Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 10:45
General
-
Target
2024-09-22_d4fd4d5bb3cb8d844562a6dededdd8e6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d4fd4d5bb3cb8d844562a6dededdd8e6
-
SHA1
5edcf2cc3c7da634575ae48535061d07636ea531
-
SHA256
92d5395b13668f9bf257678bd2faee874441d9e84c4ab2bf089a071fabdb95ca
-
SHA512
bee2d00b692d531419832276b5720d0d53b71ba496a290ee68ddf364ce267aacbd7c0125b9e7cc52e50d62cfca6df2cd668f16598bac6410dbb2bd4aa2842887
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_d4fd4d5bb3cb8d844562a6dededdd8e6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_d4fd4d5bb3cb8d844562a6dededdd8e6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uKuPZFR.exeC:\Windows\System\uKuPZFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwcWXJv.exeC:\Windows\System\mwcWXJv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrAVyXy.exeC:\Windows\System\QrAVyXy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ahMxtfV.exeC:\Windows\System\ahMxtfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGxVZsJ.exeC:\Windows\System\fGxVZsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSpDJle.exeC:\Windows\System\HSpDJle.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxIqGCm.exeC:\Windows\System\MxIqGCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRxslnc.exeC:\Windows\System\KRxslnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNhEkGQ.exeC:\Windows\System\UNhEkGQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGNHjXq.exeC:\Windows\System\OGNHjXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcDBQlH.exeC:\Windows\System\qcDBQlH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLRejxF.exeC:\Windows\System\JLRejxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KTmlJCy.exeC:\Windows\System\KTmlJCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iHkfcMt.exeC:\Windows\System\iHkfcMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NpolWUZ.exeC:\Windows\System\NpolWUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNRnrnW.exeC:\Windows\System\KNRnrnW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XEihejn.exeC:\Windows\System\XEihejn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sIZAIEQ.exeC:\Windows\System\sIZAIEQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iduyonI.exeC:\Windows\System\iduyonI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVALnLO.exeC:\Windows\System\LVALnLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VthVNdC.exeC:\Windows\System\VthVNdC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD507eea6eb14c0e5c1f053ed95db03f97f
SHA177eec941b0a08e7b149225828df4af1b8a7ebc9d
SHA25611c0d2e3d291478f8930a3d8d037a9c3c4f337aed43e21af7ae00fd510799a22
SHA5122912cca15f95a226ea03fc226e52945830f98b8fa0970b83979ba4a1b1666569af0b5708755c5e0604120fbd1a5a34cecbfc27cc2a8d0751cf1fe80766a67dbe
-
Filesize
5.9MB
MD5a9b33a899dbdb70bc25900723f66e30e
SHA1fb4ab1f3ac96c04b86ac80f4834851cf93c11bed
SHA2567ea7ff3f62e3ab7979487955c9dec0a9ee6710682ddc6a556fc0d68b1a0a6b64
SHA5120bf2d4fc6d333e1b9fac1c7ebf34346d1bd7776295a289f26c05971f910e005d000773cbecb22f752d15dab7c48454f2766a4829bf5b6b0d2c04fcf5bbd82114
-
Filesize
6.0MB
MD5fc5a3d7f393bc749768f2219c9910c6f
SHA1bfa3e564f17e70cbce2d7ba6371b7e5369d2aa2c
SHA256ff5473b4ebf64fecda574ca27ab6adcdf4b244dc3ff188d8562039c5e31eb859
SHA512bb309c2b57c70b69645a5e6a9885e3c38f2d3eab6715ae0593d2fbd54b5c5fe3d97a9dad7d63b715bb14c49df6c4155d0aeb1126ad1e9da621f9b77e1de47b37
-
Filesize
5.9MB
MD55ad3c351bb2be22085f0bd3ad63c986b
SHA193fb5f553735a12fb34bb0b967844cd87882df91
SHA256d751957f52767862e02adb75a72f6553821f9faaa6f16524981f1f76fedf10c2
SHA5121cf5e08724b78453085fe1fba482b6b0a2dac8c8f529a18f15e43b7d73c9d3618e0da78aab31c653de22a1593c28cf06ceb201de58b0f6564a04d41b5e602fbc
-
Filesize
5.9MB
MD590dd31b5c4fe033426dccf06860c1f02
SHA1f14e49ac536108497a3ec7ce725f0115ac659323
SHA256cc2a238b6b6765a0ee89b4e042444500acd6149fb04d202b4150ebd9457e5c73
SHA51204850b9a42b2785353fa8b873c28267f3529165847fa1b1e4ebb0328e937625be31645fe403b31515773c9c50a8c677e294de30e63799c6f775687cfbe10c657
-
Filesize
6.0MB
MD537fc44c4635fcb694a1314f9c26996f5
SHA14b3eb8b8f4536af3b1db3c3b80a1d690a346cd5b
SHA2564732de5dd592f491575df30e48fdb3e18c121a022222b1411c0ee6f33d79f69d
SHA512036c3045536ec67d7b5969048350e7679047d9966fb139dfa727969c161efa61c4bfe288941647893f9ec1c30ea843592a8f4f65fd23e2d3c61d0fde31859a1e
-
Filesize
5.9MB
MD5ebef956d9d99fde140880adb4502a87f
SHA121ef41a55074cb383e4408bcf529c3a7c350d982
SHA256004acf92f9d0094f22a65784277a932c5974a8affcdd6e3ddd74754f03c63e8d
SHA5126ae4d932a4fd8737a08af1cbd5ed374ec98d874fe5c4c12cd854c33e981adadccc1d125ca04e22492030d0d09648e91baf70168befa18d8451b7ec6c296fbdea
-
Filesize
6.0MB
MD5dbca62980a4cc116497927a9183e0f39
SHA15d54639befbf730c0ae457ea0311b327a4335782
SHA2566120946d3b2130325dbacbc7fe9e56273e437b63f24ae71a17355b7996f54a2d
SHA512fef8e4993afa991c4ed6c0e465e6e76090730d3544b5cf5ddc2ef5f004cde3e8215ff8009df9315d20a9d013c8e5cf11a3a893f8e302e0fc51786a6353ae68e7
-
Filesize
5.9MB
MD508a2d53b21cca727be8196f80ee62abd
SHA14d7ab9c82c9e8c01c1b2f72e75c1b2f5a16c543e
SHA256542961c8ed59b09e677073a00123a07495ecc86c3a7e2bb72d100e8c93c5a034
SHA5123bef3046f6a753704768c80f687a44c87f8b3f9f2df1f06d773e99542d75888a60b824b72a1175a276f92691517fe6a7a0550470e52b523bcecfac13b7034554
-
Filesize
5.9MB
MD5aa69a6f163945e84927dd98ed338b6af
SHA1934cc505d83772b440bb8d3fa23dff343c502102
SHA256abba0f18cd64081ca268b5441aae45fcb5a679387fa3fd3bed0c3f4c60a36ac2
SHA512fc9f1f978aac6ee3ee6a26c4c3ebef002423283e9e7f10e2753036e0e2e89f6857cd21416898764c995864e68523366afd5368793c48861b37fa74178219988d
-
Filesize
5.9MB
MD50ccdcc3e6d04f0019bf1d9108b0c291b
SHA1cae3ecb6f41e16afd06c5687f23f533b67100cdf
SHA2564538045e92c49698bb52a9fea19e8c018a811722ecf8b741394bdb91d3d6d669
SHA512827c6c88a49adbc4d10ac1b5ae7c2bb7d187ea349ce3700d7cbbe0533853053d2deff7856dccd12d09b58bb70001ecbfea879204cd4dee329694669a835aca0d
-
Filesize
6.0MB
MD5cfca704a6293811b320958fd950b3b4a
SHA1735db0d627a9ff41d96031877f505225731e1571
SHA256680d756463622862ae9ee4c5426169d9103e9ea7570b6c41f2a25cdf197a0f15
SHA5127b778d3d47e26c4dc0e319a2fd92c1dbd47b6cb7d875c4b5ee90b34e5753f9a40ef9eca52f4d354908e644119358e82afe4cd69d5c217751360e6747516f16e5
-
Filesize
6.0MB
MD58e265721975b930b3a2112edea41e7bc
SHA118e73e6be72e717bb389ab1387dfc3ef562291ad
SHA2563558ae374d387567a8939a1dba591d8d5c2653bd3d25c8f4501f4fba0a6dbf1b
SHA5121c18cf9c6c14cd753a3aeed5fa5584808ad4c04af2444b1b8153c9c5517c280af9d9a817b98a8d4df9ed9593d3d5ff61a17fe00835447d084d800ce1073d5461
-
Filesize
5.9MB
MD5c1706126be500325aa8be9f145ef831c
SHA1f72124ec3e490d17ee82ce8826f48da98974398e
SHA2562d15ed70d8afa4a75322afdde360b2611daefb99029639e1cb1420db7a24084f
SHA512e893c42c4abbf84c480615cd9cd7583ea2cc2a5d2ea21c1287aa7519e45145820e2507292e20940fe4fe9cd2958860ced3b7ffcfa02603791885cfa5e0d171ef
-
Filesize
5.9MB
MD5d39facecf41d24c5da7d0625c34957d0
SHA12824dc71ce2fda8ce7db91a61dbc54be1e2cae95
SHA256a135a738e86e24cad1c64218cffea3d9783b07a6a757feba8d6673d6bd9e9151
SHA5122b7215117c242f119295c466eb6f8cfebf0b1892e8ebc663a4f28b4a9ad623a353f009c3dac245678ce81211d6fec9e6b7f48e4ac52287a9ed133e8822f49d3a
-
Filesize
5.9MB
MD545a361ed3cf30b821c848928251252b0
SHA1fcd8b61c9489ab20c355baef612b936a4e137f2c
SHA2569fefbd54bfd99d020b80aaf94dbb307c17fc31304c125edc12ff9cd86e36ec13
SHA51266f5c65757d1053fef2bc3c30d54a3b8a7935935c17fff9f846fd27ec814a53b582fac9dd01679ccd95d8446e0eabaf25229e56845160661120b2212a1cb7ee2
-
Filesize
6.0MB
MD5f60b76619241958f523e9772a2d837ff
SHA1ad35555fef75bbd82eccf1a1562e7b0f84e40027
SHA256471d6c4ac1407f2a2c1a975976a5f9e8f4a8f6992596aed66d48124f36e70f97
SHA512d1917cd7f9fccdd2c0ab5cfbc7c77f6ca5a2f85ecf4d87307e56a8c5db590209748d050a63d9612c86470ca9e42fc20a60356fa2e73ebd40520ba015c4ebdee1
-
Filesize
5.9MB
MD57b50e2a7ab3348fcdf585b578af882d9
SHA162dc0513706f9d24c15a2303a43821d487d326f7
SHA2566f3b11895dfcea2b70dedfa9bcee01d03a183f48594a9659842fe072ad166175
SHA51212fe096d2e24dee26777a3ff1288798b5126f1ae8fdbff71c7772e14985f5fd8dfb0a07c3e90d398c1f63d18015773f962f8d3c31917883b5d78cf0483690786
-
Filesize
5.9MB
MD58956cc0aac6c1a68a65c2653a218ef81
SHA15b5b334e34213c029584397b63659d202ed6e542
SHA256f01e14f6f4c3e0c0e6b898be6d87f17120aa16ee27ad8aedcfe4e606adc346db
SHA5128fe53d8f37f36f891b94366cf4cf1a1c037a7fe93b61b8b8adbf8cd4ef3eb2d0094f529be1024080e33ecee2f4959394798b6a2083238853436cbe8d1957e6b4
-
Filesize
6.0MB
MD5e0c47bf216645369e180c177c8b99556
SHA17947ef8a331a313d94762d885346a822bd66406b
SHA2564bc76d0d90e93ad9fdf613266ec585752d1d95e035e59778d7a84f116bf0d906
SHA5125ccf7453a03393a2993495c8751ece3ebe2b8fca99011288ce8dea7ef53ccb4fb0a7f91893152dfc8abad02de9bc095ac9fec2f5bc09df87548e5b3ca2494af6
-
Filesize
5.9MB
MD5742076c8d96fb605214598552801bd9c
SHA133b8694c8a2c79fc7e65bcb29df828f4cc75153a
SHA256883c6ee1c7a44abe8c7511f1169465a508a81ca05914edd36ae786d78cf4fef4
SHA512b97bc59e98af9700e929638bc7c635c1e8ebbde509e68bf3360f0539a76cad62a1327e495fb14578e5f3c3f46930903d0948a67efe95eb0f351b5aea3c2e6019
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB