Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 15:31
General
-
Target
2024-09-30_f8ab2ddf99e97da64b99e5b6433e786c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f8ab2ddf99e97da64b99e5b6433e786c
-
SHA1
f2c3ebdda9ba882cd6daaa21d3811e2ace368e06
-
SHA256
6b04d88e211747e105b910cbda4153477ab6613dbab87ef5cd24f78020e912ac
-
SHA512
61ee7c611bdd479a221611b4d1473ed148192fa37c66b47d90fcae7e6faded0f40986b3f3291d9282fa1c490e0f8f2bdd60870586324a395a1bac78e21a94845
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibj56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_f8ab2ddf99e97da64b99e5b6433e786c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_f8ab2ddf99e97da64b99e5b6433e786c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UjNWcpf.exeC:\Windows\System\UjNWcpf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YaZXLhP.exeC:\Windows\System\YaZXLhP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vghXSxT.exeC:\Windows\System\vghXSxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GMmlUoQ.exeC:\Windows\System\GMmlUoQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMFyAob.exeC:\Windows\System\PMFyAob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilYwUyU.exeC:\Windows\System\ilYwUyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZAxmEN.exeC:\Windows\System\CZAxmEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuyIQZY.exeC:\Windows\System\CuyIQZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xQlZAdg.exeC:\Windows\System\xQlZAdg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzVwUPA.exeC:\Windows\System\rzVwUPA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYdLKcl.exeC:\Windows\System\AYdLKcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPbhEsU.exeC:\Windows\System\TPbhEsU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqzDpjX.exeC:\Windows\System\YqzDpjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kBPRwHZ.exeC:\Windows\System\kBPRwHZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LeWkzWH.exeC:\Windows\System\LeWkzWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GaOmnRr.exeC:\Windows\System\GaOmnRr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLXlhND.exeC:\Windows\System\HLXlhND.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QKvXNtt.exeC:\Windows\System\QKvXNtt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WoOPkWi.exeC:\Windows\System\WoOPkWi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVsOlUY.exeC:\Windows\System\OVsOlUY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOHhVNs.exeC:\Windows\System\rOHhVNs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fa346fdb28c996df2c6a63e17dce4052
SHA131338cc33c4126737cd5af312d6c70e92174c1a3
SHA256ce5d26c5abd258bffae62c7ff01437477b5d1b98db8b6d3e7fcfa5841415a8ec
SHA512651d58cfab704c0f719f21d698c3a6f1a80850cb1d89ab7ffc14bf891cd6bfa48bf67488b0c207482d5de15f5783f60810dd086951bd00d778a075df50c3f0ae
-
Filesize
5.2MB
MD513b0809f67bc61523f8bf6d317738831
SHA1965c77b47c9009dbdc6f11fbb2cf543d140ebf30
SHA256f7a7dd2dc020001d615bbb00a451e506b4507a758e64fdfc03f520f05267b5f7
SHA512e01115a093cdd616bcf8bf7e22773046088db88a011011b5ce056617778c12d77c8c30c8f0bd571b79e9eab424be6e3c27e654611913d975a027ed2cef067071
-
Filesize
5.2MB
MD57cdd7d662172cbb4faffba8e9c2db449
SHA1978889ac3a7a4d6ff003b3c0846e3f3ea47e5ab4
SHA2561b8406ea7810077cc76327ae0eeba32dd482e66b367a9b1058af050bb6d2765e
SHA5124bc17b4c1b0c4abb2e61cd7cfa1dd8a1fba20d85973df130fc9d30af6cb97745a1f807fb8db8a4e03017fddaf6f6b7d1cbfd895c850d61a114579c31cce1cca7
-
Filesize
5.2MB
MD55a448497fa032c21dab36ff76bdc6eea
SHA1fcd8d23501178548f8753009c8bd751a2b2cf9ef
SHA256967cecdcb9961b7a87b3eda618be3c44cdd5cc29a61e3de08a52796b467e0462
SHA512a5ca1151c0f810eedf670ad58918678bc02beae77725a658b6c0c374e269caecc9db3afc5c66ae592ad2a1b3f85bf01ae2543d04c6b02accd406656c32b96c41
-
Filesize
5.2MB
MD51e654b38f713e6a029b75182db3fb78b
SHA18aad3b6a6ebc8671a42179b2f3b02f13e65f48c9
SHA256b447bcb3c73d00fb40e8533bb7dd635c5ae073b8fb9c975e39850b492a899bf3
SHA5127ea2a232b1122bee36a3278848e4c7ec9778818380c1c320c5fd6ba65bbb958368e18fe317a74454577d059caebcf8aa99db50c2b2f3f4e9160566b5220bb14a
-
Filesize
5.2MB
MD53735fde2ab9dd1edb3b633bcd1453721
SHA1110818fb78640db15a2ffd15caeee38b3ab3082e
SHA2568a3ad6b8c620d675f872746da438878de3cbeb9d687019c8284285a149407635
SHA51276beba91ca7c9e8b2135d67fe08dd6a681636812f7b63e9e807ff10e294dccc7952e9b5716d7b0b61d98b141ce9ab10c7441ac4b43b361672d2ac8ce9e1befa9
-
Filesize
5.2MB
MD5f0324cbbc16bf07e05e9dfcb2b5f7b05
SHA15f7b04792764539a6c9c5d735bb95d212792a7a4
SHA256e4000312112404eacc2b8f82b61377277b32479edfe8f1346d616b87367bbbbb
SHA51211890256aa0fa97d4850729e827f50b646441cab5316acb92af133a9839e316cc5f319a9fdff20fdb78eb30e34b35cb7bb3083101679e1ab0de40ed36ec275b2
-
Filesize
5.2MB
MD57a83762a82941ae079aeb2c0ba993bc8
SHA1794bf3bb2ad8a1d2ebe6491e102b06b05414717a
SHA2561f951c3b411670a2c7e4cf3f89800b15e3b667b44122b18ac5eb6c5cbed8b2a3
SHA5123b879a1c754d609eeb7515596ab90c42980c7a09c5d6db636508c7064980f8eeb447499b7fc1d1c6874d826d31633cfc630b7ef79c9fdd98d7ef4c697ea55ff4
-
Filesize
5.2MB
MD5c99d9679b13f9a47c771257bd26fb3b4
SHA11f2bcdab2148233f547cd0f97194d0e23644ba61
SHA25626f62523631838f2de60eb3c78aab123b12434371c72ad9eaffdd1342acabd0e
SHA5122ac2d9821982c0fdf9ec43e04989e27fe99ce0446d182fc46bf74bcc4071be172c979b1a3cb59d35a0a4878b0c521b51523eb9ced1c5a8ff972b14329ca1f20e
-
Filesize
5.2MB
MD5ade283458c3617b7d423434fb7ca1d30
SHA158e16773d0cb30cbb2262a792ba4b3af181a7a71
SHA2561fff4007d439697f85a768180f3be53ccf898506073b0a42dfee5cff6feddc13
SHA5123846f4f7c218ec91dd8621d10ef40625706e7fc99b351a09b89b42d0f43bc664cff5be04e7144bd5f64aa7e706e34e5169892cb06f139445fa8114207893aa15
-
Filesize
5.2MB
MD514c74b4534957569ecb4ccc26e425e92
SHA1b5383b9cb35124497a08a51746d54615c7b263dc
SHA25605682e59d41ac50acdb7289f1a2a0238248eee04dc95ec9f473dca66ed82573b
SHA512fd8868ac1892be829ae4be911e620a0f3832ac93e6f233b35e6a14e306dc2e4e74d1424f5ee748e0305f22548cdf64dabba9da4d01119a19c3ab641157ef0b78
-
Filesize
5.2MB
MD5ec46eb6574309ff467dd84be1d2a5845
SHA100dec5cbe98c299bb754ed3c72f54abd1259c832
SHA25616942456bbce8a3a0963dc02b39f71aee39dfef65d7983338a206bea2c1f5b15
SHA5125348ae608cfa3ea1e2491a6911b82823390f962ef46a7b8d548d762f9c84fd3307153e820737409a08fb553f4aacf3a90bb695cc7bfc6b1a4412c53859369f70
-
Filesize
5.2MB
MD56e4163d8748b416541ba2bb06c77c331
SHA1d875a5eaea0c49c724a3ec18e0d536c7c2f91225
SHA2569e27067730ea94bc80cf414575a80717e7ded7791070a5e43a8ddceadff31a25
SHA5122ead475cee7f5974e871977c160843192b5a4864542fd5cfdd27aca4d308c42b45f11cb5692516cb9358528a9c8a52b6ef09b3a66ec9d07c20696570dae34694
-
Filesize
5.2MB
MD52d544a9316643ceae31ee3ebcc4bdec3
SHA1bd2575e645295e2b82f463e336775a36d2f3513a
SHA2568ed18ec271cfc5895bb7c349cda5c94776b31e2604bc570af51479901ce0d819
SHA5120c33b89bc0f084393ae8f5b79b9cb7919d47293425d21cc6597ce84b52defdc3fbe25391c67bf0f91dd63bf8e5da2a641684650e7077daf67ce58fd9dbafdbc8
-
Filesize
5.2MB
MD5e491c7d6a219693ec1c37500b850bbae
SHA151e5aaa417be4f6d06253073eb36974bdc229317
SHA25642ed6b0967159cd70d879c2613fafe3fb8197b60e2f2fc65ab26de389fafe4dc
SHA51276ff1806c39c16c89005b9d2c88c20f7afac4277b1bb17af52668b1cadec228875103246c4d78c7f2cabefaf9ad9bede9037a20d86d5f0561d823bfa631b3223
-
Filesize
5.2MB
MD58b73f74d8f0f5af967454eb08ede8fb6
SHA1a2d946517ebd07eb79bf7eb8846f5f1f1530676f
SHA2564ecb719bccec5f4d9c16fc115d98461947bbf9c5bfc5183a80fcc72a1dcbee63
SHA51238debb566243a93bba7c4fe25846124b7f005c257d14682bbdb0f677a8830da893eea5fd07ebca349d5bc1e4aeb7430eb2059b551b9f52813f29a52b4fe9bbe4
-
Filesize
5.2MB
MD580caa85f6d2033374dcead48dfc6d384
SHA1793e179578a552f8364eaf2d44bc966e01a83d86
SHA256e7fc2da83a77118fe295b9e60bd1b3503e214159d87939c9332d955da8ac0f99
SHA5121f4444bbb619d94e8ada3248d974ca504ff51407409f45a714cf01c39fecfaf2da82cd8038c1e1506a9447d1f0318a014aabac99300ab57c2e4a4b04946f6c2b
-
Filesize
5.2MB
MD53809f0ebf8cc06b1a4dc7574386c2b34
SHA1a07a12e57d1df275245a6c8596831190d623d5ce
SHA2566570d1f23e403d92ad044cb38a4aac6a27e54fa3ac0211ac112227170fe8cb8a
SHA5128fd694f9cf2f09cfbe04866406b6b9701197ecdec6e6b52c900789c592a4e9ecfa0831f79f4f5078b6a9cd989235e3bffe592c821a830da3ba0ed45da006e6c4
-
Filesize
5.2MB
MD5c24424c8b371b1fad3c9414e6df87bf1
SHA1d1ac3f51d26caf04f828590c2c65c57a3fdd46a1
SHA2563379121899368e41cd7a2d732d4e09f46bb21052c4027f288225c5176a0187ea
SHA512f755c0cd11c18cb6fb9225e17096a625cf3cec394a8ee78d9f023c698750c51037ac9288b23b6bd7224d5d41e6a039a1d96cf816eda9b1237bdc56a0109c4e92
-
Filesize
5.2MB
MD51b8230d0f24e29469a0f568bb2a919bd
SHA15bcc7a28572cd79c7ba43505cb60163bd0c91771
SHA25607f94e538c8d61ad9ec442afababe7291872a0736a0d6f8a5456f133534e111d
SHA5128eda6fb8a421ea5339e09d486281e04889374983af01a7f08ab2a6e67c7b45a925b187240d8b3c3900960aade208eab20291b7181ee85f7f3a64af101b669d23
-
Filesize
5.2MB
MD5ce691931b33fca6ec71943dcde7094c3
SHA1f664c0317f76a4ebc0c2cbc8514105176ea8f90e
SHA2561bd59bd06ef728f062577b0b770d42a088cd77a0ca7b86fc1d41252ec1923825
SHA512b5f03c6ac93daf032d1505dcc39e3e312eb0358379da0e9ffd6ae65dff1f6dae3e787f17d83416d157b00b837ccb2997d1ce81b2204a48f4dd34a13053c934c2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB