Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/08/2024, 09:26
General
-
Target
2024-08-25_0511c1263bc2ce82b6c87b51bed0a251_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0511c1263bc2ce82b6c87b51bed0a251
-
SHA1
4f43fef738291dfe2c49c7694c0f74dea664604d
-
SHA256
352a0264b89555caed6d452b412b14e6aa740b238a9cc6fec6f0d307db4b948b
-
SHA512
f3d422724d454a527e57c31c4036c6f9fa7a1c3af65641b67b6b36bde34a429d4e7153ead07c493777d549b5e02ea0e3090ba8faf1d3b348fdc1ea6a96892ca6
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_0511c1263bc2ce82b6c87b51bed0a251_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_0511c1263bc2ce82b6c87b51bed0a251_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nvpZsWr.exeC:\Windows\System\nvpZsWr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djEjkbf.exeC:\Windows\System\djEjkbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLWqOdZ.exeC:\Windows\System\tLWqOdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dyJCFXZ.exeC:\Windows\System\dyJCFXZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZHbIasB.exeC:\Windows\System\ZHbIasB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsMyeDf.exeC:\Windows\System\JsMyeDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwLAiIF.exeC:\Windows\System\gwLAiIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VQlZMRx.exeC:\Windows\System\VQlZMRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Cermgbn.exeC:\Windows\System\Cermgbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPJxqID.exeC:\Windows\System\CPJxqID.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URJWrJT.exeC:\Windows\System\URJWrJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HnRRMKg.exeC:\Windows\System\HnRRMKg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPnRmJU.exeC:\Windows\System\wPnRmJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvBnWHR.exeC:\Windows\System\wvBnWHR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aaakXvR.exeC:\Windows\System\aaakXvR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yzSiIaY.exeC:\Windows\System\yzSiIaY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QisPWPu.exeC:\Windows\System\QisPWPu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dhXPVLk.exeC:\Windows\System\dhXPVLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDQNbAa.exeC:\Windows\System\LDQNbAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gKZjJUP.exeC:\Windows\System\gKZjJUP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmMWPif.exeC:\Windows\System\RmMWPif.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD592d242f81dd7711c54971d4042e344dc
SHA13abf1eea9eff6814748c7e3eff05e7c42bd771f6
SHA256fd0d3329fdfe21b295b7b5a6a3aa6ba8b8c986d6c00654a62afce3868caa6e40
SHA512f33d89dcbe8fa39683a5910192add97bf892bd6c21d5fe5a2355de9c21949cf582a237567a271af3960a25ba4b29709d57d4f868cea0389c6c5a54f6068c48f0
-
Filesize
5.2MB
MD522ec43e6a09ae72afcadc31c1694e198
SHA11b411596628e54cb0d8b636ece5116ce366ff703
SHA25633a35dbdb42f268c8df068671faf75b7dec7cb7960281f13461bea8a2dc691a9
SHA512b413cdcc04d09c33fe22fad3aea5db011626d0fe5c64ba8a02792307a29fb672b8c99d50420ef3efcae87d5ff306807361f51876592524ce6af5506ca5a088ff
-
Filesize
5.2MB
MD58d4ffca71fcb366cf4c3dfe3d37c64fc
SHA1766961b596239698f76f494c88a5cc9d4c7cc3ad
SHA256a52f6c7cd6aef747d0e329108ef8286c908c52a6aad9aa2d9aca83b19d56a487
SHA5126d09e194b4a5529235da42af18d2ab1a2b1797b26f0fe5b01eb2e98eada10e2919666c08d2aa288817479d3c8a71f01e433d5777d936736a51cf31c0c46b814f
-
Filesize
5.2MB
MD52a82e05455c2201f0eacdd23d547f3a4
SHA1daaba583e87d4e8a7f224d780e5f629dfb7e1a0d
SHA256e77931a0ce893beb62e37b6f5c474828848f4a27b7eda8a9bac317958fc78cfe
SHA51229707c1eb1db78446185d709233bbf3f4a01792164e1ea767b786958313cb6afa2307f2e20c876d3c4eb556f034a1180c2bd7c58fea5890858541e20acac8add
-
Filesize
5.2MB
MD553a1c7de0de15da4b7641e831a9ee710
SHA164cb035afccc83fc8fb17f7c5f2b0210b2a5aa43
SHA256a877f460b9c0022cb492f1e2505d41f239629fc6874cb11aa34d53c5f553b656
SHA5129c7d9df011df1dff3e0973ba57981907d80170a04575a883edc8932579fb0f5f24f2d663b5920dd09182402117fe564024715d686a78abe46c0f6b9781ecf6d7
-
Filesize
5.2MB
MD5c037dd94a375222081ed30d39d59bb1e
SHA1c43641a1f9af744698932e16d84afc833335c999
SHA25604c0bc4c0c91a8c574608fdba496d1a1db6b80b37a81dd4c004024107ade6675
SHA5123eed31cf58ed2f0c00f110f8d55f35acb6cc80b20eb09338c7e08171daab813fe059b1d47008512511c6dfc689f95b7a94ecd1e4086553abacf41e377c191af2
-
Filesize
5.2MB
MD5b754824a3d4fdd099de5d4039c50c753
SHA1ae3c1b8826dadb48c3de34afcee334070448af63
SHA25616a011121602413fe780fa02e8c530eea807b0ef2713009f648f2b0cd3cddd71
SHA5122d6e23f239bf8a21153363fbd9d9866778a19db88bf0a5be5e27b529492981c9607af87406c965b62509c31e82b524d2956dd81225e8cb53965afd886cdd4409
-
Filesize
5.2MB
MD5ab69084d38a2478b52a6b7b1290878a6
SHA1c68263b052e43b4884ad4a30685ebeab80bf6598
SHA2568e0958b0758b75af1bf55bb7edb3db45ab567988e1890c4f9df94d83c4cb2b6d
SHA5121eff5af2bfe8996a8bb624508936f74c4c355f986cbe047c0be6e7869cef7609950cbb28a6066f203c5c712dcda2160415ae42e705ee6e6c1d7b15c135acaa53
-
Filesize
5.2MB
MD5ca1ffd76223b2d7a3802acd15be2036e
SHA1db8f02d53359aabc6dd3d040cffc74b945e320a5
SHA256d2a4e9897f6d2706471f8f0dc56812c2c23c1603f4444e79aa4d986661326ca8
SHA512067ada0bec9c7cd31e5d34c2b066f05f0b2c437ac503b1832e2ce1dfb56336516fba6dee22bbad7888b73273699f205dff6a1ea90f6fa040b92f05180adbba36
-
Filesize
5.2MB
MD5f63f0772c0800eb852a14a38e4c3cd51
SHA1dffb9041121e79a3408591d12bc82f68f4c06888
SHA256ecc9e97638edc9a488501b29daab4197191f627d3e2715260e1ba1280e2e70cf
SHA512ffcab97a50aa5382968a8b7fb95c96cd7d318a682235b826ce7eb4be82b863746fc5d1c84c1925e62f6672f7f0d5527d92925fbd22046a679235182785e508e7
-
Filesize
5.2MB
MD53ad0534f186a919f36479412a9870a8f
SHA1b5f18787c86e33e2989f01d61847b28ff88d7396
SHA2562055f2bb4f7a8eed42f5ca78a3f17320841139388acb2e5db983d71b9bdca7b3
SHA51217a65e5e27720ddbd241d7863fb4e44cf532d69268e282a4663747adc13ae468a6b73616ad7ea8ddbaa6b33e78c78cc0b751409dd161016a04e336da22f77870
-
Filesize
5.2MB
MD5a97529f54f29b208be3f69a8cceb3673
SHA1ac000f675ebe3032dc29671c7ce69aac43cf1f58
SHA256af54af3a4967e29372fee5fb53cf7005b1158ff63c9b235154e12b7c72f0cde4
SHA5121a94f281a01d525aaf7cf8b38eeb80e81daa649c579c92b5b19d62dcfd0dc85beb4426dc4486c59dd1682dd175cccccce32f68a995ff738f74f067539a174a98
-
Filesize
5.2MB
MD58b7484653c5e3fd49f6d1f8933d7b6cb
SHA1ab4144e8fe05d092221aad0e318485f5f6efb922
SHA25659145ad037012eb5e5d960b27f4c5e264a536c7eec71cbd972557fe5f4f40652
SHA512881d961d7b5f0ef80b8f52de558c8f47babc87a0d2254ee4341092021029cc589781b9b2e277bd52a764ae4db2cce15a2d6df82e7fe473d48bd9b7b6cdeab22d
-
Filesize
5.2MB
MD53bff5d0d691231291624c8c3fc4ecc2a
SHA1431b808084bf5404653ce911f7dc23949b4806a9
SHA2562f49074fa56817ea267ddfd2a96b7f62017105d27d03a523e0ac9dff8692eb38
SHA512420ea52277e604f6bf64bfdc2638185cd8f59eee9af4880d4274cf54e27d458d74f19bae35b472d96768a7a19b80b2c713b523156598f5af4a3e4d022726e94c
-
Filesize
5.2MB
MD553c37d57b2d417277cd10d030b2c78cf
SHA19557a00a12f40bf32a3a17e730847bc3b1c921b3
SHA256576938f3cec466ae3c6dafed2bb893d47c42189bf7b368b0769cc174e4c28f3c
SHA512678c86fc8c9731da32adaaa20dc1595fb62e8c2c9f73791714eb97c753c89a5472915a024bb34294686f640493572c8b4c68412dcc55af97ab1716c910558443
-
Filesize
5.2MB
MD512215a60074375ccb16413e99be8b68b
SHA14d676b031b1dc2cdb65f8d1e82bf02113061e088
SHA2563b09fa1b51b793935c3950759193cc7edb27457e031a05aeadf9fc31f71a6381
SHA5124ef79d077c4af11054f756ac57446ab3b9cb993161bf83e6832b415c487252d7cdbca4c7876ba8eee54536497bc63ac3b1f06db4872eb4b6d5c04a70e4694f3f
-
Filesize
5.2MB
MD5dc043cf5f6f6230e39c2fecf2c8bc788
SHA1ee498216543f22510f735600e782f9a11b8fcdf1
SHA25678e596fc09efef675c145353dd96187abe68d4d5d05fbb8a9167726ad9c0afcc
SHA512d05d957c2e379ab251e412ed8ddde11ed59507e8a78d1713b2c5075011b412d4c43f698e96662a25504501580eb4244905a3837b9fef823a331fa18abea28f65
-
Filesize
5.2MB
MD5f68eb90109511650c6cefaf9d2dc302b
SHA1a68c96c44ebe50d107fd7114a0f0a004caeca68e
SHA256385e6fd0db8be15260df8513cd5600bb550be25bd86684629a0cc5960da9b367
SHA51287d9198be49210e8d136c8d0fc545900498df18dbb038849e6739fc2c7afcc6318077bacb266f89f6042ff99ca75d93c22e0c250d8402ca240d73c0bb130559a
-
Filesize
5.2MB
MD512c7aa0ae445d4b2189b89c0ffdfed8d
SHA157e5f411ae893af361c5d36aca7eb17034d4120f
SHA256a5b1f177f5bb42867ef9c0e7d4a2fcbb7a1c12e8fea8aea90bc6978957e08023
SHA51255886dfcc55ff52b1be40d5d709bcc8f70623c49c5de8f8ea226fc3419e0a10724883c806634d91aabe6cb61742bfc4f40e46c841d4589745a4176872d3adbe4
-
Filesize
5.2MB
MD5836ece15f00ab1716d5d11a7e37a39a6
SHA1f232acaada5ea88ed9923cd9154158ba888cd649
SHA256a73624ffa2afb632b1dc81f80abcc351c65896b580bd8977ec090c9bcfbecc0d
SHA512f771c9c5ec6bd5d0c932ed1563afccb188876618f77864b235b626327ce552a4186012cbd23afdcc287424e270d782acf291838e459c38b131dd535a5539186b
-
Filesize
5.2MB
MD5ec1b98dabfc27ff16b7d0ecec4724ccd
SHA16574e355f24d8c8b82a6e98e15d6b38ded5fa911
SHA256cf41f2be5d0ec6d2873af821ddbe0aacb869ecf5d42901c7e9915900e13b248f
SHA512ffc36664957d6d53e49928bb5042fb95b4f4213a0572797787031e03a81fabf59526841f2b02f158bcec02846da5d2f00c85a6a855961e9ae773111c3c775866
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB