607e7d2e25c17cf0210105d6662635a1be0fa592454ad84934bacb483fd93e3d88372db7e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_7d1c6c7f51525b57ab6dbf2ec2f9607d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_7d1c6c7f51525b57ab6dbf2ec2f9607d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IOBGMRb.exeC:\Windows\System\IOBGMRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVrvuBM.exeC:\Windows\System\FVrvuBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHZLRhh.exeC:\Windows\System\FHZLRhh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OuMRyBc.exeC:\Windows\System\OuMRyBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDvMHrz.exeC:\Windows\System\hDvMHrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GeOKchh.exeC:\Windows\System\GeOKchh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eUwUGxi.exeC:\Windows\System\eUwUGxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Gnpzghb.exeC:\Windows\System\Gnpzghb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOvtBjI.exeC:\Windows\System\dOvtBjI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwqdmhK.exeC:\Windows\System\jwqdmhK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qpOhVaB.exeC:\Windows\System\qpOhVaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhGBRzy.exeC:\Windows\System\jhGBRzy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpJkySy.exeC:\Windows\System\mpJkySy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEbWgza.exeC:\Windows\System\FEbWgza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMunPZo.exeC:\Windows\System\XMunPZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oKrWfbb.exeC:\Windows\System\oKrWfbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VEUiNyv.exeC:\Windows\System\VEUiNyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsOQElL.exeC:\Windows\System\dsOQElL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvDWZcY.exeC:\Windows\System\UvDWZcY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRYCjPR.exeC:\Windows\System\KRYCjPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AmllHbm.exeC:\Windows\System\AmllHbm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cf4f0a4069c2ac50a648d6765e0ed571
SHA1ec81d65e5bc22ca919a721a849e721cab0854f7d
SHA256c6b58928655d3ed17adff7399b43629e3d5a43788788c26f6f7d3ec96848fd57
SHA512d36e0a9bdfbb29f8fc91efbdbc86f63fbab91cfa4de27fe4506275791b008fcb75e0cda15e88dac51d77fc6b8d777c6b2f05663d8fb207689c96a2a1ffcf621e
-
Filesize
5.2MB
MD5d132a772461f4c2afa26adb68df5b73d
SHA16890f56d3ddbd1ef89913eab69ae3da2107fa622
SHA256a683b97ab19e8f24aa63c38f6297dbfd51dafd40665edff1802e0ef3f71e54be
SHA5121ad01cf9fc6286dc16d3f9eb8369b015f59adfb99fe49645870075e36e69e05df7d8063146d907039e4d594c0ac568651ab9e792ab462c085191ce279ad43b0c
-
Filesize
5.2MB
MD54e5450990d8f5758d88e11544aa672e0
SHA12f15f42c4aa706f6c9150d0c6e574d26fb12355f
SHA256bcccac7aa8b5673e50cb0df534832dd851bf17b82c8012f8db94b6e94798b9c0
SHA512d7e6b12545be546cf1e8750d3c0ffe7b2caa38765436eecc5478d7c4d366f5901aabd59b238b2ad943acc9c015aa23ee83da06a3d509d2ba3f4e4a764cfcf9a6
-
Filesize
5.2MB
MD5cd65ebed7f23eb8451533a4d6fa323be
SHA199416a7b537506a4f17d4202d9e881934d5ee50e
SHA2569668c08d7fb87e955a2f94ae13edb40d962c3d39e8196b828a28224ab7ee0ee5
SHA5125e36c7897810512e33934d722ee5162c3f1943c8e0cdb5a086b98959e684cb6811696cac7b7c40624c74bf2effd7c676c9c1bba726de24d06b74efae90c7925c
-
Filesize
5.2MB
MD57f77d367a7f37b2348f1a834110977d1
SHA10095e527b09b62f072793453a5a8ae52b4dec957
SHA256a827833409fb273bdd23c61c2f9b121e4f7dc0509e749d023c8d70561df32829
SHA512d9f950dc10978358e373947330d49cfe7ac3d2038e6200ebec2f728a2b63662999ac32ee8b445c48c92cecbd7ce5d157c0363a60ce9a68e935084eac6b4c12ba
-
Filesize
5.2MB
MD5c5eb5012a8156880c16d520d67d16c90
SHA16781cd0bf12fda0c94cd4b19b2e384f7deb17aa2
SHA256482123d42bda0226e3b193b471e127128dcc950fc0421f0ea895f79481559edb
SHA5128cfb6fd61194d490c753c0af6d0b0f409ca8df1a7343f69fe8cb604926be6ea64f340f4b76865add585582ef3bcabdaf0b524e7774ffa4e3f492b097a459f09d
-
Filesize
5.2MB
MD523bebd0cf351337c233325099a7d4a7a
SHA100b5b6928cf6acd40265855b6dda9cecbf1d1aad
SHA256780b59e6873cb56276b268fcbac8757a2f28c5bea51ce65d91771947504f519a
SHA512d0094ee7b7ebdb60c55529dceb44bc2ba915892f974147499deb68e429bfeb0fad73747ad4240f853e5a92fb714c9c421b8d3c4b1a525aaa35abc81692cfc00c
-
Filesize
5.2MB
MD5b345f4856be0c739287ea090ae336e99
SHA1ad6a99ddec2552cf90665487b236b460352fa706
SHA256b4409a921f7fd02304523a68b82e36fc0adf05e64b0fc36fc9d6f9aa0b8e6bf3
SHA512546b2a6cb97a2fd83161cf5f0694ff4ebbcaa46ebc094dbfa0a3dabec49e949394f7a1aba39ee6eb67e143cda877d6018cf6d3bd38156e34d4ea62e4ce59786d
-
Filesize
5.2MB
MD5e693d655fb29a28a83082df711346d95
SHA11f544f9a851054314f5ed601decd8ad84a6d9d12
SHA256407b9e6c2fb6e877b77953c2941dca3f83d0885bdaf5eb0a5795fced00070197
SHA512f56a744ab6013aeea45ac8d197b5f8b7bc2b27e3d246807f8038fc5a85e77144897e020ae23b0f6f5de49d4b93d19d791a85e8ba8d6a5e29ccd6877a3d109d87
-
Filesize
5.2MB
MD5872e90e161c638f161a6224defa7bcd2
SHA1b34557ab8099487f2b6b1c0ccd97872ccccc651e
SHA256dce8dfbc97b347d55e8ae9d29cb260d410fc509aa122433a22e403dbb7a43d71
SHA51256dfed4a786ea468b20ca7b75b2ec60e23674e879d01edfc636dedeefd0cc90f8df9aeeb8741f7dc08f68a94e8124a3d2b1862331100090c2bba4903dbee2520
-
Filesize
5.2MB
MD56a968e4e0960314cb6a9c76badc68343
SHA1fd7dbd9853adb7d677030d46c6811c124eb28cf3
SHA256e3ddfb0b0bafacd255807fc16d58d7d214ee31aa90b64e0c297a5f33a4c4caaa
SHA5122256969f209d2684afa8f6a1b2ac871672179d8ac97207e9e167c79b601cbea2a12bfabdacfc91ab48bcf564e47dfffed4cea57ac1b9a9b7b161098d2b552b43
-
Filesize
5.2MB
MD5eb2cba709a35cbf88ca59831f994b16d
SHA1ae722ee82a633f795a994aab58fb4de6e7237077
SHA256c706249900b59796d647c1c747a56c1d60f333aeaf2c8ac6f6e42d6ab35b0b7d
SHA512341ff24a974f8d740248cb34c455733003d4d9a2f38068f5594a26f4a063e64472e99cc20965f3b858ed4558800da0a93348ac6b18cdb921f75331c72df9aca5
-
Filesize
5.2MB
MD5e156412ccb4a87776a9c43879155f8e3
SHA1042f411f881dd1d243ac1ebb119eb2e4eeb5bb15
SHA2567cd20ae804de52fdb91369ec9d8bbbc8a3259cc5cb155aa9273406fbda4fca81
SHA512810bc817292f8cd4d30e4e0c209f1d6ffa0fd59cf23c66c17aa19ec5528821af7d723ee1d41b33eb45a8a96c8610bd314fe10a1c002dac0889e6031294a8b873
-
Filesize
5.2MB
MD5ba3ed4a7e09fb0747f5a5d98758286ee
SHA12691dd20e22c98c4b79493e36f2f9b2b1e462fe2
SHA2560df0936ef158fb2515b60b8deb4ea228e29bfc886009b9f64b8c664f711e4096
SHA5120bddcb39bee798963dc032e3104c2377b39e99cbe8f273cf76635451d4724b6435f7fe6e40a03e8f23cde01ec584bef4ed58562a11cb6d531dc8725d0db08abd
-
Filesize
5.2MB
MD506f817d93dfa538cf3ffd8afa085a639
SHA1a2a155a793dc7fe3dc15497d45da7601fb86ed43
SHA2567613757883a4d72fde23c8a99c436ae759141a47895a69f78f7fb5b851b189e2
SHA512ba94e3a0b3251129fba17289bfc608dc2318d5182e4268ea887fc8339ad3f18f0ea31918a15c2092727ac3e1073acbc9a5cbccc427eb48f660554640169c635a
-
Filesize
5.2MB
MD5db401b891e39b7462d402e4b50c0da40
SHA1b0d5bb9f61eafdf6a1271b144db8d553652eb5a9
SHA256a6b51a5455151e96cc4a352eedee8a3783651baf62e780e7df0cca5b5ba9af19
SHA5129100861689b1b2308762c2fb9ab3b05624bd29340208e109e8fe366ce00b3f69b5eb28c1f0a90551da47d2136b3c9455763a51d877b85b2b8f54364f26ae3564
-
Filesize
5.2MB
MD5308b276cd103333ba1482b015b2dda17
SHA17d65fc3563bc6b7021452347963214a777634398
SHA256cd2e3a2193eae414fdd6eec49127a325564c9e9a844b58c1e3f5fcdba564dd76
SHA5127c453d81db1e67e1040499e089d19b3f978e1bc10dc050a05e94cbea4112f2ef77b6abeee8a8eb3120f29ec5e37bc581ba432070fa409588b7cc3c06c143adcc
-
Filesize
5.2MB
MD568508f4f4e747899606eb01bcd4165bc
SHA1510a071cd382677b01cca99159932850689006bd
SHA2560466ee780f81c7ffc7ecbe8431aa12e41d9c561f7e424a62741c483ab31338bf
SHA512fa2d5b5e67fcd7931fda6b7629c3f2c0aef285ddb0e530affbbb86043cfe6e91d5bfbbad70909212dd5d71346d279987a44ef08983743f9332bd16658adf6ec3
-
Filesize
5.2MB
MD52a50f8bb0285bfe0a8b8b0e6297032c7
SHA1ad9596345dd1547465c76881111e2d527973ef96
SHA2562af7ebd78c47e5b448eb1de25cbf7f9778b7a34f35b87a04e19d3947ad6ea1a1
SHA5120b1dbb1f38b082100ea91edad6c1087cdd2d692201cc3e574788c1d885096697cd7f9d6844a0745587e8089e5e0701252a45fd2ba18f9cc5df4ca04f48cf9d15
-
Filesize
5.2MB
MD5090ac1192dd362ae45be1a2c37c4e25a
SHA1e786a318bdf8dcde2357bef65b2ff4637d2e8d58
SHA2563002091cfec067eaeb8c7713d6208c255e37eaf69c2f27af81b55bceb6746922
SHA512329179ad1b7fe7bad6a99452611f017495985e94f3dc768d5d96c6d16c0461b2a3c87095c98d5e1ed9644e03db27aafff4dcb9eb4d3cee3e306098357e6f9dbd
-
Filesize
5.2MB
MD5ce66a1384101399596b9cfbf3f7720e0
SHA1d90bbaf58d0fb466e8de84716a4563f3702c7e36
SHA256813f78f10592facb75ab68531309acd79ff2162c7c6463d590072c5eb4bcbd0a
SHA512640d65513e46e509b6a6a807f7527e547e9ab0b59e1a42f1d40dd7e8bcfed82fcda38dece8882813098eaffc915dd559d312f6cb89a616593089e0b98e346835
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB