Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 16:54
General
-
Target
2024-10-12_2c64a77623a32caf4b93f78005167501_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2c64a77623a32caf4b93f78005167501
-
SHA1
8f03a657847919334a0dc8ae53cb8a167c5c27dd
-
SHA256
5e91faac3378d625203fcbaac1b7b2f6691e3bf6808ca72a18327f3779e6dc8f
-
SHA512
00621f2dac61baee3515b47f7b17c1cfc4216445c097eaf626f968e2e1e10aedcba3e179e22c09501ae9be3d260dfbe7278cf4fea331b019f03c70b46c21da5e
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibj56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_2c64a77623a32caf4b93f78005167501_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_2c64a77623a32caf4b93f78005167501_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wAOnSdo.exeC:\Windows\System\wAOnSdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdsyoeL.exeC:\Windows\System\cdsyoeL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTfruwR.exeC:\Windows\System\oTfruwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOSBkQK.exeC:\Windows\System\wOSBkQK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvlUHCP.exeC:\Windows\System\UvlUHCP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CpgnUyq.exeC:\Windows\System\CpgnUyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhphAFs.exeC:\Windows\System\jhphAFs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xoJcvUp.exeC:\Windows\System\xoJcvUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wItrAMZ.exeC:\Windows\System\wItrAMZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvwPAgI.exeC:\Windows\System\kvwPAgI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exiOTxn.exeC:\Windows\System\exiOTxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGgJcvm.exeC:\Windows\System\yGgJcvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jieDWSu.exeC:\Windows\System\jieDWSu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdkBuHM.exeC:\Windows\System\gdkBuHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlsKcxa.exeC:\Windows\System\ZlsKcxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuxxTQH.exeC:\Windows\System\PuxxTQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nTTvezU.exeC:\Windows\System\nTTvezU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzvhGgZ.exeC:\Windows\System\QzvhGgZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uwaSeiP.exeC:\Windows\System\uwaSeiP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYwFWsQ.exeC:\Windows\System\BYwFWsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GfXvBMS.exeC:\Windows\System\GfXvBMS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD560b6433a22c56c6ac7ff07178b7763f5
SHA1c16c3569d5afbd291da4b52b72262a47651e968d
SHA2560da7beb6a5701d240c218c6d8010483f463e82eed0b614377f7cb4966d83da00
SHA51204b42fdbfe49b7063e139faf1bc91b9c5732746da5e76d400c3ca989784efe3e18f325db45446d0259b1838b6d663909faadd2fda973158b4ab09ab4e1bae151
-
Filesize
5.2MB
MD568e74b33710036d99345f2b33f728985
SHA106ab7a52d8da7cc558b7b78e5b8daa7c75da8b65
SHA256ee1ed1d05c74588afa19f3afc5d1c984525bcd4f9c182f09c8d7d731f939b858
SHA5122385e50be9cd3afb325b748429e511a945100686dac0058cd306973ff041dc61b514b3eadddff738ab1bc8b5ab3c8f03412b548918e2329517783f8a8ae121ac
-
Filesize
5.2MB
MD572853a1dd7ac7fa12c042fc5798561d2
SHA10dcd5028e8da292a826c446580b2946adf8f01dd
SHA256909d683500085c67feb4927681208b5913dc84283f25951cf0dd92780f3f6dfd
SHA512667574149cad72568abb33fbb7bdcd6a8412f0d64026f213ec8e2539c807faf9ff826af3176b540a31ddbe51129a1d0e5e1fc58127e78a8fc562e969ff886b7d
-
Filesize
5.2MB
MD530babee47d7cf73f796449bc049543e3
SHA1de4eb63a049d7da4a2742e61eecb77415934888d
SHA256e2cd369339628c21bf786458eecbf8162b4c7d93e19f3f96cf93a2d3af284c8d
SHA51205b5e57ffaaa5521a8912c32d6e3ab0dea23ff2d9a035cfd6c656d5451a5c7e6fb01588d37ebfcc61c500a6c8c5e6997344245b12a90b9940e2da3f0aaec2e4c
-
Filesize
5.2MB
MD50a02d71c1e6136d2438161c4c4556d76
SHA19686c57b77b719ddcdffce016bd4fa695af5e2b6
SHA2567f1106d1dbd80943d80a498b4fe7b8d04a1960909bcaf1d43413fd51b2fe321e
SHA512c1ef1b8ce4159957e2c82fe43a2cde7d9f46d671536377254521ea3c33b177412ae071df8c7acffef149b492d48a60305178b827348d0d5df149c50265ce6722
-
Filesize
5.2MB
MD5a831ef7f08e3641a01f489da6472c942
SHA12f64eca89db68dc5f8cc6bc841871df970153490
SHA25607356b107632f085fdbc75852dd2d9f1e325d02e8ded85bc68d4cc880f3a9335
SHA5124b7a292e4cad743da88116b026e98e61e922fb06f828fce7cb921db629945e5addbe1415520a23ada7fb0afabf668ce0424f086a3a3cd0a6f080493defbdda1e
-
Filesize
5.2MB
MD5293d2e15f66173fc1dc6044d16b84a55
SHA1003779099c7dc58c40105ecf2327388f5f23e4bd
SHA256c6c20d8396d07b12e21e3c597226d3809d544caf1277e94f0cc2717268d9d3cb
SHA5121260befca4e2e6638ee0e88528917e8c4a6aeead1740f412a8fdb64e8e2b80ffc94d09da4de68e084abf83162a00e27c47be4f0c068ccf1fb0db96a2e1ed1a40
-
Filesize
5.2MB
MD59e6f18309ea750d628b9224d07634f7c
SHA19bac5326032010e8502a5955257b2d9dfb6250b1
SHA256e6ad1524c31367ce27a41c5806b7b734e9c297f7db32ee92c2255d0044daa8c7
SHA512570192cc166b1b2aeb639edf68acdf85d52d0a29aaa74072a04092859b118e521526e57a25e0a12e4ae904fd144180f2d9a0a48110cc558a487a661d4f4f7746
-
Filesize
5.2MB
MD503a0864478e41ac0fb43007dec4eb30e
SHA1956bbc0c06e374992e54c213792791d8f5ecca8a
SHA2560005f667155e46fd24f93cbdd1588bba645d5f46363651bc649bfab9af9abfc1
SHA5127aae49e9b4a710b2284816c9d6ede745fe46b9f4c0766640645bdcea6bc977b474d2678fab0d0e253e6021fc9306e7c7d1dc0df9299d47d844157371a5f853cf
-
Filesize
5.2MB
MD573e7875d870071be782c231d5a6c55d3
SHA114739a6b4f32b2163317268ec08c4a85ab353192
SHA256c330c4d58881602528e99fba75239c9c3cba590f2b0b677dd1213ae01340eb3a
SHA512fcfca56da6b50eace0552c95502e8646f75618d68890c15ef188476385b746c973be78ee57fdaf9a03747579a464b54150b1492ca6ff1a79a35a9ec7a70e3a85
-
Filesize
5.2MB
MD5a900d4ad61d0c07822f9eebda9dfcc51
SHA187c10df705331e480360e5278ddb493c673c6798
SHA256fc64d2ce9d85738e56d6713dc2737e6c3c1983aab43643409f562e42fbe75457
SHA512378780f66687fe3b0ea2ecf5f48762175b6fda4c31d20be99b4a754cb5b283e5e7a110ea6e688bb56fab1bbc7f6db6f6e0ba4a660b9b519beaa212af139ffb60
-
Filesize
5.2MB
MD51c7ed5e5350d9f782b58b2ad8fefe174
SHA1b95ee075aacb72431829ad669372bfaa021f94b6
SHA25634d4412df81b19517804e6eae43224fc222398eda06394d63deaeab71b5b17de
SHA51210fce3ced4355530b9a33c8b0cfec3718868841789e5e9c7be836f785aaaf491b89a1364e4033a004b372389ac73ae283c63097716d8ddee9b9e7dcd5ccbb19b
-
Filesize
5.2MB
MD5c92d0e01cb86f3d4e51fce34272228a1
SHA14e6d38027fb43af2ec295ab1e7cefaf5285a2a77
SHA256bd7c1c866c5357d3b959fce1ccd71dfa33a2b75f18a08bcc83186d8f58d8887a
SHA512e196e79afc4fd7b336441601044df4125ea907b6b3496f35a84bcce4d730943e955f22dfe6d6e3ed81a1e5ed3597c413afd1fdb9cbb3449971ac73f7e48e3b49
-
Filesize
5.2MB
MD54c856a273dc55d2c20264f24eb681c99
SHA169a1df4980e2c5665332bfe130456fa6e75bcc57
SHA256fce4d6d4491216f7b1714401e861798170fd91c4023e42cb272fed33700e2899
SHA512465d1af6e7e52f054880c6e0950797ecc1ed5e9aa819d4d2346ba582e2112841930ad85c3f4d42a4fca44b4e423e3130460521e208a5a0371ad51173955cbb9a
-
Filesize
5.2MB
MD5997cb2cfc4e16de4eddbb89160fa20ab
SHA1308a997c687aff9232ab2a48db3cb9f25d8217d7
SHA256db291dae7e6857059e85c777aeaeb6b9ee1d63ad85520e1ef4fc991aa069d2fb
SHA512bced310b9a328cef873c79d1c9448c4ebd494358a97b4ef20981711bac2f038afcc7235f5ea54fcda25a3c5285a52e4234f8f0be59ecec52f309b1406e462212
-
Filesize
5.2MB
MD5c0ed11953efdca0d6c252bf45c754661
SHA1facaaf598222cdae8a3d872d94ad847a2ba37476
SHA256da9d592e7f09c89641c1722fafcaf4f13e855b69da55d5e79b7f163ffb74c600
SHA5120fd5dd95676a5b3206b4b9d6116ae51745de85e344968e6fe3c67de2127398b74f902db180026e67f72f2b32d749e6fa4d50bc4394659ee59e9849532f1f941b
-
Filesize
5.2MB
MD5b49a8f06b45ccf3bf427452789d5fbb4
SHA1ab1ddee1e588fdd6813093d0bb1116580ed51fbc
SHA256d495d22a3ad300e35d913a18c05d5d7e97cea812dfe2d8f4dede140210edb01b
SHA5125737e3aca10b9c31dae2c44a2ce1bc6b554b784a913073a24ace8d5ac6b159f5fcc2abaf519fdcec450b19472bdc9e88054f2792554654c594fa2094621e44a4
-
Filesize
5.2MB
MD540988b2c1c9e62630d3840618a873eda
SHA1c47a648ccef5e0fdf1a19eac4a457fc5f9b523a8
SHA256c9350add116523fa2e4b4a313412257d5c2ff4be1b4f609d2ac5e79444cafdf3
SHA512047957d7992e31cd5ed5971f3bfe4fa6670dd760c6b343dde44f5819da4dc02cf3992ff64b19e049aa5c48e3226d654117e25c4c0cff44991d28a0deea12203a
-
Filesize
5.2MB
MD56c66f78dc23a416ea1e28936db4deede
SHA1de25835c239763170b20dd7540ce71f8e3acd116
SHA256ce6e4e8eb76a20caccc43bfbd04ec5f8d4a9c50b8816c21500cd74c99dcefbaf
SHA512e9654538bb384f48b3ee7f816985db72366a24e8b70c79761ffac861615632be6f0d33c9b5b9c227894ca0bd55ad7e04e4f1cf8c8f379b2a8c7e54d7d945bcac
-
Filesize
5.2MB
MD52cd1af6ab7bc372987b6180ff761defa
SHA11dcc364763d66aae8efd45f847cf7f69059c1f6a
SHA256bd1e01b75e2cf84a96216d3afcc95b4e5904c5791ff823a8116a75eca0040503
SHA51269ebabb013c856ea64a28b11ec22b8d6043db7ce143ccf90f999fab6dc4496ff9adc10608b664b48817e3b37e70084992ddef420ee1c6e29e5ce67b56e3d3a42
-
Filesize
5.2MB
MD5cd50aaf22eb5f40fd4ee8d7d67166d74
SHA1e82ddaf63da168eecbdc4a2f6cb39b725e03a53f
SHA256c0d8bbb998affbd874180f42916d89a1cef7d5d6295f94ab718234c53f210396
SHA512333679e8a0d528ec48f85c8503f2cc801fb5a20d06055584b6ded2f992512e5165fbb5b589e8ac573cafac14cc7527f23c7eb64d49bb8151326a0a83fa67cfb2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB