Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24/08/2024, 15:23
General
-
Target
2024-08-24_1359f0c496c387b7162f5c39bb07f72a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1359f0c496c387b7162f5c39bb07f72a
-
SHA1
0b67f1777cd3cbd63b70fcab5d525bcb5336cce1
-
SHA256
b609f999a15b80ee840afd5dbcf54c32791f0d7ba768d58dcf2e1a74434db3d4
-
SHA512
520469698d460038bff949843241c7a217b4e459276650adf729fd24090e851b03a8992163c94676274c14e1afc150c63dc013aa14e6e47eb51e0c5e2ee66f2b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUj
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_1359f0c496c387b7162f5c39bb07f72a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_1359f0c496c387b7162f5c39bb07f72a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nrMUpOY.exeC:\Windows\System\nrMUpOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tIJanme.exeC:\Windows\System\tIJanme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xiYuQmP.exeC:\Windows\System\xiYuQmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MNTSqiP.exeC:\Windows\System\MNTSqiP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TKAVeur.exeC:\Windows\System\TKAVeur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqNqAWt.exeC:\Windows\System\AqNqAWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMbnidB.exeC:\Windows\System\oMbnidB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJYiXev.exeC:\Windows\System\KJYiXev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMRVELe.exeC:\Windows\System\EMRVELe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlYBvsi.exeC:\Windows\System\AlYBvsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuXozXK.exeC:\Windows\System\tuXozXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYzmmIf.exeC:\Windows\System\BYzmmIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrrSvPn.exeC:\Windows\System\FrrSvPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MiIhZIj.exeC:\Windows\System\MiIhZIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Qyonjdf.exeC:\Windows\System\Qyonjdf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aHOlczu.exeC:\Windows\System\aHOlczu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCBoQhf.exeC:\Windows\System\KCBoQhf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TcSxTSb.exeC:\Windows\System\TcSxTSb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKEmQPm.exeC:\Windows\System\VKEmQPm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VTGqZPt.exeC:\Windows\System\VTGqZPt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zzhzUUv.exeC:\Windows\System\zzhzUUv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5fa41830bd581745abc9bdbe1d6b3e979
SHA11b40a10c1d05da999590a8da8d92f7454f2fce35
SHA256517fbebd870c63bbc8fe511d70009b7f4520b027e201d3d378c1a5dd6afed878
SHA51242f6a4098da5a27c259e96164cacc117a16c1bc23a608f6e74b51624241e57eb92891373b29dd919cfc100d22a376a868cc4229840848118b23e956ef43e525c
-
Filesize
5.2MB
MD59fba8bea2997578e8906903721677d33
SHA1d04f2c5f5d0e08b033ea19bb2d07ff31c2dcfd02
SHA256d066377aeb3fa4968f91aaa705c51892bdae0b12d2da3e181f5ad93b6db4ff5c
SHA5123fb326b052c58ff7362243464b8eb8369ed06bdb9ba2024519bf378881ff6a96a760ea21fabaa84c127d44f1f78c614fb5eb840d550f9d89b304f48a4698afc0
-
Filesize
5.2MB
MD533fb81d56a13499d74e916c2fa3625a0
SHA16a7e49a6b0e3749aa05b100ba1ebc4b5142bf2d6
SHA256187908ea71d201360b63cedaaa99f6a6fe25f49f56ab7b5f016cc40dcc0d56e9
SHA512e045ca9834f660f4b4b771fe73abbb17e3ba658000a72f02051a41e16ac1ca232747c61b6649363935f874206863a6cdddc7bd6eddb5db9004b553b6441763ba
-
Filesize
5.2MB
MD5441138ddc1dfecddc681baf61c8da899
SHA1a45a122549cd269efc16f5fc5746239c0ab2a44f
SHA256c5af18571df603867dbe3bd77e44e880f8e6e8ad4e65c4a77405f3b3bc253cb8
SHA512eed297474b0aacbda9f39d876e134da29563b7370a049fea5baed151852ed490b006f62c69d773f616dcbb4b9c625f1d370e298592beb5b31ee127fda676ea9e
-
Filesize
5.2MB
MD59e717a75112f02fd3b6c88dccd8fe95b
SHA1aab3248468b85ff5f65c4edcb56c11bd4530c737
SHA256a764ad153888e1cbdd19bc76b272e886c385e8f483db7e5dc2632abca4ee61cb
SHA5124012826a74b78c75fcd2771622815bc4769b7258d7a607d5634c076a9653e35d86452d8528613d96db8211cfa92af8c90451a7d500f57b50ebc92863f11bfae1
-
Filesize
5.2MB
MD56e349720024b5dddd47eab2918e6ba06
SHA125c609e47934d30c7b09cb06e6d662f504100cab
SHA256c22cf7b1e33de7248ca2d0623a8baa95b9215a2868b564d430ab5d9544f86ea8
SHA5124485708f7c789f90c4790dc2657a3894222cfd576614f41e5d4f51b41fe5bc65a7f923222462be3de0ea124079bdbe0d641d5ad8ec40766ab616072efd03b8c7
-
Filesize
5.2MB
MD5c6d271986a412bb0d69c0be21008b433
SHA182a53df86d4139656968359929b5ee70f9f6801e
SHA256aaa150df6ec8903e68a2e4a275f44051e1274e6ebd35214f3a17d5c8323c3683
SHA5126611190a98a02c4795b2e0182d4e7b0e6096520470edd52d90942369feb41746cb555d11bfe1be872d820c7567215857c92fabf250352e9d55d4754bcfda56d6
-
Filesize
5.2MB
MD52ff4a8ec72c4b0721b841eeed848ccf4
SHA1bebf107127610fd0159729e0bd10d627fab0057f
SHA256199507cce5cad3c3d0f82beb539a6f69ccf969d30f69445aa03b8236e8f0c7f7
SHA51262b04f47362dc8ca158e45ee75459c9da169a325a5549aa858f64408db11a0e28afa68990012c4ee95378b013f44522c55b6943c81e126707e06142f0c652004
-
Filesize
5.2MB
MD55901992a9f73786c151d541dc5d7b774
SHA149e4b92e686203515a13715fcf683d8584cfc50a
SHA2566c2347519b7ef7e44bbb7c055e03c7b3884c71971e787a36ac52a1440395490e
SHA512bcc7827407804e3a1dda08916656024978274dc08da1b08f26399a145646528aeb7184c5acaef8c3313b11d846d0e4e617483edeebbca3fb533050d37ab8a759
-
Filesize
5.2MB
MD56785ecf8cd24d4c54a96c6ac8a0ce307
SHA17f66fd7d5bd8f02be6b0d70a08183de91447c0cd
SHA256ec3d6f6d3e92426a53b1b1178dcdf252d007a6929d521dbb7c86d62c209bb937
SHA512830e0614c938e749557a5b957a251c3adb8455f87a881ff2a261b4d680db046a79ada21fcb848bd38697f7cf8f903778d93925b9ba194303007acf249e854fb9
-
Filesize
5.2MB
MD5de164ec9b582267af30fd131ef0fd82a
SHA140741cd65c6cf4db460f2bc1a9a166457b9a79a2
SHA2569740ae97c6c4f578c30327a983454f3ff076d72462753b302cf9a91f08b2de46
SHA51281c07b2d5f9460c8cfe0dcafb9d94b80c5bd632ccbb5ab2ff499e5d497d7fd89c0759c3ff00bcbb739eea1ee536c1e0aa5e3ddbda2de01caba4c14c0bbf5534c
-
Filesize
5.2MB
MD5cbe975ef1e8804c061ba00b9f709fb62
SHA190e780148d78e68bf393368bc225bbcbf784af5b
SHA25688bbc183dac0959eaa37d86c0fda42cbcddefbbd34339cc5250ee4c9b3f4d3fe
SHA512eb4285c8b3e2e1bbbf5ac4e95b8c75a338881aaf449a2634269f9fa9cd3d1f6d028f1b1d1ccd25284b32d4fb6002129ad7324c242da80f766f1f0c4e3b716a4b
-
Filesize
5.2MB
MD5dfc757525ed377e9811b0baddfe4f836
SHA15aa6a8249ba99e4f8aff566e93a20c2fb3743266
SHA256a376506774dd633e5a3213714f743e8639bd964e0661eadc40ec2d5b0f00da54
SHA512079f9ec0433ca69f276a15202d19c7006e49e2f1253589cdaa002fbd00ebe5c8ae50f08af5be37b7f8cf2334730d3af30e25d2ed4e1ba80758f088331a73e4f5
-
Filesize
5.2MB
MD59688b9cbb748853b94b32bdb12ec5760
SHA1cf10affe9967f44afdf40040977b5f54c4c37c9c
SHA2568d5886289aa6146a089ac7084d0ad818a269a5e0f62ecef7b27b48bc903aa223
SHA512baccdb7ad09c8dfe2f1f541ae5b74d625f1cfbfe721c3c2cff2c8b480bb9ba3ac95f103f56a9defbc458c8c6f53b35215d8b861c5f444845e9e391b9c721be16
-
Filesize
5.2MB
MD5efb4e962ed3c761a6f41327016534309
SHA1b3089d8c8adb1142d960a6638f5a808b3b36d052
SHA256077505aac58cbf506bfe304de4b6516d83552a4d2f1615d715811363093591fa
SHA512c5596dd54791281381afcc76f36f4e82c608f8f41307076ba398c2187fb03e786d65371209ee2d655def1c45b18a15433509088c1076d01b0356621af1cb34ba
-
Filesize
5.2MB
MD5b522357ddc21310cda619e2ac3541f2f
SHA1146ab3817dbabf785d4203724f0a8c5cbf5cc6e6
SHA256b6ae7058039e0ade9bacc8051cd14d5550fe3ec0c5ca5ecfba181552a6ef5186
SHA51217013841a52ffc9589ccbfce6e6ce6dc60c9fd6a34e1cdda874c2b6f51eeb05261bb266ca81b2af293a28d1ed758c35c97c2863459deea82a99cb8d8703dcf3f
-
Filesize
5.2MB
MD5b9ef69d5299b865e6aa9cc275f1c0b08
SHA1d17f4be929cd6c0cd38001f56a3bbb43edabab07
SHA2566b9866a3964e6e3995708a0b477e2eb91dc4afc89bc7f1fda4634ffa1c4dc757
SHA512a8126f621a800ade1efedfc85c79d2b76479f7c3274d6601aa658f9d3705bf478625d3793a30368c8bc79843ae3b72c3514cfd1f698f176fa369941464ad8f1c
-
Filesize
5.2MB
MD5bd74fc9420db195cfa21cbf406ac7db6
SHA1915f9bf7d44a2aa2f4e05ecf54febe960677c3ab
SHA25642efcfd8faa5cc12f53825d9c02f821a7a492ebe48f9c0448277fc03d14bfabf
SHA512c0a78c5e2142e968d5c98231bd09cc4f445b9a098e5015066573c8f671a08a2b16dc0f7a763c6ad2d577c72fb7799afb7773687e9f439a2fbd60678650868310
-
Filesize
5.2MB
MD5160fcf0befb1db5c8d07ece75345840c
SHA1c83e6c6b1145d30f1cf143ff6ef8f07efe0206c5
SHA2561e24f19b7950589d2b811678dc0a0fffb651c99403959d228e97388c5491a0d1
SHA512aab16e31d7c0dd2445e7923dde8ebcc5ed0b3a9192159aae539a116d0eeb817288247719518959a375de9461fe0a26f58a30b17c1069104175ca6f7ee02c06e9
-
Filesize
5.2MB
MD5fcfc0832e060960c54ce20ec24b275d7
SHA1f6e68727e126824801b7d559f3a51a46eeb0f157
SHA256f58cd1916c6d5a0e5fb97e54f3a62fd6b3c5cd8a92f9c9debc3feaefd5a5c967
SHA5127f7548a7b5d778b5221c1357e0fd85ad548bbadea69be2eccd1df412d3dbbe8ada1ac5b6641953c2662439787a592febd21d118ff1cb066ed15ea788450b1775
-
Filesize
5.2MB
MD5f42be3ce40e1803aecfab8e16a29b5e6
SHA1835c9d60d8fdb68958892cad0abc28072ee78dae
SHA25607672324841baf835d9029c9dfce8cb626c8c4962129e0c9f6bb83fe9a951c91
SHA5123cedffc403af4f1c5a31e3b7429259f1a311ef82820e56dbea10ed77488b7eeaf5bedef76e99a080414101ec7ac043059105215b445b4e5539611b292701ce53
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB