Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22-09-2024 17:06
General
-
Target
2024-09-22_3bc076f23150dd1c91c97c26adc63f1a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3bc076f23150dd1c91c97c26adc63f1a
-
SHA1
201eb7569a7a9f4ccee9199ea7357548d4460259
-
SHA256
903740dbd2546990b15bc7846c34e6c3d220dc74bf084283e562a38983fe9757
-
SHA512
1f6472296a34095e73c4b4de633a0c960c0d0a9429994ec1a2a843de48269998cb6d0abe369eb607a2237d947c72f9892a3b8f072d8dbe39f757ae2614f6bef4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_3bc076f23150dd1c91c97c26adc63f1a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_3bc076f23150dd1c91c97c26adc63f1a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VKvTAbh.exeC:\Windows\System\VKvTAbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\trhzSrC.exeC:\Windows\System\trhzSrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKFKMqm.exeC:\Windows\System\IKFKMqm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCzlgnT.exeC:\Windows\System\GCzlgnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Htvzuqj.exeC:\Windows\System\Htvzuqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfegsgD.exeC:\Windows\System\lfegsgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHTotqy.exeC:\Windows\System\GHTotqy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\baUDWCQ.exeC:\Windows\System\baUDWCQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pZehIwi.exeC:\Windows\System\pZehIwi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yQImIkI.exeC:\Windows\System\yQImIkI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mGkCVJH.exeC:\Windows\System\mGkCVJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FuSrSNZ.exeC:\Windows\System\FuSrSNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCvRxnV.exeC:\Windows\System\rCvRxnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJaFXuT.exeC:\Windows\System\yJaFXuT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjXowml.exeC:\Windows\System\TjXowml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gfZQjol.exeC:\Windows\System\gfZQjol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGIkvoO.exeC:\Windows\System\OGIkvoO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmyhNyL.exeC:\Windows\System\FmyhNyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xNPYUov.exeC:\Windows\System\xNPYUov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRPcakC.exeC:\Windows\System\YRPcakC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NBqngWA.exeC:\Windows\System\NBqngWA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58968452ef96bce2b8dbecb4e3772a7bd
SHA16ffaa6cbb0792ce362bb9fec8c66e4bbb6a27cda
SHA25632903f33eab5e3a27a3f8e9db9ed3f5de1106a8cf40de63486e7129c6b5a7bf0
SHA512ac37b115557af7399756799f7cf5f75bc544c812ae9c0d93308f51bb9f8b0f4c48b6f23503fd2e0049f53ca95338dba40a7928f6f3262de8508a7fa3fb438902
-
Filesize
5.2MB
MD582e8a0ae4d559f421b67a23d2e530a62
SHA1a9e9a93dcc73eb0f104a73545f8733a553c70e20
SHA256cc29e44612b09426cc508677542fe962e163dbaf5e30c521f484ab4e3d1eab2e
SHA512da084789ce1574b9847c9a57a1b194d0488790a532c1dee41d9f1f22efcfe42bce56999bd66fe5fe8231edc766885bd15e5f72c3d7410bc37eb70195824a9c36
-
Filesize
5.2MB
MD522b113e3c8f42f002473988e9979a9db
SHA19656f7c2bc1644765a1697114cb86a457fe2070a
SHA256f993fbffa9a350c819a86ab52de2979ffe3fd58e537516e3b9e125c6f29c62a2
SHA512c3dfac72d1876be0c8b18cf7944ea0b306d3c7e2376e0ce84835c9f0d590271e7c2769d0da2542adcf2cc02583dc1d70a557d3ae74e46fb27df5ed93b65308d1
-
Filesize
5.2MB
MD54d3902358de07df822aee06be1ce3bc9
SHA11641b9ac7ba8449bbfb73530f2e52817a0f09094
SHA25651a814a9bdf88496ee931b993ac0df2adcdd930a37f205f0e1bbfc37b3577c72
SHA512dde0e3554312b70fc9fc5cb4cc5532558939f40700e65c61c24f8c5926ceb673fe953ed60be9548388582c2b3f200fb663bf29da07d471514fd8e94430e9035c
-
Filesize
5.2MB
MD53de0d48a727227a1d6f63bbc45035c88
SHA1d2a48cc1c35298756f891f00a861fc140d85c244
SHA2564578132b74c3060441fec7ded932ab62ec0210309d2f49f992aabcc553774f3f
SHA512b5bc8c565e4fd39ae2dcac8f8939abd2c7b5f2f486364c373a8d2e89dad1d8df3071cabc5aeff46c46f5e1d56b0f86f1ba5e48e57a2051196078878bc3ee6aff
-
Filesize
5.2MB
MD5037ffec4b85072c5ff8b7eb30a5d8c46
SHA1d2e3bb381fd8fd1c1169c74ef9791990cb2c895f
SHA25684852c214831467277d0507874bcc2eea77ac4a9d5c370648b612634a22e8a0c
SHA512909637b2b86b3ba423846a3ed37c5366dabed8235d665383fc81ff8edb01113fa1927c721b8e8a2c9caadc3d2f794122b95447e6ef83ecfb65c1f119e4b90d70
-
Filesize
5.2MB
MD50e10898d01de61d53b7d763c877f0148
SHA12543d87d82d5f523f5dffde01bd632b29413bac0
SHA2561976da0acf984a055894294843496aec3386c4a041a6d4c5b5cf424c9f687f4d
SHA512b0124eca4e5320de19bf0c482cb93b2aadc37d3d516b770ece77f44099c3ad6125df26fe7f13f7fdd153abb131eaacfa9925439e7ee5853a5d07eea62da607e4
-
Filesize
5.2MB
MD5045c9cfebbd64db327cd70efc9c07a92
SHA16c06e401467d620e323f1dd20c18745c10c41f55
SHA256b88ad5929339b78a0b28982a30817502ea1f6f7b30ddc9ae1d9e2c43d68c9151
SHA51285d541a94cc284b45db8e312f9da7eba83f1066830f3296b83e704488b3bec0e6c08fcea23634a3a26a7a502157448603c3076552c583ddc477bb46bf10eb463
-
Filesize
5.2MB
MD5bf3b5488e8c736b89211f3738a8f178b
SHA195decd29b8c8f2f4593283c468b6f04005ec87bc
SHA25682bf2c1777851d4baadc14567d5435ec678bf7b2e24ace2b67f0c49ba6db4215
SHA5127126421205a1d81d9b41a7efaf7dd2feafc866199fa297acdc9f97e48dac7a3f9a161becc04bb1417be8214aa65227e60f9b786e5c613ca99840836e64f6fc98
-
Filesize
5.2MB
MD52e3dbd9f62004dbee46f4142fbcfd873
SHA151fcccbc2045f2dcdf1221dbcf8cc1e5051c109b
SHA2563e24f117b64876d0543ea920fbbb1a73e81d019bde64b2260f7381ddac1ef720
SHA5125ecb90e628d828e52b51d41687c6757c0e14562c856b32fa48525ffe1a4eed7a1ada06aeda2ea60ca309f4721b71d70d8e67198a6e82c5de52032b8d39773d85
-
Filesize
5.2MB
MD563c19f2950d4945b496a27968cdfa8ad
SHA1707f4ca05547ca1666c4e0fb30f433150c1e88c4
SHA25656374505d231bbb5d26bfe86d3e7d5c253115e0e84e373a64d55e1728b51de72
SHA5124dff202f486eb5a48b3859c88141d3ffd2ea96eae249f46283fdd350c002bc39b095b58a5a49d8e59c9303d5c745bce0c102f68971d8d91e6ad2b0c06642b135
-
Filesize
5.2MB
MD534997b9b5855b7a05e27f26a0e76e93e
SHA1ac6c08c9d97a09d160f426428d5b6b129c0c1837
SHA25638885ea4f04331001f7c16ccfa01240e5fade4f233eb14dfcc43707209f23d95
SHA512f8400f81f735600a4b048f3dfe22d5788e4f370a6dd9b2a9413de558965e6248f1d3de943a26796c71f84a62e2f18f522b13bd5cc84b28a03d175beee239118e
-
Filesize
5.2MB
MD55cf8e3c6559ae8e24c2b764cf2650b00
SHA13b63c3e4acb014ab111ab7e52445bdffb0812568
SHA2563fda88fab7dc7527577abaff051c3a6ec06a91ebeb91ce82f3a3d6a6db4e385c
SHA512c52bf88909cfbe7fda57da5384ce418cc8e4fe13043a30805f6481bcee4812beb6c25b005505666d1a233679e53a8aa915c09b2394c40dea64e523ba22b50a10
-
Filesize
5.2MB
MD54d7fae6230a8147464e916cda283a2ca
SHA156f403ecde641ec676625a4abf60b7979826fc60
SHA256c184e1f55a229527dec24af638c3e36c942c8b710b6d3a6ba93daa97328b3707
SHA5129479f8a9f8416210aaaf5c6ef69733a76cc0c796d100c500726d4149b880a3c822d5342e3f9cc57c897138b03160494a2f9e46e73516bd1977b193e3570dee55
-
Filesize
5.2MB
MD5d1d7c72124cb2dcfab7b7f3c33ecb091
SHA1214258f7020b8b1dfea9d56e32c2073b0716750d
SHA256374a080eb43ab9ea373f37ac36691ec462290085578b5b38334daa8ced951004
SHA512811cb10f31b3b2d3faa0fee75c5af6ed5b9881d5ebb796ff2054a2356b96ceae271773782fb97daaf2cbc34d016a91f57fdee643db2c1ac34c297cf0804f8cb5
-
Filesize
5.2MB
MD5f24dec7824f27cdcb3e142f84abd477d
SHA1f4c79bec20d426405f5d72bc15c42622a94e8345
SHA256936f705355690e2e83260bad4763e344a5abd516e0004a741bb1b53569abfc27
SHA51294b3b6fd5fa3bd31ed6e9774f5ca1da40350e547e4530245ac39aeeccd4c4b364accff0a1f52b909b7cc2c2a2fca0f0b0b16868427d4db01ede1a2325f9c7020
-
Filesize
5.2MB
MD58a5e0b3a3b74bd3ffbb509b84f37499c
SHA1ca046da3ccc169a2f1ca93faf95e71f199dc385c
SHA2567299dc812070fbc8c627b2e54e1844c8d680d4d599d8e3cea2977b38c8c89830
SHA5125c7a34493cf293ceacec67f68eac5a3232a55d8cbedf8ca2b056e42de8415a2cacb07a96f7a63b4297f419cd7dcc35b6414acd2b3a4250a45912106ff36e050c
-
Filesize
5.2MB
MD58061b053290213dc5f23acb5af6bf7df
SHA16b7af4405078993f54cb8c973cc15f71405004a0
SHA256f8e0a0db5706d7a77f24edbd77d7a94e336a296e1da1582ae74bc11aaaadf924
SHA5126aedad27637622c3c0fb4637bc9c5d44fdec67db589007c0e55faccb127748ac50d92964fcc7add7f7b35ec3593b63631ef0ba77d134bd5cc16b9cd884d453dc
-
Filesize
5.2MB
MD56857abc0711a9fa24e3b78bdd4c216c1
SHA1442e40bcc1dd5448a8c5f0c1409b93a85a318ba8
SHA2568e46f6ac010bc68a79b190fa0d6a345ba9f6024da5cad89d63733e084e062be2
SHA5128cd54a8cf10ff5f5051f074c6614fe289d57000014f0e9e2c8e059bcc714c5e50799f3cc873ecc3093fdbf88a637a0951cfb942c34672c7dd15bf4be4c0fe169
-
Filesize
5.2MB
MD513a70f9f71b34897e286c69846708372
SHA133b50c6bcaf9308a6f61be8c3cee142c0c095469
SHA256b4c819bb383e1b8b2489f7ba92763899f438e69f23e02cf21e16c446d472c2b8
SHA512d412bf5e8e66f4fab8bac9e7237dcc532cda1fdde461a1cc6bd70bc71383d84004742d6f4e320e13c00514dedd549c1a89571d81b50ec1d61db3409507885d87
-
Filesize
5.2MB
MD5e5f76e2e04397815cebb490195b1c682
SHA176337dc0080c35e8d20bce2ed9ec24d3db309002
SHA2560ff114d3af811b4932ea5e65791bc767909f07f92a140b3d8714fa247bdc7899
SHA5125bec835d68a9fa684c3defbf5449021506adf31a8c77e825c69aff513424e87682b79a1ccbcf4931c7054054347c26b757187e261356f96d224ec3f9f3857395
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB