Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 01:06
General
-
Target
2024-09-22_ecce330ae6eeac65a3dfb73a777205d5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ecce330ae6eeac65a3dfb73a777205d5
-
SHA1
d5746eee449e33cbf5df1776a0d987ef20be9828
-
SHA256
98e23a269c039dec6e2da32705b2fed25df041590165b73baac680742d44a29b
-
SHA512
7deb67afe45e86fecf7053d8ed0d2cc6c4feb9b5bd689c587647c1ee7f58a45bb116727557a4107a7cb58bcdde53e4df34b2900d56377f310bf88529c1590430
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_ecce330ae6eeac65a3dfb73a777205d5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_ecce330ae6eeac65a3dfb73a777205d5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qNqrTzC.exeC:\Windows\System\qNqrTzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNCZvio.exeC:\Windows\System\QNCZvio.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BELElTb.exeC:\Windows\System\BELElTb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbwfBUL.exeC:\Windows\System\UbwfBUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyurFrH.exeC:\Windows\System\iyurFrH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhUwcvH.exeC:\Windows\System\uhUwcvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EuWLpoN.exeC:\Windows\System\EuWLpoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhVRuEa.exeC:\Windows\System\jhVRuEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMKWfOH.exeC:\Windows\System\UMKWfOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePxIhxq.exeC:\Windows\System\ePxIhxq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VtqUohz.exeC:\Windows\System\VtqUohz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDezLyY.exeC:\Windows\System\eDezLyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUnWrbR.exeC:\Windows\System\xUnWrbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErCYKYV.exeC:\Windows\System\ErCYKYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\geGDZrq.exeC:\Windows\System\geGDZrq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYrIVAT.exeC:\Windows\System\zYrIVAT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKZqBHK.exeC:\Windows\System\MKZqBHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IBnAPXz.exeC:\Windows\System\IBnAPXz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PmSkuIW.exeC:\Windows\System\PmSkuIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNSwdOK.exeC:\Windows\System\tNSwdOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jExmggA.exeC:\Windows\System\jExmggA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD561c007ccc4627275ee7337162492c5a3
SHA1a32a910e7b80e08a8e87d82efe74578ca7b95bea
SHA2569a6a07954ad1946fedb4d5de8e1ff5ce97046ab314c545a054d8d66edb657624
SHA5123e63510bf258f2cd12391d2439ee6673ace009f947badcb5e0cd45ee7088a04d60ad0080fbb9f8ffa900db71d2e35e6f2260fce0951d5b6df7beb185e5b6cc7b
-
Filesize
5.2MB
MD53dce93eec4e73cf5537d430fef748d5a
SHA1911002aec5f750b70a81891c551a323230649484
SHA256b4b5d6d7efca1f33eb51fae2ce8237d35f88a46afaf9e4b1dbd1e3c24174a3c9
SHA512540ba425a937ff1066ff33119496d32c2cb0b6a20e579a46e1a3b7fa5ee255b6ea7d0b527d56cf1de13ac2e276b47a94176137d83c57ebf03e99a9ad2dc9a434
-
Filesize
5.2MB
MD502d548ab3a8422df8754ebcd8ce0b7a5
SHA106d6f1506ab5279e51d6aa58ee0a46a475f49354
SHA2562c8d037d4a83ae63c0ac7889233d2071a0456002f258c33b7cbfd6e0d8764f3a
SHA512d0226293d2735829a34b9520bba924e67a623b9bc03cdb24f4ff2023443e0f10fa303d38eb144c063f6fc966ac7a55ddb72d53a5e9256eed415a42005c255032
-
Filesize
5.2MB
MD5b7b85e8b0e0ebe218e9c20cd6a9b6559
SHA1bb861dc1f413e4ff4857d337ba29e01521f219da
SHA256ac52baacf5a16f0ed42a1e8333e74cb6916dfcc4d03871305da83a27998099c0
SHA5125e7ff8489e57dea43c7ab0b7baf4195243109729d0359d1a137961230857701ef8c67a0a84289652f4a5869d1693dbc0e7668ce6dc019b580e73da4c38a38e61
-
Filesize
5.2MB
MD575874d4abfbc6dad6e8e8579b48480c9
SHA1829ca2342c6e9d6275396183a07cdc4be6a1a6d8
SHA256bd02a4db6dcab9e28cb7fa3f92a949562ce9c5f05a9ead60dbb79ad222bfd4f4
SHA512827770712bcebd804905c3037be95b8ec263908cd9bc1c5feb9c97d9519bf603a6bc91ec2d8173fd6c7707013a788ed2e4ce0d0e1d0be787f82183849644aaaf
-
Filesize
5.2MB
MD5abc042d9c5557f2cc5af8fb3d8265b90
SHA17a9f11b676eea7642f30c461c62b3697894a8600
SHA2567fef2b0c16df9cc154540cacc5e8246ec72160c3f499c40626360070ecc15674
SHA5124271517829439c16f59a35579d086fd7c49d39c3cba603c20df311fa91ddbdb1d736a9a6d043f14f06322256823e24c5b029a0c0743844ae11943da22b538f6f
-
Filesize
5.2MB
MD5550a5eea0c101e76b44a42db2811f0a1
SHA1d8445405a62a7c59f6a5bf6607cbce07b57cc3a8
SHA256966e15e2259d0f49fa859c21ecf25126e2fb8b694667a2e337fdc66522727de5
SHA512465a662232fd37a1dbba194f66ef2ce8715b15ad581d238d61e6a0cc466579f360654197d0d748a954673f3115453bba740feb6e80738cd026411066ba65ca5d
-
Filesize
5.2MB
MD57ad1f0bb5e8c5059be4051a010b7ad83
SHA1335e0dc29b84717f907a0d838cd4435438f6bfa8
SHA25623d6eba3c3dd81dc9973d53cc27991ea0154eea99e6b91b837dcf1297aae8206
SHA512fc32086331350215a8d2ff02834bc07e40640ffca16e4fcdaf17b459d38374fcde4a7def0fab57b1b7549f4b58b043d999731627d6bf70e9c608acf4ac207a2d
-
Filesize
5.2MB
MD556e702ac3e4021d167c465c59211226e
SHA129f63ff72075be6033796f85252324a891d434c3
SHA256d19ee530abb93515e90d04cd363b596d8fea8764837f97c3d2453107de82c614
SHA51242d23b8d96112d1f8761b43960e0e19a7a2c0b05e636997f3c1d81ad67b85f7da1bdbc529eacf4888c23ca7787053162f163596422a9cbf8c0ca596bd6a67931
-
Filesize
5.2MB
MD5fcd28f851ee50d4e39dc21e8b92d9bcc
SHA1d8ec04174e52701c879d57e01343676879339c58
SHA256d6dc4b665a3476e0f2e7c81dd2cc2252ecb198442c3e1ec0cbce290d132f302d
SHA512d61789bf72201cd2b62c907d9f451bb00ee43926132f1722563bce47882ec6299926594197979ba82b01ea41c05b5797c90245e13cd0381950ff0169ccf423a5
-
Filesize
5.2MB
MD578fb4fc4f59ca7f37af3180ace6d9d96
SHA167c518619064be76d861c5c4da5f018c910186e9
SHA2565b46d71c2130f1d023bfa89c567b7f86be7d1b60883d66e84e94d1ec0d6a7ecd
SHA51225a65f913282a54de23d6ebf821da365c6b25d0402f8db583189d8fa902afd1b861b3a10a0ae74a34ae04169b4bf95f73544c973f3ad14c709f774e3c21b3ae3
-
Filesize
5.2MB
MD5be2a4a614624fca63a3d470523ce5392
SHA11bd28ce7346a7d6ca6f421833afc15768f241224
SHA256a01de0912a87fdc7110c3ae8865f9df3043d96da6614f66ea163437420ec1c40
SHA51287334318006bc45d8bcb15f9f2894555e19930cc2168f2c63984c00211a9b9d7dfb8a5a0abe08f60b8f9333fdf8a9ec64cfec23dfd70bd08767d3ba7433bdbfd
-
Filesize
5.2MB
MD549e11b23b6bddbc62581d20f15ced9e4
SHA179caf9b986cdf9f7ef2e20faacf84d32166a8eb6
SHA2561308e82c559128f2b78a22c6e7110c9ef5d6552554c8b45026aeb1517535df6d
SHA5127d2c49e11c9ad2a228d3332466d48ec57b30ee56beeacd1550f641a419a160ee1339b49a60f9e06f1ef332692fab064405229d5a24bcc515a40e0c99ecb03ca6
-
Filesize
5.2MB
MD5c629b0fea7800b98d114a5c4cce40cf9
SHA1b02a39fcdcf34606c2eb74acf7d55f3b67b4cb2f
SHA256b8b1e13290f2b7195c516f20ee8266cf9305679df18b4cac7dcfc4322f900d03
SHA512541804100a4ace7181a631529cc3b197dd0ca0caaf5726ecbe7b5bd4937b7f0ca91f67c19a51372cd16e9370e8ab42b2c7b2f27406463dd92ead2c983daea2eb
-
Filesize
5.2MB
MD5a311e89412c1579e74bed783a793d6f3
SHA11a502a775f2606d064568291d39949c2aee51bfb
SHA256dc8632f023f03aa3a541204b846750745a566a3811795678a1d7680ae0aea233
SHA512a8d09ecb0adb6e0a3e0a0592b12fbcfbd22406a0db87c1df1a7e1792628ba7366313972a74e9f9e3b5402f6756abefa91914540e896e9eb9ea5e4ceca748d372
-
Filesize
5.2MB
MD5534657bc95e0e81b3662fc07b0a26498
SHA1baf6277272e1b1167ed2bf4ce0c5b7839d1e82ee
SHA256b1af3579866cbeb4e6fba5872022fd51d82e40c4496f827633260e43ca9f3c13
SHA512034cfae9d206483754fb5ad10afef1a21845a4d452f204107f68271efd8e5db5387648e1ce323a60b562bd2d1bafc0d2e39d85a3894dd557e18fa9e9e6665fa5
-
Filesize
5.2MB
MD5e20073488995ad6acc32c06f05ebe8d2
SHA1037a077a9dcdf3ea0387b54ebcb951142c6c06f9
SHA256f860b52d169882df1754902e3b8ec52ada7d087732b270a8ca47137d71308d60
SHA512d0d856ea8781834bcb06fe5d07fa1bd935ade4f5623a43c1d5885b76c7e1af1a97707be5628ebe89cecc05e7878402f1511f7fb675f297aef3ffb53562186a7f
-
Filesize
5.2MB
MD5c5b8d588f62f9f7e5e318f04b81371c1
SHA19c049ce97b903062f7b3d85cb8d43be09ddbf484
SHA256c732446a3632f51299341c1747c10a376861be75e9529831f70dda9cc6e824e6
SHA5129ce39b0f98abe78fdc6a748ce5ce7621c553c50db23f4ec6d7004c77042069bad1257186b4483db400164f69aea6a85eb5473b6aff71066e1bf7ce50a775baae
-
Filesize
5.2MB
MD5da979f5514a0b3676cac90c911baba4f
SHA1ac8f5401cb8f4b2226204e3bb36484ad721beb0d
SHA256ff2de0c70b3c9878d7e12aba1e88da2f63238ea0bbebb7573fbfb55cdab6c7df
SHA5120aa87f52bbdc6ae31fea59dca4192b3dac5b2bfc7713132e3cf742e1f9841734d9b0d1780ee0fc2e66e88bf239b8fdde804feb12bcb12cf96441c6792de2a691
-
Filesize
5.2MB
MD53d8c3a0e26fab620e97dba8d4ed97c9a
SHA1c022c253959af0b033204b797c37bfb5148395c3
SHA2569b66041fd989309491751ef318cc785dfef4969984d1348f569706cb835b1b67
SHA512bb5cdfa9c9bca1562acfd76d793e6b5c039aca204ef1319958fee60e78564239fc356f15a4c1a3376db25b4c682dd9c1cec63ef00f04c238dee094e422fe3eb8
-
Filesize
5.2MB
MD512b6e5c7aca654e779175b7caa654abe
SHA1891ba281e7c06c9f26e92bc32d0283bcd921a30f
SHA256c5375789f39c81393477d99ba5190d5e5750dbf27262b904ede9dfb9b00bec97
SHA512a4dc67560276ebae3ea5e71392c6a803988b531156fc7adcea0c009a3be6bd24c4aa27519d17517fdc44daabfa76fb988b8694ba1552dd6b2ef39ef181521f12
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB