Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 11:53
General
-
Target
2024-09-20_66ff7b24106ab708197531cbfb9098a1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
66ff7b24106ab708197531cbfb9098a1
-
SHA1
97d82d014a76ecca925e8486a9f8090c7ba27227
-
SHA256
2598501a9a87ecd72466d468c066e6d62572d206ea0669994bd0b92521ba0af6
-
SHA512
793cf0eda7b0a2db3e7bbe7d3bead48b4a868ad062f5c3a3107c4fcc676d073fb2dcf63f6d3b8a70d0b08930ba5bf12c29c1ab22f326cba0a07d9d3f69f35e74
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:T+856utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_66ff7b24106ab708197531cbfb9098a1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_66ff7b24106ab708197531cbfb9098a1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RbCqFaW.exeC:\Windows\System\RbCqFaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQDAoZU.exeC:\Windows\System\dQDAoZU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLrtOWJ.exeC:\Windows\System\SLrtOWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLsvRxr.exeC:\Windows\System\RLsvRxr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NwObOTC.exeC:\Windows\System\NwObOTC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmsykbo.exeC:\Windows\System\kmsykbo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\geuCUVr.exeC:\Windows\System\geuCUVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxZTgRO.exeC:\Windows\System\oxZTgRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQuKVMH.exeC:\Windows\System\EQuKVMH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\llYrYAL.exeC:\Windows\System\llYrYAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akkxpCj.exeC:\Windows\System\akkxpCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKoldBv.exeC:\Windows\System\fKoldBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sCEuZwQ.exeC:\Windows\System\sCEuZwQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jITVBrG.exeC:\Windows\System\jITVBrG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGlrKbE.exeC:\Windows\System\zGlrKbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FaVxyKG.exeC:\Windows\System\FaVxyKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETjoKQG.exeC:\Windows\System\ETjoKQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rkXMDIv.exeC:\Windows\System\rkXMDIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CJGIAxb.exeC:\Windows\System\CJGIAxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IanqmnQ.exeC:\Windows\System\IanqmnQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFUrCGx.exeC:\Windows\System\NFUrCGx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e154c3af65f8383ea0c19a588e569ad3
SHA138ac0aba1d52a98a064eb44bdee1b305f9c1b43a
SHA256b0db2cc9c6d01f942e79f2a6cd65b964d01ddcd0222f070b6149a25c4167310b
SHA512a38a0bec95f8fc333fe373f68b86ae23630ee137cded4d67b87806b9a17898108a91118560aee99733e63521d8c207cd17fab0ba58916e5a375bb66e815ddcbc
-
Filesize
5.9MB
MD5445dde28ef1d432d06bb75c5f3d9c457
SHA1262cc626e7769c9018c766e6dce9dc27e37d32a7
SHA2562a23ab69593a25b5131042f2d7768b421cf9cfb5c4b343bddc3fb1182b1d96e2
SHA512edae63309df4297cce82a0b379cd63d49b82843bb720f8912561f48e77e6dd32e55722b43d1aef78cde71b59e13db4e8afe07b4fd8540d92f735a44d1028c0d4
-
Filesize
5.9MB
MD54b2f3f8ef21096984c75e6e81f254766
SHA1fcec520a1c5b3775fa28367405c5184dacbe3055
SHA2560cb474ab787513bfa81769ba3d237aef3a73f1d032b885e0e395a064cc6bd355
SHA512b0b94a83498b30ba037a103a3a6f0e04d1cf7f59f15106451a5a54b02331f1276ca3656976cdcc86de49afb3fd50edae3b23035271016d88718652d5e63fc162
-
Filesize
5.9MB
MD58af46ca5c1b3cc2696b804b39b0e210a
SHA1692b2c2f4621ca2768b3f2819ab8f4766cce6554
SHA256093b25487a6bd4874ea0a0e81d41579bc99ffcc1d2d11648d8848625cfd10362
SHA5121b4ee98e182f777835f0e3c309eed5922815e7634a698c2f0c3a96b903ea6cbd8a4977c3031f6b8f48faa4e8df990f5005e7ac882210fd5911a2671c14595241
-
Filesize
5.9MB
MD5b88cf5d18534f001b8ed607d21468c71
SHA164d6cccd19a0a87037bfff269075c20fa3d34906
SHA2560ce816af5e3b9abb7a4129603b5910e7cfef2a78a1c64f529a975f331acb7ca4
SHA512e17e815cc439b7512245e6c031e19ad3f1b67fd5b0637607db8a2518ac5c502956a59e8f8724348bbdad1a5433582f3b788ca926983730d53c200ee5af355684
-
Filesize
5.9MB
MD5914e76a333702099a427850da321e2fd
SHA15916c6b382a3c8b35f14c970b1c247e36ba2804a
SHA25695bf75c3a15532baf6cdfa35286aabff074ba0a7a91c599ffdf81cc5379cf92c
SHA5121a5bfe40de5e2a465b91f5be1e0dd797bec6cb791a20f0ddbd19decaf7ed5ae7a78990a1116d9dd3e8167286b2fb926f72a64817c8a3c0328adc59559253da0f
-
Filesize
5.9MB
MD51f37de408134f060f128286957efce6d
SHA1c64dbcbf3febf730f657472c85b08d3856a23aee
SHA2564e1daa171df5a40ebea0390057a9076db3058bb61300a224a91b2e2a0c13632f
SHA512a91b11db96ad6fd3aa3bd8c122e7ad94b5268fe6ead84b1140da66597575a076f9026e3f81936a8d10404f77e39e99d126ba600dabec9eda528d91020742727f
-
Filesize
5.9MB
MD5ac3d8de5a2ae1416b3e66be3767f8047
SHA170d85987ba848b8d4ed527f394a5dd7bb5c5c99a
SHA256598108051f4029529188e04993c1d2f61de28666c801d4e92de7390851f2f825
SHA512c8e174b6d93a755a30ff9900fc7d2a4b3fca81e0daf6ee389c6c5a86d1bd0868e393f9143aefa4ec09a5bc0ed3365ed1e1021b6577681f9b22f0855ed4b5bfbc
-
Filesize
5.9MB
MD5c5f2b65cdb5e1eaa53c60cd26d2dada0
SHA15d3ba5848b1241fc35c85c607dde1ed60e954f60
SHA256959e34ec61b89978c65a16d23e0af489df455b51ee5bee3a4cdb7238c5ae9a10
SHA51237c91a8acf7c88b19aab0d0fc80c6c226f56a91e96e9142f903758a8de287f47e7a1ed276741aae0b67c075c3428f94c507f8c95829483c7355146d68b8ed33c
-
Filesize
5.9MB
MD5281d3f82fd792b2af65372e6074f7b99
SHA16af06f3937da84e0eda2090c335ee02a4a68617a
SHA25625d32c725c7df4b73c3534c6928f74327c8bc48c75d6b5eabe5752cd0eb82510
SHA512c0b51e9cf35a83814f2c5cb4ee7cfda43cc629f6f84836fbea1b0e5ef2ddc1ab9e8d829313a26b99c933807bfcf126b2fb81cca37ad48f579c10309f5eac2067
-
Filesize
5.9MB
MD5f0cf1482ac85e0efa8e4ba5f7f4939b2
SHA1b59ebea9f5d511b0046e527ecf3dfee2f4894d60
SHA256ecf34083fa7dad5054291858e1ff3c34dd32bc44ea1e87bfaf2945b83412229c
SHA5122d33f2baf11caefea20cb6c9b80d22dfd327f8495d85c32da091f62e5b5d637b4412b3c259bb6a44a045f214cdfab9d11bc628135a540d7bedc9e27a633712e0
-
Filesize
5.9MB
MD5996869557037c8e4214194f17f76a60c
SHA10881acf0e947dd98f14db3f356252e9e9891649f
SHA2566815e9cfe6b2dceb825c1b15044a7058d230080239da03d3abb9826f22b75d0c
SHA5122340c02cd1953dd5e84835c3ef4fb056ed8425f4e4137547474565f0a0bc3ee48a0cbec1d5aea36f130cb1826473589e5b353ecc8e84c9db564b2e6fe433fd9b
-
Filesize
5.9MB
MD5827c68ae4327971b8ca22f4b85e83427
SHA14ce0a1266a8328433173419050aba86653d883a1
SHA256d00ae70a3b2b43e42b62856b08bdb19278e5cca8c5bbe5bb049b511c3529c32f
SHA5123d572d835e2319094ee0fac6989064e4f40a684feec774a7520d7f03762c1e707c6710b6229b683752c2fca6fe0ab0f3122e2887b6bc3ac5ca6679faf51000d2
-
Filesize
5.9MB
MD589796d9faa8303b256f09d70acf991be
SHA1fa6045533e11b1a8a60961b3835352e27e786b6e
SHA2568a2693e6d9ae3e0e0b06777cf8165b445279c07e01ed81983376a774197a825c
SHA512c04b42737340f15969eb855ef2917c4356f63d818adeea31a32d31d5c46fe3bf9bd09dd8e077ff08bd281de3f0a3e7810713a9fa77ec3a741c229f4c63c35b89
-
Filesize
5.9MB
MD551d67231735d134f5d8679c2095f9f7b
SHA1a35d1d15b1f7ab96eb6f14a3fb9cd7738e784598
SHA2568eaecb6aef3c466eea74eca5f77470bc7f0fe695e4e87ea9f5fbff75a0054016
SHA5129b0a27e3d5a9ef1aa7480a607b3cc187600d44de3ffdf54d89b496c87c272bdb292bc3fbd5631580e4227fecc992312ef280b5f232843b3f8e31195a2d516ce6
-
Filesize
5.9MB
MD5ac59d313d86861a57398b35e76dab02e
SHA1a7ba45af9ba0d3f820d57bf1d700a3c19b0948ef
SHA2562ec92f555d169698c1726ef06409269b2670e8f3b02e95485be0494ec953e4d3
SHA512ae34522114ccac12ee04c20cb0864932418b5747ce214c8375476e944402b6813380e617e36c4eaced4b464a54b6b1a0ee21e0efed2cf7ac66f8d35f71bc4b40
-
Filesize
5.9MB
MD5a0c631df5532919df548da20226de3af
SHA1cc7177aba7b6445c46e50668538f7e41895620fd
SHA2569487c03ca1df381f65c1e8fef107cf8360f1b2c33552c43961c5e9e00325491e
SHA512a8b665e30f90a905e1c37a8cf57c6c0c63918115d0fde9858101ee63e7f9487dadd6a9be13a894542cd69e28e6c5af45478f6ffb137e80d6a3635e892ee9c915
-
Filesize
5.9MB
MD506103e205e1865c2a9b013cc85d15afd
SHA1505ca172589b33b90266682dd0004d6f91687f51
SHA2568010301c698f46a9e3d6782b1017ae97ca5f6c2c4d50e5b010507ed93beaf0f6
SHA5126ec25ae89739a6327179358c44851f0ffc5a20df388d19888bcf2aec81f86dfcfd76fa01bd63362e4f9cc62a5edd78c767e04bdccda9a580d31cf37056c1071c
-
Filesize
5.9MB
MD542a35e23bfb9f2e0f0280fa3cc14bb10
SHA164de472dbbf4cc501224cbd88f690ce51af0fdf7
SHA256c9a60ba582b611262760fdd79a2c4ef8c54b49c0afa2dff39927c73034a5db85
SHA512f83041dce1effc584b05f659221eb0331d7716eada4203e511f09f65a402abd1ee93c953b98be8cc9c49c062e8cfec57296a14996ce2d63b059bffb174f0e56d
-
Filesize
5.9MB
MD5b8139b17d83d08702687c86200e861b9
SHA10845cc7774623b7807f0bf7b1582b0e93f2f744d
SHA256ef2111a375fffe7302d11ce6807b1b146b9bf38b50e83733d4f6765814ac3c0e
SHA512d338a89f1bfcaa1e8c99ce73efbc4385d37aa6df9fed1ec936d2f7928f2ca074eff4b26fb6f2efbef228972c3e432679a2b6291e847bc22a4393e8c4d7eebec7
-
Filesize
5.9MB
MD5236386450de66fe9a9bb1a3a9ba2953b
SHA12d1fe817cdbc3ef106b07ad07404c4946a6ff363
SHA2560ef1a187c6fe70c02831b6f974b501a654a20ae3b170704dd81d00b26d4932c4
SHA5128d7ddfa97e8fdfa113f27241aab3612edb9d0a780b3e35e5c7689640d9386e6fbe309cdc4bced92afb43cf65aba28d39459fa8012172b90c4ba92dcef2f7d91d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB