Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
09/08/2024, 12:21
General
-
Target
2024-08-09_bb1cf37adac63ce82b54ff5e18391f1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
bb1cf37adac63ce82b54ff5e18391f1b
-
SHA1
a0efb217a99ff175607ad2f0c85cc8026bc2227b
-
SHA256
b04d02617574be7bede8a03df00f44835881b541f8e4380f29822e1f7bedc802
-
SHA512
228a7f011cdf97943dbeac6172601a68afaa0a69ba0d89e96e6c8b9670097a37e28e849b69885736a5ee59bf91a8cddde55e3b531a0a5556461f9c1b15cbbaa7
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-09_bb1cf37adac63ce82b54ff5e18391f1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-09_bb1cf37adac63ce82b54ff5e18391f1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xquJBnB.exeC:\Windows\System\xquJBnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icPIetm.exeC:\Windows\System\icPIetm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ihAeIea.exeC:\Windows\System\ihAeIea.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykGMUdu.exeC:\Windows\System\ykGMUdu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwhKcDs.exeC:\Windows\System\WwhKcDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHwkQeG.exeC:\Windows\System\tHwkQeG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGgfVCH.exeC:\Windows\System\LGgfVCH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JyVAiFq.exeC:\Windows\System\JyVAiFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWJxrFB.exeC:\Windows\System\xWJxrFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fXpzmLI.exeC:\Windows\System\fXpzmLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzpuNZV.exeC:\Windows\System\lzpuNZV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsUiNsx.exeC:\Windows\System\wsUiNsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoSAXZH.exeC:\Windows\System\qoSAXZH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqMTsWa.exeC:\Windows\System\LqMTsWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZlxgXo.exeC:\Windows\System\UZlxgXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WjLOMhv.exeC:\Windows\System\WjLOMhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jiGetzi.exeC:\Windows\System\jiGetzi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CCTovov.exeC:\Windows\System\CCTovov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgooyXL.exeC:\Windows\System\lgooyXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdKwnma.exeC:\Windows\System\jdKwnma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmgnMaa.exeC:\Windows\System\MmgnMaa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e4f59be296ff97a5aaf626d670d78371
SHA1eb364faa7db21dec534037119812dffd4829f63a
SHA2567653f01b8dccdb7f010fbef4be332f2f070d53a6400f48792451609d6c6761d7
SHA512b129bb3ad319b00afe494820efc7c3a542bd6b2c71f0c097bd9cfc3afd57690b8629c4388df5ee1ffd91c5fd0503bcba40176a944c51d20bd16fee26eccb6334
-
Filesize
5.9MB
MD510a4d3f6db120baa968360efe7ea7c9f
SHA1bf07fcc767ef11a160ee35e462d47bfdcb362aa0
SHA256ae395913f6b5d6a24cc5cc6034dec47a5b7b3df33dfd5198f5d329695462da79
SHA512820f3329647b3d340a4168ec907a4abe97ca2dbf25d16045df154c071600e047de3506e4613e0cce32cf4c71497d382293c8418bf592f3a41284a6b5b4740b3f
-
Filesize
5.9MB
MD5b31663bd257284c77e32b81335721623
SHA1297dad7d68cb91a53f631abc962832e4ef299da1
SHA256d938c2a3c6f5a3a17f3ce87d3853c53c3405fc45b877f083638b63ebea964fa0
SHA512dd479e4ce35e43f61778138e4dfd8c314d08cc60e54817af7f762243b92a09acd0ea15edb632dd6b00eff93d7f3e2c84d7a56b7661cc5d3dded63b5b5b3a65a6
-
Filesize
5.9MB
MD51942208cff0fc6d489f4c8b13d821e21
SHA12b4248f6efb19318d1921c13f71c322e969c66fa
SHA256a0ca3d3c9b4c762363e125977d8c7e184100a4f3e5094322c7be03ff976f746e
SHA512fbb0b95c225937b603bef0de3caf059f2a8ccfe83ad2f22aef194e8471cfd7996f6236655e145eea8bdc63ddfcfa9adee6395d4bdbf22fc395216a6122ac26b1
-
Filesize
5.9MB
MD53d0830cebfcf12cd3548fc8c04589935
SHA17c7818d363d24acce09a4db10a860c6570bbe847
SHA2565c905f524a8169f6c1b6d382e0a041cdf368fbc9c0dcda1bb46411076bce24f0
SHA51273dbea20a32504c39d1d0ae4c9d0d7c22df09aaba6641c914f4a9b004b43d5f7640ebd30b577c0c3196dac52f9949e5ee87af2144c5a8d5b4571397d94548af0
-
Filesize
5.9MB
MD5f0333840fa2cbc63484d72e94d73d784
SHA1973cb1a4f403740ec70c1b448d12ce68efc39642
SHA256c9a66809cdbdc8d86f470c85fa8354698d25ff1c1d42d58392dae36cbfc67b5a
SHA5129090edf60de20f86519c2ef0dc776b80153e005f9e09d83166e0197c351e855b4a995cc0742c20e2b856ba603aeaaa7725dfd830fbd54281cf14d8a4563e5166
-
Filesize
5.9MB
MD548685e5169936813b008d2ea76774776
SHA1e3d1bb7726c8fba5b650e71357ec44c5ca7af5ea
SHA256702ed49d94c97325924948c8f85c8209deee1a105ff61b40fc24201b9e4cf22b
SHA512a5c2c8bdbfa62f085f4d697d70ca92fd183f1cb5609d5965fd712ebd026a166af05378be80fd22d67fb6d79f53e901471b3fd4ffdbcca1a3b69ef838a425e306
-
Filesize
5.9MB
MD5fce409aaa0fa3b614b6afdecdae68e3f
SHA1d087e32058c9d962549263a9bc972b46473e4246
SHA256c28dae710073cca19045f18257241f7810881efbfea542fc4fff328adfbfb6da
SHA5120ef5b3fa0e5865543de7e010e63adc0abae4d6dc39c5a5bbd6346a8823ff25b7b2fd2b85f8fd2927c5aebf1da3513e3bb6902bac207cbaea8631931514320697
-
Filesize
5.9MB
MD54d814800c28fb988f560ad4985060368
SHA11596500d43b66bde517b90a9142a60bfe7a05112
SHA25633aa203f3c799d9e4fe1a1028e8ca2a3f717e96d2ec13c5ddb5b125dfe9e73cf
SHA5127c4e9ef70c9610f232da8befdbe488a2d37605ae377212062f6bf0c4cfcd2942cece7017f182e3415a3a7d038a3270df4b402fe115dd7e841e152586ffd80a18
-
Filesize
5.9MB
MD53caa294e3ed1e2c9d78085efe4d3bb47
SHA1f06329054aa6373f571ee7a360c967e0a9c78bf7
SHA256288da50dd88157e8d0e2c93a76a2d0d04eda2e758078d213691a7753ee923679
SHA51219b6d8191d876b9d73479f5ce87d97910bb8754a6f55d5912daec44b2644e58be86f44e02aadcd17ff945d2f8621647bb57cf9605064e3797d816f36c84c884f
-
Filesize
5.9MB
MD5c837a203c21dcd88a639f3751583454a
SHA1bfbb9a538de4108227911dfc62729c83a85d70e1
SHA2560a298663babe192e3d5f32689aed659f5d55750d19e2aa01925e1087ef29dd6e
SHA512e565acc93b6ed29f8d4c7676d6e21112584d0bab6d7e60b1eeac13856a820fa7b41f66ee3c037f87c1398f303543da5507e027e97348f14e7c97a945d8a2f72c
-
Filesize
5.9MB
MD5ee3da500d90a959a66523a5f12efa391
SHA1b1b61f726acb005d62f223dab86427762c9b5520
SHA2564502bb77e13c6cadadec905411e75424bf041b3961d6ce6011b0c1310ff57ec3
SHA5129d7245734a4d30e7100490b677fbff5cc0c672b0b0dc41139789c77e47c71022aa18301b510c3bcc8fa193522015d6ac4ce8f5b4d33120214ea45d7a1903a34e
-
Filesize
5.9MB
MD5c86ed8fefcfcd616e91a0d402bd1ae5f
SHA12a27cf358eedd3846877d4da30841270e935c680
SHA256979a5f946a32de0d63df6834f9146267b74da5013d61d97f0b23ab159d8ff0c1
SHA512b8d13398a3f0f8acb97acb6edc0dcd498e66fa15ca8325dec78368d104b1f3e5bb324af54fb1e479a9a78b61af774a9fd805bc7ccec83a9ac45a9064057d87df
-
Filesize
5.9MB
MD54363894d95bb55d5212043131613f524
SHA171ea848c4b3826e1bcf2f97eec68b62e4e0c827e
SHA2565921f9cfb5fa997095852384185451adb23c666eeaa02bb0cdaca271aa0b868a
SHA5124fca7fa47be90f314a52b6da72c7d8f309ff73d202e2cb8fc5eb1e69206f842bcd395ef6d494342838fc37717973474150f9c195b81fb0105f8ad11b1df629cd
-
Filesize
5.9MB
MD531219f48b8789f3a72f2cf1b0b4a04f0
SHA10afc5e2082d03c2ddd55f6dd64ba0649ef360259
SHA2564056238bc9290b043dec4f37378204c8dd53171bb075957356421d2b30bc5391
SHA512e3e8f730e42dd8e48c761d186d3cf6d7bdc243d7e08a8d9658620fc90437810420e3a8dd1289a8f1830618c5624e0aef355c6c5c8ebd3657d76d83028013b6bb
-
Filesize
5.9MB
MD5c06e10f7cb362c18d6fba51f374d549f
SHA15b749adc861dadea13d1af5d199a1b41a8ae2d73
SHA256c1bb3860433cd70300f541fbae46ad39ffdcbf389ef7413270f1926a8fc352e0
SHA5121172182aa4a9d7aed2eff3fd90429fa2911774359cacd89ca44f8f6194224bbdaef0e0463de5aff9b4764291e6aa7d80b241d4aab1edc4ced3ae6c49c8a1df43
-
Filesize
5.9MB
MD5c07ca40e65e24a04cc8f034e9dba9b1b
SHA161aad2720a1a04c8c659b948b70207d99b338a96
SHA256c3387398881e61cdf1c3379b68dbd26b30a50e50385a0d40141de6941820dbff
SHA512917c0ed54110bd95db32b8ecfb887354a594156a0b74bfb0cdec52ebb9a5276eac790fe8e4e2fafe0bbc16791b79c1603a765d6a33861c2286b6ccd1395333b9
-
Filesize
5.9MB
MD59bc0c50a145f15fd02004d7b88fd09ab
SHA1ad4d6b6603cf89c066bfd623d26daa848b12440e
SHA256599022483c57f0b28cfe8a2ca64a160370dd82d724a0014a0c70b8e289425977
SHA51218d5aaec655f81f85aac0b1957ccc7ffdd1deb631a38c783ed3316cbf3bba72205e0fc1574db2b037a9c687a903a4510175bd97f9188767e49093db121e9f1b6
-
Filesize
5.9MB
MD5bf9fc7fb1675532794c165d3a5295223
SHA1a12f6cf706ed4005e85bfac618122c0dcf234939
SHA25644eb6142185222c64865f41669dcb246cc04bd2ef1083c02fb207bb663e7e800
SHA512efd9441f01bed4f649d40a58aef41e965484f7c5e92116107da84db1276e23e6f98163862f50edb6a0fa16ac84d5e2130f13c6f35657b32476f69b9cd34b1d5d
-
Filesize
5.9MB
MD56a2fa58079a4627a3dbe189f16a89b47
SHA15cda5fa2add3fd684f69c63aa72c08b952289e6c
SHA25663b81023c5d8d26399a49841eaede1c3cc65fe1198c68da1e0471b8d4c5ac29c
SHA5128462dc8a63bc17b932a7550436c8827033a4ce0a130550ccdad3362e131a6bf539a9f50ba0ef80fea81d4f6016eb3d48b6a3896fde6197b7214b99f389edd987
-
Filesize
5.9MB
MD5ecde5415c480b0c1908488993bd2cc34
SHA1ad8bf0e4687f7e1d2efb87d4ea7d356dd1dfde55
SHA2564ca6779f70f339504166481cdd33a1d94e6b061c3a6813d19a9d4a627aa30a83
SHA51279f6cf36db3855c8390c35efb0b89b370535fc175afb73a90fc9364a476f7b836250a22a2931a618a31d0e825e9dd2400ff91b320f62d9c5582ce143be2ec52f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB