Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 06:27
General
-
Target
2024-09-23_3bd4e4db4b3098ac84cf26be2b08f364_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3bd4e4db4b3098ac84cf26be2b08f364
-
SHA1
39516342e782ccdc1801f808ad67c16d1bd25f5a
-
SHA256
1dafcc91527945aa63cd052121647c72d4df58b385b3f1c3c61e3371b14ee056
-
SHA512
cd7461010533bbde30ab5d182a492dcde8dce3d907ff33c8205f5f8afbf75ae65ce2b6dcfe654931b9a0eb1646f5044fb812d8e5b1adbb717f2412a1db7e009b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_3bd4e4db4b3098ac84cf26be2b08f364_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_3bd4e4db4b3098ac84cf26be2b08f364_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BlQIkSf.exeC:\Windows\System\BlQIkSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fQfpzrP.exeC:\Windows\System\fQfpzrP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IoLDaIS.exeC:\Windows\System\IoLDaIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHOcAsQ.exeC:\Windows\System\sHOcAsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\umixTme.exeC:\Windows\System\umixTme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dZqKqAq.exeC:\Windows\System\dZqKqAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJFjygu.exeC:\Windows\System\HJFjygu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SPEPZxZ.exeC:\Windows\System\SPEPZxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oWHSUKU.exeC:\Windows\System\oWHSUKU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uFUILTA.exeC:\Windows\System\uFUILTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cYjijQv.exeC:\Windows\System\cYjijQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrqyksM.exeC:\Windows\System\lrqyksM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylAORIU.exeC:\Windows\System\ylAORIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryiHCOh.exeC:\Windows\System\ryiHCOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njrFQyG.exeC:\Windows\System\njrFQyG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRDOEMX.exeC:\Windows\System\BRDOEMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJGblhm.exeC:\Windows\System\aJGblhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubGNdyb.exeC:\Windows\System\ubGNdyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuvPiAN.exeC:\Windows\System\fuvPiAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzNHeyk.exeC:\Windows\System\nzNHeyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfjqMgh.exeC:\Windows\System\EfjqMgh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d777199b039f5d8311e5756b5d2587a4
SHA145822b3cc79a124b55116a3086a383199f218a86
SHA2569f77ace59c99bf9187ca6cee7692e0728dc140a4b7b618d23c353582b76853ca
SHA512e333442adfbe5fa941cc1ae03d2c8d645688542f83d685a7ff631901c7f0802714e8632c10ce4a550ae86a99b9a5b6340d3f63f27f16e3c5a92a1d0b803205ff
-
Filesize
5.2MB
MD5ef8037b7881a3b528a83749be42b2b2e
SHA183d57b4f202f6d5efeb586fc014b27fe8b237e95
SHA2568840b0f6e5cabb0fff1e64b977992229f75faac0a28b35725d16c42b5a34358f
SHA51296085708a6d9e0239b191cdef8a25e21a3e345384366054ea489d4d6a33db29ad96161ee5de8325bf18217428fb3864a0082385a275d4d60e15cdf8dd00e5ee7
-
Filesize
5.2MB
MD5545210aa8a5b8c15702036727cf24382
SHA1c06163a9ed43f6034492ba287afb2ad2f61c893d
SHA25608c254e2d88818d4cc258ba100de4b91f6e9a45c0251f1255f0da62db8fce559
SHA5124fa81c7066bdbb0822e813313a175559cc4b2850f3cb06b80e388fe988c69cf09751995aa0e0e1894906ab79a459ddf34deaf68e9ab46944771047522f7f8017
-
Filesize
5.2MB
MD557cbb9ce424d07c961ded477f77ffddf
SHA18cefe739285afe70069a7ae89038ee6074fd039d
SHA256a22a6ba17fafda57d3a22a88e7ce025125524338925d95628667f6195278bd9a
SHA51280527d9fc63a327e451d781c7c63a76aaf8b61fd11b597cdadd89992653de2f59b282061f0df0d9f8b03ac0f30e49e1bd63ce887ed3010e74dd35ad2a2d400da
-
Filesize
5.2MB
MD56fffa6912670b7df187c9a3466938323
SHA1b461106849f45992508bc1f0b460f2ffd6db3a27
SHA2562df11cffca502896b0f80e28a4a3d36397504c3d9942b1d3cc4e18dce16d58b6
SHA51215de19ed9c6f106031ea11e2dfe4d31aac53760f88292015021727b63a686d593f2b7407be7bead974d0dc38804a7622ce2c60575c968ef7f20c36c5cf1f932a
-
Filesize
5.2MB
MD5d3dd31cbe56c3589e7894a9c44343370
SHA148687394d22b25cb5ecedb784e7899e6e2a02377
SHA256e29bf97fc86aefa5b32c7aa9920ae0dfd2fbd44422f1cb5c9a6deaf4a2a7d679
SHA5125d91489a62ab9705af712a01684be08da1673cc88f2ae8362e70334d48e799614dbcbb40548cf08888f62a6df5d35eac1670af12bd31913baaaacb03b9014536
-
Filesize
5.2MB
MD51b9f412fdbed4e1652aa2a56d62b9d6f
SHA14c7ca3bf7e62ea6efb691f266a7a9982c9b43bc5
SHA256ddb37cc06ed66910e6626d565968a4b8030835bf36f9988fff7a4c211ba3e005
SHA512eb1464a260e3faa0b1af2d355871728b40c1e7982378a9ba65f3a7a2a5027f4a78557d3073542bccfd40fd53a084297356b6c7d785da470dff2f31072d858980
-
Filesize
5.2MB
MD58302459e62a01cb50cd49594b3491fc3
SHA1f0e929c508fcb439b30ab4a904457ee38fdcb6ad
SHA25644b5a0b64cb16f68ee79661f96ec9967e1b0c3354e2fdf31a85087c0a83e79b2
SHA512412cd24a851a16bcb2113fd08fcbe774f8f3eaaa70391e795d219ee067beb0b5c57dd07375a50f7472ee6bf535c9cb9193e53373c072295915d05b9c2f1707cc
-
Filesize
5.2MB
MD5289f20f46bb7b4638a55c62861d5cac9
SHA1492c4422cfc13591470f28c2af4c0b6be6583efa
SHA256b6cd119f667fd7873855ba68a57d8199377910aa0a899f2e3bfc7c87926bce49
SHA512a05721f1d9e41817e2ff14f0ece2e92846a7717ed621219400aa15fc2e9ae797b3aaac179f6a68398f43b22b76adcdbfc21697b47e87083088c162e68d648673
-
Filesize
5.2MB
MD5ecc20b2c5d6412ef590f4bfda15e76c9
SHA173028e6db68b23379ce7355c0047d05526639a00
SHA2565d8f96c389f06f0c8738c13cc9ff8ed7f1b75d0d1698e5dab084a7e6bb75ff7f
SHA5125a24e94fc96a3287cf7a2f1a358112de31974d8e33d380e58d3385c3a8fac3b57e730046ed9e483165dd7b9f2ae245f761693925a9b69905ae193f1d9470b061
-
Filesize
5.2MB
MD5e4d1db58e1e037bbff8f2b8d559cbea7
SHA19ad2747d531c1a45232948b35886395e2808cad0
SHA2569bd75bbc3361446616a89a8d5c1da02f8ef0334473d2cad418de73b5c8437a53
SHA512f21b63127de425c3932ef9ce38725f443d34f83970abcd4e7f5b5782088f7cdb12647d26a6b968eb576d8783e2d25a45ac7058af665dc1b7581e10b70944ae2d
-
Filesize
5.2MB
MD5e198a0f63dc31a70dd2a5082ea2b89d9
SHA10b7cb2e77c29acc0a0abbc11cbdb9968f20ca6db
SHA256467d66e5e860fef7526597a316219e5572416fdc6a7c2438f60c1f503ffbf517
SHA512ca8c3eaca5c4d99c175650ca325bf2d56bb5fa9ae2990bf741a33f87e5e6980eb9856757cea1e339c2ec0c03ae46b019f780c14e98b90e7f08fe5393c3c07fa2
-
Filesize
5.2MB
MD53c589f5a19be780ae71b61bbb5bec900
SHA114b5d88e6b49941b90ec5ce7a8ea9a95537a1e22
SHA256c076b0d72653e0cc0241ec603f2b403e2198a81e46e197ae89efbb44c07c625d
SHA512832e9fc88996a3e6472ec2fd4806d108fa435f2ecd146fd10950e2e39a0ef68165b654b988aa724bf53b9575e88b277c68e6addea82a52d70beb995db11bb0ca
-
Filesize
5.2MB
MD5db288d79eee573bc1fee81226f214f95
SHA1a86e4f1a96c671e200b4b97a7f5da318a925bcb8
SHA256049fea68ea14fb7c3d4f8f8b3a9cacbde81b9a42c4308783a124edf43dce041d
SHA5120a690ca188b62e1369a64ef4d81ea3c4ebe42fdbc76b872ca0fccb19a3a1a81b1ec307d963034f7e3383e223ad85188be0a35fd42bd76de531ad1fc90d4c22fa
-
Filesize
5.2MB
MD5bfb565016fb6498227a2ec2ece6a3ee2
SHA1e08474735f211c128924e661d41958fb1b1e4dea
SHA25632dc17d887956a409f0f665509b3ad8802ad1f6111d3766f22c22d920fdf5973
SHA51286f3440f49a7e1b1e3e4d375020f35891693d8b5066e777358f850a5d85dcc5dbafc22269535821a2b21aaf95200b132ab60806a41730a932b5e79a79b720158
-
Filesize
5.2MB
MD569997bfbdb90c256a841be96692cb9ca
SHA19cbffeee0d6279724869f014195e6c20b9e4bdb4
SHA256c0c5a5528bf229a47c912820b377506990dc50cac5309e9d87d0b44a017d2158
SHA512254c214c6674ee6013afa59bae3e83b5b5e2da04122c1578128881aecb73badc7824bdeaa8bb18a6cc9b5446c393b00c0e3bb2235858ee10542bb70822f1fc99
-
Filesize
5.2MB
MD5037f9a6cf6e55193318738fd9b2f8201
SHA15e07d6609a75cc04e5267ba028a82ea6657dfc25
SHA256051581f72efc9fd26f381924a3cd654b4ff720c61048488a1f7cfef647da7d25
SHA5128f5d7fc13bdb0f3ac3f54aae9a30afe90cbf931bedfba355a568b2b3e86c39970b666aabacc74c215df24bddaafc4160a7c964febe77ee9f4071b81bff51f509
-
Filesize
5.2MB
MD507f650ddf26cb687c0d3c53426dfc18a
SHA14c0c6801d114a7042188a378cc16d81cc742df62
SHA256f30ab6351c3371b739df967b1fd22dcf728576eb34ce19eecc686ce685c33b54
SHA512943c973600bb8cb27c3da4a801be9bc79a538c731e1690629b2acf816cf29ee87f34a71c92c56e85bc366a2be8913d50e5723c27cbd99b4e3be2317a8fdc6ad6
-
Filesize
5.2MB
MD5cedc1d2d021132057d44cebc7bf28327
SHA11613c1ac2d9c9951812ab52092e1a7a85ba44fdf
SHA256cbad6b61db4fb5e1c31b42d8a19172034b2ddea0255ff7b435bbd95929a0fb1d
SHA512dcb9974c2e59b41180e879bc2a3cae97dca3c238ee8523ed0644083e4c82a9294861713713898c57b358c26258ab35552ea341559fe837786bbaa154863bd17c
-
Filesize
5.2MB
MD5199112fe63e8825456480f393097fe3b
SHA107efd865b0ff268aa308164b6dc5e3bd476e7299
SHA25643f6122814bb65609c4e77eca4722292339f70b6f611492d8200a3481609490e
SHA512a53b2b4f3176e81127a0a043c27126f2e4c4c1e0477cc4590cb339c9e8031366e8f29951b42d8ac12d468bb801544cf54e0b9aadf829ed56ced0fad10f147fc0
-
Filesize
5.2MB
MD589a8428383b707e2a9671e4384afbb0b
SHA1ddf1582b2a4ddf9b1e20cf5cfcaebcb9b8b9f1b9
SHA25634fc63ce8ba08ee1b040fa0ca6ef0f29d9dd1c2e8d127e571948d6e17563250c
SHA5120fd9195ae5ea643bfef47b6f4cfbb9ab81738c413d0a5ff89b6b38d57587eb28bf10ba7304e10e04a77a03f0ac34f02272456c4043f1cd4ded5e3d66cbab4754
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB