Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-09-2024 08:44
General
-
Target
2024-09-24_41408c47913631d5c2cc09d5e1f404c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
41408c47913631d5c2cc09d5e1f404c8
-
SHA1
e638d2d2bc475d08877517ae483cfeac346ac7fb
-
SHA256
c05c2828bf15eeaee89e7c4f6a8c2268094f8c368d9a29c4a502f9fce62fd287
-
SHA512
a1589e35ef01b2b2fb06cf286297a1b73a0864cc4644c1723cdac21678d90d5b0359bf47a63930983aa8454d75c5f831ba93a022bd97702b450a8e0fb655b994
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibd56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-24_41408c47913631d5c2cc09d5e1f404c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-24_41408c47913631d5c2cc09d5e1f404c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xXfXpEp.exeC:\Windows\System\xXfXpEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPwlvUI.exeC:\Windows\System\TPwlvUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBwpgXz.exeC:\Windows\System\FBwpgXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WkJqVIw.exeC:\Windows\System\WkJqVIw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XoIeOmN.exeC:\Windows\System\XoIeOmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bitJEKM.exeC:\Windows\System\bitJEKM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SZFHlIx.exeC:\Windows\System\SZFHlIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPtbjHh.exeC:\Windows\System\TPtbjHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzuvQQm.exeC:\Windows\System\WzuvQQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vdwewGY.exeC:\Windows\System\vdwewGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MDcYifv.exeC:\Windows\System\MDcYifv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NwbZjHd.exeC:\Windows\System\NwbZjHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvcvxHF.exeC:\Windows\System\jvcvxHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ayeYrNi.exeC:\Windows\System\ayeYrNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sVmPdIJ.exeC:\Windows\System\sVmPdIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvIkekP.exeC:\Windows\System\qvIkekP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dhhkGJB.exeC:\Windows\System\dhhkGJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjfXJdw.exeC:\Windows\System\LjfXJdw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pAUdicc.exeC:\Windows\System\pAUdicc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELXtYub.exeC:\Windows\System\ELXtYub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iHqIlgD.exeC:\Windows\System\iHqIlgD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53e04113a4458475c6beddba38048151d
SHA163ab0348ba1b3e4ca8d4a3dd118ae28044a1ba82
SHA25640f8ddd5d89ecad02bbc1658d6dd5af24a92ae600861298574f65e353b251d69
SHA51274701eae5963ede71ce9ce79f4620dbb63d28fbc953b18e92f0e19a55ecad44dfe2bbe8dacd347e55dc1d239fb284d82cc388e22adae4f3cd2d19d49a75e7069
-
Filesize
5.2MB
MD5e1c3839644d10d634d009a32122af8d9
SHA16f8f28a95b125a62753eda0dfa7af72285738e79
SHA256316f634bfd19a32833bfee38d2e7da06b52e8c519d09c405bf993abaf7282f0f
SHA5121ad29d578a501095688914aae8a7beac8ffac598f3b1e9d9412a5924dcfc5f942cf28593e8e76b838aabf34fada85b6f984828800fb09c7bd0c0c7be37799dd4
-
Filesize
5.2MB
MD58d59e7539f672a50c1aa93e6e71dd922
SHA102e90e44d62d0565c307defafa669f2f706e2e4a
SHA2568bc7105139c69ea10772037ee3e33e8bd9a4013da8033486f52b486848f7e8c2
SHA512ca58de4ac59caf0bb1a4d1a381970898c0859a93b56693fe5219e79d510c3aa055d79386393b1d164396df8099fd8806a56d7b9c03ba8343d22240a8df75ba04
-
Filesize
5.2MB
MD5adef04b9bef48292eb13fe6dfe458f35
SHA1da4b936fe5f9285a06f647a336cfa57e66244b2a
SHA2569b571d3d3ba2b90c17ae599de4a38f8ad722b3b409b49cb62c0e5cc4c21f0d71
SHA5125203018837c42e92cba0d16511e4076478f740f62c71437c0eaf28918c5b53817c7a221bcd3de52dd7a3d15d26c101cc847e098280f53b8647950edee8fabb2d
-
Filesize
5.2MB
MD56ed1975e3881cd0723ed7ace0012af35
SHA100a8b85b7e60ebd72ad2fa6d119274f74ecc53f5
SHA2562b5395d2a520682cc6a0de3528c4e1b49850f60a55c65e7c5f014c7bbae997be
SHA51239ae26c48b3e6cb360dceb34633acfed5f7d0addd477faef5e6446c2b73cd0a4b03ee22adbabb0d4c06a781827daab20d7f85418957f306637d2bf4f6742f4f0
-
Filesize
5.2MB
MD5e2cebd32362310e5edd3b18d5880c7d8
SHA1d7a15edf764d8a190c15be8aa3e2236e3e5fab90
SHA2560d73f8c9a7325b580cacdfede3c22381fed06d2770488102eaca96519d456474
SHA5126a82172214007327ebe5f983421556438aa7ebaa34fc1ca444d247c49e5c74fc6db82284f73f312641ad8b59691f4a31add4ee24e209b83ef479efdc866ef5cf
-
Filesize
5.2MB
MD55af7b172ef6df729a75900d4e7766df6
SHA164ce0b71a147777caf9c3bb137a9c30ad430a5d1
SHA25671310f16b9b06cd5b924d2b6cf12881bea7d46d6d5a0281d88b9699479e162d4
SHA512e10631dab40ea9fe413721626b2f68605f627c6dbc696f1aab714b2a50cf5d65215e020ec982fb2abe4e59c72ea74b06539b0570affa874c95557bd941285164
-
Filesize
5.2MB
MD50a7d4984aae44a788051bc5ef833b5f6
SHA1b49ddfdd4a2430610dab01734591bd531baf936f
SHA2569ba8aa5b404a35524ad55864c5b262413efbf16e7f5087f99d27cf0882b04137
SHA5128b1e1f5e52dce33b1a79a337b72cf4f8c71727d787d934c6f782219ec3c4ad32a908e58415c5812f6e234e442c075101cf27bf2d514f40d8c1721b62b52cbc86
-
Filesize
5.2MB
MD5a8c809f309a28681353db1f635163ffd
SHA1161ef6342b0014bd9967b11a9926f9ae9fceac54
SHA256044acbbf332e9ba06f17578ec9611972c95991b14f804674df31c34f6e5b4f7e
SHA512acc3fe7b9a547f0d36d6d1a783b98c9793e0fd53fd86b6d2bcc45557ef25994ab55aea0b5b9b3f32ffd635d8b13b03ce3975ce59762a4a3b7f8e09fc690f2997
-
Filesize
5.2MB
MD57df9bca7bd54b218c6ceec32feae491b
SHA1fd1aff18e8bc1c83ccd004fe33603b82f0831bdb
SHA25619f60940cbe7ec87084dfd25de70549d323f3475ccb786f6033674273a32afa4
SHA512ab6128332646ca195a8b3d9957a87d910d1b00ebf2efca4a2433529dd97b7149411b59994d26e797893626d254519cf2fb07595726f0c02ef6313ee0bea91afa
-
Filesize
5.2MB
MD5fa4061d0deefa2d059fc6b66fcd6fa5c
SHA1a82b093667b1d6cd9340821dd9cbf883c61a5926
SHA256f4fc258daa59415ea0ac865cb11e92db27bb654d89cbfe60b4749fae51a2c286
SHA51222410b201d54a2860a402633e5eb8912d99d8f985034605aa391d58c9b4b086ef8d628083bb6450931e109187f8dee4e23f61c65f8ecaa8f1a2dd264929a4873
-
Filesize
5.2MB
MD5092862a871cff01ab7f8e0bae26d3375
SHA10ab4d2c8a39bd8b5d045f6f82ba8c50bc153824b
SHA256276c1dfabdf684b43a0ebe3d7eec6115c6e1b08d127a09de51b6a0038dc7020a
SHA5127a5abae893a30db01667f36e1dc37a6533a768d31b6596af8ad5ac13b41b1ec5ac7a40e4eaaddb9ce7fc7d10dd52119246683f55bcd599399b695c0dfe14a6c8
-
Filesize
5.2MB
MD5d5c1edf82d44a3a9533c57e3926faee0
SHA1fd842d72e7b42684a24bc9ef52dfbec0e0ee86f4
SHA2562cbe1274a90983c9d9e1211d770e63f87474ea293f98a9bd49d8734ae5d1f6c7
SHA5129e179b190950cea4db5cfbbba11bb23edae2607c43181126e8df1cc76401a49c20c119af5240617111853d235e2a70d8b61ab79d9b4fa30408eb97e4e00945d8
-
Filesize
5.2MB
MD5d142c71524986c5247cb6474c7da45ab
SHA17e1ac6e20faef7d785d7cc9a44776e8045b82288
SHA2566725a96520e9510f3d815d047e08376616b8a9bf4a938b9117bc2bc888ec230a
SHA512f3c8135cc0f4c4a3c9e3345859390f27f7f2773207c9d449b667279e47929f3731a2d2d4cc772ef1b387e65aa73caf58dd54b6a1f4509993acc670bf252daa81
-
Filesize
5.2MB
MD59f42f880854e5e7802be926163d10e54
SHA1ff3d4b8e467a5524d36ba01036a5993085106720
SHA256c5a92c1ecd3e394dbe344dc48992a8d6352683b36567d807df55d0dcc0555641
SHA5128d0375a9389d18ccbf09d47035cd869170e352d74d29fc64839f2e552177bd1656f27dae7cdca35a62fce5c50c6dc36327b02abdccf9c70a217747c30ca557dc
-
Filesize
5.2MB
MD50a60616641d11b698d391fd1189fa237
SHA1c57734a4d142ae6e35f851181e9642ab7cc07528
SHA256c80bc3c17da9d90b7320291a01ecf9c901ee01ae3294ed34067e443d53b0390e
SHA5123c977d04e6367fb8cc94235584baf4f28c8ba91312c672c03cd057968b7e85bbad06cb8371bdaa4baf12804d578365002f9e1d3be68e1615b96de35917939f01
-
Filesize
5.2MB
MD54a551992821e05fa083f38370de6adf5
SHA13e337141e3e2a2ad0bf4251b2be6b78e0a34b524
SHA2569c59ecc9a07045edf7245cb5d3477bb348188202cf2d15070d4a58e0ba979fc3
SHA512cab6ebe23e4db858d0a951525b61ff54f1ca756ff65fa28a898f9f5f45151693323b3858909a4ee8baa4be1c4f1718796385e5ab61393ca78766281d1ebdb4fd
-
Filesize
5.2MB
MD5c6c05eb280ce3515dc1bad7dfdd897c8
SHA17c3b700dad4af2fdfdaafc3763f4f28266c7053f
SHA25601b098a9637dae605fe891b8031e8ef7b229e71b6efbe30b432ec8c81674f205
SHA51285ac0bf6ae4a9d673d0d45a9b1d25ff530c4bbb5dc71b4614519d895bdc0dd0c152217acc77da45bd4c2ed297293abc66266e4e3cf619ee0d7787fe55857ea66
-
Filesize
5.2MB
MD5b21532fe3f103d611feaa2aa64d5d902
SHA138f02ed752b3b91d2418529ab16dd0e57ec6d7aa
SHA2561508a66bb3c33f48c9e4556c266117ee50e82c576415129db2d1fcfc075bdf34
SHA512ad9b3e0c4a2cf551c7b4cb3e161d05ea55970e415d2d92f0030a45c3d8b505920aeac42c8219ea590a4761cc7b274d451bd87b89f7be6895fe31d3405370633b
-
Filesize
5.2MB
MD533f13d21ef523f726b2536be591b1cda
SHA14861c2d8b02b6f600a5809787ef43cd0c6a4b045
SHA256a919e42a3d5f4986ab0f90f5d6a60fc4c9182de183411ccfce4c45c659f9979a
SHA51236ed8405e71b271f5a4a81a69e4f3d9f5a7b74892852133dad8530a18340c138966ec216cac61336607ef60a4efbee2c9ce75c2b5e5ec590d2db6ed32e91c6ac
-
Filesize
5.2MB
MD54ecf89eb77f21b157fcf0f130839d558
SHA19e202f1ff7c156c01c39b7405eb77b0235970eec
SHA25643b95156516a3b7a98d75f709b5de7be7cac4cf7f0be15c678736af69b247a84
SHA512ec07bbb9477f7bf8885c0bb818e899d723bdeae187335bf84347a3192054a70848e345afd548fac37ca29aa139b7c650096885c41f113e7c1fdccaeb8d5fdb78
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB