Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/09/2024, 11:02
General
-
Target
2024-09-06_48402b100d3d1c283e2bb3c7ed1f0284_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
48402b100d3d1c283e2bb3c7ed1f0284
-
SHA1
62988eb3c6689290203ee70e734049bfe0497da1
-
SHA256
b2bccaceaf694088fea2dfa0dad4c2a819a2b8aeb4b630cfbaa66a8796888fdc
-
SHA512
dd2a8b3d7eceb9fc828bdccdf19da70f4c2e3879ae602603a30e4f71827cb810f4f826254baa8a5c4cd6d4acf10da580db2cbafc195ca265a6f61cb5463a84ba
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUd:Q+u56utgpPF8u/7d
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_48402b100d3d1c283e2bb3c7ed1f0284_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_48402b100d3d1c283e2bb3c7ed1f0284_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gWbotBB.exeC:\Windows\System\gWbotBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vGbPtoJ.exeC:\Windows\System\vGbPtoJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjHDnkw.exeC:\Windows\System\vjHDnkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMYORZw.exeC:\Windows\System\AMYORZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dniGqkE.exeC:\Windows\System\dniGqkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KGkugDm.exeC:\Windows\System\KGkugDm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcYmzDN.exeC:\Windows\System\BcYmzDN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieDcUHV.exeC:\Windows\System\ieDcUHV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LbubKvi.exeC:\Windows\System\LbubKvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zFPnfuS.exeC:\Windows\System\zFPnfuS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zRxVTry.exeC:\Windows\System\zRxVTry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UxjPOak.exeC:\Windows\System\UxjPOak.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OFLQmCI.exeC:\Windows\System\OFLQmCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DHQvIFT.exeC:\Windows\System\DHQvIFT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LPTSzAf.exeC:\Windows\System\LPTSzAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FgHNgDG.exeC:\Windows\System\FgHNgDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sjHGTTE.exeC:\Windows\System\sjHGTTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MEUeJlt.exeC:\Windows\System\MEUeJlt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFRYUkj.exeC:\Windows\System\DFRYUkj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gJowIkE.exeC:\Windows\System\gJowIkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLnvkPa.exeC:\Windows\System\RLnvkPa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD50f2de5bf2b17c309ff486041b2986db8
SHA16c0268a7ba4112759a6604e0c28e537fe298a5c8
SHA256f7c1a8c75014d99892642e44083f22333e5956da174abab23b8b7e80e80b3029
SHA5123318db075de45ae9f124128d5243b888e2fc530d232a42a8946f2a7adde7192309f8bcd34a8ddd57b919197c4d9c118b1c22ffe80feb1d0513e43c57e9d6d729
-
Filesize
5.9MB
MD5f24428ff262834bf1223da4c026f75db
SHA1e8a0bfdf16497b4423fb693fa8448fbb08eb8df6
SHA256c041a7f33ed808228325be9d10b6bf6225f3be0f855cbb0bba8c3e8db40cfd8f
SHA512a5705b8f0b4a855489e3074df6588a96469ef47e32c6fb812fb24df2568267321a69620d095f3f0ba43082b8bc71735c1c40420c0966dd6c5df08fc944358e4e
-
Filesize
5.9MB
MD512f04b17461644551d8fe4e4be8bd82c
SHA192fab9366d87a48410f7d8d9dc112a55f8f82c59
SHA2563ddfd87893e37975c7313a5d5850129a4d71103ef009b4138232d866ff1fd387
SHA5129929d01be565fbbcacdfa4dbe1abb786067ed597384db5dea7d8a1449b2dec248db68c658d0d6742c890e88c2970eb4e14f9054d4adf28aa9599826e9fcce9c2
-
Filesize
5.9MB
MD5bdfc5e3b6559cf15be8a85ef5fd2334f
SHA1cb8933798f0def9531acfe2f15e136671afc7c06
SHA256affbcc3c8a5b8884e2d5157dc13582ed29fa1f472c25ddf87f9b95224474778c
SHA512b95df424118347968ba8c195b6f4d56cdc51dcb6d3f7594f91050ab538b92bf9188f9cced5363b47d42d6a1a45cfe140a5c1695c3b92a6658e9dc51143bd0357
-
Filesize
5.9MB
MD5a84b2d3008a55a1052c5ca483a733020
SHA1380ae56b27cd0b093d278f985c97c2e2cba208d7
SHA256bb55315ceb028d9cc997708ca9c44c836a3ffe0b3d7d17d0dea074750a010e5d
SHA51246361620372a2eef3c014607056793cdb599b5c88ddfe35ec028d69d99010ac692964d510913564dba6bc5f6a4c56e7221819bb5f07ca81b516e111787c667ec
-
Filesize
5.9MB
MD5af757fc6f0018fbef9f653335d55b085
SHA1b1b974b6e103cf7c2a3e43a840b45183881a922c
SHA256ef5fae31e4163527086d6401b565ed9ab2b16130cf16642b58437628020350bc
SHA51290b11fb943d88173a787567f1b8757c5e8804f54db6d61ef91c2aa5c66688a776112260e1076fb973a5fcdfa09b350c53fa44912213a3f6dcfed37500852df40
-
Filesize
5.9MB
MD5f3a3cfdf95d16d95b703609d9c285a91
SHA12ce4a744b08fbbe9c3a58afc80cc5fa5a019e755
SHA256f375744665edb237fcfe3641909c616151df94cd2f6f07f5aa226554967035f1
SHA5122be635c1eba1081ad86b2e438dd0ee7380d8e030c8ab8c8eb5bb01a966dbddce3f33479412b8821ac0e71ed79fb1a2d93c2eac9d4992556f5329e2e701d19e9e
-
Filesize
5.9MB
MD50e1d10af019b7f1f50cd2628f53ef407
SHA1fb3a43a30fc327e4f14106712c8bcf8dd8224c5e
SHA25658ee6961d43dd332c260112d90b3009cae77b1757cd4ac7a3c3fa2409759f0c2
SHA512b9fd51869d726ab164576a2d20d239844d705567d2fb8f9adf25d65268f2f368803480e50dc6a7e8f8485aa70b9e1eb2ca62ef6eba682119d3dbbe17c8a3d099
-
Filesize
5.9MB
MD53d13244a8f32627c85df1b70ec0439eb
SHA194ae16249a5dc6ce28d4bcfeb41307b8d7dad79d
SHA256879344718886da62302780415d9028e9469a99d97dc484c97d329a8abff82688
SHA512b3030be7c62bab27435a7bc2a98cc93aebb7ba921a8c982885f37d4ab8521ea5c8a55131793639526e928d9aa3d2d53b2df3922c97f8cc496d58c0e872b447cb
-
Filesize
5.9MB
MD53a2d68e62c5888ffd0a9cef9a8905285
SHA17d2e3d5f4a89a6d44741474896293e70745cb3d7
SHA256d59288ff40da764f46268d36c3b3d7f35dea73708a05e41a36c26fc45c70ed07
SHA512dc6f20bc622567814cd9089cdb5460e7e7dd8ef5d14fbe530af1e2d4e4edefdcceca1b4341a6b6e8fab038599ce36a2ac9cdd7dcc8b23ab10a1c002cc1e01678
-
Filesize
5.9MB
MD59bdac41959053ba45640ddd2ba3e0d31
SHA1ea10f59a7b0915f1d1d9e949f394b343d0eda83d
SHA2562db2503794e143811a0ab13fd12c234d482395a8726de7d20a3281445b37c316
SHA512098555f1e8595006bbe3b4e594843070791e0567954b36136f1f8a17486aaa9c5e75a4b867299fc51213a982abcb75ee2e53cf6f799c2419d1a5606f50a14a4b
-
Filesize
5.9MB
MD57e77047f4f25a162e2281c73e488a436
SHA1e88cab9f86fa252b441825e2d4d9275834b99dc7
SHA2564ad6e134fd5a84da2b1ee85e9b123f019375655f4486091e41830b02946b6a54
SHA512786de2758a4f20dedd513569ac8ebe0b9e8d70d760a79edb2c1577abc39f5e6737b4a58da9fd37875cb6581a4dcc210a1f5c58c38e1e6e85e3e4ba0439346fd8
-
Filesize
5.9MB
MD55862a297c573ea2a13344b4cfa7cb23d
SHA1e28426332d9a8ebff5fce90318077dcb9f8aa1e6
SHA256862d6ac5ac765d9cb38820a7affccb0e19fa62fe1ea346bac3fb0139e2a1dd29
SHA512e43b0da4025b5bd98751d79eadf51dcc94f764a2c5e2b41c8fe204895f04161b6b96a2f5fadcf6c2ea567f9bc590e1a31924c60789c403656942894c13eb55fd
-
Filesize
5.9MB
MD5f03c1d3a83a7edc80af2a9358dcb991a
SHA1125b56df0f1d7b0c43081ae2053ea47430605faf
SHA25670ad33c344a20f1101afd32354c8dda2bc6a876579b2b6442ef37dcfb574340f
SHA5124bae5bb9648734cea5412f9ddf3d50c9bf585516055c0528d5eca950be50d1da10c20d9ef3c53b1c21f61735a653c574a5952b2c74d4bf5569a3ab97301ee2ae
-
Filesize
5.9MB
MD57081b762e012e1eb7d84269960e14d01
SHA1af3080e6860ad819d7bbb3f4ac8fbb522266e39c
SHA25610b3c0e339d75a534262ba51709c3960ef282c0d016f84c57948a0063829923d
SHA512eb8d341a09f59d85054d2f1d846a7c7ddeb9b99080348c5b05b75adb01bc86cf995790e8395004ed1e8c8d2e8ecfc14021c48cb2493bc4eba426f8e18bace364
-
Filesize
5.9MB
MD5e95790f42422e26904c42e8005e257bf
SHA15a8ec185e758fa0f21ac16744d07438a694ea7ca
SHA256e2dc4241f1ac5ac8ababf1072feb8385fa57ed310f2c49d48e3eb09bdf7e75a3
SHA5121f17802fecff8f031b16218f6ced722d74f7d85131cbc8ac2a6fd622d52ca370fcbe9e21e4eed9c618d7bb4517140a889b17b9839614f5a0190eb68713952efd
-
Filesize
5.9MB
MD57bff3bd2107b2ff042e6a5ecd73b583a
SHA156edcd41a4508dcdeadea3e6975dc277119f47fa
SHA256f3221a97dfb7f1b64492e39771e8621c337fc37699005f84966985528d331ba6
SHA5126af84a27e019236dd9bcf51c829cbd0ced65719777b2518611523b7cb822c18679311aaea76929ec591c46d89d269306c7f1f2689915193dc22ac438b0713be3
-
Filesize
5.9MB
MD5a9acebfb20c0246f73877f6e2e0cc290
SHA118f504f4c67c296d2d0c7045fde47d457f176073
SHA25621db01b827b7b061d88e7f3eae66a9d717434ceb6325dc347e413230157eacd3
SHA512966edb2f14c43592909b38463435d043cbee05bd03e9a22a351c2b7c23e27a36b9ae9562b7ad6748ca446130f0513cf8266aaee5971e77469c230d0a375de545
-
Filesize
5.9MB
MD5fd107f8dd56d1674f62cedbc63fc0fd5
SHA16d733a195e7a2c3ea4b4e250041255673293bfc1
SHA25652bdfcc36ec1478941c5cfb8d759c8522b5ae3f0e0f8adde6562fd529349d8b5
SHA51200eaffa5278d99ea49562963c47c959c433fcd7dbcecc999b3194a77dd274364b952eb5340c323877e68febf6ced51c9a5982ae649dc4e544df64445804bf0f5
-
Filesize
5.9MB
MD53023db52ef7ad698a9bb87c218603062
SHA1db3f88455c236990acced5a5371c38b583008934
SHA2563275a9fb538d460e68e42b2281b4ef9e35e29e2d7b2622ac2ce698688826a633
SHA51262023f94be8e8028792423029a47e1d759b2652ded0f8d3204175ee4ff29c7061561e91851fc2cb25c87e09c21e1c65f9e398b7243149a09a83c8900201928ed
-
Filesize
5.9MB
MD5bf17b9e634d238c6675ff2ebdf8852bb
SHA1ca7f2296ac20990762211863b46a074a7e23b7e3
SHA256e8d9a0bcbc984b2f45ab6f7365344c67b182f61c03d304a63b4a6787687e3545
SHA512a9438494249670189b5df7e236bbb42578c28595e1fd57a5e9afb273931bea03a914c3532d730e62d5ada96f3d00ec03ee186dfee3083df4aa40e99cfd76950f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB