Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 18:47
General
-
Target
2024-09-26_0633a429664570671662a565cbc93efa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
0633a429664570671662a565cbc93efa
-
SHA1
642441451ab05af235717d2429d0ad8225a3f5bb
-
SHA256
875c86bcbca4ae8b4a0aac2c9f14c70fe42c91358a61931621a1b000a585fa9e
-
SHA512
e18393a6ac0d7ca1f1345b1f4fdbc98ba3223d3043df8edb2022b1cdcdfb4fa6ec0c697d4602c22071b3d5078203db437c1e72ea73e48f3cb19b037dd6971d74
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_0633a429664570671662a565cbc93efa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_0633a429664570671662a565cbc93efa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RZcNrZI.exeC:\Windows\System\RZcNrZI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxSGVOY.exeC:\Windows\System\XxSGVOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iiYJyRB.exeC:\Windows\System\iiYJyRB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCswlmi.exeC:\Windows\System\FCswlmi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEIYgRP.exeC:\Windows\System\fEIYgRP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfzqVIt.exeC:\Windows\System\IfzqVIt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKjUbCG.exeC:\Windows\System\tKjUbCG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MLigkNg.exeC:\Windows\System\MLigkNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUagLAa.exeC:\Windows\System\UUagLAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\snHAnVU.exeC:\Windows\System\snHAnVU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTrTmfH.exeC:\Windows\System\eTrTmfH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ChqdXKH.exeC:\Windows\System\ChqdXKH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fMPGWRS.exeC:\Windows\System\fMPGWRS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dtPNQzl.exeC:\Windows\System\dtPNQzl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EchMcKC.exeC:\Windows\System\EchMcKC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VGffKfU.exeC:\Windows\System\VGffKfU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcChdjy.exeC:\Windows\System\zcChdjy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOYNwhG.exeC:\Windows\System\aOYNwhG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MTrxAkA.exeC:\Windows\System\MTrxAkA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OtAPZTh.exeC:\Windows\System\OtAPZTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DccxseZ.exeC:\Windows\System\DccxseZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55a8a8b76ed77ee583de8e3004168fad6
SHA1cc974fd02cf3a50e40a84abf0fb1704a7bfb20f4
SHA25649e1fe8d997eff36f298e90a04ee05cc09989112fa344a9facefb7a74171ffd6
SHA5125bded2270b94b89d36aa1b3b943dc2a7400ca0dcdb3eb5bded0961156a34ab166a6251dde37de983eaec8b0236e89bd6704e87f8a2cdf5826de453eb99ab499f
-
Filesize
5.9MB
MD598749493b2b023573043b411ef32aba2
SHA171b8015d9378a7b0284c112cf612c983b5017787
SHA256cdfb0ae5ac1d137e5c57e5409e1c50bc7733318a600d485c81c4f3733a26c23a
SHA5125e79074287f0d5858d7839e9ff8388de27d7ca93ba5cea1eaaa67fbae28b2282a2dd499ec72dfca5f866bfa80674dc70e67bf7b09fde4e5ee52245fbb48fa9b5
-
Filesize
5.9MB
MD5ed9579c55f261cf67303b556c6e41dbc
SHA1fc29e721c7e75d23ecbc6694aa4939734255a257
SHA256438f3422466294e8802813e1909ad932657943ba36b99222c4a4ae566f25aa4d
SHA5126661eda0a2220377aa0d2867e9fefe5886de90394b494b5e64e2c381f788db0d391109a755794b29a7b5962b5e8e19350087ea5837a016119f3be248adf142e1
-
Filesize
5.9MB
MD5f927d79cff4b622f5bdc6f4b62bbd1b0
SHA12f3d19aaf3788ccc55857f8d6fb52c699ba3a81a
SHA256b66f7ebeb1ddd2ad1a526e489e9d3b1e7ce891968d1de1251bd3c90fffc7ed92
SHA512c97244375d9b7019007104549cf06a56310e9660e82394c0ee1a7f28d55c653514d82ef880f821b951939e18ad7d70f61a78dcef8fa1d60a008455c839d198b0
-
Filesize
5.9MB
MD5bb9e20b6e8f310b9818c7ddb9a2f22a5
SHA1b386367faea4de36647b10bf016ad830c6b51dc9
SHA256a3aeab22d8a0dff459a56fb636652dbaa9177902e0c45a8b016b791b2d104584
SHA512f1e710ce34f8f41c51973e761c35e8cbae9a127583a95bc50d57f4466488a3e011656865fbac0604d1631b8350284229e7a48b5bdb352a6937cfbe1b6d592694
-
Filesize
5.9MB
MD54d0299204ac9ea28fc525473748572f5
SHA18f0b58bc40b7d2a2d2f4f8f3f4cf5d40c93bd98f
SHA2568e81675869c786309b3bd6344b381af82decef9180d63511578c2c4750528e99
SHA512bd6693517217c0424a5b71bbb5f90d81a53463418742ecad678e8534588ce8b8d1ccd6611d2b4a71497c6a52cf326ca26f6b784089f4db16dbe2bc624cef6a5f
-
Filesize
5.9MB
MD5a2f7f71e4dcba00298f22ce46f56972d
SHA1973c1faea015762a4d78f821522781be4bcfcadf
SHA256ba441029ebd605021e89f52ed3cc874a5a095bac37b4cc6539cf977295cba1e8
SHA51211b64e387f803be028f78b9e015fbec80a4fee18e4689729b9180b4cf8e274a22019bf3bc08d2485d7c670cdb82e726b5b3d7a18d34a3fb96f238c9197fa6c88
-
Filesize
5.9MB
MD5154b5f6d88ddf82a2478b56bb733deca
SHA17b49952d65c21843e2a230f21b904c81c2ac999f
SHA256f97d0781cd787058322694b656b6d08e691f49ac312d6db636e13396a9d3b2c3
SHA5126900f89a0055963adbc865adc51e9ec0a9b2e226b19319934e54d6efc9f96c0f9d620c38de9b7ff2ab1e9dcd3f4f5cd457fccda65d0ecb66ff9e8dd60b5f8f88
-
Filesize
5.9MB
MD56cb7ca752a619298f4def58d946cdfa6
SHA1b7f127d805b6b37c0f59bea83212a745e7cdbaf4
SHA256ab3768699c7d9bd5734ee8ddb3e43bee3089d7c21cb77afbb83f748e97df51e8
SHA512c8c28863346d02523a8fce8212966da6ebfae60be0bdea310b645d94d8bffd33c9bb8c84195d5bb4379d45f427469176f92d8a1ad5b926e96e68d1491399dc4a
-
Filesize
5.9MB
MD57ac94371263dc15884150fba2b1cb810
SHA174600061b147e694c297b4b2b08d3b1f0d9e6716
SHA256abbcb7b1a099ad4e0938ab63b552a9b272c77abaaa91791a03fc1982772e7c09
SHA512747c1a8686c34e816ce5236f5e6c52019499f24c5de102600353139eda76d57a6811cfdecb870c755f5b5f7a6165dae128e8d2fd757f4c9de461cbe4ed375075
-
Filesize
5.9MB
MD5594e274f5acfabcbc818ec9174cf4e3d
SHA1957a6b470501b436ac5d65d5b65c0fc6ee440b90
SHA256f667e1aa659e1976699cce785dca04ccae3ec949bbf9156b12c5afb4ca6fb994
SHA51221b82e090b724cdc317b2bec298091f4446b0154a3d7429dd03b50b53d5ec9e7391dff8d3ec4616506f748d5bf8b6be6910af1c375cf64a566d32fb19820e3a2
-
Filesize
5.9MB
MD50a4bdd8147a675e192dbd7e6743cc6ec
SHA1b445df315e2e1cb1d6a1d5655eb3825d76f07934
SHA256b2db33633ae671d57a293813751eb602214aeecb7aa222c02ddd5fef0fb17338
SHA51221302dda637f5d7c70a2f7debcd367198ce10cadaab65a29d1a596f05a83c3789c2508919e924af2fc351414e6a16fdf1f32b80db90bf26386c123b065d608a4
-
Filesize
5.9MB
MD5cd96f415c3ea0e802f5d38aa8cbf3cca
SHA1140d52ba0ece8ca46773a9286d836a0bc40a8874
SHA2566015fbc0897f86abdc7946b810834f38623206e651503745bfbaff59267cba5f
SHA512dca6bd78ceae5f0a53bfb297459a569c87e2de09fdd43dd5eb07e3aa3d020127a38c620f7ebc8e5671fbf510fc8d98fc12e9d5332acba0ed1100111e4bc887b7
-
Filesize
5.9MB
MD5f086da5b65b90475add1353a49541f9d
SHA1439e51029ee763dc8012519bc475d826e739ce42
SHA256700ba7620261d818b4c54236401422176b888242ee2280b14d501a95cea72d38
SHA512bb9ad05614df8530a25cd70ca5b8bf415254c84500749ae2ecccbaad4969eaa41ad6cf682fdf9af749272690a2fb39941947a45548f0c5d9ae2209f4823199a3
-
Filesize
5.9MB
MD5b50eef769944b66bfb1a1025053c2d4d
SHA1b03b10d3f3c438b2428350cd9c80f910f5885f05
SHA256cd0dfb816d18a24b7ea4d8680a4219a18935a90c830b2f40f26aa56d35094cc6
SHA51232882577eb7447e65b4a99afb939ae13f58a025019b28be61c9516e6e1447a9330c763efbcc5fe862deb942f31a5bb8ec6e31faf650855c6813ee00651051664
-
Filesize
5.9MB
MD57213477c780957bdd95cd435dc190225
SHA12901561c30446e2a3b35116b815cb0ab0dd644e2
SHA256532bfad2fa396c45c52cc29d9eb2129b760f0116db3001fe7471878762b961b4
SHA51241351936597149fb442dc608c43c0dceefffe6b4ef3e52eb0151c6154e5e2d8bb9e984b7b010135943f4b3cb035d63a5cb4a8d7e48e94fc84c8813c5094359c8
-
Filesize
5.9MB
MD54d772e9159329fb87626b918e7ee78ae
SHA105a82c4411c17d433bbf76ab9d56a30b20f85bfc
SHA2567a768fe22890ddc0ad866be6f4c7b66e0426efbfc636dc3f35a7d086f9de20ed
SHA5121044af62d030a801173aeeb7242a3a9c21abf3ba8738bf3a21cc2b16375f80b4a7592418e841e239e132f6ad002e324c934ffe5a30194ce79dde0a38cea42a45
-
Filesize
5.9MB
MD55589ce4bb114bc096a3400924841a99e
SHA132500056c3ad55f543e151e9ab21368f0a2fcac0
SHA25625d1506ae04719eefc230652ee6c4817f7bff9bcb16bf670b054787888449920
SHA5125c85bc4da2b09a8c9c1a11466ed5b03965e5bbf540e1b385f1ac34d6306ec43e06de195ca4fe8cbeefbcdf7fe14f9d0b43b76b003681a0cd9a011eb7632ad894
-
Filesize
5.9MB
MD5059f77ff2f30447dcfa7503fcf8b3d42
SHA1471c0d09057fac0ded1208300d1057aca68ea219
SHA256c96ba4ad826c13a84f007cb4bc822451a9dc999b02b5918d6a3956d8c0c869e6
SHA51236c74f7fc85c5f45b20d9679c66f56b488ef1ce421b8871c44470987229d1e9a01873d367eb09f27a3d6fed2123add57a6b9af32e6096654f293ff57c43384d8
-
Filesize
5.9MB
MD5a76507f5cedcf8d84ce301fb039b1ceb
SHA1e2ef668fd3566adce7b46ccfc9486f296f106f47
SHA25671f3ced3dc1c1ef07ad8f55aa2c8486cf7462882af96a539a2ef7ed5a132b1cc
SHA5129f226d04f97d1b54ac35638eea2ad28582e84c8f92ccae3ff21754a264f3c986935c6f40cab489edc3a8eced6fd610ccdc5294fc7d8d9a720397fb69147956d2
-
Filesize
5.9MB
MD5180d26fd1fc0c961f5cb67a0a8f06cbf
SHA1fd0904ce9130144ecd57b90ff9ecdb7f9aebf5b3
SHA256f483d3baa10ced0d62f47e08455cdb5f1cb683be5572e0f45da47bac30d1ec08
SHA5120182481654f5f4885faecde3a92083e9a0cd29681a65a0d9e23a26a20bfff4ade7617124f84052a5317ff83fd4ee86c7b53cba6da5d64d5f599fff4f987f444a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB