Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 14:10
General
-
Target
2024-10-09_650edeea4c3dd560f8d799d9fa38550d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
650edeea4c3dd560f8d799d9fa38550d
-
SHA1
0af0491d63a9f218d2bfee3f0e05b09c372bf3dd
-
SHA256
83def0bfeed3fbac6266334034de9c5b5ca4ede6261a521393f7d88d4819cc1f
-
SHA512
c76674b77e20c3c331293be6a20308e74227f6ef08ef7e155d77a861edfe4f46cae443a9ef39ac24b2948946933bbbc0567533bb80ac3844e0d118fd74d59888
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_650edeea4c3dd560f8d799d9fa38550d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_650edeea4c3dd560f8d799d9fa38550d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QZofwfz.exeC:\Windows\System\QZofwfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEifGzI.exeC:\Windows\System\zEifGzI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlvozdU.exeC:\Windows\System\LlvozdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMpGbeS.exeC:\Windows\System\DMpGbeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jbeIgrA.exeC:\Windows\System\jbeIgrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrmFHpH.exeC:\Windows\System\zrmFHpH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rESQTaB.exeC:\Windows\System\rESQTaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eOTzCTD.exeC:\Windows\System\eOTzCTD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuixOUU.exeC:\Windows\System\AuixOUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NOlSBiA.exeC:\Windows\System\NOlSBiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGwLOte.exeC:\Windows\System\nGwLOte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VsxgBOe.exeC:\Windows\System\VsxgBOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEYFdAK.exeC:\Windows\System\fEYFdAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xraUYsR.exeC:\Windows\System\xraUYsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OhewwUA.exeC:\Windows\System\OhewwUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EvkjWCY.exeC:\Windows\System\EvkjWCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbJZxWP.exeC:\Windows\System\wbJZxWP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SFPBDLK.exeC:\Windows\System\SFPBDLK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EzACZaJ.exeC:\Windows\System\EzACZaJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bHmiOsh.exeC:\Windows\System\bHmiOsh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUhFaxA.exeC:\Windows\System\XUhFaxA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d1aa760880eeb61a412a3a47657f9e31
SHA175434077bbe64e389f91ec19985fc7a581c0d6f0
SHA256c3a87b83f91e4e97258d89cec207a7a11063ca289e67e262637ab0ea16ec502d
SHA5127c9626475de46cb237658db283019519b9039ec319bc79db239a9eec5140de4d1cdc8a128075429514c985b5424fea56be5853938dc8927714268ff00ca08724
-
Filesize
5.2MB
MD536f2480d80cbd1b1256bc0b0f95a2bdd
SHA13302bc4b6670005344baf3c4620beef69f5acfa5
SHA256a3ab8190a29664ef11e3914c9cfe831c58eb415c6bdaa64378075de87525620e
SHA51243fe726a864d4f6afc1254113cad32622ef914936119cae63f8f1a834149a75f9c149a205e30224f3736594ba5da99f2339d00e9a18835c0af2dde7f279ac832
-
Filesize
5.2MB
MD5dbea1f66a9145d640f27db8b9c2fe373
SHA105947ec7f7364cc54122ed141368298bad6badd1
SHA25681bf5ca622024666079c250ba32db722b90c20a91b734f1f4c39fd8b027965c5
SHA5120c9cb0dfed74126f015b8e52076a3f2c2a5bca0cfd18ab661a6522a3386e85eafd98f6295795bf3e398d9954f31c43d85313a5988324f5e7c05b93132d5c745a
-
Filesize
5.2MB
MD5086c5643568aa78469d0d78c4af3e684
SHA17ad067a50a7c331fc7deef28bc0df4a57d46f2f1
SHA256144012da448d64fded88d042922246377f64c48638cdd59fdf0f0007e2bc0363
SHA512fe5836c57f9c0b62b3b94df12d3a8b8dedff68ba8c3c20bf4d1c7f14ea8311b1ef8039fd2c7f34ef12d8ee04a2913d141b13d3a9265700d88cd0743fac75e91a
-
Filesize
5.2MB
MD5db9c37f01765c893ab26076573809cd1
SHA1370851fa2d73617a1da9f47cc9c934716434d464
SHA25616eb8cef4a4c27066ba107caca0eadbb693280cb3e61a7bf7e1c8ea2b4b03983
SHA512fabbdb41a00da791fb4724b6be21cba0a5fb2b3fb1ebaf86f00390b44eb0524f1ae81e015a6d8197dbbd295c3d9dbed3e67b317b2cac5adc3180a698dbe91614
-
Filesize
5.2MB
MD57fa8a8be9c32911eb4dbe1ca1797be57
SHA1ea929bfa76cd679d12dbd6953e0a025f9664d841
SHA256e7bec16926896ae00894f9779126eed86b3120f5a81dcd608d62a27fc8b4b2e7
SHA5129bdd68d4e4465afed46a64a459ade7a25d4ccb09f1ea2dfc8456cab5362e4452f0c59542d53ad3fd219b0096f80bc7ae012405a88572ae74f8e2bb32c8bc1ad0
-
Filesize
5.2MB
MD590589ae12181a70349ff71fe0a5bb0f6
SHA1ae1c4b9214cc487c1637333b05a324415e7f46a9
SHA256600f826f9446647b8e522b5c571293722801872c8bf6476d3180d99a1ede185d
SHA512d5ab9bd392d0f11241a5f1e45ab11b86272eae44495805d6ab626c953aeea017a3eddb91a036cfd6fe1b539162b8c433c0ae4cee62956a818fece2c4b2f581c4
-
Filesize
5.2MB
MD520079ccf7f3366331e1933ca2106ce49
SHA16bdfd7f927289f178db57a598a814083cc6d90ca
SHA256e0feeccffa510f1e36228eb2467eea49cc037d71efa305df78816fa8cad89b46
SHA5123b6535e221d55d60b38f721f49781647c9cf719541c35f8a03ead64d3df40d1e89b5466b9b5a72d162f7a128d027e8ff443d63356473835ed0747ffabcbcd4af
-
Filesize
5.2MB
MD5344f429924b0c13931fb1d0acf72719c
SHA1027abb1b2e70a761dd9a55a819e9134b0d7e7911
SHA25686a941ea9642a082d6115408d22f391684338f89fdd8bf3c530900125efaf983
SHA512b3ac495689dcc02bdddfcb54fa47c36b3f50a2debe992342d2158dc731a81e6741014956e5125965d21c6fa8d189b3f483b36eb08c53838aae6f393f4a0f7b74
-
Filesize
5.2MB
MD524a06972ccbf93ce14101ae4f41e8f28
SHA1001ecf8ef89d12db5a646534f1785c510452ac24
SHA2561a3b9ebc7689d26bd655d3170cdb4cbdeb1cddc4f04cad36c2e3d5f1f7a91068
SHA512fbbe4616f1614a7ba7d9044595540e096aa26970e9ac348ec06a1dad94aad226dd5d0824a2dc6e9d740f450fd4359215ab84a29af48f655dcfcd6ce574b71b0f
-
Filesize
5.2MB
MD50a38e341f3285949ea7e6477e2b08b66
SHA1144fe48395e53891f5bcf22bef6726a8126dd193
SHA256060a773e248f90849fee0cd4976d2798e243ca55561ea2ba6f9971d3c1d67a88
SHA512447457d18a67719aa0681c1290d004abe67cba2aa0e5a8a757a99a9bb8d4be17cd8aa41aa412637d8a847bc2dde33dbee8b2bce2932ee129cf0a445a458197a6
-
Filesize
5.2MB
MD5f002a35feaf745656c90a7d6274c4491
SHA14fff3345d5429bb33b50d1c38973c824e20c4838
SHA256ed61eeb3fe9f638d6e52f11e6c1b136c1482cb6c60894a01717ed09bf5a48cc8
SHA5127a9c8f4c8d154b74550cfa8dcb5933b363b1f25834f6010f8ca0c953925f774824cbb1f0d4b9fb78f84574280d00f9ed125a130ba7accf8baa75f4a2ebe15664
-
Filesize
5.2MB
MD5dd68ea91f27d44dfa8838dec8f42ec3d
SHA131adff3040b17f18973b06cba1be48bcdb56694d
SHA25622a04e0e24e81736d02a7c7f26d9d9cb8c2ee359e9a0dbb7792199d06d0b5ff0
SHA512b3ac109b43650156598b83805c5a9d6e3714b22da4a4e9ffbe9aef4ff3027d788ebc1293f87d142aed64499e31c08d5581ef7d2551804e9aad959b58aa9cc119
-
Filesize
5.2MB
MD5b6e73f0c1dc93a8afda89ccff4a429d8
SHA1fe98de0a6c63e1d8f83a97989294fd7c267fa7e8
SHA256f0fdaf92d57d83807fc6317b76f9c2aad7895ba13eb5a247fb7fabf36b802477
SHA51240bb2f9572a09387d014decd6ed9fb133facbaa523b49e143dfbd9904fcf2dc00155fd6f22430aea586136dd54699eb292121e4f5b2f8e9d02ede4b9b1880b64
-
Filesize
5.2MB
MD50f03257569b85c734d76bb603bf22ab3
SHA1026a0944cf3aefe573d99f3d6b9ce9396d106094
SHA2564f4e3cf86fb9f7783e296e837ca30d17962778e0680ca274a66842f74ef88e6f
SHA5124a227817eebf0c490e2e873f0521d39e2e0985376faf6e4d0146cb418acc2be10e1832817f7960dc546adaf3652824f7005e55199acc1223b6f269384c87cca0
-
Filesize
5.2MB
MD51b66468d739f642b198695415844223f
SHA1a01242c21a690b89a41eb1d1af9639ce2f83bc54
SHA25695327ff52857045633e7be4874020fcd3d1c34a3904ba645d5f0eba6e498fbde
SHA5123c2ea39341e1a3d395c6ebb8538d64a83f9866a5ce10f097d07aa5eb273e6c836aaf1134c9c70b770f8b5c1ce06b89bfd032c9e8eadc034d6d3965d7830241ad
-
Filesize
5.2MB
MD52dd13fcf19195b1297fccdec5ba79fd7
SHA115c1ce0f3625a968d7fd30d3aa920bc8ac992050
SHA256e90d9456ea57b77d595a6d17633d5ff2dc922650d9e58a0b6908f4e44ce0e240
SHA512e7faef3d4c61aa33d420dd4e557ed11d1d61295d0bf4259776e0f7fdc0f0363be017fa3a429f40f09e3e6b77cbf86b148d65f6cb316d7e565d46a2aff682507c
-
Filesize
5.2MB
MD5d969a93d24ff1be8aa8fc71130fb4c3b
SHA12a1e7ffc16aee722a39a6449a4b47fcd1e8b17ac
SHA2566d8c8ebf58dac9dff724cc476428aef60d2890758e3400ccbd086655740ba85e
SHA5127ee6828aee289c947cf29d7158f41f7005c7e4c2fe4f494d0718f3bf565f9394f795ade1d13eb22a67674eab5c72b26a1c873bf9fe396372f52ffccd6db78567
-
Filesize
5.2MB
MD57c0e4881eabd93d69c5cbccdfb42786f
SHA1255bf114526e799f0820e9226c0b5e3530b15bd2
SHA256a735ca454256c3219b68250e8fc8289046cea42eed1c9e389218530a5beeea9a
SHA5122d4fe77c0b077ca654f0cdd325ec0d1c154c8479056466d51b628ae4185d23751e76efd3b21018c47e0a2fd81c505229c537368726ff11c31c909f1c4919a2fb
-
Filesize
5.2MB
MD5bf01eb9a0068845a76ab0c5e85f2417d
SHA17da58b191fc50c70d0fa806abda7281d86cfe8d7
SHA256a687dd4fcfca078563a80b9654a90e6002affb87ffed83c065f516262bdec212
SHA5122dc03822a6cfad44dd828ec403ec50eb2c669e62f5441095b4bed5a3ae842864581e0e639090e6d504ef1e69e0cec062ed241bc106209b64d135a3c6590de3ce
-
Filesize
5.2MB
MD5686fdb681a7f17199c9cd44e8ddeb0bc
SHA148aceab64c1aaf5bc546e85e7afd9a123c1c0cd1
SHA256cac1f8824c65800fb33a2d1cdaa9e3e2d700b74bc3f7e924b5a9898fd2f54b18
SHA5126b90bedf8671370e11e44150b255cc94fa4e186240108e99f7118b54ec421ed1a2eac40aac97d75d4112ffc0309bf5dafc156fbd9456425802605609ef1c37e3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB