Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-08-2024 16:34
General
-
Target
2024-08-29_c24a9a87ac2e9f250676a8dd565cab1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c24a9a87ac2e9f250676a8dd565cab1b
-
SHA1
e6050aac7d0ab13c9ea929bc53d2959e5b2ef4de
-
SHA256
6a5bc7eed4b1dabfb43ab13014e0a1aa50cabdba2f94b9736210b2c199e8d6f6
-
SHA512
d24b2e759cc01dcfec4485212e48ae9ae2bc40eab5c62ef8935eaf91fd776fe6eadd10caf51c8c2f99864018ef7f798d4779479ad3714e3018d7bfb076d27574
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lU6:T+q56utgpPF8u/76
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_c24a9a87ac2e9f250676a8dd565cab1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_c24a9a87ac2e9f250676a8dd565cab1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wQNRSlZ.exeC:\Windows\System\wQNRSlZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvcpbYn.exeC:\Windows\System\GvcpbYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHtgUxw.exeC:\Windows\System\MHtgUxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQvYVOY.exeC:\Windows\System\IQvYVOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CoioJnW.exeC:\Windows\System\CoioJnW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HStGLmw.exeC:\Windows\System\HStGLmw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXfdbJm.exeC:\Windows\System\sXfdbJm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDEJvlC.exeC:\Windows\System\VDEJvlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jOTxaUL.exeC:\Windows\System\jOTxaUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UOPeQJA.exeC:\Windows\System\UOPeQJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EViWpNZ.exeC:\Windows\System\EViWpNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rMwWypV.exeC:\Windows\System\rMwWypV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjvZEMV.exeC:\Windows\System\cjvZEMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EZxEtlD.exeC:\Windows\System\EZxEtlD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bCpvbxG.exeC:\Windows\System\bCpvbxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPIoGCE.exeC:\Windows\System\IPIoGCE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yihRHgg.exeC:\Windows\System\yihRHgg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzJCbBB.exeC:\Windows\System\OzJCbBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAGcrvp.exeC:\Windows\System\RAGcrvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnEPpwe.exeC:\Windows\System\VnEPpwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hUDUecP.exeC:\Windows\System\hUDUecP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5676b77567a56273484377017c4f07153
SHA1d87accb6185e096d2c5ed219467cb2b2793b0cb5
SHA25644fdd2229e02401514698fe17bdd8d42b6f9bf23065dd84ea5614719622835b1
SHA5128e27eb965c34c17cf5b71ed208d07d4b6b1c3615ed3c9079820c366cf87bdb5d4d71ebbc28e3f3b50515d738b7cbcca8d9f93bea767d74d279b372fee1d95a1e
-
Filesize
5.9MB
MD55a9de3178b49fab91281ff6c82c3ddba
SHA1f3e5ab211d2fb6ccade9c6c420f392cd2f29f6b7
SHA25638907b6c614133f686817328375870e4ac8f8151ff5cffcb00c4564c43991a6d
SHA5121aa6e84f98c96382a7fa059eaf99e542366081c823c3e738f73c500c0deb6009a480b8a8a82e3a2dc5fa7b60910497f76a2e46e5d35160779e3b04455f283c81
-
Filesize
5.9MB
MD5db362d70ff053a09eea7969482e4d2f5
SHA1af24c591e704e284dc2e3f26ed55324e2669c704
SHA256fd8ec2476c9f89e826bd83ded01106d8af8bf1c452656405030f7a9bc946fc8d
SHA512ef00b538af57a8163a1f596d5acc6e4382ad4e0d5408ec387392645ff1f0b7a3c47d77a1503d025233c60ee25abda5ff882b551f1e3d3bb44959fc765abca00d
-
Filesize
5.9MB
MD51107db5ed8a0d57bf335d2099fbbbe43
SHA14cf79cfbc5aa9ac0363de9e92039a6e2d96a4c53
SHA2563e21e1c0f259c1f6d16dd8024f823644c09583f245b8a9339e5fcc0d70727610
SHA512f32ced8de2fad5fba33bd5f0eddd8e8fddb2383a751c83ca5973c276899b05060090c059f433ba2b4dc8c6b09bd61f722926aaec96d947dc20df6e1200f8f6ff
-
Filesize
5.9MB
MD5ff29430b574694341e4fd7fc49b87a35
SHA1dc3a1f4b8d2cc109e93045389ae4fa4a955f4e24
SHA256c725e9c715e06fbef654cb20e440511b337a0a07ff294f849a7e5c8d58c93fd7
SHA512b37623c315077967c7ffc96133076c6690b01d100dc0a5281f90712fe6ed4beedd79f579b48a5cf7c45f27a10ad517df60256ea561dd56a23eed19780a6d148f
-
Filesize
5.9MB
MD56da606467586115636819cfa5bb7ed96
SHA12dcbd973272d29503c4d49046291bb971c0c96e4
SHA2562adf2ec522e26f264b6f30df1b87c921d93799dfa46b08bd13ec0389da055a1b
SHA51214f2ba7a71ef996b1ea67c17b21900a7fc4241ce54f59761721ce1a792992326fa9aa58a67b2254f77c3136fb6607de5c93303e43d29eb60c769b139a6cf1ecc
-
Filesize
5.9MB
MD535ab57737cf73c1aedbda9a95deb04b7
SHA1308701a1dd6f63e85ad6ab2acbed3cf5eae037a1
SHA256bf935685e4a1a4575e2560a5764623bfb49628bc174374cfb29657378e1c2138
SHA5124260412dd7311cd2c0bed130f665b7b67d5b520f6159eb3902482d503fd53b8340f6b8626e6c5ffb835d44700403e1bbe098b4104240b7861dd1f86a94a40931
-
Filesize
5.9MB
MD590195f4baf32665e5b50ad0e15043e8e
SHA1f649735b8200dcc45784e98c2fab2ad7c7b3bb93
SHA256e2bd15199a9a2daef0ece34e75f24ef2ba08c5b62f64fc594915933a9dfcdcdf
SHA5120656243eb12eaa96806abebdaafb9f2a1563bebc168e2f69a4e218a7f0f2d44b1690124c6ddfeea0e8773e24946ff6beaaf54c6f9fc0175d771506c5bb119809
-
Filesize
5.9MB
MD5b141527a7b504a6065cadae6eed664bf
SHA1557373880c14b5880c66a680224ce68cf017f40a
SHA2564ab8cee6d741b5cde7da04497f080ae19570e2ae4ce5c72f51a7e3dffcd0d434
SHA512dbbfaccb90c8a2981175cf2c3c4f6319f68b90e391dd6d5f3ac783fdb5de0cf0d460780735c0c98445985e32fb6faa18c99275c76a9f3a0a5b3cfc1cbeec1493
-
Filesize
5.9MB
MD54a890ea2ef23c0868c4decf4cdddc4b3
SHA133ecfcef633edf5ad345e50dd464cc79ffc4c1c9
SHA2568e14b7198d3c207e63c07f14aa1170b52dcb5a1dd98efcfb0981dfe18a564d61
SHA512d4b18e17422ab66544c495fb6d2ca5ddac7888a8825b3a9a2d50ec321a2a04a8ad241db5143abd6f0474074c739da49b1d3cff9d6800599ac0ceef806891c431
-
Filesize
5.9MB
MD56ca49343644d3801580bf402633d8bdb
SHA1fb144ec2f298849b8ab01b083e240c27fc47b11e
SHA256b05e479a5debf16adfc62e20cee1a22a72632a8e3b74a1e1e99d4d2714004d74
SHA51213442e672a5875f260e3a59bc05a1cc9876b16acfaf72c14112ae4cd9c285e43b339b0e03fee5b4bd7e09cd79140a8753f24e235f94e3d3aca3db75b5bf66c7a
-
Filesize
5.9MB
MD5a6a4b943980cb503dc57d8315ad71a7c
SHA1885e41b5eb0fdbe7821da5bbac734fb92f4d648c
SHA256b30c66803746435d24ebcc5fcaf1ece424acee8a59dfe474ea4db37ababde93a
SHA512f64263d4a5c758deaa853580b53438be3cc71aa1b6340263e6cf81a970d26fed1ef6a158d2e28636440fa80851f22e269776e98c0c8057323c1f8e22ca31e1c4
-
Filesize
5.9MB
MD553f40b80ad0e1739ffa3feb674a280b5
SHA14f575f64ecbd1401f91e97133bd94fbbec0349ed
SHA25657b54f4a2c662c7eeef242947541a3c96078e778118d96344d8831f73308a658
SHA51243af1b202b63df36cae3f43bf95406bb3b06b09ec8703bb538310a17e98f980d41f86011bf99fe5291ddba15fbafd75c4d6b53fd93d8b3e8ae9ee36c73e79170
-
Filesize
5.9MB
MD5e8e5039434c0b776451d47878473159b
SHA144820fa1825eaa30445127af7d1160bfb331deb9
SHA256a9db0f684eb2809c58e755fb16dfb993b1dea142bad2890e95efa39e2a98a98a
SHA5120202e0881097a87a2c518aa6b211a2542ef9416ddea3b4baa7236613bf1345b68410d9ac295586739afdc27d618c5e0f5b7ab5c7a5c63afd3fe89f608554fb36
-
Filesize
5.9MB
MD5e149a168931be32785f1b78d2205c313
SHA13bd4a7fafb2b52516d02937ac0ccbafbcef7f93f
SHA25686f26721e1e15cb7e5df22dc8d4a4c1d6e278a9d7f5337417d29324b59c34b07
SHA5129a19fcfb245d2948abacb0dd2e8340ef65c9105f91475da9f68abac4216c437ceff6b9a4b51b62a62c6c04514532436696760cc8f8d99a262d6207e7fa36f6b7
-
Filesize
5.9MB
MD51f4906dfb0769317018b0a3328877a9f
SHA1bdf0fa9f4e548329e8605ef005a9c4af4d053023
SHA25602d747dcb6574e5893f9e0e899eebb98ecf81b68392ddc897d4fde6ab1fed346
SHA512d8ee690e5da0d9cc5fac722fdeda25369ab5cf0e238bc55e65437f209acc86b8df59cc5b2afb85e560c63e98ff10bb819014c7b0bd8d3e141e4b221b93084e92
-
Filesize
5.9MB
MD54245475fd6eb1e5e38bca1c47fe5d714
SHA177ca3782787ae5b1edbe0ee94a6f02fd61055d38
SHA256d84b9ceb66e01335621ba54029beaa9de8a54f143ff6e4d7ed896b1bf6db040b
SHA51213a0b2a6785f2c4a856bc1bdbb90ff083dac96f173b9f9f5eff04a61bb8c3e86d079f0a0ce04af00479fdb280e34ab6eaa14b296a66ff5123b655e792e828f36
-
Filesize
5.9MB
MD549709dcee9e20ce9c59d6df00f261400
SHA1cef2fd3349ea0d564cfa7835340b96e96f0503a2
SHA256af8536bd0bb54c3ea098e904844f6aa4e51de462c9d7a8b22c7ea114e766107b
SHA512e614a6fce9a3c7af165d0573f2133d8682a4105a9c2da65500c4397e865c03dc5485e573f44b9a4a1e5d21259c2a2e70d22d701c19a88abfa2fd55b97297ca30
-
Filesize
5.9MB
MD5cf83c7a2b0a48ac35a0e4d7c56e50cc4
SHA15357b1443f308c7c87a31a9c8b5af468bbc1a8d9
SHA2567315a03880240dd3fbd6bb4b1f0b8aebb47a5513a97eb10cf91206c6ce997b8b
SHA512a394093fa813870828fd5c5c7505da0da6b3915d9a105729fa84aecea0aa7016f96ab98421d3e817fda7ddf95ebf73aa546e1d3cfda534c675d26caa18bff0f8
-
Filesize
5.9MB
MD53ea869318c48769120810e955dca3626
SHA161a7658896f7acb4d3c7eaa25b341e1b2dd3abf1
SHA2560dcd6e2c176e15b614d717a7480575d5169c77e48a113e56ba1a7a9a3857da88
SHA512c44dc0d6989211bec0b9759aaae3bbbbbc7db18a17255f902eb811228548693303d9da74bc1a7e0ba08f8057e69f766200d09626f178640664c2addc71ee0c4a
-
Filesize
5.9MB
MD5078718989d480c9b7cd0e8c27e92b366
SHA13a70348711b4914bc84e1e4d3b92c2a1285b0d43
SHA256f3af5bd634e25214306e026fd7c6ad8322c79e30b1206bcbcbf328bfc1419592
SHA512d9b7f284ab116598fdb1ade02194d5460b94b6107052ab42820fad21e7e1872cb9e72c22d2a9fed8be99f8d3b71c6d070882d74a01b980291337a984f3603b67
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB