Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 04:22
General
-
Target
2024-07-23_084c28207fc55414b3ede2aaab9a0ab9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
084c28207fc55414b3ede2aaab9a0ab9
-
SHA1
8488c6e82ac7a3c1fb4ef8a3e17594958fdd1aa4
-
SHA256
21320919a28c259dc12a91fa8f2628c888756420d455b220295e94d3d60dfa6e
-
SHA512
92f129c1d464528984b94d5793f55c4b722b9d0c48cd2560d7828b8935fe11533f8451a406828046775feff29f155509337be7af3cd5246105cea086eee13f0a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUC
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_084c28207fc55414b3ede2aaab9a0ab9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_084c28207fc55414b3ede2aaab9a0ab9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iECeCNc.exeC:\Windows\System\iECeCNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ozkRjBk.exeC:\Windows\System\ozkRjBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dARfqkc.exeC:\Windows\System\dARfqkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXNthQp.exeC:\Windows\System\qXNthQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bdrelZV.exeC:\Windows\System\bdrelZV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KmNDsSI.exeC:\Windows\System\KmNDsSI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OwfieEt.exeC:\Windows\System\OwfieEt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiMAagt.exeC:\Windows\System\qiMAagt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tnYaexw.exeC:\Windows\System\tnYaexw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jSsqmBa.exeC:\Windows\System\jSsqmBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vCaAMEe.exeC:\Windows\System\vCaAMEe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ggTmDJW.exeC:\Windows\System\ggTmDJW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSsfBEM.exeC:\Windows\System\gSsfBEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NiYppOh.exeC:\Windows\System\NiYppOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GDaoGdN.exeC:\Windows\System\GDaoGdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFhrRfd.exeC:\Windows\System\oFhrRfd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgPsHqV.exeC:\Windows\System\CgPsHqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xpxuosX.exeC:\Windows\System\xpxuosX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAsmokJ.exeC:\Windows\System\IAsmokJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAcVLNc.exeC:\Windows\System\GAcVLNc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unhnuoG.exeC:\Windows\System\unhnuoG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57893bef3607002621848f1be566bd8ee
SHA13787cd8e5d8b87a706295535bc06715e4ac87222
SHA2569c968e2c5e817f502a13afb79f7c41719b61aadb95f0394b06b46202cfa14884
SHA512786f85bead937a6fe2c7e36ab0444e5f603b61aa530aca0cd897344b2bc482aeb582c03a51495bbeb1c23c48ddc3b84941c341c0c1d5ecffdfb88f2e6f546860
-
Filesize
5.2MB
MD5383535fdc7aab8dbcfc587e01071632b
SHA15c8be66a591bbe782ab6391b86d9517cdf0ad340
SHA256de6db4b5de9e4d870b9015612936b7d67cd7206e4277419e6defb499cee5be83
SHA51288e2b01311c4dfe5eb59ef44fbda24122341836c55abe6e96d4d4c0b260a07fe3622601a332cc7faff79145b5618ed7376887e2481ea32df2914eedf07a62ac3
-
Filesize
5.2MB
MD5e409f7016ac47f3764fea8e9a3fbee8b
SHA15e017b9e4fb69b2c61d72cb68dbb2265fea50745
SHA256297bc56ae5e5a4f3847b51ad417baccd8bd37f8492f456832e26e2fdca4598b8
SHA512431f8982d0a0303dfc136f1d034c6bec3790d269b13896187f34a965e87bb8582412e539046c9090ed7ed7b1e815f3730e733098423ab5baea390e5a93750ef5
-
Filesize
5.2MB
MD503edf410a6746638223ae76f6a66769a
SHA1a048b98ffcc3ab25defd7a389217bb1400bc501b
SHA256caf702c0b5f96ef212fa7a110d8d86358e991783fe167e302575ae723b9c6cbc
SHA512e6a4436fff764d773f44f3647150a22f3046a6b84f86c0f1df18c6275910dbf84c62102d1e1837de77841b198afe7f7462528186bdecfdf9e933b86144688b4e
-
Filesize
5.2MB
MD5e57803f7bd611c74114e604b3b138611
SHA1b9fa802a57b105b5be7ed776ad9e442fcdcd13ca
SHA256fd7343b20e1c741978c0e2d1a5a43f5709f65f08deeab3120840afa59df29d30
SHA512e76c70e85f177ec7eb0a0cf896529e745716e27baeb07d87d02f6323c2b214ba0147a2980ad45d33c8508b54a442db5a5cb7ef2ff4c9f00a7a89e2224eb894fd
-
Filesize
5.2MB
MD5b8d70b8a2d205214b17b57cb58ba6325
SHA124a61f16a844473e6b22282ece1a65b1e5066679
SHA2568f48b7fc4ec1e5a62ba3583307688923c05b7c4350c4cd681a2e80ca8989d57a
SHA5121f05739aa1132158d12ae9044bbe2194018ec78909e56c967c9c729425aca732772c599c621541a0a3c8c9ee6c518890d959bda40e0cb05c7f3a39a82030e08d
-
Filesize
5.2MB
MD5a8f5eeb07cf595b1a9c80e621e81ede1
SHA1b9d0035ecf75b15407291c3996c0430a79711c98
SHA2561011d3a8b7ac7973308f1f84472fc19c254a760598d0afdc9a3e2c896ef7b191
SHA512cf11ff07d1acc455be711340f3cc14a89f2578da581f43545ef460a066fb2ad2fe579c59d2613819aa272d750c3e0f306250ccbfefcc762e9d4cf636fb07a9bd
-
Filesize
5.2MB
MD5a49b89ed7940affe78a31f0fc55c4e27
SHA17497bcf40b2914412e2b7d6d28d655abe8a3e6e5
SHA2562f7d43ea5a235c663dab178993cccc3c93eac585349cb966b1dd306b01ea33ea
SHA5120dc76608d8a2ea9fd6d9245c08c9d67e267185a87a591acc5903b3c5c4acd6f9aee523d1584fc8c1beec6090bbc7d71b45073c6fe34f57b02ac5cc211403eb1f
-
Filesize
5.2MB
MD528efb84e6a75856b5e50ba6616464edd
SHA1f8f0bba53fbb39e6a26a40f95fa4b9d2f8ea9672
SHA256bae6ceb7edbfd427f4bd5fc97aa7d5049b718676009d804891974f7912f13322
SHA5128751f3efed2c95901b42a89fd0bea555ba30d3d9ce735dfa1adcf5b0121328c2afc6b6e1c1449e8adf9d0be8e9522344328d4d2b948468d8ce4d65f10dd7bd26
-
Filesize
5.2MB
MD50242051fc9aae60f8d79dfa6d12b44b2
SHA1dbe3c37c84f16cf147a04ef7d99054e63c507ee7
SHA256c432233335ec60a3ba1fbb51bf424f7f0c96b6f5cc10d593e5cfaa678f4eba08
SHA512cf8594708538b10ccbd98c9d8f1511028a6f9aed3b9ba242d6cc084da3a67c9d4ad4c239983e81db17e615b5922bba277683362b26510a9bca814e66e46c9a47
-
Filesize
5.2MB
MD59bf657fe77939f63e230ff1e1b59a7ca
SHA1ab95a3442714195e73cefe7d9d2a24da2ea18528
SHA256f9e01d2d1d57ccf4730b03a27db408ae159d2601e4062fcff7a989c59ecab4f8
SHA51201f5e817ef51268ea748a7327051792d6d7a63961b9b10be2fb83798603df8c304e9cf8950d871bb6766d0a33aa41335708f7bac3c1d7d8dcfc0a75d51ab216b
-
Filesize
5.2MB
MD5c91771f2628bf3ce9750c2a80c0f035f
SHA1ebdbe90415e8041cebc1b180acd8e7f57859df90
SHA2569d7b474f3d9cbd9f37ad3fb1032b3ed6d4d950bfb7bef9896986bc8192c40f89
SHA512e798bb7c6c6bd0a5390f2f0ae4f4a2e68327c2f84704b33f89c909921d352a6e7be0e868053371775a40ce8cbdf00bcd919d9fdce80f3f3b03756f5fad943570
-
Filesize
5.2MB
MD5330d866fa29531825bdc976df3de931a
SHA1e1deccc3fc28bd310abb927d79df3b15122ed9b5
SHA2569c0cd12804e0bb93ec2f19eaf2eb439e0def9395f14213d856d500aaa4792dbd
SHA512dcb43437d0896ffb676799b335305719e4e675780c708670fce0dcaf975d080a0c7e30b4fc637e9716932cf63d1d8941daf2c0476db98f5c96f603708543c45d
-
Filesize
5.2MB
MD5c6f9c2088d26063a2031ad8d704547c9
SHA114b3224ffdb48485cdd1df0f80aff6896338aed1
SHA2568750d4a9d43c1c2b15d48d763aae6a97b4f473ee3acda89cac656591d77bb8cb
SHA512ecf3c4921fc3099bd33e6eb27e50b5cf0c82b94d5bb042a39d842278989cd1bfb28401a4517faa78a7265afb3278599e07db8957642af8b33a7c9cc84dd1a155
-
Filesize
5.2MB
MD5441839a76c132d2eb1921c07f12df9ec
SHA15ced00541c07015da25b9178000dda69e0064772
SHA2568d81204c5fc5298361e6d58b5dd4be47fe4fcfd3eb589f6882e317907638bfa9
SHA5127adab751f50546eef500ba140e4a0ec40bb3c062a0a1b01e6a8bf1aaaf8fb2b9b4f73cc2ed14f494313d947f55c03203437775bd1a13fdbbcae3c7e2c64d1c90
-
Filesize
5.2MB
MD5ded179322e2be67c59174dc112a3c524
SHA10862217237921137fbdb5a3052aa742b4646fde0
SHA2560b8c9abe1ad7b1bb406f4c4afdcd8c8d3fc4a6f3f8ba95da23f04ced8717c1b2
SHA51208cd657c51edb798fca6da1f6f1bd1ab5b27cd99a5c9536912599d1605615c85281b517348be8898ca65ba047c74ddcc7ad040c15b58b64fd7828e57c282178f
-
Filesize
5.2MB
MD53444d8310246d93bc9e5bc1b216d2f64
SHA19fa95a8c69eea32587e37a56de2ba21c4c165857
SHA256f9ad518c4423dba686879484acf7dd3a3871708c9ebf51429da172dc3caa8630
SHA512d9f6a2ca8b3b091efca09f5031cf70f3cae94e4f6d01db04874a0334e3ccc258d5a32315ce6308f0ef499d5eea1318d254b71039d40d3cd36da90172a693aac1
-
Filesize
5.2MB
MD540c657fc33181eebd4925471117319d7
SHA12492865730f37653b254e198eb2992487c06c52e
SHA2562e957b9de2e1d9cd595be56a189c8777e6346e29487a33078aad15bf0d17ac90
SHA5124dbb638ca82047fda42ba25c942f19652c7e008c5954799e86b113c6f3450afaf8869aa917653e443ce121766e99eea506e49e25fc2b3bdc4f700d931ff1f43f
-
Filesize
5.2MB
MD52b0778332fdbcea7d3cb39a26a8b00d3
SHA1bf1911c46866d09978454b3bb1df767ee724d0ab
SHA256507f89c02603ebbc61bbf213b6a560f05b62cc664d572f5b8c9c0bce0aa86c42
SHA512ca235b5370e797dcddba1a303d3fac3166182ededc0714ea00ed25922cb80593339d80d9de0ce416518de8e2e053b6a1ca4ea5d421e8e22a41879adf643af095
-
Filesize
5.2MB
MD5ef2ce49e1ddcb57a2c8667038f368325
SHA17d6b78ffb890be0f2c7bd7f13fd262e86abfd9ee
SHA256e201b4cfe9aed9bd8497b90298d68f525e54255e77c926852063a7190c4d7a85
SHA5122f1fab33316915708028e3fed1ca6e837f92afbe467d4e07cc9d0c25ae52cfaadc0bd835b91e79c91147f8a5b21c6ac36b653966c5d8948260ea98b7ba819822
-
Filesize
5.2MB
MD500ffe656a75d4c0741279ebd45f76835
SHA1a0b2c7589ea6c90cce24631acf980782085cc390
SHA25681690e28559ae0916b22b142657f245431d3fb8892e5ebf23bbacf875353914b
SHA5120a86e094004dba9aee3a1a1fc28c5cca05d2087652351f1719a56a078f1146f61d7ba926a3e4b44287182d983ff8ab12d06a2623238018fedebbf735aef3d366
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB