Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/10/2024, 13:45
General
-
Target
2024-10-03_10a8e01d3bee78abb96e5654a397f7f4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
10a8e01d3bee78abb96e5654a397f7f4
-
SHA1
e15e45c1eca19395944df45fdf352255651ed654
-
SHA256
e65800bb18284bdb00cc599add54d0475bbc201cf326bed13384ea1003b357f5
-
SHA512
8e34d9bfc7533a67888b870ffbe86fb3f70fd38053c56c3cf8a0ca8075e7443c5efa68ff7468ecdce34b56008f24d5711bf04b70aa1c2db642ac737c606c8c6d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_10a8e01d3bee78abb96e5654a397f7f4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_10a8e01d3bee78abb96e5654a397f7f4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\miXePfR.exeC:\Windows\System\miXePfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPtABZl.exeC:\Windows\System\TPtABZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BoTgGGi.exeC:\Windows\System\BoTgGGi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGlpSTU.exeC:\Windows\System\qGlpSTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VsODnNo.exeC:\Windows\System\VsODnNo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFvNMqD.exeC:\Windows\System\FFvNMqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FkAzlRT.exeC:\Windows\System\FkAzlRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PppeDhE.exeC:\Windows\System\PppeDhE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LythCpE.exeC:\Windows\System\LythCpE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TRMAmAA.exeC:\Windows\System\TRMAmAA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlOdExj.exeC:\Windows\System\JlOdExj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pVgmWRS.exeC:\Windows\System\pVgmWRS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyJtSjV.exeC:\Windows\System\ZyJtSjV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lsErAop.exeC:\Windows\System\lsErAop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xDxSzeo.exeC:\Windows\System\xDxSzeo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zNEZOVH.exeC:\Windows\System\zNEZOVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbOObes.exeC:\Windows\System\BbOObes.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gcjoHIC.exeC:\Windows\System\gcjoHIC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZPxBKx.exeC:\Windows\System\BZPxBKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGwcawl.exeC:\Windows\System\JGwcawl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdcVGNA.exeC:\Windows\System\jdcVGNA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f26920063a3a3da983a8686244dd0f98
SHA130b2ca78603f641aac65c9756ea923d499a9aa2e
SHA2562c376a4ef69a8bea55069107e334c9920ae180b59ffd9e5948dc5e27d147c9e6
SHA5128d12f7fbd43950a85c47b2bb247d597f03f1aecd2ca5987fe612981c2b8bfb33f1f52e8aedaab829a36131e97d15f6a6715eeef39660a6279800b1e27af23889
-
Filesize
5.2MB
MD5627f13861f8786cfb2084e38da89949b
SHA16dc115be0409db5887c4f99d813b7cbda68bc32f
SHA256126e855e3f6ac748ca34545f1d2a73c190ae945d91a7188db86a4c15ffdf87d2
SHA51220c75c31cdf8b24783ecabe4a317eef4ea31a9ddf9fc8a24403826e1cd54ba4c7e8f126c76e720775be0566f9eb6a1064ef307666666e16543680a116942f029
-
Filesize
5.2MB
MD5734845b535f1d24cab6c9e1064a167e5
SHA118c3f803a70002e0593fd51fc530472bfb5909e9
SHA2566d4ff03cc857b107a9cb1ae56221df8b34244a8beaca8306d8b48f773af53598
SHA512f46c4367a11d7856d184ed0cf4cfddf4fe4c5675884234431dbe39cb4d85e36e86e9e56692acdb6683be5e7e8d86898ddd41b506435d87c6b4830c0735ffa997
-
Filesize
5.2MB
MD51003f205279d184d410bcfd1ce8485a8
SHA1526d83d0e63bcbda3fc5790ed82b5c715fc55150
SHA2564bfd6874f92dd96297ba175aff822113051b975f1772ffcc529403d39bfe6d19
SHA5127c7134e27867aa20257dbb2ef944030825f48b9db3c6f96525c09e1c83c10f08fb2a5719bf9722deb5fe930d99561da1d01e34a5b22fd1f6190f8699ede562a6
-
Filesize
5.2MB
MD5bc44c9f60f28e64e8a8a10dfa28bfe70
SHA1e77a625492e413d557416328c762d161c74dc4df
SHA256d629f416f5106cabace9cdac58a36efd89bc82c989db5bc3e5fc9780585a713e
SHA51285d3a61cac432de3e68ab99163c6ca1e61faa39de871820d2e54d56f90a061e0fa0d78a4fac40d624c9e1c77b95bda4daf5caea4f382e714bedb945485b5be0e
-
Filesize
5.2MB
MD5bbb0a4793b88679a1278b25db88e56cc
SHA1dadd9369d43035718e642f051e0841f602ea3de1
SHA256b239e14481ae49f7b0b1ed1224dcd2a81f68512c2da74c1610ea8febe52c0941
SHA5125cb407cc505fe90892defbd5578bf47b260edebbb7f31e4e1fb5af90fef5db62d9f480852b8b9245cfc8ada531120c7d626361bcf746a6987c02ffb2efac1586
-
Filesize
5.2MB
MD5df1f11ac99789f584339aa9494e1ce57
SHA198bbb0340ac205fc27468a202179127203e5441c
SHA256f392796aad9258f457f092703f719eb177b90a76de480f1b0aa3b0f64aa43ed0
SHA51250c3058b1adfdfde1b024532e70a1967f7c68ba629033cef9ad2048bfc6d8b9fe7d33bb073620b99bc7f7b898b1e85abd0271a410f91ab36a1b42aaa29333b5a
-
Filesize
5.2MB
MD5c5d6d8c06ca31c98ad6cb31beaa38fe9
SHA152468e7c037a1491e599f0c440aeef5e763bbc8a
SHA256e297372472f968c508d2fce89068695cc03debcd514121849610d2c6a6899665
SHA512ba94dde796ea8180977aeb5b2461517d641f025ae5e6d8585c64721b40c81c58644e4fe89488863346eda382042eece001daea525c956731754ea49358a1d44c
-
Filesize
5.2MB
MD5a9138009b5a60e53a518bd5d92f497b3
SHA170bae1f7b04b8f4f8d903c79bab49e5df18f12f4
SHA2569a0adb64e03e6c059d75fe56b4afc7f3becea14b5d8e9370025839a0aeef03ab
SHA51293d41e8d504fdc7774596117a89786d9e45c0e07ef5caddc83e4b807e52374022bdcca3ce2676d1632d9e40eda51c2cb3310587e8ec7d487b89a3e26a240f53f
-
Filesize
5.2MB
MD586fca413275965c9d0365836fc29d172
SHA15a8bfa07ceec2bad504ee7507256d01c0ba4e228
SHA256c646c2db122f3cc87b1ee5c9c3330dadce926cf8adbc7ea2e9414b0908522747
SHA512d4663a4c0aef29dffb0e3afeccf4a0f3edf672d545f873630c13428f2bbe502146b25519f088f720778529de9420ab424a4c4f4cf0cefb7611f37818b21f2150
-
Filesize
5.2MB
MD514209819d2811c0c1f86bdcf06e0e410
SHA1cd48ee7fbe551c8e8ef68d8b68833d20480fdcc6
SHA256d1ae931afea1d388f9e7a8f945c5901f42ac74a6b2457470e01bcae4d09d81b8
SHA5121f08e94372956e3adf1732b5e4c62e725af4c2a7b70a4b65eaf132485e9ad0cf33d9e2c91aef37f39e82d91ac55fe9b68544add659fc3fdb3b7b230241e58959
-
Filesize
5.2MB
MD58a11b0ebab544e87f5f83c2d71de63fb
SHA135c3b7deb4e0b9899946748140f426861dbee346
SHA256f32449c16ff4416a1f8df2f543a707beed479fc5f2aa82af0110fca0f86ffe63
SHA512c91dc209da16b6ea0c533653e5c4accfb6dc959b67f39ddd7bd875bde78540331fb46ad7ba21798bff3360784cabb374611ad8b87f1c1bd168decb3efbfecc8c
-
Filesize
5.2MB
MD5cf3539ed50e1844c1b209d2e2d3b98ac
SHA1cc0ee9255827be696c8e361ac395e3f5e6c11671
SHA2562d362c8c8e2376bd7197db4830cfdbe80f5dd21af56becf98f2e62dd933f1789
SHA512fab283c8527cbb3cd343bbc8ef15ce8ef136288eacab32b633cd2bf03af9f85f0c601fe93b228d1e60c9e1dbfda5747785d0cfb17dbdd8ddaf5caafb091af337
-
Filesize
5.2MB
MD511f2558dc8ce87dbd9fe5cadfbbfde9d
SHA198af8dc102a47d5275146d3a702fb59d525485d1
SHA256e8e5df84d121e5ab05516ec4361d482adf47de211ce331fe668fb8b3e091a5de
SHA51226222f0483fce7cdd7ceb3637af0ba975c03d8a918a941e6dfa62e36e4317cb0d89bd4d93e5d6b34ebec35fe7b5dfdf8fc5e6a114992101818ba489a19307d97
-
Filesize
5.2MB
MD5792e91b0bb51b61e4499059a655fb466
SHA194577dca1e100571d710f78250fa6da02d712769
SHA256e7b9edf784a32a3e5881bb45161c2f7eb8cf7b5a85c1262fa7b20d4af3b4fe87
SHA512b635e07cfc4a8341750a2d64bc23228226b3dc3676aa6433bc2c70ef6c8a66bbedf81c01945d7eb65f4dd0e3d238a07c0a18a245858af7adc1b8f7320a05954c
-
Filesize
5.2MB
MD5c88a2136782e6d7d327be788bdeb9f4b
SHA1ca81bb4934c9800f15ce8aa947ecd7abfe039d4c
SHA25637ade9bc5b22930e4f4ea7f3ab64e61db363393316cabd31a2ca5ca530779309
SHA512acef0de2c81cb5cd4c1885f9d29e54dcb75985bee1bcf282eece2c283367b23ffa5a5bcd2c90d1a6321ba691edee4cb8848c4c9a3f7ea0e0f63a67a8604f805b
-
Filesize
5.2MB
MD5e26948d1119785fb65448bbaedef187d
SHA19ba2c6a4ff385349934cbd6bd3672511fbb69572
SHA25650ff7b6d8e07e3d6967bb1dd3f8f2c86405a7e2c35eabcb68c26e0adb34aa906
SHA512ba63b9286c7862f7714afa724026e9278b2ad08d8b8dc8d800603dccbe546c356b1fad8e3dfb4607ec995da6f16c378dd9e80396626540d2f6db368b9f62a43f
-
Filesize
5.2MB
MD522e41fc250ebb20d73620d56e92006b1
SHA179d14e089347b1288ee32f8dd8659ddd193a1ae7
SHA256d3670dde6daf3f350f3d5543670ea46a03389339985302ab5abf87cd4d87954c
SHA51255984b574bfc2d1a8daf33964cab89e4dabd135f8556dab57a66a929996c4de5682227259e2bcb31283dc1faad229f390f7cc27a0e4ede5405f1327fb4576f09
-
Filesize
5.2MB
MD5972f66052c5b95e526b13df9150c8d3c
SHA13af9bfbfa51a9836a420a417461201aaf4c44322
SHA256b5b489d873d179af6f9bc102187cba5b829eaa4b0c470f378fa397253db95bde
SHA512cf3d74057fb0c4d2f51083c211b392980dea698bf66aa8632e493ea85d5cb6b450b2dd04b9e76f58244a0ff2d86ee92986bba4032ccd8bdd961e804cb7907720
-
Filesize
5.2MB
MD5ffdb59ddb21432df4ff61b24d9a7c781
SHA1e712d7df91e180ae00d4122885fb3fb17d6f343c
SHA2560fffc3fde72e496d059414bcd5c5cc5e28a90930e64ebed8188fd6a84c9af0fd
SHA5126cac468db23d62e6e54d552ebae281fc92bc1c4f8e0605c7d77a66ff042b6ee289c40dc162dda3d746a1f24d4712858b925f167eefdc48ae5a2ce72b9212a2d4
-
Filesize
5.2MB
MD56c4542dc327c75944e3ec2724ec6f4c4
SHA17c79fa283542b11d1925d702328eb77b6a4504c0
SHA256e25bb041250a1dbb67e4092f25fec4a8ef9f3faac09ca89ab80da61bf898603b
SHA512441e960be05f3cd7d7ee71a80d3b589f00c81865b28f8016106d868639b86713c498974452c113aa13f0c200847a1f2c83418f97ff5ce06735c0dce292f46add
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB