Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 07:47
General
-
Target
2024-09-23_2381a4489df6611069121ab2ba4a5272_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2381a4489df6611069121ab2ba4a5272
-
SHA1
75ba3c4309308ffa69c4830a106558ee8921539b
-
SHA256
2f73b01d0cdda8d330f8a35dd9c4ac2dd48c8482290cecb7cf38542cbdc7ff16
-
SHA512
3c781ebe845f2571f2764a19a51c1f4143b800f053007db19fb448fc9aa5f4c3e546b668d8387a93e199b77f8976a18c62556c6b754023515414b72341f92275
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_2381a4489df6611069121ab2ba4a5272_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_2381a4489df6611069121ab2ba4a5272_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lXYWIyJ.exeC:\Windows\System\lXYWIyJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SrZnpfY.exeC:\Windows\System\SrZnpfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rdYOXnw.exeC:\Windows\System\rdYOXnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\utLYhSv.exeC:\Windows\System\utLYhSv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KARneZR.exeC:\Windows\System\KARneZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxYcCWN.exeC:\Windows\System\uxYcCWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fksHDol.exeC:\Windows\System\fksHDol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hgocxUq.exeC:\Windows\System\hgocxUq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\deIVzHv.exeC:\Windows\System\deIVzHv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVMiQwd.exeC:\Windows\System\eVMiQwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIPUTgV.exeC:\Windows\System\CIPUTgV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnTFwUu.exeC:\Windows\System\SnTFwUu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVgWFgE.exeC:\Windows\System\YVgWFgE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tYNibpe.exeC:\Windows\System\tYNibpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MeDlCHQ.exeC:\Windows\System\MeDlCHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oCEaMrm.exeC:\Windows\System\oCEaMrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiWzLcS.exeC:\Windows\System\BiWzLcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWaKvRs.exeC:\Windows\System\mWaKvRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leMWpdI.exeC:\Windows\System\leMWpdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YoPmswD.exeC:\Windows\System\YoPmswD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vxknBvI.exeC:\Windows\System\vxknBvI.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4388,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5552d446aef22201e327cf38b06dc4672
SHA1c3e786319df22663f50429c841e41a47daf771e6
SHA256251d8982a8f117a24ca803197838bd184f839416b373e14af8f688305c6350a1
SHA51245e7a0d255ccf9605ec201772982951360baaaa36ebe35446695c2a8e527a61615ed4d4e7451b59b7826b0791307975987e821556820cb55388d2e98954cf767
-
Filesize
5.2MB
MD51cbadbb5fa41b47a728af49c9309b7c6
SHA1294eaf0dbbb4016d8d9af8d6a1a100be344ee1b5
SHA2562b60a65747263d0d1d154380ed0f380910b7efe7fb10669180ab4c27d3d953cc
SHA5122d8f99ec97026ee6ab691f3db5d09c29a3c293d155578d8f0c7f8027e44dc17f54c6beb527b1d5847de339a19163d25117be066d975fabb1a3002da34bc0010c
-
Filesize
5.2MB
MD54f2f31a3fa8d5d7bc6ee14571718c8f1
SHA1c9c24923c61525c7429d9d3a25cd6e03ba3bbbe6
SHA25673475a548eeda90370246f9ceb8abf33b50742432b4d5d8571538784201d2f11
SHA51214b44df55b02ad6fdb10d88b3a925c92cb3732915580142ef04279eba28820ccba0e2adc963e419bf94622d86262278aa51287a0605eea7e7235f7566c04f4b8
-
Filesize
5.2MB
MD5c2fa52be588c06e05e554792aac6ff1b
SHA163ef9d9cd33f49c52fde6ffc6d6b7485db5e81b7
SHA25665eb7d8748fb8ad494279d8696b9d0c84b922b479d75778958aea7259d5e903c
SHA5125cddfa40e3c594fb38022bfae28854f0bf5ac1c4d4a2609a636a3d9eacc343c8199903c7b96805339f72e61ae6b3ad250db550e3af71dcf3062543c24c655b4c
-
Filesize
5.2MB
MD55c66f452fdc7e14d0de44e10513e271d
SHA19e1060790505f40d0af685652744ad77bfffbe49
SHA25690f48060c3cdaa4e6f1752071913a91c820fb319e7a066b06dabd42cd1092adb
SHA512568f900370eecfb4b007a33737ae0ccca35551883c8cde2693eb008cd7993d0e2d8633da986238ee3d48ef8918ff5362c2c56a7596dde0ea961a7b102ca7c473
-
Filesize
5.2MB
MD5cc98291f543b5030ab4cd5529df059d0
SHA1b20f7cf242c73b0332b32277148def4af381e45a
SHA256b829a5c8b4df2f40d84f0af6a0067e1e73cdeb3186641208627e52d3ad66f1f1
SHA512635f8417bdbee3d3e0a7ce7e23f20e49c7acc7a2f12cab69e78d346c3ca22e8d3014bec6e71e933687950546ad31b8c34f02327820cdcc65e92ff1b903b254c5
-
Filesize
5.2MB
MD5cfd3157f736015633ab0a236b50b2dce
SHA15dcca29e206bee27a1af5d078f91052a636aa90b
SHA256d799f6460083982873815c18df142da9483bfb3c4f1adbcede984f3fd79b6662
SHA512cbb553536fe9a98d92567b686c28f59c083605b44eca16745ec9ede8f4151b99d652e3694e8eabbf81a639e86bda4a3831799c617874786de29e9de11e486079
-
Filesize
5.2MB
MD56d71c053ee9f11de7f1c4e964bca2381
SHA1bc08ba5649abfaf68c5288b8cea6b749e3fefa77
SHA25631a4f1ced7f8c20093237430fac764280cc989383ff15fc76e10bc37b141764b
SHA512cf937b84abee299ce2e33641c12da773c5b30e9cad41137c248556518033fe0f78fa3e55379567eb09f6f8560ff7c50778551b770108fb8840a2e98708738d2b
-
Filesize
5.2MB
MD597465f6466408b9936c9be4933910b9e
SHA1c265082877844c02cc7f84a7054fd8397c69ba26
SHA256f16d97e38403c092eb2792021ca54b390565fb3a6234dea38debf445576fe198
SHA512020391fbca16b4e2523fbeb56e8e80b537211cdd5de9539e8aae44a80b3f3395bca9c1967b7a14af8127fdef813c5ddb32cf49df5f4e82196defefe2836cf532
-
Filesize
5.2MB
MD5207c89a10c677ac8ad1a0d7ce7890467
SHA15aedae937c1de804630643a8e8c34fe2ae32ef82
SHA256b0cfdbeb283856dfe326be5233cafe78354aab3eef0fc0a0a42b48f574acc37c
SHA51264cee4a30c3697b8440ceb324ce1de4c8d278bec2ca9f6056162457121c068a82ed9569e2ec4c1915ee3d369e5863f6354f1f332a4534d3ce31b115f2de46924
-
Filesize
5.2MB
MD5468bee29cd4b318e1f4bc593376dd091
SHA1784889cdf2e42ad7cb7c7cca82a6a348954e8b60
SHA256ed10818e1ca665aff44b3b57c7002ca441f17b0926776d51b6b4c1801c7d19f0
SHA512ddc5565265ade1b77641bc2fa0cf6b6d10d92c674bc46bc5e8f43bda57e092a383626a0994fabafc88f7e670b6759af5b03970c8b3e212b56153137a2698607a
-
Filesize
5.2MB
MD57521174f142ba698155131fc29ecb00d
SHA1df47a482e36924f6b7c1e4f5ba3f2d3442792aaf
SHA256a81424ae5b91a94defe93ff3cc905067e3c3dcfd79779dcb0dbb83cc4e57caeb
SHA512998c1664018f2422d68cfab7a050933aa8aa6a15144941ddc3e98d8b4c2d824ad3d2c5a20c45b5a481227b493a5fa3d62d5308b0e96f72b01a2581096c744d36
-
Filesize
5.2MB
MD595d863f5a86dc665710624c9bcb9b654
SHA1399bf42edc578b0d9f97f1385db56943b54a2220
SHA256360e2ccbf40ff523ee5a6aa4ec76a436be1832e0b32c45e936e52238b6f2f975
SHA5124b42e9e2a8e09d6579d8e300a3b9c0b528cda5aeff4e376f31ce56b81b83417586d0b7508e5d71281fd6331a52249cbba006c44158825c7b8dc7a35452bf1a4a
-
Filesize
5.2MB
MD59837245e76dabbe1a71efd7ded2ad1d1
SHA1833d69cfe10a9bdb0ed38dd8dde22040d4e6c83e
SHA256b72bb74d5c3eab0fac731ef721e1777e0e5587611529bc2de510866f9d7b6a08
SHA512f310f4daffead4d31b6a6447c423273712d0e29bf7336fc3f5849dc88c88d3bfcecb07389879e7655d81d032ad37fc213b1c47cc5dfbfbd50d3b0eeb3c1e5cd6
-
Filesize
5.2MB
MD5320310a525bd496ceb40fcad2208f021
SHA18d5d78e6c63b0583c2bbd61dec10eaccd82dc0c6
SHA256b98f3c2c4a4ceb3cd0404c050ed54cbb96f5e67bf63deb3b34d65dc1f379fd9e
SHA5127d7b21c1a0bf7ecf135530d327cf2763ae0c9cc6f1cb799ae97fb0d91c118cc4e01b24dbe91f5dfe4f764fb78b3c015e612006893e03787f8d1a9815b37ffda4
-
Filesize
5.2MB
MD59524bfd058ea64951c1cd166d69541b2
SHA16226cfb81db261c77d8193710471c3b8fe92690e
SHA256922d16bc28478fa126e6547569391e4dd132aec7c75433bfd167f00a551ee611
SHA51239d9f71919c74e21d2f91fa3c758cc2392e24e18f7db62553cafeafc453c2e1552fc3f584ff70f21a05c273db7d061ff825a79e8e37045227741c8b3a1b1e641
-
Filesize
5.2MB
MD55d2eafcb11cc3141bdc19c4426622377
SHA1a0d7076da723eb4a226b7be6ab2777462330ecde
SHA256c48aa5c4a70110ecf767242f43e8bdc5750d03db0537839810bb877f056b223b
SHA512ffd7384f0ff42c8ed8dddaa8418c40fd9f4ee11b66a5018a6892480b921e3c4f87f7c2e4be9aa13d4f6f1c1b374b604c0d9e86a8701d3fa3d7af7de84d00ddf0
-
Filesize
5.2MB
MD53cf77a3412933aadcd20e394a468bc7c
SHA14b430fd05948a25e756ad00be8f211f09311683a
SHA2569210e7186da76df07480525ddfb5c6049ad8adeeda1efebcdeef71c689722605
SHA5126698a8c0fe79078b15a14e4d902af5692c1c63d5728a65ab7eb65b766634b0826ca23fa0bdc09e88bc473782c95a993d0a4d52a1e1069be2e7170a3a457ce645
-
Filesize
5.2MB
MD5392a779c59d19420f3ce88e971040479
SHA12dc39ef3014f4f95e1d70ab58d186a3c36c20689
SHA25699b2b7e7a326e18585ac63b12b4bc7d7368664e7fa25678e82cb90f942e1046c
SHA512c387e0f048282d26d1d41aca718aa7fb6657530260ed3b9d0b66d5c7e317f399f3e5ed8f17100469b12b51bc367a35f88eb5946cab32d5a2141626ce9c2a0103
-
Filesize
5.2MB
MD5b1962ae622af863acf032b9515fcb385
SHA1e953cc20cdaa58103599610f872e356e38702ce4
SHA256c46db83de2e269523d434fb17be607d7f7e7fb3f0497607880808d63f7842177
SHA512c50caea6d742c850441c88b74ebfc41868a55f5b593c22370d4b23b75b3a8e5ee64ff87644dc199359025bc2def6cf70efd1dae9377d886d1ceac54139d0a5da
-
Filesize
5.2MB
MD54276d6ade0cf3872bbcbface11cc86ec
SHA1114a344e0fad9f000b5f763bed46843cece018be
SHA256c91141fd0e4e2f8b96574d07f55de3ae0c719edb8885a83b967eb4249b55c553
SHA51263392272c78d947be1e5aad96cdd24863756fc7e43bfc573cb876852e4ace32129ba9eb64f1e88d586db53c8fbb13e3a9384d3368d5d527d3e0c0c4f4c7c8d3e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB