Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 01:00
General
-
Target
2024-09-23_ca0239d46ae31a6cc6de879cf449c23b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ca0239d46ae31a6cc6de879cf449c23b
-
SHA1
8461b3d40bc33f8cc605bc0beaf4bb8da58efaab
-
SHA256
f89416604242e04b86f02e2bec94319d68a01775ee3464a12643351669742bf7
-
SHA512
650c0d29dff6889965d362a60a887199e00e616e46c51d8a656a222bea8f632c6b98fa4a979e233f3ef888b4e3680edbbe36d6501d2fb46fca71f82bac2eaeef
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_ca0239d46ae31a6cc6de879cf449c23b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_ca0239d46ae31a6cc6de879cf449c23b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tVleLNZ.exeC:\Windows\System\tVleLNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nchFyxi.exeC:\Windows\System\nchFyxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfZmcyf.exeC:\Windows\System\wfZmcyf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlHrDFr.exeC:\Windows\System\JlHrDFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RKpDuKi.exeC:\Windows\System\RKpDuKi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCZqlGH.exeC:\Windows\System\CCZqlGH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BqpGZyy.exeC:\Windows\System\BqpGZyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GDtEmxG.exeC:\Windows\System\GDtEmxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GmRJjDg.exeC:\Windows\System\GmRJjDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNUgrJb.exeC:\Windows\System\SNUgrJb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wLquVAT.exeC:\Windows\System\wLquVAT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jYmhKVn.exeC:\Windows\System\jYmhKVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kEBUzib.exeC:\Windows\System\kEBUzib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZAoxyP.exeC:\Windows\System\JZAoxyP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMWOfCO.exeC:\Windows\System\yMWOfCO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWmasBo.exeC:\Windows\System\eWmasBo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coeEwVl.exeC:\Windows\System\coeEwVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljxQOZT.exeC:\Windows\System\ljxQOZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EZHPFEo.exeC:\Windows\System\EZHPFEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fRmpxhx.exeC:\Windows\System\fRmpxhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZzCByb.exeC:\Windows\System\IZzCByb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54d117f0b037e8da0a33f806444a04722
SHA1f7f762f7f44b0c69b1a5d1e5449fd5ec462a313d
SHA2560ebd4155c4c5818244cde6f8de95a7f0e2380682e8292d41a5a314ae200451a3
SHA512c9013e57140c96813084efdcea0658d4e1ad303ff2c86513019606c2eb914f076dd5cc36c66ead34066160010e71c6c14ac29021b0fefb884b723c066634d465
-
Filesize
5.2MB
MD5e0af8fc2a30de3f930e38fa8e8763a0b
SHA1ae2f406a1cfe048d6b4a7eccb37d83562132e16a
SHA25647cc9c0612e55346ae6067b9356f3b9e96df341682a12802798fbbf65a2522b0
SHA51288f9f9f63cd6e6775543b7a32cf338fc5a0ec899dfa1f82229c758f1b6c0a62ed50231f709ac139221dd86bdf653855d481dd8588c7ee5c59739b839fb87fd41
-
Filesize
5.2MB
MD5ba6f0f9b3bb542e257ee6a473bf41fc5
SHA1133edadd27c8ee511d5b076ed4f62460fa1472cd
SHA256d63bf0933529e348c430b863a73f3f6fe43886f79dbc4e39e1d2717870e9e9f6
SHA5124113fa96ab369fdcc96f213afe17ee9aa1d9271a80f8c00cd78a71f5ad793c90ca368b0b9f98801779b6ba1dd303f51ca84a3c235e99a04b85e4e9f9e95b44d4
-
Filesize
5.2MB
MD50a3262ac7bfce0a995399e8ddd5e54f6
SHA17e15ac0c48b573d7d87c8ea6a63da7d4f3b6062a
SHA256ac0bbd989aab46c338806ea2932ef4dc32d04990cb0a740c8d7a07379adec7c1
SHA512733e5cbd19dba389a871a90d8e5df01f8c23745341e9cb2622511678465ad4ab7d0bf9a4c4de06f7597b85a22ebb5b16fcc192f09f94a33bbe1bc85bd3f275b6
-
Filesize
5.2MB
MD50f47d0ecb7df61b34619ba818e9a295b
SHA1a724f50d6360e79524a86b4ec69701ce0a41e03e
SHA256b73b3a1c6b91ec933ae12e673be9a087b5345c6c1277a900b5dc1017c2a52b6f
SHA51284f03dec1f996fae0e9f99f397832068ee10e30e2aa3665f3ce620c5999687a0f724485b8e2efe58f96613968b331ee057ccb13ee5d5934d0e302d7be978c543
-
Filesize
5.2MB
MD5c137007c3cf19bf4421c1def9ce08a6f
SHA1ef4389678e95fff1a6538e682eb7eb271cd09dd8
SHA256e93233904890e08cb949855d9a3d41b82f6ade42b655bbaaaab71abe8b65807f
SHA512cd83e372cccfbc95d25c5069ffeb7d5fa4c542198a5a6bab14d0a00600d107ae0d46aeedc2b1d6e0f5ba8330ba318b685f18bb7cf49c0db82fbcc833277bb123
-
Filesize
5.2MB
MD59daa69d8576fe2e8c953c22caa1fc393
SHA1451607a3da170dfa0f68a8d775bc53f73cea28f0
SHA25638149d6ad05d32d5d11e3eaeab8d09cc89fb7813d5055d05a91a0ae87fce0207
SHA51256af95666f8fa45c51994b38cce9d5d0811e7260f21cc381b4040c98ae0858244aef67e7f2c3bb165572aaf62c6c8db6bdb6cc8c1cad184ee232da18de3fcf2d
-
Filesize
5.2MB
MD5e29eb641c69f13a47b5c20e98ff683d8
SHA1d6983abc90013fee19bbbedb447c8868c8a552e6
SHA256a51d36d01bd6071996c72272284ea6fa86852a819b3a7214df3de729056b9bfc
SHA512d1f4202641afadddf855787f0a1e871d927de9ec340491650f9a6fd8af4230041722ca4874e16fd5586bfe93a6daf4211b31bf12e75350ac04c57d37da533aad
-
Filesize
5.2MB
MD5318231732255d26d2c231f50d1f46cf1
SHA1d00ec17c54db1a66bad88c2c1c8cefc21ae70092
SHA2568fcdf1fcc78c390ecd18ac94563863a7e71058a48ab8d9c40097209df0ed3b6c
SHA512377e2cfb405a208bac54bb668f4541c8576c3fadc38a03534b8bcef0cf5dedb198acd0a4256110b913dd1a53c668dc4b68971a9ae8a662b7522a4b30274c9a72
-
Filesize
5.2MB
MD528f9e004ddf861200a3ab6b332004f3f
SHA170abbaf95c8d15c62dddba519b82206e3384bc76
SHA25643eab32095327568c064209065e4a8f0852d078d2f7b5dbfd27218c44e122733
SHA512856779d046f0d5a1887e55c604bed6447311c2430da9aebcec90424249edffb988ecc20f96e5cabb65b68b535480db2e5df0363b29fc85679c63f1cdd7e48ab9
-
Filesize
5.2MB
MD580333c10c76393f02fa71274b5d91b97
SHA117735f33ed5db79545eaa9ba01a7be34c9855900
SHA2562bf6069f2a52d44b63936ceff113a2d9da53a9665c57c72abc2992d7c28a22ee
SHA512012f325c812b231adef5494edd34711b2a142146cd1e6a82727c53b7eb7a55f094383c0ca82eb27229880a2e95c1dc08f3155b470e2387ce59025cbaba7bb9d8
-
Filesize
5.2MB
MD5cf20a3dc9b135b4553294287420b620e
SHA15e457b5077650db89217b0cc82318251749d8bd5
SHA2568be90e69dab34aca3f039b1f30e6001618bab502feafa56774f6d5ae4f0c38b8
SHA5127246e6ddd7cc9f6c721d688080ea6fcd6fea8f4ae34ac07955b05e3580202f7724bbed701ab7877ca4928fc398d8f3e2fbd697a347080253ee9047ce284bab86
-
Filesize
5.2MB
MD5fdf333813bd86447b26ae7b4f906b331
SHA1bf6b1dfbead4487a8f555bd0ad16f8d855c42459
SHA2560e569941cb215c13de869bc771b0d308684d8bf60f07c009aa09a1925695461e
SHA512cc0a4e18f632e31dd5d4cfddb35a3fbffb4f5d3f3a3f1550403a8d64125e412fcac78bd4b2f996f72735c6d3650cc71fa812672d37e049efe61790b4dea1c32c
-
Filesize
5.2MB
MD557e9f979127d3243160a8178c0f00f85
SHA16ece88b25760aabb039f47c592605d37dd38bad2
SHA256eff16229575682b60b2109e6a88f1ffb003de1b04dd056fc4fa1496a41f5fb7e
SHA5129cb8f0ee0176c9bb8c31daf89fae6625feba8716a7a966cab9d10bca3ab8cce708fa4f5dc388de9da3e3faa86f483adda00aef8096ac713348d3c4a950691bf3
-
Filesize
5.2MB
MD55cf55ffd76b0b3d3f5da49f8e8aba0de
SHA12e90ba56205c54939a4b30e72a9562f8f8c8fd20
SHA2567d7095558ea02773613d13177e27c19329213d0984b064e9d392b38750d0e117
SHA5123b28cbec6c54aa5dc06d2609c399e03889ef9ad6cd279d6cf9ffdf66366520eda60a8ef0147cef500f3b7acdb24bcb9ec10f0064c71b56ab9bada60438f76833
-
Filesize
5.2MB
MD5e2a758305ade3f6c1374398cfb2e3115
SHA1fbb7a3b92539d81042187a74b4891a62f7c887a5
SHA256e361b8a74c4f867029fb7b998557273061fa78da7bcb4e5c6caa6a870939d06f
SHA5123a4f193cf79ea330bc0fdc812fc69970c7ad3ebac14c2f72a92f823e87f23fb7fa35c8a3ad3be2dff543b7119dfb3893879932e350b321265efbc236897884ff
-
Filesize
5.2MB
MD5e5f40af5db95574fa08c44030691767f
SHA1e8f318fbe86e3a3088ef72b1ca676d361d4bd997
SHA256801aa3dd5bfb0e176ce337325f014d889f3661fd5c46b64127681910d50c5319
SHA512634c0e8c286ca927c2843eb29447a7296fcf7f7e3d2c073621a5432e6476fb27670a68226287c8a41531391be608cb8535eff5c49ae459aacdb17754e76357e0
-
Filesize
5.2MB
MD5c5d13cf678f263aa4af683c95eb4661d
SHA19ee9cb359b7a99396a83bb010bad5e880442a4b9
SHA256fd2f3cc930b3606049a065c5144a00b0a599ea91c126a7d8f5b32d7dc42b83a6
SHA5128f8230c5917dee26a6e11edb2b4e81b01cec769cc2f06545084efa9978caf1f447bb8a68de5599fdcd1cd9ca1ccc3da75fa6ce691d7d9c6019ea4ea020ce50dc
-
Filesize
5.2MB
MD57ace0256eafec3bd3865736cc591a059
SHA186f8c4283e1a0175514efbe2aef8aaea405175e8
SHA2566d80b36218fa8998f49130746efafa6d8fc5931bf842b0b057e2b80f45393b98
SHA51264f57ed5ca747fc4bc886a5c4fdaa79048233cbe23c37f72f1dfac65c0709bab81934d218174fbb1d731706cb44ecf9a35a779f006eeb3fbd212f584bbc4a5e9
-
Filesize
5.2MB
MD5a8451d0d4830dc1ae46cd4456218939a
SHA18c3686d533f10b20276c4a4be2973ddb6ee52bd2
SHA256ddb7c2b8680574ea709f3c91239cd2be40cd75427747fc7e376963070206ce7f
SHA512f6803a5318d1ac15ba44e703a7fde7b5c121c34a7582d23df1a2eda7d6102661acc9c6ac1f9256e7b6856c73ad1b4f38874ed052876a46d91dc944d811d712b9
-
Filesize
5.2MB
MD532039668b8fcd36fb56fc329d1cdb483
SHA12217915cd9094caa0624b93bf766b847059e021a
SHA256cd62a4f26d57655f47507eb888aa6c815775da1aef7cadb2f70afea11bf77bd3
SHA512769bf59978eceb1a04ce6c5f56a308647c32aac8c92ab87119ae3ac4a3e5e7d3240fe9f4efe6209f9e00442d2fc2bf146b168b2f5de6bbbf922e7c47b8e9f007
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB