Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 00:52
General
-
Target
2024-09-23_9c583759e4ec4728e1d8e7d6b8b8fa74_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9c583759e4ec4728e1d8e7d6b8b8fa74
-
SHA1
8adcd5ac075736bcac31edbd6df0e0fc92c4a17c
-
SHA256
816ade539cc0351766c79e45c66f4d2b46ac420ebcd6fe738f94bfcfe4e0737b
-
SHA512
45cd065ecb0c656845a25edc4d756db40957598a7ce8feee80c5c33489b00ea8abf505e85137d9532b22cfa1ecc88711d1a306ddd1e8434c701c09c8f52c3c29
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_9c583759e4ec4728e1d8e7d6b8b8fa74_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_9c583759e4ec4728e1d8e7d6b8b8fa74_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pvENEps.exeC:\Windows\System\pvENEps.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXlscBO.exeC:\Windows\System\MXlscBO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aRgWTzg.exeC:\Windows\System\aRgWTzg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZqLxLA.exeC:\Windows\System\qZqLxLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwTpvdU.exeC:\Windows\System\xwTpvdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\svhARhU.exeC:\Windows\System\svhARhU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzsHJSz.exeC:\Windows\System\rzsHJSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZGnojU.exeC:\Windows\System\IZGnojU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIpGrkC.exeC:\Windows\System\nIpGrkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iAnUfaE.exeC:\Windows\System\iAnUfaE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ktsYSeS.exeC:\Windows\System\ktsYSeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPNTkoz.exeC:\Windows\System\DPNTkoz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpIOrCn.exeC:\Windows\System\zpIOrCn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UQteWpU.exeC:\Windows\System\UQteWpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rmUYBdZ.exeC:\Windows\System\rmUYBdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jYRPNNF.exeC:\Windows\System\jYRPNNF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LXHIoUE.exeC:\Windows\System\LXHIoUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIUAyik.exeC:\Windows\System\NIUAyik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DeDJLDx.exeC:\Windows\System\DeDJLDx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzLhwyW.exeC:\Windows\System\GzLhwyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\POlizgc.exeC:\Windows\System\POlizgc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ac4a6d47e58be919806ecdbd53477d65
SHA10b9a37c3bfc8de351880665741afad780b795638
SHA256a6be3c5dbaa6a35a518197ff9b5d6b1ba6a94270af55861daa88dcfd94cb9fb5
SHA512a5bed28d7914258e2f43e2a79de53e9c12148ccd862cfe897053e6021c019f43816a7e3684369bf92d5a75d2d6792c2105d432fef3ca7d27064d2634d908cac9
-
Filesize
5.2MB
MD5576326e8b8601a1142d0fc45e78d8e32
SHA1ee2e87a06701e510ebfa7aeafd4ffe2c10125db5
SHA2565708fa28b128b53329d6ccfdd8230c2fa8753c00284d0c942989e22f1dd38fa1
SHA51293875b0897bad21c646e5a49e36ecebbd73ac3a713b9810767a7af13faddaa797d6dfcc01b2a8dea65049d490e66fe47418c84b6726ed2f1154444bab524e959
-
Filesize
5.2MB
MD52dc53e1450f32427f79a486fcb3e1ba9
SHA1c12a0b8be077a7c40d2412b3f1d4b7fd5e48fbb0
SHA25691ffc3630d7660c49a0f4a4461f804682e9d10122fef82856f3c3db957eed54e
SHA512497498f27a909989a3e631027b04cddddd16b9281026803409c50f249ca7491e06f6cdf02423d837b1a69069b2c7a42121a0e59cd6a575f7398977eef8535ed0
-
Filesize
5.2MB
MD5cf4666449ccbf93716f54ace1483bce1
SHA1789c6e299fb3548e1077c2673ea7d71c554f8741
SHA2563ea4204b045337347f29d3e2e92f28e8c75ea0d2d1bf6c4bd4110c290e68e636
SHA5124aa42d821776f762d13c8eb15e6dd565e882bf038dcbf639cdf3cc4ee69d4af40360c37bcc1de2a9c831dfdc99d641088339bfe420cc2b200464a263d5fa147a
-
Filesize
5.2MB
MD563538a6a907d41e7f84d847b7d64706b
SHA146ff3aa19ee09abe4668f9c6fad1bb33cc0479c8
SHA2567310963bc4ae1fa9bd7926be53b21db7fcbf13096b16f372d592875f35ec0c40
SHA5120c1b1470d49bf0696b754d47653ec072ca34507c406245ee12c9bb295006acfe7cc0660ee5688989f9b33bc80bf0476eb4a3c06e150706527793b3be6dd90e2b
-
Filesize
5.2MB
MD5f16a0063e66e124451912efc3928c0ef
SHA1b9cbeaded0b93b125502529874407c8afdb3c6c6
SHA25686dabcfc132795ee161322f8d94ca1e8969de98729cf4d6eaaee268ce7eebc55
SHA5121e870502861b892d511a9878789ee10ee27fd8fc6ea680f4dc31f857ddb67497d7835558f7362f4e067bdcdc9327701e76668cfbad9abd33fd711862ea3a83e1
-
Filesize
5.2MB
MD598e357f234c1c1c17be8e81bab451850
SHA12ebba30b049b956a93f31d52901b5602b4dcd1df
SHA256d1232c60ce6722913fffed953ee86ba30ba200929f3d9c64a73c7f69b9d5d23a
SHA51299540e7386391269ce1da87ca8424d36b38515c0e25075ee934a47b94a41d56faad37070f215aec8b52436961c7adf276a9c70cb518cfd3fb658ca899b4b57b5
-
Filesize
5.2MB
MD530f031a7ceffe6c78c53b94b389a7c69
SHA18c45194302c2506ac14577db2db0d11c059e5d1f
SHA256849004fd5fb196a8b801dcc27d18b4ba0af2aee70c8156b77e1415c9711836a8
SHA51272c1fc618a694b81c4cc883b11567a16f5a4127f40db25730a03befc51ce87fad399c7481e188b5512b8f2784d4ca04f9d0e15aef2ebad70a297b86cf5f6104f
-
Filesize
5.2MB
MD516f1f68e686c2bb16d1c74ee9be50b72
SHA1ee945a460bacfeb6fc505ebd7d80459beb3885e9
SHA2568371d6c117c69b2c74c00e765486cd682466cde1c071a4d44e67ef8bdb725501
SHA5124affba695177de54629e4faeb8cc13cb5f7015c0253ea2c79a9a1462a925ce916552aa0773445de3df3969b438715ac6025c05e8eb75bf9af007704ab4dceebc
-
Filesize
5.2MB
MD58a80951cf479fe78aaa3f71fce7c9171
SHA15481b0ea013d87da1fa48107ab4f56f286bea9ea
SHA25622527289dfb545bf326113c4efd1eaebb0a2a334778f17dcb53abdad91cc8fb0
SHA512d4bee146199777196d3d3ac56b8e12b87b196f35accb0099c91d2b008f18ca58460e19854d45a4d350f8129116eb0a6a4dfd4f3836d3f98acc7a066586023460
-
Filesize
5.2MB
MD5cab63615b638ec7abeaf1e2470a5cdb0
SHA19ddefbaa8ce0a6ea961e1f238ea4fee03aafe065
SHA25652fea2366f80f27290772821313599d219de06a7a38290ba79dc1e1a19bc30e2
SHA51297ab1da181d199eb77ffdebea6310ce73fb26cad875ad6d7249baa4bb61550af54a9b8cd1790aebef667be30b65a078e7b0ccecca2561f787c92ab4cb0c252c7
-
Filesize
5.2MB
MD53502d7d107a759086a6e6245864c422e
SHA169e975ad509564a19a15b8061513901618949ca1
SHA2566fa6941b4e3bf08e6592756e433e2438a6ec4d0d33bda3c8499978d76358fff1
SHA5120a84e69d3906ec36c00aa8f3e567fb40d3533037b12f0bcd11b727296dbd12c7c4207e11e393ac36369079009c4f4fdf705820da27e5239b0d55ab46369c4ec0
-
Filesize
5.2MB
MD531c8e083b60a2134360a0b0f1a18d0c3
SHA1a516b6cd5a785a914fbfbd44346fa734db6cadba
SHA2566b0e2fbcebc334ff6052f0c6abe4bb0c1b53619246cd3c916a6ff30351335ca7
SHA5128f0fa686e1e2e18618fdb6bbd5004cb599b1551236a6d62d3abe4009d3e6dfc5bf91c6764c8388fbb91f7e69c3537806f157e5f1691a49457b2819ccaaa87ba1
-
Filesize
5.2MB
MD56ce98a8517f9bd63683c5a4624403bf5
SHA12be37607c7956f694a93dea47761d5e6da02c113
SHA2568f1331c6c3f6c9f0cf6f617b416d0f8c29110dc137c4519af6182377a59f119a
SHA51228d0df8ef8f25ea0c152e5c8d0ae3e204c7c04a81c4555c91f88029290e3363823b687a5c94d804bec26ec2c6e10e44813576eda3d55961e33cd0a2946d57e00
-
Filesize
5.2MB
MD5ec7cf9a1bcc6512f53a5c127ab8ac03a
SHA10b8324a4fab2709060f32bf9f284ddafd283bff6
SHA256aa2cae03eba3e1678a44a2228d7519015bc9483fcac058ba038ba3437740de5e
SHA51261c4cc93f106d573a9cc9144e208233e164573a67acc4a9ebf4efd25990073d915a7bc7fc76ee6b089453307c9917c2ef62216c2173a1c87cde7115eb5182716
-
Filesize
5.2MB
MD5d8bf376957c871ec63f9fe06b539a982
SHA1baefaad88eea40bf6968e7be5370625f0990f8a6
SHA256f27c3061779ac396a5a4f1b8112b6b5bd43b8d573f3032752426ebe55780536b
SHA5122b7f53e9d0e00a9610de909c418670b9cd6452ef9287c95456ac16fbd76b7407b240f20b2ea301e68fbe3da97c469b49008618847789a8ba5b6052ea6c52e4c2
-
Filesize
5.2MB
MD545d619c94e93f5b451bbd7be545d7a98
SHA13e7d4b461c5c7abd1a08bb2d02c62647e953e167
SHA256ae9867312d82bc3d05923e605893f1fc989f7122e61d75305c3beb512eb10c10
SHA512983e1a788f6edae5bf46cd6581c5bf0b41f6bc6b446aec727eb490d2a4975c4d237fad5a0fc3db6e50a9037a47b282b976b673f3aed63ab0708f9289e703ff4d
-
Filesize
5.2MB
MD5b6efa1bebb0b55f4893b27c243bc8435
SHA1035c7064168ae65fbe9cfc763a1859e151bb3770
SHA25631754d5dc1844da2ae1525c54d57789684d62231606a2929d7ce615cfbf54793
SHA512f25f119870cd524d60679647317e26ce27a41da6ff24003a83598b51d0fc8c635024a5beaf0e04f92865d254d6211c301ffa4ccfd1ac43912629129a044d2c14
-
Filesize
5.2MB
MD57b25a1461a906a404145dafdf8289922
SHA1304ebe69e2d1b8496bbb2d97c662e7798237739c
SHA25688bef6c9eb3fcf8e792a4f719746d2981260169c58be001a4eaa1ea2ca90fd39
SHA5128da53ea17517414e1a9e00fe2a7ca4050712f18f0599b84f691940dedeed89fb3abfc08650cc9d72699ab227f83a90859d2e39061e3dc0242505c11116917acd
-
Filesize
5.2MB
MD57cb03d31f5408cbf365162ac252927d6
SHA193611af1a6485d628429fd3bbdf76cf6fe2858a5
SHA256dac95ff507dfb72618f43a935ba88ea18faa9051aa7bde4fb206b2d0256b1ae5
SHA512dfa6c168d57e5bd53f90403b731fdf62ece0715ba85df5a11afcf4366c3af0a4222c6a518504715a3215604adb8a94ce5d858dc70ca0d2f884c611328465bab5
-
Filesize
5.2MB
MD5571c8fe5038d44537109f9b8204c2316
SHA1f679d17fd88defc17a3dfdcec1811a58fcc25f83
SHA256ded10e6d73acfa83ed8a6b4bf0fc6236e608dce106c47e0d390ba391060dbf7f
SHA5127e323ce1ca085b905b99f594c9c972bafed00b628d2e7170dfa01cd0f4f19cae45a156f0d2ea73bb1e43419d191c1df1cf9418be38c5c3c09dbfc91dece4c5f6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB