Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 15:47
General
-
Target
2024-09-25_7d603e6db7d8297083ccc274fd662491_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7d603e6db7d8297083ccc274fd662491
-
SHA1
36852420bd323b0a5ae3501abea71bec36ec4d1f
-
SHA256
9272966959761c5bf196a7148e11a498d11c37900b35497ee9fa7cf823508424
-
SHA512
46692d39c05407b9a9f123ff68718a5fd09fa2c33a29e2c201ff63716c441a50c9e465f538ec52afc26a54fd56b3d109a4867c6955fbf7cdc5f3a63bc6b746e2
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_7d603e6db7d8297083ccc274fd662491_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_7d603e6db7d8297083ccc274fd662491_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gaUReRr.exeC:\Windows\System\gaUReRr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKsLeAw.exeC:\Windows\System\WKsLeAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHtiVFE.exeC:\Windows\System\BHtiVFE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OzmgAKo.exeC:\Windows\System\OzmgAKo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PgvOQuG.exeC:\Windows\System\PgvOQuG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gEzJuAG.exeC:\Windows\System\gEzJuAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojFdRff.exeC:\Windows\System\ojFdRff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfRbZZY.exeC:\Windows\System\wfRbZZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WyDzIIB.exeC:\Windows\System\WyDzIIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zoTqMda.exeC:\Windows\System\zoTqMda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXLIYbc.exeC:\Windows\System\qXLIYbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zvPvWlt.exeC:\Windows\System\zvPvWlt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ixUzxJV.exeC:\Windows\System\ixUzxJV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dpYujsq.exeC:\Windows\System\dpYujsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EimTsAw.exeC:\Windows\System\EimTsAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErPapkn.exeC:\Windows\System\ErPapkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJgThfT.exeC:\Windows\System\HJgThfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWhQsiU.exeC:\Windows\System\tWhQsiU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JAgNGLv.exeC:\Windows\System\JAgNGLv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpTNNpU.exeC:\Windows\System\tpTNNpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAMMZgl.exeC:\Windows\System\cAMMZgl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD513ec169e7672711cacc273a093442574
SHA18d3368a82baf6638507adeb4f21bb91064819369
SHA2561303b4bfc6278d642848ebacc24d01deee157edc7ec23fe8e66ecca850783655
SHA5127a10c236d3b2e67d8eb868a5565d419eb598bb1e29051cf85ce532be07507004ae28643f647af5c9dc2916d0ec9c9c6fbf0d7c14c5fbe3c34b1a01b0b79bdbf6
-
Filesize
5.9MB
MD53a46d5e449602de66c768944376e689c
SHA198ba268fe84d44b307709f8ec117886c5b579032
SHA256f63773c68fe880cb7c7fb2448ee31fc0e6a4a8044aa4e3b3b371698db39f603f
SHA5123fa54f6cef49fc2345f9f0e117b555bb642d587d712a2e23f285d1c930cbfdf06a4bd642b1ee25a3621f4c25a4fc259e7cd97162867f5e6529d0f3fee42471ce
-
Filesize
5.9MB
MD5cb72838f5ad018c619926709f09cd831
SHA12dc6cc0eb5b21dbcdf59534f8ebbbebbf4c2ec3f
SHA2566daa51203d7fbf07c5d7975ea2547cb7b63bfd406817d105c56d4f2ac3faf4dd
SHA5125b75fb5e9118e7f5c2e0d0c3d6be029377eff39d39ac736783ccf4ac82030186fe18ef3bce2179fbcb7bc13c3c501dd88660d72209f10df53a44b42966c109c4
-
Filesize
5.9MB
MD508ebff36c833f749036ad147c5658b97
SHA1740343ebf77e9382ab0ce18c4381ed140dc9a122
SHA256eafbeb69fdbaba059ea043cdbf8519413b1300daf1f2f1907a1cc5711e8938d5
SHA512a26775095c6d7d6eb668f362ad4033bd4b468c577f405744630f95afd4b0f094e500c663f5d5b8845d8780cf7532305b42ec73742724a52d7b6d972f4f5138ef
-
Filesize
5.9MB
MD566fb08b8d7eaba6d49fbe4b57310d0b6
SHA101542deb90e21f13887c0bba6d6a6d4488646052
SHA256b73cb00c0a4e9d1b1accfba0dcd3818c19f65401817a8989904092cc7bc03d98
SHA512367a7952e60ee73a187f78b51483ea9004ce9f99bf9a2d2dfbb21dc5c42923497713fd39c7f4f363baa155bd08b571d336aec3d648405652783905595f2f927d
-
Filesize
5.9MB
MD5e5bbbc4b1e2570972b63264fda276143
SHA107c8b8db622fa35d17f8b5921254e1ff16d68250
SHA256ab6a15b2255b4f6bc4696854862a9204549e67908dacc332757fed2f9a2fe960
SHA512b97beeb61171d549c864e01959ff454fd2c1d4a86ef8345c44943e7c0673b638dce3064429d8a310d49d0769e7388416c57ccdc262d45040d6449020432a78d0
-
Filesize
5.9MB
MD5a0b1cc8b6d798c1bd44de22b5a48275b
SHA1dbbd8a9e91e8548c100174f2cbe1059f8fe17753
SHA2567aa81fd76d7403255479b30c3fd0da5dec64fe5beab2ec629ca2e311071d5efe
SHA5120fc530b2d8a551f118616a85fad9639c96133b99672efe664c72d87a5b2f2ca6fd40b52759907f9b1e8e642a532913fab7760f92d637113ec62e27ea0e4acedf
-
Filesize
5.9MB
MD579a6b1fa17a3240f6a9d23106fb5188d
SHA1d4c828fe1daaae1c028fee35f88bb7298795203c
SHA256bcd52152c25be0a4431aef04286eb25ba67794319f1bb39fb45f86675d4e538d
SHA512e6e255709e5fceb63ff3cbbeee3365e44ff55ce42e020f418b1681ff62a2c31463f8a40c0674909ca7006e964ace7885a00a80cd33c1b8b968b041ae014ba3fb
-
Filesize
5.9MB
MD526cb2db3a8b519e3117312f97cc89463
SHA12cf138004d5e79958b7e5eec1557b33c44796b4f
SHA256d55d9c1816f77c087f71c109030458707f4f01737b894498d62b19cef66ac9ca
SHA51253551955ccfd02a50ecd3bcc65c5d6d6213a9532328b04a16516d4bab2172f3db2b614f9464610ebe7604fb4392a7761af3b02d7b47da961292de27e8b9ea87f
-
Filesize
5.9MB
MD558cd4fde356707e109b63f9373598acc
SHA1fb69198d5f0e3f89241a9d618a38096f194ce5ec
SHA2562d77256714834fa28c5bd6876aa68b62953eeba2204b00299d4e32ec726042c9
SHA5123ca5c70322976fc54fc11ef5b90db64ab86ba7e4598560e39d97444be688286a1e0003788881c172bde7df26a98cd767f3ef2f683cde26b66eed4c228261507e
-
Filesize
5.9MB
MD5f3a3609419a0961abde7d100d9106633
SHA12fedb2e06313e8e52e9b8d66374a5b1498f6082a
SHA256c0b7b8bfd790df61216c6f0d2c58eeaf128938683ee28c71b478faf43ea13025
SHA512d1ddd7ab7ac16b72d2e2d65941af84baa3681c6e77bdf644aac6260a0710c972f4ea418a78e618668070243c6e9586f8f06f91682a09813bee1cf0bfa8d9c402
-
Filesize
5.9MB
MD55997e364fee00355eb0a7d41bf689ae8
SHA12f0665ef2d99ce318e0faf8ad55d4830cdaf76cf
SHA256dfd66a357a3c1e7e681680f929a65e0544ef8f78c503a4b701ed7c36c5b973ba
SHA512548022e9db64d95f6b6eeb46e3de72238e9793c817f0cbe5ac0d4410bdc2936ea2f7c4aefea320eeeda2f975408871df33cf160fc942e97116e23f9471beef6a
-
Filesize
5.9MB
MD58993f4b7a173a7666ed55da893145ee5
SHA11eb95c9266453c1980447178a3d5761ba64290b9
SHA256d499018b009ada91c10a6c8f9e5b41d7692e49232221a327d5a92870303a5dc6
SHA512c8c8c607b94b32c5eb1cf378657ea27f0719904fb97ab5438ea80d1505ec952b6e3ca1960fdec58553657aa6279d36c5ab9d9b1898482ee926d6b5d50ce3838b
-
Filesize
5.9MB
MD5d29c0f21c790132559056fad89162134
SHA10f8ece50498b4aa146ccce5b1b791f67408213e0
SHA256e237a31794a9c77c3afe6320313fd9ea25155f3778bd4f309d824f632fb6e6a7
SHA51242ca03f6d3af7863b64fc8098ebd2584230443f7a3acc605fd890e8582b9376bd4ed7eff3ce7ee703dbd3f7e14ab2f857312f53205b96246c3e69e281d9cf94a
-
Filesize
5.9MB
MD5c28f2fc724637f2ec6abfea518b1d907
SHA1ce3106e5e5f54f42691b88cbb5d4387edfaea605
SHA256f11d67e0e1cb65d77c7ea973d326d34f178e40f3c2cc816d0e53b90cb5afa9eb
SHA51256774693039a0d40a81e5deff3db4f15cc3f6a518450084523a9b5cadb42dc514ea592a8b9f87394e55a837ba4f0896a949f1fff708ce4633c9099b067569b65
-
Filesize
5.9MB
MD5667f210c80bec38d3d5a6176342cadca
SHA1799bfaec1e743d12a8b57db32e6c1ac23f761fdd
SHA256e97a0265bdcb1163246a5d65d89d56661a1ce0d6ee693a29370526906983146c
SHA512716c8f0c52b12180e070563bf3c9879f86a52d6a997896426fef89e29fe40692b71b1a41186144cbbde241164aae3ddd960ff3f11d28b7b2702398486909217d
-
Filesize
5.9MB
MD5abdf87234c12f5df517d6b4e0d5e839a
SHA15d0612f9f5ec0300bae5935f5544d42b1b6b35d4
SHA256b876ac20391a3f68f3b9873884208f371c5a7f8f0e356f5b04a110fca0e9524b
SHA512d021f22d01a0ae09716c3b2c2d00fa39e15f413585ce1cd109b083a24359c6f6da4eea38279000e7a4003e2aeff5f895067a560eb8594f0504138ed8d14ccbc6
-
Filesize
5.9MB
MD5033ea740d70ff79acca993e6f665ac81
SHA1821c1d191d3b66697c1bd43cbd12086fdf766b9b
SHA2568e1182b289eff6c614287eb37b67109513657fb9602fa686e42c019686ff27ce
SHA512dbb30c3e7bfcf348baab4cbad8f11abee753f5c40caf91590720454b6502947e17e2d405a3e4516bbbdba55428c79beb20bdf6c3595fd2776fd40c313b1aab03
-
Filesize
5.9MB
MD5a0cbba560d34569a7b71bea71f974384
SHA16a4202779cc5edbdbb74aa6990165880426379ef
SHA256eb85fe65de550e72d7a8fd76de8fdd4273b3545514393b29b844fd4942d7b1e7
SHA51231b752f1a4fddb1f4bfac5e0028c800839b5fdb2f16c7655f8ff60cfa1152f922c9b2373ffd3288946155f056bcb2c6a3428eec2873835e719404a63bf3359cf
-
Filesize
5.9MB
MD58493109a9018754fa38b3ca59c91f243
SHA11c709e0dbfddd9b27d59d8ddab48be311c472383
SHA25669c5c3fbea92d7fed33db3c6bca5bebc29acee6d09d1a93536a4a7b4aeaf1d52
SHA51273d149f6cbc11d22622df3c445fb555c62fa520d494f2ee501c82905c63636cd8a36ec2f63e7be341f9d6718526aec646f6dcef4d250b92b384dd4926375b2ca
-
Filesize
5.9MB
MD59b3c0bd5988d042bf46e63a05da7896d
SHA1846df1be358527295f79ce625c5d64a60ac91dc3
SHA25602db01b97591b2d4a84bcb4f8e1834753e06475e396dcdef47fbe37802b3647a
SHA512253ffa296ee5314a56f8f7b0da2a23e67d62cb26b4e77b5ecb9940a6f8b707b0d46dffefc733ef48996633fdb67190ac2eb3c61d61e81c7159ac895430b1ec53
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB