Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 10:13
General
-
Target
2024-09-08_8c3367cdffd87b16eb877420c7eef42b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8c3367cdffd87b16eb877420c7eef42b
-
SHA1
c41b6348a112f9c6fa973b65a2fd9dd14c446515
-
SHA256
5f1599e37a0886386fea827bdeb8c591d582f8c4fc37e29fa5e8224a426f88f6
-
SHA512
3eb70326a2c78f3722ea06b9ebf6f7d09f8df8fc3e8cc5ade5336d8efcc9e0e0a5c9efc06a5ec6043aca0d4cae58884ca476b3543dea1c064dcef709d7475c7d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_8c3367cdffd87b16eb877420c7eef42b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_8c3367cdffd87b16eb877420c7eef42b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aDeqGqU.exeC:\Windows\System\aDeqGqU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGtvXSY.exeC:\Windows\System\UGtvXSY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvncTXC.exeC:\Windows\System\pvncTXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYZpTdI.exeC:\Windows\System\KYZpTdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQiRVmP.exeC:\Windows\System\hQiRVmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAUiovi.exeC:\Windows\System\MAUiovi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HmTJlsi.exeC:\Windows\System\HmTJlsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJofTog.exeC:\Windows\System\WJofTog.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlDDdFE.exeC:\Windows\System\LlDDdFE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cZGGnpD.exeC:\Windows\System\cZGGnpD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVscsgL.exeC:\Windows\System\XVscsgL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XtZQNdS.exeC:\Windows\System\XtZQNdS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZivLnDw.exeC:\Windows\System\ZivLnDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXvpBqQ.exeC:\Windows\System\vXvpBqQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uficsIf.exeC:\Windows\System\uficsIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ltsBvzi.exeC:\Windows\System\ltsBvzi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amkzrQp.exeC:\Windows\System\amkzrQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiEbgJS.exeC:\Windows\System\uiEbgJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oHvrSWj.exeC:\Windows\System\oHvrSWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCVVWQC.exeC:\Windows\System\XCVVWQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AIgCrqR.exeC:\Windows\System\AIgCrqR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c902d36a0f213aeefb6e968c5c8db2e1
SHA129117edf6ea801067ed43f90b1697924f3f88861
SHA256aa4e74e5d72a97e473f33fdc29d47a1b9d82e3202284f4efd292e0b9a84f3d48
SHA51239ba1e34d7a72c39bb1d6223a7a4f448b454073708cf8bb2ace69adaa64b12672d5b97bf3108794234b85910f84c2e083c26280c4c407ad7f1c435545cfb1229
-
Filesize
5.2MB
MD50d90f2cf1dd0bfd335775a47c5e27d26
SHA1ca745a192b3a63485f8b9cc07bcc4dbc6ae7e51d
SHA256a073d2fc59e27ccd1c5cc99291c682c6d162e05e97b0a71374dea71bfc658b72
SHA512f673c60b2a7737ec87d44a53cc412326b04e34c2b3cb380f0c14a36f3730b34def3fa2e1c6eba8b36627b6d770ebb9aaa740648f3746202d5e3c58383eea37b7
-
Filesize
5.2MB
MD52589ef5c149d22cf5d3bc9bcf64c5d13
SHA1c8deccdb7cf42db40772ae1ec82a9e74f63e6fac
SHA256b1fe39223a94e3141be5b075c0eee9314976ce35812c5b327d4e22623b633af4
SHA5120efb70a55a68bd017538914110841f54cf8f06f9270064a0d8ce8ea22c8912aa75b0f0d990e2dc4bfa327f1a022d07edb458f3054b07166ad954b4844d4bc84e
-
Filesize
5.2MB
MD50fca19b73650d9714ec4de0eacdea19b
SHA1cd542b1f87a4f5eb14540d164f4cc4662d742b81
SHA2568a2c6f2255751ad8051f849af26b62dce3b7984964c0c5d8462f032723930b31
SHA51264ebabd19f8d617d3d7636e490b866f61b581807b8094aebbd14eefa016bc10e8933626e7f81af6b0a9ae760eed034b7f4eb5d1125ea9ff9c1f8de3b63f553a5
-
Filesize
5.2MB
MD5de1ba1fdfa87feb6aad3718225506c40
SHA124d62371badf1582b941edb70c358eb7db4dfee1
SHA256a7c4f5e02669bffe25e41bcb1ed631c96ada3f9dfecfa57aefde479d42156d1a
SHA5123064f9057263a0aa41e97e9cfa754642cad228f0ac0bd128251a6d5992fdd5acd8eb4865ef3e35dacc24bad711d402e9cec8598df9f645e4ca75a75f819c9837
-
Filesize
5.2MB
MD59b27ad450b4701e0c029825ef74a7cbc
SHA1978ecc2f486faeb8de2826d6f4beb20c3d3be77b
SHA2560e3082d07302ea02f52ae6fc71a388ce5c6b4e00bc2b49d9758c74354cada2bc
SHA5124854d2b58a42d79aa7fcf28775e6d9095e292b246edd6f248bfc55b2116afd3c56885363f9f19aa2f153d28bb766fed66162cf27b829045444f3bc0c492ac6d2
-
Filesize
5.2MB
MD5505edaf2b763ffe61f49fc8b239534a5
SHA184911384260adba024d091f66aa4b39b04a88549
SHA25614fa1987df8a75e34b98afc5808db685095fc39f5cba623760ed8bfb09a23806
SHA512615369d237479f627929f0fe612e6c07ac6deac468cb4cd9f7f8bacb7e7be96b6783cb684ac39f0660e9be39e18b30e560c84d05e23d6a06fa5c32f3dc461a02
-
Filesize
5.2MB
MD5a0c61157ef664b6646af77e6554695cb
SHA19ddc0ca0463fd9bde58a291f23449ddc7fbf4544
SHA2564fe853c1afad229f8b2e19089be9f3291d109f1d514bab3abdce02854138fb7b
SHA512748d3e19772433fb7b97fe7690f32ce6fd0ecd67fbe2fe493cd9a0ce38459b9d2439abd4decde97f54e2fdc015bdfac9a490b33f0e89164827d26a4e14d67341
-
Filesize
5.2MB
MD59f259b3971f2f39e9a2b02593c7a632e
SHA158de100f1b87163554d54c09879528ea1123c7cd
SHA256bae13f318943936fb4f88a693dfb4b60bce3370bc409651eccb8bf36503f3da8
SHA512b34c61af824bc07544d318e0f34aa19d5e7547ccdf36bf92995bc4b6f11ca5bdb5bbe6900afab6e7f4a1906eaa06abdfc50eaad2b0a4cdccef6a7e0d129357d2
-
Filesize
5.2MB
MD5e6d9190665241d912dffcb8d25a63326
SHA1e67af8da20cf61312301c939c31bb222ad1fcd6f
SHA2560dafc80d0f62a189dddd7d3e6bdecfbff82febed98d184a0a147598fb06c5c02
SHA51224490cc9cee2d4910d5b99bb17093b6925d4eae1bd2c2c10ac722355b24cc50023a86b4d2694d8c60d4612aff0dec5a1b626ea1587ea7de3a3b1527d96d043d7
-
Filesize
5.2MB
MD5ba23ca1177384807d65169732e22a93c
SHA11029ec08ca4dc2b137d15e9a45e23ba66ec9c05a
SHA256e1700adbd01766ed2b7e159febabc60ceb9d9939602b2ae1977ef752ce145417
SHA5121c5a0e75a0067b3e39a273a5ab84d1b8265aaaac48f6078039a07ae7bdce4cf78b905c71901d712e749b344b80ad25cd2fd732f5a7672ae32ef56a28f9680999
-
Filesize
5.2MB
MD51f5364845ebccc947636d562d1c19255
SHA1ee432c2c5e909d14c263df70487f3ccce415db69
SHA256026ae3c27731603324736835c1e9a9b05fef7b70e42fa1f5dc489ba4419c924f
SHA5128102766552696b02f638d954c5a890b3f2219f9d3fd98a80e476d5e01c0dd0bae9f716abdb1a40c9e2e2bb8af15b6ee11b789902b445d9c72e32edc8b405c77c
-
Filesize
5.2MB
MD5e7d7ff1c2b6c4381ec75deb300baded5
SHA19bcb0012f31735ecab532686f321c90c1a287fe7
SHA2563ec5a1bfd4de8bd57f6b49093e49947c94bb2e8a55cd41ba1df71fe57850a242
SHA51272c732b5614e7192d92f722f963c71b214f63c52975d20464436130c277c0036c6d65919d55ee9de0c487f4125e2a3d0baa9837968c957f542634b48b2578270
-
Filesize
5.2MB
MD5a3674ef93b371c6738b07ad0b431ff76
SHA144dc90098fa21c9a36c9edf79ef77ef2d4f1fb66
SHA2568fb70074aeeb71e141e8b769992470a34bda1e2449df598c9880055063a83b3f
SHA512f6d260a8debf4bea66a2c49ab14c97a349d94ad01867ccfd2274a13de4518b2724b9972424d1ee8ab40bb7f95f9947390126370ecb2e6d6e82c51c662f153e58
-
Filesize
5.2MB
MD58f00367f129857ca203590afe2e4ff34
SHA17beca89fb500ee7f37e9862e440d05c708f0f350
SHA2560b0dcec4974a052fe02de184b8f5c4243cd9d3f1263dd69494b33a395b5445cf
SHA512fd5a41eafae3318e48036ad0ef3e088bf17bded2491b1d87bfca6527addab323d27e84d034c3eed64ac1ff8d8a730f5af54d16d60dc85b032d998a5d25a3f463
-
Filesize
5.2MB
MD5ef87700aceaf150df1e059f85bb286fb
SHA1dc0cf5bcd76440a925c64aa81634cbf9603d9cef
SHA256585e5599bdfb112ef0d581333a61ecf1525addeacad6988641c142b9af17f0ea
SHA512e735d9a789ef243fb207968ab29389930dd1106069248d8bd624aca3e76560d61a9f935704269e1b4637ae656c79cf5e517fb60517929f55295997436b94516e
-
Filesize
5.2MB
MD5d2e395ea77277da3b7c421fa0bce1458
SHA1b979783549767801cf2a744226769ce539d87b4f
SHA25653664c1ebcc99e44d4c8e29559c026dafe055ad2c21892d571aa375e735c104b
SHA5120ac22f42d74563af26cfdd5c7d450221883346fc5628b696949c5481c49738e7aeff41f940f39fb8564def0f834f8911c8e97627539d62224814466a1cecc67f
-
Filesize
5.2MB
MD51de74f8a4685416ce53d3b924dd43487
SHA124215d4ce2f99ae4400af27c6677345e64a589bd
SHA2563dbbec36d1b44747df4c8c4049a0bdcdbf6c85967a53681756389a853fba5d99
SHA5120cf8536232453f28043eae7e752bf68ba4b1eb919472a428eed09dc82b1045ac8cceaa460a5a6e9de52faa844253205f7a5987706b5856ec7b2c74baf15a6bc0
-
Filesize
5.2MB
MD5ebbb62e692f225cb5345e7e1b559b3ac
SHA1a9456caa57086ce4fa018602ab05f3cf34db17c4
SHA256bafae0f6e094250b2f11c76772bd2a930e3263765568222d41217cfac9cae342
SHA5121f1187302ce1f251a76b911d21180bd37f1fdcf5f98a8ac3954a4f4dd0a1c292131b453cb91e2b63a3718ed37994f15db33d73915ca22c6dd23be3cbc10aa6a9
-
Filesize
5.2MB
MD5244146302818dc955a3af0bf456a2595
SHA1463f4ced19731f4e9c1e02812b8be8f445999bf5
SHA25632b826e1fc7f0e114f0dd42b735bb44be12a32dd42ff92c4b589af38b30f8b4b
SHA512a9e1c7a3f9cf2987278eafd9d810643e130bb84e82ce40e8436f3424118520e9b7779bade2473a0389760c98bd68101cd3217547199983219d463f1908f25ff9
-
Filesize
5.2MB
MD58ee56679ba650e503f643dc9f47bbc86
SHA16c9416d9f8f346b1af5b08bb7e01231966d7df1c
SHA2562af9e2ca40514351c83bc5f7ab81a6b400796e4849446802a7343e6a302aa99a
SHA512702707b24b6cbfaf011993c36f3feadf0b9e064612ba79b1cf9d3cc8b86810ea91c730745bfab8de3f2fa10eadd8706eadc07786cbdb15527eb8adf2bd05dc85
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB