Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 06:34
General
-
Target
2024-09-25_9a8d2d46d6a411513fc76b2522c1b1db_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9a8d2d46d6a411513fc76b2522c1b1db
-
SHA1
ab809d70f7d98cac0fc1eb310b648ed3cc693fa5
-
SHA256
d0b1ced72dd74838406ba4724862fea8cd006b4d3a7cfb18fa97a930fd49e731
-
SHA512
bd41d6b5445fab879555efc5070cf6af5d132273260eb9c22db90d1a8044e6a63f6d8d7e64a1e73f82ba6fd004a33a53ccddab4d354d9179f35f766dddb0133e
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibj56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_9a8d2d46d6a411513fc76b2522c1b1db_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_9a8d2d46d6a411513fc76b2522c1b1db_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DGLKAyq.exeC:\Windows\System\DGLKAyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GslfWOC.exeC:\Windows\System\GslfWOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qSNBHjM.exeC:\Windows\System\qSNBHjM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBrDwAk.exeC:\Windows\System\qBrDwAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrgVBfr.exeC:\Windows\System\KrgVBfr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\muHPpUy.exeC:\Windows\System\muHPpUy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHEOxsw.exeC:\Windows\System\AHEOxsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glhpXSD.exeC:\Windows\System\glhpXSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VEHoUIg.exeC:\Windows\System\VEHoUIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xxIbLaz.exeC:\Windows\System\xxIbLaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVimehr.exeC:\Windows\System\dVimehr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YHLiGIu.exeC:\Windows\System\YHLiGIu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjKBPCi.exeC:\Windows\System\LjKBPCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fglgJwZ.exeC:\Windows\System\fglgJwZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RoHRyJI.exeC:\Windows\System\RoHRyJI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FYZIRTY.exeC:\Windows\System\FYZIRTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\daXlxYq.exeC:\Windows\System\daXlxYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SKmHJNg.exeC:\Windows\System\SKmHJNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwKewFv.exeC:\Windows\System\TwKewFv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQUGdbm.exeC:\Windows\System\hQUGdbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGWyIfb.exeC:\Windows\System\AGWyIfb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52dd62c402637845da8432084dddd43b7
SHA15febe759b215769647f330d76c5842dac0a03a20
SHA256ad43c9b38e27473000b37e9e7bb515d82e6291f9a10e8ee108200cc26096d9a7
SHA51253df62217d180be3912c2ba56462fc26cf8913e2a5b1b7757459c3ba0de2daf254ea7feac68a2e875f96b34a56a773ed6c07061263e246e8cc23ba4207767ee3
-
Filesize
5.2MB
MD5e539b3f5c2872ceaa5a5b50d556c7336
SHA10d51e2d5bb58b947131623187e4ca577ccabd6f3
SHA256b92b4744eb9d3121c6340262b9a9fd1dd64ecc586becfde93c04bdbf0b6bda5d
SHA5120cbe39cb5b5848f96d9038b66ea23167514e1db602512d4117b45e749b5534376a5a3310556518794bafe360bad9220ee58427b91a57f09f4fd305a4a1abd36c
-
Filesize
5.2MB
MD537fb92b7fb0300c409b3aba7b32e769c
SHA1c2489f3e3da367c6a7a720899f9578a8360f85e1
SHA256def3396d9e1cd73fc622e3c4e6d440d5a3c84ab10b4e74f4130578fab39422a8
SHA512e083176613559e3becef14149e9f9f1d1ee9d70c7f67c07168f8e58985820fc52e04605e0f3d7afd98ebafbf8ce0fa6ba1e33e554ed6d465e927e80c59111a80
-
Filesize
5.2MB
MD5ec8ffe0153e50c451be92cc6ffd2474e
SHA11759af7263c6981ec49ec9bbef8359ffdef231b1
SHA25610a96baac2b2142ed09fe59f34f0daca0d51ba135294b5f20744406d6150d1ae
SHA512bac93c71026f51729214e1cf8e97866d8c0d2c2fae2889cbc754a63da4e3c969220d1ff7f702a8121f1ef5dc1f08e924e4a6ad794a34dab8245c906c9757f00a
-
Filesize
5.2MB
MD50103e354eafacf346dbf34f3224f2fef
SHA11bb21a1aecb5c5015a5c83106a90ebd3ca28da71
SHA256f0eb61621abe618911057c05e1a4b564ebcc915c5b2a8f43357bb25f26b47904
SHA512b7cb976a9e2f4a0727e76d1f67e7a713406506d51efddc634931b137fec22d15d2667705fd4014127f5abe53a9d82e67e412b11e8e7ac401c3ce3981f3c7ed87
-
Filesize
5.2MB
MD59986f83adebe4f3e6b86bc10658e3107
SHA149649b20e98fd0a9c2142d2b08179c5de9b375fb
SHA2564d1ef6bec7ba46cf66eb7b600dc89c5f78a65f6d5e7c53b70026ab4e02fa9e72
SHA5124daaadd54b80d017bd61d01efc201d8647a5db38673a3db33dddc987104f6aa9377ff51795d4ba1a9ccca59c2e631cc6ece9edc5f89d08077ceb18c4220d29bf
-
Filesize
5.2MB
MD5b57a761960366b8a8d9d68384dfc5ba7
SHA1665f58745eebfa292399324171fe5e0a3dae7612
SHA256faa4771766b2d570cc0a98a0f66b7d3b2369419601c0109dab1ef31f6df6d80d
SHA512e5c41f0d0710804459a01e2d4b395b9e27a3ab7a9827d67506030d1069f4b925f0c8cbb066d6433285982256a8659a6e19a6a3a036b3586862f94a34e9d89feb
-
Filesize
5.2MB
MD55a51b580403e8d3f436b036817b6b9ce
SHA1e31bc8f6d228046703737880623b8d46b95d3b07
SHA2566b434743f633928780d43ddb07305faecaa02ed3f661c3f12af41c4c65d47f22
SHA512afaabfcd1e42076fc5a84972adbd5d608051a025e48c23d9dd817a7da0d03ade152c4d7271057ecb8aa0d14da0b295c7852b8301f0f8efeb00f7ad11bfdd151a
-
Filesize
5.2MB
MD5acb5ef302e5325b28d62bd0f66826df6
SHA16cd6952f4b5092358a7382ad60940a03f94b36d8
SHA2562205f1c57bcf3897462e2c9c3395b242b928a6aaae08943c7ad7f434798c95c7
SHA51212e965d72c6b3b4338944febb827403a1f6c6f3c8ebc36565d1198da658f7ea304b85d992452666b1da829c23951a9cfd597bb62f3f01085c1045e38dd10d94e
-
Filesize
5.2MB
MD50bc9b18dd4678fba7e53d85d7ffd5257
SHA17366a45282911aa8cc9cf52558d8d0b8cb85c2c1
SHA25672f8be256ad48d6b3e9b5ee88131c4c4301c14fb312ca445c07894dd0fae6e86
SHA5123aa84a15f953631a8f82b6524bd458a7f739255d693d9cb4cb86dc78a9c5b9e22147b032e006ea29f357cfe9443303bc5158b944b99768eee2e3213bed23882d
-
Filesize
5.2MB
MD5231e9540d50b4aed8b7b044218f83f69
SHA10b95d6f05bc90f80d7fe496a67660e60d457bce5
SHA256c02d372875a2e2d38d097e0d69111dc4cd1565f42aa356c05a9bb5c739c48ff4
SHA5129d5cf9821eb5a78af13886361cfd5452e1c78fc46920052c2cfb7fd9b559b7062b71be9dea264399708665207979b16d3f1c59ca68a05c5cbb46aeda3586c817
-
Filesize
5.2MB
MD57ddd6c616ad21aacb5a0cdd4e8b6a2ff
SHA1d3b1da9c1e71fbfa2d35ac30ee64f0051f773faf
SHA2569347eb9d8a8e04fbc29dd0fb9fbaff7ee9b6b97364487932f8708e97b561bf54
SHA51257dd057b1812b377b43bff0336fd0e62fb7a9f844f871550d00943c19772f11ca26954225120b6e3af7d49022c36cb1a8da1d654851f62d96fe40c8bfa0022b8
-
Filesize
5.2MB
MD52c84fce85cc563747610ac0927bc83c7
SHA18877510b4baf387870df90363fafb0c179eed813
SHA2565659a1bc5ddbe9cf984cf1106c2bf28141ae8145b61d462d000f038141deb0b4
SHA512963e2bce9428b4b273701089f5a82b5dfd42d157bd3642bff15fe7b676f9dd4b07dc0fdd1ba5ba85eb7a40f518ca8cbf8d743bdb29a7d9fa50c775393c69f182
-
Filesize
5.2MB
MD5091d9f821307ad8e94a85c3ebc3ca2af
SHA153f1450eca0836ea973d1f467bdc9367b568027a
SHA2565ad1757fa42ec5d1f3038cc29308ced0e42780d77776c4b89fd71e9e86e90fbe
SHA512c198dbc56f63d080b49d17360636009003f168b98b367c84c1df97a1b84c139dd270fba82a8dfe8e9283d76b1af739a23e4aecb953594e5cb87c539761d72093
-
Filesize
5.2MB
MD5feb7e0f0642a31db036cccbd06644d8c
SHA10388aac64ce76c785d0ae98f7b61dd7df0bf9e59
SHA256adc0e0fa57e6f4a9e7e68bcc02d59361e85bd69ea2544c6fae404c91ae44a0df
SHA512a6c1c1041e0d704f96271458c12bf51cf71a574115fb5139d801c835808ccaa51830d6b3c9068469889f2b8e05c4f378f6bce4893099ae04c0d41bc69214813b
-
Filesize
5.2MB
MD5d7ea5f4f16af3dd93b4d9262da325f6d
SHA123ad9619cba3aacd16d33cea3a11092c4a1702d9
SHA2565370c892f95952e09d07686dba17c3ae6b2f44ce762a833b6552c2d6159c8cc7
SHA512695466d10d443ab5c1a06d3c6a4cbcd4245436a6f0637b97f27c61455eac7cebf60c418de850a923e23209aced2785a6e0d883da9d2ed272d17731cfb9a6c8fc
-
Filesize
5.2MB
MD577bcc13c5f3785559c32b44110294aa4
SHA13043673522531b089a1cc65742e74067436de37a
SHA256e8d23c5f32e5dc7a61b10cf21258d006955a935e2bf7fc47f07f5bfaac574fe9
SHA512685906c8565cf22fdce43bb7cc7cdc31e62e281b8abb71f58d76419075b5271a521cf57cc1d2d7d30490020a185223dff411a4ce4f199a928b5fc02714445e76
-
Filesize
5.2MB
MD5b79bc3138a99beef36e33a6a6148e178
SHA13af9b16a780fe421b0df440206580dc33e802264
SHA25671e3f7d6c649a6925a4b3875dc1e036bc82160cbe4aed910e6dbe3b5b2c4cc18
SHA51202fab4560ec5e40bb9b6f61d2dcaa4622e30eca3b870bf70160cce294e59546f22a08593d973bd5c14a0833b210a678dc41b599bb2d7bffc19d7a4bce857f9e9
-
Filesize
5.2MB
MD583a8fca6f0e044f134ed1f26be46c6b8
SHA1baf72824a3c402841204eeb386f06eed7f6cea43
SHA256814e6e470a28a0791dcec050fe14364b63cf37dd860968cef26b05b122a2d2b7
SHA51291da95a06437d8e52e2604f1c90e3f6c5dd8d1ac25268d29e6df446ee58d0aa4cb92a48f59768cd9f1aca8ff31b8f6a28fb3ca593e5a294b4ace24b6fb9801d0
-
Filesize
5.2MB
MD521f137f338f661eb30de169d6827245c
SHA1cb0d0fc070c41ff5812fec8d76873a8cd04a5741
SHA256bfa69c0d2b1f848a1f1ec7f26f51c703511d0fa90078dbd9fa844d49a9edaac5
SHA5126878d596a1c852d5ee3af62d77dc1bdcf09e450bd1e4441567b083efd503a894f03aba12a4bd5910f2ed6738d0ad8c048e21016605270269762ef7d1858350fc
-
Filesize
5.2MB
MD5a95502e08b61ec09dd9ae6e14e3e8556
SHA1e1c1daf051e984afc1358ac117c852b4da2ea55f
SHA2564ba2dedc21e0f802bec0292e37f00baa1d9309d4384be3fa8e3a853d7aa9214f
SHA5124fa8c74816051b3238fcd46871e41182d004f62c6a4a57b4d09a9e3286b3b1f8bacf81120aec9b1864a47fa1d88cd50fe9821fbb00169f9ef98b680ba6c05038
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB