Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 22:51
General
-
Target
2024-09-08_88b31af507b0ff2b4dd9a21482ca25a4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
88b31af507b0ff2b4dd9a21482ca25a4
-
SHA1
baa6c5008d5f6907d23f680008235bd8b20b844b
-
SHA256
deb2f85a81a24eea3721aa6c166e3a08631ab19793ac781b34783f60269ed4e1
-
SHA512
8a33f7cf75b491f5b90adc23559d45b8e31124200c65033b8ffb5bc7b8a2f8729dec5c66cd8f066a5a14333f292d0a6d35f2a60ff83aee114b18ae439445c6be
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_88b31af507b0ff2b4dd9a21482ca25a4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_88b31af507b0ff2b4dd9a21482ca25a4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vBxSPbZ.exeC:\Windows\System\vBxSPbZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vhWcLdj.exeC:\Windows\System\vhWcLdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMMCqLf.exeC:\Windows\System\oMMCqLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqEvZJe.exeC:\Windows\System\lqEvZJe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhKOsti.exeC:\Windows\System\WhKOsti.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lKpIMoB.exeC:\Windows\System\lKpIMoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XocdaQE.exeC:\Windows\System\XocdaQE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HPsQgTH.exeC:\Windows\System\HPsQgTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWRDHOj.exeC:\Windows\System\OWRDHOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfKwOry.exeC:\Windows\System\EfKwOry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyajOFV.exeC:\Windows\System\iyajOFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVfowzO.exeC:\Windows\System\WVfowzO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SwMWxVv.exeC:\Windows\System\SwMWxVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbNAQaA.exeC:\Windows\System\qbNAQaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdbwvBQ.exeC:\Windows\System\qdbwvBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRFhdJY.exeC:\Windows\System\hRFhdJY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gIYyKZj.exeC:\Windows\System\gIYyKZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbXEqsj.exeC:\Windows\System\UbXEqsj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SVjwuMk.exeC:\Windows\System\SVjwuMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iiowlVt.exeC:\Windows\System\iiowlVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFlcgXu.exeC:\Windows\System\PFlcgXu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56e0bbf8dd28eee11b1cc9cb4cb062e9a
SHA13d42a6e433175cd476d55356df4db7fbda1883fb
SHA256e72d5f39d9e396e58832268bae5332efee49f7e676c4c1ab8de32cb22501986b
SHA51237e1da9ee734501bba3a018df0d038a9448bf016687892e4ee074d0df5db452f5db37dba31f30cda743ce2161031562f4d4cf092fe82098698cd3e314324b45a
-
Filesize
5.9MB
MD5c167d2532b7826d16fa5ab007e7b908b
SHA14c3a387d0df5e1032b9ca1aa89ff87bf21868372
SHA256788b19cfa1e6fba738bb8cc3f8c5d9556a41954f79c6b1794906a145f2034075
SHA5123b27d99a7dddfc173d341e584ef4acc750a11da2b097d52efbccd842a698e5c159c9aaccdb76726fa001d63c345ad88f9d7875c8cb23756228772dfce3620ff0
-
Filesize
5.9MB
MD5b12b64a87eb0c05833aae5f43eab4516
SHA10c9175d864ba1161ca3be4314d8023ffbdf57e0d
SHA25612ab7af07939e2db4343ea250cddde486c0cad90330112ab554bb8b72e77b076
SHA51258a434786be48ca4f218bff19fa591a0f716483e67903cfec21778299182690f86a2fcbc26c4258631e203e6e0673723c0da47ba778250e226e121829b36980e
-
Filesize
5.9MB
MD513525fe12e8a8e8a4bf28509ce51ef05
SHA11923c305db86d3b639ebd4f08ffc1b7b1b52e7b5
SHA256623102d0e404ca3b882cbb144c999eda324e3fd3177be049a482922988cd7c16
SHA512dec7ac527c6b0d8a0e5bd729eba29e8ab15071e4d2f9309dbce4a466053c586a0dc45a3bf2d20da96ed6e041a5f5fab47c1268436f410952af29edfb88ccf8ec
-
Filesize
5.9MB
MD56e38ee65f6fb1623a4ee22c970c03583
SHA16e37b410b94f37558be64c19922f124032eb4d1e
SHA2561029944d6becd2087f936f1cdbbe433477a137bb566cc2a7876c271481740f9f
SHA512f644e9c973106a1309eeace1f360a16fcf7d55a24aa6b8ab5b1998736671aa319db3670451cee8033ded1517f08b07521fe52c87b2d9e9399a4e772e942ecb54
-
Filesize
5.9MB
MD5f980a719fd264ce49b9c41aa7175a118
SHA1a7ac2e37434742d3765cae83f5a10420ffa7eba7
SHA2561784345f5d8c4b1e6d7ad8a82e680e64b8270ff815fea8e4e20997bfaec5f736
SHA5122c9c1646b263429bc52a05db9539d2bae288ddde39120e3ae68af4de3274e10269f3dff7a78f53bffc2deb21b1b7e32c1cc2aa2e9d4d37ecd2b2f46c11fb1eed
-
Filesize
5.9MB
MD5e83b4fa6ba8f329e17336ebb33a6a06a
SHA1ced02abeede36211c76f0b446f2c5c10cd39dbc9
SHA256f7e6819f564f6efb469cd1302562748bee59be90194f82e76800f17ab43bb374
SHA51205cecea0c414e44744a9840de9eec2e87c572f3dcc25fef070526fd3b3fd4a47bb6582e4528442d0b0d37630222df09bedba99e13a64a581dcf184f7eacd2a42
-
Filesize
5.9MB
MD5ae73d057b7671cbd7bcbe4e08f8d6c35
SHA1c56e506e410ce052157bfce4121c3148c898f0cc
SHA25683827358a0890d55a82ff8a4504e767948e7561710c23bdf46f2ec847d5e59c1
SHA51224cebba61446c92458c8ccebd02a92fcd120aeea14b20eb7ceb854fe4d93449870070a598f9688e5b436fc99a7b0fe49d041a0b38e80015c3f59829696b9fa4a
-
Filesize
5.9MB
MD5e91a7f382adc53f6ae030685263e9d92
SHA1dbda7d48ebfae1f40e011f08cbf25763dde2b06e
SHA2562a98e69f3bda2b1a073fd19a4e4ed8f4c2a32f1184e3d3041ecf09f9d412bf85
SHA5125ec61deadeebf50d8ca48c74c142b274a3245b3c62fb2b632e0ea6e489361b24f6784a55c89ff535507861f2d51dd06b20259c9dd2274c7767c5716b048b897f
-
Filesize
5.9MB
MD5cd18f50bd51428216e9b06cc86b116e6
SHA1446aedd2e34235c5d59154e1adb34973cf3cc6b9
SHA2562827f5254636ba4cd16c99e4e3aa8f05bfb0460eb2d5cae930962578df0f97ac
SHA5128747336ab505adc3e3eff5ee3d75a3fb0fe29b0eeb37ad28e8ed70e962a2bf2c921492bb98a46445fbae7f0ad28048d02b8083f46dde4a2d5d16fe4fce79fd7b
-
Filesize
5.9MB
MD5bfe8617891583909c9ae93cbecce40c1
SHA106cc57c6ac072d3458478503c8208536865504f6
SHA256e79818e10c0f43ee056d3d83097db60ad9c17943849cc1b7d724122674e2bb85
SHA51269e9f33657a48edfb82b997db8426edb7541d5d1e7f8ee0600d6a65ead5ea22ecafe71dd95d30cf425fd344fad49daa934acd4bb9f21aa8f2e67012439f346ab
-
Filesize
5.9MB
MD5f9f0e069f842fa224fffc2c5e981cbc4
SHA10bbc608e6aef6ab454ac195c08193bbef1757841
SHA2567e880615c8693a9da804e55eaf8b59795956389ec5840cd669f776ed10bdfb9c
SHA512366dde6944ec41799b4ff376e94ca4527322843a99c3fa379b2e90a50e63e836d8ff6c2c2590ee76008846d66ade2c6e17d310156c71ccbaa0004ca097b6bd41
-
Filesize
5.9MB
MD5d2b28aa0d2f6d6eff315584a777bd27b
SHA159161d97a6232974f74c81c36646ab6df7df4e12
SHA25651dc690cb56be2c4774ecaca9b38da82c9ad7d3aa2565e4c046bc2c357b0c0eb
SHA512b7661866773a45d425a034d06fa79aee4010d6d00d3e5c5ceb3232d61fd4ec70caa18612a14b04ac381e675aceba6c8330f1da2387b7082eb22fe40bdd7a748c
-
Filesize
5.9MB
MD5fd981112cf4a21d136d9d5004bd9311a
SHA16a24289ea7b58527345a609a562e78bcaa65b4d8
SHA2569f91944f33187ecf3ee53b257af692df15ff50d3d669526697aea6daefbc8c77
SHA51297b9836ee74bd79d773e067303b92f18aea91c94b9706353cf9fd5b4b5af42ad97e45706b5fba495dc10aeb83f0e606fa69cf6e902169d68b541c09426ef08ec
-
Filesize
5.9MB
MD5ea09cd1d1f991d3a9eb45e9d2e10ac9b
SHA15fb4dbcdc2d924811ac8d021e3d7fa3ea8e5be81
SHA25688b4824b5e096732e8651819fc8fe538a57bfe3210a507c14c2de81f1af4047a
SHA51263c6db7370b2be1335aacdf1fd4cefd67f28d9ad1ac5cf97504c44c0231f514b20b64c52939ada76d1938dc584389c1d630dd507d31c1fbe643613e389f121a9
-
Filesize
5.9MB
MD52fb9702725eb79671356170f924095ae
SHA1266ddb4434b2edef6d9bc979ffffa895ca8e4349
SHA2563e7437af62d6f7ad36a77613c3ac40662ce346732a21d589f26ded08f8949059
SHA512fe7b714efd1bd0364778ec2897da089de4d65a384d45d2452733eb86957abc58eb81d2a6cb52d93d7b9e51abc0e643bfe7a537a943ef8da6d498a93cde7efe7f
-
Filesize
5.9MB
MD5d8f3f8979f719ef38ba433e344ec91c0
SHA18aa7973594c1e5890e4b3568492e1fda9e4e8f6d
SHA256b19b0361974d741f826be01e98138f760ef52a1749e7a57fc417ed8ff8a34e96
SHA512c5bfa111df4d36ace94cfa5f4e42682a551d5cf39619c8c0cf512254232f69d6732a134d56ef833b4d4622336e132ff1b3c54f409869cf5ce52e9d76e49346c0
-
Filesize
5.9MB
MD55f25a1a4b584f8a47cf80829ec09d20f
SHA1d459e7f4a2dfe77b2167b1ff8db5d6b4004b1eab
SHA256242e0b2e46ffccbfa9278dcc2a6e1f5edbddf5bf20003762e34914568a87afc9
SHA512781bb28e288bff3d690f51aa668631f3f68e79eee8649a17e016257ceda7b87f9b5b0f6fed63187658ad88caf00ad906e4c6aa1c9180cc551fa50da0a4e77621
-
Filesize
5.9MB
MD5869c89c4b3f5a1987c2c218b03284fc7
SHA12cf56280d0392cc92667f3b9bfa6e7e69b03d747
SHA256538397cb0659499a0b72c99aa910081ede171580a4fb58ca5e8022135055de86
SHA5121058a4c1efc4340dfb67d1596d5915bfa8204121f30d8c915c575231b2f6a263eb334991515ca6fdf48a1d5bdb1c81c51dd879f879c8cc8b5d379c0fa91e0a81
-
Filesize
5.9MB
MD5744b8bc6464b35ec0b52097179d5b72d
SHA13acbdabc47c51e9b6aeb5ab73de1753938e50417
SHA256ebb55301254e7199e31942c779d7b72605e89c5e565381e8898617318ec18212
SHA5124383486d23f47525cd3ea8b1749a9858badac4c7a323d515e21adc43fe1e32161e3b6d94de3985c6a7eb6aac47b5982a5bbea816d0788cb65225643f74c2f863
-
Filesize
5.9MB
MD594a35ac5112044825cb11002879843ed
SHA1a12b3a72e9d68dddfdc8538dcf094db6a3fa5ce3
SHA25688d3b0674062b93ef4c1902f8ca23b0f9692252f8e7a5de298de3ddabb354ca3
SHA512280a71fa302371917c5d068cd20688639042027329c84a3a83f7791c867b3d3a8864e2eac4d7b25edf5f0d6dcbd768ba225e6abf1406676ba95f60c389fd78ca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB