Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 18:55
General
-
Target
2024-09-26_6faccb1348cd217dd84fd98a470eaa3e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6faccb1348cd217dd84fd98a470eaa3e
-
SHA1
76a5797f4026662940786656802879f85cd549b5
-
SHA256
3a159e8566b3a706c8a02b35f7b0f88a744a33cb6b8fe2494899a2fc8b18dd13
-
SHA512
f087f6ff62800ea465c29b30d6cb361c34491b0743c15a9fa57ecd7fb4086a4ab93fcb3771835a737e02ee0edab5aef4da1d57d225b2f20b0f896f3b42f1a315
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_6faccb1348cd217dd84fd98a470eaa3e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_6faccb1348cd217dd84fd98a470eaa3e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yiWYkWS.exeC:\Windows\System\yiWYkWS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uVJrSAx.exeC:\Windows\System\uVJrSAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jSpAhWd.exeC:\Windows\System\jSpAhWd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edZjQdX.exeC:\Windows\System\edZjQdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EankPzF.exeC:\Windows\System\EankPzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrFacQu.exeC:\Windows\System\LrFacQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oqzJQON.exeC:\Windows\System\oqzJQON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lhIcgib.exeC:\Windows\System\lhIcgib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxDfqwy.exeC:\Windows\System\yxDfqwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxXCVqr.exeC:\Windows\System\CxXCVqr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AURYAjP.exeC:\Windows\System\AURYAjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RKctoXL.exeC:\Windows\System\RKctoXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqNWbDI.exeC:\Windows\System\OqNWbDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWkoCVl.exeC:\Windows\System\FWkoCVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lruIDeW.exeC:\Windows\System\lruIDeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CqkrjJD.exeC:\Windows\System\CqkrjJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPGMxcQ.exeC:\Windows\System\DPGMxcQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pJCzyQF.exeC:\Windows\System\pJCzyQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZoEtFG.exeC:\Windows\System\HZoEtFG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGTgmds.exeC:\Windows\System\LGTgmds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vhAsoTl.exeC:\Windows\System\vhAsoTl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c310a823f8fb01997efceea5a05d26e2
SHA15e52a7c09fd11513f557208d1840385728dac32b
SHA256c32275476e431a0f2920a5efbeb740953bf8ba98267b9817c71fb37cbda03ba5
SHA512501e021f913b253f52bb644dbe0ca256159c798557505d1b5e1285c2b3f03c3466c0f9ca0e9f47dccd7b1a6fac4ec85cc8336a2acc36e9bc6ff9f77eadec950e
-
Filesize
5.9MB
MD5fdede471e6b73541bfc1625838c0e24b
SHA1a2ab98792651d8f8ff47d7da0b869b5866e69e57
SHA256a148a28a0dae498f15d2a4b2a51f1c167ac2353f074861f89878b80fa806dd46
SHA5123411bfc9fd508c939c67f2c0d87ab243a98bc9ccc1f82a10d373d671843f785a516539e2bc880ea68615a92a7a8ff1cde188d618c2605e0f25675541f3654c82
-
Filesize
5.9MB
MD5fc7ad43f7c857b127917ce79a30334dd
SHA141fd1fc44406badcda16dcd5c9c0132cd4734914
SHA256c69a40482bd44e295337e38d8c12f1b3690e4608043128dc9c36d08587868ebd
SHA51203141254e61f229c77aef1bd31b02a278c9be4ae57d05b8c4d1fdd7b05498fbbff3f8363b66bedb238c4400864d848d52fa0efa76ee9517a54888bc9120af298
-
Filesize
5.9MB
MD574cc6292bb6afc2ed74a59b26bdef0fc
SHA1b41b3cf254d7c6d4cc136f6090e33c5150c08647
SHA256f6b1a32e3aff4cbc649e97157e2cd291f367e984be50cb769263ccb8ca007126
SHA512f5bd8d06d9d497f2c24911c9caeaa6a8e3c380f493717b6f982d8a80343eaf645a5aeb3e7d9d656700f5595cec2a1961a2ce6066bfc5b3dc41628cb4abbf082a
-
Filesize
5.9MB
MD50b105947967052032a8262aae6014f3d
SHA1fcf497b7c1a69d28a1c7b87192d821183738cefd
SHA2561b55abe57108298d8822d472d0189ebc5a59cfe66cc5ce39a2c03bc4f0c9b836
SHA5128eb12e10ebf1041817d1a910ad63100c4105b5fcd527ba2425af117e12d926b01af615c93b17d1f2f00c14baa45842660b1ac198f0438fd4913e8344c16f8fc4
-
Filesize
5.9MB
MD5ada047cee6f4f18d7544e14690109e71
SHA1c26fa9a2211c414bd9b2442603ce1a0b858da434
SHA2566b1941612df60bbab0ad8ad6b44c917d698ac24ceefdeb08d31709b29f79d6e5
SHA51267ee45369610b2d072e1c5b63fa3c9f800b13e850b35bcae11ed4ceb6e238bcc06bd48135f125ae0dad739bf2bd86059518b042ee776d931b1b667ac394cc6cd
-
Filesize
5.9MB
MD53fad30cc842ddf870847fe2827cd1576
SHA10b2c1092bd40b78ae73fdb18d25dbcd47a73a0c3
SHA256f5b2db0c00ea96a7fb925b4843549e733f3d325a5d1983b704001252ff98996d
SHA51254dc158f3f69213e47a5955092c7cd06722a62a3c1f8e47e3c1fdd903f79088be9c4dd44b40a7836060df8944ddeb5e7ca1cccfd0c2778894a993e6a27fb2fac
-
Filesize
5.9MB
MD57318abe5374d3830f9e8b9b722e89b62
SHA111319f547026520526babe4f77d6b84ef759e620
SHA256e1a2abb2011edd907922b89276412da44c9616993679097c376f661be3fe3ccc
SHA5127b4a680cb6e017328876f52b68c732a359d4ed069ff560ea6344b158161ee82fc6e75fe8bcf260b77498058a7ea646eb63db3a8a33fda7a9d67bd1b2767f5e5c
-
Filesize
5.9MB
MD551031cc706111099f9f56365f2ced6f3
SHA141bdfe053a8ed7a0b4fc0df8917a7439f97113a4
SHA256085ca480426e2f0a3371bd6d9dde46cb302ccebdef12b2880d031ecc67aa8151
SHA512b8baef56bbc24fa996c5ba29ed7b4bfa93397afbf6cf8780daa309981802020e3f145e33568cdb2328155605c960d83c4d92ce965ab07da40204bc7532eb8580
-
Filesize
5.9MB
MD50e6d4ed442da3b66965a2e2f7c9d96dd
SHA1e6c49dfb0e5ca06ba44d92c625feb05eee3b054b
SHA256acdf3ef327c0bdbb22d2176dd172d708e4ce9f7627de06d10430de44527b9e78
SHA5121f5083acdbf1bf8bb59d72569b98bd1b5bac9daffb9cf8d9a47ac47b2842ae7f45edec240169d31a8e9894883412f9ec93a23643f27975cf8d95ffbccd4cadd7
-
Filesize
5.9MB
MD54435b069d33547ac5e87b315d80e0696
SHA164c5991d200acb97c96f107c80d9a24c25e4e3ef
SHA256500f02142601a37dc79a8cc94d7c2d9c9ff5670140dd53420b873108bfca718b
SHA5120507dcb3d01ceb5d5957c0ad5fe694c57b009592683a807cd33617e7df33bead5e2d42fcff8810582d6a47cfc6d33c6e9c53fe77cff4d48c94907aabad99e9b9
-
Filesize
5.9MB
MD5566f0da52bd1ce009751579015690b08
SHA12cb73506eb6fefec81dd2e3ee0a314687e9f94e5
SHA256ec0c045f5290c882221f606a6b181d4207eb338fb1998ae8c2953f62d8c22fde
SHA51247708dfa614cc4f36ba79bea66d2c29203052f1cc41e53b417de2299e0be803c852a5f89fda82a3b5a7859c529af7e7f29754ef7ecaa0a1137fce15e2aef5954
-
Filesize
5.9MB
MD5d607deb381c0f24620a999df5f17603d
SHA194f376da4504f1aa90b160ffdce976a2b44251a3
SHA256e292f9d53b88b9fde9cbe9b7932f80c604cb844d7aa5fce7fe8b9245f9956880
SHA512e8cca914fe88fb61f52a9b622a2e78df9a51a194f2ee69f57c7d34e30942dc404810065e2b12a3b8680f5e1b840c2af3dbdab6f6ecd4671e55043f084de3dd47
-
Filesize
5.9MB
MD51ed77c75ba7038e6ca51a6e4d85c467b
SHA1d3267b92a84234318831ebabd82fa3805d135f5d
SHA256a9bc166c4159cbf7ac90114792e6b7d6549d831e6fef828d46c85410f2b8c812
SHA5126f332aef73213e4741b365445afa17b72a22f1129833ebfb4ae2e5804dd15556112f8b3373b59d4d49739ec9a8a7581ec58d8c27b943b552a8abfdc412369b32
-
Filesize
5.9MB
MD5a592c0a9b8b25ade1f8fd8bca2c615b4
SHA1b358120593996915dbe028416e875ecb99d95b5a
SHA256138c15b73b5945d13dacc30700e64614e21e0d1e8f3b6c46322213e8f8ec8db6
SHA5125d877d333e98d4d0511d384552daaa84095bdbd1bf65e6cd4f4d953ed912c355304367d3d790ccdbb51ad13f9009dd3c01983f36e4599ba7cd30f0f79181fea6
-
Filesize
5.9MB
MD511f28cab6045db67d03712c9c1c28d89
SHA1c331ae30238ef7128312f0c2255e5516216bad46
SHA2569f10556da41cecedf86b4f6d9fcc709262c4ccce9fb46a70a60a7df6894e07b9
SHA5123970d31b7c30ee073daa756cf358996fb68c43ad04c0fb5aae8a1d08af8fc56921410d6f09e24e0bdde1faacf96a2b5f4651468e3f744cad412f5cbf8cc080d5
-
Filesize
5.9MB
MD5c7f10ec9bcbccd5fe8d88bfb1f5b98c0
SHA12d8fa33e47705e0c8b1a828666b6cf94b1d5fef9
SHA25645cd406dc5031240793bd09c816cc075bdc8c4584f5b42c9462272e541addebe
SHA51264598f003286e242f660e4e8029522a8e16dcf1667a26d86d5df8261d2880c4d447456df67525682cd264ec3367745f211d5949b247bbc68a42b38d241b6534e
-
Filesize
5.9MB
MD517f184b0c5dd5331f76421966a0ff3b8
SHA1fd1033f8db824654ee4e9a8c05c7cf169193a037
SHA256904c3a643f0634fc789d6f82ca45503d990d85f48e36274a9f5e5893cb04c53b
SHA5122f72f56aeaa4e4e1c0f49bc2d1cbb820bcb1c5304583830706de12248498eb3e24e3935e95955094a95a3b6ce6d22f1bb7d5c79f7b46d6f78ad53ba69ffb0f0e
-
Filesize
5.9MB
MD5e4a809f4e133fdf61d7452da0caa34fc
SHA14f1e9ddb6ef30e87701742b12f5c29c43eacc002
SHA256da788e91201cb9687ac04ce4cd57bd434d301229b83b0771d5ca484a3eb1a60f
SHA512322930df2bcf61c777cbf03e7138bee48b7472b221ed25f77cb5f8d3dabf45a85ff70bc9e9714f8223d3ebdab83b91bf0846e6378a8bb7785f435baec2b1698d
-
Filesize
5.9MB
MD572c715fed0460291cf08d4c52f113c73
SHA1613eb1807afbc3d7b264eafd572f407dce94949b
SHA25661dcad455ba117251c240899ef11d901a6635b6ed8f0630e41a8ebba32ebdb28
SHA512bcb2d034ad3668595f41967c101b8dce657635b30a775f4bb9a939b772cf0cd851f4a8f49aa5740bfb9a0e2a041c8ac81c82acaee352a7d3c342fbd01b8b7c7b
-
Filesize
5.9MB
MD5aa5e7f1751f8ea0793174f3e9e5e9779
SHA11bc5ae8fa1b2b1b58498cf26027c2d6649d482f7
SHA256fb2219e7f53a22f2f52b5a03e22a3a4a3d8494d3bae740274ff06e7a023c109c
SHA51284cbf7daef5dc61ba560ff8d0fe927a8ce816bf7e6f01a3ff941b1a783edac15d027c5fb772d2de0a77d8f9e1a964a27dcd4befd983f4570b8311a3f4f72d3b9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB