Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 18:45
General
-
Target
2024-09-26_00f3a43ce69d013ab27dcb22ec39e072_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
00f3a43ce69d013ab27dcb22ec39e072
-
SHA1
d91e302ec239291fc94bbf86bb22068081a50461
-
SHA256
73f8a0799975ed012f114ebcba484f4c0d07aad9482a40c3700b2e278e3a99d1
-
SHA512
ffa7c835c14a2a76ce1b96080b7b3bbca4a44f9dca030bef9d377974dc9981be86db4f8f26031947e2e6896f29d093dd10296418b49c577a43e584a26c4d6e9b
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_00f3a43ce69d013ab27dcb22ec39e072_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_00f3a43ce69d013ab27dcb22ec39e072_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LZeWLmY.exeC:\Windows\System\LZeWLmY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQOgTaR.exeC:\Windows\System\zQOgTaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTbviMk.exeC:\Windows\System\lTbviMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQogivh.exeC:\Windows\System\XQogivh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRGVFKS.exeC:\Windows\System\QRGVFKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AAMjiVX.exeC:\Windows\System\AAMjiVX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXSSIVW.exeC:\Windows\System\aXSSIVW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JyYxrsv.exeC:\Windows\System\JyYxrsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HhrSlmO.exeC:\Windows\System\HhrSlmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTivWcG.exeC:\Windows\System\aTivWcG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSVyfnx.exeC:\Windows\System\oSVyfnx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCAvvUE.exeC:\Windows\System\tCAvvUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqpoQye.exeC:\Windows\System\yqpoQye.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFWCkfw.exeC:\Windows\System\TFWCkfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VtaDrAV.exeC:\Windows\System\VtaDrAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZVwEod.exeC:\Windows\System\UZVwEod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKfOLXw.exeC:\Windows\System\OKfOLXw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhwSLBf.exeC:\Windows\System\RhwSLBf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUcrBUa.exeC:\Windows\System\LUcrBUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yeLiWsx.exeC:\Windows\System\yeLiWsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEzCdol.exeC:\Windows\System\hEzCdol.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD578a1222b89a1e5ffe2f4a77c1f311924
SHA1af8b2975e20d67a41b679a7d721a0b39bd6a4290
SHA256453cff8cda6ce192cd9ac36d2655a129f19c5c126ee362e7cbabc7d9c6a24ea0
SHA512daa9346800dfd3646e00f54607a37c42e2b0dd648823bb3fb7939810965b8ea73b23ef03b6d3c1f1213c758756c327011bf28ff32a5a1df82a91263e342902a5
-
Filesize
5.9MB
MD563c9748a4d265f09f0d9bc8ffb17b0ac
SHA12cb474d08b34d800f07303b5c25c82493eca10b9
SHA256c251e21f977c1dbb243c73dbba81f814acd0be1860e5d6b8e9c59651034f6d34
SHA512fb21cac27d3982ea0dc46854f67c1fd21a10153ccd5596dfd220d380f1c19d0af9055f15f8d6b519613bcda0c0b760468d0e9549db0bd0d4cd8e2db01b536c2b
-
Filesize
5.9MB
MD511c50ceacd0ece9685a380e56624124a
SHA1a39da071163523965e0eae464514189161d045af
SHA25613d4d258f70b4cc6065e9b3584c53c15470cc5ede707299c810b795b3d308808
SHA512a6c8adea812ed618c6fc9275661fa2360f1623fb75ef6cbf988a96382d24eeccfb510dd8469ab0e491922fc578b3288a747d3a51a85372bc459fb51d5ecdd781
-
Filesize
5.9MB
MD5197b08979bf196597790b0483c3d945d
SHA1b43b184635bfc45b42d8d307245cf5cd3a0612bc
SHA25684ac5fb508f2bb86d6ae91cff9d8345fb2f2cd60c8d0067c41be61d503f314b9
SHA512606d864c48b9d40fc251075b115b263240d0c33cca4cf1f9d24b7a26bfe31e148ead59bacc9c641ebf429b2799602cd131f1220f58a1e870fedcb2a4d1ebd506
-
Filesize
5.9MB
MD551e9e877a00c3ace6aaac957af122a58
SHA1c452846cfd422379cf321ed5c899ae9d1b1ca89f
SHA2562e26f68551eefd79a3a530549a9720325b85e0c29681eff6075a0cd204707f20
SHA512815b5b211fc09c9a389a01843dd993beac6ec32d12f3f63cf9ce56d0f58968240c79cd42d065d1a7864add194afb44d1ff1525cb36d9ea953d5b4ad582bdd270
-
Filesize
5.9MB
MD5f5de4a2b34e216a1c83443df43ab15ca
SHA187dffd35750fd2bc878ec362addb4633a31207ec
SHA256e54079bd7c4ba5ca6593589d518e20b06a8e8e72f2bf591ac91e9acd1c1dddd7
SHA512c1cdc7781320637d846a5f583c53b958292f5accbf81b43f9672ab64099a74a729d353e6926270b1358de7e107d3508e929105f44643cd578dadfffbb9738a63
-
Filesize
5.9MB
MD5abcbb5599ecf9e3d0b5c43d1b9f86590
SHA172a58eced0ef4bc2b2a1a45ee3ad5b88fccf0ffa
SHA256e9b174af2fcd04a00d651291ab6159769569483a1c053e893273cfabbb6546ac
SHA512307fe1f98879a15ddba763c16d82476d9049422c2bac8f9617c370344c549e80e1544a2e27f50af9dfa964ff5cad4115b29c07449a3b7ba0536105a9474a2ae2
-
Filesize
5.9MB
MD59ef6f2c8fef271ffb048f76a88fcb53a
SHA169af262e32bc9be735bff17eea18c163035a3c33
SHA256b50005bc2bc7b41a49496ca075a0369fd163cbafe972b9c5874cfb7ae11040d6
SHA512abf3eb29865017641fe488faf6c0c32c67a7be260afb26e0cb6047a4c86cee728889df7e22e943959eee4bd85a655021f5ba42114d18be321d1c71dd5c2b4ab4
-
Filesize
5.9MB
MD51e3ecbd52c6eb6aab1b27119ba3e2473
SHA144d5c12e79d19eb5dbbe235cddfaebbc33ac9651
SHA2565644a7c14c08eea0bacc96be2e470de6c099b6619ee8fbb08d28ab432d84592b
SHA51252ee791f38d2a224b7eadf65b9efdfba4c75ce9ee17262d3a70c83de3721ee9d04d7f6f44ce59014aed42d7cec88a970913299452ec8dc7fdf88a9cd5483a6ba
-
Filesize
5.9MB
MD511a6dc066e396e34bb9345421d25835a
SHA1b6b03c48d7b1144ecbad2118fcb48414d797ebb3
SHA256083a1248efe77d33fc20585e5dd8dec062db61571d08feb81a0c38ff878a6694
SHA512644152e63fa3be4aae462a1273a5f267a33325bae84a222f2eecb794e535071c0223dca0a28713b5e8e5c4c4ad637e4aab58eb1249875f1854c4ed4469f01fd9
-
Filesize
5.9MB
MD5fb64c113fabf99d3afb80afb90c724a9
SHA144918acd75ef31fde5f3cc92f4403ba4876949ec
SHA256d57800b3299762fb6ec71b68079d9acd8a6da25efed13c3f5926bb136ae5f681
SHA512a7f28cc9a3d30e9a6f66fa022d2cced3e601d016244cdee000504a340fa7095e04439c59659457a2116ba5f78adde333c4f9ec34aeee45060d422b8a16b230c5
-
Filesize
5.9MB
MD5dd8888958e88ab1db034aed9a0f8c23e
SHA11ba25011e87c1007897bf2270dbd9d0057f2436e
SHA256273b8fd99049161d24ee2ee1c4bd5a8ebc20cb4093672e47cb53933e60f032eb
SHA512951ea98766f9818611c5e27210c7614332de87b035bbeed017339ca5893480a68d494d9dcfe21bf5053ad0e085bece7029218cc3937979968d17307360f4de20
-
Filesize
5.9MB
MD50de4e966d1467f79d11970f83aa94e9c
SHA1c15953ee2d84bfdc67f59f6f6ae549a50ba362dc
SHA2564108a3ba874f370523a432579c70ddcdf02a862615e7887abd6abfb16be8f70b
SHA512a22f31fae059573563f6338fabe76e79e0c42ec2c388c053747bde6a70792100d3450f548b245fab5035bac11c53918bca011d30c271e612c9a39a13d6820665
-
Filesize
5.9MB
MD58faffd9ad8299a41a06e64596630a5a6
SHA1c2a9596d010902c5d4f2d8b6f0308103a0d50e1a
SHA2566310cc7349fd24e577ee1603e97084f60e9790efcaf98e38628b813465529462
SHA512958dd0cfa1f81c700f2f84be465095965bc9e10cbb328fc0623144e5e58b7f31ef9bfb50ea5785b991bcd6f2c6d489f1bd3c3cd474de6bc963dc8555bb36d573
-
Filesize
5.9MB
MD5c07e94f4b3b3a10cf615e68eb1cfe21a
SHA190d9fae4446402f39a99d2ea075468534fd39313
SHA2564fd035b75c4b0f012586afde260b7a583d63ba034523b671c300e76fca9ca6c6
SHA5120034c1d41c69df8dcae56f47d2f5b2de5a39c40268b9bb0a2bc6bb104690f7ac5ac9db462da33261d90da629ba9dc869bed1ce02243ae51b2065d6a3a3945587
-
Filesize
5.9MB
MD5891256342b131729a9bd4bc55efaaf1d
SHA1c12e9ae78e46be498068282f60126600a3cdbee8
SHA2568a51cca35f42d947587d0f541b0cfd4dce7a35ffbb191d6147575f136f02a6e4
SHA512aff8d487677263700d09065a216d819c44aa463b892c34d64a249a2febd06e77ec89616ada7f542b40327bc490bf0ef4b7c9bd52c0a9a9ebdfc3c5767b671581
-
Filesize
5.9MB
MD55f8388103a945920e9c1cec94a5aa450
SHA1891095ed3f80d7385b9174e7d0c21f691c845de5
SHA256e91f7329f452758351be56f5e43e4877fa26b36cd6deb287604d45e451809ac6
SHA512efa480487eab205d72f930a38c0da40d31e5ee8e76c82fd7a1d1e55260631dfd3fa48f72e8a58fd400bbd579cb218f48d2adc53c64bef4133bc14e7edc1f0442
-
Filesize
5.9MB
MD5c4291fea62d330cf9ef2b3710b142110
SHA1726ebb98780ebe2b8ed403b9757090726420ad78
SHA256790d8db7beef61db37cd424461dea2b04ed760ba5c89c69aab8d932e84d380c0
SHA5123f02d48d504ff3d439c72261d63f887fec8ed3357b9df7e8cebfea3aa8b2be22ae66e3394a0fbcfaae78ea8b3ab9714cf555bc509fbc8bfcb8e1645d7046a461
-
Filesize
5.9MB
MD5c00c05ce19e834935e81fb4334c628fd
SHA11034d68512fe0a49d09856ae038a3e172098cedd
SHA25674b29c8665899e288c990f06b638b44f7ac3c574efb451b95d83912454ebb820
SHA51218c5bdc3168ffc8221948ed9377cb9313089566e7b0028b458357443428494550da491e82cda9e329708886fb3446d3faec5f909f4995bca3348246c3a5e71d7
-
Filesize
5.9MB
MD50b59704cbab2a0746081316fe1d12ac1
SHA19c523daaf0f29a7b6b9baaa7413006955357b137
SHA256c9ecae6799b8b185e9a051e5ed7c8af2d636acbda1a25fe7231a66ae403ec8eb
SHA512eb763d9144547237330cb9ddfc7955fde48e52c9c3ccf8a006f102038903468b2066a4029c4990f849f1f0a1fda08ebf097c85178e1c411da1c695d7841e9773
-
Filesize
5.9MB
MD5392b3f456781e52a0902d2e46a523903
SHA1ed1a687436a96f4acd8130512bc9087d3f33e8b2
SHA256261cea355dddb90eae76c3d6c1b69c5338d0110b6acfdc0b675494bef11b1645
SHA512954f29b4bbcb0ffcdd7922d927373b416be0cccdf00291f27f23e68a6402ba424b8c51a2d192afb9e12befdd20bb460e84528aa5c3aab8ea219a733ed1cb3135
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB