Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 10:53
General
-
Target
2024-09-22_393baf922a51a00d7b2de54dd31cf8c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
393baf922a51a00d7b2de54dd31cf8c1
-
SHA1
13c94557c7ff6dfe784fb03143698eb56b55ffa4
-
SHA256
939b8c1dc67b2f1741d866041215ba4648d7d4424d3f1a5f0942681d723981eb
-
SHA512
06e431235e1279845494e64e0ede0064cf90a8d0fedc7b06288e32835d992ebc861b7119f2bdcccdc5e79a84586084c2a293c5de1345d596091d5ab4a6227248
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_393baf922a51a00d7b2de54dd31cf8c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_393baf922a51a00d7b2de54dd31cf8c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mYFUGSR.exeC:\Windows\System\mYFUGSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cECdbzL.exeC:\Windows\System\cECdbzL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yiepExj.exeC:\Windows\System\yiepExj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSXZKig.exeC:\Windows\System\kSXZKig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcMKZBM.exeC:\Windows\System\GcMKZBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BquyKvC.exeC:\Windows\System\BquyKvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGoGKEy.exeC:\Windows\System\DGoGKEy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edbjnhc.exeC:\Windows\System\edbjnhc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrQqPws.exeC:\Windows\System\OrQqPws.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmieSGP.exeC:\Windows\System\qmieSGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YrPJzSK.exeC:\Windows\System\YrPJzSK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkluPaM.exeC:\Windows\System\BkluPaM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMkKHOm.exeC:\Windows\System\EMkKHOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlPDIqk.exeC:\Windows\System\rlPDIqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhPWwDb.exeC:\Windows\System\yhPWwDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odhOSHC.exeC:\Windows\System\odhOSHC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\McQjfpz.exeC:\Windows\System\McQjfpz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xXMkVFR.exeC:\Windows\System\xXMkVFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUPNddU.exeC:\Windows\System\zUPNddU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nwkZXUm.exeC:\Windows\System\nwkZXUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGswNeM.exeC:\Windows\System\kGswNeM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5eb5de0b9d75f818222ceaa8a020597e1
SHA165e53d842d29ff0b41dbbd1ee0587331727079cf
SHA25643f06df5c42d19ff3c0f5c349b66edb5d9096ebf449a77e0beae96f499c7ae89
SHA51284c3e89f6e6d8ef2b6046b4de151da7d113f074a16eea1b45cb52ff003eca1b30be9c0c7d43df59cdc3ecd0d152c25d6575e1fe57008f72d77c47e125a369421
-
Filesize
5.9MB
MD5902262855474fb5df6b1f90f6bc6d198
SHA16746a801167a93355a328163b433cbf82fc41325
SHA25680cbaa98ba814eb768c56722c0b1e18641f296effb08013bbb0c245b9b5bd397
SHA51290d94c2be7dd6ee2bca39fb3ae7a0d007747de7b41845d58dcb4e6b9604e03a098d540b29d8ec9f5ad8ef12ba8225c2fe367c8795f9767a093b78399eb111026
-
Filesize
5.9MB
MD56cb10e5364ae6df983ba76f9fec66b9b
SHA1c33d2687725c12a411d2dbf8750c0032717393d7
SHA256b470f7db9fe3c1a892b36eb693b69b17a5210c3168a26538c4b891e9f18f9b44
SHA5124b7a45265eccfb46ed12be4560297bf872b5d0c73a0e36e1d68b3537776e12f95e22cf2fcd6e809748e9d397f69e9e9299816b8f53209c66857fdd0608597574
-
Filesize
5.9MB
MD52891c8bd20141e3d986e9c670282875f
SHA1a9e4455bfa97357f8f30a40b6035273f3ee33de7
SHA256692d03912d07e8467ecb9a9476047f6a9e9461914862ac21f04a5371d3c245f0
SHA512639e158c0f0835101c84c6aaea41e1b2693037f8914f0881e882a1b3f8f9972349597b70c2055c7f4b6cc81162f22d3b2ab1673df616f23b8f89695e666cd759
-
Filesize
5.9MB
MD59a68e5646a8bdd5741e34da65ef62fa7
SHA1578b85cdddd1484e61332286d0eadea5392dfde9
SHA256d8a9cbe1a0f9da52584a06ae9168c88e26f83673fb3258ada8c60d1069b57330
SHA5127abaf444a2f161390f882d2d17f5e3a7912fcc6b4474f648690d5a37b3c7eb6acceb927f92cdfdd32d25922f837cc4231611d9dbf4c355c3848f0cc634c5ec84
-
Filesize
5.9MB
MD594dc5630d31a5b41a04db86ebba27dce
SHA17dc768223ae9291e10bc6b6c2944715c0bf30baa
SHA2560293592e53571d76775df3261c7f5d7fb2a1cff49eee265ee1067d24c555b672
SHA5128b4078502a007807461268938c05c8cc92aff293a85201461945a62898f86347cf160a2a657cdc589a3019f2104f8ec14ca7386eafb8bbd4682b54414524c36a
-
Filesize
5.9MB
MD57c8e2ecbd6748b3970e8891d97c95e51
SHA192ad8090a2ee775d4904813053c80007bf2c956a
SHA2564d170320cc588cac05902316f388b531c9180f5b285e9be2bfd82bd8a782e800
SHA512221b5482d7ce5fbd94726c8614ac5ba924b1e06f513c45d37a7d65841fea3f0cdf5df38183dc4529b24fbc6d18428b4a49a3114e657d0632181ff5c78f001eb4
-
Filesize
5.9MB
MD5b8c2728e53977c038b91746379a96f76
SHA138e34428e613b1ffe7886a89d1f4c90a633dd2c6
SHA256d853a84745fa9734e1bd14f9bf1af2df92fcfecf92918044bc7f5158e6861af7
SHA512026f5030565b0fb6c6aa861f5d4ef7431d44c67ac4654cc73ac89ef109feaee8013fb045b79dbf28b36ff702841222e4df9eab1b9ede3de11ca9da0b325f8497
-
Filesize
5.9MB
MD506d4843415acb49af48a46b04f7c62b4
SHA1cbe52f47b07401e9976324c0c6b88b2336f7b72e
SHA2562a66f282ff6b39a649e6ff5205b1d8d5a0f8f9ade328ce27d83dab0117e577da
SHA512312b16c9f572bf2237374b67aa01e12cd0e27ad485dbff38a58d7c24abc85ecf7a92b01003c43f8e9717af390dcf5792ef5c0b6affac42fb1110f364a8acde03
-
Filesize
5.9MB
MD53ce3f8194b9a81cef5e4edb4f723b679
SHA17b51d84bf54985dd820beed44352be93fa7c8b15
SHA256a338f39ff0552cf06dced4e32351988631913c5b71b5b812a659a6b1a16de974
SHA512983af76be7f8e3dffd6e51b9f1102f3dfa4a3597fca638a09500c3524542ec1a528c8f995d5c27665b17c259f87dc664b45b578d9a7b9989d623319c1adfa801
-
Filesize
5.9MB
MD59f680043ca3ab2817ca28bd0dfe0eecf
SHA120dab19055b263d5af37d2a9322b0d49742d0d79
SHA25690ca651e07daa126e6ec245a186a554368a6cefc15e84f238835caa2c24f038b
SHA51298877422067aadc5e25a1bba64d5a2151f2c5307309ba98ebcc0720ba2bebd20fad02d60ec5efe9f480db0278ead0cb0a2dfb26a42f5c89de79727aa85fd2d7f
-
Filesize
5.9MB
MD5a5bc6b6514b326c68fe026340528a0cb
SHA162ce08ef524a67430d6030fbbe023eec95db3307
SHA256ffc3b5124c02883c8968af8a1747c9656eac0bd3b4fa109d4abffb20318dbe70
SHA512000ba530a7e6808df5192d18d82b09d67e3b78baef754119471996c477bb7615827bbf9e268f7ac67d6ee931eb2035425b8aae1b00754a5726b75f396c42480c
-
Filesize
5.9MB
MD54236913875807161c650793f61113700
SHA13fc2a6ebababdd5e18fee4b9c4275ce0a585bb4e
SHA256f2ec125613b7c937169b6e1d8e107226e741499dc08b5322507397f43d005e0b
SHA5125c9b093e4f9dfdb3819732aded5f7ec211fa0f8868445ec132dcb4c9e1ee41a8d1f70dacbaef100469d3a1e3303362d9fbae1b4aa7c022ec805f89525124cab6
-
Filesize
5.9MB
MD544f1758ea38beb787dd7a1865d964667
SHA14700e0e98b4e1b0c78731bc1b692b4109b9b367d
SHA2568249cb4f8a3a896814170f036a6f735d83bf4a5fc76c01e1536b4dcd03ea5389
SHA512c81f956b50e668653d3205176f7e5964bc42e1111e9c53458770aedf9d39c742690462fcaeec4c1df6e8d47edbab8d7314b9bb371c7a7858944d4ee49f7bccaa
-
Filesize
5.9MB
MD50266b4019a4db9d34b410c2c72ce2778
SHA1449492841b3d83b409611a0e26a1f038c6d2477a
SHA2560c899177c9a2971dee3bb0f55ec867331ec438bbac816339f90854f8c06c69ae
SHA512e65034baf7110a798c855ce177c975743052059ef01881ea16f4a73f4269286ac8b502fd2ad8f66d6879b2a9d39e3c7f5503b53a86c331da60c0b2c298a3039a
-
Filesize
5.9MB
MD58d289b5d62d3b5db5dafaaa7de4ac45c
SHA18ef3278dc5fba45592a75e23004c7e391acc90a6
SHA25632f865c7ddf7efe6a6e68b7b5e4fcf6795a5138c243fdc1f9fd718786f6853be
SHA51273f161683b8f6996b19430fed4f4b5d9b5b43a7a63a7afd22e8dc68b18c32742654a0a894b270c4d7bf908ec8cea6ac04d8296f5c21b622d1773699c8f700db8
-
Filesize
5.9MB
MD52bd81c6555abd71dde38f5455c2246c1
SHA157e578ba03005024f11ce382035207f6a4cfc67f
SHA256b8e16c8a90bac8130268db3e8649ae8458160fda7d21cd19f493b9f14186c59a
SHA51281d2e8022dbbd2ed2b559ebeb7511828d8e0f655e1c638e76dead6c641127046f3dbb111a675a44591c1eb310f04d80db29ceee8cfc0a377e48a34434170b496
-
Filesize
5.9MB
MD5034a24b4235f7397cb35f816a623fc49
SHA1aa5c70b6e4739c671b4942fbc865860803f08e61
SHA2569b5da34f6e6a9d5f790922bd3ae835bc0b97ffd26ec96298cb0f2e8009032ea8
SHA5126ba7875ea73976b69cfa6b3cb5f931298b33814c927cf6bbb2c7cc99c1300f6d39af050900742dd53210dd7f8b18f6bdebeafb251dfccdbb4fb53040878481e5
-
Filesize
5.9MB
MD5c7ffa2a38a95952627ab2b678f97a151
SHA1a04f67429ad2c3bdde15f021dd27662fca4939a7
SHA256ea1c5a2c8777d8388280a590438aa34ab54da19c170699d5c746d5f13691d99a
SHA51260f0f8a8c5973d576c700da22e80bf4c35265fa91b0427bc4880be2977569b750b372117acba26c7a7cb64ca5fbf4497df6fdf551aac393252b4a08dc292fda0
-
Filesize
5.9MB
MD5478345a0675c061800c32714d4b0b2dc
SHA16bf9f143e3fd72f60003eb65a3da6030468e042e
SHA25681bdc558796c5c2414564122265f87893caa8f523116639e912e7df2ffe42098
SHA51253fb159a75776d2d1f03b9794efa0a01ab75630a6eaa84e64446b5a58bd5ca433a5216448368d4991faf653be6b9f6a86c2a07566631ce3e7cade7c0ca69cead
-
Filesize
5.9MB
MD52e118ecbd6deff2956d515176a8b7ec6
SHA1a2bb8f406d93d829882134b526a21dd0be060860
SHA256e52f38146edfe928cea36be438ab76d913404fded2aa5176ff2808d8f87b4ffa
SHA512300451557f1ef711029903dc262da1f22b90804a27f8ab272f0852941de7d88ecd6c2f069b851f044d32bfaa179aab71f8efaaff7317cfaae841df7bf8c3deef
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB