Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 06:28
General
-
Target
2024-09-25_55045cb019e83416f884e16d9890dcb5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
55045cb019e83416f884e16d9890dcb5
-
SHA1
c0511ba40328cbcc55a287d188c9741ad7f8819d
-
SHA256
0c0caaf55ddd9d8b8bb382857d495565c9383f645ed46c4f1850bacd859f8f6b
-
SHA512
e851d92549ee66607191d89d7176d399ee9c3c46536e591149595b53b7e59248dfa40e135aaba9c11e2aab8f774997f13c36bf4814cd31cec57594e900d27038
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibj56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_55045cb019e83416f884e16d9890dcb5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_55045cb019e83416f884e16d9890dcb5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oABKUtF.exeC:\Windows\System\oABKUtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bHcSAPn.exeC:\Windows\System\bHcSAPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMQVszy.exeC:\Windows\System\TMQVszy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HXUVtiV.exeC:\Windows\System\HXUVtiV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBKjALJ.exeC:\Windows\System\tBKjALJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhZhxOq.exeC:\Windows\System\WhZhxOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEWBgbV.exeC:\Windows\System\zEWBgbV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCZuZlf.exeC:\Windows\System\DCZuZlf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWzMOuO.exeC:\Windows\System\mWzMOuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\whcNfyo.exeC:\Windows\System\whcNfyo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfJQAXr.exeC:\Windows\System\jfJQAXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xtbzKyb.exeC:\Windows\System\xtbzKyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxYlhLi.exeC:\Windows\System\RxYlhLi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CWuCziQ.exeC:\Windows\System\CWuCziQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wisbVaR.exeC:\Windows\System\wisbVaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEsQEIi.exeC:\Windows\System\yEsQEIi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpxKBeC.exeC:\Windows\System\gpxKBeC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBpvNls.exeC:\Windows\System\gBpvNls.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\auKKHKn.exeC:\Windows\System\auKKHKn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIfQrZX.exeC:\Windows\System\wIfQrZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYWzlje.exeC:\Windows\System\QYWzlje.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD533f4423ad2ad76a9e88e97f38b951e79
SHA1da30c8794a2d956836ba92e48bf60c9d3f670cc3
SHA2566de6cdbb779eb494b32f2a8c9fccc8e5cb3c11c838123a7ad5b5d41c5127907d
SHA512a33aedd0aaeb5c38dab85da50920b27238f4dd553318cff9db55e1a906db354e61fff660b4823c5e66c73fda0f3df07c3edda4d5d111f6e00f2d9aa3db8e763b
-
Filesize
5.2MB
MD5dc2f63c4fa38c874a1cdc82f82917e81
SHA196290b00cf8f4867b8e47543682a2f224c21bf7d
SHA25622f823b84e4bf2de8d6f2835020578b217dece8b51124484593aa1b8304e227b
SHA512e5ac66170ecabdadae55274069409407fd45648302a78382ce6cd52ad91d715d52f758d041be3ddcd364708c386be8c93cb909bf38a7bf236d3307d3b4b9cc75
-
Filesize
5.2MB
MD513e0ec3e3879258ad4d152103c01d800
SHA14396825f1875c1442c0ad446d28bc666de74750a
SHA2561de6ac9d52460596e953dcff72c454fa6a351ef431a7583ae536ba00970bee7e
SHA512dfc60191b41d992e333d98803e3abb03fa046e89232c554341cee8bfc5406de971b3dc1e9ce5c8ac4a8f468cdebd407a555d87b0051e166fdc15cc8eddb922de
-
Filesize
5.2MB
MD5a1f51e56f867612ee7622128c5fff634
SHA1454829c64ac353a0cf916c95d4f1683b45a51322
SHA256200ec93a4c72eac08adafe511e876eaaa919c5a1ea6da36ff665b49b24006c86
SHA512b9c696b8e12655d96b76afd642aeeae12425c3166e7d4be426b42135f9e8c12f747e039e8bdba211d4710bcf45d9692cbfa89ba87b51a83fa31f68842f8076b8
-
Filesize
5.2MB
MD5b1cc377a19710055c6bb37806b514d9b
SHA1fd23d4e78da32b1f9deaa0946e88757e3c4e8e60
SHA2564c9aa7638b1923885296526d6fc180cc83236526295fd8e9396ba72e268f2db5
SHA512ea5b31aaa764f6361951d50a1ff7fa6432df7fd2f852e87f61726ab6ec76ea122f32ac62e088383c09a1fb4cf2c90c345f9b7cbbb9de563f715e34fc1843dc15
-
Filesize
5.2MB
MD56eec70d6f54b40ccfd7f83fae56f2237
SHA15bda9215b5c01fbf6c9bc9416d5cf88a0af2de50
SHA25614c8a3f6b5ba9eba05161b0ebc44b0d10345c54c989dae606786d2fd07044c8b
SHA512dbd5ede10e0e5588c725f65af75d968df9b12cd6b260140a1e3a7a9f63f8060b104bfa6c0c2fb81b2befc681687cea730c5f62d9dc7841213edbba070ad39745
-
Filesize
5.2MB
MD50295a9a246d7968bdeacf530f29070a6
SHA1e0c2d82b234e109030b9de6f3e32c20f10ca7914
SHA256fa59b059f1ad31e4159ad17239d41f3290d7077dbac9094126039f0fd46d39f7
SHA51216ed2206356e702f028df3f241655d31c5528c655c3b398ce4bc15430cc9a4bf2fc9385ede1d72bdd5c3b08d228457a14061993552419a89362e04f0629d4e62
-
Filesize
5.2MB
MD554867a50d5cf2387ba7465090f12abb5
SHA18df75106d14ed209db6d0f85767692d0dc19b8a6
SHA256d01f9ebf23d34b8410b1253e55d1307a758d2280cd0a610860133fc4556fe6d6
SHA5127d980d14056cecc702157d854ac0523645d53451acb470b242ff020b8bb8b22e6fe167cdbd0cb33aa2e44354b4d438423f0767d2a9f6112bee4961085d3e42aa
-
Filesize
5.2MB
MD582cf63e8c8bc273a98a5c14f88f88ccf
SHA13959665584ded7ebf32864607c47c62d21a5723f
SHA2567beefbd4e2c9f1e3f60d043139c13d9c262a7bb8dd56b22c6d503cbff8bced20
SHA512aaaf158184ae1fdc264d53156939ddaea6829ff5cca302d7c56d4c8f99231c2cdd776860aa8283b6ee165c516370325f691e0b33da67f2edf11ccce039cba9b3
-
Filesize
5.2MB
MD5683a2f02f2c2d99936915b9bc5eff019
SHA15f0f8d768addf3265c413ff81b41ade5fb698024
SHA256cbbbc7d8ec014dcb7bf95ca9b1f587908334e5943328b2b72ab81194460ba50f
SHA5121667f5c208d69ada9b6deea1cfccbc1890a4b318f4ffde5618dc33ad2f3ac50074657234b44c1d45e277e6cd366d5adf4255dd8dfd8a622fc3745573bd759d45
-
Filesize
5.2MB
MD5de318839f8c7e21a6f0610af2dfe3545
SHA13d06083f285161d6b3ae18d705a8d99d39b95b32
SHA2566f1d6bb6e140436517d8b2203fa911dff89492a3c754cf1f2e441e994eab3cf0
SHA51269be6ecc443851ba53bd870f8eb690ea624c525c95ca42aa15c2fc66ca35a9bc8bba9cd77e31ef34d9fd40082881458c8b7620762365232911457caf5e46d84e
-
Filesize
5.2MB
MD5feae5d38056a235689916570c50626ab
SHA1a95f61cb3786c52ee3835f57299eab914726258a
SHA2568e078f1413a5d2827691254d191c38758992c393a121e67ab2104cd9a830e458
SHA512145735e297ca8b41660bdce5cfc906a80d65d08af062a8a1faf6b3e8d05f4207a866e2111caa6542cf4524c025309f8489ea0bf4b6872e685b78fdf6d2ccbadb
-
Filesize
5.2MB
MD5aadb3a804c56a82aa4bf021ac7c3e8ac
SHA1dd14c3105b50fffc192ce75e965fa76a6a892527
SHA256e5d19a2d12983e49c5113eb33576dadbadf721474e0b18c62f3a5b117daa1a58
SHA512a62d203c45e1e1c1c4b7de1d547944bea7cc71661f6c8adbbc9189ed61516aaf9067eed70acdcf7e69adee6449aee69e78a47f7e85be1908964827d1be408ce6
-
Filesize
5.2MB
MD50b3f8e4533d06bc76614f19f0aa6c781
SHA152a7b49882185ec868af40867e7c939961b4ea58
SHA25674c3394e65d1da86c084d2c284167855b11aefa33a3b85fef54153ab36aa3f66
SHA512e5b5fc3fd4c022e26f2128d2594025875be52d609e5c02510993837897df30c45c4b87596e09f7dc9ce4c857d64eea7dc620262bd39bae18e39bb9452c7cc9a7
-
Filesize
5.2MB
MD51d0321cc91b10d7c338b7bcee7f1b9cf
SHA14f55b17065eb7031269b48108a3067c5d9d9b126
SHA2564e38e6f966b7584d3d382c6fe9fac684244094bc947c31e4c3e4a509fc984768
SHA51246e1e4c6b6dc7d19fe3adceda4296629e33df8a24635851d570309d3c4b93fe0ed5460f83ab6bb877f5770279a262c14fbb27e32b8dac281f1c7a907531f4970
-
Filesize
5.2MB
MD5693f2568b8b5b8776ad8a24959e6dbb2
SHA1db670336a8cb7bd7560f063c7f632d490a7d94ab
SHA256ab77fe99ab0abcfd26b4b47ef4261fb78b7ed9e7983d0e58671c9369b1e48c55
SHA512fbbfe02953d4838c423e6d38b004a6af784885e65d8cf9b5df9e6ac61be79eb676339fc6e7990f599e43f18a3159f2d7351751458ae20f659f143ef4818b54ff
-
Filesize
5.2MB
MD534d7b26d0ef71de8aae084c335e76e39
SHA1b884e4c07970fab38189ab2daf7977052f84673e
SHA256e0a8f989a7e8287417509b92635f0812a6f2a153ffc2266c494a778ef36a115b
SHA512fb1c7c88a8e8d87413fc3e6ce9598406eca6d4b5482684119bf7ea9e314c0dc1dca185a65e88dd9ffa8bc455e86d3088f2821e3645d0824243c115415787336e
-
Filesize
5.2MB
MD5d2ca1b09ba293b64f3cb2e479db6dfc2
SHA13e31c64e360bb64b1737d6d0158fc9ef1efb1589
SHA256f1e9319de4a027d11bd6d61ec83dccab6e3b92d98941a40bef1768e6a9f5b158
SHA512fe4206467cb36dfbe824b608387760ab1a82d05a827cae2b28d42044fb627fd285c4e1ca6ce3836f5193fa72d0058930b291ae281ad34f27f0ffb89fe6dd01b0
-
Filesize
5.2MB
MD551b7c2e88a3d3a3acb21dbd3f6e8d130
SHA1bb37ea3ff5d890051c14a2af48bcb0ed7e485ce1
SHA2568a7a9ace64faecd3981f6111c94ee51d5aab0af185e5f142f377cdd0352de8c6
SHA512411477b018e85c3cac08d531fc3fede3a6b9b90221d9695a5140106de4c11187439274eccbc3041784b0a0ad4ecd8ea8cd8f542b3d65fb64ce74a4ae1529d1b8
-
Filesize
5.2MB
MD5b7533a3041f125530fa6d3f00fab208e
SHA13c62d3c49a51bbacba2fbe36cdb3258d4a7f0ad1
SHA2562f1deb91756e8eda23fc6c198dd27eaab3fb0f04498c8dc5512b9e10586cb625
SHA5124f97768f645437b25044b0a6467726b0e64403a7da81b9422632661d77e1eac9c0050b9343024a4998fc87287ea87f28297b4223b49e2144a3c5831fc705bab7
-
Filesize
5.2MB
MD5ab66e51090d8f5109b4eb45051cf70d2
SHA15b0fb6ef5e5263437eb60ccb1aba5b534e45b256
SHA2565af1c71954cb586065a5f6c2055eada7217adff216eb118a198b949b6880092d
SHA51256a1a35fa7180fc433e7b8cdcd05d493fac11b09a0b250e03b3dd45bb511b3044f6a4ee3a1e9d9f9b567b80e34d6c7f7d7dcf82f803601c96fb2e69a363f557a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB