Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 19:00
General
-
Target
2024-09-26_90b199b6861d8bacb2cc73cbe3e58668_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
90b199b6861d8bacb2cc73cbe3e58668
-
SHA1
500e4e00caced8c2cd6ef253b27bb3986dcbf2db
-
SHA256
12adc4e1c9c01c2fc0d9d47f40584e970441feb3317f0a880231f40c2d56199b
-
SHA512
224ca21d1d30d3ee3690573b59bec0afe05813dddb3093ec37b0563ed780d6854bced45ce6c33cdce7350d82bc1efe77e5a637fb342a0e107163f3ea820b4fea
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_90b199b6861d8bacb2cc73cbe3e58668_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_90b199b6861d8bacb2cc73cbe3e58668_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CVtRhRt.exeC:\Windows\System\CVtRhRt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUgmqao.exeC:\Windows\System\fUgmqao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJEMAua.exeC:\Windows\System\aJEMAua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLlcJrr.exeC:\Windows\System\gLlcJrr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCtdeoM.exeC:\Windows\System\yCtdeoM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TtbklZj.exeC:\Windows\System\TtbklZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zAZbpde.exeC:\Windows\System\zAZbpde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMJKowT.exeC:\Windows\System\SMJKowT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AJozkuU.exeC:\Windows\System\AJozkuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AIFhahO.exeC:\Windows\System\AIFhahO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJwHWwx.exeC:\Windows\System\PJwHWwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ogDFxdW.exeC:\Windows\System\ogDFxdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\grViabf.exeC:\Windows\System\grViabf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pCKoQMd.exeC:\Windows\System\pCKoQMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmCUuNq.exeC:\Windows\System\zmCUuNq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKPaeRs.exeC:\Windows\System\OKPaeRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYRQfHF.exeC:\Windows\System\PYRQfHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ywFcsXY.exeC:\Windows\System\ywFcsXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkVecbF.exeC:\Windows\System\dkVecbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmVPdfl.exeC:\Windows\System\zmVPdfl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHADiIl.exeC:\Windows\System\qHADiIl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f969085ccd902901aa9072eb9845a00c
SHA16eb3a9c0739189a4d7eeb0bda380aea8d200f04a
SHA256edc565b00d7f01da4ab2241de48fd8b8678127e2f20af317049375d8a051864d
SHA5123ca3c62d3d4d9faecd4a22dcaaee955b7e00cb3f946953acb35266c712f9c5d08cc0efb5bd3ebefb4dd938df1f16c14aba245ee5d0f3d628ffedefc13fb77041
-
Filesize
5.9MB
MD54ea018fea73fa6968295b2830b0a862b
SHA1eb59508669578a2d142a8302f74b52618966254e
SHA256f8b4bde59869d567da7b7cf6132a67bdc96688f0ce00283aff831b216512ae00
SHA512941298d8d7afa2a82aaec85c0efb78d8219bd38b8088febe6eaa0db8ff7709b181be163dfa960e48ab53dea2180b76078fb3aac9fb55c5c209591c1e5388287f
-
Filesize
5.9MB
MD5b8554ba6add587331f59260f2e73801e
SHA114875c75e35171f44d436b14e50f03c0fbfc0d7f
SHA256a33d70614f7e68dd61b9244dab419a841114bec45a153634f8f8b703ba3a3faa
SHA5120fdbd10d5a0349080a12ed35e9f03f2d557f9bd111ce3e0753fa41ca1dc6ef0fd018c8d2e103876a04e064114f15e755e146e0ad21d45437a48e0d3554c14842
-
Filesize
5.9MB
MD51dfb21bcf0db50a15fcfab85c28f2e35
SHA13a12c04c40ed3290466c6f5cf5be8d65543dc051
SHA256b6669aec8ffcaf8b073684575de87ceec1fbba4974764bc77f9858564f7628c5
SHA5128e6604f25fcd04403e5cbdef8c960c873dd078c8a92ac097b7475a5e9fe74dcccb45db2891c30778b165a450fb65f09e719483d2b0e9c545104a820d973f027f
-
Filesize
5.9MB
MD5db4cdea558185685a4ab336be657c35d
SHA19a012270c26eb6517ab84f4367428ec17775dd3f
SHA256be7df7a74981fb7419a8c09f4769d2f88fa7c05a2b39e1119a74ff9a2bf734b3
SHA512cfb6434109dd939887abfdd132ad0b6f1fd814c9486eb6c58b609580878c65a2a65e34238d694839d6e83f31fe5c4088116587c6656d1672f659f286b852be0b
-
Filesize
5.9MB
MD5ea0452f8257b89762e9b6a8868c245c9
SHA155003109bfbecdc19f506b182300cbebe6484f08
SHA256553d366ee234840c6e40fac4b0944ba276cc6396f52c3b4c79d14b56bbef2711
SHA5125a30d5f5a625a710c990d49f620ca4874537a1ba5b08b7a07fb2d3a5e4621c194a01e03ebf74b10fd7af423684d9391bde67a5914fc8872e8f781ca9d04fb599
-
Filesize
5.9MB
MD55748f1ba935083044ee00f8991c119fc
SHA12efecc41146c66af6af3dd739e284739cf178f5e
SHA2565b1c4678ccb7aebd0015fdab1fcf86b9c19f85cf631593cb8209ac754f6a053d
SHA5128d21c18d4c952eaa2fb42d8e363caabd6d1ea73b47429053b8e1259f2768b4fd9a5c018ae61bcd6897c89a9c077cb2af80dccd9a8cd7ec687f4dd6752cb7da59
-
Filesize
5.9MB
MD5b34060dd5268b203fcb7657c658925b4
SHA12a42284f1aa6ce9d6da0c4c973c545b2b3079776
SHA256929708d4aa1f5fa9fa9277d174f814efe29dca87bfa5cdc2d502efed96dcb2cf
SHA512c15ed5cb9e8fe277a1363a8530cc3397b151c690bd132ad53ae746b8fe88ef5f0f035ea9b25ae53cd3ad2f3712f0cbfb1e498fa865ab2791e72d8f5430fe96a6
-
Filesize
5.9MB
MD5fdd73cce51c910ea2ff0cb9036443b10
SHA18d51f3ca1f57c0997e8b9927d75a2de625f0fa3a
SHA2564a79d72c95d0bd802cd35d05dc3c527d8f2a6c764b7d3b6a80512336b6b4491e
SHA51278463ad347267f8b5fb5306e2466d6f08654267e451d07e6c4a8462658853e22d397be7c36faddc90d06577f0ae42bf5e9892eb63c3d621c7d6caaa6469641c1
-
Filesize
5.9MB
MD50c6a015cf5b683ff0a0f257147220885
SHA17cef2bde96df4bc070df2682f4a3542360b76313
SHA256dea3802d6c2c00fc64d977b0c184fcaf30c7abaae7cb9ed640d51bfc546218b2
SHA51245853b75bc6ced460fd619bf1890a7ca5c4cf215240a802aac74610ce80a0885753b699e06c527a64b694ade7490d571c780aaf3e78384ca059d9ed077b78dea
-
Filesize
5.9MB
MD5649bbc9a9e72c34b3879017efce7b525
SHA1b0276eb6e2e511d7d21c4e5f535ada57a0a8f226
SHA2561312fbe04a9bac25e328cd74e6015c8fab2dc2d9fc3bd0e93d25d38308fa8741
SHA5128f7ee1310bc7788a17d0f1697acaeafed3e8172ce0ad755ded6283c262bd2015ee64fb608f1562075a88f9795219dd44ecfa3121c945c2ae22ea3001de9643d4
-
Filesize
5.9MB
MD54194b81808b944a867587a8c6da4cf4a
SHA1f084084daac9b747f192cd9ae48bb1ccfe77cd71
SHA2565e1c6c2cf582fa87579403b2bc59c950e3db66fa884165200eff5645029ac59f
SHA5124c2773e509f3856c3f033b88390197a8b46cb19a58ecbd307f73e4fdb20f9fca4087d40e1a2f9c651aa1f7dda7b607f1282909585b21eaaf74b4c3efa88162c2
-
Filesize
5.9MB
MD57188db311c42315cd7e0c9350d968994
SHA11c0b69e5a105bf6c4326bfa9e3b54d14b3adba4b
SHA2562ab7df11bff7fc7e768dd9b32684f64fa5ffd7386d1cf7060fbd789d1039ad3d
SHA5123c3c65b49986741666c0b15e606cb960e5b0c69866e0333fcd2be19e13a0ff55c077dc4abecb0492e888b8674df4c21802dcfe5b4f040068da67a324963571eb
-
Filesize
5.9MB
MD5346595545b11e0cd33146aae18ca3a9d
SHA1a006426f26ed3765d98c120affc8a0cce41f8da0
SHA256169ad938fc8cf4e4e61dc6ed3d1c13e6bdac567ec5afb29759f68381f8ae67c9
SHA512e5a3249e1d959b6a5603b43f7fd4f88b26e72ee0e3926ecd86898938806d729053c1d5adb421c5aa7148fb48cfa2998c68a62f2ce4f3dbca72b5bdb282a0255d
-
Filesize
5.9MB
MD539ac30cff6d67c253d1b755110ff2200
SHA14696365856993f6bf2d28a1e07d2fe6788d67798
SHA2564128ca8800fb7f67b7815120e3aad11b5c43445b3424ed918a6db6958b7e2b62
SHA512ad3b2df1541a2be80c478a8bd058e5134f26e0dd0c5825e40e9a6c515e4aada4dfc23623321b0c5cafc3bd5bf6f5f49cd0f6f34f783617e00e27a61c34401422
-
Filesize
5.9MB
MD5f3ccdd8cbb2b95dd5b2da6823e611ff2
SHA113c24e6ce662180c24a9e07c0be5227e09045376
SHA2564f874bc0ed702b5257dc054b6de44695dc3d2f895bd707323ca47d2e8591c4db
SHA512db570a3c0a46d1a4d359454672672c8b1bcd28524ab9665268f84764195e6b89fa82d5386fc356d8f1a6beaea97ac9893007aa8d125ff61ae9d4b94c86abecb7
-
Filesize
5.9MB
MD5070480e0f3ad85b74c56c5786726d56f
SHA174653c810082b98fbc7c83d8148600f62d71e11b
SHA256118db1461ede5ee0fbf3d791c23a93eb37912e89c4dff5ca1a36d9e607cd9923
SHA5129752c847fc552ef3deedb5d8b67f4277c73cca9d03198d84ec9f6ae11c7e5cdc6309589a93c68ff3e2b0eaadf7adfaf79886b0fe2254986fe850a7a0270094de
-
Filesize
5.9MB
MD50fc703819e5c6c56ce5aca0ab8b674f6
SHA152642d46472dfaf8a35a0f0fa7c71b7b1336f475
SHA256ce28a8296ed92d1f1b1187e0e9dcbde9799c296767210097a312d5088ad531d4
SHA5125d1fe6f4170e128f6a83a89321e56c533764d86d418cf247a619c969fbb683bfa6e280334f61338d3a78a64454f74c6422df38e34fefcb738ec3b5ff6f0dd85d
-
Filesize
5.9MB
MD54e8d0bc812e37a30b6280deb5c9ace42
SHA13a7ba25d41d58287fb115d8c62cbdcf419ab3013
SHA256ae8f5df567fa55e8fa5acbcfc4f65e95e07c4b9783626e93c4a4b828ed40770c
SHA512ad2a76caebd7a7f04103a3e4d0a34b04d96b7e2d2aacb012271e6c78c038894a345c67298c17c2a2daad18a87a40ede676b9cbede17e5d0b5165803d586d71d3
-
Filesize
5.9MB
MD5ec8434baa10b64fc85a3c147d9c65c5e
SHA1dd570f547aa714422301a10ac61366ff015637fc
SHA256f8cde3ebbe2bce88a2faf4eb931d6e3d62623d4adfcacd419beeeb28e607676d
SHA512a9c624475d97911f3a876f1a14abface0dc9963e907fe6295241fe8b78ed41e70f87ebdc69cccb623eb7034374252b8c00aa6ce03847138e54bbe2edac405057
-
Filesize
5.9MB
MD5d5b8ce23fad5fa4651c86d4c0d9359a2
SHA1d5f7d1b9b19c29d245125532eda0366b0b4d741b
SHA2565fe6670c6e2e081cab7d961f6398f659dfa070d6441eecb8657bdc2be17e4024
SHA512c3e37292e8553643df1c626a0f918e6497abb0e694eecbc1324ff766016f04f19b913a10878521660225bcdae99945c8f6be869a271a0a1f02aee740f20951d5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB