Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 18:45
General
-
Target
2024-09-26_01963d129e87b3339a7c5e8bc3f9396c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
01963d129e87b3339a7c5e8bc3f9396c
-
SHA1
ccba383ba3ea9d1fc7220e7a4f7468a091a299ff
-
SHA256
cad885c21c7c42fdd667a6a87c1198497480b28091bc2f58e92932e7f8747b67
-
SHA512
ccf25c2b21abeba05054395b2acfc73f4f2c560d4da6f9d80cbe4de09c41dfee778b52fdc81e8a036bdb33df3ee792ec22fd81c9a5e475dc3262ef466d429c54
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:T+856utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_01963d129e87b3339a7c5e8bc3f9396c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_01963d129e87b3339a7c5e8bc3f9396c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fbLFuet.exeC:\Windows\System\fbLFuet.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bAeKphU.exeC:\Windows\System\bAeKphU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LBgVxcD.exeC:\Windows\System\LBgVxcD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piDIonc.exeC:\Windows\System\piDIonc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvYkiRe.exeC:\Windows\System\VvYkiRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxrJSNn.exeC:\Windows\System\yxrJSNn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsaqHhE.exeC:\Windows\System\IsaqHhE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PRkmvnU.exeC:\Windows\System\PRkmvnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnfFmpQ.exeC:\Windows\System\VnfFmpQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rSeyqCq.exeC:\Windows\System\rSeyqCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgHYNtc.exeC:\Windows\System\YgHYNtc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaVSBjP.exeC:\Windows\System\VaVSBjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Uetniou.exeC:\Windows\System\Uetniou.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZeMpwcm.exeC:\Windows\System\ZeMpwcm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ozudsqq.exeC:\Windows\System\Ozudsqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\koofrYZ.exeC:\Windows\System\koofrYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEaDMwo.exeC:\Windows\System\yEaDMwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqmYviy.exeC:\Windows\System\GqmYviy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omIkeBo.exeC:\Windows\System\omIkeBo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONaRifY.exeC:\Windows\System\ONaRifY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msJrpYq.exeC:\Windows\System\msJrpYq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5039e52df2444c8a2a41c461136001126
SHA1852ed9e0adaf18172c4ee4e8e663f5d894a7b224
SHA2566c5602c4bb2167ba9c8b051467ba65f35560b0b46483e681dc07cd62d6936464
SHA512a6ddca6ad10d48ee8502034734a49417b0e90d906a87f95050f2958f15979cfd784ff991ab9f98edf5fd92517f5574bebf53cf6c25c5a3a1d8db8d18111977d0
-
Filesize
5.9MB
MD5657cd2ffdb2ccad91e35054c0fbeefea
SHA1fe655ed734a4982dc1527d7d0feab20b2546a0ce
SHA2568e5f847cfbb40685b22945ed4549ed7305e89937b097f3dd7cfa4ca86ad779a6
SHA512374c42d335e958e89145bfaae8ca1873cbe21dc039f80b33236d65c215d6e9328016d85a03e15a3a19bdf0065ca3f1b38d30e3b734a155165decf7c9f96e0971
-
Filesize
5.9MB
MD5c0373164bc044559f7a7e92be5046aa1
SHA1672e4004448fc6e6428d9705539f1a71a09373e4
SHA256ce965b91e139690ba29db8fddc639bacbd1a2c52134e98b98104203619a108d2
SHA512287c62a58a6d2683f4ae26559bda0fefc581752a6014cb8460e34fbe9dd6e41d7ed8f444b5ad4e42d85dd1cf426f9d27a58d02193f65eeb74d5c99fa4b25f422
-
Filesize
5.9MB
MD5aebba58a9d8820bc7bd26b57420fb22b
SHA1bf84e432e87657d5e9ed87f0349e046f1b3a84d7
SHA256b0753a2005b48afade32995b2d2f0ea8bd78e82dd5e4e948bd77867619b8f65c
SHA5120f564e33bd59b1524f665c7f7fe22c559b535f3fbb540834e58ea97f4ac8e51a9dc58d5bb788ec515d2dd88712b9f21b9cd17fb81738d33139c992450798a35f
-
Filesize
5.9MB
MD5a14514318b331057c099da95d5f45cc4
SHA16f245f5bae57b7b041e1a00fcbf8a591497d43ea
SHA256dfcc9ed7d334fffbf8094fcbfc0a5aebf331ede6fb813403f1756169a6239552
SHA5126f71ec3ed3fd43b97dc568d6d122609dae9a48994843cf2fd6fcc740d71eab5d493c99f3ebfea9cdef7b1458e36f504664a3f122290e6dcf14f17308fe18133a
-
Filesize
5.9MB
MD5209b755a933537f8d760192fbe3a31f4
SHA1e8559cb74405119bd467d008900d50f167026eec
SHA2564c187585ade89207efb5453b8fba7261d73b341ec971ade1f22784da24562f08
SHA51273b29d35532ba03f351359ff3f427d32a5cf57c59b9ac876bac33f665d3072e123340bd930b97cb6b92a648701da5f242ea033e2a2f4ffb2d9d9a883532c216a
-
Filesize
5.9MB
MD5fea9765932c8f365a76279bbd5c0e5c5
SHA1261d052d7074a2b628821f0519868ec1e7a1c061
SHA2561eac09aca35b13029196a19345958ef760ef7c687e53d496f90e2ec76380dade
SHA512096379870443668eef4443aa7dc8f3b60f698f873341687a392946816923a2b3838d3d43e99a2c1b2eb32c9039f9a1cbc5e99bdc10c80338460180b344674627
-
Filesize
5.9MB
MD5a2d834a4d2aa213ccd5dd427016d8a98
SHA1581917b2df423572e32f468899a8a6165738eddd
SHA256b788122d919af1c7b1a73b4cefd18d1b370c916540ce83189145942ff9d2fe2e
SHA51291c191a98b6eaf9c700ce64f137ee483d44ea621af43d2be4d9009b6ce57d45e7edf3bc247487cd0fd99b460acc7f3ea08b4d62e02221ff37ac75bcdaa3d4791
-
Filesize
5.9MB
MD5df9bee8da78b6fa302595927620b709b
SHA11a6a9eb4508e95a1b3fcdf1d257e5a4c049e517c
SHA256e3aa52cbb6a1893c49dda338add51132de00f92c59f574644a0d63853da166a5
SHA512f568707e2942ec1bf9f78e0f0b1ff941bf5d400bd2fe8268088565a231b00529fbc52d0c362726e3eaafb6a564231cdc9bd37cdab8f45010df5f183e18d2c7b6
-
Filesize
5.9MB
MD54a40ae4c42664f9d83004e6d58d2bca5
SHA1f6cb309a718f4b60a309e43c399ee98537f81e43
SHA2563905fc539671d06a8bde7e1aa26d42bb3dd93cbeb513c09f2759b9e1b2a5d616
SHA512019f37f1bef67d7f06dbca97a438f287160376cec908783cc6ae4554c443ca1505fd8dae5704815a3803f25dd3acaedb635237a48dddbe2229c0ff72cfde341b
-
Filesize
5.9MB
MD5a0a78fe6ff71795b4bdaa117513f4c1f
SHA128eb01bf7cdd98e7e11217586791f081a9ad39a5
SHA2560c572c6a3938cb5797556f085ed335b5f7357463824cdcf214aa671eb62fc0f2
SHA5127086a64f48efd13e4cdd6f99e72311daaff2ca8cc344c8cabcf8d2b1c6fe08f5ff131729185346e01b9dea9c0392bb4c27c009cac83d740157a3e6ad2f0887dd
-
Filesize
5.9MB
MD5706656b535713f9be175e8e41644fad8
SHA19d5e03cb4fc64d1664407dd9c475215bc7dc570e
SHA256faeb7cbc96bda5c8ca6f9dea4899ae96290319762441e9828b79e0f8de33a248
SHA512f5c84013363afaf190094f4f90e5d793fe3f97e5e91f36c9e9da7164557bda471dcfd5ad9d0b422e2851351aae609c3acbeb8fdb0fbb2b3ba47ece22837f3e0d
-
Filesize
5.9MB
MD57a8f3c71fe8a000350036bb22b3d1795
SHA1fd849a3dec92011b8d8e65002c36c3662db546f0
SHA2561262712ca0255ddbd159b22b05db9cd7bc1d550ccc57eafc50f841f6bbf1616a
SHA512d7727d3eb22a0110836134c4e238d2a0bf71200459ca05364eeeb36bd0e51ebb3928ff623cec1e00554f0f2606ffc75e9815a04fceaddc10865a640273ce8ad9
-
Filesize
5.9MB
MD55a32f3a7ed1c6fef8cd5e13c23809eab
SHA1e464cdbe7b66f97edc487cde12d61fe788089bf8
SHA25690684a7818be3f68fa4fb0b6240aeb803cefd01f766b973bca4ee3b6e7d33ceb
SHA5121af54f584398648e98c039eebeb62f7af46ee35c16152be70eb23f5b1d2f3e0849f077035bb81520c5e4b06f09b87b466c55c3293e8d0e5b5645ca6a7609d5a1
-
Filesize
5.9MB
MD51bf4aaf08bf3568a4824282ed47d0795
SHA1d768bfaf0651c32fcb42ef513b8665380287c8a1
SHA256990895fd3f7d419a8c9433b8a66f5752ff4d6c64b82ebead993d3c83552b13d5
SHA512ffa6ce844e077b439741aee0552a705c131e3d73c1609767a10e38ca2af1b33a721e2b69b764875537f39f77d4b631c8d72795d272e592aec29d4db053e46245
-
Filesize
5.9MB
MD5cbddea72cf47bb875847894d42a34d6d
SHA1317d9416549e9e30066c32ad838c401999171736
SHA256bd2282aaf41ee13c60adfb5034c1d0f2866a1dc436bc6b765664633179b83a51
SHA5128726e44dfe4745b39469fb73e29dea30b40c54c2cff4803ab756a75cb3483e9bb26f9aae7c4ef31d00adb41e7e86434110c1eacbd0b9ea2cf193c5aeac389725
-
Filesize
5.9MB
MD5e9bf655cea94f5202a6894ba4aabff70
SHA17307d40a22bfb7582075c0c6b3bfb9ea4d3b69c4
SHA25619660591cba878390082a030f61ee112b5352991f501011167baa1db147503f6
SHA5127426ac0bf27faa8ab3d3cea3789b43f0e6794206b560b83acdb6860ebccfd0708efe81b2ad8087e8bc6aab5abbd6611f745496ec70e556dfca382d7dc0fc82d8
-
Filesize
5.9MB
MD50014bd4d87435c480bea88dce353ef25
SHA1d136364439d10ba5e057a5b0c5ea47ff32208481
SHA256c98a0f68add1e76bb8f6abd14cabd008556dca5fcdadf53a63cb3a01df3b0b68
SHA51253ee5d969fdc12b74252391cd65a8a80bd42773af507d19a8237ec3a7a42064519cb6343fea112cb0000eb7c48b9c91b7e6c6451fe46ce230b5ab391442d8a6f
-
Filesize
5.9MB
MD535b94b3ef06b1c5dc2e9017f22a3c628
SHA1599bf603281870234b3db3bc9fefff2e37194029
SHA256cb4bf8ecea7be0ce763b8038cfebc5886852dcfd0b2d6b36c46f2cbd334aa0ec
SHA512698b6c695ec22cb5c312fc0f5a95c96cf04f2bf6c53dea37b98c8b1992ea55da23c92c18809b05098af8613083022e5d3feb3d6dd031ffeab52e1dfae71cd369
-
Filesize
5.9MB
MD547453d22dcf29bfcd8802d7f705b7791
SHA1da46628e55a56151e08e5a354d078c27607dfa58
SHA2566dd63855a32842bc55d497f60179e2fce8f413a486067f03375cee86ed4c7695
SHA5121919c11ac71bb327c83a8cc95eaf1fe69f819d72535bc39d0f18f5bb00d214d6028cd6c45c63adb0af195ada36d33d886f2a7dcc5a4b4940cf88962d136d57b7
-
Filesize
5.9MB
MD5fcaf7a5622cef3d5a2a65235d3067578
SHA1f8ee7f20d41f5a4619600c07d542807c625fde50
SHA256c06f0188b2baf0123c6178a952f960adf2d2665617b194700a39b927a82d0900
SHA512f1983a33667d4e6ffd1da8573f284ce8274c5260771bd8f465a312ff1b77e852722da5769bd187a68318e891e11db3005b7ae9385798aa65832742df303e073b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB