Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17/08/2024, 09:43
General
-
Target
2024-08-17_46bc14619f3caafb0901d84ea1bd49ff_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
46bc14619f3caafb0901d84ea1bd49ff
-
SHA1
2daefd22390d589e389e0b79c3d7560aec3f4e60
-
SHA256
153cac7015d02c969ebb4e7f6b01004afeb7af86e2c23afcf2eea6723ddc978f
-
SHA512
e332c43f262eaf14a7aa31c1e5755753d94f5d29881970b84f117b0d5bb100ce69240ad2ef5740273a2d2c094537fb46431835b5f14e5a681a039ebd70c527e7
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibd56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_46bc14619f3caafb0901d84ea1bd49ff_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_46bc14619f3caafb0901d84ea1bd49ff_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MjaWuAC.exeC:\Windows\System\MjaWuAC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BELlxhC.exeC:\Windows\System\BELlxhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ILRwnhL.exeC:\Windows\System\ILRwnhL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jszeIyF.exeC:\Windows\System\jszeIyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVBQexm.exeC:\Windows\System\NVBQexm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NkUvHjr.exeC:\Windows\System\NkUvHjr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MpiQgcD.exeC:\Windows\System\MpiQgcD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxiWlqS.exeC:\Windows\System\PxiWlqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DddVxee.exeC:\Windows\System\DddVxee.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qaxiIiL.exeC:\Windows\System\qaxiIiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ualfZjv.exeC:\Windows\System\ualfZjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BKndrOX.exeC:\Windows\System\BKndrOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DKSoFMF.exeC:\Windows\System\DKSoFMF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXmBpdy.exeC:\Windows\System\bXmBpdy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYHeWSD.exeC:\Windows\System\YYHeWSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAzqWjw.exeC:\Windows\System\cAzqWjw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxRkVaG.exeC:\Windows\System\MxRkVaG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETzDbxV.exeC:\Windows\System\ETzDbxV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPyRcvj.exeC:\Windows\System\TPyRcvj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCaHeHz.exeC:\Windows\System\iCaHeHz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyDSnvj.exeC:\Windows\System\eyDSnvj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b8e73da96e304f2a5490efcffa518e16
SHA1b7a0957f00e81fbce2cb4f8aea757cb26b2045d0
SHA2561bb543fb0fa780c7b80e26d97f93889bbf61f6903b7c18797c5034713c9d0f96
SHA512e563cb9fc4f40bf3a761d41b8cffb206ba8da1cb19e6b59e9f7b0d6d6ce5030b0696c575a354e30c739c306a9748ed124c4492546b2eacac24e9485b977c43ba
-
Filesize
5.2MB
MD51f5a3d6ca49dcbe5fe0cc071c7f59de7
SHA1dfd3f59b9c49cbe9cc9ecffaf408e18ca578b6fe
SHA2563bbb44cced8c9941e2f8dc6eeb65fb60cfef286df0c4d5fc51cc0016547aa162
SHA5128bc64ac567c21b1cc2a417579d97ebbf0cfcf9e52495f6383af6c7d8915e007ece34420aaafc62693932f18721e9ff8566466a60abf3fc07592d0e8d959a25b4
-
Filesize
5.2MB
MD525f0f5fb997f550ae25058c4962832d5
SHA1b24d911600d23861c384e9c1c785c13531be7567
SHA256620aad71d4e4b00748bfe2741bce052b411a4b3230d44d088b4420700c432bc5
SHA5125902295798b5db9e1ff1f411d6a7158af2b8efa2599a9cae95e2a1882421af1b2c39cce19e8c48fffdfecda14db16c437f03aa214b35d22efdf6d5cd4f0a5ca3
-
Filesize
5.2MB
MD5777b337f2435615ffd0e02a7d1fe5248
SHA1fcf5b43e19f49544075e8678a431f867d1001bc2
SHA25687082fe49397bb26b29c94d89be2e62503875474d8915fcf4598a792be154f1e
SHA5127304b49d06a1a2848d51b0ca39d4144575c372a593d2e44e7e8e3d8b15a862fe2f0f49072bcd3c109b1bb8e5aea696b27b3ff881702fb053a5d0f93310d4231a
-
Filesize
5.2MB
MD5984733ecdedc447b7f5b79f3f0493d47
SHA1ba754ac46ae387d9157afe287fce02e3bc6a7500
SHA256c3ca469da252f30449161d4e5ed115997fda7d3c8af162bc9779010c30cfaa15
SHA51281f83ccfc9b5012e154b85a3a8fb845c2bbd79bebffe119ba601907599b2056466ca3e2a1c5fc91b54a4938e2d59ad1ce82bc7cdb14262f20da57a3994ce7147
-
Filesize
5.2MB
MD59d4c9f4e7bd5d375dbb7e30e82f04e7a
SHA1f366078eee5ea6d660b704064781503f3127d71b
SHA256b4b5e9d174b5cd8c11185297ebba53d3b65ba5f237fd324c9b5d614140f3c637
SHA5124436c28987eec35de749f2dcdb885bd469d8fcbc2866fb9d46a271ab01812e90d52fc07270ca6a1fdfd7999a81a4b031ef83c9e32370fcef4a7469988b9fb600
-
Filesize
5.2MB
MD51d37efde3c0bed01acb4f8f70dbb2b24
SHA17c1bc74712446694d9e6180d757385a057b2361a
SHA256492b3d5e7673f10f4759b88776c130c21fb58f1a685c114abe65d1d75a0265bb
SHA5125dc14762c097a2913b1fee4a2dc0d97ccdbc87f03df0d55ff345fbbb73754e5b76465bfa97299394c0ae8027f1d12c9cde044e26a2d80440c814732cee02b49f
-
Filesize
5.2MB
MD536ca0d5c3ec15e4426bcbd548f123a29
SHA120e39052191a0ca5185f87b42c0ef7edde86d784
SHA25691a085eadbe79ea0576f5c6d84f584493ceadb9fe6e83df4d7211c630b02d305
SHA5129102aa880c0313020a907c044ed0a292b48a11b5b6e022cf2ed787793bd004408b5390f232d208d90f8508312a69515f08868d9d2a38d64978a30eaa026ba639
-
Filesize
5.2MB
MD5751058b6b15f60d02bba68b07ba592fd
SHA13fd5713127aabcf31799cabdab0df51c99b90d99
SHA256c71bb3ddcf7d9a8bb625485aa5940e59b3898388188a161941e8ddb1b0c0e6c2
SHA5127f523d852ae90a15ba0ad4d3b7be6e0069aa79a6be17ad3f8339343177aea6b5eb6cb69e242a5bea0182a893653224258c825af602e27e9c17a02247de14a7a1
-
Filesize
5.2MB
MD552cc59348ce56daf52c1d27d270827c1
SHA1d4f5e96fb2e07f1c2e0af679a8a0eef433a3e027
SHA2561a8935ae8b25ccdef4a97b2078afdc972ac1d07fd9addc48f743990898424d55
SHA51292ae03c4f57008bf19d1f45c64390ec5e05f6ffeac11b3c013c48024befd5245132637ee630ce7076c0625cd9a2c6982dc00bfe85ee86c85a8c4988729832aa2
-
Filesize
5.2MB
MD5434a050bf9e4907f0c91b4fc8d9f353e
SHA183625d285cf1be7e28e67011536ab9911864f9a0
SHA2569e338904911762f51445853696c62ba8c6dcc8f282ec22704607574a5a450c1c
SHA512ddb7b5f6bb9fa2e4ecbcf6868c2e551e0ab3e1bae7535d460f9c845ba99853ec386306f2b58a009acf7665ccc837c09f6bbdaa5d4b0b22711d9c777c238f85b5
-
Filesize
5.2MB
MD532bf1b601ca53eb40787429d26036d84
SHA1b7da6bb43fdf9bdeb1a552bd1b8c42dacdeeec9b
SHA256363bab72a14bc65d2634a9274afea85ebb678af44cdf79292491797d0732893e
SHA512565bfced1ef27a2af52ba1e58d733473479ccd4fe1927371896a92e2980e7feab0691d700f1afcd7f78bb36535e03fd5d9a01573a6efc381037b9a81488951c9
-
Filesize
5.2MB
MD5ca6e30f7cb17c55e8839389e243593a1
SHA1d11d0e11e3d6b1ddd382258cb6ce7d52de3914ab
SHA2568f15292bf702e1d5171cae62926a02012f8aa05efe8ad5609f8e5c80e11a6f97
SHA51220c192d09af1adc38657c6e2aa0cfdb1bd3054a3803b2b228057c54090ff9068339e7258336ccdbbcb731cdaaaccfd51b07abfdf51e4046aca7057e27ea259ed
-
Filesize
5.2MB
MD53af587cd775aa51fbeaace1d56f50e7c
SHA1fce9308856a2434a94b7c208985620725064bf8e
SHA256a2171484c692bd863a95324eb48d16009331c08d91f491ba4e1ac9fedcd8b7ee
SHA5129c99394e0c2e88055f4f195739ac95285170b61f58b9128526b8d254f563ee5ce6f5e18c88924dbc4a47cbe9ee3655b107cfee1d47cae0ed74f2eb0f476f1c0e
-
Filesize
5.2MB
MD5f2df92f1b9411b2e690370c1a621c374
SHA12bf647482744a01ce4641070c627947788c2f780
SHA2560007b2bd7696fbba74e12e22ee15a47d63b18b2dcc0811cfa599dcbec495164b
SHA512a921a09fbdeeafa91d4470117a6c79b08b410d5c3f80cbb1e5d074f4fc8ee3856d878ad0821802b1fb8b226b041d04688285adc84ad8a4feff015aa69ae33062
-
Filesize
5.2MB
MD55575b46b720e2ca9e7175e82d12d0eb4
SHA130f1c9680bf630183b3e370a9ccef6ab920dc4b6
SHA2567061d8ac81f93e8cf2d070fe6995ccf2e91f437c8c4cf272cbe768cff453b73a
SHA5121e753a363b496199b8bd5a5abd5e5a21f6358c671267118b5927e668571c4c87324bbd2bc8b0a44cb6b60a6380316f487929ee65aae057ff6bde593fb12636cc
-
Filesize
5.2MB
MD5da900d46ab9bb27bb5146fd189194dcd
SHA1dd7de378b5e70f755bf89a0fc95bf918030c40df
SHA2563f29b22bcb10a506a85d437ff16692da8ae5d935e21f2c827dc9ef28b3e95026
SHA51238612ea6ef8f300d6d593c2945c94b19b085aa01109ca64b6ff3618ec7e20407df33dc84f968b3afb2567dc074363e71d87ee9018bc1f33363e104dd4010ab91
-
Filesize
5.2MB
MD5035bf0a6c15a573bc9cbbbd3e8b91946
SHA101afa4870bad5347c934348638e61e606ad427d2
SHA256573e2c70758036c5112334d9e0fb2869cf98dfb38c1d0803f09e99d201e24630
SHA51229635eabaddf6259c41946c330dd474c9b13ab3ece51117ce12c6db6685484c6f1d45e9cb9d224578fdbb81043ef968e58c3e28365278dbd0fe1ab9ebd5a8720
-
Filesize
5.2MB
MD5e5e06f885421aaacab8db35b2274f6f7
SHA1a7b2951ba823307d2b085ba2894eb94bb34a0f05
SHA25626de0a599de00ee657cb762d3b3025317c34839ff5427d7796edf3c35e36ec73
SHA5129c1b62e3c6c9b0ec69bb9f1162a7dbc85d15f26fbf93e47e9dc64942da89180304d2303b40d3d2883476169c53fe9aca9d2583c89306ed5947e03a6b44cdbde2
-
Filesize
5.2MB
MD53f08609cd6e0e6f70c4471b86460a9ba
SHA13bc7b718fbc7ee46834b38a604dba2297391b14f
SHA2564933511735d6fa9503176aef1d0b1b0fce9decc8e4ae79f2babb8b5b79042c5d
SHA512c1fbd31f287d1ced033b802b4c1fe4eabd8000c4695b0f19f482f80a4450b3bf197e1dbb9023bfbf5c4cc4cee33e9a65ac44c0542d415eda0501c9b2399fd968
-
Filesize
5.2MB
MD597d717a5e343a5dce304cddb104196e4
SHA1caec1d09b75fa33f0df6dc815a42dc0ebee95bf9
SHA2566a894f8b50239b24ec2b8b4a63c01ae8921036192e139de40d7bfe464900d506
SHA512d6e9825f7c2edb7af8cc9952505b0fa1a8130022f795c99e953aac42f7c939af79230c13ef88ad0a88882075252e32f399ed626931c2b46e0458ba553fc3a578
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB