Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
26-09-2024 19:05
General
-
Target
2024-09-26_c27858ce71f29eaf681d3ce9248ecda3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c27858ce71f29eaf681d3ce9248ecda3
-
SHA1
01de57b2d856a3664bae4375a04004f3f993a265
-
SHA256
be088e91af57583e6a53dd8cc859ca18671887f06da26c6dda081a1160d11e7e
-
SHA512
fd0b38d7895afb71febd3b50cf61317b6d9863cf8b913a5421d46d4b70b41403bef3421c4deb7dc6f09a43f1a884798ededb47aa02ca7052326f6d936ce50282
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_c27858ce71f29eaf681d3ce9248ecda3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_c27858ce71f29eaf681d3ce9248ecda3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VLfEgpe.exeC:\Windows\System\VLfEgpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\foiyPJr.exeC:\Windows\System\foiyPJr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YzkXhor.exeC:\Windows\System\YzkXhor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pxuVics.exeC:\Windows\System\pxuVics.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fbMKApw.exeC:\Windows\System\fbMKApw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lQoNAFE.exeC:\Windows\System\lQoNAFE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KgEYzbW.exeC:\Windows\System\KgEYzbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKCtjmV.exeC:\Windows\System\WKCtjmV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mboqXZo.exeC:\Windows\System\mboqXZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NzCEIMC.exeC:\Windows\System\NzCEIMC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTBKnAr.exeC:\Windows\System\fTBKnAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUrghWg.exeC:\Windows\System\OUrghWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmXBcfR.exeC:\Windows\System\gmXBcfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uaOxgFH.exeC:\Windows\System\uaOxgFH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LZCAbLS.exeC:\Windows\System\LZCAbLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBlPGLd.exeC:\Windows\System\dBlPGLd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJEjweY.exeC:\Windows\System\VJEjweY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gthgxQb.exeC:\Windows\System\gthgxQb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUVTPxm.exeC:\Windows\System\QUVTPxm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmrjDeN.exeC:\Windows\System\qmrjDeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqIYFQz.exeC:\Windows\System\lqIYFQz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD595d2f5d148eb846f2fd18c94a261953c
SHA1b304440d22460044e32178c58053f0c4e49521b7
SHA2565851648e31c4088f0154f209e6b6914d7ddfcc60dd4ff74cd33bf7e225ea5916
SHA512f58ff81bef837f0b377d9c303ad5a68ce03d074f21e06b457dd3b9943ddfa25874827b6f2316998d68d3b81ab32b68b57a183e741c53b32a0bc4bd7261153618
-
Filesize
5.9MB
MD53964ebc552f666eee5591a9fd90d0502
SHA1319bcb02ce69bb0b7bd79982c1b42e18ece36434
SHA256594dac4826b26c76319ee7ae68052f5aa3ee2fdc3db77f3c11c208ad518b4ca8
SHA51203ef4d2da2260e872d70de309ab4bbc5ecc6b3584d04b6035879f47bb75d42f8a092bbf7e43972d6546e00948a7705eceb8db426c81e636a3d74969278d33ca9
-
Filesize
5.9MB
MD5965254d394d1b913838f90a574a2566d
SHA12b9ad1f5be8183f0a7332f94ea4ba7d25a5689ae
SHA2562fda3e6fbc71eeaca273a0af86351d92f0358ab2554926af4492295676e48cf3
SHA512559dea514646ce8594f63137f65879d708cad2d40a1cba3c81239bbc89663ba75435f95a4441f086442eabee5f7c275c69da6fedfb47f8aecd8e01958dabc366
-
Filesize
5.9MB
MD5f70f8d3374eaf1e4e805d514a2e99c17
SHA1251b9f91e908ce3cd29d327b9eb3ac21ce979f36
SHA2564d816b6c1a19ed3b59fe77d69bdaf03082059dba848c0101852e9fc0a4d1bea0
SHA51239059c4076f84883d13946c3910a5a37ea9eb4314bcd984a673e2825e8d9e787c528c0c2e12a83cd9238d22bd01d74078bf0776defc6c050fd5d7594a89d808f
-
Filesize
5.9MB
MD51a0907864308074a632d3e1e0b54dbd1
SHA113221ff2b8a7fb5aef12ebaa3b8c97febb040ab6
SHA256e5c9a0c6bf94cdacc8dbcaf1bbcec68a8e3cefc91c1cbd88fbf68da517d6983f
SHA5120d0c01e0e347d57b57634f530f7643e68fc94f1a581c08e6275e71eb381296736ea01c83262067cae7185d98c2a16b8942dfa9ea9a13297cfc4c2d549bb23cae
-
Filesize
5.9MB
MD5e4671d71a48f9a0281a319eab958f7b4
SHA129b371e1e49dede1f407fa00c21ff3731e125621
SHA2564797b8636f5f518a10b8f285d70ecf0bdb7417cbaa2d64623f1c981f8403a51b
SHA512ac9c56e4387979a74ddc43fef86f3cae5c69965d77ad11fd773981f742ae2056184c2a86d0f8a0a26f3893c5d662d1300c28f1fe29f87ab43293e3835808cb49
-
Filesize
5.9MB
MD5ffe5190cc178a822b2add3a5d3264d03
SHA1cafceecb6418866653a31ace265fbccdf952e9ba
SHA256947abb98b0dd4f7ed3c1b4a0789ed3f871518d12794e2c3c5ce4eaa6eefb23c1
SHA512180033c7b4355ee56871ca8085645e4c795e3b7b4792ba02bd2c3f7d02fb49931b6d07bcf4dbe6042c17b450bf65012090cea67afdaa124d3e63b2bf035701a3
-
Filesize
5.9MB
MD58a2ff3d7d0766671d414de41ce1db5ac
SHA1588e51f0e83b466022384a026c5f802027e6d0e6
SHA25636a4e400973ce321d721f35d8fd08f906eca7276fab4369ec0561b6235eb4b88
SHA5129359da205ffbc197d7f709f69ce87734a2e971642af0c8ed7dac2f2a9c3e991d1aaa3f0ca9fe1738a7e8013a9e2e0dbb02f947e01f2013d6b9a10d94efc74961
-
Filesize
5.9MB
MD5f958adc5bee388aa18b122c504882a7f
SHA12fd090c88489f9c55f1fc02c3258780f5091c96b
SHA256f1e1a2652406145ddc995ffa62695e072564f1589c964661fb93d01905e26d33
SHA5125a29167696ca64837153e2b11fe717766e7a207cc164fdbd748a96e9124acc9a06e63368dfa187aadfead31871727ab47a087af966b7be028b8bdc2a0e6b59a5
-
Filesize
5.9MB
MD5e8077934856b62fca2a889bcccc3d792
SHA1443bb2d13e97dec25a7b5b594c3fa33faea49658
SHA2565243ccbdff82e1cc047f25f0ecfcf3a060dfb64d7e4e5809ad8ed968923bc115
SHA51215a6aa7623cdb527a188067ca4ad535a86e92b4f7b142a1e416004048f0905ebe37b06307609fa4197836c1ef0dce2496278befc1f381df0ee93098e945276bf
-
Filesize
5.9MB
MD5d13865f26f937673d0c0e13fd855e820
SHA1d976e58b4d616aa907ceee7eea7bd3b060ca3d6f
SHA256ec73da6481eefd85e76614800006b06a0891046699ad325ce579c077c161c455
SHA512f0532c65e6cc934f1841466280d81f2bf79b6e0caab457e998955697256110e88ea47350b496b47b5d351d8ed3d240566a4cdb21e7d44ed12591f56cc4ad65b9
-
Filesize
5.9MB
MD57698a91bf66678f7b2691c9e15dd68eb
SHA1c356214f9d64d786b8ddde5dec1863984a9c42b8
SHA2567cba81e69679b1fef11382e36f7769b59bb4fbb761695f0465c13e3990ecc2e0
SHA512e777c0e4d4de71041a3bc5f675dd52565a784e5a79b37a327440bd035e3ed52d114e7728201d364cc8efaf57dcc9d5f2318a109c6088c9445d939662580fca5b
-
Filesize
5.9MB
MD5e04044671575eb19c347646c7d450998
SHA1959b5db062fa5d1544698f68123fea63365abf15
SHA2568650a2174410b3685dbdc3c71516862b8f4804918ffed5be4453bd5ef756e70e
SHA512c1f0878e922a04a68eb58cf1f22f9379116ce18abfe0463b162fc563ddfa94b42a8f5b132add7dd9bbde7bbb8de06751237d3dfce7e1e31b004304cf62d3430b
-
Filesize
5.9MB
MD5f58cacc3bfeacb25c18c715edc096e90
SHA17059bf05d6519f3a3c4efb6824c7136c4bb8837c
SHA256acb176e065bd80d6f561f0bd56818b83e1f1c43c1b4194f60366b27666daa3b0
SHA51289a823622535030656cb75a3ffea56df44ad7337f68267a038349dec05d970fad7de76b3dd174f185b00883fb76573036dd5a874a32ab96568d8e25849aa3694
-
Filesize
5.9MB
MD5402632a63b78fd9b537d8fac8a4951d5
SHA1ccb7bbc0910ede261ff5d60873b4058482c8c442
SHA2563c6b6bd63e4f12f1dfc124fae4f3e4dba5ede251ba40e7c2e1c3801932f32ce3
SHA5121df8d40274eef04e0b5db99a73f400baddc88bb05e5f510896c68660edb318d27b0b4652b09abed68e7bea102923f0d75eaf0880d8f2dbf15d198747875cf03d
-
Filesize
5.9MB
MD5bfefd2de35e07b5fbb87730675152ea2
SHA15cf985325670e877b80646ccde16a161b2c3fed0
SHA2564fb036bc3aec037f8266a0894c8a893153244569d55f1efd12451c81b9857756
SHA512c8d5e0e40ded97d6f179746e57e759cf6ae84d0facaf676338caf9f3074a57afc5bcb42e56c7a4261b53cbe8ee0a3c37aafbfd3c95d0b12ffcdbbe64490f673d
-
Filesize
5.9MB
MD5416da807e3caef5e349e9cab098dda51
SHA1bc21725e6f9b8a29f4385ae0133bbb3b42119f66
SHA2567a6f2ce04a5a56617636f7a4f84f9cc6d654e8f8e8a51aeba575eb1a2f343b6a
SHA51222978f31fb07b5b7e4828c67d1d94a923b71e86fb380cf68eddaa08198e867c84ae7b99576b29f9bb079f8a98884061674b2db1fd9554df71d0c195d918f7015
-
Filesize
5.9MB
MD5ea72d583170ca7238e369e1cf7b7495f
SHA17c0bc419880e3cc2fcbbb55b039f0c58899b7c99
SHA2565d46c5703e61193580caca06a1180bfb476a1db0c9aa88f52c5f0325761723b4
SHA51242f8a25961d1a2f2ee18b1b4251250f5787492c180883665a73ed2eb075c9e95cbc670593b7def156f15ccd8d5007db719236f626462c66d799fb68ed6aab5d1
-
Filesize
5.9MB
MD54331e71003fdb00c0e32f94f1d6f76f6
SHA194cb0a998577a2b8d79ea23e0327d6a852a89b4f
SHA256cdf929f04b22b5d413bf1619c57c52ff24ab792fcdc4431fe1ffb5149c393ca3
SHA51221370387629d5108e7845871353f38147bc19a94c35fb5012b2f94eaf35e982600350f35fd6abc91f3af3393fc524d8d02d47475c82371b7b5bc0a14f9362a11
-
Filesize
5.9MB
MD5b21cb38c50bcc4b01116acf277400378
SHA12b29867817484784ac2e8ae23213002f1d689dde
SHA256cd23fed647254c479947b0c514f44c12484830655c7ee0369145b072b343c18e
SHA5127c7038395f693e702ac730271d7fb76ce8a4fa52330fac4f04654fb40b4c3344feb86052827703274793083df68f1a9d54a5b94327de265518101738579e63d1
-
Filesize
5.9MB
MD56dce9c4a282a8c950fdac2bb1c1a787c
SHA150a69f232b5a6955f5c65acf3e7bd62a72f59c45
SHA25628f6e286af591e1eac7a12d197d726ca5649f7f808d6a8ef2d457247f52c8977
SHA512959c52a871193ee517a958235f48990770a06838973537c6241af79a5dc1d05644a99c3501fd59f54824cfa4484c3cc1248fe12eda94bacabcb6ba82d6cce051
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB