Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-08-2024 02:45
General
-
Target
2024-08-29_80f7620f48b2145fb03ef9674f795bc2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
80f7620f48b2145fb03ef9674f795bc2
-
SHA1
ccef7510d3dfa39ef0a03c7ca342bff359d900d4
-
SHA256
8b05c4d5f309f30dc0a18be8fee312afffe45a91e59f8183ae06d000909b1007
-
SHA512
84b1fe05978182cda53b35fd6eb9e45a4555293b50d41c6a8051ff3ee801226a48725448fdff0dcc78b66b58bb0fce894bf591aade11a2d8ddd99246019eb3c3
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibd56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_80f7620f48b2145fb03ef9674f795bc2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_80f7620f48b2145fb03ef9674f795bc2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mXusPHV.exeC:\Windows\System\mXusPHV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rySsmOt.exeC:\Windows\System\rySsmOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lIQPeay.exeC:\Windows\System\lIQPeay.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JVUSFVR.exeC:\Windows\System\JVUSFVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gnDGnHy.exeC:\Windows\System\gnDGnHy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXPerCY.exeC:\Windows\System\gXPerCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKvoUUn.exeC:\Windows\System\mKvoUUn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMhcclx.exeC:\Windows\System\EMhcclx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FZyZRRh.exeC:\Windows\System\FZyZRRh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfabTMK.exeC:\Windows\System\kfabTMK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsFYTfZ.exeC:\Windows\System\wsFYTfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqwUimP.exeC:\Windows\System\NqwUimP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPlTLod.exeC:\Windows\System\KPlTLod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SdkQRvk.exeC:\Windows\System\SdkQRvk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vyRlXXU.exeC:\Windows\System\vyRlXXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NgQqVkZ.exeC:\Windows\System\NgQqVkZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cudIswO.exeC:\Windows\System\cudIswO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IjQaIcU.exeC:\Windows\System\IjQaIcU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLnSosa.exeC:\Windows\System\gLnSosa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpIUQEs.exeC:\Windows\System\tpIUQEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndaJTax.exeC:\Windows\System\ndaJTax.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57249ef7122942b160b19956cd4ee8b79
SHA1227e3788cc6edd51b6a051d95755d0a81ec19d5e
SHA256bb4456def112b9be4a45645ed14c77130404e9f229ed04776e010ed4b860bd94
SHA512f6713af76be531d133e6b2cef25a237407a6479cbbf7e96507a1cf2b86020d74356d4ee5f81bf3664a2887d41b84f79738a1951635a6ae287cd087edb347a9ab
-
Filesize
5.2MB
MD55f01d1d055266d2877ae43a93f2ce640
SHA1d367b3934e7970e905d46e7f8a3dbcac628a6b30
SHA2564b9007a1ae0f02504d5d41526b55713ef6e3c4bd0cd860ec9390422aaa738721
SHA5121b3ec1138c1d3557be634156209e4913414149597b05a300b04ba0256e2c308d26a93e44078f15f470d8e47a1ea03f4088931d5ab4ea5808335b33a320215458
-
Filesize
5.2MB
MD5ce36c7147b15c153a7035f024aceefec
SHA14f4f4da5096a2a8e54264f63bebdbd12b1fbdd64
SHA2561c53e08ca9af4ad7670bf3a422c4d1f9a1814a8da528aeed3ef0a21c32e2a37f
SHA512f49ec179142d1711ab54541cc908052338c675945e32d8f9e80ec0d986f6ed94ce0c922dd4aa56a55ca679d2277319e40b0b13146de188578ab70ab7f4b645b7
-
Filesize
5.2MB
MD5124910fc632ca5fd7dadcb11df5c5daf
SHA1c7710e1b0d84b44e57adc6bc1fa6c2210eb8f6e4
SHA256f4d5e379863b6b016df5b997493acc71d8f4d41232d8b468a514dbc94bcc27ea
SHA512c81f72dcd5e2b8af5d5769b6f679615571ed1dfed75705b5d01a5ba4603e4e6057b9fd8216c0721644534fb5572b98fcfa6c5702fb4b1fe63748c146a52d8620
-
Filesize
5.2MB
MD57609b61bdd9ba17867823b82b2cac1e5
SHA1051f8a1ef38b66857058d7fc4460681cd8fccdb1
SHA25636c7de9b8b7b80daea4af76c5407f3ff354ad512a337ae870fe29b98b5ba5405
SHA5124017a237184d81d151488eb9b644aaa22ac1ba497dada02e54773d214a742d65b437428fadf1d8a2f9312787ecd0fba8384af3b47ad278f7b78bb5302b711bcd
-
Filesize
5.2MB
MD511ed08e756c287dc0504001cedfbdf2a
SHA165a1b58f649728a919c7de97933d77e7ff8ce64a
SHA25629d253164b6a3012865224a679f1bd58d097a681a94c6ae9693a8e208d5a4ebe
SHA5123c5f2e08dc84fb58a6d462a69f0fa792001c4019abb5e540eeba1164131260b960154b72b2f9fadf1ce6b02d75fb449f1d7082f98fece6250d648ca3b0aa0130
-
Filesize
5.2MB
MD557d24a4acefd26c03fb9daa8f645a7e4
SHA10ca916807c1ae93abd768e6967d1e6f85cc56d1d
SHA256f90b72727937a900a167e61650504f74fc3f8926e1ff3ce05bd9e79400cf43a4
SHA512a01167f4c88f9c5f865d0a8794a2e45613ae1b5b94835f3de23e36006daa5583394846184faa5e1facc3406cae5766f320758b79a4eb50f625a226c130a9c36a
-
Filesize
5.2MB
MD5428d5b95c71503420b37de5084892149
SHA129ec9801a5f6085c2ce2faa0012979244cf7ca6c
SHA256326c87e36bbb8d09c2ee016ef5a8a514b98d5e80ad7cf84af1d4b3ea6cc4ad05
SHA5129c54f2c9fe816e69d01641dcf2a04b7c16ce1c809c73561fdcb37ed80b5112f8dd685d09b7f09ba9feb40f00624ada9c62c41901bf655767de94dd65b2500f9a
-
Filesize
5.2MB
MD52851559572d62cf189def861de82e672
SHA164de0a1a0dc2d9e23c53ef11771de721112ad295
SHA25696d754727cf31f6b8e255f3b545e5fe3b2fd42ead342952a3c4f8c19f306a6ba
SHA512add727030d5a3cf22e52add0fb2a52188777200a18b5e5bda4027b9b72e0a1ec9f330c59d5ce69025c395d86486218aaa97104b3becb6aa1c7e392209bf9ce5a
-
Filesize
5.2MB
MD5a7249b1901d1002788a70cdc0ce5f717
SHA18129c838121ade38fe52655171a5e3622cb29377
SHA2566f4e24734b5472e8d8b528393ab57f581c2c08c53ffc84d48c7231186c526dee
SHA51226e282f550ecd82d6a25e1bf1228e9c38ed8f1e90b16f52c1b000dd61d69e0ef51868ea6aef330453b35d131cad8e15a3710f252d9b82c4d5430f9a1aa3dcdb8
-
Filesize
5.2MB
MD5bddae7743c20faa0014fd85747fedb06
SHA14896bd1ad6699072d7f0ddd9d0200a34d98cd0da
SHA2561ff5c0f89178767491d508d44fb1790af0183e4c22ef6b61e7f24be629877e1e
SHA512985c32301c447b326ac3474643d2fd816cf817cfcdf3db9b5268f7749b5e262ab67f786c3a5a2c7852986b75dd98829694d70a0cb725f30ddb12c0bdce72177e
-
Filesize
5.2MB
MD598db07b09e919b3083eb4dbedbde8121
SHA1b6aa279070ff7f06f384706754140667fb23be37
SHA25655218839c2c8506851aa615f990e47aa136191fca7cf03b4baee98295de75cd1
SHA512ecfa75004c5c84e7dea1636d9b2455a05fe2d2f685f19a3dcda138e7e417e751d49e38b57e99ae1c8443264c7270b34b13f3d2a031fa9b232f5532fa40092ea7
-
Filesize
5.2MB
MD506ef13b52e388a3929e3ef75efd73937
SHA1b2dd1beb1d30c5e090154c3a3c8c67899d5a22bf
SHA2562148258db1d8dd8af7b0a10ecb9dcb597b19a68d8c32eb67e1821810fabbaf7f
SHA512e7af7ab60da057c7725de4053be7345e142c05620a8d5d7e1caae9e721afb34e34ca1aa27ca91b97e6d5eb736431b3815b50094ffa5356a93398e2f08ba2d640
-
Filesize
5.2MB
MD59981bcb47e0cd84697886c4495f4cde6
SHA101771c271c4c1a1173f15ef43ef647e2856e5da9
SHA2568a2c027e0428596046c37a4392f044c36be4d176d81e1b33e8d72d1d9f1cf853
SHA512129899c1f79bb2f3de6ce3491be81856cb9cc00f35b40cd3b81655dafd833fbbca193a1933344c488eeda71f759daa8c3fe212b65a21d84d7303acaa2a1e7411
-
Filesize
5.2MB
MD5dfe17d67558207c939cd51c350168423
SHA17daa2187737dba722eaf7d749f09886436693398
SHA256175001118b3d88bf34e63d9d48f7654c535690eb30a6ecda3f5c3a0e29f7ccfa
SHA512e3094ab549a1dd499c88aa8299266646921b59afd14e9a33eef5fb45cd74d3d71b806306bf9222f0d2c1df15f030eea589f0bba2bf016d49b857afdc26ab7517
-
Filesize
5.2MB
MD51e849e72db2fd09dad5771e0bd8cfd4d
SHA12e34b18002048dfd9ed80d05dced3f515ead98be
SHA256e24a14428835f456eb7f9aae51c2cb346a3e3a0f8ed39a928a87aef205fff898
SHA51291c6e97a94d6c5ee3e42ecbbc2b978f1d94155b10cd85b3f9bda612f63db46f4ef91277ccc3080daaf13c48759f8ea75fed6eba8ef0f0a503b771898801d142a
-
Filesize
5.2MB
MD512ecf4c9a37b9926bf5ab2af237e3521
SHA1364256eadf22dc67ceae3f1567cded7dafd99521
SHA2563ecf63f70eba019c1dd34e0bf9d01e8d6cc5e3c30259d49cc204f323cc5e651c
SHA512307c08f913393db80f556d21b0345cfb71408c30caa21f943abf575f7c1bdcd2fec310186226016ecd36c89d23e303e6e91f83cc1d768936eb31dbdca355e325
-
Filesize
5.2MB
MD5908b6ed0007151c5752fd7afab349ada
SHA18ddf902bd5c7b39529e9065d4c2fbd924722e3f7
SHA2567fdc19a9e801774b8eb216e63a179863fa0acbde14acfe4b8ee095d73438968e
SHA512a3569c866d82ab4caaea82e4fa9e87870a6ef816c0d0b3f215f37b44092e6fe9622468a669b9606b0a0ba5c7e8153b61221071bdb1271856db41ea59d8f71b01
-
Filesize
5.2MB
MD5ebe2830cb0bebd5d6580bbde979e917f
SHA119c7bc80a70c52f9dbdf126d4a28a205009d5c65
SHA256ae342cdcf5d6b1ab1eb24ff526d169724bb1b4eec4cfd8eea844eb5162b7f3f1
SHA5126280b1436ff662f8fb75f0854297dcc720343192fd01ae80db69502610b49fd9ae21a01c85c81a640c840641eb79375a0045e9752e3db905970fc0795a6b2a09
-
Filesize
5.2MB
MD5c8091fe8d2f3f0c2c364ef52c3d95f53
SHA19e3a31ac6d86e60d82ef54b6b411c170dd8b3910
SHA25632e4705ffc8840c3cd1893113e5fb87aeb15a8d564d752ea1443e83f7af32cdf
SHA512e99433860707fd47dc7c2bb6e0644e2329fb5f960194126eab0baaaedc47138020bea7e39b7628dca9a5d55bc65cff815d86fbb20f668b87c0ca0094087672ad
-
Filesize
5.2MB
MD51d7560034d013a4a3b15d0f4db9a7a6e
SHA10d5bb335df5dad7f0d3c089edb78a6032010ad14
SHA2563088030c18215cfc7bda07cd858d683da9af5834465a0d0a8a531c7d6f22cdd1
SHA51237ea19a6f2681692dceb3f62c4640e1ddaac2b3c68aca40cc941ccfaf0ae3a6f0ecefc43591f1e310d60dcbb86b06306ebb3307a190abac5dc8e00eac6d94b7a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB