Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 06:36
General
-
Target
2024-09-25_b54ee0638dd41e55897b53d2d9af5065_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b54ee0638dd41e55897b53d2d9af5065
-
SHA1
3de9264c025730c639cc1f9a15e6ba3e458d8ccd
-
SHA256
5046053cb4eb2abd02efa11f08e548060fa0a86c10b7ea1f55ad5e3b5b3f6316
-
SHA512
90a5d39536cbfbf280464d7c070fdf3c8ed22693a475403b5470e07b2bbe5b5b4ec64131fc81cae2c72e8ddf52738bfd99830c9dccc381e351886f3f7a652ad7
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibj56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_b54ee0638dd41e55897b53d2d9af5065_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_b54ee0638dd41e55897b53d2d9af5065_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wgRXajM.exeC:\Windows\System\wgRXajM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HhOpXZA.exeC:\Windows\System\HhOpXZA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EOpwPqI.exeC:\Windows\System\EOpwPqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HXgNTcc.exeC:\Windows\System\HXgNTcc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTCsuQB.exeC:\Windows\System\FTCsuQB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQcTYcX.exeC:\Windows\System\cQcTYcX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSgjwWM.exeC:\Windows\System\oSgjwWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MOpgTGy.exeC:\Windows\System\MOpgTGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qKIlOms.exeC:\Windows\System\qKIlOms.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EyYqzCB.exeC:\Windows\System\EyYqzCB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hShceIV.exeC:\Windows\System\hShceIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\puSDCaG.exeC:\Windows\System\puSDCaG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bYPYkyT.exeC:\Windows\System\bYPYkyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oqIYJEr.exeC:\Windows\System\oqIYJEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UOnsmOS.exeC:\Windows\System\UOnsmOS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzuTmoM.exeC:\Windows\System\WzuTmoM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYPEfvX.exeC:\Windows\System\AYPEfvX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyLmOyd.exeC:\Windows\System\fyLmOyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhgkRqp.exeC:\Windows\System\UhgkRqp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZdXBQL.exeC:\Windows\System\wZdXBQL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cFUNIek.exeC:\Windows\System\cFUNIek.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55d277a20c115d33c6584c3d8c31f084e
SHA129099aa8495216492dbfc703cc94680946b7eebb
SHA256c089f397764e48abdbb2b7a735864b8000d2e9a0449ad7bfbc40174ff804ec3d
SHA512a98b69d4320786e8e6191c7a30ae952b8df0e4504fd3ff657b34afe35f2a9e50d342ba412f1d887501a350574776105471e204db68e4dbe6e166b863a6aac6c1
-
Filesize
5.2MB
MD5e72ba58db8853fff108fe838578b6ce1
SHA1ce97706facc6df37210c61a92c99673e084cba72
SHA25682de6b9fda66bc9caa70c5a763b985b594090e0dc6f25f67f727c2d3c78ce4a7
SHA5124cfb00cde9fa6c508cd6517033ef9c707a1c47a26b7d67cde796b96ac7bef9a80caa45ce7d927206c133b93c0db1a1d23cccf81aad4d633cfe0d005911003043
-
Filesize
5.2MB
MD5d6abb264b1298403f53273c5742327b0
SHA149934bb6b6f7064e195fc431df4cb022fb6aa138
SHA256040120f75ddf1024fe1162c740227606ffbb27a2a266e5df129e1a75c50f6d32
SHA512fedb56fd90eda5016258146397a4bd64e3fb46d9dd530193f430e6f0151a2aed81651e364a609ce3664d3f18dd8ba5dd0e50883beba73ae4cf37635954f14b26
-
Filesize
5.2MB
MD5c645915135dbc68dc44409db7fdf2146
SHA1f91fc096aefb4f530f24ae3b62f811861490edcf
SHA25689b172363d221e8e47f5e1a5ffe2682d27ce078e4558271c2682082349cf8e4a
SHA5124a1714c14e8051800d4c4eae330e3d38c8a8d048d09a60847ec85787a1c8b86d0697b21cf2251a4337d5193e02516b78a54e9072d7c8e7c4712b22b892c5ebe5
-
Filesize
5.2MB
MD5f6932c02bf7e0e1b43bf64570e3a3c3a
SHA112ca2ca93d4995dcfb6fb930a5445f41f916e11a
SHA256f633c2b91907306804134326fbfd05f2d42b5da4010220b061134ecd494e7bb5
SHA512ecada1f3b3c4bf11d36aac165abdc861b2e3038f30b428d42923fe67301956ba339f6fd0f19d59d83aabf2ff02a1431ec4c8f238551d0cdcedea3bb19699deaa
-
Filesize
5.2MB
MD5bbe3c3f92c79ba92f589a1433792edcf
SHA1efbffd74e840c53a2216f13ebbceda905bd82d3b
SHA256e19fca96af735bbc63599dc341f3a64ed03371aa2b24458b2a7e293c77e945c5
SHA5127471046ba894565e6ffd1eba4535af7edd8a21c26364235272c0c4a967ca2e50b421ff953f4975feeb4ee297ba64c9407a193e022a61d38f868a9e9b08e91d52
-
Filesize
5.2MB
MD5af3701a91d93b25c087555e8d21e9e07
SHA1ee99bf7321fc6ced245a426d70145c961fa854f2
SHA256a79a8e6932d0999e6db4aec22899a65ae84dffe564a33d65cf40a14a25e26c35
SHA51273e1d8bb099376a0c2b321be242764d87623e80555ce42b011c03934243c79dc77a3ae6d42a4e123da0abd64e505d1e14d78f8a521be1192be30740eaf8124b5
-
Filesize
5.2MB
MD51e4a649ec28ff7107e7f8ca45f9cb727
SHA1db4bff6a80afbf3694aa6582a1b5ffee32d7e241
SHA256baabd2de81a953d443e0cef55ccff69b8cf765ebcedfbc1c7121d5eab1560630
SHA51210ebb03b85ed82b1821ed2151d67f8a9f5794c3764020583c62df9de052c97de2825da9c4535bad5779b8f746e14cd7418bda726038ac070ab141200716f225f
-
Filesize
5.2MB
MD5abd9fbd24a2fae8bd39008424fa2961a
SHA19ee90d726220793bc378cd38538e7f6b0ee93f10
SHA2568f5f472a047138fb43f8361035935210204c78270fba74222939bb034163e9d0
SHA512c4a7f06db9af6d6572e2d3840d2be0a81932210284a36bab6b8bc018945b921bc895b9d32b58ee9fc4bb11e4dfc4805312f8ebdc30a85ca75616582ab3cf598f
-
Filesize
5.2MB
MD5172337364adf2cf91b4568b7ed009fcb
SHA181ba51a204a86a3e09cee82337af7a7ed7721b40
SHA2567ce7e5ace55a6eeb33cc4eadfc6b9207a4b252825a3d4f2f4066dd17646d2577
SHA512053a1c1dab4048ff4f619b7596c0b832e17aaee2357d1a04459db54ec09f054d3298f1fd90fd7495344ce0b57aa67b5b660604ea1f229050134d84efddc1d461
-
Filesize
5.2MB
MD515d471a3a10c0b93b78ea011215a69c7
SHA10e68c220fc38424f5f176edc9058f9a9a1352e05
SHA256f20eb12a684639794a768216e253f631c98fee0d8293cf4f1b8cab7d15945477
SHA51267800807e96eefd4f0b3e69875117f7fe8dd3b745a369eda97e870d57b3eb06165c2faefbc878048e30e5359faf90eb8f3cb52f2b8ed0c312df1f87ca51cefce
-
Filesize
5.2MB
MD5e6720d5f075c25cce608dfe099f3a947
SHA12e7c821b37610690b7adcef23009e58fca782533
SHA256617a4567f66deee415ffe5c6b3c0d5a5c1fed3d776d04247d93d7bc106dd3ed0
SHA5121d226e4cb546243b4052c24ac9275cc5f948c0a8c1bdf9d61f456f9c5a19a9fb91daec72c0a87be7e0069c44e580f832477306d208deed0ec7b60baa3061ee96
-
Filesize
5.2MB
MD59c7ebdbcf49b21e3d5dbb75f00d3c572
SHA17b7524d647c1385ad4128751d82860b192ca45f1
SHA2560900f49e40d50570d5460858e34f5ad1f7184d891497e25519e859095711106f
SHA51215886431edcb05bf4427a05b2887e9a66f88b678512ff50d9a0d0acb25f21d73ce0b0c89d2a2187fcf422e17128b3efbe87df79758f7ecbf2746aea16dbda58d
-
Filesize
5.2MB
MD5b35850147ddfe221e591ce14cb1a072e
SHA1beb875c4d26340ec67a825496d47f7e18d4db6c8
SHA25639a3f9b04661a59e90463c516f2047b514fbcb4532f251bd875645660a87bf20
SHA512079704159c5f9b58bc45d9057e956c508c5927d029802a874d5b64ac2d3af170bf223cd7630e562b494cec4f2c27d644e8705198401d5455577c012cc0c3e2e1
-
Filesize
5.2MB
MD55d60e7fbf608578aa760ab1ba8a060df
SHA13af88bb18f289683984b84514a27d122df36be6e
SHA2560d4abad3079356b826302297c5d9ffa6ac0efe5c0be841fdccf4ef2a1a0fe4dc
SHA5125d09ec452c0e5118eec4c80d58b1e9bba1153dbac54329de1d6348cc484171a2a8ab228e449de4b48567ed39c41f5462edc8e3aa2f5c9eca51a90d97cf74379a
-
Filesize
5.2MB
MD5085eae30678d69153f04ed5a882b8f0b
SHA11c52b59f874fde14702f60bcb703a93f930759ad
SHA25621b2afa4b2bd3f12516c92481ce12afbe01ccfcee230ca79bf013300c1f269e5
SHA5123aeee3596fa3a58390ebd1380f587b83af299031565d05275a66292c35d299492f2d8fbbb5a305a98d94a77c3904c9b80399cf2a52f34ae1b1d171539b3bb9a1
-
Filesize
5.2MB
MD5223f80305aedc8153b34270245f2091e
SHA166698248cbc0f06ede6de1a77375c16a69eee9e4
SHA25649cafadf76d157eaaac003cb39d87dd3fca726a9285ca95c5bc325a539e91c15
SHA512e78d0b7af6d19b233283a430101abeb0c8e84c279b441f984f6fb6ab214de80e976c1c42ef6ac9c3278eea8e739d1b1088eb20dc3e06cc84f1cf7e099a264db1
-
Filesize
5.2MB
MD506a5b094023e73e2f2a9548f0befd8a7
SHA1186f83f7ebf38ca146567aeea8250df12dc05556
SHA2569636041be7120cc57e79be98cc3572be8116361f2d64b89fbf9da8cddda16f1d
SHA512d7be5f7bd981a13a8ef5666f68009ede029b5c90eaac3d9c5100bf3e12fc81d9584b9312a8e16ebfbd79a5cc983caadc31bdf11f658d18076f25c9a8516e8107
-
Filesize
5.2MB
MD52aa4bb5f154fdd3692122cb62536093d
SHA1db5e14d7b9418419d22715b08b5829b60448c929
SHA2565eda30204481754fb8109dc4c634ad9cb5b92a55a056a4e8fb76c452d8b70591
SHA51231244990b909a5275f8bdd9190f9e1484ad487aef4c7f82a2332fd20eb9430f9efc65e65ad795ac29e716117503060a921e63da1b1b5b43db0fe67f4f1c01246
-
Filesize
5.2MB
MD5fc2f8e9527a8df14eb418a1e7148c021
SHA1ae6437779bbf3f8133ad9a654d06191141600ade
SHA256f0821f01abead069e54e0e3c0ba63486c18c2aad604944654aaac0abd72cc45b
SHA512d01183cb984a68f422b5f734781ff513264f4de4581f75b592dcb25804c2d3d9e6cb81349f645b71cc91313d9af8ab3813758e0e80c4c7d9093b2c4f5a7e5ae2
-
Filesize
5.2MB
MD5c5e43a13d9fe96aeb093ce69eaa2e85a
SHA19d91f00f4b571f4bfc03ae8a773e878928f84e16
SHA2562948057e4355a12a3ca7112a9067bfb5418c7e3e4c32d37f309af31e96387cb0
SHA51294e7c652c7f3ccb92e933c48424e5a7219a10ef1a2a3856001f49e76fecfb01fec1f245e22752f7c4a5fa9adb467affe708249365147cd6466a15f2a13e3b983
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB