Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 06:30
General
-
Target
2024-09-23_5f8b8ef95446d470d0469448586a4775_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5f8b8ef95446d470d0469448586a4775
-
SHA1
20c4c9375e2d4ba453b6fe78b05527ef94b966ed
-
SHA256
4eb0d2675d02f378e5f9a24f0aa69b8d4d5a93b740d78f09daf5a6f14005cb24
-
SHA512
19c94d1fed2e10cbf86924c8a8805b8e4583ae0f3fedc059a479ee1d246add6e51341ca7ef537c943d1fe9ca00a3d13b0c3b2613ff53d94cb12bace7b8610d69
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_5f8b8ef95446d470d0469448586a4775_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_5f8b8ef95446d470d0469448586a4775_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\myDceKN.exeC:\Windows\System\myDceKN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYTROcI.exeC:\Windows\System\CYTROcI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdicAZW.exeC:\Windows\System\WdicAZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xGjILjv.exeC:\Windows\System\xGjILjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQyIeze.exeC:\Windows\System\RQyIeze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOSExxs.exeC:\Windows\System\wOSExxs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrGpnwA.exeC:\Windows\System\mrGpnwA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQqcyaL.exeC:\Windows\System\QQqcyaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgEIOtd.exeC:\Windows\System\wgEIOtd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQggqBY.exeC:\Windows\System\oQggqBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpUOpVx.exeC:\Windows\System\HpUOpVx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sVvYtQZ.exeC:\Windows\System\sVvYtQZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shIdDlX.exeC:\Windows\System\shIdDlX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqtwfrG.exeC:\Windows\System\PqtwfrG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nvYWfDI.exeC:\Windows\System\nvYWfDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCksgoV.exeC:\Windows\System\qCksgoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXTqbMA.exeC:\Windows\System\bXTqbMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJsndrC.exeC:\Windows\System\uJsndrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FoIOFlU.exeC:\Windows\System\FoIOFlU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcHOdpn.exeC:\Windows\System\xcHOdpn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fYHEuiO.exeC:\Windows\System\fYHEuiO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD534a75ed83e82312324cbe822ab10aa60
SHA17927c7488bb2a20cc18e435dfbb0f86bbe580b13
SHA2562a35e00c9ca8c77767c266f865cad5f38e2cdaa24d36a79e7d07acf4f622a4f1
SHA512b990e47d76fd2ddbbaba215ba6c9e55713e70737144d2533137483f1ca2b98c60945f0de7cb02a090c3b7f1d4e8f47d943f467907e7982d9b81afdc5dde31e67
-
Filesize
5.2MB
MD5e6c2eb85a198d79f0165e7b0d23414fd
SHA18468d78231b5434dfa6f7b3fb18b448af933cd92
SHA256214e03b685fb38370f46b01d9b8be048da38b0592c9b586a05598c349b27dcc5
SHA512fb61f6568c5b3a827e180eea463ab51938203ebea6925f25129453ba6c224f92e42d6d5866185e0640558f7d46d2449038fa1c48aee04a2e834da15401751ca4
-
Filesize
5.2MB
MD51a44d69f95e50c951937a7f8ab6f883c
SHA17774933cf8dd33c75699a82c7c46f90bc41c6a9e
SHA2562fb388fda12b886c10fa7ae5c3b802af11c58afacf08f45fd926e38fbe35c87f
SHA5126a3772fafe3cb5614c1ba57db1c9bddfe88c16486013355d092fe6c1738e05997ba36da8b1ae15544e85f596c1ea6a1f077f32f22d4d4e8d8cd06d8f8afb887f
-
Filesize
5.2MB
MD591cd4724b908e0b74d8c562e33be3d2e
SHA1898030e4545faa49bd0b5f194481237874c250e9
SHA2565fdaf7499b4626d3418d9685af4ba057d1318ee08fdd6c0661cf31c4fa2e4815
SHA51279d320209c586e1a285a6d2c5cd33cc9acf28d4cdf64f0d959caf6b74415edf4b53cd254e2f5bd19d11da34d004f51d292f45afef464e1c18f50f9e6522d16dd
-
Filesize
5.2MB
MD5663641fe32571192c59e1521a909e98a
SHA1cd4bcb9a6b2940291229b32fe213a0af5f8786b7
SHA25606155ed0360b47b6e9a89b09ffc524c6de24032ebdcc1ee527ca537d86dde401
SHA512318a0cc95999b9fd6945cb616628587527152c0100d346507eedf8c960ba9c2768e3c17bf7dc3a61eb430d03eafc41b420582d2fce8c027b26f5562bea81b9f8
-
Filesize
5.2MB
MD5acc2c24f74eef75316d387964486ff93
SHA1a20bf0b7481e1d7c7af3c40f96d0c90bb0c0cf03
SHA256c0acc04ee03ded5eebeaba6d8848841947deaa123190c13507ceaee0f38003e6
SHA5129f81ee6c9332d8e6e0ac3f02584a8124f8f13f93715448b57bc36373029f3c367bd703af92656f3d760429a4751eff0048a268131dbbc9d26890b11f9da92b8f
-
Filesize
5.2MB
MD5fdec4fa6389a2939e0b7eeb9633e150f
SHA1eb8341334a5bae5e836cf59fb7632fec2d1c7e18
SHA25682993bec2e4662ada5874d7b86a51c5886b8c9aa2774341afd98e2471b4ccf72
SHA512cb181ed620c23724f1f350f165154bbdae6cd82f148c0de84e5e18a4eff06552b6584c94e939443a4f391975cf4fb8fb01d0c1f8f24ad122e91521499e59cb9f
-
Filesize
5.2MB
MD5d9b1034243ba7db77f3fe75440ea7ef0
SHA10cd77c2a792709b954b36bba55d46b28f7fe354c
SHA25603464d9fd9643880b5ae2b0877a434bd9ec7bceeb70725e843817de8263e05a9
SHA5125faec66359c798f517589d75b295d4dc6a807283e4aaab1a093c76cf405ef11631b03ab78373f6ba2385f76e2e31c2447763bd0f41ddf761c5c0efa33c35d1dc
-
Filesize
5.2MB
MD505b730de07a289ce888fb78c8abc6d6a
SHA1f3c10630819b16c01a26462a92e3ebf42d1fd842
SHA256493f53ba34fcb2dc630b88a221345374714afb301a303c1573daa637dabbd3b7
SHA5128cf776ee963063dd8c2595c69de823e87f2dfa1f57cfb1147184372505e1dc4b9e8188a1aa82e20440e00d737ccf219b77a4df132cad507a78203bed492c7748
-
Filesize
5.2MB
MD5ea81355dec3d5fd71520a69c86a9a717
SHA186f1e2d4d001f73568491dc8a1a4a2f467a01512
SHA2565e2fd1bce8bc99ca1bf7672c9513a003fb227238e139d643addf067234abd444
SHA5129ec9465a0be344a410164fc56d3bdf505f47a7094bdc025ae352bef1fdcef428f93b52f4d187c34938e37b7c674d2fef10ff87a25cf0fd75f109a70eeee1c47b
-
Filesize
5.2MB
MD57edc1559534789a1aa1aa328fab324c0
SHA13d9e2ce302ff4e03deda09fd412c42c40c558f73
SHA25695d14c7808a39d71fe3cf7b386c5c87a005a471c03ccd886234dccd9c084fe09
SHA5126ffa1bd438a6bc9ff536cfc38729064f7d199b96254d008647e6b019b1532e012e18b5945bfbefd10af427e64b12e53127fc24291aa483859f95565f4053b466
-
Filesize
5.2MB
MD5785cba3b285903dbcb2c3ca2ae351a91
SHA17c08214dd6981e944acf6616a5a13ba5313e06a0
SHA256b9506242a208d851912a2b152ba639b5242f324c5ad47d489143f53648946c6d
SHA512beffadb66c63a7a9a226efbc5519097b8ac082b7baa98d3035fedb1eccab91276d3b8f7ece7c538849b16f85fd711350f34199423bf080f288bd6278eef29223
-
Filesize
5.2MB
MD571686ef5e7c77169c64e25ece6b16d5b
SHA18004d352e3d18b38f0495599825bee4ee8ab713d
SHA2567e1afb3c7c00ecf7ee3d185a117b88bd75d09a89b43f4d7a81bb7a4366edca9a
SHA5126849299958e9e54af0d1cdd00939b23b197b95087f4c93cd698a8f3c9e3246077346fa61488f3b087b10d495eee548f6a099be7c748ce4454e3b9b60839b4abd
-
Filesize
5.2MB
MD52a094fe213261058007f8e1dca33449a
SHA1408531191d497afe71d4efff628ece183bf4c4f3
SHA2569900c31cc7a16ffa893657cb12ba38239b7394b421bb8b2af82fd33be2843950
SHA512d26eb55ccc911f7e08ff264433e314eaef539c82651deabaf19f886786736e7146dfce873061f0f5cfb41b62338596d51d2067a57fed7466d0590f6002a324a9
-
Filesize
5.2MB
MD585ae9818d3c107c75dc757bad9f81783
SHA1f396a8afb83e0094207e7c97b948f6eaeca860d9
SHA256307551863df8f3ec92b314438ca1d1ad058e2a8a35b1e0cf3b7624afd7a8c3aa
SHA512944fd33b1afa069b6f73b47c39312c1f3aa09e00c39e4fe439d24b7c432bb0b890be139af4f649e6c5d51e79567bed3aa91163f605785394ae3826c51479b68e
-
Filesize
5.2MB
MD54cc6028f021e34636532fff9b0083ab2
SHA113a59e53a6e3894ad4d19099470112c472d080e8
SHA256fa728c0e44582c41eeee0986b63074cb70c1076b1a6a0c39a257cf6b92b14abf
SHA512a6122bc914ef5ac9802b2590cc0707e7ee5bfa2a49128399d847ea7daea32c8fd177a16dde867c12514f698629eabaf5b0102bf8473caa3759bd59cff67ecef9
-
Filesize
5.2MB
MD557acaaa1a3208f8bbe6ed20ba9041503
SHA16406bca45b2495db419c4daa72cbbf30a43c7042
SHA256791d81ae87322ea67c857ee9cfbee30c24deb22f4c1045caeb90504fb6e35645
SHA5129f370426a77b92b1cf4433b570faab2830daa81e4641e2fc32c616acc2b3ecebbb86cbc550cb8c7d9fb74aff808fa7bb4f383a55d3238d209c26a7cbbec50ac1
-
Filesize
5.2MB
MD587911f60fed1dc8e3dc2e4e09634d577
SHA14b2d4a40cbcf6b44aa967ced4a5283b96e7c4cb9
SHA25661c17a90e6f5a9707e4a8751a67ce5936da78b6f5200a7c9670e214f58243ec9
SHA512196d3a7c626e00d11265703f23503f41d22161f2fbbd4e9b042a3606653b7ae8ce5fc6edca3f97cdc1d87cdb3eac6a4d2e991eff2623c78dc292c0f3ae7c7212
-
Filesize
5.2MB
MD5ee6f338a50ecd324989b841f2dfc4007
SHA1cb40447bef66c52669731442753286a39a7e6b2e
SHA2561683ca0ca6319cddb72af185c9074d5e65d4f696dbd19c170591c63516e27046
SHA512fa214ffec0b9b097adb0daabb015299706508ffbe1f15ec0d9d8a7ca1dc65fa2d9fc1e5f6ac56bcb3e1562089c5c106dc56570f04c61e50d7defa0675e2abffd
-
Filesize
5.2MB
MD58bfc2ceb94308ad1721ca347f6aace3a
SHA1f93b114d8d56da2173e5bcfa5751133dc6311549
SHA2564c9b321ee9a9d2e51a858ea884eb8d63ae223f382420cfcbc7b1d09477f55d5c
SHA512c14abb53c4f4da21fb4ae835bb381fa83b1d402da3d1862e2d8e783dc3a84eeecb2355f551c4bbcba92fe1076eb1a1381ead548819847ac54a0c770025c4c613
-
Filesize
5.2MB
MD52379ef4f3914ce37779216c019efd3d1
SHA18b45890d4a8b50487862896ab9cc530353d10018
SHA256ec72276cdbf00c4b89a81400e1756c8a0db1a9fc9fe93529f02c13ef4d6d83fc
SHA5121e1fb231ed5fb9b8f3726c29bae460a4735e27784125b8824fb93a2c66a735462862ee31ae7420588d912496318e12bef9ce474c360eccbed7519adc7d78c168
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB