Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 00:48
General
-
Target
2024-09-23_81c3a749f6e58253b1eeec336b240a54_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
81c3a749f6e58253b1eeec336b240a54
-
SHA1
ce074767f2e9469d7d7a81c19f1f2fc5cdd81a5c
-
SHA256
4dfb6e355c06d3ba30bbc53e6a515dcc16c537450e375c767d5752a1534bf29b
-
SHA512
9788abb2d0b2daff4faf77fec34c42061ac2048d1e0fe4502358466979aef80cb076fc28d07b2f91b7bc7f3f2decb45a581acaf5e1e55a505c904209a77734a9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_81c3a749f6e58253b1eeec336b240a54_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_81c3a749f6e58253b1eeec336b240a54_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yqSwWxn.exeC:\Windows\System\yqSwWxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQnFMvg.exeC:\Windows\System\xQnFMvg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtnWJSD.exeC:\Windows\System\KtnWJSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzBQjMi.exeC:\Windows\System\xzBQjMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QntcGDI.exeC:\Windows\System\QntcGDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tDeuTuj.exeC:\Windows\System\tDeuTuj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIHdEGD.exeC:\Windows\System\MIHdEGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yfyxcuZ.exeC:\Windows\System\yfyxcuZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kWfDmXn.exeC:\Windows\System\kWfDmXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EHOmCAk.exeC:\Windows\System\EHOmCAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NzmUFiQ.exeC:\Windows\System\NzmUFiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YdNEPHe.exeC:\Windows\System\YdNEPHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVcFlIc.exeC:\Windows\System\HVcFlIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lNqpgCy.exeC:\Windows\System\lNqpgCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QAwvGtc.exeC:\Windows\System\QAwvGtc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLbwCiL.exeC:\Windows\System\GLbwCiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NYbwyWs.exeC:\Windows\System\NYbwyWs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPcesWD.exeC:\Windows\System\CPcesWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ahGayLW.exeC:\Windows\System\ahGayLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bJxObih.exeC:\Windows\System\bJxObih.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GXIwjbz.exeC:\Windows\System\GXIwjbz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5532e5271253879d8b4614e412916273a
SHA1d52d6efad426c2af9f0bed5d7856fa0db39b1d8a
SHA25633f879fbbecea095dd784d3ecac84f75aed11f70d7eb729ffb2fd8b953de2f90
SHA51249ff4317ecf683b9dd1eac23a5a8bbadc1ac516325c19411723c2d191afdd4097a4b97c6e6f67335f3e8ea624025893cd848bf51857a7616bf809986528afe7a
-
Filesize
5.2MB
MD567aacd44e7aab071d72cdb574122c0c7
SHA1e0515db3bf909210b0780e1ecfafb17a7c42b8c7
SHA256873a0cfe528a2fe9fad05f2df83d9e1607f020796e3156764fae1cef817696fe
SHA5126098a2fb67d009ea0e36d1f0109d4082b2ae8b9df6660d1231e306d5eb9186ed9653a24a1be610572046cba79841cceaae6749d59475e31515f4bdaa9846edba
-
Filesize
5.2MB
MD568a10e223d40ed78b8374a5bbf2ae266
SHA11655ecb9f1f07a13b1ee63ffe0b39485d7b475a9
SHA25616e8cb563cc8a359e21ead0ad3ef7ac0a7663e57aae77f8bb915070fb2804013
SHA512c7bb8b27fd11b9b2cd1c8306cd7fbaa627a17f5eba6c834b7c544749162dee0ded48ccf88e0c93b9435717e47930378f3a82973b27c10d8294d69a8a5c253649
-
Filesize
5.2MB
MD5e8995d6e5d8134aec3304e785bb51c47
SHA15b263e67312b43fa8a49b3a2fc6a895e673deee4
SHA256994eefd663a33a460cd3f0902b1a29b8183fd6046cf97e47d13a492f1f9866fb
SHA512155372f8eb236a1e7a54bede49875e3ad913652f78c94fc4eee97bc87e0fcd2242dea34380aaa1611470b71c9cd13502df83a9bc8476bc1ffd771392501bedcf
-
Filesize
5.2MB
MD5992fb852abdf2d23b2ef72c03092e54b
SHA1051542599bfd2dc1c90bdfbe4d3c43874b9e2a26
SHA256b72e464d7e8009fa397d066543863d9a2e661053810577d28615040121d533a4
SHA5120b02030be6150ff1c92b8bebab1c2941e04cf584e87fcb296eb2ceef8a21a1aef556166e65fa6d76c3f4ccb0fb1a7690bc187e29f82897f949e33293bd9a51a7
-
Filesize
5.2MB
MD59f033a818358686df2bad6afc83a1eb0
SHA1395f3e451f3bc0aa4619683fd89ccdf003c572e4
SHA256f2398551b6d3a9461e6df7975753be6bc8a7f1be3f904715c299c6eb60a9bcb4
SHA512a26f5f636eda7ac937ebe5f331c5f4003348a859966fd73f31f5739308f39773370730d80924620fb545ad9a0457128dec11697d3bdbf04328d57c3fd93625eb
-
Filesize
5.2MB
MD5d1585f432e32d7b4ee2b3425cdfc2427
SHA1f6247ccdc7949f1e4386c2dbac330855ed4c2d2c
SHA256ce5232ade466ca6ff75a113ab6fd6c15852719607b209adbe68bbe0cbfff19f7
SHA512eb4347f68821abca17cf97b1f87d179b4f968e3452d303969d106e7d4e228420fd729df2dcccb7d9664b5572d810db99629d56f08fd9df630a9516ca3f2326de
-
Filesize
5.2MB
MD58112977a0e86f98d1cc74b60375acc30
SHA182a17b74dcb228099fb270c3ca187da2af03ffc0
SHA256394185c5eced9aba4f87f70f01731e42390fe72c727477b547b65324ae960370
SHA51267148910da10c05fb716ec87a8a8fab4ccedf150c96b8859f522089f34ffc230222078b35dbbb6a68d543fb637bab1cd0fb0406f972325157cf4908e154391d9
-
Filesize
5.2MB
MD5af1a64d134417c0cd0cb203648ac86c1
SHA1666cf6815d10ed7643e9e8416439a4854b58a1e0
SHA256b683690ed3d4846f33805720e01d7e3a46812239afa1d763503f796f8fd2dacc
SHA512bc2f0fed91038f1358b61b7eafbbfa0ff4acd932f98143e59cee3e5a6d56e72b7301b228407f06d621ad0dbe917ceaf65bd8870bd9a5d2d2e1c3ed745849d2d3
-
Filesize
5.2MB
MD51c6f44f3e78cf3f2121e173b9799a07e
SHA1e8e1804e821e98e8c21be07b92092e786c6f7829
SHA256c9da6d4191ee1370eebf46e0faf0d9bf52260e931ef859c380e5a84f64bcd244
SHA512251e888e68be2beb0239530b6af0e004deda0e65d8187975bafebfea4123a1243205bd2d8446006f354583df5992ab89fe0af3675e4e2115d4afe06bacfc014e
-
Filesize
5.2MB
MD5ca4d73814883c43ff59b11b186f58a7a
SHA16a4d3b1976695feb744a3a46ec78817d8ef6c957
SHA256c9f1daf98782d29122f660cbd06a5e2f0b233bb2a69c4cd0ff5783ab55507330
SHA512cf0919bb72bee5c642d4ed559907f3760ab6bd9a25152d51dd7ddc207074f7ae8f583f8255b3d2014ca7b6b0dca1733cd5adbeed8abd2059e8def8a01aea79c1
-
Filesize
5.2MB
MD5f546d2e251dd68d411ba721929b80c41
SHA1770f3d7289b827ddfa153416190dd4aaaa1f9bf7
SHA256f65f0679dad554d8bedefeac20ce3d85e463a8507a48f43c6c9fd3142fdc6f46
SHA5122a0986108302f80570fd358c47feb5255b902cc37a6d2478b86762ccf1aa4c263d396cae80565c61c00c09e8004768bd3b5ad152d8a92d71e3fa6ed303c26678
-
Filesize
5.2MB
MD59c983f69b568c2b30171495ad136652d
SHA102ce04b6b5b4f1cdf5aa95f9a66d63dc6bb2bc08
SHA256d7a224db986ee0fab55103aff94cb8eae033ba80b3b7e1afd0f799704f8fff62
SHA512852e3aa8f2865e6e70d522b9d6e4eea1d174dafdd6c343c4d709bca8048fc02b084e8bbd61d04ea3bc55e5a507a3c1747961a2bf0209bdd7c1b20ede0bafa561
-
Filesize
5.2MB
MD5b177566e3a45f49b4038d2bb89842756
SHA13f67096c6be6390ee6cf89b90f443f710cf587f7
SHA2561b5ea77f28ee3d62bf0171ba3d53a60bb2b0f7d774b6be9a9f7c2b0a9f0beaa4
SHA51259c5f66b7e90fd6322cf37c3c08441bd7cbc2cd8d698a70244ac852b48a00c6287fb502d01d767f14dd51957f54ae3bd6f39a698ad53c2e03e41f4f6544c673f
-
Filesize
5.2MB
MD59330c946f7e545413f45d46f231802dd
SHA1ee80e83bb7fd49df7b60370b3c8d9e01e83329f6
SHA25648555729f70b51849262d24035474b0fddd61356cca24aa1a537c0edc2c6f0dd
SHA51222cfd32562835ba82decc6ad2bdcef4530bfcb95df84420043b6ab6d293fe7f5e0e680a0698bb2bc7240c02067e1a3b940fa83777765001466c736aa7a3c1ac0
-
Filesize
5.2MB
MD5b821f057bb9ef6be6e2602f9f97ce53f
SHA174d2b37e44ebdba23ecf43b070327ac2e161068c
SHA256af9480d1d48d60bfcedaf472d5b760822fb6c31562754083f4d1588d2c72a6fb
SHA51248fc45fc2f102fd414caf426cb4c310ce8c5ea757032de294805b7b46c5de12c67dcd713e3a8260320575ab496ff0a31890081d37803957c2b3c6ce8fdcd0bc4
-
Filesize
5.2MB
MD504885b954d75d81a30f946204ebf3a8c
SHA16c7dc547b8e87c0ea9eef61a21a96ee58a767e81
SHA256210ceddf208c56479649f7ae05f01b897f3617e525fe4ac1a7a96bee2c375243
SHA512442e9090397c2188c26a3c0b9f9d44c0b22f851d15829c418688b1d73f98ce1eb3b5432efd701a0ba3856e6791da6fc92a586a231bd7d9a86352b55933f87af3
-
Filesize
5.2MB
MD5a2014d636faa32ffc27b48e745c6293e
SHA18ee9c29c4189ff3646f01fba647e6b9475786a22
SHA25628a2294c4cbd4fec66a11d48f82f8a6b80c5895c2a7bae200a876ff013de95bf
SHA51297a927b36cf869faff43b7e2199e7cf0c54e94d276b7468ca3e7b43643713c4dabc209e1bd9e8cb5776a6303af088fb129d72f7f4117239df858e222b4f4fdca
-
Filesize
5.2MB
MD5ecc1b7968a4192b6258b45f5292feab1
SHA1c1f3aa422be5ce97c552dbcaa8397dde7af2fc2b
SHA2563810d2b98480d2cac4f6cc3ebe83f5d151a2bc0ea6cd097626c600506904ed54
SHA51243a4d1244bf674eb08216dc98b7e829b877a84d021fbfc6abccbb450dfd1c8c88137d9001c8a948a54872e781866a417690c9f59dbefc280187b2588bc724d89
-
Filesize
5.2MB
MD56a0e970b3f34aeea41dcebcf7911b773
SHA11971bb61bde6d44da59c9d654e80a2262f419d58
SHA256926bfbc5f1518a5ed051ef511e62ba68f9bc60b97383393b2d54c457332209d2
SHA512dfe3dea15681316efb11125befef6ea3e3b66dd440a45c717e800e7158caa64ee0811f1a9a3877d595930b7603342496bb10836f12cf31240fa35329aa13b654
-
Filesize
5.2MB
MD56a9685bd33cdf7a0479158fa4eb75104
SHA1b00d7702ec3b9c2f7716bcc4042c119184fa17e3
SHA256326adaba9e71748412eae7ad711dc9159ae85eef3cf93d4639d68c4d28e4e8c2
SHA5129dafafdadff9631566c5214b07e6e25ae236b11f4d0718905903885c62b5fc2871fca8c644f14d3a09466f83d8760caba8cc415aebaa750feffcd3812cf4ff1e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB