Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 10:54
General
-
Target
2024-09-22_44d6e4e3b976c8917eddf3a72f86fc61_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
44d6e4e3b976c8917eddf3a72f86fc61
-
SHA1
83701bb67ef71aed967e0bc5b56c2cb1332caa83
-
SHA256
908ff2d90bb8dffadeaea6b8039903e6d7719505bdb18d7f4715499bb59879dd
-
SHA512
3b1b56b26759c5bc29bb50d925b664515a76d7577225b236fad7206a5648045fff4831fb081496b1d1d39c186ea7fc3cd7123e1b00073ce0de6756106de0707c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_44d6e4e3b976c8917eddf3a72f86fc61_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_44d6e4e3b976c8917eddf3a72f86fc61_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qJDUDfS.exeC:\Windows\System\qJDUDfS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkAaMJl.exeC:\Windows\System\KkAaMJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LeiUAQQ.exeC:\Windows\System\LeiUAQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsymtRN.exeC:\Windows\System\PsymtRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzWcilM.exeC:\Windows\System\KzWcilM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhSPNfz.exeC:\Windows\System\xhSPNfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkAQnWt.exeC:\Windows\System\UkAQnWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRBOLrA.exeC:\Windows\System\sRBOLrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOGbisz.exeC:\Windows\System\zOGbisz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QghIspr.exeC:\Windows\System\QghIspr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aqqsHCB.exeC:\Windows\System\aqqsHCB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGmzdKY.exeC:\Windows\System\oGmzdKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvUezeN.exeC:\Windows\System\DvUezeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASOnARy.exeC:\Windows\System\ASOnARy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXsnWLk.exeC:\Windows\System\KXsnWLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MApsVNB.exeC:\Windows\System\MApsVNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OlmSUGs.exeC:\Windows\System\OlmSUGs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KLxpwdu.exeC:\Windows\System\KLxpwdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naMcBTo.exeC:\Windows\System\naMcBTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBliomK.exeC:\Windows\System\YBliomK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkixFLQ.exeC:\Windows\System\NkixFLQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55d0c3e3f8cf4d4cdf8725ad1dfd6f482
SHA13dee08082fe70c3aacd2dd618ffd9c6c539f6593
SHA256685472c1242bfc79089207467a03763c95c0fb3c0b863fe03cacb613a12148ed
SHA5124962349f225162ae6059c7a44f63a7ebfeadb7bc6c2f40bc977de24244114d5965f3e6e0870ffe6a92373d775166c756b029431054e321394254ba7c90a74039
-
Filesize
5.2MB
MD56f142bd44fcac8897e894ec59a63cab8
SHA1969a0a2d86d3aa879e3880ff7cfbe66447016fae
SHA256bfc641df0af0afd37b970944e01a9171cf5f50bc402b9b70eeaa208b0d772e6a
SHA51236e65afa27e33948fe300e2f0140cc96a0f23239a7b5f9aa9d231446f6e152c842de587c1b0819863406dc9c29217375013da56f5a5656dbc4e84dd12ece23ab
-
Filesize
5.2MB
MD52bf8797c3fa012d95eedd3ed0f58b989
SHA1e18d865568c811347ea68326995172a4823e5bc1
SHA2561ceb18796dce8de25203b5913471fddb0fdd0d19b7a83fb1ec9c84b5f8feea9a
SHA512c99ec2101e1949acd6a07d97841f2fd4b641c54d7712f23180c1404a5e51ca50156edfd4fd9c63ca9a8d6659671eb7d0c3e4ecdf32006fa8516be9bb5c9fbd12
-
Filesize
5.2MB
MD5b04a799b54520ccac19693c99e678e5c
SHA115ff34e586e0965942403867ce71576bc68f5e29
SHA256285593750810e7754ee4b2d422b2c397fa0f00a839b2fdbba568cd76d06b706c
SHA512f5f3445e9516c9996cf1b57e058e1fb8bccec4a17123cbb5cc0887da2a81c5d60795b459b976a4c1f8216c2f41faf00f56f65463f14c12cb5ae80a5db01a157e
-
Filesize
5.2MB
MD584b1b3c9c5bdbe4151b7d4036c6749e5
SHA10d6787f896842b7a57692d9e314ac41b4f78503e
SHA256cbcad4ba8c2ef0dc61b715acce28b7c01fc29eb6b0bce9ebe523ed329c14910e
SHA512866c0ee0cfa68b4f0d8c81713188a20f036c84703711a266a21858b970600ae70f64a000c860ee7921f0a25b0fd8e3674945876c3562ac6943b292b975931fcb
-
Filesize
5.2MB
MD50f6c0c5bd96cd8c418a92da3e74735b7
SHA1e7b5ec4cbce18f6e1c36f058c143da7e7841c2a2
SHA256ec0cbbe8e1830287e6b366e7ef70e0e0aa4aa2551b67fde3654212382acb7d33
SHA512ceea7ebba21a0a20e0ddfdf77b0a57df4c67a07eca4a564ac5f60291d58deaf67ea2b1e1aecec431a5d32879771acf8bc7eb691a876a9145446094c2338f3120
-
Filesize
5.2MB
MD5549378eb3a265ba2e29482fc5df0f52b
SHA16d65e265a02075d84c9a1fb1f30bf67f794d1260
SHA256fd8afd559f3426226d5113b381c4a49fc1ccc29e67ea1457479a2ee9874a8930
SHA512e66dc22b7c8bcbac38f77c890fd9bceaf0e662c41b28558c8b540728ec873b5ebbf9d3217993089877c916e8ea8c27f2fb6c0c22e2e7bb2f083776736b27f29f
-
Filesize
5.2MB
MD5bef7be238631589c1e5d9296159d9ceb
SHA1c6a7a5d00fd552040712d81a02ac335c00815a6f
SHA256c625139fe855a819868ee8be0b9eeb54c93c6b57ddf21971df5998beb28d5255
SHA5125d54f58a250895cc4541b25008d92ff082de1bd1305b7643aca8e34681945a5a0fe574ee22685cff5580980c12fa1a2d7d34c8571ebccc28c8a3802e75e574c0
-
Filesize
5.2MB
MD5f8e105aed4d65e75606b54e2328dbd2b
SHA151498c3a3d582b2f9dcc45c67dcbdca68451aae8
SHA256886bfac7168ad3bf4bbb4f293f2d4949bd757094fedc609f306ac3137c23db04
SHA512ca13e52273f93b04f48d3aa61a6b35328cd1800383c7d02080fda137e774870aa60e69c3d567e493a6daecb43ccd94ca34cbfb3169cf76d45b5024b5fb381b5e
-
Filesize
5.2MB
MD5e616d2eb0bc2b6808ab80ae77a46df13
SHA15bcb0ee80677bc57bc1d6ebd6da4f07d40f98603
SHA2567f7a1cb40fa8bafa4eb743bbdf83e2174ac5075ccd5498db66c5cfa4e3578d8c
SHA51232d5ae5530e3da6e44c9702cb680ba5c2e071e8e7674c7fc51edd8c3b0f48e872e30812498389d824b76c57d3bc01e1a396b4cc265e81f19c04cf6a42a8c7933
-
Filesize
5.2MB
MD57b8e384c288a3956f3cb2e28144d6379
SHA1887d502f122c8c7dc6845497141dcd9abf000f90
SHA256bd4a483d2fb0bff74fe035ea4be62878501bdfe870d262b115052f0125b24653
SHA5120454f690c2804459ffbe4e1d5f813ddcd35faf04bad448de1cd6aaf645b120f1f5c5e370de1e9475d6c1170c639ab20686df70a3bc9ec393015c2ced47371940
-
Filesize
5.2MB
MD5bcee0e72358bc6a70f9bf33651f6de03
SHA130ecaabba49cf5c874fee345aed09bba8106e16e
SHA256fdcdd8b977f5f03ffd0a4573cf7acc084f7192b6021cecd023b0c0835a1dda3e
SHA5126ba54fe28955cad50080187d7c10967921e809944b947db0088ad0d70565f8d7819724ac9961595327d0fa888d1d6117616b328495ae7c1cdf9e0f1324a97adb
-
Filesize
5.2MB
MD58caa11fd3b4d752e596ad7e928118fc6
SHA14dc2daadb7cc77e90af6f2b492a761cca999d7b2
SHA256c88200134b01bfc25edb29d9d77b09814f20ff4f04b0b337c007594080034f7b
SHA51270f7fbbed04707736319db65b87c61b8c013b84f5fe3e21e6ce7d92f705ef2b7f47efb12d943c4a905d1d4ba361eb1d3fee35b1a0b02fb9947f06f9873b844d7
-
Filesize
5.2MB
MD565b7e67b560e44142eb4bddbfb90e758
SHA176589b623f3e283825a500eb5232b60691d4d6df
SHA256dbcfda4f45ca287d1389e6f44993c3b4282194b87517e7adfa1bd111681f5399
SHA5124f22ed1877bd4bd2c7cc5cce3446c6dc53add168811ae3e52ce8652a088728fcc900a88fb7c7721ec20cad1cebea607753c0f7bd921ce28d47b70a60ba678993
-
Filesize
5.2MB
MD51f083569cb37e7798db5bacd6c39d758
SHA12d768c3aa809147fca6f6e9e6ca8cf6cdc7b0135
SHA25616713fd5b49e491edf9e22adfb9b3389c0137e6e61fb1d02df994320237c87a4
SHA5126ca9ae0db6b6cd41d5479b51936e12f608957201cf6f6b9869d5d61e997ad920c3e7aaa7b1d5dbd5963160eb86650b10525e8b6b6511dc8434b5757713be0f0d
-
Filesize
5.2MB
MD5e65b8ff406d87dc9b4ce8d184f52ca64
SHA17a3066992d2d446303ce3291bf6100d18ef7485b
SHA2569f3bc9f4340cfd94f422435117b220dfbe1fe50924db08816f12167f4666f28d
SHA512eab60b0cf0f5a8f562bb2717834fa650672625803e81df99271c9c40173471c33a018b018949e932b2c0c39d8f77c560079aa9521df06715e355b2fb48d32948
-
Filesize
5.2MB
MD58b82dbf2ee6875c34daa52d8b682e227
SHA1183d4ca4429eaf7eed9f820f78e99c2536f30424
SHA256a9ea3884de488663daf168611cea2f1b9b3d318afe83c4be563f14283d8d8031
SHA512707959e090f4120f4e1c6fc50ec926aa18530724a97c8d442404bc50e3433bdef369c27447b0fec2adb4be3caa616ddec1592a842556bc9343eca83a210ade34
-
Filesize
5.2MB
MD57c4fc191132591cb33ebf5bfdd5afae7
SHA11b09346440b1bbec7d3aa141ef2e8750d3f45c8a
SHA25636aa88dda837290ffee17b88d8bb25e77c16291ce34736cb38f9d3745dd1a30c
SHA5126668afa786f8926f1b9d5900fd9aeb35cf2864e1b650d2f6fcf0a821fdd2d9736706427c0a640c2d2f39ded48fdd4c6e70cd41d2035e7ed9b57d392ba70eb2eb
-
Filesize
5.2MB
MD5bc979505f1f254614195d2b2e5fa3558
SHA1d2e97ad02bd1b5d1b3398456890d176161ed391a
SHA25662de822975f94a2529fcaf6a4263ce3219ade0a8fb7ecc160d7fd274cde71ea4
SHA512b84ac23d13c470080ab05e22000f3482dad93d3374f30676697963461767d90017bc2441a8410e171c70711cb786d181d1562f7bbd0a313b02c7386b5dbbb88d
-
Filesize
5.2MB
MD5384cd42974662c198391162df6a27b98
SHA190f02828143d9b005db628fe9c2c06f906848d28
SHA256d22bf69989f4eef49adf3be0df85851bcdfefe16c36bd6c3f2b10325a91d39bf
SHA51245b93676dbbd66ae5bcd3d28c8d3abe5d2495bd9ab81dfdf3665eff534e856cea28b03e6b74fa7b3b77223bde84e3ae9e348d36ac9683f40bba65678e9314aaf
-
Filesize
5.2MB
MD56443e3395b5efe63c8955a37fab611d1
SHA1c7e57d9e66e0a9973612c393e31bc7e9cba96e52
SHA256d05404fcc16642007e4ffb55a2af82d384d2bafbbe97cbcfacb597762b0155e5
SHA51261cebb178dfac4f9d6dd417d17f21e31db0f668d89726ccd1b5219c5af66b816c193a442beaf9f7d82ee627846461962f9a35a95d2108896569e2d3d265d66ec
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB