Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 08:34
General
-
Target
2024-09-13_2f04e9b651cfbef50874f51bc03fe742_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2f04e9b651cfbef50874f51bc03fe742
-
SHA1
693477201650474916775d8f4f7bf7535be0e709
-
SHA256
c7a65151f0f06acc930e802108eaba95151ed5f57e6b9ec9cc7c8b30d0304654
-
SHA512
5433cb97a904465daaa9718abdb798ac374f629a71147b91ebba5b0c60733e190d9880ec2f0da4768bcf52f14ea134b30e25cf0fd08191374940d41ebfe5c180
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibd56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_2f04e9b651cfbef50874f51bc03fe742_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_2f04e9b651cfbef50874f51bc03fe742_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NrPSCcW.exeC:\Windows\System\NrPSCcW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NrtBhWo.exeC:\Windows\System\NrtBhWo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VRlAFej.exeC:\Windows\System\VRlAFej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyaAfdO.exeC:\Windows\System\gyaAfdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eNElYwm.exeC:\Windows\System\eNElYwm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYKpZyM.exeC:\Windows\System\IYKpZyM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TBsNYRO.exeC:\Windows\System\TBsNYRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DDUqgjt.exeC:\Windows\System\DDUqgjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUEpzEr.exeC:\Windows\System\UUEpzEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTVZyHX.exeC:\Windows\System\uTVZyHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtVxqPF.exeC:\Windows\System\NtVxqPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HMVUoxS.exeC:\Windows\System\HMVUoxS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZcHUjVF.exeC:\Windows\System\ZcHUjVF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqwznsG.exeC:\Windows\System\dqwznsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMPoHwI.exeC:\Windows\System\BMPoHwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NpwhURo.exeC:\Windows\System\NpwhURo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bUtoldk.exeC:\Windows\System\bUtoldk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjxOdLY.exeC:\Windows\System\wjxOdLY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZEoVlXx.exeC:\Windows\System\ZEoVlXx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PWHWIVr.exeC:\Windows\System\PWHWIVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoQOSCX.exeC:\Windows\System\qoQOSCX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dd6970b1fd91a45e6a297ad945e76871
SHA1ba4e76a6291994718551c02ccf825c4b4f281d26
SHA256586938d395fb06319b8987890ce32721dade0cccc0091686ebc47a5d2a82c535
SHA51288a7afb31c87eadaf57cb963ffc0f666c1c76dda8c1d01bbb46729ff6602c62cdfb0a2dffc08019963761c2a8c08cb844e7a97a0fd1fe029ece9cc450de6de73
-
Filesize
5.2MB
MD50eacd6ec93ccbc54f86dabf8e2cb75f8
SHA1ae21d1fa16f71c27b0242a178729d07e75755260
SHA256bc7e769d3a5e3e7559b8db8af15903f80e5164c6b1f36a7b69b3809a128c0441
SHA5122df414add6b12470c23015f98bcaf9f274399ac82ad36a2d118f41f02ced06eca90aa7a2eeed668a436d50c5eb10a2a85e519fbc1e9d530762685331f76553e7
-
Filesize
5.2MB
MD5ef93b94d02b42d04361911cbde99eb3a
SHA1ca57e5431bcd644d8406c69cc28f6359cba86cc3
SHA256b7381e4526b2efae7dfe54eb1fd501d771a993942d826aa889523f848674ea26
SHA51297001fad5831dcbff1d55e7e4620465547e0fe28f445c0f97b1ff006f0464a607f3cf021ad34d685a0cff9c63d074d1921a1d1a06d0ad420b2fc4c5524e808b9
-
Filesize
5.2MB
MD5815af0acbfa92b94424bed341a4e91aa
SHA16c4da46bd0e699deef833ee33bcbf31e37e875d1
SHA256df3c582c0dce8c9baf76c82958ec84e4abecd19e5253b2e88292c08edd9cd6e9
SHA512fc205b577479279c3c396d2fa5d67553ba3de10355bcafa1f35a5a7e76dd6bcfcb878826f9d8d4475b0f03cb36f5856bf72affcbbf269cbbcd3c0be7f7bc02bd
-
Filesize
5.2MB
MD57d6ba4538eb3e354efa0b6f22ba968c9
SHA1885650546d0cb5784b614a5efcc4a7c4446f18a9
SHA25668f704c0e0a59072ae9becccf7af7c35e28a8bb6eae4d8f56abd516c08be7792
SHA512c26d8cb52895c4e77c7b169ba2aa46f46d327e367ebdbb4ba70fb062070ae17c777b9096fe77cbb581198a1aefc95339eb81ecdddddfc43030f5ba55425b6af5
-
Filesize
5.2MB
MD5293bcaeecfc6c3d545f81739705dfc2d
SHA10a408256c2aa7ee1d3faa9f405cb80c736b4503f
SHA256eb602981c9576afe834411323b132597065ea90ff4dea9cf1be022ab7bb03e82
SHA51271d61e961087ff4f9ef7dbd6f8f98211cfb2d1b258b21f472c7910beb7d772e51683d30bd189afa43b19266725edcf353ed9639e163a1f789d6b48d98da89bf2
-
Filesize
5.2MB
MD506a241468bd726ae40ae6c67d24d81b8
SHA17ebabad9e7158405f379f3220f478d6c1a540809
SHA25694e69a01c7fa5a0917a1292a193576795d8950690cf5aba6a37331efc0201666
SHA512a7ccb6cafa30e9ec80e993e579535f3843e08396458f26267b9561907de984391486c399b87d2852ae3f43393b8c1721dc626ab1fe810ed9a2a9f0a2ca5439a7
-
Filesize
5.2MB
MD57287cd40f315ed36d86ab0c337d522b8
SHA14da4c6ac0fbf8601e1a976ccc1e8b3e3fdaea0a0
SHA2563c129970e687eaafcba211e1859ba4e8b46d93f36b66f2dbf59816ded8849beb
SHA5126d4cf2c3fee4c58a56202cd5e1400122b735af180399731a77eb3d67fb213f43e5c7db70c54097bf0ee0819ce73f12e49f1158aeec92bc08dfb2c497c070ea60
-
Filesize
5.2MB
MD57495315c086e30f31bfb81de5bf48c9c
SHA1dd3ad87d9490233d61ae431080d602bd92752b88
SHA2568ecef0115f482f812b52a7b40d2ac0b4cbeb9e4cdd076ca88c04eb73f365ef42
SHA5127df324259555c58c54779e6659d4c1fad1e9245d415c2246db9cc6fda8039edccdd09f4d1b31fb17d962c8298190032836230ef3386bb61c8ed7d5cb5f4df9af
-
Filesize
5.2MB
MD5bc94624807b2a7c001e424a75462e7c6
SHA106de291e077614c0f2664e12aa5ad80b8171aabf
SHA2561d9f738a12eec3f467459d4109e0ef4af3fae69af31a8adbf33f82aa501fe9a3
SHA512dc5fffa489043ae078c94672eb05edc11de561cf0014bddfa0b7c17df170a334dec48c7bd3510c60bef50460c9b41a9c13a858c2f26015d350707a17e940d718
-
Filesize
5.2MB
MD5a0e47f3a12f36d621d3cf3c35e8baeb7
SHA1823bc4273947c68c8d79bd4c221f2ec026665f27
SHA25631a36d8e98e5e1e7caf2321a71e6b1cd9fc5c98c27eb4424f042387b57bea3bf
SHA51284b948e44c0ff3851c02717eb029640523ba5db0db4f8a0ba925780773efdc84a125bdc4c83bba428f420cc873a7863a55a83eba7f4a5f8786d3cc0c0e01b285
-
Filesize
5.2MB
MD5f2389c005225408a2709a5da511fbbaa
SHA10f5696cdc3eed1e3f7655034c0cea610abf249a3
SHA2563350c36311bad0d74f35282998156f64d2d26878987f411ef4ccd78b575864ae
SHA5126042d89880c9492a9b10247678c27cf5da597a0e24174ff63992443b27b7e42db3ed10bf3c1ee24d24bb86f3365703f04657de0209fc71016f065fcaf3d6f9f2
-
Filesize
5.2MB
MD59dd627e25bf7022e88fa93692b5f6b3b
SHA1efce224984aeaacfb7b4c72eee8b962c83e55409
SHA2567084def3e5032da1c144a023e266db2064d120ef16bcdc224f41725c6cbd9dc0
SHA512f4b4e80fd291584026e78a7c6c96b10bdd3682131c80814848065d191e808b133532ded83a787aadb6af5e672b7e3caa2494ca1565f03b6b0bcfee6eacfa1eb0
-
Filesize
5.2MB
MD5f83cbe06526cf6d313612bdbfab53911
SHA165f673b531f3c0347ccbe90493cc30f118944bc3
SHA256e9015e30a870777717d85b6e98729163bcf39b62223b383c62e76023fed71fda
SHA51243b9e7f659a2f8bfaa7fa837cdf5af288fc5141fe06d1def0df6fad4186c04c0e4d87ca195c26a31701a7ce54c2a6e28d88f58f8f5d2347422e88d710cddd3f5
-
Filesize
5.2MB
MD55b3cfd0af0e7330ab54bac0cbdce3489
SHA18c42b83e387f01e273a4682017575d67cb2a33b1
SHA256a055f21116051649d2f9398c6ad76d98082bf700f7aa1787c54b8564f673bfda
SHA512ff49140092ba2909b07814947a725070447ca1363b3dca1bebb521f641b1bf61690da7610745213d0c267308973bfedad784df36b247c3f0401ac949d98cfc26
-
Filesize
5.2MB
MD50e32e7e4a811de14e9d770c82ef1e366
SHA1fafea512c1a9a7e52fa1bad8b4c52056540cf824
SHA256a59c7737f7faf0b0aaacb4eb937883f5249a0a41bbba81125e20b073654db115
SHA5125aadde32f0ad52522006aceba81d69d1cf1876f5bc088ec2b0cd211653d3885e41cc22cdf0b43c6a11fac8d866b5cd50b70a8b7d0a15afe70709ea685f7f1a95
-
Filesize
5.2MB
MD5d37872f058bbba812f68dc28635fd474
SHA1562d9a842e4b885da2a7ea8fb4cae70c69f1207b
SHA256ccff470f3ab32320b2d19c51b37bb8b8c19f61dc7cddb6f2ffb5659e74093b48
SHA512f4a3eda9bcb1766836b6d5680eba775da860ca5a489b9f252c86524b0d7eb9d08a644e621358e11a4dd0068925b693fb4447f6230296cb5798f0d0d566d0a1b4
-
Filesize
5.2MB
MD5e172cf2399ea32ededf019d2c13ca21c
SHA1e8aac055a8ce06899660b6d8b5c27cd38a35276a
SHA256591661d257b634053bfe6cb29c8a84baff6f9ec8e358679758246b17b026baf1
SHA5124e704c8e847091302aec58444d2c6c90a77852c9b7a44be5dafdf65d876af96ffb081dc15a20d5564e3c769467282c004c55aab9368d16cbc78335f76411723f
-
Filesize
5.2MB
MD55cdc4183ced6626f7da840ee5e31c1d1
SHA17c9379b081452dc01410dbe216786e56aecc7472
SHA256d1e78ae3f09c77c41156d2a5681969ffadf8e3793c3dce7ba9e244cb9ce512af
SHA5127c7d09553f4f9c03d24cdaa065ba118a9c3d4ffe1ec830872efaa71f9f780f69a3a99dedb536154cec8032758610f19c7dbdbb489c5ee6bbb04530abc018ad65
-
Filesize
5.2MB
MD52784372493171b96023ea72ae0a5b828
SHA1f2f11caef301f851507a860543ed720fce903099
SHA256d4854916134993d9ce0f899beabaf693d2a163959a529f27525e1040123158a7
SHA512569d0072edcc32ec5f55d6fc9b9cfdc0076f0019e8e3b38b7b5f9f8cb396ded48848bc15e106e212644be8f0b5a0692da69d15c82e303f4ef9db5482825b3f38
-
Filesize
5.2MB
MD5f42bbdca4ffb83e9f6b7b1f1ba733921
SHA175eed41db9a2311e8245570e042d4278963d8275
SHA25663156fd87650c2499eded7b05eb752013681b26a8fb447ed9992741a46d06726
SHA5127043894520142a4b00ed1556aece78aa2871ed0ecdf71c5780d9b7670a17ba268e144a75f5da13551f52673a3638e629814435206f3ebbff4734d93cb9ba600f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB