Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 15:45
General
-
Target
2024-09-25_388331c407977be153036d0831c093f1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
388331c407977be153036d0831c093f1
-
SHA1
874485310492c6603b6a977ef75e782616ef1e6f
-
SHA256
c43eead33d8297f81c9483bdf9be615c86868fab45b61b929051b24ac8da2fba
-
SHA512
afd316a535ba29e7aef40afb1b71547b1f46d3b53ed7984d70a3154eadb2d8e1652bf11ffb4bcfb85d6c377ce53ef4335d514a0b62101de31f431751be87f90b
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_388331c407977be153036d0831c093f1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_388331c407977be153036d0831c093f1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XGuqXqd.exeC:\Windows\System\XGuqXqd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVpzjwI.exeC:\Windows\System\DVpzjwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Rooccnc.exeC:\Windows\System\Rooccnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYoHVZP.exeC:\Windows\System\IYoHVZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRwJYrj.exeC:\Windows\System\pRwJYrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjmJheL.exeC:\Windows\System\yjmJheL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\myPNBCg.exeC:\Windows\System\myPNBCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SXSuqEu.exeC:\Windows\System\SXSuqEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmzOADt.exeC:\Windows\System\ZmzOADt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohqPMhC.exeC:\Windows\System\ohqPMhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UiCLdxh.exeC:\Windows\System\UiCLdxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVYXNmD.exeC:\Windows\System\bVYXNmD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJZmIeT.exeC:\Windows\System\dJZmIeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZaXQTX.exeC:\Windows\System\rZaXQTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTIJJGZ.exeC:\Windows\System\eTIJJGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArRpzHp.exeC:\Windows\System\ArRpzHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tRzgLrq.exeC:\Windows\System\tRzgLrq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPwUVqJ.exeC:\Windows\System\kPwUVqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYEQamK.exeC:\Windows\System\VYEQamK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrROKbt.exeC:\Windows\System\IrROKbt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJzZkRQ.exeC:\Windows\System\sJzZkRQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5a2c6d17aabb0c3a4d984257276a0665f
SHA1810350f9b2aea9f4a3e9be77c55720baa5bc6e36
SHA2562f8f11c4571b3698e4aae64ab25cb40df49c038fd7423b95c61130c55fb42182
SHA5128d65d5400ab4f0d1e0c1a2deccf7668cac4e1db2fd7428fdd7c9d7dbdd8865d67c7d67495943014704ebe5a32bb1154a07f076fb833929183e31f9ef1aee6743
-
Filesize
5.9MB
MD503c6d20b58ffc8ab48879247d5c40172
SHA15c842ed52aed4aaa8fbba3ea2c5ef1a3b9cabe0e
SHA256666f716d48903310b7543a1d677420a858659e0cab7712a4ab28b44f6a96aa2a
SHA5123b4acde6654606f7598a1ed8ae418a1d92cbc3d89e051fd385b185c69fbaeb28d6c71b0b71f5d3f21ceb0269098edfd979715c6b4f5e3e350f4f720cec6e7ad9
-
Filesize
5.9MB
MD5e96bc7146b21d00ace47debf9f3f16b5
SHA112da29c7a12f5569422815b34fdf53790a614679
SHA25685e5eef98121002d553fa2baa07049a2d2af7c062c140b57ced6f55ae2001ccb
SHA512890cea297b878ac75d1421216cb54dc86fc4b4a5aea82ab18c34651c59b6a22fb6c730cd8bde463c925eba02cae99b04a86d8e0ed367ccd2ff00dcfb5756accf
-
Filesize
5.9MB
MD5dab96d9d92bf40cfea8eaba399384b97
SHA1f1036613b999bc8ff0b44667bbc70bbfdb651002
SHA2563c192d7845af3f7aeb7b417fdc805a5b316d7e8f3c7069a164578352fcf26288
SHA51230482262e99486e89c27522b8e7c268e55ef88aa6d955015b9b741e9ffa9f6a5aea533cdb767e0d207cc3d83235b2fb713589ffa1bba4d53e2f993664b26e703
-
Filesize
5.9MB
MD5c72502842196acc523edb1c4ba4ca857
SHA1908ee1f6c3274f5d04c24bfba5f38953939868a5
SHA256921b61b937d75f8d80634c253178a305d5ae1bce31237b15588069c0084ded23
SHA5122659667ff5e7d18bb96b41dbbab8aeaa5f20d7232104a1b13e0f655c6226232569a4e9109df6ed8ef953d8c5e23901f62224a0e7000418f54d973368ea7b2fcd
-
Filesize
5.9MB
MD51668b7268481ec35b887257a1cc19f36
SHA1e1b3f5821c8dc22577ecb3ede338ea08ed4a3bff
SHA256940e16498fb9e08b61f9f123fc2801062e5e8ca83c28dbd5d167f91f8589c306
SHA5126a227572ded731809c1c7600376def7c7a0296b67d9ed24dc4f8491b4f6cbbb1f70040f9e259364869f1cccffdf7a031fdf421c622ac40aec6046959cdba5713
-
Filesize
5.9MB
MD5418106ea0828d1928ec6dba0281aa868
SHA195e0322ecc79d4f29e00d78a3fa8b2434bd446b6
SHA25650a948dcad378b313b2575c48c13cb452f4ab52004695bf47abf8a77577e0557
SHA512f2a69f86202f831ebcc201bc0c2d0952cd3cb01bfee025fef8ed32983b4d1504b16bb545da789e65b44af5827a50a785acb263fa0c251676977958baf0e9dc22
-
Filesize
5.9MB
MD5287d3257345ba911913d25cf61804fa8
SHA10dcb268fda872693e57fad12adc9da047aca4ce0
SHA25618bc147361f113c4d4aa31c03a7a48e38418b96156498eba108835dc8c2a90bf
SHA5128cad1b0cc3498f0487a1c22cb5a29129f5eedd16866d108182f9f10596c6024150ab41669f4e2c0d031fb7ae9f474ba35bf6503d9cdbcda67179ed73ea50d56f
-
Filesize
5.9MB
MD5e8225517934f5f044c5a471c58cba78e
SHA17989e2dbd4449b22d98132fcbb8247705332cb20
SHA25662783e5366ae54735594c45a4df456dd938309e3ec7d71ddbd63c0a1b802152f
SHA5128bf1c70155b4c5177bc7c1acf099a65f930ba7d0a35a797628a59ecfb62737251c35620ba78de5aa11184fb8fef3568b550a5fced746192e53785554eaae827f
-
Filesize
5.9MB
MD5b202b7c19cc430b4942d68356f991116
SHA1c4f259d548f701f03a988616611d1d8924b49b57
SHA256d92fc2bc5d99d4824624c186525c64b1e36ad194f285c2d7296158f79c803b7d
SHA512807d48fa920454a17a918e09cbed97ed6bdc0d54fffcb65de148acf9c31f199160bd31b1c7b12dd0bf40380bf89a316a54fea9cd7acf2b6a06b9cd2a3ea899ba
-
Filesize
5.9MB
MD5e80c76919eea6fc5a980236f3ede97bc
SHA187db47d88e4001f390966008dcb27a647eaa91f3
SHA2566772053e7b4161f9936d42b818c6b277881a189c3a3c1b0f6df5243b327df895
SHA512c0fc2e44a45d45fd80ce4072cda8510ddcbbc6e8bcf413d8e8034ca96c46c281d5dc2f68c225ab90f0573611dde55a85d1acf58d91215d9e21e3630f8961b8fe
-
Filesize
5.9MB
MD5e1e6742b0a4e0548ec4f23a6776ba07e
SHA12496c4128f06ece7feab4bd15646201dfe991889
SHA2568a950af5bdd41f8b8a52a104ef40b3750fad98c00fe9fe52bb37326a60a85889
SHA5122ff1a4aabb7ade734143010fadd87efa1defb20736b47c56ff7b82756fc20eb1a5e1547fdd8850cad065e2af6edb694d9fc3e2964a32cee1d4fe5aa3ad6a69ce
-
Filesize
5.9MB
MD580a33794a5f853479cd2e0ed7e4af580
SHA18f99007966171a0cf5b2842014e0937642b7bb71
SHA2561832b639a012dffaa08a08282d709f4d1f9f266598b688a998e8999d68da8a40
SHA5121e8c4c2b792fd3d53e5d4b2c8204cc1f5acf05783badf233ef4e4ad5d783175b73f0677be06a552fd047a95b9063fbfb2172db381f43bb0e929e1d1404ec713f
-
Filesize
5.9MB
MD5a20be635f111f01e72e0db93cc6495e0
SHA1973424579ab99552398ac02468f79e534ae49391
SHA2567f7309653c294d5267634ecd5939236f751edcb1c969b1434337e61081e0bdfb
SHA512c72f45fa420e8302645fe773afee256c5fc175e09eee5ab6e4c69653afb4701bbe3b66e2634ae40138b06bb8a5c1c3e55991ba406c32d17f827175a5fa5e558f
-
Filesize
5.9MB
MD5dfee41285f37c5ab914ecd187e6b96a9
SHA1cbc384a4c443cf09403887f6ea5ad0f39d88002f
SHA25663de4e67c008981688973708437f7bb4aef12515dcc11d572aaaf5674478be5d
SHA512ed25fa34120a44eeff47c6d26959b5b760b0e8e1add0459ccd69a8b22bd42d6ed9b5b2489dc56ed1355d92c25aa08b23ccf9a92e71a86a415c8cffd1e07ee176
-
Filesize
5.9MB
MD51ebd11782c69ec1e9d20b1e7716d6d4c
SHA195483f3cbbe3bb19989c450042f0ffb568817945
SHA256504c9d15c3bc9e1de25aef531d1d6bff3c98c499d9f052822fc88ebdbd9b203f
SHA51216c5f6cd673d73a41e546df0cd9d0b45deba33dc3a9f3246dbefc308fde687e6697961b3529c90cc659d3c5e51ab4d6cae552812ff2f68f7d3b576fd4205a62d
-
Filesize
5.9MB
MD54ee50d1a754cd508fd769cfcf1bc2e8f
SHA100edd59d8144e663432214884e8f404e812999dd
SHA2569b35dd8289c103901f691caacd77f7fb0de9345107cf9656b6ffd92868905722
SHA512a8e5cd97d47bfe987018ba41af3f69e13291cdfd670dcd4de6a1537f185fa06f1511472a9ca311a1975fef00c3f62a15977239a13f69eb96da04b81a2bf77b27
-
Filesize
5.9MB
MD5dfa59a62205788dbc1d3d822a1c0b0c9
SHA1e53ea1354381c77a2fcb297471f4909cc1e7b9b5
SHA2563331a76414480a103f7d4a38bb489ecb584e49ff492943220585d023eaaf1572
SHA512996809d9ad13a9f49088e7ca563d896d292559b8577a64312306c48e128a9e7d31c91bbfb4915c4b2846758b6b4610a8969bba48924c9341f78c98f61087df9a
-
Filesize
5.9MB
MD5bb6f6c27eb662ddf870f8c21ba0e523b
SHA1c05e3cfcdc49f33968ebce6d804d011050013071
SHA256c00bdd2e23eb0ca58dab82ee0f1b854a1b6b2af78dc66c8c37f146cb24789471
SHA5120c0e28ce01a0aa739e50eef4c249a867ea0d0d4c463990c998fa8a52de36f97aaad21257d467fccb084c6a5e838a5c68f41a2ec856d71ca369e405f9ac718057
-
Filesize
5.9MB
MD5d9d8e9c20f452d1c548ca3c6a83f3546
SHA19972226119789b59624f222d6933211013f8ad54
SHA2566cafd601c828e04bdfb0e991210bc9f9a993d6fb2618bf1d9b0589fb319c1c01
SHA512cb228990103e87c119903553880a9be7140cb5a1776dd2a960afd1ac36d60209640775ee012f5b82ece0c25d9d2ce6e09e0ba2fa6ff8a5b65921b0086ca53f2e
-
Filesize
5.9MB
MD587c00f5a19552f50d64e509e8a0fd2bd
SHA17e2973ee1718cdded94370440f7aa8b7311f4ce9
SHA256a5627a432a4d5b89b34c0caa22f348d8c28008af4eec27cb65d520f7bf647926
SHA51214cb49dc46c1d6c821a2aaa7d7dc17f277d26dba96a1db33a3b8c5f72146b65b10fa0f43f3f17eb9762b86c9f0038cae6d4cfa7f39982e068bdd65ee4dd15f08
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB