Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 04:16
General
-
Target
2024-09-13_ae3bb7c136b65bbf07821a72080125c0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ae3bb7c136b65bbf07821a72080125c0
-
SHA1
35a68b70e7360e012f22bd2cc7e2fb5d2f65a577
-
SHA256
eee1b9a2ce5f4667b551cd86215a847a501ce3c34036fcdb61d40ee1cd845271
-
SHA512
7033e7086b9c7c57872fe59d8c125565aa261b7f2875176ef57ce231f580cec268c0e1be1297f2261f5e927eb72b35cf161a54bbbb2144c81ad20b2b3b8c3580
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_ae3bb7c136b65bbf07821a72080125c0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_ae3bb7c136b65bbf07821a72080125c0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qnbPAdt.exeC:\Windows\System\qnbPAdt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npnYgGa.exeC:\Windows\System\npnYgGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWiOKOw.exeC:\Windows\System\LWiOKOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqkaNnQ.exeC:\Windows\System\EqkaNnQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuZviWI.exeC:\Windows\System\PuZviWI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVjdFJb.exeC:\Windows\System\bVjdFJb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PQQWFGT.exeC:\Windows\System\PQQWFGT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tikcufO.exeC:\Windows\System\tikcufO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OOvfNGB.exeC:\Windows\System\OOvfNGB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HCyLPki.exeC:\Windows\System\HCyLPki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdrVcro.exeC:\Windows\System\cdrVcro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnkdGhN.exeC:\Windows\System\lnkdGhN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLhTPeC.exeC:\Windows\System\SLhTPeC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eXfqWUC.exeC:\Windows\System\eXfqWUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AepFikk.exeC:\Windows\System\AepFikk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xyEmhdi.exeC:\Windows\System\xyEmhdi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ezwisul.exeC:\Windows\System\ezwisul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WWCIzpB.exeC:\Windows\System\WWCIzpB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OpmcFaE.exeC:\Windows\System\OpmcFaE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YInKHxe.exeC:\Windows\System\YInKHxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBfnPEb.exeC:\Windows\System\oBfnPEb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58674b74a2c38a8d28dcdf21c03983362
SHA1bc0dc9c50451f1119d13ae9ca731de086efca433
SHA256e004cad4959ab4dba4d5edcaf5cb086d3b59879b15252f7d20883fbcbf08d2ae
SHA512305e93b5342fe4a038fc6d1a8e0f35dcdb03cc547b81c6e4a82033ba5eb90156296add18fec170939136f6fc90ea1cfd2c4231f656e8e341b194d11315e0629b
-
Filesize
5.2MB
MD559980f43ad5e9c60657c2fd5b44c6bef
SHA1e510a536c7293afb102c5968206b628b1dcf0fae
SHA25628d43311d7ebad9c124a67a1c3d8910c47e46a96bc9b7d9b167d78b815ab498c
SHA5124b563fcaba31d85751b73ae81584ff102da08d45484b7294d5632233f7d38de62eeeefd6c7e50116aeb4c36b8973e64318597cc1ac9ff9d7b832695a77d5cf37
-
Filesize
5.2MB
MD5b2d18cf2ee787b0dad69e6654735e50b
SHA160a6246a3fa3078fd2905dd7ab045cb4217def85
SHA256e60630a694920786f2e284f7f7b4d4b1b9ff9f77b29fe5cac9a2f78d1d6046a4
SHA5125410ad95a9670ec022826beb6ccbb18c291e551cb60178ff337045032e7b39e2d83524663c4b5be7494450edba89390f5cc746ce364a3c886d365e84ead36040
-
Filesize
5.2MB
MD57357ffeca795d945c873bdefe381c74a
SHA17d03a926862c7bbdb9ab792e5d5247d947140d28
SHA256bec9e3ed638a6b1b8b970cd797e2fb4dacc485dc2ab00ef1ef3469f7bc8b2d80
SHA51254efdd3974462310e5b4954ff040ac4f4be394b6ec55fa0f071c99edf5aacb5f101374d23f06413f904a20c387a98a8bd21554ddea445d69fc91ba1ff9e95c48
-
Filesize
5.2MB
MD548899a3622660b97f3751ae156c19274
SHA1affdb050e8135eee1f799e7defcbae0894b7fd96
SHA2566b49bbe17b7d5fe877f4d0f396cacb8f6d9cd3bd5a76e0d6c430c6f75266bc01
SHA512b24ec78610fdb732868c3db4a0102d21095b18cb08810c5967f0ba97acd917fa86862ff3ee2e98dcc5972e1f4c21da412ba028069b78816cd6f90b0a25a62c53
-
Filesize
5.2MB
MD5384790b040f61ebc1d9aba1e8890dbb5
SHA101f1484a34ca872ecb47915d204f9c67cfeffd71
SHA2562b72e1fd507b083071771d70f2894f7391d5261992e047d7a41634a7688c3a19
SHA5126d924f3275233d495cb4524e13b4e479b59f6f381d9d4b9745bb5309d47bf711ceb9c96d1065ddceb5afd99821f99ae9eb5bf1bd5ec988d4c7f07b1f97a428d1
-
Filesize
5.2MB
MD5c459bfe64b82e52835e0b0de047424e7
SHA16e54b98fe6f1ea1a9cc4802db4abcdb9220a2354
SHA2563bd79d7d35e8969ef567e3a64b5c18f08681ccc6b7648faced6eaff9fcd03f3b
SHA512fbaef79e134be44e53762e62a56e9d97abb5ae7216fd7a3db3b7cecf44d3cfd51fa5301f261ceddf675223f1bfc37423fe8422b47713301b1483499727596464
-
Filesize
5.2MB
MD521736e2e111f4b8e88aa1a5ca46a3d2f
SHA15a13bcba804c1de35c32191ad040f1f457aa9106
SHA25691c3a800c994d7d4e8a29422652e474e889c6f2b42e539dc4ed5bd59f2f1e203
SHA5121186a9e1a0cbe14400937e8da4d073ad2e8c4f271a323b4c9f1814d1897a3b85d922e867a8cd36fd4377453ca0b3e7900565179a2b934d6ecab279d773dd175a
-
Filesize
5.2MB
MD5802a7e86b5871f1b161110de245275f5
SHA118cada5fa6fbd5e1e9f95f3c63e048c67679c4c3
SHA256d0bf47004fbf9f0c378702a7c80d5390ac1547462f440b8ee5b24c645fe6ae01
SHA512e3179ea34eacac40a05ab0bfce4a4e4cf8038ed39f0d9d6e435647f878aa69fae84eaa2d7512fe67b8e6662ef94b89c4bfed4118938c1d5e3f56a9456044d021
-
Filesize
5.2MB
MD51029585384db22c73db3974826daaa71
SHA10e9c93056a37b55aeceb2089edad474fbc499fce
SHA2567a2456df0a31a66aa16ad73ec804788bb65c52a9109ce5ccd57fe160189d8a18
SHA51248d0d1ce65068c80b41812a505b978d6b1cee3414feabd38abce7ee651b154219ebc2127f08c47e4e8a86fe30ae354a97214034aee551fb1f3fb13ddf80db716
-
Filesize
5.2MB
MD5c37c8eb79c6ad9652116e78fbffe6d92
SHA1fa494dd9383f3f152d5c853923c95c8b8fc8c8a2
SHA256e09a37f87947a9fbd909c068695bbecc3a18681dfe9600c8329094af90ef36c6
SHA512060daa400f6377a28a6c3ca0bc9994f7ec0480c02adab7de69f8bcff8d237e851556268e215082c555f085669d548b6efbb307494ab5577241412bea70f9d60c
-
Filesize
5.2MB
MD509854b5313a231809324917b49e2f1c6
SHA1878d7238e1ce77ab0b370df6e11d12493d0af8be
SHA2566cf9fd196d42bdc55635667df707337d52e0a4a321e71c6654efefa881f333ae
SHA51275dd77494c48481667114ddf7ff32dfcf04a4c2f7578a58c26d87234cccbd814e60b0de453f3b46306a579c10bda46dd8ad060642dc0c0dd4359ca65b5bf4330
-
Filesize
5.2MB
MD5c1df993598acfe74dd10b91285c0e8e6
SHA1aea3dd678dde41682b43d3f92a8002f807c76af9
SHA2563e77655637b6cc2309993ae9acc82cbdced1036ca5a7654cef0ce72b7cf3feb2
SHA512d6415a302a6db9d7245f40b2ea3e5017ff44ecd089bd17ae2385c04c985b69c0598e8442b442c3631e3eaf209b8699a15f326e8ac9ce54c758b9bb597b591969
-
Filesize
5.2MB
MD5ece13d507a692109c94275a34383547b
SHA15d4c5a05a656fe935440fc4143580ce0a09dfc86
SHA2565e35d5adc2ceb877459db6728c7d1550630b0323ba51165fd25db50bd291825e
SHA512bd756c587e335e331a81f906a5bcdc79f301b89252310f2586dbf8fee3862a1419ac7357af29a9fbdebc99d1f1e64dd99eb0fe54d7c6eae0d698e9c7bdc0f299
-
Filesize
5.2MB
MD5a0ecb0e5bc8b839dd0892ed26ddb50de
SHA19dbda288cc6d91e86ac031023818b67c57906b2c
SHA2561122249f42219078d8a80cde8d50d054537be39f8ed7629f5ef8dade9abda822
SHA512bf73c79b6286b406accb3f078cd3319752af2de2eb17d872b9c242fdfd4f831bf9f5d4cb153bd7f31166b1a30b398d52786258bd861a9b639416eae23db21cc3
-
Filesize
5.2MB
MD5de17ee14cffdf7844d393f4c8f94105d
SHA123a91cdae2e28147ecae980abcfb6bc74b5503da
SHA256a4dc40c40da9e4c548f64c57427999457d0ee952f555fb83e9e74375a37e0eaf
SHA512bbadc7256b2b2515e0b83ea2cda78e2ae579e5c3095df6880e64f18cdd841a8f540fecc011dbed1ff3fc1a2760b5b51f15b04d33293ebef8abcc2e77bef44932
-
Filesize
5.2MB
MD5d88afa85704632542787457b08483fd9
SHA18f390d4f0ef86686f3f9ee552bc802c92cbdba63
SHA25690ac85107580e3adc3e37e901eb7773e30ae6590d949c9b644bc58eb10556604
SHA512c6fbd4bdea19c2fc4b00e2ece173fd364b6c0fd29744ebb81fc1e6e8923953f28407549f83b54a802d8dbc508a178d75768715be4e490d3656010988bbe4ee5b
-
Filesize
5.2MB
MD5b81c2656a1eae548064eb33f51dbcb71
SHA1c829fda202b1fb658e6de5892f2e8ec147ae42d4
SHA25631b8b3114b62bcefa490f61f174f6a8a86aabc39c4904dcf3faac1298b1d9c5d
SHA512ca820ba270e2dac69fb3258d50e3bca53c6de84daf35d9fd69983d20f789649192e9df2fc145c3054c77d1cbb07447c2e41d16d99ae9dec6a3e90eb187b0de6f
-
Filesize
5.2MB
MD5a39d69499a1b8b4a65da0b0758e02e60
SHA16647114c95b92216e90305a6e0d21d215485ed52
SHA256b37dc1d9a4d08ce36087df65c49b6de3e09454b3c5e3b1ebaa98840c1fd4ab78
SHA512f73657956d701c089840f510a6d65cf3372383d9f6084b3db53adf3d592f91f9bd42106d1d8e46ac45923b4a3dd69a4c1b3e9b4e30b0b4a5ff36fa91c0f16f92
-
Filesize
5.2MB
MD526b308fc92fccfd6dffd7f3459236c4b
SHA1c282f45345eedee8bf1e8054570651eb6d8c6187
SHA256e36b5d8287ea2a0126457fb26483da2278ab1c243b588902d1df64250e58f2a8
SHA51223124d8dc7afc557874e2907f45bb8c34bfa99171f9933517300213ff6f6eb3ed69f36227cac8afd5f4e922b5b0745d85b3d5165400aa03a0d3b854a06c19a36
-
Filesize
5.2MB
MD5c713ad14593800310b310e1e59f3b21c
SHA1ba1b14ce30cf66a35c495ebf011cf81c55f54896
SHA256710c526302e8ff1a9bb3ff2685a168837bd5c3539e67ea76f20a301e915df972
SHA51244946f1bf1b690810fcb7263dc97aa432de4059902b6ffa7a021b6ad82c3a5b7c7e1dc46a74175d855b077edce624b9de53ce1da8c69089f6a47b8132f59e2c3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB