Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 15:48
General
-
Target
2024-09-25_978a92d526dba4bfd78830414f514281_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
978a92d526dba4bfd78830414f514281
-
SHA1
4b6e34f923ac8b7df41820281aa6a3c644df3462
-
SHA256
d907e638cbf32ebc28fb0e53712e71dfecbabb7659dd01b34a9f80d79f1ec070
-
SHA512
c13bb7096a5bbb2b54fd1741016298de9217abf7f741d3fd362969351493af0042ac5a7ab435e951ed9bf0cf4942943a6f9de925113f95a76f0beae1479b1f7a
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_978a92d526dba4bfd78830414f514281_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_978a92d526dba4bfd78830414f514281_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KTLgDUb.exeC:\Windows\System\KTLgDUb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSqYgHu.exeC:\Windows\System\oSqYgHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RofAqNJ.exeC:\Windows\System\RofAqNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SoHqmXh.exeC:\Windows\System\SoHqmXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrYroGg.exeC:\Windows\System\BrYroGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TyAhVdx.exeC:\Windows\System\TyAhVdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZZesTuY.exeC:\Windows\System\ZZesTuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Dpsrqhb.exeC:\Windows\System\Dpsrqhb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IkvJhYI.exeC:\Windows\System\IkvJhYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMstHCR.exeC:\Windows\System\oMstHCR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdjBDqe.exeC:\Windows\System\WdjBDqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VuZDwUm.exeC:\Windows\System\VuZDwUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fntKJRN.exeC:\Windows\System\fntKJRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wtXPYsw.exeC:\Windows\System\wtXPYsw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qpitENB.exeC:\Windows\System\qpitENB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbStWGk.exeC:\Windows\System\FbStWGk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpVmFSS.exeC:\Windows\System\mpVmFSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BhorohP.exeC:\Windows\System\BhorohP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqOSfCV.exeC:\Windows\System\yqOSfCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhesmeO.exeC:\Windows\System\mhesmeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tnFaKhk.exeC:\Windows\System\tnFaKhk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5603fea9539be13a03e225e762020c252
SHA17eed07891856f28001b5c1bb0958eea10ff6237a
SHA25658f699604a17f44c5b26c5441510d7ecdd1e71d3fc2caeb830146e4c0abc318c
SHA512e82f3b2528ea3857c52f594e6b94eff78e8668ed3731a7b3a975ac6b96335e0f88a692985d14b2cc3ac9af55f1a812318abf2633e88f4ac52ec0dc39711ac305
-
Filesize
5.9MB
MD5a0712f1120daa6584e51b9d714cdc40a
SHA10abc536d1d69bc0568e9a2425022090c11742fde
SHA256c7a24269af384e66a58779e9c6aed7a0107e1b18b117e38c89478ceaba20f2b1
SHA5124ea76cc6a024eaf14f39f123e6d10b776201388f403aea8e4c1fcf2fee63a3bdf37dc4cee4c044e9d74bfa2372d89cbae5306e2f939c66f9b6e4e1475c5e0ac4
-
Filesize
5.9MB
MD5a8c7ad15243606d6dfdc504e9c9127b6
SHA137b180941c3e03e6dc8daf41870f1f2636b54f20
SHA2569e6690c177096859c1b25b3c5a6372ba8740c84a44faea7a6ab3fcb6b0ce271b
SHA512e18c15366a4c60cbec70de0596bd9bab155594d463ed2d1a446fd36ccdf40c2dee293cc9e9501c1725f22a56e61bd792e00809676987c778c2803fda47e8733c
-
Filesize
5.9MB
MD57764fc4d460a1c01cd24cae0203ee056
SHA1fd4c64892a9fb946248797dbd6eb0e82d0b56367
SHA2563465d028790ba1549996a1c58a8fb3fe07dbf8ca8de46ad77b63ce631191ee23
SHA512a54682436a3f09b110ab6cf817fd040d32a0dc95b186a5d85afd6db6eca6586ed42f57c56b4d1210114995650dccc244a2278cb977e6ee81e0a74f8896321d13
-
Filesize
5.9MB
MD51e1a867082e932c5e30f67e1144a1d27
SHA18ad4ae6b793d3fac65eaa3ff824a64e794d5aede
SHA256b4c608155629becd966b14f1a911e32df6051e5f2020b64d37896b5be5255f5b
SHA512bcb82de58c10d1bfcde2876cd4a544b440bfbb6cb3ea2b3c3f808f65da66284af9c347bb5aec878ef6df8110e6121c2d68bffc422d41c68221a1557f887f5e35
-
Filesize
5.9MB
MD55542f8601e04c3e3cefa5faabe054128
SHA19026d787a4710fe126fcc673397625f824256429
SHA256d51e86def1058e84b79644bbef36723956c4796c056184b0d36408d02c7d7cc3
SHA5121c33e041ce43937d9941ab9a8d3cac46907c5b93b2cabffd6e9f4e13a8b0a404eb22b3e51318ecd8b9aa1523982f0cd17af8aaf668f536b6c0ff4a4b5a42de3f
-
Filesize
5.9MB
MD5658847cd3e00d56a04e6e6289eca3960
SHA15aa8058349252e0bc2c681e32d79ec57c4571656
SHA256e729a2dea9f820e0a26e289c72ba18186486e017dc3f276ad90d40fcd20bfd46
SHA5126bd1ef1c47441f8325a0cc51cead39d1f6c3934c721a9c80b32d2bd97066c4c6b91b017f4363dbf0f76707822f73b0e67d19adb8e09aa38adfbb0362bd07eb03
-
Filesize
5.9MB
MD5133faba89fc6dbd0766890cbcae58e0f
SHA117fce542664b3de104db66b8cfb9aa3b27f97b0d
SHA2565db8e63c246805bab88083605f40a6be64797e1a2a4261b82beda474e9916196
SHA5121f3b9771d0ffcb9e526e03511fd05fe7af311c52efda40c4ccef608909954ebc11c9ac2247259b064ca52884d13cde55ad192df483be3f277408f3cc6827bae6
-
Filesize
5.9MB
MD504ea87a97ffd57e29519ace3498b53c9
SHA1f199d39449a92fb8ba3b935d17837d2fad89e558
SHA256f908df03c909ac37c832805e179212ddf34116873a08e8d255dd6b160dd1804f
SHA512c47b6b0197a534840ce6a2e4091778f25bab213f6cabc39bdf008fd64f3470df93f1ee3589e7330bfe03337ad53192f4680e94e2b8405a11e159d395188308fa
-
Filesize
5.9MB
MD5437dc5b622e7ab323b8fc18b541801be
SHA192948882876859914dde1f670db9d9bdf9fd8e30
SHA25698e9d4f1d51e18064fe4e08ea291f73cb546c7c5552256acb86ff218894011a4
SHA5127ff0bc4c1f332de12269354c67ae7e80e269856fb240c683fa36c7a3ad61fd2fca3f38808958df6ce0975083cd24e9997f7fadc9cb1ba5b844831abb58226f70
-
Filesize
5.9MB
MD5a3da9591f5e67f79d75d4506540c7dc9
SHA1342913e70ee5a03a98f0a2e909b2ae345ad40b35
SHA2564724c4b3748864854172215bad0ec6e2ddc59d518fbf5bbd5a9e8dc503dced2c
SHA512bf478276f35d3159131ee544bf94fec77e4b28ee95f14b49c99384dbbf6f4d1bed970e425165a8743fda585c37e5a27afead5e93de8e40383e5f79488f73219f
-
Filesize
5.9MB
MD520505e7a2ad19cd7c10019fa557f3c5b
SHA1bb930b4e47b3f7cd19f6f1720a2ed55d4b4243c0
SHA256904043d2c6850e42366241cd1ff046d8dcc2fbd726c4d5785c0f965696a4b3be
SHA51200c1d6629bed67f0a80385f7c92bb6b6341d43045444c0de19c51b34111777c015005b0694f82344552000d55c42fb40ece8af31b31302f10909849fcff69f3e
-
Filesize
5.9MB
MD55bdec696e34bce16029076d3797fcf4f
SHA12a603c183a6ec690518adab482c4abc3758973dc
SHA256bd9bf670ed5b7281691fbf317b841c81485e3e5e22ab429a36b34fb73a983148
SHA512111cfacfe545d5b3246c7baecf3eebc3d3075f922e617516e08ad4b8e6b984c00f9f9a80ddb85f998bc127961ca8300ee62ae210629959ec2b7d7f6909bcce35
-
Filesize
5.9MB
MD57888f98b23fa5ec435939eb1561e701a
SHA1d7e543bc68d78182555093875e380953edce3f5d
SHA2561c97adb5b626cb0edffcd07b306784ef0d0ff3a5937611b4a598cdc04241c411
SHA5129b22f98b33a5d43d1bfad4407c494aa14ee26442a12607efc70c8660827d863172305f4bc1ff076e5989e853041f5516bc3459efa06b0610be3ca01f6b1b5751
-
Filesize
5.9MB
MD5cfbdcbd7c0e6c3619fe7e65d098789b5
SHA179ecb58da4e321fd69d4f3433114c773ae9a1d66
SHA256da22b909cfd87d34e561b7178b5ef20766092c2ae8b05a2b995610dbd21ecc92
SHA512c9c51b424f3c7939f140fee7e44336816a2083f4d9c1574c0ee30b05c376740519894a65d5cce87eacf4badccfa37484eaa3f251926901b910656c571effc572
-
Filesize
5.9MB
MD5bb7a981c12a62831c1bcf4f084e18713
SHA1eea3c1b74f43868a502213c366a5e47bb094f75f
SHA2569976ca2c3c30b98c98b36681ed23850aeeeb01a8854240a23b60171379fa711c
SHA5125e072a0601c0e8bba8fb1cdcb3de06ef07119a539e481727ab3ee32ea330570b281ddbf07380764fc70093140464fda7c814015204de86626b206db3c1bcf266
-
Filesize
5.9MB
MD5c300c1ad4356d490b45f2848680ab004
SHA1b71611f2db8641e5cd9735e61abd52e725fa3085
SHA256cbcf7a5dea5328d924d4689d16f25c3c092f1d0f2ac0e952a793dff7dcfae059
SHA512776a3908d2095c82e209c7e5cbd1a662a084d8ccfe10589e08ac5a24b3ab1f3c7ab16088938bc3c5cc343348d3df09e41bf38f3e8cc219d3610a245eae0ee507
-
Filesize
5.9MB
MD582e7c78b6a98fa11fd2b13495551d451
SHA1bf35d4f93ba4c1c73293044821dd634ff8e16dcc
SHA2565b4851473f4d6dfa0be8bf5a1306aba5d879a2b9e5d8b9da80ff16bd023ff580
SHA512fbbdc4dce9bf4e49dab7532d80a776020ebd3520f5c479f5c4953772fd50ebbfb50105568a54a7dd8b17fbc51b881e297b6239f31f9de8257dbe77a7e36b8ba7
-
Filesize
5.9MB
MD51827f190728a263a3976e62dfdcc02cb
SHA12b2eeb580b9ea2815b7f82db4ef7e4b64507d101
SHA25608036976c13136689dab1bc0c611144b0e7ccc010e00d2506bf2848a8d7be623
SHA512b953c3ebb1df2c4fd8028dacde18812fc8b10214fa6c6e22f6fdae4b04f542ddec5704d693027a126e9763458ff028c2f2561479c95696312655beb7dc653d73
-
Filesize
5.9MB
MD5056329d218c99da1521b5dd2ca8b7002
SHA11e2427c0aacfb219e015c9a8b18858265dde7a26
SHA256e59c60e5891c3744cc96647e711f95e9b42dc94b969f55114368621226d12957
SHA512c33cf280da7bd6294c62599240110d2843090d763bb2ab3fe41bd8a32faffbc8f52ee6b42ab9eddd94d0ae0db96b8e0763ef30456e154cd67dd5ebc9befe1526
-
Filesize
5.9MB
MD54fa99c62887ea94522f19ba598ab029b
SHA16d5cda898b892d6ac37a9bb6d9aee1c0fb5ff352
SHA256c57ce2fc79ec312ba5ffe259e5b945b7756812b05c80cfdc22d6e960932c9d29
SHA512f41092eadbe86ff043af527ba824c955ab2bcb3641e5a3391f40fb561721279e48352d2efdf063733a20a9411e1f9d7614072a1be2b92aed37436cb9f4403141
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB