Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 06:32
General
-
Target
2024-09-25_90b7a6a865a61f1b348b7d70c07baf15_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
90b7a6a865a61f1b348b7d70c07baf15
-
SHA1
fa7d2f2c93679c78c6ce24da13994a76834f9d9d
-
SHA256
8502fe1119384ce385e75d0bc72b477c5f4875078b071a7b75c312c7a6a38370
-
SHA512
b0e2a78bb5842eecf61b3057495c32dac6169fde30806fb6de6d25702f6185b27d432b6c60b66ae5ddbf15c07380f93b9a933eca127a5b75bf9de192829abf8b
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibj56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_90b7a6a865a61f1b348b7d70c07baf15_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_90b7a6a865a61f1b348b7d70c07baf15_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cVLvrKR.exeC:\Windows\System\cVLvrKR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\deYFFuh.exeC:\Windows\System\deYFFuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AsaplWY.exeC:\Windows\System\AsaplWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SygFuOt.exeC:\Windows\System\SygFuOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CjfCMEa.exeC:\Windows\System\CjfCMEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQzAgTP.exeC:\Windows\System\SQzAgTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MJKCBNI.exeC:\Windows\System\MJKCBNI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npvpoQF.exeC:\Windows\System\npvpoQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYRHvqa.exeC:\Windows\System\uYRHvqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrsmAUW.exeC:\Windows\System\OrsmAUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFjvaYG.exeC:\Windows\System\jFjvaYG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cFYXzxF.exeC:\Windows\System\cFYXzxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRniUzH.exeC:\Windows\System\CRniUzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ITsNbiQ.exeC:\Windows\System\ITsNbiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwgPUwe.exeC:\Windows\System\YwgPUwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuufHDa.exeC:\Windows\System\RuufHDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnYmVzj.exeC:\Windows\System\NnYmVzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nyCQLhT.exeC:\Windows\System\nyCQLhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJHZWkx.exeC:\Windows\System\KJHZWkx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VGMGIlz.exeC:\Windows\System\VGMGIlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWrPBli.exeC:\Windows\System\OWrPBli.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c1300a9ccf04bd9333dd0c420b985ddb
SHA1366685ad0b11eee061eb36bf51476f1598cea3fc
SHA256e751267c545ab960fdcd9c611f3e7ed35fe2e24971f142a2adfe6bae7799aa9a
SHA5123526b10e3e23eb5d883e7085a15e624b30a43ada2cb4355bb8b59e90e72b97b2dd833d774adf65bd6b9a0279511f29aca7d331af26d9cfe4b4e094a6bc3e97cc
-
Filesize
5.2MB
MD532bcf13984eb24f88017d1ffe44ab43c
SHA13a237f4ae628a402bcebc39a3720155a2c41d9da
SHA2561b1ab4df4f29fe95ce2089724b4fa3983478ce8bc7e7e4421d46b7004972977e
SHA512bef334443fc4357be9ef17245a0c44f1a8951a80271407367e464196f39d16f0c99b8a131133b6fd46687ef38035d60c97752ea20582a1bb30da2a94dfc414fc
-
Filesize
5.2MB
MD5e5593544912df258f7156ddb145f2e2a
SHA12c1a152422a7bceccda2098b6fab6351237b70ba
SHA256ea5155032405a44cb3292b93d21e51b55aa06435bd94cbdc7055a051582bc0d5
SHA512c10f98961ffa3b5b4edccf45e03d0e1055357006d4d5902194d4bad9d52d4b902f5585e8ac20b9efb547048910bf757b3a20eea60d1690a9c056844322f4b1a8
-
Filesize
5.2MB
MD5cf1e0e28ce867d0256240fd688a704a3
SHA1526a459d1dd943854da5c02fe779f6480260c380
SHA256a4cae58b07df370d74e195271dcb79b3cf24178a8ef4d0233672839587233038
SHA5122fff50acbcc05518b4109efe732ad684dd4bc2e9d444c363796fbe12c0fbe820813adc4d9313609e85f22d7bd0f4180b9f95d23218b2b7975b8db1de93a29d1f
-
Filesize
5.2MB
MD5760f07661cf257cf414057e61d50386f
SHA121f5b79212c1e87c7dc8fe6b6069ec8cb811c6d9
SHA256f9502fd638aa6132b1695eddff5bb9dc52eab19f79e54cc0c4e1a4dfd5621b68
SHA5126d85195b4c0a3749cf6075349e2107649eecf9ad836fe4092cb3784a93c285b0f3a0e8b1f98d7d6b35c72bc148870c8cf1a292551cc277d20b933dd076a27d0c
-
Filesize
5.2MB
MD54869c110e647faa20917c125adc89c66
SHA11cd019eec7868423b0dc669dbe6a2087ee94d14f
SHA256991a6a588dfaec04b76a3ffc35d5eef64cc0efdced9000de6f8ac7057f959c7d
SHA512b3f7395125df46fcb558bc51c447d00d3edae8a1356ca24ecd355fb18daa9263404e4148b8dc5806db1f622aa30c8a34cc7d86a0da4f0dbd72ca41c101c6669b
-
Filesize
5.2MB
MD50c7c51d9e4194e10c718a825059e9a88
SHA1fd401f8eae56fea5bff7bfad5df62aa9c793efa7
SHA256d4e47b766959d7bdcda94fda806bcab128c721932116b3262fe93327d2d5db95
SHA512e6e90e0265918731c07ebf1ea4a369de458611877b3e6aeecca7fbf78248647311fdd04f87c52e55a878edcf54019ea89e03c9c502024142cc3efcc94b069df8
-
Filesize
5.2MB
MD543e84b7d5f6b7e3eeeb36a6a2a74822c
SHA173dc70db56fa51c24a8d13bdcb7e994b2c1880f7
SHA256a8fae97ff225779a0b5ec3ac9cf5ba96ad321c77ac88a79b2ac3726345a9f1a2
SHA512e71a68fda4d9dc19ef47edb5fbd6aebf2c3d97c51039362241344386061b0a9a22cd0e7230b33ddd25b3437e7dd66544f2e2ce4c24e2b4909213cf49357ecb51
-
Filesize
5.2MB
MD5a82a79aacdc85dd49751f2c974e7e108
SHA1ea402e040255096f18ad6fc701c829b06464fe35
SHA256f4c0a718977e843fb7ae03aac9d6b94f7e275023763eb797d335c29416ebf5b8
SHA512921c2996716dd953eee48fafed5bcb3d6c7a428be95f8f34e18cbce295c8f3058e64700871793b50a7e1cb10d472d094796671fc9768ac9ab806df50d68c7b37
-
Filesize
5.2MB
MD595d08e376788ea1efe8c51ce65a3bcd7
SHA14c521971442beb7c87e1fb3b3fd09b375cbddaf3
SHA256342f32142324e59081ba596ba6b1797e3490048032cac7c5b74740151f04f998
SHA512d90fc9acc2e639073f63a3ffc95ba5bab5280ea3f3bbeeb8feac55f486d0fd137f2c49171c4370a71e1d4d82ee7452034293c4930d065cffda4ba4f36d5391ab
-
Filesize
5.2MB
MD5de23a725dcb1c96a450ae012ef0619e2
SHA180feb75aa7f25e8b564872a16dd7319cfa49db1c
SHA256ddee1dc97dc13cda910887f906452380886def9dcb4eb54419ea6644ee9c083f
SHA51246da5ec47d351c771a7ad7d29565e354e1f1d74c68c34735c8134d10aa308e40f7b76a7131fb9807fc25ee7f5f37aba072a51727aeb8ea0e27c0f449ae91056d
-
Filesize
5.2MB
MD58be1aa669aabefcf93b97b15fce88022
SHA1db77c985256f72bdbc5671120da9a5f56506f8ea
SHA256e53efe4be848b1ebfdd272f7df0084d8e63e33b068cd500f492089d9bae1eb1e
SHA51263de0e14252f5ca5737627b4479427af257658f69f7067df9c3404992e67b67a2384b36c685a4c3a2527ce101264cc641aa9d108dd3bae408f2ba6ddc35928b9
-
Filesize
5.2MB
MD515b243ad406bc41eb33d9dadb8a985b5
SHA1d52640bfc8ecf63a0f4272df15d6cfc4a49270b1
SHA256acc47a90ee7ed15ea12d095e69931f062e17e9efb4068bdd188456bb26fba557
SHA512bc3f32fc03f81be244e0e70b47233c741820ac0db08c9b237a4dbec8bda367b6da946b033f78ccfeb07efac9cd60e143f10a99eb6af63d39d5bdbe8ac29cbb09
-
Filesize
5.2MB
MD58946aa5ad15c9c3f722ef6781aa67168
SHA1fe4a9e3d4c552669fe932b2e44eb70d48c0add83
SHA2566fa8a782aa40860871718cf47fb30a4db95244d41e1e0268cf897579808f6381
SHA512ad377a737934aeff16a4e50fa67fdff3918c2231cbf2f2f6a9804ae3a2b7e74b7166437a82a86082138b2093f7b5da1a01a72e4608c756574038b6cec33f4296
-
Filesize
5.2MB
MD563152936d6361aa9e58d5e0f0819c1db
SHA198301d0a0677f94c2ba2445832a546e940d1183c
SHA2561e736278a7d76beff8b6953dd9160a6172feabf66b9eb8cfb9e9364b0bb0c17c
SHA51207c3a9fadd636680d66afdbb7f7b5b9ef065e9579925bc3ca7f959b0e79bf67da0793940df5990a6983789f248e995bbcd056ef80ff78bdb52eeeec5aa7b876b
-
Filesize
5.2MB
MD528b8ce541b5cc65abd5df916a5f2966a
SHA10a312fe59675cd0543daaf19e286f49890f6805d
SHA256b6320ecbc0e2283db59dcfd06ed9e93507abb0a94468d0c21bce815992a9bbc0
SHA51201cfb2482b8eae3ad491d52e2c5bc4e8a8685144e7854419ba220e06b136f0c012b932b6d9695b837c42e663dc1dbd62d67d999c1688ae5e0d4eb93877f0eca7
-
Filesize
5.2MB
MD57ec6d589808b2ce5735185330660fc28
SHA168be63928e4145b97e98bfd9b919b7cbbc778904
SHA2564cec526626deee1af0f59e1787c8de0c19cd8dd367487e5e43fdcc637c5ddfdd
SHA512de54efb1b1396b0e47edfda44f1212dabef2e7938410aeb4f9595da7a8bdb8bb0f79f15b3692164791c46d58d6223ef2fc3fe7dfcbbeae1277c1a835536c16d1
-
Filesize
5.2MB
MD52d68d9f39f5ae100a469ca890bba35cd
SHA17eab4d42b6926ab39ad9086194f1e40fbc3dcf52
SHA256f15e1ba9f7c127b65abd258861f39a158e2f8fd108847eb613adb4d079950161
SHA512870a8cd51dcfde0ceb07ac4023860ab1815a827581f163b77f056a830a86d51610322476d5a15c28cced8c05455b6b51ca0332d1b2e39545b667e30f0e688588
-
Filesize
5.2MB
MD57abe8b32a368ebb7e69e97a708d56cdb
SHA1279dbb9c0aabb020eaac9866a07a817fd7067935
SHA25617fade1d4852aa6e1d49a74fea5ae07dc38516e2d377e6467d9c20a151838d0e
SHA512ad6ab2f30804c7d124ec5d8c49792ab2263910eea726b7e4ffd762f84b7c6051b8f514bb60ce5c9eb3346ca9e2c88f04a72f9dfd564054dd20a740d2c295813f
-
Filesize
5.2MB
MD59ae0db484be005821b680ad0db1ce741
SHA12045622dc70d67fce43e833ed51ec84238edead0
SHA25643d6db70b5ca96590046860e758b18bcf57a38e88fed0fc941f1a879c3ae63c1
SHA51242295c80680644b22671129be9510130207c24b78b9974fdaa8e22e5db925a557bb0e6a5270dd256a88d46d1a26a52d87468b0ccce734dd88ffd17091420c730
-
Filesize
5.2MB
MD54dfaba4665e38db497aee2e3b85954cd
SHA10c325aa3f8beaac5333a7a08cd4463f06e8e17f5
SHA256f9284eb0106640379f80c30629bc7a4ec44cf93be735c5dba9339c5d06acf739
SHA5121d503e0bfa8865ed459e141f64cca1235f4d9e32a74b66f1de643add091f2d1dd9c234658b06a1a93be41e79853335ed7e5ad43277d2865cd3f38d69bcabeb6e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB