Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 14:38
General
-
Target
2024-09-27_d7c1c5df3eaca6ee14eeed00db7c4e2b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d7c1c5df3eaca6ee14eeed00db7c4e2b
-
SHA1
7e469b75941d2a7e485229198985e2b409fbd66f
-
SHA256
c8bf87778e6793f4fed5d2b9999b27cbc04fae639798e0c48685917c884c76ab
-
SHA512
ddd512ad094db15e6bcf72b80cd251b59120dc062b98e824d50547dd861218dda81ae0f57c1b799964c919de314d04b98094a72e47b939c4d39b15ad7e5a89fe
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_d7c1c5df3eaca6ee14eeed00db7c4e2b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_d7c1c5df3eaca6ee14eeed00db7c4e2b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ifjpmMh.exeC:\Windows\System\ifjpmMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XoFufTq.exeC:\Windows\System\XoFufTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HduaRdT.exeC:\Windows\System\HduaRdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwbcowz.exeC:\Windows\System\xwbcowz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uBJEPyE.exeC:\Windows\System\uBJEPyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMINzLQ.exeC:\Windows\System\BMINzLQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\abYhUkY.exeC:\Windows\System\abYhUkY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJzLYwG.exeC:\Windows\System\LJzLYwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkTbBHE.exeC:\Windows\System\UkTbBHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBdmtJP.exeC:\Windows\System\fBdmtJP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVYEjVm.exeC:\Windows\System\dVYEjVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JXgsBKT.exeC:\Windows\System\JXgsBKT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RJKMjNA.exeC:\Windows\System\RJKMjNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLvJlNE.exeC:\Windows\System\YLvJlNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jzIByZc.exeC:\Windows\System\jzIByZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMWZZLB.exeC:\Windows\System\aMWZZLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BzRyzZx.exeC:\Windows\System\BzRyzZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtryxIL.exeC:\Windows\System\DtryxIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ovwkdjg.exeC:\Windows\System\ovwkdjg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRCjRig.exeC:\Windows\System\uRCjRig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNzYJFu.exeC:\Windows\System\JNzYJFu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a497d3a9735707da41d9fe28cf248971
SHA1ec1b82e97148537601e3b5f04ccd1320a60ec546
SHA256a48284b303b76a2cf7f72634c1efc8007f5b92dd3353392156d100ba4890b20e
SHA51244d3d4db5df7fd64729abfc5c3f797ccd347711b7941bcca471d5ea56c12331e3e0cf40caceb481e35dcc3cb5b4af16ae2d61e04ff151b912c18971131591f50
-
Filesize
5.2MB
MD5f4ae90f7605deb7f4fdc53269a92553d
SHA11ff8c14357c765b81552e463190f1bacc98f43cb
SHA256a67d023c8dda4e6be933272ceb49d78871c05de2439c6ef6a3a6ed8703769fab
SHA512f6fede7b0b03b85036605a5493612f1c3191583972cc4e044eef7f794de47a2950c13c310388ec70aac307856890ad40a94a04d4cbd606155e3593d459b73200
-
Filesize
5.2MB
MD5c949a02a36971f08b7fc4e7f46e076a7
SHA18493c5035c7d4f4a8b40851ebe527fe39ce1ee1e
SHA2567bcd6b480ac02ed7fe88d3b59aaaa97db1faa5a6f7edc71239903f29b7cb8a66
SHA5123e12651e6384df728eea6f9610d572774f88c53be93c934674010c240c757c9329cfabefacef7bd08b5f5cfddf741b892853563a348d6ef52a0b22549f84acd4
-
Filesize
5.2MB
MD58f16d0b7290fc51b556848be2b5b88bf
SHA1c0c7ec97d111297051a10c47a1afdb72a4f03eba
SHA2560e216fdd93ca0b246edfe28b133c35d0c0e4952a13c71c51080ea6f4f1b44187
SHA512e6c81bd9361d9ffbba927c21705d2f9d9533f0e19b48cc662d1bb5c5f4cdf55dc86ec33a65585a0289e7cace3bb27955369152541cf10914a4a20729e62db470
-
Filesize
5.2MB
MD5ca33859588957c7b8ec6422c67c5b32c
SHA14ee26efb13434b8cd0be21fca8cc6be74a619823
SHA25652e7dfc6d0815061880d503ca24730cbd50470bb3f55b44a7720ed7db3c45593
SHA512ffd456bce7f8b174d3e33de4a9122ef76eb00dc57337ce6c497f6bc3bfcbd190b27629ee211958239a575315a9de9ceeaea7ae303f1b6876609cd89100b0bb06
-
Filesize
5.2MB
MD5f7f7d506106d56bb898ac6bcbe7e55d6
SHA154e44c91164cd897a05314a557ebfc01467a7538
SHA2564389b131ae9f2bcf7f9e02dc7d3a1d1ec843b23927fedc948543c8ca785b43ed
SHA5126a555de8a62bf3427ca30313ced1fbfff276be47f7b52b9ca03ec70b94412f261f406fbbcc8d92125adf828e7e3b10f59d120d98f19c0517cc92a51ed22a29a7
-
Filesize
5.2MB
MD5c71fc5848cbe97344a0b39f0e7317b4d
SHA1ea0454380b2e917a62597bc3cb2ebb64b7f048b7
SHA25697cb9b19d54b6e909b1c25624ebdf01da53031a50c837a4b8a197664b5f89be5
SHA5129b73114ac9565799d5d7ef224afc5a05f557d313dc3d42d29dad048714c6e9e1786dedb5738bb8d6e9794ba89a053a9f0f94b99b679ccd648495153b816d4069
-
Filesize
5.2MB
MD591615b222ab10fbe28128d1730c2ef9b
SHA1edbf8e4c8a26b818746e0743419bf20b51c8f24c
SHA256a192dc00e4cccbe7bedb93395364701c8169abb7010fa3195a31a27d507080a0
SHA5121660e2cb40f503f68996392aea213c84c8814ae7d3757dc089a736913bd4e77df92b9b874309e75699598095b42c7512b939cd71ed6687ff251d5397ef617154
-
Filesize
5.2MB
MD50cfee4923511659cb080733917c1192f
SHA167c6765947360d0b19088c12cc3ddffc5201e7d5
SHA25618328b5d1859f2da7bed43cd0bd9826ae5899d0b1ac47c2dc7aaeb76314d5d98
SHA5120c94f6184232ff38ca14741b46330d6595f94a49a2f10ab36649fc3a48ba2d6024dd6c5d20abc7fdbfc4c1c09f3928a3ead486810b09ffdb46aebf05267e1efd
-
Filesize
5.2MB
MD5c875c84735bc7e5cac70d549bfc83010
SHA1acd198d1ac87e00036746ab30ca854d6fcc9a5d2
SHA2561486865eb33feadf45ff617feccc16cc8ceb2b1a3a1fc57b3a35c892b81c434f
SHA51234dd147abdf303347ad976e373c6e2eb4f9e9361119f7d08acc563f0bf2d39e2ea97f8a43108d4f10b1c098a1ff90e80e40c9a90ed8fa238cc5ae2cdae1d5bc0
-
Filesize
5.2MB
MD5b9e2ec10edd3e823991740af81c08c87
SHA148d066ae85c6f17175cdb9f5c1686a25dc85cd4a
SHA256bf20769b949392977d23f0117735a0a507937998cce542260030a2ea1c2f19fb
SHA51253aa8ece71c8d11ff7e04e7eaf6d2c4bbb63f5d0fd3be41c968ac6bf317a1cf33fbf074362049933b608bae1eec74ad39770347972a5ba5ddc88269699f15f11
-
Filesize
5.2MB
MD5bbef16c1a79515f90d67518139f279ad
SHA18bd2437722a2b575aaaf50f25f0f4d37463325af
SHA256ca8846d24c439356977c91f73921a73baaa4ddf954aca287163cb357212795d1
SHA51285e76e9ed57a09e2bcbbedb034a41d152e1f7cfcb7685e23bae5cdbe403406898a8d921521a1e405866e3a878b60b3265eee52d053ac59c96ff8f0e04d34cd98
-
Filesize
5.2MB
MD543bcc088819f9d09fc46c683a010abe5
SHA192b5bf7ca99f9cf42845b760042497aab779de30
SHA2569fd7627e6218801797eb72fefff682b91f715d84f185862f90f44f9663fe29bc
SHA51274cf12eaefd2980f0cabe51803ccd84917d1fe6338a7007afb3b9048983b4ce7811b26128085b1802ed227212e42c8962332d60534eaf89e04ac85b4d4cf57c1
-
Filesize
5.2MB
MD582558913b92ca7dc1e3372e1a55a379f
SHA1932d225ce3af0ffa3bc0715f73c1e5cb9e83f69b
SHA2562fc6dce34c35a070de281215c76529578b61b0d55be4a196c66ede969dd246c0
SHA512f5c2f6a4e55ff00e5a3f525d45db3f24bbc9fee0eeab7cd5bd93d9289f52c436d4f63acf02e3163806a3b95d713d507e08e6f4163f5663719a10b14983d07e30
-
Filesize
5.2MB
MD5789718e220062ba5d1f3d9a523e280ba
SHA15a174fc1079b98c60692ad68fcef598d13c9c55a
SHA2567584c51516adf62aef7eee507c224a5ca3688f829c78e711f09cefdc27d6b246
SHA51278e04b72bc39d0490ba409f996e9942cc2d3032f1aebe080388f229b9eb120b8036ca50f0884c582af95e3e3a0810ab74921c7f3787ba70796fd192c04c755de
-
Filesize
5.2MB
MD5bcd0303c66fc2f2144957b2154021541
SHA15a8a08526942ce3892e10f6223a1c80968a524d1
SHA2567dd186738e980d92bcbb2ee1d1b9a4da02b4030e7ac318ae5d7dc324b528c2f6
SHA512340a1d7e3475ddc9d7c3d7bc5ec01f56ec47c2c05bc6a1ef680d34a1a8ca5e61e7599ae6c4d96282f84a118d3a5735338fd52b42a1e02254df9cee11c2215863
-
Filesize
5.2MB
MD540f3be2acce1c9541577076ee20be13c
SHA13b19078094df13172306c8f111d173231b3987ae
SHA2563255738a22c3aa7ff29b4dc22c470c77a157786b86f356a79e22354db22af75c
SHA5121f8954d20d397715d7c2fa8125c9822ed0b965f8f37b8a7703f561af4729360ed0364e3004fff379806b79115cb1e2c39367bdc294c43bd0ed5c65ca2c9d5c09
-
Filesize
5.2MB
MD52968409233cc0a73d8d6d66ef8bdd8e3
SHA1d87df3147df32cd3a1af2a5614499cf208263cbe
SHA256b833083f8741db6f4b55b6ab50367eeb2694691d28adfd92fe97cd67646fcf4e
SHA51217bb7a1d664286e51448cd8d07a37e6c2abfc430c739d0c445dd5d3084aea6fad3e9b24a9cc35a65bafdf0a2f8fc3e6cf128dae99d75f525cb9f7c39c30bb33b
-
Filesize
5.2MB
MD54442206cc239e6efd9e1faf7f7be7c02
SHA131a845b40a8cb99fe9332491d7ac2ffb54aa9eac
SHA2563ea7ca07dd15a390dd32a9e3ba1608a73f76588b3b398ad7cfde7268af8f1909
SHA512f6b7b3a303d127da311e3fcafd52df6a4c5831ec64253fcb5f2697f92c304ec32bfacd0758ac9c24d0bfb357fdc6e01c6037f1f6d7ddfe4f640731f0dba7cad9
-
Filesize
5.2MB
MD5d1557a5a8bb55e8efe9a9b6830286a47
SHA1799fbbf2745d5fdb4f1449f6c666ea9fd65a614b
SHA2561748cff8323632c839a4d841a358bb16e3cbbc755d99c9ae0ea3d6d2a052bac1
SHA5123fca4c8ac0ef639e856bd0bd5ca53c4ddfc25c6972430d2b57a3124631e4a6623bce6195fc3d9f4482bfd1900b3046b10ca1be2d4c398268325c711d91bfe10d
-
Filesize
5.2MB
MD5c511799252a54d5abe7c18e886360e23
SHA173d1bd019a5a4876e5bebe330cd649879d7f1118
SHA2565a1846aa66b9304427b8b3d61c6c6f491785a1c59dcd89b4ed6ca818f46f4237
SHA5128faebf2113a40336216e22ee26184dbae945c3d9980a9eae2c83b2efa77969d6be675bd6c1e221d2f8ff4e1efad5f9657ef7efa44efcfd1e15a7460c908b1592
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB