Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 07:28
General
-
Target
2024-08-21_1b801362a2d0f1785cb6ae18dafd7815_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1b801362a2d0f1785cb6ae18dafd7815
-
SHA1
42ce9df75df8784628409362f5c9e7469eef5ef8
-
SHA256
4060e745f1bac843f91f728039aae342198bc5763fb40b1aad1ace8e2ed59efa
-
SHA512
95f33514b9e025742710651ba4e342d3a6c54f7fc1fa655ff719cd40e990b7737f1f6abe854c7efc8063b4ae03d136efcd22f49880101e9425be07ea0a90d7d0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_1b801362a2d0f1785cb6ae18dafd7815_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_1b801362a2d0f1785cb6ae18dafd7815_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wtQCNfp.exeC:\Windows\System\wtQCNfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iREHsCi.exeC:\Windows\System\iREHsCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYZHVeZ.exeC:\Windows\System\OYZHVeZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CBwickI.exeC:\Windows\System\CBwickI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FcVnpko.exeC:\Windows\System\FcVnpko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUvwnze.exeC:\Windows\System\iUvwnze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kAJFYNl.exeC:\Windows\System\kAJFYNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqFxrzv.exeC:\Windows\System\KqFxrzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSbzFWp.exeC:\Windows\System\CSbzFWp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqIAZGo.exeC:\Windows\System\EqIAZGo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOtanjP.exeC:\Windows\System\hOtanjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIAuSEC.exeC:\Windows\System\nIAuSEC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxbxzoD.exeC:\Windows\System\dxbxzoD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aZSwWOO.exeC:\Windows\System\aZSwWOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYntgfJ.exeC:\Windows\System\xYntgfJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKUiTbi.exeC:\Windows\System\sKUiTbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZYtTYMI.exeC:\Windows\System\ZYtTYMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWajKlN.exeC:\Windows\System\fWajKlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLHUMNS.exeC:\Windows\System\eLHUMNS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qidRSnl.exeC:\Windows\System\qidRSnl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnKZBHn.exeC:\Windows\System\TnKZBHn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD585290579f9d1f02220c3c9056fefb894
SHA131c29b8e9d14e23c14f19fc6448b89c92607d898
SHA256052007cb2db9bf55cddbb484d2c8a75b6d1dfb59763c6521c6d2cdb499f5f536
SHA5125dbd0f8d1c3f9d81b39c0b5e26af2110880751e7364ce9bd36e07a626ab3689d1bb576ef37c00d1e7b01be235b08af1361ccd7617a40476a5f96273e6a85da54
-
Filesize
5.2MB
MD5596d485fc5a79d7245a235a76cbad0fa
SHA10001756f5ee873cf157d602749fae04c4c4e534f
SHA256ef2951ced69cfe872e6fa512c06af8cf3ce2424f1780edbfacb57078997924a1
SHA51201051de8111aee9dd89ff4948b2d9e459a01cdf46304f5480611ef44ee7d60d24f15d67e0fac9d755e3db9bd64c816b27da729c05a2d50920b18b65487cec151
-
Filesize
5.2MB
MD537a3aac9003231e1be696421207e2e29
SHA125d4239ddcfe9cb748450ebea0a5ae989af3e40a
SHA256c9667e8ef23023494a6b764a9d4b1bf378890103a1d2b676a4b7aca4d9d6decb
SHA5121921edc8086ef021f4d3d2c0e4d74d4ce7e64100ba7b9d5e29028454b49cd4fb83cfbf1a9c5297f418f2c6c9ec97526ab313c90c41a2f37a4bb9c1d6d0dd919c
-
Filesize
5.2MB
MD573d42a436029f4060552a7c840e48ac6
SHA1f1915180aa9cea91951854d13a5d1e97d3e0ac20
SHA256a8f028685cdeb92aa89349b9b90010b5e28f116b078e7ef0727451cab501f851
SHA512a10727fcc431f3c2678f184c0f82288c110ffe5905425083a327b1e14da87023639326980bb50e31ff247dd0a6ee90a1cc0d91a3fd8dc0484f8d655e7d17e402
-
Filesize
5.2MB
MD5f55f515284eaa0df5c21e57e6c05424f
SHA108a4112db4a6b982dc628858196d102eae35020a
SHA256cbb2f8f57896246fafc04805e4d8ce1499dab3827058c28e9b0a62e7174fcbff
SHA512b3d58b9c6ba66e388b6ea99cc5c8c08cf3c73b389b608cff42826912e5d7c8dd115f934a9b82235e293d8fe1b786315da2d9c95eca3d98a6cafff66da212b76b
-
Filesize
5.2MB
MD507ca5d4b9ba84e14decd638a0a34b396
SHA1aadc4ea3004e9fb03b7bf03ce8c372e875fcf87e
SHA25602b2ed756ffeaa4138924520233b72b0acf0b3c94289b3e67aee7c52760758fe
SHA51271c43f220c55d71ab006940843ddc7c2edacc3ef72782cc3a2e65ab775e71a16710e0d79c511aa8319055c12ab6c6d9417d6483f31fb8001bfa162609c116eb1
-
Filesize
5.2MB
MD597b289a37c42bd739dd2a58f81adbc32
SHA1004a07410487938789c40e6b9f6d5cf461db8114
SHA256fa784367aec79634f68bc8593649dedbf29ff1fb2d6b152576dfecc93043fbef
SHA5122838480617bac59d40abf943b7acd99adec71a014e74b364f68a6c6b6298f1355a2cf52a5cb36a24fa0f8c5b1f11461345c4569bdb03541272d479fb71bf9ce2
-
Filesize
5.2MB
MD591b24c30a860da9584c2266798717bae
SHA19e113afd36002cf14a7f5f822dfbe17088cf25e5
SHA256da83f0e3f460042276df343370855353de530dce28ff0ff35e76859b9698e6c7
SHA512492326d16164f8868285a781d75d4c76576e8277bf871761de64cd8fbb83ad22686df6589be24d3fba2e55bb4dee9c2cd8d94ed4c6e8f2077cd591ce76575e67
-
Filesize
5.2MB
MD5524dfc0accb6ad9cc7264a061889e29e
SHA17fda0d2933866ae35b2fc4da4231854050025b02
SHA2563753cca290e52f9af3e5d33c4d3512f08798485504b09a15d513e6fae2cef406
SHA512f2dafe4c976aaad8a2bf5fa19bf0697248c9113e6d3bc5d9a3a0163f1f3bc0d562316ecc87aee97c3f92fceffbcb1aced9db8d1f55b1cdb79f0223a9c0693c97
-
Filesize
5.2MB
MD535e0533316bd39d6088e2cb87e5888bb
SHA1f96d432f179706b30dd9a17bb622d8611ac9d6f8
SHA2560f5fe1862541288900ece34f00da6e4ed8e04f72e5b15d5a50ff0233dec8fbd1
SHA512690812fd54549b6f0a090be55258e6e10d86b0ac0ecb818f9a77998a07a8d8707c5ad1d95b0ee1aafe4674629c8114ef1e9335944185b041a58f7d983dc860cd
-
Filesize
5.2MB
MD5e1af118e807382edf3d977024a39a1f5
SHA12a6129b8ec786b0842dc4f20b2cb588de1d78a55
SHA256eaca806b8ba7d2661983df7486615671cf16d63366f2001a38a26fe87b470338
SHA512f240b2a68703eae77f043b68395aa9aae3a7fd8ebed6fd0f996f7aece2a8cd1ff77230038de39f4b5376ea9179c0f50c945bf0c1a2bd48a9494d93ed2a282839
-
Filesize
5.2MB
MD52d5801d0723e21a733b3e9bf48ad8b85
SHA1b175ecc0d535e96795b12a6eae6b93ec75af219a
SHA256a781fd1354b8684162706f764afaacf4b271f250a19d9aa628787bba1586e2bc
SHA5129806857afc4fa1ed4bba60a88c082c0e5be2ed76b3d509f5dd707b502a54b3a79be584e10c6cdcb5de666d97916ca5faaeb9b8d1a06ce2d8b9b250d9d3c42706
-
Filesize
5.2MB
MD5f45c2571601ccc969cd28f47d3eaf5bc
SHA1367922685ba43cf2cc04ff23cb532e9d155046a2
SHA256006f41f2fecd0ed88008e2f6cb40219d9d9f66088f97b97f689e96e3a5af677b
SHA51271c5805ce39b41a14916b2f871d45b5c6b43f41065cdbad6a97b55ac7f9d2d3df2db0a06996b54030c56b8d0fec6b390f366eb0f68a5b92971b87aa7ef6b73cb
-
Filesize
5.2MB
MD5e710ace2b51a015450d4ddf0d18dff10
SHA171446a406676eda8d4015e4abd98b88095d38ce3
SHA256f14f71adfee093fe3f0db04e43fd8ae81e52b075deb7821455799508bf4613a9
SHA512e15e2e194dbbd537db697f9c861d5b1d91e102303663ff6c2af396e5b1ca833f7b5bb2f3df29cf2658361b31fc3a9918a822f0e82ded9cf98eb0797ea526dc17
-
Filesize
5.2MB
MD51e38edcafca5c68c9db1cc29d524fd7e
SHA1892aedb3d83c5f8da63f330e9d7c4832039631de
SHA256a59850bdb4e21d256f9695db7151116c34c89c1538743eaeeb4b97d3ea5477de
SHA512a3590031eeb4f1d7ceb08a4f420ccccd982fc9214c73862da3f25cc0540b7600a85ab2d17884e2fb1d2d1eb59d44c501681b5b08b1b67437701325f18fa11461
-
Filesize
5.2MB
MD5fabff7aa9db65444666638be28e58812
SHA1afa8bcfeaf133a0b97f3ebc23c8c9d1bda500fa9
SHA256e85aafd659e4aa8be4ae080f68149b859ac632e85d34556f3db7aac5d3c77639
SHA51220f46261565ab17a995760b8104647bb33de1ba027d0648078498415a36e999bd9bfb65291f9051e134be202c01117d9444f896b09cf30c4f268b10b351cc95c
-
Filesize
5.2MB
MD5e186c9558acf9982e3c9084f1a8ebb4f
SHA14bb40440c6804f2e7a7d3b18ade9455354cd0d59
SHA256e0c6977655735ad5417f3d4e1278a8fdbef0dadd3c6bdf4d81d57cbcc989d4e3
SHA512ec85b5dab9d1f56fc375305794bc98ddbcd0b2a1a9538fe5ab800910be3d18730969640c67419e7fe325162da0d0f3ee4323e4632aeeaa6c4372185ac480a45e
-
Filesize
5.2MB
MD54592b1a995f6c084ae3b79f602231a9e
SHA19e8201ae1a3fe7b0eaa48764ac10541320791c9d
SHA2562b53d11251aee2cd6a9f21dfc749dd85be9f9af5857caae36107935a5c647eb8
SHA51276119f4f06159f456d67d717caff0d06dd2fbe99d4018da0121ef651a0480bcd63904b81d5a27e486b9e52ab3595cc17d36aeb2efd9c49cf68741de6ab166bea
-
Filesize
5.2MB
MD5386649289a1df9ae5cbb26961b6b08bf
SHA1f47846cdf0531cc593fa30e3f13cd63f265dd123
SHA256b5da1810a4407f67d4e31ada595652317884350661d54fa6f2b50091e2ecc5f5
SHA512776ca14777f355017b44a7665a32e95050dcba8c9643338c421e86013acc9476b348b3d6c22f955e0ffd038a214b2b47c5dc5aec2a020eac78eda552e636ec09
-
Filesize
5.2MB
MD5f4e0944b549d646735fd301d4325d6cb
SHA14762e6384938135cd9398d803668876a236b9e60
SHA25650cbb537cd5faec144232223ede27cd25c63cb22c4c28c2e40f82273b8bc3d56
SHA5127e834fc2944f386ed216dc1135906d1e9472ead6e7f27ed01982ae80941f1fcf21a65fa9b4f89ff87713987e52692639318446709c2e3c510ec74c9e5ec9e906
-
Filesize
5.2MB
MD559de8854ccfb019f0bca89e266c1fff0
SHA12f227f55e43d04750e561756471d4a71023069a9
SHA256492650e0468136b809b0072c16fc97991d1f51e6cb338419631af6cd3a3a34a8
SHA51231bc561e48494126ac31e92281d584c1ca2bb307ca63e810e75d6eb07239608d8e7e88f36c631cb68267a3730b16de7cd94c3824c96580286e4e533361afc592
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB