Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/09/2024, 10:45
General
-
Target
2024-09-07_0415c36f700130d3928d7866df40f02a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
0415c36f700130d3928d7866df40f02a
-
SHA1
5ea74f98358c11153cae671e7508303dc6e20146
-
SHA256
4a8e69ca6d5ac5d38b003c9529bcb6c5f9800b14231a5f56efa82765d15ff7cf
-
SHA512
680f2ddd6c02861a35eff74846c9eda470d1bdd279b3da0b7e4409465e1562815eebfc501b2c593f2359c19257db108195d4c2dfb4539e9514ca80f182703260
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUn:Q+u56utgpPF8u/7n
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_0415c36f700130d3928d7866df40f02a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_0415c36f700130d3928d7866df40f02a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yqGRmTK.exeC:\Windows\System\yqGRmTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThDerCw.exeC:\Windows\System\ThDerCw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWPeIaL.exeC:\Windows\System\nWPeIaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OQigWfZ.exeC:\Windows\System\OQigWfZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCkxmJL.exeC:\Windows\System\qCkxmJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZQhNCy.exeC:\Windows\System\rZQhNCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEaDZZW.exeC:\Windows\System\bEaDZZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMojOKG.exeC:\Windows\System\FMojOKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRKfxZT.exeC:\Windows\System\iRKfxZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVAZcoU.exeC:\Windows\System\FVAZcoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWmwRBm.exeC:\Windows\System\nWmwRBm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFQNlLg.exeC:\Windows\System\PFQNlLg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BIVTjIu.exeC:\Windows\System\BIVTjIu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xBMvPtE.exeC:\Windows\System\xBMvPtE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xflRAPs.exeC:\Windows\System\xflRAPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnamIOG.exeC:\Windows\System\EnamIOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqCzmEc.exeC:\Windows\System\pqCzmEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YkaezBQ.exeC:\Windows\System\YkaezBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bYHiVEu.exeC:\Windows\System\bYHiVEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcOKUzt.exeC:\Windows\System\jcOKUzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AUYVNaT.exeC:\Windows\System\AUYVNaT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b42bfbab13d6fccdcd85e679fbf37065
SHA12aeb0732b7e81cd828cc13341dbe979df52eb9e3
SHA256e28d686f5aa78d9416c610826aa8fc8d3edc66bdca8f8051b8356f1ea8ddb598
SHA512722308e8d28faa8ac139d36f836eee6146b38ad98726c937fb65bca627cd9c5a2d77a7970312db2fde426f82b6deed0247d95e65cac2482747f60a7114b89e5c
-
Filesize
5.9MB
MD524a965c5ddfc62d720763657b008ba34
SHA1b58be8c665a9356792b0c1371971fc989c1e966b
SHA2567501de640f3d2547ab458126dc8323b5cf307b6904a8a5535b3299bdb3f39fec
SHA5121e5c44617dadf3c3b5dffe0236ac0d33d51d8cb311dbebe901d23cf9058ba21a66da59b05ca777924a5f65de3a414ed094f522276fb2423411154662cde4c04a
-
Filesize
5.9MB
MD5f0e89326b37b2d1de450482fc977c6d4
SHA1ffb3179cb45cc509f02d0613e88c91a6a48d147f
SHA256de9987589c66535ddfe35e72a4a7b10df3b7ccfd2d41a47d083d87c9470d5404
SHA512593e0464d53685fdde2cab980a9534db1a871d5e4e9ba38f6665ad528d8df8f5c7d5572f3d569a760edbb189d0892902fb453b0df908b3588efe8c8ad75c8bce
-
Filesize
5.9MB
MD5084e6851f7c79a36d0424838a41f7ec2
SHA1ed9d08e1e4b7edc68bb9bf80c1da5b1ebb439ce8
SHA2565cf0b788bc79b018ce13a2780d2d904a514b37484db9a223f8b0e06eab0dea73
SHA51202d47adc5b9fdbd102e75bed7bf2b727ca588cecce7eeb33efa8b8af9912b60ab5077568165805459341a2fd88808c34161955e09d5f731b7435d10abaa84a45
-
Filesize
5.9MB
MD56255e6a5a507365d0f53337e1c382798
SHA1ee865a2f835a0bd52f742579c9c2265534cc5614
SHA2560b89b6819f643d2b58178b8e8e1ed820a8f9ca8d0b92ac8de6f3d5c88d914617
SHA51207785768e562c1dd6321708b082ac27d6bb8a4bc83bb5337cc441908e63671f2d71cd007e10b2767766f3a0f4b8f0e939ebc465b39e844b4d764d60338ae6236
-
Filesize
5.9MB
MD5262168b793b0dbdfaab2000b8297b0d4
SHA1e1e2ec12ffe02acaf22db354760676c8b19ba63c
SHA25649b589027c06f9b975a8d4b3bc08c53c9c546d5aa12b1862c2cef04261572cc4
SHA5123619145b642db79d597afd19839f35d809e36e80ebf4f9686c9a7f683f2efe67f5e7b01a356fe8ff9e17d19d3ea70b77ef642ebc592f32ab6ffc981d22cf5683
-
Filesize
5.9MB
MD588a7923504074efebf56b09c4c7f873f
SHA17e1e1ca1d6ad2e3ed91e163db133aa46b7ff7151
SHA256a28c2ab3ace65a594761c5fec6b296896f26620a68dabb47eacde5d1f77d5597
SHA512d1209dac62df1fd54c53e1755a3fcf944d7a24b84e17df88b173f1ef8ba34a4be28ac8e4634fbc4e855c54d61e5ad87220924ab7491057ddb535b293218e846e
-
Filesize
5.9MB
MD5ed6424164167749e7708b8363f43320f
SHA1e2b52e210957aaad2e13b3423a7c5e6bb4e4067b
SHA2560f88e9bb1f8ecda5ec5fd3c41fa3f34b9410fd7381182551342f7fe7695d7dd0
SHA5129f8fe6889e728ce3f90ea9148c41c42ed3d222e55a14654cfd24248f983bd3ff2dcc53b6ba88b92b27cf574f2d5207c2effdca4967451777d7acb4910a67cf49
-
Filesize
5.9MB
MD5583c13b82f1320104b738cac10b4fdb2
SHA19b0c3ce4c0a330d5473c93eff49ba847a895ca40
SHA2564513d71a5c526d3f487d675eaf456167d4457da89b5ded010122f3f0ce10f608
SHA51270c3ce0025dfc0e75ee16dd084cede82ae7a8d422dc8b3697714853b1926ab7b23289faa9f0f9b1822f581fa38388f9826b4952ffa6d1dfd88f008224f905382
-
Filesize
5.9MB
MD579df319b725232f53986586ff0613f92
SHA1dc119804287596d1fde3bd9cba10f4c8df705da7
SHA2560a26f87407aa998aa328501c84f5faa1591a78d98ab89c4f64597d0ed8e47afe
SHA5128b842ab6cdd91fc18af6a771558b99b0ce0cc9b450b040a7c863202ed222f2c6112b49946a3806f5d49a58b4172290eaeeb5ff1dff575ff837e816a80e3ac9d0
-
Filesize
5.9MB
MD56e1f1ebd7601e49efb97394e4b4d916c
SHA1426bf2d1d23b3afcabc115e8ddcdfb34d8911fe9
SHA256c1e578398bef69d23e93342989c02ef6eee01a7124250bdeb509b4472ebf26ac
SHA5128f2d2789eeb7f2ee92b122c7f96dfcefd9bced35e2667edd57c871ffa75b6073fe7fedf7a402ff4f516ee54e096b2072b510f9fd1d6b9bd04ca56a53c47a68e5
-
Filesize
5.9MB
MD5a6f9cffb9adee673b5ff9ce000b65bd4
SHA15a185b29aec30cb0f0cf03b2c1a24340935eb851
SHA2561bd71cfca7ba772d47280db3c371d060d6d055d43c262ef3868abf91259171e9
SHA5125452751beebd0fe5891ff9291435bb83ae3b1d62c152db6fab641e18c1508240dd6883deb27ee78b6c573d5106f606770dbcde306aaa9733da83755bd1f2d49f
-
Filesize
5.9MB
MD556e3a19f16bb7f34ebdbe217b685019d
SHA1a5dc9fefe9f197ca8ef45fb78fe96106da5eadaf
SHA256e14b1508bfe27cba6be7010916888bae651d8fef233e8abf6ebabdaf967ca3c0
SHA5126c629d706af962fd02df606e8f76cb30fa4e772a8009a81005ed6e2bcb84e90ece91df10a1766735bcc36b0046ba31a302deb49e9c3c8d51f0249ace6c8733b0
-
Filesize
5.9MB
MD5a7f5838374d59aedf697bd17efd1b699
SHA1da385138c637f181484ecc1378f33a264b62256c
SHA2567a9ed7f99cfa610cad2d4ede73ce2f687ee7f131e3024060bd0f771c37c295e1
SHA5126c15e64517ae0de61e524bdd20abf807eccc23871cce835f5af5952ea3327309ce81e9a37a3619d6dc47305bac73f4d0bc6c30f1ee9ef72a2838b16e2dcd9b8a
-
Filesize
5.9MB
MD57f58f483e04cfa48058103a639dd42b4
SHA1191dccd2f5f7b6c3ce20bb8295adf7d05203bcc8
SHA25644b2b1ef8f2950b2fce85c538ca0ca168fa7fd6dcc1401419489d1f2392e76fd
SHA5126d44bd3a4cbb7c690a63fc1d8270b76ea5fdbac620e8cb4e6a8ebeb753f52ec03183bcfbea651da640a59600d245fe4d387fee971fa68f369af494af0d30da6a
-
Filesize
5.9MB
MD534a819f17cad8b1c3d12a7798cca7e7e
SHA17c16bf114bd93eb784fb403b416a97312cbaa6d5
SHA2566b18dba553fb44804221184fc10ed01e7c4735ab2eaf549e15a2f10a6f7545d3
SHA51265ba9dd26efba5d9adde05b23eeef8cbd59aed6bce4a3ba7db078100737bde207e857834adb6c0970c232ade7701384f6622f755d0a545bf47139cef1a05fad1
-
Filesize
5.9MB
MD567173fd43df3d40b0e90ad9bbfe3217c
SHA1f469dae0b12c4fe21e510785e1faeee250a8582c
SHA256178c329ef89117cb46d7c03b757f7719cd0192346ce2cc9716a4ee03c9650cdb
SHA5125e32c889221ecd15e01f4184a776e4fea0bfbb8f6f7970ec2f4d675fb1d4ae3e8ee8fcf954cf625f9402caa52cc599a72f2c2b726ac75ea0f1c42d6790d4d9af
-
Filesize
5.9MB
MD53bffcac42cffc8e3963293eb18e465a9
SHA159d32d8cde37f543410e486502c2bb450b197c01
SHA256a6313a106e689d34d94b397bf0e79920f90b7f34f230b7844a5d969af7fba83d
SHA512cbbbb3a981b25370039f74518c7e730da7c8b2694ffc3d649a5e138fb7c15d3f4f53a385e2afb545f08b73649ee62f20b02a7e1333f67409960771ff033ba2c1
-
Filesize
5.9MB
MD5bb237cfd6d404e79aa1e8dd2aabe5dd8
SHA13e8bd22e92ba6b62938e8acbb42394dc1e5ce858
SHA256a54cc62b0a8d85ae562c5dc2ce70287a4656f5a9c5ca3ef2033ed88c8c42a054
SHA512ae69a3758f7cd815f6d682a3e54cfc08d5d466631097e3f365a37a302252e4ee066465968115f1a2451859cdfd0ec31a867361788a1197ab8b651a5ac36d00ad
-
Filesize
5.9MB
MD5faa11bb6806b7b659c5cf0e5173755f7
SHA13fd612c4a0b93cccf5a5c46d5467c653aa57d9b3
SHA256b0d7410ec4f52c36c5c91d60ea092d2861945ff913a79479e4fa7f90a5fcb3b1
SHA512d145407d3c1edb61c7ac4b19aafcd5405833e01fc49fbd704508e122ad15a7170c9e44fd05d90dbac10f37f231936b50d1b94c69bdd66c126e4ade9c1f422108
-
Filesize
5.9MB
MD5437d172a4397e2af252375dccfb06906
SHA19c17137e2548091c1fdbe88bf009368ed79c4f5b
SHA25668b716b98786fb7b15e92c80aa2ea122ab0135698854d1fae1cdc5f71762511f
SHA5127327945184fef98ff7cbbde8077bf6e7151b0ef7bd3aa45df98b9bc0dc6564f9a6cca72313aff718e31e3501425d5b856aeafd86e6a2d005cc77b30bf3322a16
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB