Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 18:57
General
-
Target
2024-09-26_852002491b7019a7547123c6e1a25e95_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
852002491b7019a7547123c6e1a25e95
-
SHA1
5282a0a78356d39cb531aafad9b395b90198b3d1
-
SHA256
e272cfe6a25880fd96790bd008d1d3ace323f8500d132ffdcf72edd176380d8b
-
SHA512
24617c67830ea048fabb1d0b93ff2b7a20d70808cfc3c307d94dec1df63271d1273c81372541566ea1bd480d05cf3b8fac0314c7090cd65abebad0750f1dd5bd
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_852002491b7019a7547123c6e1a25e95_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_852002491b7019a7547123c6e1a25e95_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rmNYFLN.exeC:\Windows\System\rmNYFLN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TzlNczH.exeC:\Windows\System\TzlNczH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GGuLPtK.exeC:\Windows\System\GGuLPtK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOqsYNp.exeC:\Windows\System\qOqsYNp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dheAngJ.exeC:\Windows\System\dheAngJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOERHfX.exeC:\Windows\System\sOERHfX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmlLCFZ.exeC:\Windows\System\hmlLCFZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDNAsTv.exeC:\Windows\System\PDNAsTv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KiCOQvK.exeC:\Windows\System\KiCOQvK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIDDjDH.exeC:\Windows\System\OIDDjDH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omPeUre.exeC:\Windows\System\omPeUre.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSAGwsK.exeC:\Windows\System\zSAGwsK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQoFzzO.exeC:\Windows\System\EQoFzzO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCzJBOV.exeC:\Windows\System\uCzJBOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\diZBEyi.exeC:\Windows\System\diZBEyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxVPpRw.exeC:\Windows\System\GxVPpRw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXOmGzt.exeC:\Windows\System\jXOmGzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XviBMHi.exeC:\Windows\System\XviBMHi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GoYQNvy.exeC:\Windows\System\GoYQNvy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IJGwuPH.exeC:\Windows\System\IJGwuPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MXkAReF.exeC:\Windows\System\MXkAReF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD53b95e4727da880acc54e419b4eaadbd6
SHA1054ed6c9c334807e06a6bb9687ccf68d3b7e6526
SHA256b692d0c5e88be77b308dab5255080910a692a66fea2f6303aa6ec7f261d7ebd7
SHA512a1a5bfb6c5ea9f0c7ca66b2e75616caf4ead97482112145353235762227e1b6499b82f049fa2e2f4cc202403150c5e27a61d8d6f871c9efc0d99c91127b26b99
-
Filesize
5.9MB
MD52e04d1dfe5d510d83c80fe43ebdfeb50
SHA1bf3e2038e53d4d56e049c4103411d71b9a1cb044
SHA25691b0d1d6cc3d3522d17f1480181402daa07b952152af820e9595afdddcf9d4e7
SHA5126abcd363fb48caa8e318f15a5149e27041a246113f2516b7353c6ab6e36abe125a3c8dfdf16ba73e16e01a17887e73a6dc050d24684c81d2a8e0b99fdfcbc55a
-
Filesize
5.9MB
MD521e0e9cc9cd714103cb6add2e76eee47
SHA1d72afb3f6a043c7729149080315fbbe413a72f26
SHA256fb49c5a65c79f844c371fcffe6a035daec26ffe0a21a71afb1ff3e0e1aad29b8
SHA512e2d19ebab46dc4f15dc3ccfbcfe1fd9db0e1821b7c16d39d6c3dee6279e56b930b874fc3076883c0e742d4455778ce7e009674f081a9280e88a3b020572e20af
-
Filesize
5.9MB
MD5388c1f0147f70ee2c2c6918913c914d0
SHA15564c4cca24dd32e6afb568aab1b8ead91a7d18e
SHA2567198f9f53f10d8ed353511898c2f58ed6acab078cc4134515ee8ce53c3fe3f60
SHA512714e423c0a6a317e5c58d1e02f0618068da95d244b11fcc2c534db441712609ff96d546491ebdba44b955a66c68e6fb6ef658d804eb4d6b5aca27a76de782c7d
-
Filesize
5.9MB
MD517f4fb2553a6f7da849305e24a508a8d
SHA1e1ddc84527241076c727e00056b2120763fa0d0e
SHA2562fa654a525b1c569725af9c84998e01ae5a387b853848abcaa6b5f92f2f09713
SHA512b3e6285aa070b1f4faa1818454589678c672eec88e4ca139d637780a4e40163922b24128f1e70265741d4619762be4626f02551e02b766798674c2c7e6758362
-
Filesize
5.9MB
MD51fe5f2d52d4eb7ed1f023541564cbaff
SHA1ed8ac0d653e7ca9ae4dacf94d4bc98c410eabad8
SHA256e8d467454f32b05e5de5cebdc7c9a660e16a4dcb11065735ae2eba0fd77639c3
SHA5120a2e5e04b0a551bd48c6a3f77dfff23e150d5de9d96add5952e57a0ce1803cca1b913f22891c2f3250b222f4347f8e19dd0a096bce754628d18478d48f40324e
-
Filesize
5.9MB
MD5f6e5f77842110be5df6ddbf1a3c59dda
SHA191cdc5a738e1e0c9704c0619302aa83647e141c9
SHA2568849a0d2221191cf38858f799473525efddc5183b425d2d07b171cca7a384981
SHA5122aa341dbd9fa96d6daed9a65e27da5109ba38f31ac04983fb1e89c72bf0640c1dff9bd6879a0c9119b60f32eb26705145587d72251a412fbf262613e04fa6769
-
Filesize
5.9MB
MD58c8ea1876cc6805de29d8b005a4196ac
SHA110d0fce888fea565d6d2cd7757874a5efdf3d8f2
SHA256238af9ae98f305d307df78e8e63897ecb86da853d1df32f84a1c8d5636313f05
SHA51214d569d27be19e819160ef468f19b459cd70786ec4be8688567d1a2edd0e6d46c876cf48a96e7a3894cb32ef75e062b1140585fd5fccf6abde3e9200259178b6
-
Filesize
5.9MB
MD58541a1550c627ef52c9f33398efe502d
SHA185f67f59cd64e6462cbdcac8aa7e36c0a6b03e80
SHA256050a9efef03764d901a3b268a1026aa4b8c9086707bb218ee2351a37cfcf3ec1
SHA5123d643417bd0517438d3d4c21f56c62ab9a49850e57acb10a5bc66a5957455fdac3a58e4d7e6f07a80af310d4e76650bd010d171e17c41d8438cce977f6fad91a
-
Filesize
5.9MB
MD599ce135ee0bb4ff1c77da487f9086c20
SHA1f4d99c12982e5bb5ecb312dd516daa13fa643ad0
SHA256ff728a80aee0d9c58fea7838953f10b04c5b42dd95f6e7055d16ff1b58485bda
SHA512cf7b936feb892acc37516033a9cc5267e35e3d5a1688b2415d75462b3ac8d4eb37dbb0e1648f1c99f7be46a5a202055b261326b9d44eb0c917ebdc7507ad1115
-
Filesize
5.9MB
MD5b3e1d5c6ac40517cd662115e7338d89c
SHA11e1e63b508a71ff4bd7126bab33a332ce7591f9d
SHA2564283c44704efc5f9b05af188f6a02468597e9a2de15ef6fbd7803857a51b640c
SHA5121ec54a0ad9938fd0b9eff1d9895ed20163afb7f4d9e5b64e8fbaaeb40bd2076239a0d6ce2c870317746613b8bd9263c70e765790f96a90676f0c1d86891a0e1b
-
Filesize
5.9MB
MD550b1db50903f8e63b800df0f06ec55f1
SHA1e8ce922f5f9e44c55ac151d01dc625e55c0cdb2e
SHA25609392fd003e3e426a68efcd13afd68448a7a55b34272faffaecd396c3d665b97
SHA51240b1083a81da712c087b682e34abdabf4f80dfa6c8ff1814914e5d9e4efecd18817c27d1b27a9a3a51f38cc3e60c6c1a10b5958a320124d78c298f972cb25afa
-
Filesize
5.9MB
MD5149a80967a6e864701732a7c72c3d738
SHA1a98ff5cf9541684d7d059b8f23438fa2702b32fe
SHA25615498f1b3ea64bbd4fff8828305dd46d125da724b6fb261b09c40cd0796ae4a4
SHA5120902a3d24e96eed170ff7b86f34ee4674b46ad2dc1c2419ce3adaea76924da9572f07c55260b60071239381d769403bbce33fd87f0e0e20da6418ee56d5ddfa9
-
Filesize
5.9MB
MD5cdc7e2d0cecbe99ba35caadfc1b78cae
SHA11d794d7145e8c62b93a5ac0ea6a1b4e47260993a
SHA2562ced6d3b63a8b28aa8cdcdf9d6c1537dd2460b6de7bc77844d51e0a52ccf5e3b
SHA512d53e57264fd49a94cb6444b08bcd8f7b19e582a36a53fb0e02250a4813fa583775af965a2098a56b6c0853811c6feee7ce2b42977884155f71da74dbef4a4b21
-
Filesize
5.9MB
MD58a2ded36fd1649e9fe3400a87efdec1d
SHA1c88c65e2bb5dbc61315adffea67a5e47446dd1b1
SHA2569323507b3b06ce02ea178257574f217e6d8066c27dc97fb446fc79322f5f1135
SHA5121a7c862acb4ba90ba15532408274504cc7cb0dcc09fbbce65f8246a193ee329a4cf6806f6824eb7e7b04124a8b2ef7cce361e3e011bad19cc4654f71d283407e
-
Filesize
5.9MB
MD5d37fe52b9c62ac696ccb499a550fce2d
SHA17f47dac6f84c6565a312fbf44ba42018bf03ed3b
SHA2569021534e2fa281b8bfb7d4d2284f4b2bcc842c9cbeff16c531245a3dcfc74458
SHA51275e43dea06f7df66685589b93f6511591d56487780a8ab28cf5e49d8b367e0cc256857c421fd696e791279e3bfadcc9d37a2fce93e9c24ed3eb6c079e0498dfb
-
Filesize
5.9MB
MD59c1af68c343cd19a2f1745cbd066243e
SHA1ab5850a5dc2cdf7ceadc62f7befcbedbac41d1f0
SHA2560d216f7734deec759574b38e1ef2caeabf4a0df17c8604085648e1b275dcd49a
SHA5127639c070c96c396447cecc31dca32deb0758a0a3c7a465d1b836a87de9f2ab41b41d0452471cf1aa55b3ea56d98dc2fc51d48144bcda7aef561a8d26b67f4958
-
Filesize
5.9MB
MD5609fcc8b88e59627390fd0a9165676b5
SHA189555a8d61b997e90f7876c049a2c25e7dcedeae
SHA256c0ed5c037c78b9ed39653c57f00a2c7cdcecdfbf7a4176f6e6e4e96bb101a3a7
SHA512d6dd89b28e96453d2d8179c8cc4896830d82d4e40c12f7afbc76226f66dd1b20e45512009d6f6d027c6f16f679fb3e98f7c7551cf99c9736fb7cc06a148ef35e
-
Filesize
5.9MB
MD5f3ab9e76de2098ad40c3f0caa8d80fb2
SHA18758559d9c920003c22b66173d924a3bfcd62356
SHA25693ae538088fd41df7ba23f3adcbc002c9971b9e4919164c862e92ba034268778
SHA512c4f72d8b882b57c7a8118b505ee0cbae1ffffbcf689e63bd356e1f89b3b43a13897976d641879896b22e074b0f87ca17fc4b0c9f70431a11162a0437ce503769
-
Filesize
5.9MB
MD57b24327854c8ed57cc4e203177576090
SHA1182a26a26bf52d1c4dc3993ce29b6ac8fb7c535a
SHA2567bc1bb5d0cca50f466b89bda5a05d4de4d9f5f7b882c5d0060efca7e34550df6
SHA512c127d0a20bc0ebe83ec98b18feb5590b65e95d98f0d74d3171e6af85efb17125362d8bd53bb3a3290819a40853804dabbad479980cdb01d6694d8e38c8c308ae
-
Filesize
5.9MB
MD5a37e2a4549776e7317d04f46fba315d8
SHA1935c3669f89cdc2fd9121cea5eb3aa487bf250c3
SHA2564306ad49f599ef73f51469b178713cbc0844e5b76b2bba11008e2601c571486a
SHA5127c3acc74e75a2c474923aad80a7e273be6c08043c85dbf7c0e0fe4c880d45f69149f255c7c49c243abd71ba7c7c009e546b6e316b2252c9c1465a2b49936d6e3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB