Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 11:54
General
-
Target
2024-09-20_6f1fdf49960393610b5282359ed112b6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6f1fdf49960393610b5282359ed112b6
-
SHA1
e07528f88d859c54a7649e3f7e81dc0b8ba4ff82
-
SHA256
78a9f6a986f8128360441ab0efedce232fda5855a17e114062d65d5daa62df7b
-
SHA512
0abe4e0e3b0df2ef3ae871c396c6080df845daf5bca4ab42944561d3cd4862ae816d502a70bd8c9dedfe73678caa2a1dfa4e2af0b4e7758bdad46823d41a618e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_6f1fdf49960393610b5282359ed112b6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_6f1fdf49960393610b5282359ed112b6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ezGmlFR.exeC:\Windows\System\ezGmlFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMVSAbK.exeC:\Windows\System\ZMVSAbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rBUuCOj.exeC:\Windows\System\rBUuCOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOwYdgE.exeC:\Windows\System\hOwYdgE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huVEEmd.exeC:\Windows\System\huVEEmd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpslZNz.exeC:\Windows\System\rpslZNz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGtBgUV.exeC:\Windows\System\AGtBgUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXgcVHW.exeC:\Windows\System\wXgcVHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjsMinI.exeC:\Windows\System\jjsMinI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaNHSxi.exeC:\Windows\System\oaNHSxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aUXsLce.exeC:\Windows\System\aUXsLce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMkPXxT.exeC:\Windows\System\iMkPXxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFuhgnT.exeC:\Windows\System\wFuhgnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDCeXvd.exeC:\Windows\System\CDCeXvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCqyyLX.exeC:\Windows\System\uCqyyLX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bIYStQG.exeC:\Windows\System\bIYStQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxONuqD.exeC:\Windows\System\mxONuqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvFDdrp.exeC:\Windows\System\UvFDdrp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipIokZr.exeC:\Windows\System\ipIokZr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOXiOdu.exeC:\Windows\System\yOXiOdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kCknteA.exeC:\Windows\System\kCknteA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5589241115bd25826c9b529ea45077327
SHA155d76fcd70a76cc988d8cf28d34318e8d7d542ec
SHA256d367226655f0b7d5a7a751be11d0af020430ece8406cd68254ad7883b7760885
SHA512c2122151ea4d36a5c579bbf8d1ad1832d7ba3766b9f9ed1110dc971ab84ea5f0e9317b170f1c0ded35c78a37972afe14cac517546f4ebbf66ed715d1c01f716c
-
Filesize
5.2MB
MD5b5ab953876bc7630866f5ee9e63c197b
SHA1edbfb3d001abf8828a20fba1c344fbb634a49303
SHA2568656cef7bd5486e80b8ef25dd197385bc992c90e5b6d8872b236002c1188fb35
SHA5127f844d6e0ba85c01c4158453671fa365029de184bac0119dd42ba60e66c1c91f220cadb738b18579961b519b3ab2178ee29e29b639325ba5caa76fb7cfe4335f
-
Filesize
5.2MB
MD518ed5399a168d785a0666283b2308652
SHA1f6f64eca0e190e88e31acf3050813e767a608d27
SHA256cc2657ea3a8671ee13e8ea1f1808b7501bdd02945f2a3f33bc4765723ecb023a
SHA51292bb745af5fe0881b60806fecc42e0f106a05731f48d0c367f637cb6a25dc9530dc44f2d2f5519fd6212cd3a8287fa81f0c6da06cdb105627fef73a43d605820
-
Filesize
5.2MB
MD53a4d706933b4fc79c8372d8434d92113
SHA190c055c514386da78d87a88c91706333c451911c
SHA256800e5eea7c0e593bcd9eda25b1fc1d57760b880f303d177861f3c7f8bd941173
SHA512bddc98dfa10714fc32f33ec5262a5d9f2ddc7d65f305d4886ee1e26aa0af082847cf18a7a55b5dbe5aaa10a0b35ffebb119b588fc8daf93117d3cd34b39cfd2c
-
Filesize
5.2MB
MD56645f19e9a0dc38d1aa08c025ebb38da
SHA17a9d3e4215d7f0900cdd1a3022a6cfa5cd877dfb
SHA256712a3a21ad1bcc317613b439259c279d79ab50b757c09cd7bb1ecd24c769bcc7
SHA512676dedee08d4cfd4bdb7e231fd54c17b9899e824d3f949ef9b5914885e71b49c27acb872d37fb0d45907e3b11f3398498c9b95c152f138cefa5fa49436431290
-
Filesize
5.2MB
MD575132c66845dd56da4f470b5b6e4e2ba
SHA147b5c6353ec8d98be86a821b4e65f5f82a1adb5d
SHA256726f7ab6cdcfcd807c2e4ee00a61a880bd25f04d7f3af54c770f47e3f76188bc
SHA5120816dfdc976603a661ddf147597f0b0e3024df8f4a23ebbaf15e18cd62b239bc458304110543ff8d4eeda5654a12fca3b9ab1aee754631da6990a061176dec96
-
Filesize
5.2MB
MD579d02357ee79f29d82517c4f993bf638
SHA1000e001fe5cd856e953348967068a653bdfa8d22
SHA256a94c1a446a62d5058f71163816cd4566fe91ec30c66c020c4c7258aa9065b247
SHA512d1076b71d8d25b2b1ba2b6d3500e3595cde12a5cf384b1cfc1542d328053024a8086a74fab8ed6aa16e32ece300c8f78eea466140a2049d6375cca6254d8b329
-
Filesize
5.2MB
MD5a36a9f24232dcbcf9f09f99e92cae77c
SHA10d3be8c9498d320e88774ccf1b2aed3e81601e42
SHA25632eb67c4f556ce739c2f8a5313f3b6776584ed9a4b5c15429eb3ccfbee498286
SHA51279bb1c55a6289c8cc1276543e7feac2f92ff5c6802b3239fdbeae3465688b67e6b95c80c10c548fce4f06f312ca4beccb03c139ce222f1aa18006252296dd6d5
-
Filesize
5.2MB
MD5d9c18ed1021d5d5cce02f14606328dc2
SHA1907e4e360b8313b2b8895e04dea0cc3c4b9eb9f8
SHA25657cc0efce2c4709c6d8de691a0bb4ebc6886c457db263f43abccd529e5236e9b
SHA5128bf372cd0106842270a0a36ec8a084eda5a372b5bbdf1fa138df5883bb22f160b9cc172a91019701ec23ad823462a8c267fce5f1c77d9d46e50676bba75b2c2f
-
Filesize
5.2MB
MD599d2a1baddb5f9c4db3bf730319df443
SHA15fe1df1e16748e293cda8859305786078f56ac72
SHA256f91396378e30e1aaeb59e368567432b4915af306c7b7ef97d24d2f3f93d83623
SHA5123a259ccaac9538f15f900a0749e2af4d2a89ede637217ba7a95df66b7362cc20718f3c7aac099efd4e1ddf491cafa5b7da56beedbf6347350c6ffc3a6845c6c5
-
Filesize
5.2MB
MD57015a8d8b1e9a7caba0213248e1a9422
SHA1dbc83df76fd57b20ae21fca23b9ccaa28a809fc1
SHA2564e9da205e6e686875c36d066559aae2c1f00476692288dcf59831b2339544299
SHA512c64d2709e9983fcdfef8cd9746c6c65f716af747453b798167fca50cf3a152093ea48679e84eac9a3edc8b3cd3f7b899f594c9df70a368a46924c7c7a280a618
-
Filesize
5.2MB
MD5897226bd449bf6f6ef751443dca776e2
SHA1504c73c3db9c6302d05a14379070f40cac26275f
SHA256cf5dea2d0d1725c58d39d37123aadc89b6eac67b7a5f991fb36f62310160d209
SHA512063a547fbcacddeeaca1f4e0eff71b1556794856b8c898750f76ab3b54c6811d48758a628e49fc15e64788aaf7efe456457cec8d01da502cae2733bb2cd08d08
-
Filesize
5.2MB
MD5a2af771a0465043132be1e0ec8e77c38
SHA18024c6ba6df22341d4a93563e597cba7db25325b
SHA25685e1b829f2c796e585235c247d32d25e47d0594133eb7bb57562bef4e7170f77
SHA51280f0446755cb4c8e082b9961843c3003717e2914165af0951bfb7b6d0b7636b3131f0e72ad2d19b3e4d419b57aa2725118b629dfeb0d5d3eed5e586cbfdbba1a
-
Filesize
5.2MB
MD53919bebb5263a2e8346026998eb1dae0
SHA1757d9fd8c515184f156385a7641708a3fb0490cc
SHA2565d9863ab5f0b30a71a82c2067a6fd10743df5ed0e6eae2ce9838b4baf02ae226
SHA5124c0c8d673f1731ecad4af7586ac04deed17dbced9a43a6ce4201b60f8b55bcb645a72cd9fd295af468c640e49a3ce3ccf5e8017add15b18b10177937320e48e8
-
Filesize
5.2MB
MD5822a69435a5d9dba84efb527d1a5198e
SHA1f7fdce3decf747d106057c7bb30844d170524533
SHA256a2a0ba439ef168d14fce1c928cd21fe3ed832c5d646703dd9cd0393b587086f7
SHA512738065acfd5782e1be66372b39deb7c0157ef8ef6eb1536a22f482eb7811377d442abc3a1dbc824cffa777fa925e4e25fb32d4985c589a108b86be9e5cec9357
-
Filesize
5.2MB
MD58bfc879136a5de35ab978da4ed9fbfff
SHA1b1fa8418ab6416c9c464f4b911b27d7a7f667b9f
SHA2569d805925e57a5e29184f511319a7430541982d6545bd7dc253ff8e8b0a3229b2
SHA512c65d1e89a120856476df842c0d46d71e5788fc32def58e4d7923e1ff8e147ea1a60e069c4f66bb61481240c8dedc85a646b77c259e9a95bb3559cfbc4ab4c29e
-
Filesize
5.2MB
MD52735ea230ca38fcad433e2a1ffc87e82
SHA1bb627312dd0bf097a43c587542cdf9ff7affa55b
SHA256e2f15172c1aeffa1751d4e13532daf4e21d9653e24668d48b6cf7519d99f98f7
SHA5124592dd617afc62bd9bca13d0a97e2e19de2067ee4f0e30dd9f44f1676ef8200b3e1e1731e9bd9e7c0d3a7cdd0ff781be9425969fc29da14c481ed56db6fb7454
-
Filesize
5.2MB
MD544d26e4273693fff4529076929b339f6
SHA1d8435bc185b3a95458776db88f65894e8ad995b8
SHA256fea81c48a11bc690898fd44860c91f5085f9170ba8c27048c0f7f5badfc9cc40
SHA512871a6b63f4b996851ebe5618839de261e65a772eb48987fb41a76e2f33ec14c0b60049e1377a4174d87cf91193a5bfd5f7f252ee31f71605c3eeb85580ab0a1d
-
Filesize
5.2MB
MD53171363b43e2635d143d5b04639e80d6
SHA1ca6e78f6cad5a454f9cd10a423fb3860ec66dcb7
SHA25698053fc301121c4debffbf36e930232930f7159cd8de7b1aa011d737f39d0dd5
SHA51271861f17c2152034b9a141f3bd980d6d631a359a7dc7d3ca139a48edcafcd696195a7ca795736bb77be235059a14202b33895d5cf930b487f9a78a2a49388601
-
Filesize
5.2MB
MD5ef68791fcb9ae5428b30881a4a9af54a
SHA121b1f3314f466aade2cd5f6445ec7b34a044f04e
SHA256fb0a8919830bdd279161906b978bc3dd57dd7d44345cc78e727b81c4f2b3efc4
SHA512d25ffc9f801ae3597469e52a92887051ff69925b0fbdfff908239408f02feb1ac52b49a66c3e159e8c346d70593a3b919fcae72f136b28a1e2664244d8f05b2d
-
Filesize
5.2MB
MD56727fea54586713d3b5bb77d655ed772
SHA15c4cc9d1d8871577c2da4fa509d8f15cd0f9a5b6
SHA2566000c435a65ef4c6a6e16d79f2eec54901e7781d0568f9afb41a0ab516b272c1
SHA5129070b97248a74d0ca16974af5c2e26c32ed63193749e235764b66a495db53d62f0a4f390ca16c878b2e3a4aae14e3a03b55427092a5815b07a0b10cd71be2e15
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB