Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 00:56
General
-
Target
2024-09-23_bb6e80c2ae727777873ff56cefe949ed_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bb6e80c2ae727777873ff56cefe949ed
-
SHA1
dbbae1bb0a77d17c09d1606f1f4707b2ab5b86d0
-
SHA256
20962710e1bfe91b069ef7a1a4c6565cfe6b57709894e1539c2a6644e7d7265c
-
SHA512
3f433743c10683c510683618a196462f40aaba1eb7ac862679be2e663d54dc6d47d38780900d7e2224c044f9fa7d5efdf00e02f3013585dc49f23342eecf69cb
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_bb6e80c2ae727777873ff56cefe949ed_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_bb6e80c2ae727777873ff56cefe949ed_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NrfUGoe.exeC:\Windows\System\NrfUGoe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQUcoIX.exeC:\Windows\System\LQUcoIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NWXHWdb.exeC:\Windows\System\NWXHWdb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FGderBM.exeC:\Windows\System\FGderBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPnarOx.exeC:\Windows\System\IPnarOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNpHWYo.exeC:\Windows\System\DNpHWYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkLXFYM.exeC:\Windows\System\UkLXFYM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BFmbRbr.exeC:\Windows\System\BFmbRbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfXHqGV.exeC:\Windows\System\lfXHqGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rishgML.exeC:\Windows\System\rishgML.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ESWeRJj.exeC:\Windows\System\ESWeRJj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVDpaAj.exeC:\Windows\System\IVDpaAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dNAQjPt.exeC:\Windows\System\dNAQjPt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctHUKiK.exeC:\Windows\System\ctHUKiK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\elEzWJp.exeC:\Windows\System\elEzWJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQxIzau.exeC:\Windows\System\wQxIzau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PREIMmY.exeC:\Windows\System\PREIMmY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNHeJYH.exeC:\Windows\System\CNHeJYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbUaxkO.exeC:\Windows\System\AbUaxkO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xCKdeZf.exeC:\Windows\System\xCKdeZf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oqOvNsu.exeC:\Windows\System\oqOvNsu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55974a44fe8be0c6fbabde10fb4b78783
SHA1bcef24f0671b9565707121a1a38d53bbaef9d246
SHA25629fce434a53538bfdb1f1c0b1ece4b5603c0f5465709d9c25d1b6d17716bdbf7
SHA512ac42fd66ea5f58d0a1134517365622f20df89dd99d88bbd4acd298fbeaa5d1804398a3477dc360e153ff24c9ee2705f40f63f723e26c9cd7c2f28c8779a0e854
-
Filesize
5.2MB
MD569a2bc54a5bad302828c5cfc9f5260c8
SHA10c87682f75431b9fbfc128eb1a151cf573a91ab8
SHA256ca72b350271019929d90b654848400a53466c0e0c46244ad1bf435fe1abc6b77
SHA512b27e1996558a578c4b33c94fc9a9a9202856a6c9e454aa37a4e935214373759e141a8fded0625107a1f820f9105480acd07c39d10acfc0c56045e3e2ed0e480c
-
Filesize
5.2MB
MD5b48f6e5120900388dbd3d4ed6003d9a5
SHA11fd0eac2e52db0f3eed9016e3556df8ea0dd84ea
SHA256c9133bf568503b85d4882feb24dd4eb5a2c629a8af98332a71dd647217f5f659
SHA51251eb01a718013f2025575bf0b30e882370182c728fc1c8166b96ac15b9676007a2d6f389469ec543926aa181c2459f80914620686c775ae88506825509249564
-
Filesize
5.2MB
MD5fd2e179a219de8a35fe8b62eaa253b7b
SHA1e0fd6c0773407d4ae65bcbf60c45fb7c86be9d4e
SHA25612eb43efa460b634c4435a2da2d1b2337aa1383ab0c21eebe43cf7e4e1f169a1
SHA512893c605cc6a3c3b353c02688a181bab96776f17987421c52e9fc36c44ca6b827f067ecd98fc8a4826230f05858a7e5d541c7190d5e91f292327d46fa4f733e42
-
Filesize
5.2MB
MD51210e430c4534d3921bae6d807e57498
SHA1808104cbe35755c28b8a9d7c80572bcb521fae6e
SHA256469222cc6ff3c3d2174e89762b4753cad88e86eba32aff7c2d67d4493334f6f0
SHA512cb66b7a35e7a7ca804dd440ba763177eed69e518b9dacb908725ff6b2c5f65eae51d808163bd83f757d846c5c983b4a6119d108489c2a1a195fbb27228e365bd
-
Filesize
5.2MB
MD51b83093bf24f22ca933154bf52dcdcf0
SHA1c45e0bef2099ee36702b51a5a9650175952ecbda
SHA256154efe044607cf3439f56fa828637350084d92d549c587ba42443a5e9d67921e
SHA512370a6becdc8a6082ff2a28a2a1a7cf09e4d343f38ca367795ab87a43f030ce6fc861840f132999f87fa69d19ac2395e63dd44d6078b3bd67138202bc5cdc9fb1
-
Filesize
5.2MB
MD52fcfba8b34a1160e334bb5a4bd10514b
SHA1894dd410c4253d03b25a3e5c664bda94c8d4eaec
SHA25604cf0ecfe5b138c82c318aa4d2a02de10b3484a96f515a774688eb7e5103746a
SHA51277195e7ee64ffd4f7059175e0cf289c246b37a869feacc1cfca8b0f0f54bb7d629ff6fc7559bde813e84287a8d6515a0b61ab697a19a1dd98b1340abe6d95227
-
Filesize
5.2MB
MD556c60ffb8097ffdd53c0c1d7d01a0f11
SHA1db71e6a1c3723f477adf3a3ace8a042de2aa2a17
SHA256f03f07efc3c46b77d7137380a6d539fdf81382185d9cbe0b1fe6873590c8bd89
SHA512474fb2b26fbe8d1b6f4a30e5f839b03a6027e0d555274e0aca80fd902cb8cf9e8c9546f01f93934044e648c9c5de43f5b2aeef485930b8c75c001e19456e6d42
-
Filesize
5.2MB
MD5dd2b06642a3ea6fda99d4f29d8cc7673
SHA15e72b0e2b4440615f21a25fb34b6d464356d7533
SHA256497a32cd0ac33b0cd0c9a9edf062d0cd29714f5a10714cb62c7c6c75476f813b
SHA51249250a0d904568eac16d691087be1020b001f2700d30083e1f2835108f156d7bb146ce9ac06a4161dde3cd4d415c2a9292af1832e930458e9e94cc114aca26cc
-
Filesize
5.2MB
MD53b0adbff9ca8a29fe46841be5a1fd64a
SHA16593f6ee68eb253537587cb2668485c03b2fe4bd
SHA2561a20fbeb0c168c8f98c3d1f79915607fd73f19eaf8cad6cc6c011fad10f8b782
SHA512c9c47e12c370512ba862e7d6478bdceb167ff030a16e2364489b21ef3a9af39d64e5de8c33c6ab696bd0f42abf0d389b3e0957d8f1f13adca4a4376c3f648224
-
Filesize
5.2MB
MD50603fd07e6a01926624ab1c73a31ab09
SHA16ff47d88130564c8c86b1c5f1b229b19e61dec07
SHA256e5ec9d4bc9e51dee71dc58508a88857521df3538fda05b37187d8f1a0e563902
SHA51288156d4160c8386ee1b51467dfb44f053f062f7502cde6f8c45b7efe911cbc61c7e8692dbefc1b3738610bb3c8b399b3a3181b14f4060f2b2076a52a0e2c56e9
-
Filesize
5.2MB
MD515903ee4a157aa8f2cfc7c598bee527b
SHA19d5dea26f6f1a27f2359e71cebe842ce319eec02
SHA256e422e7bc2b8c9e8afc8b258b5efafe48e3237c6e0dad49cc79938819ee4230da
SHA512605a2d89c786cd2513a6c4d450adcae1497ec2e0dfee46afc3a63ac1a74e051f18d35e64d56fd3ac2d08dfdba274dc36e224b0d82b59cc52ba45a169bd3f05b7
-
Filesize
5.2MB
MD51d16dc2320e2156872a90968c70bfabf
SHA1cd4707abc6309a187d5c9a8447c2b187008a3b0f
SHA2567e33e4da2f4488799bce7b858b36febb11b20b75f9c94259882aef1be1ef7260
SHA5127091fff49e3effaedfa53b5eb229caf160fe16b8929fbd6ea9e2cdd35313ee9b46084e4fd17ba5bafc288545644d512ed16c65dc530b60f9f622911d598a597d
-
Filesize
5.2MB
MD59ff3f97842998f75e7698a63aeb4db81
SHA1e8c3e10cc6a3731155419a055233906ddfa16e39
SHA2568a68848db2598cbd322923c1b492210648b74e3c40d18dac128bddad04788bbf
SHA512de1d22fd97172aefe633eb8c330f85a4ab4ed08799dc7aafec829ca9ff8d8854257c84620a4fe16b03f81198fec9707b725531006c9250a65db948dbc1246ea5
-
Filesize
5.2MB
MD5e514e4bf41d6008ae4d1a3e1c3f6a48e
SHA1faad1b52736ddd649b346eb8752bf2a8abb68d42
SHA2566d1e5937335fd4623de8a1ba748922571f45adc96f9cfdec9783be67551bb76b
SHA5125fe7a5fd91afd8f86de24b1ea09627146acbda7976c7553223536955c049dec33335b1477404fde989b0770abc52e0a9041beb7a2db3ff71ee0ac56d69ac39d3
-
Filesize
5.2MB
MD594a293b6a17d7ff0fe8c99753698c9f6
SHA135befd0de286c7ee2593f95b108ee139cc0fef5d
SHA256ec8fe7fa55d6a4c527f4832ba9e6690732439cc20c691f46e5c50aa66c80cc43
SHA512644e038d4b216d89b7d7ded0b3f88a326b0a4248c96eb5c6b6e5e9861d663f53baf7bab01c75e1afd2ee91d2c80d2ed37bfcc6111e7e2d4d16d5d279e353bab3
-
Filesize
5.2MB
MD5bee74bc5612701f09f349673a3ed156c
SHA1df23bc1fe7e88946a5a15a3c51917791edfcafd9
SHA2566b7a4992c05ec8d247d3ed9760e295593a998fb10e4399101a2e269cbed8828c
SHA5129a4afda1c26dd719c71d3d1bef4184ec8a54cc548738a6e08e1d14361b63767132f3c9a700e27cd421aadc3a1d1ff01fcde942bb5257b18be298b4a98a9602ec
-
Filesize
5.2MB
MD5c0b0ea418a8703955eed51a6d4140a28
SHA16e82c8cb683fb359006e7a3e2b5cbafb6b1dff89
SHA2561a64faaabc6f93a52a3b62ed9bdbdbf7b8b3d43f5477ef98d7a19a8dca195100
SHA512a7dd448a8402f87f1d7f5677884c93885c1c2d31b44ca7e689e5865f2c7a90125a208332a027f892064379cf2c788edb03d81f03ac0dd75e185e34f403717b66
-
Filesize
5.2MB
MD55d4e3ee47d49b6807c1038af78930965
SHA110310621a0e61a51a91cdda19b9102103da24296
SHA256788ef7d4212e7ac61e9f7b935c609f23e59c79fbf5b0e8cc1668043063f5f167
SHA512087d3a78f745544ff932932389ac5c1f35add39a0b6fae2fd78e33eb7c0a2d837eaf953edf28f5fd991644da016b0efb99eff33bf02d6030cb87f17b279f10f2
-
Filesize
5.2MB
MD5a57eca8983f3bd9bd4f6723452d49806
SHA1377cbee0e01f79dc3779aab8377859acec274432
SHA256731dc2da6001385425f7f7a74360611bde59f4de8135df4a0e893a58f8f41b9b
SHA512105205450b83ebe587ec4acc76ab0e345f3cab8f01f0cafaa8c31af5d1b9cf662bbb275846d51560bcb762fb7f1c6c54a4fce47bd7cf251a7094edc0554746b9
-
Filesize
5.2MB
MD594cccbac85136d946bf7811d47ee09fa
SHA1f0368c787dd48017db4a17aba125d0bdb2a17e8d
SHA25638963ba972730479172e9ba722ca7f552744680a0f5924aaca4b5b66b9649735
SHA51284a6424ad151b36cb163bd55d8e14ac1f712da83f2a8111a30ecdaa9cbf7f17a7a3d13844ea41bf7a088b9fac03a72a951677a20d881c718ae3d13dec1bfe074
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB