Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-09-2024 10:47
General
-
Target
2024-09-23_520d3daadbdb87a640a7fb7108442c3b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
520d3daadbdb87a640a7fb7108442c3b
-
SHA1
acb516f39897c25c2ba3510050a1c58ca92bcac7
-
SHA256
8d71809a792b604417ec79280564f8a687361ae12f3e4f705a04deba68b1663b
-
SHA512
2c6621b2a7c11d8d0f03fa18e5021ce724cf77b0caa729f1829d8495929408768d2b8be2e91fd9a0e47148c311588afffe38a97fdccbbaffdf059d059b63bedb
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_520d3daadbdb87a640a7fb7108442c3b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_520d3daadbdb87a640a7fb7108442c3b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mILrhqf.exeC:\Windows\System\mILrhqf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kWKqQaH.exeC:\Windows\System\kWKqQaH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVHcWkR.exeC:\Windows\System\OVHcWkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dUlFgot.exeC:\Windows\System\dUlFgot.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tChbOJP.exeC:\Windows\System\tChbOJP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZSlDRr.exeC:\Windows\System\wZSlDRr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlTawED.exeC:\Windows\System\nlTawED.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yQWkEfx.exeC:\Windows\System\yQWkEfx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nnulzZP.exeC:\Windows\System\nnulzZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ewLAvhY.exeC:\Windows\System\ewLAvhY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TghMmni.exeC:\Windows\System\TghMmni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxafHdK.exeC:\Windows\System\wxafHdK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odWvZga.exeC:\Windows\System\odWvZga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MeXjwGG.exeC:\Windows\System\MeXjwGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBXFjwP.exeC:\Windows\System\BBXFjwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jseYwsU.exeC:\Windows\System\jseYwsU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhcChBc.exeC:\Windows\System\NhcChBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmvuvBC.exeC:\Windows\System\BmvuvBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HnwjTEf.exeC:\Windows\System\HnwjTEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cadYDbf.exeC:\Windows\System\cadYDbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwrjobi.exeC:\Windows\System\vwrjobi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5199d3ef252dab108e9683102d0236ce9
SHA1c655ef55a11569a8e4c78dc385250f3469e163fb
SHA2568285a90fd361e7db66cbc028694923e660aa5fb60d188513004996d142fa7a78
SHA512a9a88276b688febe2cf5ad00261fd940a4815e760ccfe33aa77637de596ec763984aeb4938b1b5c0c400cc13f80e91145c3edbd61cd3c1cf050bfd022c14c28e
-
Filesize
5.9MB
MD571299327f4f5d831055378b7763eb0d7
SHA1e93cecf699c476d3a44e7a1d4f4930869df91008
SHA2561439879ecc0f8b3cab33233b412f59c91d8c09ed0dd95ad63bf3a035b16b9148
SHA512986f2777b7458a6c2c9911544399c3bb3e42cc9ea7d933d97e838b4594f35d6ad596ea86e851935cb7374a9fddff4f856e00c56bdd69cb1ec8ec5fc9f33a2cdc
-
Filesize
5.9MB
MD500a65bcf31f59d7ad19e52231d56801d
SHA1ff014c24f6e886ebef289a613b8a62756c18ebac
SHA2563fe42c50c380293e54d74a0c8174549d9e3454b5628985b3e507cbe5ef089ff5
SHA5129f5ccd7c46d45a1b192011d6f4afc6fe53e210a8a3c8cd4c4b58f2a8c1d2aa2d0814526ff682b9d5e03009f34d8d30210a653c016953bd1b86af530cf888fb48
-
Filesize
5.9MB
MD5689811509e68038b39f7555f40b736c3
SHA19e135023de0bd64a18acac6e602acab8c32a1330
SHA256c4d8ac650efd8fb54d9e395eda2c07536c6c52fe1539203a6486303f42125432
SHA512aaf325aa450fcc10fcb32e300fb919fcfbe5a91aed72dbd6d06885c67fe4b3616671efa2167cebff977b84ed456d847b821fa516c5d9f7719b4a8730a6f4070a
-
Filesize
5.9MB
MD5c344a07171a91f66c2dd45203ad20b70
SHA1d65879c4d0756a7faa7099bf79fa07c0cf739faf
SHA2569db21743c9f79305b7c87bcbb9e10fd891afd3354606bdf104ee8b8a30ce1854
SHA51290637df8a174f30cdec1275ca2d9b9ce69f9544a19ace9b0b2157c5acf943bc670ed042e529d71faa50341386aa62a87478199938ce0444055c29b7797f52bce
-
Filesize
5.9MB
MD54907b79799a4cb4df0499f698ada2be9
SHA1c9d799185d71aa05bfdc7e4ba7e4a19fb1b48d0c
SHA256dabe3c69bc23143183a346369e1688070ae608cd874420930f8df5d46c10b8c8
SHA512b00b584b1a58db0887808ef2667fc212fe1d52c1922f6b664eb5023e6c52d3fbe73e5de7bfcab4481004afba54bc9f0c2657478642c0026c5a9abf768aef688d
-
Filesize
5.9MB
MD59d5bd36043e1b9335e611232cf5829a7
SHA1f14518bf39b831ba07d311a882594988ce784b08
SHA256fa977f09c72d78b4f32ef8a10e729c187b9c91868916120a5c9d035633ca4ddf
SHA5127a1b5978318c367a8409a6df1070b9c3e4153a285433aa673cd45d2c7b527d2ca742d5e2709437f0147e116faa4b5111e5849c8c740bdbd8fbe7414e74fe30ec
-
Filesize
5.9MB
MD58a4f6de607a828ee30978b53a01b4e65
SHA1d892026dee601286c801bdbd1638d96c5ef9a3e9
SHA256416e09b1c78927bbfef36ab11ab3befdcb8722a695ddcfdd9a0d745d2a88d3a5
SHA5121bf4e3e3a8b26c73b933165341c7402601b41f6fd6d91563b2e9576d8cbc6286792a0c248b6f9891280a8431a97079068946e0ba0f72fd4b3e486f352e71079d
-
Filesize
5.9MB
MD526aef11971653ebbdb40a972783b7cbe
SHA12abf419ca44ee925e129dbceb6755b594654e5b5
SHA2561bab457af4d11927527c5e741e677754dcaca96ce6e0d4304d63659d05920b21
SHA512ada451e751f170999ebdf55a096cabd0ee92aba2d9946fad987e7ec309c58e1e6a5a7af13d73580765475944b50d914baa02ee4b64f8fef9722cc95856ab5073
-
Filesize
5.9MB
MD5c8fde865839e9cb72f5ed2eeddcbeb73
SHA1b73d1848b77d34dff1f5304e2c6b4eb2f2426778
SHA2564464a7071bd68e84dcf772f617b80302c0aa68663851256b84fe17e1cb4e394d
SHA5128c572bc4e1446d722e6201b84d68b6f4e9f92db50dc0c9947bfda47eb82da3ade2b92c0c58b1e5fb39c410ca86c9968e0ee0becc918f1a9139d7e72f3a41a511
-
Filesize
5.9MB
MD5fecf84b11ba55ebda6ab762bb33eb575
SHA123223092ecc53849bab9dbe130d3141f023a4be7
SHA256ea11711003821e681009c430d6b3b1ab4bacefffde50503f71d4c7ad5044dff3
SHA512f2d11fa223d6968eaaddca4c5d8a99799c1869da7fb4b381361a0a9ab5fc8e67cccec9ac45028496b1cecee4614e708536a5e0a604570c84b1efdbe97067626c
-
Filesize
5.9MB
MD5c9528dbc4b98c04f9ac0a9f6c3085716
SHA100de31e94cc120dddb0e16309ed035dcec57c277
SHA256ab9fb87976b67e69752eee3de2b89787abb0cd7dd9f23c508d30dd86b001bab9
SHA5124493f02c4420af21527e3471a603f9ab8d6e25bad2d68c1d7e5e9f79376e91e431658436e8aede24122a8e244d1eab287317b337e2f5edfe414cb2f479459b23
-
Filesize
5.9MB
MD589b509f48a61480a5b6782b5b9089bc9
SHA1c35975cbee5874ef07ae20e9b9c22b21cd3cd744
SHA256ec46ccc1cf6b7863b53bfb30323d62ef2c6ef7d816b101ab19dd6cc1a51dbf16
SHA512d33da2644906da99aabc73f17e44feb22e60616f3689d1211c47061965e55df89ae5de0afc0d4d72c4b6bcbed52c543a84533335213fd02ceae9a3bca1d72fd5
-
Filesize
5.9MB
MD5402943635c04f4b235ca9140debfec38
SHA190afe26d32557ad03c770bef6ca5ec7c13dd1a1f
SHA25600064a5619f3ce95c21ca10e7b647426bb5fc73d67460a92269043edb2b574d7
SHA512fd7d9b07b6becd8d7b6139c0303f59448c9c3c9086e5b8b706e3d40ca2d84b7ab595bb391291cf07c433ce29cc7cbbd1e5780d31c64cc6a0cd749940220962c7
-
Filesize
5.9MB
MD5c7ae82b5a4937527463c7309b0baa033
SHA1e0d2ba87160e0016e0da899b438ee8ecbcd8bd10
SHA25638000ca3886ae11afc2605db4fc7347e5356317c558f9f32a9bc217c9f945e89
SHA51232d87f4d88a7b15fb2f3a689d9abece390caf3b4cf0cda56e3a92988a0b331ce5eb1e6adc63ededdcd7e597fe90e6e69c6d944c59b41cf5b3647e3acc73877bc
-
Filesize
5.9MB
MD52124d21f7ff662b5e3da1eac5d3220f8
SHA13b21725a45cecb5fd4b657abf0e0825e9963db07
SHA2567db8c9669271168912a242458eeb52f8f8c38eb2c84c248bf3f8e73ed4c7bc1e
SHA512c1ec51fb6c5fa20ef237e21855395be4d0fd1ba73875f2881c0811f68e9405b62fe1aa034cc60c7b3fa45ebe1029608d5ddcd15dccb20b96a91d720cd32db479
-
Filesize
5.9MB
MD5171886b3b57657598fcf9771edd2f9c6
SHA1281b2472c8c7769d62a79e181d8f717e479fcea0
SHA256c90bf38a1ba31506c7e19318198e23e933cbdaf8c18a6238219441a0183faa41
SHA512e22d5c777550d7e800e7e4344dba0d23e28b833dce8cbd9d96498fc814731ae705bcf1b8b4d754ea7850bf3456781121f7f56e845ccd687a9ec01622bccd08ba
-
Filesize
5.9MB
MD5689334c73b7456cc11dfdc41296ce104
SHA1737e057ee5a1a03ef0500826f52a5d69b3690568
SHA2564d787631e8fc57d8e8faff09879d7609a6b906d0b8dccb2da57fbd9e74a3ea2b
SHA512e20dd9a2efe3f5c505b9cfa9d171a3d7e8a28ae5d8421ea2aac3c51690e1ea0d7bdcdcc6e02e94a3d709d9c32577ed29d45414866d9127a05a59126cd7cab356
-
Filesize
5.9MB
MD5867374afd29cb5f2e0e3073b8329c3ad
SHA18a061b85c521e5cee6c3239c2653db73f46f061d
SHA25621038e71e1b49d74319c2e030d0a3f7212c63488bb3d5f749428014a668ba1c0
SHA5128705de139c98094d3d4ec4c468230e0658e74d3cbb785e782a6b0b51586c995967bceb96f2adfc77d0e5663d04ea2f97a132202d6af46ad64a47149cef50155e
-
Filesize
5.9MB
MD53acfcac30b6e19c58acf807d8544583c
SHA192493ad5b9f4194907fd68c21f4cbc585f9597fe
SHA256b9a3fbb90373a5062402085efbb852d5a72acc1b43a48937dc148ce436965afc
SHA51283acddbfd071b7c3954cafc6cfc80a76040a8f208d88fed156e322a0e480266709cab46c4770b6fc46514122f00371d43def2f0e3a49374ad8304bdc17b7596b
-
Filesize
5.9MB
MD51e74283e111f65f3bf5df1dc83a48127
SHA17960bcf17256de588730412ba94ef2fa82c90495
SHA256dcb5b3c24e59a7afef354212798261daf48dad9f63bde4c8b1fb72643576ce88
SHA51248f8b71a728969bfcbcecba5442df51aecc59dab32cedba8093d76422c57d1e666e546fe73f41d3ee7cfa974bbcd632387f4493cba69fca45308faabd2431380
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB