Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-09-2024 15:42
General
-
Target
2024-09-20_e32e6111edbb32968583b1b59aa64fb2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e32e6111edbb32968583b1b59aa64fb2
-
SHA1
474e27971159b9b3db8e85b72c274bdb5bcb5e00
-
SHA256
ccba67d963a51395ebdf14219d79654dc29ef6fe3004ab88c25a14e8061f8afa
-
SHA512
dead3c392dac57ddc4a8e44093bc441a5c0a135778b32df9b3f1b5b73852a71207c7a6d18751b5411c3192fa2cce7cb484e95fecd58a10598639f159476b9e95
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_e32e6111edbb32968583b1b59aa64fb2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_e32e6111edbb32968583b1b59aa64fb2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VcSoHsJ.exeC:\Windows\System\VcSoHsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zbIdBEr.exeC:\Windows\System\zbIdBEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AjMLBcz.exeC:\Windows\System\AjMLBcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNkgDBh.exeC:\Windows\System\yNkgDBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SBKDpnF.exeC:\Windows\System\SBKDpnF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFEcenU.exeC:\Windows\System\bFEcenU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JAkuYJY.exeC:\Windows\System\JAkuYJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EMJnCES.exeC:\Windows\System\EMJnCES.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QAwWkrE.exeC:\Windows\System\QAwWkrE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGEXRSG.exeC:\Windows\System\QGEXRSG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YhhlpVm.exeC:\Windows\System\YhhlpVm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ielTaHn.exeC:\Windows\System\ielTaHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BNzjSWy.exeC:\Windows\System\BNzjSWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJaokbB.exeC:\Windows\System\aJaokbB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AOxjSkT.exeC:\Windows\System\AOxjSkT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOajwqb.exeC:\Windows\System\nOajwqb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\myswdAq.exeC:\Windows\System\myswdAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTfLxcu.exeC:\Windows\System\fTfLxcu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obpxlpd.exeC:\Windows\System\obpxlpd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrGnVsl.exeC:\Windows\System\OrGnVsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYgqrsf.exeC:\Windows\System\OYgqrsf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD510b14638a8899b643a201fa1959d15c6
SHA1cadfd66f0273d25ed32a6cc8d2185a9843b1a9fe
SHA256daab582853630c8ec55b87c0171e1f31ec80cd8d1e9490886e0e2ac63e778807
SHA5128afab6f274197fe6fd9112fe2f30ffe05cd9016c0d71433a284942ec2a38a67574020e01288eb4e55080ad5462820cd97deac9607454e197342cfbafcc382e05
-
Filesize
5.2MB
MD57131e6a41323a0a473230d4ea5d05dd5
SHA1fdcc63e7e257aa00f8c4820b16dd5fd96ed37aa1
SHA2565a74c69cd362d234396e89c9ebe9a0e764c004688bbf0b8b9af2bf46591380fd
SHA5128e61e02291293e3d8ec0fe2368a5e0273c5b3657720f659286835ad963f956110c69e062d266d09ba10ddc7e7e48e1129f01fe4b590be27e2f943fbe976145f0
-
Filesize
5.2MB
MD5f20453f760ca124134f1d9c07966bf05
SHA145062caa83b76e8a530eb4ea0c7f00bc185444a5
SHA256078634b4bba0fefd778f6c874edb1484fe89bdfd78bd53e7e2b43e979c935b3e
SHA5127681b6c37674f2ce09dce5d58a98be0e2717f6e97831533b90cb2f1b64cd98159a7b13bf9763697a8b151fe6de9473db7b25b60371e704fa82115627b9584a56
-
Filesize
5.2MB
MD546f6f76aa34529a2dabf2134ca68fcf6
SHA1e7b2e6130200ea37a45b342fcc999c8297be78bd
SHA25685e6af13d8a11713412b85e82a1af3425d00dec770c2ff829f2ebc0da625b4e7
SHA512a0dca458efce79e6bd2a692e83bba00fb8d722598438391d4acb0140e8875bf21284447667b01241c28d3d0a119a4301aee5007136e7008bd208724e9979888e
-
Filesize
5.2MB
MD568e906da667ae0fc229a559a5971632a
SHA1eb8f8295567e502cd411cf2167d2e03ef271e458
SHA2567c085793a5f4ccb972e230d5b8406e3f2cb034ede14f18ba486c160dae828c48
SHA51237db3c768a7081aa4148fda21bed1b25be8c7d897e5957c361627a92629d061df719657017896fbf441ebaee9e2378065c2068f1357119fd2710a4bef60c6c33
-
Filesize
5.2MB
MD59aad69412a6b5c3199fe65f17108e73e
SHA183bd58612824ace30bb10dbceb1b7ebd48d29108
SHA256303b8b4f9d0441f88d6313f30ab026f2b1367735202e818afb52d58a0320c7fc
SHA512cbb29222543734e492d4e71bc60eefc8500dbd0cc6b0a766047c9f9e96f5e2990370e6241680f9bb56cdd4e3ef16fbd73811a5a05ad844de09f4adba22744e1b
-
Filesize
5.2MB
MD5b335d764ea7ffba0b85457ba21dc292f
SHA1a1c5055c09b53138ba7478c27430261bdef536c8
SHA256252dd2e7b273346407d83d92c5cd7c9d7dc4a77a6496130357f10962bd5c95bc
SHA5125e28634246223da75afdf1587e4690ad0ff2cbb62b3f51cac050dbecf85d8ef897dd180ecb8f00a486acbb549959d76c0fa241c8ae3148df1d52f8df5d4756a6
-
Filesize
5.2MB
MD5610ac86356c4f7fa17f9590cd90e5d51
SHA11f175ae5385a56301d6e554eab845e5727d068e3
SHA256de970dc0ae5df5a9656c5540edea4dabd255f6b99368944b1b31fb52c8bef0f8
SHA512d8e703d00b25abe1456b8ac780cd0b13468a93877d7c296358248a852f30202aefde7a9c9522744eaf907eb7092f9fef8b97003f4f67fea4211e31243bb52f8a
-
Filesize
5.2MB
MD53cc9e4634821080921b5a10adc826c7e
SHA1b3f57c42ea0d0e157229facd8ffa0b5ccb46f93e
SHA256906b83bd005968bca89fead0209251d330c263d1a4815689b45fdf3e4318e5f4
SHA512413a6cff54366815bb209a02e7cd7b07ccdb40b4fa27b79ff4908688a8dd1fcc02cb38332144c9c89be7cd35f769e1f887573748792fc2178301a7d17e68d19f
-
Filesize
5.2MB
MD54dd089209e36fffa887a65df95de7699
SHA11ac5a92a81f1e220c05675d811bc0464ad1680e4
SHA256f032aaf7d63b1f17071d91df876a8d587aab5bff2c2af31a84689399ac4222ff
SHA5122d0a1cbef0ad63aa94fef79c84074bd19bebba3c575e435a12e0c15a56c5c7a4cb86e26dd7d01848d751d7ebd0ab0da8bdb0ff17a54f19dcf71b68a9ddd95a41
-
Filesize
5.2MB
MD50475f4dcf19a57fb89ad3eddac8e95c4
SHA1c0714ed81730d9c3ebcab66a0f43b0bf5bc1b1d3
SHA2567b4df38f205e9f86c13256d705ef764de954eed17df69e9c0d79b50f054ab6a2
SHA5120955840e1fc4e9803f27dd018de72c66652e51616709781fb9d159e9ecfc8fb2e2836fdbaedbd51f875192ded534d3d9b56a1491ee6bac86545da89df35672f2
-
Filesize
5.2MB
MD5d0ee416ea28532b6e96c8a48c1a1bc16
SHA1de8051160ec842d7d4405d2b9ce4fa0f7208a413
SHA2564c101dff48ea6f73495a1e1acdad6d09a9e8e38f8b4d43915443331b19624c6e
SHA512939b16b702cb82fbc037d5f908d232de0e81bdde4b609ea9d9a0de682e93fb3fbc83a0774aac3852c71608b77a6c32bbfda4eec474a3c71c678bfd4a591c936d
-
Filesize
5.2MB
MD5746340314a7f2a5bd0cca3f9f668b77b
SHA191a84897a9f96a6cf395bf94412e013f26c71bfd
SHA25620e6fffad33f06ed788b717fa25c634052e0480c48ae56cda62a477f704414cd
SHA512dab584fc05afa5984ea660249846fde683e5d3667118aaf1d07bf58807abdc3319a4dcbf4c1e9f63216fe9ce94da3baea1e5f0ff8b59041d69492b5593c9833b
-
Filesize
5.2MB
MD5d093c43dbb130fded2154b5632f6d923
SHA1732e99ba9b902b5e0f8de0767a4a35a45de593fa
SHA2569e7b08e8f5c461583ec79ac885ef65bfeff4a6fb8e54d5becfd7c925611807eb
SHA512a8731174fee420313fffc0878ef9e754a90f98e24f80d0738daf710fa9965172fbcf744d9ba3a81876c92e0d366a2cf95e3d33c443becc0bf2ba3063bafde4fb
-
Filesize
5.2MB
MD525f69e23727edc45deed877f7c335c9d
SHA1e52a5138b849d7f592b1c28929c50234d5ce66d7
SHA2567b4b2d3d91d14a0aa7652a0471aabce21b45628cdd96c4ddad1aecf9bde01bec
SHA5124d874489bffa94006be90ce7b5ecc9e371be523cce81ecb129db49c6a3881587ac852f8418408584d062b27d6bea7851fba0c5e04b6b29ab48b618d39bb085ab
-
Filesize
5.2MB
MD5f3ac822651556c2b37616b22cc6bbcee
SHA110cf72ccebcf82e9d8f29cec5e9f019348cc455a
SHA256ed191b4ff68eb2a59c86cad813a84cb60a35d398d7dd43b972885ecd96bc1589
SHA512de47f1444d940dacde410849bab04317b559fb2781a5555d90fba5a9557fda5470935cfe652d638f2c811f810c3bef7667e590559b0082b037f7f4c02c8b75fd
-
Filesize
5.2MB
MD572c72f7b59e616996654dc5b9a5d0f14
SHA120af8e13518d262bb8a348868c42ae42dc7afaf8
SHA256ebdd087ddde6a9f06f893165a9e2c48b680be3459be10f1836b7652c665b99a8
SHA512fe2f7dcbb56be522595f184f3410070e98e0ead39b2ff36e191175fd62c9848c91c566f269133c6e46a96f58311b2fb5c2f1bd74aeaf5ccb544fc2f8728c477f
-
Filesize
5.2MB
MD5a1c43b2d36544b97ce6c8852f7a95b41
SHA1e8bcced5880860a0c92947246f3dea814f22ab2c
SHA2565687b117d32234eb3e2fa6ef10621119bb094ee4b753f8180bfed20aa79ff905
SHA5128ee05bb5c396fe730af7d30e9638786ee85c3d1cde3b6a17ce7d8402da3526d377719ccf672c6bdcf5dffb114c05b7133a02edb151027678b5afbbc012573c0c
-
Filesize
5.2MB
MD51e2a4ec7a5387e185f079fecb2567cb9
SHA17e5c7782b3cfb396606055b576079fc11a998b89
SHA25604739db78d6b63af6234a42f83b3abacc0eeb6adcebc0be41372a98821a092d0
SHA512eee7594349dbabf7c2d00d26a8f9c6553acf4a3a26f51b1c1befc014d0b5b379ea26543687b731b45bf83a2335b45f7fc6dc98c8c0dc58165c843d1bc04e55e5
-
Filesize
5.2MB
MD5e9394b63dad7c3a94b19f0950e7ebd86
SHA1076b9629129507b395e480e7067520fb84ae9b9a
SHA256ad39ee5a4f503c823676414d579c803b22a7900b02c42b82a5cb525ce5a8234d
SHA5128c2fa0d7e70a72eee3e8dd83c4a367c2e2e5e0695470001544739e77a70274682848fda9a4948ea2c573d4ecadee4bf46ffe78f23fa47d2ab1fa62e0301c43a3
-
Filesize
5.2MB
MD559fc965bc7d498c6139324e373efdcce
SHA18deef2caaccb05977c14f77cc3f3d89a94b54653
SHA25663a32f8161a0dc9a07343dde058cf94738a7bdbb7f3c11146d82b5531e7544c8
SHA512d23b292de720fee0224b4740b4c7af3eee7229a6bf8ec924948bc7c032ef3815aaae98af8b4cbb47ec4b5edfc3d1bd2867550310c4d6680e8807f6b89a2a0215
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB