Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 19:03
General
-
Target
2024-09-26_aca83aa39a4d2f4baae704878516e338_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
aca83aa39a4d2f4baae704878516e338
-
SHA1
e38f24a053a66a7f77e38221509670a273c45fe6
-
SHA256
09385865d8e465d170f2beccc22181c01d2a4a0da54fcfb43fff13639bca1581
-
SHA512
d19c98441830db5ff081df4e024bcbf6c79cde06294a6e24f37ec2e827061a8587c93db8e92743163017421f8db76b3ef6ed9b6a240599ef21e03eff5d87a041
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:T+856utgpPF8u/7v
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_aca83aa39a4d2f4baae704878516e338_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_aca83aa39a4d2f4baae704878516e338_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FHupzZL.exeC:\Windows\System\FHupzZL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVrzhju.exeC:\Windows\System\KVrzhju.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\goxfYQu.exeC:\Windows\System\goxfYQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcAaypQ.exeC:\Windows\System\dcAaypQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjnIFad.exeC:\Windows\System\LjnIFad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOEYHZo.exeC:\Windows\System\hOEYHZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSlUlXJ.exeC:\Windows\System\CSlUlXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EZdIUBR.exeC:\Windows\System\EZdIUBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\chqEjFe.exeC:\Windows\System\chqEjFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjGrPsl.exeC:\Windows\System\kjGrPsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcnnXUj.exeC:\Windows\System\zcnnXUj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXhMZav.exeC:\Windows\System\YXhMZav.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbJcBpE.exeC:\Windows\System\pbJcBpE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNxsAQd.exeC:\Windows\System\rNxsAQd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tXSVPCl.exeC:\Windows\System\tXSVPCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Lfckmtl.exeC:\Windows\System\Lfckmtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jYTkBzh.exeC:\Windows\System\jYTkBzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qrCAUYU.exeC:\Windows\System\qrCAUYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPPKtbJ.exeC:\Windows\System\wPPKtbJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ROEbzMb.exeC:\Windows\System\ROEbzMb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvajdjG.exeC:\Windows\System\TvajdjG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c064047a722acd86eb58c1785ac2d74c
SHA1125bd6494a4e91fe25fba31fa72cb79838fae33c
SHA256ced0f5f6eae3096a29a70f8b4a3e740bb661ff325ae2deef7fb1e8741fccdba4
SHA5122aba4506cb2f5b3ca950a80eecef62e303f5a0ba128e15b61dc45c8603c5365e3e226ef4b599ac94c46a23adff927bd3a57db6d9876e5eb9a52fd255a959f1c7
-
Filesize
5.9MB
MD55a5556db058be736431157d088027ba5
SHA1cf5a8f7829e2eeb2036fd988692130eaa35f682a
SHA25662f25a1e37fd080098e5a6028b8fac274544e6296ee6384bd35616eba8b77c15
SHA512b7a1c52d82043dde60745b3c6aaaa9994c3b41e3a693f7feb5ea89690dc97dbb8e80fdb618d9fa33ead05420a0cb4e9adb821eb0a25191129e0bea8b82c7abe1
-
Filesize
5.9MB
MD506e368a34230659ec0899794571b5450
SHA1234fa2c9fde18bb58383ca52979072fb080e5794
SHA256cb20d6fa622b093c0c69711d21600f996bd1f5215a7029b4b7911e8e5bd3c3f2
SHA512c77e9c0de71b2e71a1aa5b1b6b089cb5fe508276ac3a37427776f30d1095319ab0b8b0cbcd87c3090babdb308a89e8f9af9396bfe1c0d6e22fd2ca8c5b0235ea
-
Filesize
5.9MB
MD577cfddaa63ec4726294d50b696139a3c
SHA1cfac3a36fbd6fffc1b517b6d90c84fe02312f8d3
SHA256632429e740564980ca27ac664829c5e41d07fd7e948c336e312d796280a1f26a
SHA512e2ada570c0dc224993ad58060e971b47d3d11df7edcfee2c1b4fae1b9d3abe4d82f74a09d335c38b8ae56b38e58de2f6399cb559228b26c0b45657c3267de738
-
Filesize
5.9MB
MD54137273b6ce50a50692c5d80e9646185
SHA146ab45f746748e7b169bf1a2020b14314a4907eb
SHA256795b024104a44940ee244caca72f36fbb12477a9c43a687a5d51f2aed3a90156
SHA512b13c7ccd6cc5918021dcc408c11d72bfd37df67021b87dfc6e0c0d809f0dd72a6dd99e952ed709d1662d7f5d8b0d26d918cb47625df3a39fd0537dd5ece9b511
-
Filesize
5.9MB
MD5c0c010941dc67abf2c17ef0f044dc6fa
SHA1a4d47a5bac8c1b156e741617928303329521e228
SHA256120df8ad796d6d09b02711357fb0209824303e4baf6f9e0694e439a0dabc05e2
SHA512bb049197cf6c9defe2cf578d19e4281a4485f01550986a1bfbb58fa72bd00651051defa0d880a29bd3a44d7d4f1054bdef29739d63d3e67266e837ce4a99a881
-
Filesize
5.9MB
MD51f6ccd1703e134174ba29c7823a71ca9
SHA1b6842cacb0bac8b81b6e4723487f609bc00eb7eb
SHA256c48d2f2230d894df67aa627e18e8771e00db7b2cd9e9f96f79710ca4eb7f1f87
SHA512730e3ead2c6c70128b1ddb634b0aefe8a6b39b59abe7d77d1a0a80368ea77d24f455046de222239563720159e03b3205cecc3987138a61610b531d029d6ac051
-
Filesize
5.9MB
MD59b658ba23b4f0026507d474e457a1a34
SHA1d648f493f0015a9cf6ad7a4c0541ea0447f8cd1a
SHA256dd59a129e22fe04c2e617aebeec0697cbf5162bc7c9ec76718155f5239452d5b
SHA5120b85cef3c4fc0f583ac7110a67576a2a5f472d8526e5440b34cd1087fdefaea543fa134338e89fd35050d9e88bb6f5934c2eb24ac255b00f5d176e399434d641
-
Filesize
5.9MB
MD524dce474c0539dfdff4ac05c9871c803
SHA19738b0f74e1b420f6b26730fd5177a3301845b90
SHA25616a1196e11ba2c04a918d7280bd21a5c3ac72e54041cd2f1c2fe39f999647282
SHA512f644f16528d974d90218ecf99480b29c8047efe84032e7a5db4f877271826b9d037ba15dc8692af04ba358c6d238923234ff34497751127154277416fd60d9e8
-
Filesize
5.9MB
MD5536c9c2082d0a546dc5f664b823b11bc
SHA136d4e4d6bc1e94b608c06c7f24ee4fee6d21c1c2
SHA256a3e2d4ed37cdbe3c299d9696df5d9a0b7f8dc049488f18e79b47fb2e2bf246b4
SHA512a55809d34cc0481b1a573934f18e6ff0a2e8fbfd16f4cc0fd8e8a50d69fb7fd9d14b333d3c4c6f1adb79a916e2952376bde7a9e5854b66d3b2b84d3dd70c1ac1
-
Filesize
5.9MB
MD59a22eb95ec47bedede2deabfb424f11c
SHA1ddfaae578571f9405c5d649ed44c6c9bf5f3ba46
SHA256e4bf72dbd4474190e59b91c6c333253c05980d28df1b63c3a24478742863e621
SHA51232b341e095d13e7b2b3aa137c7f019921ab97b0956b7e7a9a64e0a0f7972f21612d0855edf75196b8a0d42f9d5e6352010b07a662967abbc3e30dfe0bd12fe03
-
Filesize
5.9MB
MD5182d977723b6d589e6d51de5deefeb7a
SHA1bed501a49f3f59ba1152e96506c0b36f91e502a6
SHA256b4d6a92a756cabd235cdfd0b2a2e4636267bf95bfd31157098e95bf6e387fc3a
SHA512ab8c31a2e295b1f5f2b4fbe7e7bc50ce1005f05f346cd35eea5432d6dc07ab06dcb4523134f5aacc3e089a5d98858ef4255bebd0d875712d309b55f2890bac60
-
Filesize
5.9MB
MD563e8d2439aa6961cf75e74cb31ba1aca
SHA193f961cb77f0a68c3cbc1760e44a58060f5f7ec9
SHA2560e350d0a1c112623191cc3e22c0fa90c910ee2eb0f3cbb35658bedd105bfe090
SHA512bf6ff80b5850e299b7c8b60c111bfbcf85d7fc6c8458baae299fd6ef649a8d19a4a22dfff92399535136e12e113a851f11851f94f79fa62b9548080e8457aa75
-
Filesize
5.9MB
MD543c8a0cf07fc304c7ddacd8470258876
SHA1ab232aaf6a34ab9034bee89af375ec975d5be55f
SHA25695b1eb3c467376f44670f3feaa1f8d36c9e954f40b901eb4078896b323d1bb12
SHA5128ca1c252be12c9d240bf38bf80d28c9fd788ad157a0f44542ea0c68c10efd57228211d816f82b382f1c8c1bb83b9b36b2e3840a960f7ceecd28e3204ea518ac5
-
Filesize
5.9MB
MD5e11016943223073af759aa811020ab08
SHA11218630a805bf2effe3c67e6d632e51b8dadb5f4
SHA256f67370d08f3ab6d65973ad082d4bb50c5a66f36d0ccc09ed23f4471ed717c0f2
SHA5124cdf1082164a25babf13cb9b52e9deb72832638d015702502b65ee9461d504363dcc86f1e341c9b85f2900444dd61a899283a4382c10bfe1338fedee20e138bb
-
Filesize
5.9MB
MD57817d2bde97a033e92bdcec96d78f718
SHA1cb5c36f756e800b6afc67dca0845eeaee321af85
SHA2562aa1ff0cd1250d1796d41b746b5e85d00b881281d5df94899199a839eb86a0be
SHA51254105012a7dcb93912b96271dca9fc18b2a4564670c9ca5800c36bbd1cf22da555c69aa8aef6edc5fca7a36ec709e294ec2a51126344cf7bea913f1788cadede
-
Filesize
5.9MB
MD598ca41ac68f0a8ad1dec5c20a4ffcb1d
SHA1b4f1808fef5a620222faffd54f6d63f62cd67e85
SHA2560919db45accf6efcfe3809e50aa9a2ff245376aa049fb4d290149f505761bc66
SHA5125546e76e9e5896f50e27b460d6c16d50a5ef8a127d8d10ea349e7a6e09f0132f5857a4e27f7a7d860ab71fbb57cfccaa006d75982c30ff9bde02a410d717a514
-
Filesize
5.9MB
MD5c9308ef5dc33d799e8695f064d5343ee
SHA175abe5e4ba59905a457e0895f5633771a1a91a47
SHA256b589bb18745b40d25996a6a3dadae0511f62f12097a96a3781b4f42ed5d8e517
SHA512d85845d2642cd2b279b2199e47f954b8a39a36c3a69ebe87b28ded62e600c9d75eefb6da8ce866ac7d8204b74af9b3652f1713493367deb26300a4e16e4e6868
-
Filesize
5.9MB
MD516037904a3788e10cb0aa020e0b66abd
SHA1edf4f2e60e6a766ad0597f6fae90746b755d7a46
SHA256f7c16612f3bea81da97881b3750aa0c49af15c927f78ec29578b41ebf79b464d
SHA512b7f5a37b4e590a14d083c5125e0ad8611db1fc2b388cb00bae961f694213908fa04a40f6b3716be9275a87b9002edccbf4f525ca4707fef2406a216c2b28114b
-
Filesize
5.9MB
MD5aff38273d58b9db4fa049188cc2b75f0
SHA15577df919b8bc80bc17e5c4e3b2a8f3695294847
SHA256e59ffba1f1371a1670b25a9acf1d14cf4356f87193067a53dab097b2b412870f
SHA512dc91506bfa56e9d98c6b37fdd1e0177d38ddc9ffed4c3f10d130880ff8df7744f26b9b29f75898c6472ec3d0a5fff52b5cf2c26d237bdc6dc7108a88888d64ed
-
Filesize
5.9MB
MD50e5160b98e9e37b049f40c4119261562
SHA1e1bc5ba1068293f0fea43f420e50238d65acd82d
SHA256e39df08c713dc42d010d79af2f6c3e15a12d3aecc0054a135b22a8bbdf0f0767
SHA5127d6385ee2f753800da5b6cd6b41e362ded6dbd930b26c03e6f6a19ac0bd72e191b154f430ca0d16233a5a521bc59e7e334d7c540f75d98514c4b5501ac57c1e1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB