Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 07:56
General
-
Target
2024-09-23_42bdb8e57c5ce804552d1a1c8dbd3cfd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
42bdb8e57c5ce804552d1a1c8dbd3cfd
-
SHA1
b0618f69681f1994c7445682980b98145b1f3c25
-
SHA256
7c0b1d1d8f993b9bdc40997b27c64e1027bede8b9c5f903500981401f47e72ce
-
SHA512
4d9decfd2acc575f190d8a431d79ac7fee21ae59a12786a450c52ed0d4315cfc4ff989e682586bb8eff0a58060f0e13a7102d6ca20deccf8f7aab0769b9f8a2f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_42bdb8e57c5ce804552d1a1c8dbd3cfd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_42bdb8e57c5ce804552d1a1c8dbd3cfd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XgeCwvm.exeC:\Windows\System\XgeCwvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHPIGeS.exeC:\Windows\System\AHPIGeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQJMjob.exeC:\Windows\System\EQJMjob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgzZBsi.exeC:\Windows\System\xgzZBsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVmgsMH.exeC:\Windows\System\CVmgsMH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DOYyPPz.exeC:\Windows\System\DOYyPPz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBLhZFq.exeC:\Windows\System\mBLhZFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OpkYDCc.exeC:\Windows\System\OpkYDCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lreMRfa.exeC:\Windows\System\lreMRfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BfUbyXX.exeC:\Windows\System\BfUbyXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWIkcor.exeC:\Windows\System\qWIkcor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzqpPOf.exeC:\Windows\System\DzqpPOf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wnBvsis.exeC:\Windows\System\wnBvsis.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMaHGkT.exeC:\Windows\System\yMaHGkT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJffjkr.exeC:\Windows\System\PJffjkr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTAvExR.exeC:\Windows\System\HTAvExR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EehGmmZ.exeC:\Windows\System\EehGmmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uPhmOZu.exeC:\Windows\System\uPhmOZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WLcgOqd.exeC:\Windows\System\WLcgOqd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDDNfTg.exeC:\Windows\System\XDDNfTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpCjcMU.exeC:\Windows\System\jpCjcMU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fc0978958c1f3b97c396bd5307bbcd6b
SHA1863867afb9fa0e3e7bec675555aba47ef33b5606
SHA25612628df11eb6d9aa592c66491debfd9b10a75b0f7c183ff0c1d61730baa2b9d9
SHA5122d38e60bf2d279fe2de38440cc6adc996b654387f763b2b27c104a62614dd9432eba38f3f73782ea4a46482f2c313a58894383f69a1c1a828f55d0e2f5eddc20
-
Filesize
5.2MB
MD5459e24d28effbffe0f69b72d26a0335a
SHA101e9dc05c090ae18e54122866c6b229e0ca520dc
SHA25681d32df3d6e207d3e55557879dc55e919044aaaa0aaa3c25b87148da4b654da5
SHA512b74b8111e8441a56839c1b6dae090f683504966f4a43f28d86090f5703d81a6301c33afd557e28e3b0a5f44932ab654e3fd46313af12e8ee8cee50255af700ed
-
Filesize
5.2MB
MD5a6610f6159e9fa4cf309ff5d3346cebc
SHA12746c635dad9cb2702fa3d9a8e0aa4898d7eee14
SHA25695a0821208f81ec8c4ab0fb68894c06c51babe2b8830ec242c2b75f6db320b6e
SHA5125f953f6b916d6e04747d1a9d2143fd149d90d71f2e1cfc2a369590d68a94a5dbb84bd3b63876dfe1f4908c8bfb11eab85f55dd9d30e8dee51a358fccfdf61392
-
Filesize
5.2MB
MD5f872d95cd415c08d95d5f761d3ed36d1
SHA1f8c210547653aa67494faa10f32fcb22771b3c6f
SHA2560af2eec6189684d620324192ba5728b00478d30ad5356a61e5a7fa5dffab589b
SHA51278e3d9a0de79e383aed7d7f6323899e83fa7e2836708cbfe60909a79bc88627ebdcff7692f4de6227f1170c7008031688f63e3a4788c45c0b6a1686877c90edc
-
Filesize
5.2MB
MD51c0f794a033b0fe362037369858a7b18
SHA185577a694939d3d0f13215d46160033156afbca4
SHA2567bf449a6c83c325707893ad8c5b4c69f7390ec310fe1ab9a1ab42c0b021985a4
SHA51253b01d13bc09094542673ac1dd0a39d8f0a7609443c1d834156ddd6a3530afb9902dd0316ec6d84d7261c8127d39b9dd458dd6fecb1e25becb87b4b8a6fa870b
-
Filesize
5.2MB
MD5730985074da64c91c1bff80cec79c2bc
SHA1f1a89a114798274e72b52565d7943fa01f40d7f7
SHA256f56b987e8f3b6aa561a4e78f7b1c39448ed4b996e2746b9ef92f6c77a0aaf21a
SHA512c0ea4d268c58996116e587b4e42e9b1f92a226ae50f4931d6529697796bda15816427bc3b721fc0d27072a0f805c13941c312b737dbdffe4bf1b020b4ee6b790
-
Filesize
5.2MB
MD56e80f18c8f9cdec86e388687dff14452
SHA100a4779b0b28f6bbb781ed6f8b2af796bb140b19
SHA25643bb2eeace1981a2b071f8a0fc4ba7434d74fb8153493a05b60bb7461f5f73b9
SHA5129fef11a414192e8c18c0b6dc0b8bea259f71489f41217b8f94735fa2df80d5fc8b2a84f3f5bcda2bd802586a5df637cb8d41b23ac977f4176c74884fb860ae8a
-
Filesize
5.2MB
MD55f2fc6b0714bbc640c14c2849028b530
SHA15f8eb49e53615e29e66d148cc00ff502747ddc4b
SHA2568a36bc77265fa46dfd2a7a7340b7bc40a7099c5eab13f96dff9c52466536df5d
SHA51278e800333578ee5a58f47de207b71d183c66f48e595e8aa0fe8d477c84de54b37c3ceccb3a0eba6a11885345d63f2ba284b16d170d28644ff4c6e97dd301b33a
-
Filesize
5.2MB
MD50e28e94e38cab40193102de77ec0f167
SHA11b99465b0cdc1c1d5230806b25155b68e7cff7b2
SHA256fb9aa3c44ffafe7853091a0db59ccd48d3468df1d2ea8ba96928feb5c80381f7
SHA5122b672b4117b92e3e92767637fee761f927fd12bf69c62e333fd84aeea5d0997099f1bedb2bdc837cfbe2ad5e6100d24d1fdb3e5aae595b740262ea7e16b7f6e7
-
Filesize
5.2MB
MD578a159b6e6ed40f4080009be09db15cb
SHA14d102600fc50b67c8d73145cc8a3245cb11904b0
SHA2567f3340c8f36a087eb84c5fe55333d992c117e9c8d80062f303f8e6109bc016a0
SHA512d0233afab28540888d4677997ccd19dc363d1e7d1392f71ce1b85736da6464d0d13b3b05992fa3a141e6c9b24b6f54ba9d291990f3b4ba52eaa112d67c2daec0
-
Filesize
5.2MB
MD57a326290f68c4152ba6541ad62f98e72
SHA15cdd1cf594cedf96fab14d433095d784d3eadf4a
SHA2566698d70347417ac6183591987425a8c06dfd8cd9eb25c1390aa6b1425b6a6a4b
SHA512645121099e5abf6f6ba5153d4c44db6e1b7823c99736019d55352705511342ad8117b1d9e04cfa358e85591e97cb4b9320ee26f77deb17104ed504943d0c0ce9
-
Filesize
5.2MB
MD594a6819c2fd6f1f7cdae007fe9b15057
SHA1584aaae12bc3d2a5ab0a80a2e6d04ef8a828f9ee
SHA2564701c6c83dfc57e3b6acb48e54f76cab4c81cf19ab79e07056d5b794f82ec7d7
SHA512f63cbab34f55d393520c4ec04508abade04bf06408748d7bf15d6b7e34adc2759a639cccad733628ba8f6c840b3f1fee4f92605d93286ef4152c474bef6c30a8
-
Filesize
5.2MB
MD5e8ba1d9d5b974e38fdf5893e8ad82d3e
SHA165e58e8258e1c1eaf0d9ed2fc29b63075b028531
SHA25670563c427422689abdb257437ae1d24cc6dea1abdedb25ff20d91c4798b2dfe6
SHA5124510d71ea15cb010e1183d71aacf93582d371173a74f75a7cd0724013e67fc57023c3cb478b169f37b503e2b2bcbe9b311df31d0e7f7715ea6e17c93a22c6bfa
-
Filesize
5.2MB
MD5dcb4efb9b4b708e93b158b040e093746
SHA18daad8a3e6c8acf9c9226c0b372aa4edea31ae4f
SHA256dc6f5342412877f495c1c5be7765c1de6e8416e0b8b254923c22aa73f4b101e9
SHA512232b9651c115f4df7d677ba3256f55fbaa797f3ba71479282d61087a4838d66879b36d1b6f271cef02149e11a1a0254f39ebd65ea1c5e368e49ef6d5cd704c69
-
Filesize
5.2MB
MD558732b898f209705dd90bf2607535c21
SHA12b25f56acb254451b54ebde7c1a74ef3f6926822
SHA2561e70fadc43e7e9004ed0346737790b0f42ff473d886bbe789fad738402fe9e2e
SHA5124f737e934d2b88f4c184f7c1f04bfa4694e19776e3215c5389ceb674829cd52e15cfe7878fa0202788dd2b611caecb7b62fe762475f210c5382bf307b7f0297a
-
Filesize
5.2MB
MD5f4ee6ffe3e27dcc2783149b4a0fedd8a
SHA160117a35df6119b5e8d7a18a47345f9403427435
SHA256312d6328ab7bf8b5e294ecdd2b6db3a13dd6bfeae824912c569523903ddd7c39
SHA5126b7531eab3c981a2607ddaa41b389ae56d7273f37bc0afaa713bc3adecb6b2acb7f4494ee21fcb56ead99bd28c33b18b7ecfc959a9e14e2e23c38ba97c1b095b
-
Filesize
5.2MB
MD50e91eebea8e7ce929698c3a9e0091fb1
SHA1218a445dad9d398927e450e4f922b79dd31ee709
SHA2565840afc78287398b85177d7a23c5408139d94fd6da3b1d6e29ccb6a5ce37533f
SHA512d467bee8d7079e019e5b7add4a3c6ae5facc27627e118b0112a3d65abda9cefa07468c8325731665834a6fbd9777d6745b12175b0bab35715c0106d6873b7b27
-
Filesize
5.2MB
MD5efdd5ab867b2a8b30e1c73c228c189b7
SHA17b303c735d69d6fbae297a965f475d15d3e1dbc7
SHA2565be19b08b3be526ab7972f77e84bd2f8440e7d4c1970fa6f59fed69eae0eaac4
SHA512cca28ec54b76facb2a28d01e0905b77bf23f8cc63595f79c94ee8a1daf66e346339e4447b4b6350ce5c73837b428b5087b652f1e3edbe923cde98622308f183b
-
Filesize
5.2MB
MD54da2069e90392ff21f43778972889788
SHA1698813b2d807e41760a258cc45e2cea0543dc5dd
SHA2562ff23a2c6d79cc7289ee67ac84ad35b71c731b460dd0c2815f4c019f5a13dfa6
SHA512942fe7184af1f76394200b7621f985f7e19df2ce23e3c4c30aa9e1ec8651325f27c9f19a37dd79b234ed64588975d836e30430d938ba4074fce56750543f7a47
-
Filesize
5.2MB
MD57c354c37f39312fae42bd30267fd7850
SHA1b383fda70db08d435e367083f997f2259902c815
SHA2562292bdbd6688827920c172ab514d0a79ae74953aa2f2a6ed31193996553b5023
SHA512917bc60bbd1d4009b60db08451b6f86dcb1e35865c0bd9a3586bda568ccdff25d3a1ef2da4f02897e0b1548253215e2022e21408ea796a4bf45fff527ff9f1e8
-
Filesize
5.2MB
MD55fa68438bec3d355504d7570213f4a0e
SHA107c3cc4d47e4c6cc919f2d043d68cb1cb73ab09b
SHA2565c46cfd54e56d49518f9eb8e9910ace4fbe9ed25b18e4a8601a7533c1e4ae2e1
SHA5126485bd262cf175a0908bb68e36c947e1c0ab3a7b6808d9bf37585c157a51edc0c94c0ce4211a1b2c4af69cdc5dba9530fcec77bd564d7fc58014df10168ffbfa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB