Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 09:32

General

  • Target

    2024-09-20_a700bbaa4de92affddca78875f9fa91c_cobalt-strike_cobaltstrike_poet-rat_snatch.exe

  • Size

    4.9MB

  • MD5

    a700bbaa4de92affddca78875f9fa91c

  • SHA1

    216ae661f98aec68fc159e1734ecdefb340024ed

  • SHA256

    c831e08b51f3e15dac15c47d86ae4c900be1c94418af01b2479e5d162323cb69

  • SHA512

    e8a3727c365ddfdbfa4d8666a06433f03e6e66e0781ddde12a9e91a1d3b807c388483f920362231205598d834740ae6828bb0b079c18aca0c806174774b16a5e

  • SSDEEP

    49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnt:r56utgpPFotBER/mQ32lU/

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-20_a700bbaa4de92affddca78875f9fa91c_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-20_a700bbaa4de92affddca78875f9fa91c_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    PID:2124

Network

  • flag-us
    DNS
    s3.us-east-2.amazonaws.com
    2024-09-20_a700bbaa4de92affddca78875f9fa91c_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
    Remote address:
    8.8.8.8:53
    Request
    s3.us-east-2.amazonaws.com
    IN A
    Response
    s3.us-east-2.amazonaws.com
    IN A
    52.219.111.17
    s3.us-east-2.amazonaws.com
    IN A
    52.219.88.51
    s3.us-east-2.amazonaws.com
    IN A
    52.219.232.161
    s3.us-east-2.amazonaws.com
    IN A
    52.219.105.137
    s3.us-east-2.amazonaws.com
    IN A
    52.219.178.121
    s3.us-east-2.amazonaws.com
    IN A
    3.5.132.197
    s3.us-east-2.amazonaws.com
    IN A
    3.5.128.200
    s3.us-east-2.amazonaws.com
    IN A
    16.12.65.105
  • 52.219.111.17:443
    s3.us-east-2.amazonaws.com
    tls
    2024-09-20_a700bbaa4de92affddca78875f9fa91c_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
    1.2kB
    7.8kB
    15
    18
  • 8.8.8.8:53
    s3.us-east-2.amazonaws.com
    dns
    2024-09-20_a700bbaa4de92affddca78875f9fa91c_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
    72 B
    200 B
    1
    1

    DNS Request

    s3.us-east-2.amazonaws.com

    DNS Response

    52.219.111.17
    52.219.88.51
    52.219.232.161
    52.219.105.137
    52.219.178.121
    3.5.132.197
    3.5.128.200
    16.12.65.105

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1cf4d536d6c4a1abaf425af1c9a9f1d3

    SHA1

    65226ae1bd0fd2744cf453f7fffbe3895b7884d0

    SHA256

    d5bd4a6369802a15348021f42acbf4be2efd73921cec2ba067b20d0e1e2854f6

    SHA512

    cec605cef4c1400f02ad9748c8f3b4d3aeddd125e1bb4f06805cea1ca2a68daa24a88af2b90eeb58ddfcd853d1f7509de5295923483be413798115895ea4ca67

  • C:\Users\Admin\AppData\Local\Temp\Cab2510.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2532.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.