Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14-09-2024 06:49
General
-
Target
2024-09-14_86e69bf65f6cd12fb54798aea834b5a9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
86e69bf65f6cd12fb54798aea834b5a9
-
SHA1
0f476380d085b5bd0cd812c76964ed54c88c710e
-
SHA256
8828ed367c372c4f530abed7e2185a6ad4da54e4d5a2e886a58bf0236ac046e2
-
SHA512
33047b218bae569da56480f3212cc95887afd6fdb5f5a860be6bbae7cff2265d5fc5d8d6fd3c65d0b0c51cdb433a30e57b5c92d48e901256519e52c6fba72403
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_86e69bf65f6cd12fb54798aea834b5a9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_86e69bf65f6cd12fb54798aea834b5a9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LbLzVbh.exeC:\Windows\System\LbLzVbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RXVHVWo.exeC:\Windows\System\RXVHVWo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xjdfesN.exeC:\Windows\System\xjdfesN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQDLtoM.exeC:\Windows\System\XQDLtoM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHZmhiz.exeC:\Windows\System\GHZmhiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PdTUXfZ.exeC:\Windows\System\PdTUXfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GVDbGzt.exeC:\Windows\System\GVDbGzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jOZteHI.exeC:\Windows\System\jOZteHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULMAtVa.exeC:\Windows\System\ULMAtVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOwaapx.exeC:\Windows\System\wOwaapx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huXCwFO.exeC:\Windows\System\huXCwFO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgLyiZK.exeC:\Windows\System\wgLyiZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GFtmocn.exeC:\Windows\System\GFtmocn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KsTUlZV.exeC:\Windows\System\KsTUlZV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNJkbiH.exeC:\Windows\System\SNJkbiH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuMZWEe.exeC:\Windows\System\BuMZWEe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\facSJWc.exeC:\Windows\System\facSJWc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lydZjMx.exeC:\Windows\System\lydZjMx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGHIDZu.exeC:\Windows\System\eGHIDZu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFecNPz.exeC:\Windows\System\gFecNPz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kEabHpY.exeC:\Windows\System\kEabHpY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5151010fdcbe2a0009f464e152e4c0a26
SHA18ea498158366e87e2cc74d046bd5edacdea35fc2
SHA25667ea1b6c702b5af04bd00130a0ee87f682c1cb1b5a5bf4c19d178dc7851813d0
SHA5123831afbb781ce5cef8aadc88b45636d43b61e839d72fe0dd2f34a9bd89f8ed1c0bde088c8cd766b7e8073ef630ce809cae67918bb69aa7cac042ed0b23cf988c
-
Filesize
5.2MB
MD5b0e1c14c8628476f32c61359c4ad0188
SHA188b073e0d3c19ed19b407103c8fe716457ddb7e4
SHA256a0955e448a27f4e1bbb765e9e8cec032c40e846739b8ea77b8e88ecfe8763df2
SHA51267400c6b50aa1c6f07f3965f5f5e440a02d46c3d79167cb5dbec041eb04ebc7c1f407cd97a3e92a78b78d92bb9a92053d02e20a0524507d193945a924a51dbec
-
Filesize
5.2MB
MD578adea93ca36120f433f52a8df52a131
SHA1f5f6d94c2e8d3967f2d3582015e7c90e6c331493
SHA256cdf95cde13f193afd9ce02d1f1ecedd9a2aea7bae5d0fe8adb3dbb470bd01c5a
SHA512c1d6d32f657de2af53a75ff87598653c20a7ad542a22289a95594cebbc7101fa551277a10e23a9b39dd216ee05a320ca649688a77b970e73d2cae7dc66221260
-
Filesize
5.2MB
MD516e8b3997f801a5c30d03042b6a6429a
SHA18718b6c26a7a6ece7a8211f37158dbafde1f2ed4
SHA2561a34bb7d0fab841c4d2603c1322ec2197c0bfd9f275e7e9c73d1ad31942508bf
SHA5123c41a4205292b4b0899b14477bac83e150a83f6cddde2b7e6ff06c5f1b156c341403ded84835b08094ddbb627e37315129db409afeceb8e7db3ec4d46f36c44e
-
Filesize
5.2MB
MD59a37c613490b4f770e15f020e655b64d
SHA1a138863d2d60c9d955fc6b27928f8797eab02295
SHA2569412bf393e6c9315aa73938608c8819d6d7ee4da4203844394e2a9420ea34f88
SHA51210bec7b1ae4e6e6d0ca436120bb1c620b584e5f7487fefeac642d0deb4cfe50d5ee5695b08a36b6efda85055e4a686de93e0ade9295fe9de205f6244fe6fb4ee
-
Filesize
5.2MB
MD516aadaa46e536a05bb9ea7b49be56c04
SHA1fcba3bdd7ff8a2c7402cec02ff94c50e0b4ed7b7
SHA2566174484f427f55208e692d6739f2e44961cc04aa6569f7a73ff4844dac461395
SHA512c6c7db3926b40d4acf9b9fbe57fdcdf4c143c32c13935e0fcf9af114a24521eec7ce3525897077444d89646c471305e86dcc79e14a66e0e54ad40d0e426bdade
-
Filesize
5.2MB
MD51b30df8651d4e328f21a5a813975a479
SHA1fe079d55ba2ed9ede0f3fed314515f1e25296559
SHA25692b2c50f818164d3b2d87b6b943f0e5418dc5c1538fcbdc1053c7617e612cc0a
SHA512a7856a77de7435aa24b6303187bc8eae691619a39eac0bdd7f43dc9c5672344a839f32a546af36a0b1f1882f05f3256c0584fb53fee29d282abb9c1932dd7e9b
-
Filesize
5.2MB
MD56ac77bf9405225ce630432d10e650f2f
SHA133f1e2630e5d50152a29ab5aa989284c0be0cfcc
SHA256c37af6d47f3d50d4f4a063a631d5f258f62de7ade4e844d1941365213ad60346
SHA5122ba9d4bd6ecf47971fab4069f760aa904ee0182aaf3f1b0535476629bb8e9ec92bc07eb0a45f2c84e1c5355029fe31a3b1e95ad232dc7991c8d29fd3a74f75b4
-
Filesize
5.2MB
MD5d97ad7b36c07a7041f5d2e131e03f100
SHA1441ed83820ad06dd85d26736365efe27128a9bd1
SHA256d68801984670a086a06e468846226c18362ddc73ce706a79ef6342f81738a1ac
SHA512af83363f02e0a449cfe26ee85307911a11d844a19629ddb39b532d7e2faca9d7b34b1edd0435a4177da1de5341fbdcc8454c613f09e1f7729b380449aaac55e0
-
Filesize
5.2MB
MD51d475f7c0053ecb4c6daf2ddcff214ca
SHA1b11fef3a1a06c8534076a16052f3c09761d260dd
SHA25693a827d9904bcf4f98d9233f48f8337e66b859532b3b9201245d953088e5038b
SHA512136dd0bacf381b2fcaea9f854d7da2506275c116ca5bbfcd85995504ed5addffe987473a054e3540e14d603c05bf1fdfa57c28a7891d1b1d69adad68240b2eb4
-
Filesize
5.2MB
MD5828b7f614e324053dc9ac1b2daa2c610
SHA1c0a2c58d1d9fbd943c1eb639c51dc9a295cdbb06
SHA256e66fe728a0ca7f5fea91bcfe5f18f87139071ce9626864a51f79709540c0a5bc
SHA512600f710f15c61d30ad29efea8c71cf897ea01941ea3a8fc64efb5c71d9dae4d86fb2824fdf6ef2ff4eba91252b45a42a07d963471201f16599e368159bb35d50
-
Filesize
5.2MB
MD5b56df23d705937710bf07e3b54ecf7b5
SHA1b89dac5a98d357b8055ca7cfc467bf55c025b330
SHA256b4ad61f65f9c35b98e46af0910b33ef2b6dea96d38a18814243eab9a4ef84839
SHA5124268c5faffee1a671178fc5c435a9ede20f9530ecbe47947b0bafbc4051e37e6ff5d6743aaaa17735091d81ebf46c05e0dd8fc2473e4ef1b1d001e077325e214
-
Filesize
5.2MB
MD5aae13a459f823675666cab069bf68d4e
SHA1ff325941e0a67b5351d8712eaff16cde7abcbbea
SHA25640ae61c756b4f759825fb2ddb79506071b86ada12011d5f4c89f90b44357e403
SHA512919c1f52eaf4faf74e16787747808e84d3ed192388eef54715a205b6ccbd389038a8823395500491672891fadb09ff03d3e97eed8a6994894a1c30d7fe5fd2a2
-
Filesize
5.2MB
MD5ef2e2b0823b0aec17ea6e0e9e582122e
SHA1248425cdf6163c9f1ce6d90fd8688293323fbe5f
SHA2569c99baafe399a0077db3a45feeefe16724732161c45f6d793e8fad7ce4b89389
SHA512d84ccd79011dfff3c0eb06784516b41aae23d54bf7a0721d280bb70c8e96230052a06149b1b28f78c4672c43347511469e7077568bf409076931c58c44272e70
-
Filesize
5.2MB
MD593d83e66c58c6e34a03a34915bcaefa4
SHA1781c2ee92e6943eff06be932aadccc1f075171f0
SHA256e3bd6fa2626d52b8b89fad8000f86905ab9c9c9409f4dc3b50bba453df36e210
SHA5120c0243dd0c77558f38bcb011aff2731c75af6b8831d1d56c7c0d10e750a94731da2e5ea0dce102c31abc0bb85f4d700acabd426c4cc462277d1a53072c2aba91
-
Filesize
5.2MB
MD56322570e88d092f70bc4d7b72390477a
SHA157081efb92966135940e8725a617b4584d2642ad
SHA256b38436641b740caaba4832eb337884d526d61a00e3bf9d1eda1d7a0cb3b22863
SHA5122e1d31515d494bb5815cc8310decaf5563e4d9417be1d7d37189638087ef8838dc2ebbcd1f3b22e0f5404888869e961bfcda8b27638e523904e89ecaae0a24c7
-
Filesize
5.2MB
MD558b29a0feeae9b94e8b284c0ae599542
SHA1190cdd999ef56b2d65a2b6cc11d04af7a5809a5c
SHA256a321f82c795ec482906cc9e19624d9708e9411e3544deda9bf320f10cf8071a9
SHA5121e8848d139959cb250fa11beee6b2f5dbd82b8a8e58ae4d6f206b5e32e3ebf5094d5bc849747503c50783393103ee84bacee420be87f1ed9d6f9b038103ce5e2
-
Filesize
5.2MB
MD565ce6305eba94a3018104e9a1bbd3b6b
SHA1eea7f4ca26707b509348e698e1165613c29bfa6a
SHA256b3c89c06b8082046b7fb1d6159c486b7a1e456e66a623fd8f1a5f6c16d943b95
SHA512a9b50a120eab47231cde0411c5ee54a1cd56763bc15ffe850d9ced083e9817ee9a598095b74629ecdd8e794ec748614c7d0420cd700c2b8da7fc59bbb5c2b76b
-
Filesize
5.2MB
MD571d6f56f4292221b8c37922b26f9977e
SHA1af004fa7b74bad7d4a605722df6bd98cef127a7c
SHA256a4382b07f46a2a24a1d24da5f861d7c17b982b13a033557700cb36d0595f8477
SHA51271c52d58a5188d672677f0a2aa346e2a3c49fc5054742603229b285a95cd83f44bbcc9d59dbdd3dfdbefdc239ef65f7f301c4952d9ee2c137ba9468ea92084c8
-
Filesize
5.2MB
MD52291b5a7e3e15740c8ffe22942573fca
SHA1f20a33a5d299ac913dfdcf80a9c636156d9194ec
SHA256b2d34fe691ce7f5316e95299b255ec72641c356840f9265356bd2dfd68d9db5f
SHA5123e3d6e280ce2624995a1fcd3d4d1aaad9b5538e7301b1afa1cdb4e55ffe8b37cce5c899eea40c72aa3c77724d8f0b4ab5ba53462a6981760462dec0374f52ad7
-
Filesize
5.2MB
MD5d017018c133d6e815d728cf27438af96
SHA1c1d2b04529910b74354c1c44142dc6ee59d594e2
SHA256bfdccb42a03f040652b7d8cb1362b9d989d6ebe3ad7d41c919a71122cc92a58a
SHA512128c97b5dffd4505067eb1b2f6d2fcc89ca1a1d80c6d2f858fd1593498681527d43e5c0f17df484251b07df4c0e05f866dff4b62fba8c06e33320e6da6fe2416
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB