Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 22:03
General
-
Target
2024-09-20_f26b0ee24a5bfbb6ec1ccf10a1827178_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f26b0ee24a5bfbb6ec1ccf10a1827178
-
SHA1
a92155eecc4bf333d443cfe5742388623abfc76e
-
SHA256
10922e6a08be17974f4fe3237c46993df1aaa1f4f9f25cc00efdc4eded4ede55
-
SHA512
c07555718f14e52c9db5c03e9123b009ba81174e494a3bdf08d46e5e8dd17038c2ea6a1002f97452212ac34da20ce130c102937c78c5c6b6116344bc8b03a9f4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_f26b0ee24a5bfbb6ec1ccf10a1827178_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_f26b0ee24a5bfbb6ec1ccf10a1827178_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nwrWEwt.exeC:\Windows\System\nwrWEwt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ujsKvWN.exeC:\Windows\System\ujsKvWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjqaQKB.exeC:\Windows\System\rjqaQKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pozLicT.exeC:\Windows\System\pozLicT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaqrllj.exeC:\Windows\System\xaqrllj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VsbIjch.exeC:\Windows\System\VsbIjch.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TqSInSL.exeC:\Windows\System\TqSInSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePyrJhM.exeC:\Windows\System\ePyrJhM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpJDjIc.exeC:\Windows\System\bpJDjIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ihoqXwx.exeC:\Windows\System\ihoqXwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRJHSWo.exeC:\Windows\System\oRJHSWo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYYWBjN.exeC:\Windows\System\MYYWBjN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bstTEXB.exeC:\Windows\System\bstTEXB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\szotrCI.exeC:\Windows\System\szotrCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JBaPFEa.exeC:\Windows\System\JBaPFEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EaUGfao.exeC:\Windows\System\EaUGfao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HxpfGvF.exeC:\Windows\System\HxpfGvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFXAPRd.exeC:\Windows\System\TFXAPRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICnaoyY.exeC:\Windows\System\ICnaoyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tzeJZhH.exeC:\Windows\System\tzeJZhH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pDFFAus.exeC:\Windows\System\pDFFAus.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c066721e852b5bb96fe9789c4dd970ab
SHA155f88b6c0b40c4934620a7a45b63648bbb740732
SHA2563a33c5a62b3a78cf110650757294783a05a720a20b40556cf2fb458fa8443a84
SHA512a2baa1c015abef7b0b40a72a28e15df9ab6228ca92f65ee06b78940f9443bf51a01cafc50a72dc6d1e2e5c755abdc8ae5277902109a6d22af1dc7441aa9c9640
-
Filesize
5.2MB
MD530d1568573b4a283a4cc73c3dc27cb16
SHA1a1d89d00e10c6001b10dda8efe5faf5da8f63a43
SHA25620a08338e2cdd29836552f1e9b10c6bfaeb2dd82dcd645031d4c66efe8bebba8
SHA512c2d0c2766a7216f221062125677aebf37de2f91c8d8818f4833fd5246848dda2e369a58aefe154d45909728fc350c07333e26bce326a1037024c1261a3c03214
-
Filesize
5.2MB
MD5569fcf2253e02f9c18cbf8e60e56e3db
SHA13dd2d78e98187d0f8257dc71585f75b16f4c265d
SHA2562be5fc0966632a72345c4360ec2977f7610008994b783fa1513f28f783645cae
SHA51210957f53daa62bed2a69f63c6ced9fc5b8a47bbaa05589a5fb38a19090218a759b03694a0e7b65b76ba97e329372cb3ca57a889dd977f3d70c54ab2277abc4dd
-
Filesize
5.2MB
MD58b94c07fae44107bee0627155e5c3f83
SHA1ef43180605511fc20298f540ef55aa35b29f7ecb
SHA25659f05e2f37324c017af633ca20c193ae72ecf9d881b4d7cf981479e2297cc01b
SHA512e20c3b12f8cfc669eb831f8acdbbd2dcf07486a9b1811a95c239d6062a74b2e4c8eae585d2f5282a31c0116684ba760f17de7db78b0267fded6ac4a8fbd36133
-
Filesize
5.2MB
MD55f31198556df96e9d0ae1515b0936c55
SHA1bd086745033d5d49609865a278c1caee44c3af9d
SHA2563b41e801e7a2a860bdc8a6f46994d4aefc47070b63f12b91627eec6edd012736
SHA51218c4e3c95143e1aacca57b0140b420872c728b1f5a1dba775358e99e0908249609f4b4b6f62bd1be663533ab752e6462ec6f88b45fdb0ac359e66d3c350029b6
-
Filesize
5.2MB
MD5648eb5346fa1fa893c473987272bcc5d
SHA14919683132a939b6ce9c74f310e3664a1a200833
SHA2569e09ca65d855f714b0570963f6e9bf493116e31b3c334235da1a85bb2563951b
SHA5123e7574d483a6cbaff04eeb18e02e9ba7a4f0cdc0dfe1e8082a640c9eb601891603b0e3e9cf55339cf69151ce5041768b83e01b89d59aa5a8958fe27323674d1f
-
Filesize
5.2MB
MD5e27e0e24f9401f36a11a221a47236578
SHA1ecca4f9687fc0990fc0f8178ad4644c78b7d0850
SHA256fc521ca287ff8042a97ea3807ca640d499ff238f5760da4f70809861c6bfce4d
SHA512d9ab2dd3a885ed82262a501294d256da12a9276c8daa6f8550bdf03a4cc006a212f00ce209e3d4b008234207a6e5038b000025948f33839852c83a5b0330dfca
-
Filesize
5.2MB
MD5e95369455586fd815cf1ad72e0615750
SHA12941dcf86541eb18ff1dd64045e8777d5dc68b0c
SHA256ad27afcc807e82b1812e33f56c0336b78fd478a84fb86aa935a71676dd7657b1
SHA512fd34c7122815b3591e2eed4e1a357b0f189d6607a0b19c2d360b02427152431ff4c41987ce6428d7015c8fa6347ab8cccaee91ae9c3b28c3421d1831e0d6c609
-
Filesize
5.2MB
MD5fe8d476344b50ced8a3d1c302578c215
SHA1e373a4709d95350a9f12ae66ba7bf39d45c707f6
SHA2561da2f1820b35181d02c09f2a62ba893092f0199f6c3654eada56232852d17b5c
SHA5129075f30b8f2cb0a6685743480ea7253b6216d9ba9970270e6734d8b7e0dbc67dacf47702f37e3c23d2b5a1ae50837437f4e752da1e64f4292dc8712b056d31e6
-
Filesize
5.2MB
MD53cf3143be7dfbab260565d6cbace6fae
SHA17fca68b2da5b37ef7dd4dd0334af2814d30b3e0b
SHA2564eff9fd1f78fb3c603eda83dd9c1941cce9a020c7914b77002aeb69bcc58679d
SHA512339958b5394c1b4d74bfd1001c15de4c83f0319f6f591ba99fbdbff66160b0b77daafa3f3b79327bb42f2362c79f5da87f92422f07db064108d451bfc3365d26
-
Filesize
5.2MB
MD57a4ab540822a6b13daf3e01a05f862f5
SHA1452c740108457a3901d78e3c936dd0e5893ab1e6
SHA256d5009db261af4c00a384d940b7a14d940caef341c28561da618837e3bf5a39f5
SHA512954371f5df99dcd57f7d45c8925f218454cff158666dac2aba7450889f2636c5b7e557c2633792f04054534aa4cf6d44de38c4f7ac6cfd6b41d7e7fa17e72a38
-
Filesize
5.2MB
MD56f8bb69f66b662f2e1ad9148c89ea09c
SHA1519b4995ec6e90bce4ec19591edb7e2b7efd6686
SHA2564b73b51023369d4863f919f75ab8c6f4a082f19b55721befa4e96aaddc7a94ae
SHA512fd5bbab06f107f9bd972c34693665b774ac4a5f900c17f9a6cc3c8847ff4c19eadc5172d9bd4805752f99eddfd6a949a1b2fc7f0550f5c26fa5cd026246aed48
-
Filesize
5.2MB
MD50affdcabb29b3c5221267ece5c6d4807
SHA101916f0914893802381ba8a47efb5c5b70a4fdf5
SHA25682f7750ddd1ad8a4b524c433f17fbe00fe3d64a16052b232c744d72b84c5d31a
SHA5128309686cc34f6ef488083eb16ff69fcd4f93a5f8ed188503031745ea17cfd22cfd0ef8667c84096557e140f0ea50c7128ddaae38a5962d9ecc84484e32aaf96f
-
Filesize
5.2MB
MD529d2bbc0624b1e4c957a75475201d6bc
SHA18d289b9b867daaf6e90fd3f431067adc28a968fc
SHA2560d83610f1fcc4496b9a5c4c500b9f3d61d49e5a813e71c7b16d7c03b7118acd5
SHA512bad2c6c850b1073812052262725c0dafdff43a4cd95a46f62c11a862462e8c441244961888f4210a3b069f570c50f16d854e7a8e3986f6d4a3605adfecd9fe9d
-
Filesize
5.2MB
MD55b8ca4c343a8f3387b0c44551e95ddca
SHA1df16b2969036e41a30af24f409012408dcf1f253
SHA2567ac80a014b19fee618c0ee9ba6b9a97108156023e00b44e8fee2ce6d2bc8e0c2
SHA512673e162e368cdc61569a9c57bd9b4a91e96201088248965a650199acc3b496868adc1a6494b635a2f956a5ac87d28788c4f6cc83dec077ed12eb7b95db2500de
-
Filesize
5.2MB
MD5bb30d48789048ffd38ffe353949c3b5a
SHA1cc241ae5ff8e7f5eaa5ff79a18552a06ec4780f9
SHA2564931db28637c20516f0fcbde534fd91386a1409afd9268113a541580c6aeb206
SHA5127e0e562ec9320ae2fcae917d36552b04beb93be248b5ae3e59075bbd39916ca0d84d2e0ae4318f8101117b104b8307401640ec77743b7f3e5debe2e8da722c76
-
Filesize
5.2MB
MD543fc0e15c11f1ed9bcd7d3879005d789
SHA15fd3d9dbd6502f63c9ff041d9811a8ee74f601fa
SHA256bfe98c697ebeb4251dfc43d8367858705a5a9e6979338c2f2ea1880b9faff6d1
SHA512e6b5f681c5075d017466e50d3692e0a52732da8d1c5f1380915f43c239366ef1065cef6069508b4d6a12c35269773c831d44b5e30fa427066ef1aec0543e81a6
-
Filesize
5.2MB
MD5c940ac0455978f5286f7865da8ef3ce0
SHA14046b55f58eed6cb4782a53fbeea226fd0712343
SHA256fe156904b0078831c11e9a561725c3eec8c51e9ebb896760c33e45cab654ccdb
SHA51205d9e95c84be827ca236a14e1c56a72589e985ba7217d5f49fa89404b9b531eb6a39b745577859fb5f018d1835b0c61e72537faef647c76e59e6b2f341199024
-
Filesize
5.2MB
MD5c3d513ef0b7ee656899eb82a3be78274
SHA1621b5419625949cfafa50fe061af0fee1c4243eb
SHA25679bfce81a22adc94402a1e26377f6ae8a0894444b0f032a3e6f27cdc4fc429fd
SHA51283d8c849f2f7b5128b430b264bc7857aa132e03009ad355b2a5782dcc43ea448c6b0c57205e2e3161776cb817c8e43fe6b7c6eb9983f23731a62c8401df1f211
-
Filesize
5.2MB
MD57337d6171efb7ffa47dbcd7eff5e94ce
SHA1f61751710d419fe6914c6c0e2959dd137633f69b
SHA256ff1240a8bc0c2f0569415e4ce9e85cd237b8fb6df3016b58100a0b995303961a
SHA512267b4d72942c7bcdc11816791c5b77f5008529ccd91fc98ceb7b82b727716891989209275d7b7c6719195cdfd432372f253b013aabf3770eaa1f6278c0e3f43c
-
Filesize
5.2MB
MD5e75dc256a534b871c430c0bde02427b7
SHA12e023571f84f95b2c35cfe0a92dd35fc791477f9
SHA2566390b9b97b1b422d888b0bf3d04baef09960723b5b08319789124316bf9ebfe4
SHA512a9cd2172ce5c7119152f845c73a4886f127d8fd91cd14d0732cf37af484079414bf5b5ae39c4996afddda18ce27c6da8d0394e48af736a4f5d62903a3c98c7f4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB