Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 01:05
General
-
Target
2024-09-23_f2864d90308c11beb5c7dc00ffa0f993_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f2864d90308c11beb5c7dc00ffa0f993
-
SHA1
6863bd4dfb82853a49f0b3cdef79fbc1ee0b41b9
-
SHA256
8875b30cffeb064243afb9f0e35239bc10b80d274af3edcf6ade4c2375256f6a
-
SHA512
1afb16e59418a8d6e092a7801fd699196b81ef6983be23a97d88441a820d05b89df94e9dd1ca69013586b403d6be81b6a6f976216cd9dfdd2fe63061bb46e1a1
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_f2864d90308c11beb5c7dc00ffa0f993_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_f2864d90308c11beb5c7dc00ffa0f993_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oSrcDSs.exeC:\Windows\System\oSrcDSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAbPYxW.exeC:\Windows\System\mAbPYxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jbUEkeD.exeC:\Windows\System\jbUEkeD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWTyeNA.exeC:\Windows\System\eWTyeNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UCFEKvZ.exeC:\Windows\System\UCFEKvZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZKftYy.exeC:\Windows\System\fZKftYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IoFyZmq.exeC:\Windows\System\IoFyZmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iYioJpG.exeC:\Windows\System\iYioJpG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMyTcRD.exeC:\Windows\System\dMyTcRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iTYRvoq.exeC:\Windows\System\iTYRvoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nweLdza.exeC:\Windows\System\nweLdza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPcYaJe.exeC:\Windows\System\rPcYaJe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aezWTrN.exeC:\Windows\System\aezWTrN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKKSNjz.exeC:\Windows\System\MKKSNjz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWvljQh.exeC:\Windows\System\fWvljQh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dURspDY.exeC:\Windows\System\dURspDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fNdUajg.exeC:\Windows\System\fNdUajg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swxkPOq.exeC:\Windows\System\swxkPOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsjYZfm.exeC:\Windows\System\ZsjYZfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\btKHDup.exeC:\Windows\System\btKHDup.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkzbOtO.exeC:\Windows\System\RkzbOtO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD572af185ae6ff7751315044a3a16b2cc4
SHA15d6ad91936f9b3eb014b79be916a24857c4bd4b5
SHA256d5632e3a120aec615c30bba6d60256ee84f3d5e28765bfd57c95263c51781fd2
SHA5122bdd75d24abd635b38ad898efe6ad4a3f92d76a368776aa83c368208afa26fc48df6498110e5d8c87648b9b502ccf71f208a1daccc0a58813d438e739cd7f16b
-
Filesize
5.2MB
MD5943de1c4cee8749dbb90e9498e5dde67
SHA1b7ee30ef4af232aa9cc7f52470cbd91a249094f8
SHA25616cbcd3c27b921bef5ffe0aad0a0fd173d1764e4a673bbd50ad4f689b834afdc
SHA51259887ee10a307ed774b1c2324d032e8a560a443879ab58d6224c0c96e6020c36aa1d7e36c1d8d57afdf9df4996bd93f297edd1b63a0e28bc9f46a5dae915b29c
-
Filesize
5.2MB
MD52ab6b141995132eb529aac2692b1ce71
SHA1bd1c1f028d5275c4260961cdf4e020db8f2420c3
SHA256c9b4ec7b070eca7f9ab073e484bd403ada89db800b69b484e9a7adc947fd32dd
SHA5120160049db05daeec3504986125b40dd85bf44c251134d2d45edabe62767fee15d7a542183daa02c194e4c414095b358031163fb9af928154ad4694ce38c4c4e5
-
Filesize
5.2MB
MD563b00745c31e0940996e539c3862c2f5
SHA172856276962e86d44f7b6efec722844271c2cedf
SHA256c275e41dbcac8d91671db8d5ade41eef4a63e2e843ac40606426d966e8801c57
SHA512fd0ae5a538f7c7adb8c4854982d1236229be778e818780d3e5adc961844f714732e36a6a95b93439a7ceb4ad0b38b4a94f19a194c8b8a978d18830ae8f2ab6c3
-
Filesize
5.2MB
MD532bf2418c19f64b362cb1fe58e2facc3
SHA1a42f47c6263f824a75026d1ead3c75b9987f411d
SHA25607354fbfba16b60add2b0a753afb2e22c70caccf534c75b311297c426b007aae
SHA5120f604dc5609952e97465e231f63a278e3765818410836997892ed7fd56e00b04104c09def4181ab5d8f2cd4e8834f25892a1145c2101e63dc961f78ef5e4654d
-
Filesize
5.2MB
MD5f992842a84c83657c2e555392e33415e
SHA117eaa763f524a0a4a4fc885f5d815eecf6d5dc53
SHA2562a57ddb087db498c16b14386292789ff86c8efb5737f329289f97af340641f75
SHA5129464a60aed656c203205607e2870b2298513ee242769e15db44f64a08434af72997775c9c34fbc92a7d9451b2abe1fc6d812064b19883a3b2811b81fddd19f2a
-
Filesize
5.2MB
MD5a2430f453a6fa31379a6ffd61dfa4475
SHA1003932b5ba2eb6d65def5025b8d74cf96b8cbd61
SHA25697db79dc541f2249d1278ddebbb03d52c995d224241dfe1e360589bdfa38f07b
SHA512dcdf9f9a47cc7fc92a9aab8a7a1859934d6c730888a3b433781d37a526dce9b54be67fc8dcc8ded029b81275ecd9d0b49dbe07e2608df8a7f67b48df4c82ae5a
-
Filesize
5.2MB
MD5ba8e8d53b2fc61b36f9955bb6b5d690c
SHA12fce93e9389e2d9e1648a1f8d457e65825f5f554
SHA256b330e42ebdc1641a7a1247e962949439565f8a414fe2e72ddaf26d7ecd0233fb
SHA5126828b1cb9b5e01296a36436ba4d52319a3f01dc8bcaf6d5b1d9a0f1a9edf6bc8afa24c2ee06d70450c4430b4213e7ab3d1f7c53870e59724cedfdb9a878117db
-
Filesize
5.2MB
MD523b7e9863d0a6cc607819bbceb69219f
SHA125857e56f20cf2d060f6e51a0aa275f7e9ee6548
SHA2563d35e1b9ab14591791786a3c71fa12c6ffb5557f685eb0a8928cede548f924fe
SHA512cb1f3f1f360dd5f24c7a7395a7e254ce27a64264e73be30e99fca38802223fc301ee4e564a2c50ff02d63040cba7eaac3fc436e4873c0ff91082957d8cc6a729
-
Filesize
5.2MB
MD58dab8c9a42c9bee445fbf21ff53263ee
SHA175e83f40c759eba8a2213ae6744617fae33cd256
SHA25637d833974efd67179b81406c97ae7df96326079681f0e5f253756d3dac3e5eff
SHA5120fc433e0740262330e9abc7cd11007ca34b07f8cdee5ea0abac86d49cb965ec0ab449a031fddf6d3b54f9f26a6e49264e3f841f66acf87a6fb5f75acb62be818
-
Filesize
5.2MB
MD526a73b49f7b821794f0f71b1ff8ad9dd
SHA1b7a0ed3166c5a8becf232bb2263e58e2a6c2c9f0
SHA256abebf0056597f5bbade7fd227c88a4fe248d9e2deca8ded19619fb87abcffecc
SHA5124e4dc47fb714fcd5dfda5e1aedbf7a0e4440532958764a57672866970b77cd95beff14440193ade2e0999a6335993971b971b2ee175f94feb6ac65551d7a5e53
-
Filesize
5.2MB
MD5b3b4d363eb2fb7a3bdfc3013cd10cd7f
SHA16971a35b84981c92109c6312e39dadae2796e5fa
SHA256dbf2539170dfada457ca1d5b777bb45ddb8d46485110dcfcced1342d5b21e374
SHA5126be62818afbbd3e51a9b91369d28cb0395aeecc18acc55514496d8421fcf0e2f9f6fd83175311d4dc8d85d064b396a747115792962954bcc8e8189ac2b2660bb
-
Filesize
5.2MB
MD50337063894bc0779b6d1fce84b80dde6
SHA1e16cfd222f8a90d2258bd653374b2a5e882d5181
SHA25606e718f3a7ed35e975223b9d2df5d3c98012e503695dedf70261c9e2efc159db
SHA5129642fed81d9d75a1d2fda98e1f919ee12669f8008afd9654388272103a15c89f3dacc9b82cf8f2c3d3c990a3ff84ab1d22b32ea9102ba3a15da0426ef73f3f1e
-
Filesize
5.2MB
MD5079684fd07014e30ac4f068ccfd3d6d9
SHA102757f5abd4f4722ea3a52969af342e8e5491d55
SHA2560f1275df05484c5cadfcce8becdf87df92beb22c541f1ece19dc880399751b1d
SHA512fb5a5b2990073b1a795c198eb9f57ccc09a1e3f458140515084b0ebda130d5ad911194a0aaffbcf3f30c6e338e4bb1672d2d756fe07978594c9b0ac32a3e853a
-
Filesize
5.2MB
MD5feffbfd57fc3e264e7d3727fd49256b5
SHA1f5465daad065e1c274d5b02aa32ce26d801d9e0d
SHA256deae024c14aa0a94febfe0e414787ff97ab0291f01b6eb37e67610e25528985b
SHA51214cac3f6bf94419aa0ee77e0f3e5469b17d7ae36a178e08632d15b153dd468b64b1898586440cff92f5ac554f4c673fc79506ba7a11ac2fce4f340ea12fa171e
-
Filesize
5.2MB
MD552091ef04be32a84b303ca3c29aeaed4
SHA10cbcc2b9c8d4addfb71efdd8cae73a7ef250e87f
SHA25639c2817d0088df9a79d97f2655816e888563423b6a3d2ce252f828ec23e510ae
SHA512fb25e59ed18645dabec3dbd90352f9aa94eef8e613b9c10e8d6dd6997e38f5048e3dc37659bb6803aa8f340b0cef439816cfe10b87085ac4f728e8c7907412b5
-
Filesize
5.2MB
MD57cd8cda6b3cb207ee6c2d93dfa928817
SHA1a6dfb40e2c3122806e00af83912d64f207b8803a
SHA256ce09935f3ca2b835f97a5fed0823ee2d8b5e9fb913fd8e82531a5266d7cf3ea7
SHA51224d64c6e14979159ef7b276510be23bc6904ef7de59d00454f8dd448de8694c18d0cd86f9fdb16926d48173019d46c858f750c40d6ab34ae9ce060890e5ccce3
-
Filesize
5.2MB
MD54283c91876285ac1819be5b8fb6732d9
SHA1e9ded005c0c326094e482197c78281cee0232178
SHA25627de7d6b4dfa34730076bb3fb413f360fbd6d3139b7c71e004c6fa3c4ddabf60
SHA5126ffbb7c481cd71ca1f0c5a0fe16af6938b71690146d6e95a3da8de946799d5c4b5ac36e62b213278e23734ca1d8ccef4dde745018a143789cb22544f6c972ab1
-
Filesize
5.2MB
MD539bb776c747a2bc6609d33eec76569d3
SHA1ea820a70f6f3dc5ecad270c9aa6231ad3738fbcb
SHA2568b8581def7e3ea81fcddccca55ab28975ccab391c237002b62b67a2c3970969f
SHA5120ad97db5ca09b7d43c00fd9e3aefe6d59bec8f8fb8ae7a3b487934a225dc481632b9ce4752f1e21c306d789843be1eab1bf8891381987008b10ccf3751ff4f44
-
Filesize
5.2MB
MD5471030f95e8240351ddf60f2adb60953
SHA15adae7a06b3b37ae40bd0e4aae00787fc473aa3c
SHA25698d5925cb4ba996bccbb8ec6383e5aadb5fb43e98b4c325ac968f51f747ecd95
SHA5124570d9faf9f72fdcdac6acdaae2c1f914b623a09d1e647fab61043ddd55e6b5ffb394e3f7844998fe96b0d76d8d6ad0ac790d07d68b22153a194516ad8b3ed59
-
Filesize
5.2MB
MD5a64bfc3ab490a686144bf94d323607d9
SHA102c21d267dc1583d1b940f057b43757f37577d25
SHA256f6fe83e19bca2019181bdcc1bf49ac494fcae4848a97bb1d84924e75af28d560
SHA5120dc685905cc83b56b9e783db434f1f59492e662e7a03ea7e24054ad47f0afad0bfa9355d95c811ae9aba49ff2b08f1255df202bd18e962f7204cb77335f0d6b2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB