Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
23-09-2024 00:46
General
-
Target
2024-09-23_5eab5a8a110e8241c192ba499490e7cb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5eab5a8a110e8241c192ba499490e7cb
-
SHA1
69c6889e05652f0d600565fa2f20905144c242dc
-
SHA256
c740aaa1e650b0d4454c72fb4c2f67a65ca55853d04cb3d8b1153ef56a567ecd
-
SHA512
61bb9bd14d2d23f1c98d9eb445c51fd3455c3fbe12f5b1ab55f4cd68cdef43841d5686b2b5ee5a0405d0aeec23a3aa5ec05ce48a36f0cebec8c26036f24aac3c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_5eab5a8a110e8241c192ba499490e7cb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_5eab5a8a110e8241c192ba499490e7cb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WbDSQaR.exeC:\Windows\System\WbDSQaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRfeEEG.exeC:\Windows\System\bRfeEEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXCvhgJ.exeC:\Windows\System\pXCvhgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aIZQiBU.exeC:\Windows\System\aIZQiBU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pDUBynA.exeC:\Windows\System\pDUBynA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hxpPKuK.exeC:\Windows\System\hxpPKuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LZpUsvQ.exeC:\Windows\System\LZpUsvQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIUguoH.exeC:\Windows\System\MIUguoH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRIPlyk.exeC:\Windows\System\jRIPlyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BgtwzWD.exeC:\Windows\System\BgtwzWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FitDUxz.exeC:\Windows\System\FitDUxz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRwuOag.exeC:\Windows\System\QRwuOag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YrYZPwq.exeC:\Windows\System\YrYZPwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utvodHY.exeC:\Windows\System\utvodHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NYOPcfO.exeC:\Windows\System\NYOPcfO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ABLexJU.exeC:\Windows\System\ABLexJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUnreLU.exeC:\Windows\System\LUnreLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\teeMRst.exeC:\Windows\System\teeMRst.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QblNHVW.exeC:\Windows\System\QblNHVW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtssKhk.exeC:\Windows\System\DtssKhk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKAjQGY.exeC:\Windows\System\EKAjQGY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51656b085c175441f835e5241227917f8
SHA19948fbb7602e940d41c76b19a0615e4abd4d3350
SHA2564d6f28033e6bc90b61400468f200a161a9e7eda9a86f72fba6f07f8a58c66563
SHA512e59b10c9a9d0ff5cf3eca01ef8685e65815f47e521e49604c688656e7d2c8530b3978651384c891ecefde1bd1c943b32d02f513917312ea93b2eb838658e4367
-
Filesize
5.2MB
MD539c717212f29764bae21d00090e2be1f
SHA1c50e60ec68398232593a5dabe323889525d7ee63
SHA256f2965d3f799b9f7a2e08ba40d5e915182fac10a41b76a040d0cfff2969b8aa54
SHA512b87086959f41eee6407d27a728d19c6b625c1d4f4c6b3d9719c3094ee22d4939e2ddfa45364105ab616831dd89d11075adad49337e26616b63972979b8e4d1d6
-
Filesize
5.2MB
MD504f7240daddc13ed15a7fe51b9f626fc
SHA1e1548c76f81f5fe15f75a73bbba0c28b0c4706c0
SHA2564def60d9103b9374c7307e61eb886b98d96cd8ec742194b04c93e056caf352bb
SHA512e858fc48c9d455d248a88b4c351fd9e7317d26860f335a5782fd2327d67722d80f9091da1291e43c167925cd21901273b7c58e33814e4e14f678cc4dd36f34e4
-
Filesize
5.2MB
MD5255ce390505f62d62ce253a5cc8733f9
SHA18d0641e6df57c5edb7673692b3c9a6ccd1a70532
SHA256db3788343e4cf123f8afce9c4d240c767d7e8af97dabad22baf4501db3442f22
SHA512f04f3aefaa7acfd28441ed0d0376d7b01d2dcddc38aa4a66b79ecec6a05045d6d6d4f809bd1690c1129203986f5047b75f05e739fa61a191e6db3f7f85081f7d
-
Filesize
5.2MB
MD51b78cc65c4a863f009b40cc3b1d170f0
SHA1f410a88cb0154b86c6a0a3fa66e51348c54f4036
SHA256d6d099fefc79fcab34ec31171bddb43735fcf0f1528b1c32483afb50d730be8d
SHA512ea66c5772d5e9073ecf44811de9d4d7410cbbaf952d7a33a98d0cbbc7141118b4911b103fc00b2462075653e3b5faeb7f0f52c3ed2cc6e03dfc4ac53e3754f08
-
Filesize
5.2MB
MD5ab476c426a762729de3116d03d6922f0
SHA1d0aa7408ed0835e94303cae99effd64aa1de0855
SHA2567998ac825ffa4e61e1a73ea466cbadaf133b532b77ffca66bb8a16f480d6e302
SHA512db0e096c127699eb2a3e8a4994c6a16ef89d3506b9d888246f06c1e20991d82c7039f95f4e0ff6776e288a8742acbae16cd89492dbe57290072bba0cb849ce7c
-
Filesize
5.2MB
MD5498f4a69e29427e97c24cfa227f420e5
SHA10dca24b611c7962e4ec08887f8dd7293572ab4d2
SHA25641556a6d5ac98629eb0ef5785664e5976ab767645258824204d2ffaee22b8cc6
SHA512583d741f401d52900c10d0e0a5d247c586ed47df53296fb177d0ceef69a867bd967bcb68c4c596d0ab76718b34b3541ef371d4e154155c9790188d2a23adeea0
-
Filesize
5.2MB
MD5f4cb44e0c9392677d02e9a3e2450c6a0
SHA1859c1eb1c76deebf156401bda436659f6011c6e5
SHA256c61a05710fce458b99eee9fcd8cf1c7029e36d4d27b15de70aef5ad132fff0eb
SHA512d1000fdb317128c6daa8c1d0e8bc873878e6b36d88d6ca7b4c23429ac5ddf7d061c411bf74aecef25290e4cfa5466d4df37d008568647e7706d4ffc62a3b712f
-
Filesize
5.2MB
MD5d64d595d92f5915b93c66bc2cf061030
SHA13021522be6f02cb4b42964710f4f9df7c3f1c7bb
SHA2568b6809a432e89cfdd22c72f3ce0d7db058a33360040635e52c1823cabdb3ba4a
SHA512e269b56a18c946426345309e86cba7ea34e33b0a4c5d0f1c8a83665d745d2a9197bff7550d9520dbf6048a11e8ccad188ac058ff8591d2bc52b8d1f476fabd4a
-
Filesize
5.2MB
MD52ea6a5649a4c0a8dbbaeef697965217c
SHA12d3f654e380380f97d166ba3ca20aa1775d50ec2
SHA2560740e48cda4203c3f224d58f61fabffb5a63114e5d61cc57faa6281027ddb971
SHA512af0010c5810ec2c2597d4e144eac401eff1c8bc7ccfe072d303d1ce3c45a67fd251a4a2e3fa0357b8369d5446b903d096232df3cbb3816281b250b0ae3f8d6e0
-
Filesize
5.2MB
MD552d3a0404f300bd9d71c3905ed3d4f64
SHA186e026238cd8a59f242d6c464416bdb599ed526d
SHA2568e17148f6c57774a81ebc1ec500dc2c29ce1fa082b35db99efbc5bc417c71d44
SHA5123fc41511c5da51fad112e4c0dcba3aa481be32d35776cf436fe2f86719a0c227d8e61b945fbb9eba19a6c753e444b577a5b6a0e740778ca0012152ad9f666079
-
Filesize
5.2MB
MD5f65625964cfc4b182c4afe16948b36bd
SHA152b3cd39c433e019e4f1a95e1cbd1d0a35af649b
SHA256c11f41c3a98d75b6ca29a0fc1f9af8941027c1d0ce4df02ae3aafeedd993e053
SHA512d5bb9d7317ba7317f94f552aa3681fe968cd3d0b4decef4311ef8bbb9b9b9f7d3cc8e297d81307b109901a14002b4a7698292f6d3945a3c142dd7d758c6f81ec
-
Filesize
5.2MB
MD552cea62d970af06f7585e8875fa56a88
SHA1ac140acda403b519087affcf89a300f630170412
SHA2565eba19eb6f25cca65575e2a8090d0289a667b9d52f9990ef6c591766ec20c811
SHA512e0a3537c10cbfe83346dcd5c4b9ca6c2653f313df71b35c30d323046dfc763f6e262636a92e8f4c6dab3aa9ba94ccaf6304304d5a42bd579aa18ddd7021f39a5
-
Filesize
5.2MB
MD53535446866166cd4ee45feaa0d9188fc
SHA123e7113ade713ff833daa4892d77f12ab0dc6361
SHA256082db84c06e6c5e968d2d23022c88b7578f32cf9dc5997da04f6a3c6137120f4
SHA512fe77de52ad3f618a4534718db68fbb7a603301118d20a6f5c7d0a1e52b21ecb9ff4946f430943930e76ce8ad4bba504729d2e3481fbe567b5bb7244a5e2dd7e3
-
Filesize
5.2MB
MD5d2eb3a9971e477ba0765167f496c8a3c
SHA174f4623e1315dda2ebf93371f61e8b0c81bb63d4
SHA256a2d217b462af21548242ae80d91f222b1a412412e3804644496380bec17b9706
SHA5129165541a29c8a446e98e2ad9837f820461a9bba53222246b9c814a394ca3ad69958c2af38b812535c18df9d9cce1d7635a7f7568fc48af8cc5cca3f1c9eab92e
-
Filesize
5.2MB
MD536fd96780c73850c2e2c9133d1503a67
SHA1ccfeb225c15c72d965b5116287d7233f979bcbb0
SHA256ee2af6cc14b0d9759ecc7ee7d3900ef0db4d3ff3474ee1221f4f476956c186b0
SHA5121114aa0b3389ba284fc0dd1e27bab19a3362f6326ccd7ebfcd2e37f46480f2a8f20e35bb95843f671fe79f9965deda5405275cfbc90aba7d2e9ad124e4c945bb
-
Filesize
5.2MB
MD52279cdf9746f76dc7341993360028558
SHA122cc28099c4f89052b2e5d519aab8c3c51e3a2b7
SHA256ff40c542ecdd2d8c5a818eefb555c0c30b9fdf44a33215c60b52d812d508b33f
SHA512df12eee0d4a74f89a6b7bdb1b03c2894a18aacdcff19ace3a8bfd1ef605f4bea432f23183a063934e6b91b4bb4a41c9f95008f7e3f6173210516015a777d8830
-
Filesize
5.2MB
MD59bd774fcca9e3bbe43e825c1768ad149
SHA1febe5c4491afd3c150114f6b1777d6c2d0f1575e
SHA256b3ce8b0c5c8404cab3edcfecc1a06f8a70c30ec21d34569b79152d6ab0d0b114
SHA512a4857a4bf64bb6454f7dc41721f1b672af034a3f1363b03393dd517b6e463bcd0c4c7f1c66914e756b8f0aef75c2be074fd71d742c10028799624ebcf2d033e2
-
Filesize
5.2MB
MD55e1e2bd8f0a1c25d28db500cf7065517
SHA1ec73fdac3c23fb8ec8639c3fd0137fc85cd6967f
SHA2569ff39413d94d0a259fe2eed0455fde91c9efbe13b13daefa0180389a04b33468
SHA512cde3c95d727727c2a3534baa9e372cd6716a7c727e4f46ce09f03bb3aca9bda914eefa272f623570d1d52038d642f5e982175298900d1275741efdf3034da80c
-
Filesize
5.2MB
MD5a1f9403b0b1220277b586a4746768c1a
SHA17b6d5313d6d1ca550eebe4f2aa39867802c8dc2a
SHA256f76767c23bd57d97ff5619a22ddc52aa10c7087374a66110c2cc5d6417eac82d
SHA512d3e825838cdde5a9c2d549447438452a87501aaa7054ebb8866ad7cbab69458ed20906cda784cdd46d9a38bd3cd6ea2e335eb689aa18754b642adf6fd587b912
-
Filesize
5.2MB
MD5e507c0ddf244d7d7b945750f2e0c9c34
SHA1d0e5658f9b14e7548dfc4f0fb8839d8bfbd9b8d4
SHA2561d039056167f63d45731c7109cd4a2961bc5a5858cb5d812a8235a91f37bba6a
SHA512f5879ab18843693bf87ca2cdfd9c34f5a6e3a8993203a5f1221326fcb60741a319d304d4bc1124ae562491a440b597efb58498c3b5570cf398d347f82e615f74
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB