Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 11:45
General
-
Target
2024-08-20_fbeb61416871ffda29d67003fca8938a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fbeb61416871ffda29d67003fca8938a
-
SHA1
34c532df207202150d0c8f0236c863f6fa4f3dda
-
SHA256
62f4b60da8059c5df0e44613beb6b98157b0cef32ed1e90408ba3e8ab20f00af
-
SHA512
6f632f82e824b740e168eb5c3b1e594d0b89e35c7e1c7069cdb4e4f96ae95c2cb518b758b34f63f705f8c6ce6595479865538ba407cf046cc6b6da62f2a1c288
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibj56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_fbeb61416871ffda29d67003fca8938a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_fbeb61416871ffda29d67003fca8938a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fyHzJDf.exeC:\Windows\System\fyHzJDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UlLsSOG.exeC:\Windows\System\UlLsSOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fsxzVdh.exeC:\Windows\System\fsxzVdh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xZVPnsY.exeC:\Windows\System\xZVPnsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqNLeiM.exeC:\Windows\System\YqNLeiM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oOdNMmm.exeC:\Windows\System\oOdNMmm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RilnrbN.exeC:\Windows\System\RilnrbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHmLTYD.exeC:\Windows\System\wHmLTYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brRcAkn.exeC:\Windows\System\brRcAkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRZEDaB.exeC:\Windows\System\fRZEDaB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwVCTHT.exeC:\Windows\System\HwVCTHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfNvlVS.exeC:\Windows\System\kfNvlVS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vrfpkRl.exeC:\Windows\System\vrfpkRl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YovIUQt.exeC:\Windows\System\YovIUQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLBHGZq.exeC:\Windows\System\gLBHGZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UEqIUnd.exeC:\Windows\System\UEqIUnd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZSMWWuP.exeC:\Windows\System\ZSMWWuP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEUlabC.exeC:\Windows\System\yEUlabC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XsjmemC.exeC:\Windows\System\XsjmemC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClqadQG.exeC:\Windows\System\ClqadQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLfwAkE.exeC:\Windows\System\jLfwAkE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD568e617fbd58f247ec4f94288c2089fb9
SHA1c5d8fb5fffc9d42c0cbed263d4bb6d824561a8a0
SHA2569278a44e6ab755c869f4daae7d09a6add1a682136a74fc8aeb5e2a33f61569a8
SHA5123d9e6f852a3717c944c2abae094c90767b620edaba8376adf9457fd27e8dbe07a482f94518b169152f636d718699e80a43311b80296eeb5ea2d4e9c2ae8e4703
-
Filesize
5.2MB
MD517d305eb633f421deea66dd064e54ca5
SHA131ce39440ea1aa7b74be55c9f34177521e37134b
SHA25667ba03538873ae25b8d11015a0b9f0e300f039566efbe17b5c8e0deccf06beca
SHA512a810cbb6be3d3f244cbb28d35e5fcb160136fc15d07ba490fb82f36aa594dd2e333dc4c63a628b52c9fad22d4fd8ef911fdc5c95136e56efe7406de25a6be38d
-
Filesize
5.2MB
MD5334b4f9cd386ffa684a58a7aad0de8a3
SHA121ffb7bad78c4f2d4055564e3ddbd2da4722bba4
SHA256dea389069c8d10127a8469f234ffe3d0867f62dfa36e7b8903a93d29f7819eb6
SHA51299b7400cf3ce6d2ba5bf9f7b5a5e6cd6424bc05d25db3c2d166b3ed1414a76ba2bf5d4b743c99d937ae36df7593706b343471426dddb4b6bf20f18854583ac75
-
Filesize
5.2MB
MD58e3b8c4b542f4662ac1fac5ec922761c
SHA18e255f1e60f9d1ca782c3b6cdecd7663926275d0
SHA25685f4933039723a5ace4ef5c8d35d646b39b98d3661022643c1084bd9327ab88f
SHA5125a18598cf3919fbe6bbbfe578d46e5a4b2f5410060d2a133e77fee09dd5c957d72b80cdc26c646bb3c7bc30adee297d6fd97ac024f6cfa5c164df28c4585a662
-
Filesize
5.2MB
MD553a9fd0e69f8ec162b202a615a8f4747
SHA1bf3abe2b405bc26a8ec9d343493c5f85f1a4f8da
SHA25613d8176c4326768f9292db0ba2d563df9a33ed758b1f9f4021e18a59c623b184
SHA512f353fb85214633cc62c49548e6d9fb21eb900fd49c972eec2392b8fcb0a5f2784470b387243c2984d519e09c9b5b2b795eca1531aaa2db02421e7eb5097bcc58
-
Filesize
5.2MB
MD5f73f5aee533d566810c228687522a9ef
SHA1599c0c4a6a8d377f8cf2da0b02d045d670a9bf78
SHA2563c2d4f792842da3a48b224ffaa06f5681cd909988f08da7a2f382b28c4b485b3
SHA5123b779a09f4ed10cad42beec78055632fe4a5e4b1fbe05794df23ef0c00a65a3056d3831d128bf65bb95d43a78435f8e329765a44b5e1836c4db2b5e4aa203e3e
-
Filesize
5.2MB
MD54b57a4ebc77116a11efdd2c1bdb33e8c
SHA13f96617fb2052a87d0eb9c4ab97bdb22e1f5b3f3
SHA256ee49574aca3b1e886a5740b1264a2a8270fec85daabcb76050742415cfd11dde
SHA51268cc1cd9a924e0eeaaadf271598c933f76df591a97e9fe1af2824d18453f391e8833bdfee75f22c0563e65e2970ae1d73453ae54ae748da9e56bd034f9f2b116
-
Filesize
5.2MB
MD5a2f40262b74253ff0a2f51b239d05342
SHA12ae4efbb58d5092abbf3321e058131e736995b01
SHA256c5be9f287120355d51e139e281525b8279ac2a14e23bcbf82b26eda48e13ae58
SHA512a164d2c524e73fe45d2f04c1b04df94be5e591863eb9cf3e434f5133902436580c00782edc53b864c9e12ad1e31b2f546dc50871f350d03c560085a9f07fc4cb
-
Filesize
5.2MB
MD59704375e84fbf80ed9a03b1e1e2ce998
SHA1b37ce22753f34e7fc7cf7a012bd6837fba803968
SHA256acd37c56626e4365ca5a6aa88f2498a995fd6d2b02a172b7a0e8f02a999ac86b
SHA5123eefdf446573419c1075dfdae90edfeb4e6fb6959059948f27c0e3497f707980928a54da5d993b24239204ee45b937b98d7c2d7ec7f7007559385bbd7806fc7f
-
Filesize
5.2MB
MD572cc0a5cdb0f69dcb965604fd3377886
SHA17f9b954ffc1384cc338b014342e67aef285cee76
SHA256b9314226ccbe71f20115693ca3cc8f6cfb6e0dcfd739eb2d1211e702df5a1a49
SHA5127f5ff937c7a4f885a987aae2ee743a09d35e89d96c9c6de32ff88bcb1eca8ea342e94c3339a58454943cd3e2f14921bf2e63854143308c24d8ef39c15d422b35
-
Filesize
5.2MB
MD509c8fbdc198370bfd0c897756de4048b
SHA158768b6b26f494afc3cf81310576a800cff9de5a
SHA2562a9fabaf3469b323f5333b94535f17c10360edad6d4185b2ffa86cc8b9bce83a
SHA5123bd5a1b8d39fc2d6a463f79fee00933b98bd937682552bc6d374631d948bbdccc71a11240963f5f869ecfcdad1ef674e8a7a089b7b00b5430d3e23f58b792e60
-
Filesize
5.2MB
MD54af80615299052286c6f73cbb64825f8
SHA18cac6a8e42c24b3a4d66ea3eb902ad2109897304
SHA25649f6f6948d3c0dfcf632f9ae2db05001809a56d264673b5d8dc266ac5dd7d5b1
SHA51291ea7875de862c5230318391bfdf0182b14e86eaff6dcd9bcf93d057ee0a43b58fe3bb2054be582462a4b0f0a1606c985b3b97b2e7f3933481fac939480b65bf
-
Filesize
5.2MB
MD521a20904a4c02f2420d9ce71763b6dd2
SHA129422698e5cb7538d385e55b1c2111da90c19cc2
SHA2560325cd7fe91137d722015c3117cc0058eb932fd1e614001d55ae71af4e301106
SHA512f87a9669f854d10d0d47431d207a80f88f88819ecc5fc3a92945934f26fd79dffe07e614acc5fe7ca98c1e28efb401f606927ffdf01b9ec45a60b2beaa588974
-
Filesize
5.2MB
MD5eb98c21a83534f1c479fad3324214270
SHA12cbc4768f7688886c4c67bb32b1b8a250559a552
SHA2567bdfb3dc05b687cd0e7fefd357a03186c94eb915b9b99776ef3f5aee92de12db
SHA512c2a0c7b981bdba1f68f93ffad86c242335f575528d914b3c1fd5a7e6df446766aa7cd9b14075dcf605f1fe6999073c9f340069660e4f17f56a51a0367583f5bc
-
Filesize
5.2MB
MD571ce8f8db621f01e037155d889767709
SHA19ca12fbfac68314505540b2861c9a1c47b44c709
SHA256bfe847caf14fafa0094b421d2475d29977375a629b3e218a318edf14211e9d07
SHA5125b1e72834cc29ca431348600f04061a9964a696fc0237d193ce61d7e4b2eaac584930b1496c8ac8a2befa511464664d01ae07c9c1b7f0b32220c0021c362c96a
-
Filesize
5.2MB
MD5afdeb6a75dca6d8d415ac48c3a44da0b
SHA1aa2a3b28f5677c121fb4884f9a5b21a033291320
SHA256e38afc0d0bb791b8de599204abe2e67849ce26160ef56039a01a03c6d082ddec
SHA512d99e108ad034ab5ba5ed67b5abfab39780d4ec7a6fc3d261d86d411b914e2e97741b119c774b5f4c682a602b181774bd31df2a3cf1d01ad241fcfd1035d12816
-
Filesize
5.2MB
MD5242253637fccb1836e85de2c6c62e216
SHA17b5bdcab6fbc1b93dd0a3f954dce0d945bb13a36
SHA25699a5ac257350c489988047e11ea0074da5fbee93b4cbede73b07ff4703987532
SHA51231ab9486ab2fb5638b9fc5eda153bfaf6e9cdcf175a4b9f8885754856ab12c9a3d3a0803646d9ace7457b8fa526c8a94236fb9d7ea8a6b953975b61e1407ce69
-
Filesize
5.2MB
MD5294035a354ae2225af23eb4a9a09091d
SHA12b3f835d1c08767d32a33e3cad30db6f19f321df
SHA25647233926d19fa4936cb958eab898a3a67eebb8b2027b1086f9e39915280c56de
SHA512061e6c11df98bf5309630717387f8347092fcada48d86b8b7752f06b166a575af78bc1e9d93dae93d6b488709cc1365661dfb4b2e3a4ac1c90af3bf679fc515e
-
Filesize
5.2MB
MD52a98a7421d5b550b003ee43d6c0b477f
SHA1110a9169f3b6c83c2d524196c76ad5ab9f906032
SHA2569e47d4fe3d9c84ff9a584815ce178dcbf63866b06b7274e47b91155593764ff9
SHA512ce1ff8c0397ee20e1032a786cec635166b33d0aec34d151987fc06d376c6722d40e443e15c73837d2a2b59f9758189791cc7bcac528e9010043d380ed639bb3a
-
Filesize
5.2MB
MD54fd81dffa3d3ad167fefce7ae7b247c0
SHA16d8fb66440da62db0754800cd9f7565f0d0dc813
SHA2567109cd9166690ad7ab9a14e677f388dc4cf9ba2e4ec1d6a3360bc0a95ab3a858
SHA5124658d3935b7104e417327029fb5e1720056844ec4942edbed90999bed18ac7408acaed0526ae338dc5b35524c21d69484374b7a24ef42c797c3ad069f21d5a07
-
Filesize
5.2MB
MD5c6707c8ebf5b99bb3e6954538719b66e
SHA15b85effebba6ac3fd0d3a000f8035f03e53528fa
SHA2560fd9660516740e8f081433801b156260ea28472c1ce0f952a9b0ed62db9658d7
SHA5127a38a5706a8482df7ee885be95651586845eece9762ccebcc2b636a7b2e8ad4d8d2e0e95e9a39dc4e66e6a8ae4597d3b6421a9053b0c478bf7b86d1f851cdd5a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB