Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 00:51
General
-
Target
2024-09-23_92a362dc0458e8e1ba9e77588de76a4e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
92a362dc0458e8e1ba9e77588de76a4e
-
SHA1
e821c8af2e4ac35e32318085caac60007c3d16ae
-
SHA256
8dd968fdbdee8c41704696f7a4b2ae3c98d7789f9b1ea05c5d91b9a28ef416f0
-
SHA512
c45ce9a924e2cea8b1de0512590cf0bd62d04f7175c7ead01d43346031142fe5d45c13cb270b8ad958f5989d84308792bd59158397c7e1f4a39eaddc670a473b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_92a362dc0458e8e1ba9e77588de76a4e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_92a362dc0458e8e1ba9e77588de76a4e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oKpJYLp.exeC:\Windows\System\oKpJYLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CLecULB.exeC:\Windows\System\CLecULB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypIKieh.exeC:\Windows\System\ypIKieh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qjhPWVP.exeC:\Windows\System\qjhPWVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMmpQCJ.exeC:\Windows\System\ZMmpQCJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIypkbs.exeC:\Windows\System\YIypkbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vbvnyHO.exeC:\Windows\System\vbvnyHO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmaZjdQ.exeC:\Windows\System\RmaZjdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ufeOXDx.exeC:\Windows\System\ufeOXDx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wrdYPBY.exeC:\Windows\System\wrdYPBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGEJlCb.exeC:\Windows\System\fGEJlCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GTpbrun.exeC:\Windows\System\GTpbrun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qofdozw.exeC:\Windows\System\qofdozw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yoznZZU.exeC:\Windows\System\yoznZZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLyqExD.exeC:\Windows\System\RLyqExD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvXZBHI.exeC:\Windows\System\JvXZBHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfVndYq.exeC:\Windows\System\dfVndYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mEdhqgS.exeC:\Windows\System\mEdhqgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oWyhcaw.exeC:\Windows\System\oWyhcaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkCAvXz.exeC:\Windows\System\JkCAvXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MSthwbu.exeC:\Windows\System\MSthwbu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD540b6857eb57be6a230daef828965edd2
SHA14d306a955ce2438a3271d43d9deba2222db5dab8
SHA25676c813a13c42fed33568931f8a1744428f6760bd9b1eca67f1f4773260b31eef
SHA512378800816a5061b22f9c03fc17abf8e6687aff00ef76441d544734ffec2844808af22a4fccd93d512e070990cc18192694d98df7ef49e6c1c05f782dd77f6f2a
-
Filesize
5.2MB
MD5edf985417922ed933209dbcf5e2519ab
SHA19ad40e829417c8d8b1bd1f83146a9383d7c06ef6
SHA256a838f719f2316227ae0e5e2ffb9e7f3657404d57e790fac09efd8ffed5f28bce
SHA51295f4b99745dcad08e52c04509d0bf02494593b554946e534a958e098ab2048c9dff0bffb5f9b4ed5b1ed15040eaa4227c7e8fcbc3cab216cf2b3dd38dc71466b
-
Filesize
5.2MB
MD528388354730e11420ff10858d058c5c4
SHA15fbe469622931bc6a28bfc8ae0fb6f440d63fc14
SHA256cc57f06de800cf613856e6633940029ee1f86102417720c5556730658d3f5925
SHA512bce3670367fc55782e8584006b31c111b34aa026356494e3812b6d4f490040cd3b83504e97a15c6f2384898386a1af71faecff5e9fdf7811ff9f62df91807295
-
Filesize
5.2MB
MD5f353eb665a67c625d6fd17f3895e3203
SHA1a494d46a3adfd007f87c49121fb605d9e4580da6
SHA2561fa922710509e46695712e3edc2437e4f5b83e33696fce436c19a992020c2f15
SHA512efb10171a2c61607d350e2a5223e09c7eb8632435efee7bf106edbc80289f6e8330ed5f7f0049efd5e3b11dbf6d1b79623277bad53539160414712478c7c2146
-
Filesize
5.2MB
MD57c724f25aecd666549008b453a2be2d1
SHA18f6caead2e45412761f4d6d24691be0e70f5a71e
SHA2568e26c269b6d222e9a4ce34a326c9d5d130608b5e9296c16439838653d484bb90
SHA5123e1244851815a05d733124d3109857543d99127201b7b3d4703f9ae3305e2fe497a8acd0066ac68d8225882b058b670f28d991d268844d0a855d16446c7cb279
-
Filesize
5.2MB
MD5d56989d8d55d7dbcc097ad6b679a6431
SHA131728a5d6852530832ca442838476be866b6aad0
SHA2562d08d14f221ee0b4f386c71f6f71f9564b8cd69158c1903df93a4d304a28c042
SHA5125cd794a205603fc5ccaeeca928bba25454a84588c01af4de1912ff0b456156c25d7d30206eda85c50b16664b66a401447adbefb4952527c280c0654da8dab1c2
-
Filesize
5.2MB
MD546aca18cb2a62f541284a6ac29527009
SHA15e72b654aa16cb3803998d7c5da149064a41e79c
SHA2566d8f64180f48a6fd4a38ec87198c39cc47d5fb7d0eef62ab19ca625e4c4bf4a0
SHA51275846908f804d3bd1e10abc86304b7dd43c626840e6e0f3ca4768a5b561e7f2c84c221a9a51a5544e369f19799bd629183b7620b4eeace866066e1c94dd3c181
-
Filesize
5.2MB
MD5098c6824ca41d5d0b3c77d91589970f6
SHA1d00071f226d63103315034b8ceac79021d86ecaf
SHA2568e4dff1bbff1154697ce2a9817dbec24db88210d117af6899b1902b1531c34bc
SHA512899d461411b14589b5a6fa17dcd2ed1dae1a88ed95222ac9c77ed1ec4666d6e7ef31b8876b5198746c8630a48f0c51bf3320112f07d85effcfdc248af4f69c96
-
Filesize
5.2MB
MD5a81d8e6eef701c6daa22f12559982c92
SHA1c129063c1d74cb83ced69cfbe1ef8b2eecabbde4
SHA2567d286ab0d5df7295addb2b4fdef2abe0328b5a142565e33e74e21680f075dce9
SHA512b92fe820c8bd93497cd555e67120c13a9733051040dc0a522c46ed1c2ae8f9c54d5f903b77dea0127749d2987ddc1360e6d93abc57fa18e95a217a2bef3d7919
-
Filesize
5.2MB
MD52210c20439343364c525abd9a57d467b
SHA146434d00ee4e123a65c472f023416c8b7413e0e7
SHA2569575f86ae217740eadb4c8fa0371b7fd4babc4d259d0d317218dacceffb4c916
SHA5128a41f2221228c4b56029b9fa7235e2faf2f36bda99cfcd91fb46c25ea15495deee6200e2b2cf8f293ad9222844965016092d8935cdce4940c405ffa76c308ab8
-
Filesize
5.2MB
MD5f3c70a6a2d3e371079f309452260d159
SHA145c898c4daa0202830f6241426dff8d4e7d7e33c
SHA2566a9aa7c6b0e1fa0a667956440edfae43d837308626d21132bd2baa577f63f6d1
SHA5126baad137468df65878d8c9b519962f71f245968c1d43f2d563b4ac2d1c47c44fca7a8035fe1fa0603779652027a02c832d5ff311949fae47860f074d9c354073
-
Filesize
5.2MB
MD56a07d6882f567dfd6dbd4d770f36a151
SHA116675e5c4265deeef548a19625cc2de1a77d5e3b
SHA2563bb68f01dbee646c75f31b99aeabad639fbf5bc9ddef3d4a87d9a80b4b708e3d
SHA51255768a4c7b95593d415542ecfd0324c6d3b03af1442f43141232ecc39b2b957b3548fef54681f758312cc948cc9a74de58d79157dc07e726746eb2fd28e762d6
-
Filesize
5.2MB
MD529138e94e6704d1d9bcb31018f44095f
SHA1f8c76c4f953df19c2423bb0577c7acaf12044ffe
SHA256f9a9066bbeb894492d4f11db33dc1d06da8edd36c371a90a24636e5d5e647e99
SHA5124ebe5f4e33ee2545e902a81d38991f6b357b9b312ba33ab728673a9dc1d23e8fcd7767aa7c6c3d92c4e2f3789f11e748008af2e6397f9589042bd5b58f4bec75
-
Filesize
5.2MB
MD5d962282ea083f5a7eb11b4c082c84b82
SHA129233f392aa28941f892379915431092560604a3
SHA2566af8be11d1ab501abb207d6d1984b54ca12336d5ebc8e616895d90486efc10b7
SHA5127b93bd073054fe7266a87d927b98d59105154804e73af99a9889e9b1c8fa6a560f09840cb1891d52a03e9d6e2da0f13d0cb1324865261310cd3c61d09f39893e
-
Filesize
5.2MB
MD5b15bc23287c7784429ebc4715bc41440
SHA1a22e72d4db88bdd1c6452e6a34e6af835f5f6454
SHA256ed6b57998e3d96e533b99a2d831e6afef0817b30e3a77d1222bbf31728519c88
SHA512c231fa27f791db6e0dff0edd29cd7bccff69218d7d3ebc2daadc8b55a3c00fd757298a6f8925abe881eaddb800eef85bdeab4e1b45c17dbc9a7d3f9a4c6bf680
-
Filesize
5.2MB
MD5cad2e707983b496f3d9b027cbe7b2a03
SHA1851b05a797f4cce9e5918541a99587514617bf48
SHA256fac3891cca721078504b7520d6fdb68c586c28cdf2accde2654a47ae728fa9f2
SHA5128cdec5f6eedb7a5cd9eaf8a192edc83b504804f08af5558fe6c68983913c30ab56e5999267163a8a269c3c25e1b15685635d2283b43364fd5b10bfc612b00140
-
Filesize
5.2MB
MD569b95aa020b958e4acdda8f5216fbb60
SHA1989b80c4e5c362a504e8a298c3ccd5a7ef7c6a1a
SHA256679968338a8af9eb791c1750fe8607d674bbe886ec8dae88f776a12a4f6723e0
SHA512d88821aa23153e4ec52fc018b97e9ca8aac44ba51303927ae76e26d5b6a04010dd43cfb2c4580c8eef598f5563f69e07126b5dcdb6269436380b5c01b296a9ad
-
Filesize
5.2MB
MD568af9038093729c88841232e76df9c97
SHA1b238f45b056ddc83b7e03bb9a72b95a0a665b348
SHA256ad3c2b08fd8d72548fccbfb84be35976bdc75821b9df5ed2394f072122d14409
SHA51269772739cbb641a5dbf060be531ddea344e20627d584c552b4b3b327f90ad6041c7bc9860042f7a359dd279b28e912c5fc5a9a8bb5b72e2c565e5b3227f22f2c
-
Filesize
5.2MB
MD51ec33eba555f7f22d1aab52253125e2e
SHA1321d94692bc414ec835b89af15b71793fbf3e428
SHA256b6995ac0242275434c7db20ec4516c607783d7775ea17ba4eb42a514f563fa2c
SHA51224bf0bc0e0c3ec9d290d2bc3eec6dfe97f64c78531b69c1d4bae9c5bcc87ae2684976898e75b65049cc66eb18beec32c20c5ef88956601ade9a139b15265b289
-
Filesize
5.2MB
MD5ee24ad703aac20ae4bf9ff9fff3a8e9f
SHA1d8e88f0f65a9f76a9efcfcfc8442fc60bd303252
SHA2560aee759b4bd29bd4483cebecc2d5b695e5efff749928ee9c408936c50a525b8d
SHA512e0487afc96a948c97d57bb954ac8b31a005cfca31c88935ee4ab815784018ba4fdcfa4ea72f7b33c8bb2605de82d4322b8025508f03a9a7774f2a7292b9a0173
-
Filesize
5.2MB
MD52fb76cf22bcce9fcbc2d430b1e84e429
SHA11f48f66ce1a61360df91f6bcc1f21cd38e8d1a3d
SHA2567bc719966ac8e05212500dc57ab1d770e3562c84f95790611be3e278126d36d1
SHA5123be288ec238e18648321e5810e08241c4b70440ff5f8b8feb6a31261b890f93790af21f23981a919fd1c5168ccd83c24f9cb1d1e77e38446249cb7f9f6491543
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB