Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
08-09-2024 09:39
General
-
Target
2024-09-08_7f28abee9eba9514ee33eb155235a707_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7f28abee9eba9514ee33eb155235a707
-
SHA1
ec8fcf38599bc12bc51ec2f208b5382ce74fb6e8
-
SHA256
db71dbe29d6766f51767893f071bbb84d432e5ddbf78147396fdf1ed62a56524
-
SHA512
e45b2c4ec7b958414df38f891863b968eacb074b69f69ceb6f8c912607d2b601fe8e669816cedc75e4019c6ce35de841f11413cd39f881e1bb34ce627263358e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_7f28abee9eba9514ee33eb155235a707_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_7f28abee9eba9514ee33eb155235a707_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WCNajoI.exeC:\Windows\System\WCNajoI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwnkMlk.exeC:\Windows\System\dwnkMlk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehozPRd.exeC:\Windows\System\ehozPRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VtcBqtF.exeC:\Windows\System\VtcBqtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aIsatmA.exeC:\Windows\System\aIsatmA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUaqkpQ.exeC:\Windows\System\DUaqkpQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZzOzrm.exeC:\Windows\System\NZzOzrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOBYucH.exeC:\Windows\System\aOBYucH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzjKikk.exeC:\Windows\System\WzjKikk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVfvDdS.exeC:\Windows\System\DVfvDdS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbAWcCM.exeC:\Windows\System\BbAWcCM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOdAxqh.exeC:\Windows\System\lOdAxqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyKFDhR.exeC:\Windows\System\SyKFDhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ranSnHW.exeC:\Windows\System\ranSnHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrgRSgw.exeC:\Windows\System\CrgRSgw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BjlqcHQ.exeC:\Windows\System\BjlqcHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOeVOfs.exeC:\Windows\System\nOeVOfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPqWrtp.exeC:\Windows\System\EPqWrtp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VWibbxR.exeC:\Windows\System\VWibbxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHpxqWG.exeC:\Windows\System\BHpxqWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntmuLTA.exeC:\Windows\System\ntmuLTA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55273c51b8b690002ff3b2b7308403df7
SHA10d18842775afc1ae053a74475fa702780ab0529b
SHA2562796125843386c2eddaa4e751a9ccfe214934a39330b071812d684abbcf7082b
SHA5124707bcb3f07d07b50685488e6f4a1200f0eba51e140e6872d4c7716ed587d8051389e3912ebbd448b5dbfd1d9e53fe933e6d811389286ba50d335280dbb7e07e
-
Filesize
5.2MB
MD589062b99799f9873d273c12e9b6887a3
SHA1ff1f516576fea07f2cea0e15ba3e207f97752d36
SHA256597a28a5f4bc71d3f938bca2c3054e5148dd5f7b888b22fa797685e4d736a2aa
SHA51201eecc97504985d279367980cd4839eacea4f6da90f9b14550cbdd76aed2f31e1b7371f3b9d359fd7e82a24d2281bf248cb2ca823aea87bb16185c0ae77d4ea5
-
Filesize
5.2MB
MD5b2a792bf2312af997ba2cc03198b2f5b
SHA1f4816eea9ccc6f57e82edfdbedd57ab8ecdb98a7
SHA2560ba32df543b6350d4eefde70e709c985827aa9a18d78550dc6e038f308d57b84
SHA5122ff462e4baae807a9a5882b1c11e7da244d6a4dc49e2ec3134331a2d424bb6d4105649c5654727a1862e323281c4ebbf55218ad60c59c7f58d651256e7ba17c8
-
Filesize
5.2MB
MD5a7e7f33ba03cba7d22886873314e4287
SHA17e7737f76610f40f380f6171870d0310cbf0b0ca
SHA25691e40b32e907098adef7e95e6850aa136a04dc6d8e49f5d9e89d1de2e43e1b84
SHA5123c7dbb811c8b07d64db1db0adfb497734803e262820137d20c9afcb1ca5d2b2441f20d9886844710d07112f99c95314922a2afa9ceb612bce198b8a21865c630
-
Filesize
5.2MB
MD5109263ff9046ac76186b6aba647f7935
SHA130aa422a16e9b4b66fb5fa612bd2522ecfa649f3
SHA25608bd9ab0783a9555e083c073962eb1b0505d5c36de07a41b4d99de43e5012748
SHA5127bff25d36a436721fe49f1d97ef5c3d2883badba30132afcf53ea6af69e7962ef0dab040a7da19cc4542abe067128c6679fe0b1f05adea5b6926cb7f0894086c
-
Filesize
5.2MB
MD5f6406fa620f9b2397d1b98db1ab919ec
SHA13f405b9ef54e2734874b1902016c32382b3b1e28
SHA256b56cdc9ca9e40b869204e447ba348b7de054b995bf43d7f8f0c14ede8051ba87
SHA5122de4490da71e1f95c008c637bd4a64f0064c3753f0cae1f1d7d1a730d06c6ac34cf9696d4b371fb0fe2256392d59092e7f4fe54868d992eef02d457ef83a3cdd
-
Filesize
5.2MB
MD5fd21640ec52781a7a2e7bb22eec62fd4
SHA1480b73081231258f5fb8527895884228782c2ada
SHA25689c5ff2d9006ace691ad99e71b0743b936e84a17dc73cc251dafdd0dc34fdd4e
SHA512e2bd995c07ff8c58cfb5e48386a4babc383f9c332680f011b399ad5df9be0209a5118cf14ecfef37b68fa77bead8efa43b235012b5dfd2c45c100a218902bf10
-
Filesize
5.2MB
MD5d386642c8e6f2fce365952f999f46fec
SHA1730a955f8fc884d09a5bbe275dffcc8db3308890
SHA2567c3e5563763fa149b8ca7a9954fc9718a521ceb59d153f6343a151d605390595
SHA5124298e11ce3c3056211929d242fd346b2ab3cf58b116ee04f641b874cbac012acaffec137d91844536b6dec6f4864efa582d19428650e1e918b1562ffbfb183db
-
Filesize
5.2MB
MD5030256728b0e5f4a30957c7fbd837f54
SHA1ebb74e2ca3da59fee1f2440c4121867288be1ee6
SHA2569012c57ce5f1c98dfc64dd1049e7a0ffe31d251ea1738d68fbff9de96a2972b8
SHA5120e0fb2b689edace0da2b30727440c55d9e5bcb4fefa9a8db709b4a502a48bd740b230cebb7ef2d6539c300e3394de381c7f9082f2acfc75f61995fab6736b6d5
-
Filesize
5.2MB
MD50efc0043e3aacb944506c2fea546f77f
SHA13b207e6d1a03851333daf8e6be2038fb37ba41be
SHA256201ea24abbc543ed18ce08ab5e30a8bd6ca48f440772eb42b0b1337a3e46e677
SHA5120c953ce52f44b56d0c124312de84df28d39c011e693126ade9e7a39d393e57cfe86085d72f850bb84bc414884785a5b5dc8aef403820b45ccd2af61695a14f30
-
Filesize
5.2MB
MD57ed736ec7257e437795de841b384b64b
SHA1d5b8c6e58114d7270787037bb2031698f5a9236d
SHA2568f83cba12e2533cd6301a356b7f606cf439484479667bd70eb13e08258a09f9a
SHA512a64ed4e1221a243fb4c30f47b32cd81ccce44232721a1a6c5940f8f73cc3f5a11a84f8daba9e903070c99e351699bc5d509ed7dbcc75e11a965bdcaf1e106fc1
-
Filesize
5.2MB
MD5d3646b664b626f1b18d45f59caf538c7
SHA17a4ab68a1fe04c7559367a9b83d8f6cd3f4599e7
SHA2564d653f236474cf3e856aa74a14f4066af4650a0dfd1b2cb8e8400b4d86b60088
SHA51220cff7d4bb03d088ecc4614c9d753836086d626e17c899c8e96f354a46387ffeb213959b5094e1214935a9aacda8e9ebe04984b6867f3dda89d7043dcb4ecc67
-
Filesize
5.2MB
MD509f333bc7f59796e183b3a6625b8cd82
SHA174da2d2eb5ded1756686bba052871d9b75eb535f
SHA256301abbf60bc2f9bd83a43082c295962211080611da8b7ff13b74fb5ea44bff87
SHA5128416a1af31765cf32dbd20b090ae03bde0589ee91117f10060c39d833fd272954f96c224b33ca22252281729eb0b76caeb69f9c1dadb3de5bab87a638b7ecc7b
-
Filesize
5.2MB
MD53ee088790d19d8580b79feb899aa70dd
SHA1cb381784fe7ff9b3435a69176283fe96a3e73e39
SHA256f76ce0dda0a2d96f3675d5fa2314f612d6de0aca5d87e4ce957b0ef1e14c5611
SHA5128811d5f4d2c0405cc26073795c3090b5da2b16d938903bf4f1642556cef44471e2f6f0ae70c72e02a11f958b293df608de9facc3d4203fc412326b8344508613
-
Filesize
5.2MB
MD53b60ccd3b826426f82c603417853fd74
SHA10cd26d6ebfaac7313ad20780214d6a72b9030dce
SHA25620120b8238312e8c8e85b386487cdcce3c52d0c0ff952fd153eb3e0dbcb064f7
SHA51211fcda2c5c701d199347a420b552a98b8956c83a9f71f32fb4cd477bbe747ebf68135e6805f11e3734b3e977fec82d08b7fd50de4d8eeee4c87a74a889bf07eb
-
Filesize
5.2MB
MD51aa415cd065c7ce2f792bef2281add10
SHA171abbcc53008302b0676876651777c698633de5d
SHA256771b021a9c71f75de627878f4303dd176cfa2ee80492ccedec4c28b44c300794
SHA5126fec9290241c4ceb4439325f678b45d2a7f48fcd2e902e2113a4d716202915f4966b52fa4ccca003b366136c302890c58a98256595978b38c7a73a868866bcf5
-
Filesize
5.2MB
MD58f345e219cd1523dc9f06b81775410c7
SHA16ea9b1162c8a6fa9113d54553b3eedf9001df0ec
SHA256d60a17308182e903c9560381fe2b74e6877da660bf725fe15a0be7be4a1f0033
SHA5128cc9b208050b426ce4dd644bbaf1e329e80ea9f76cff2c7e57f9292b073301497343f6c08d59fa5115a6b22d4b43070b026f5dad90e0f3d752c7380af064388e
-
Filesize
5.2MB
MD52f708668b6caf2b334b686a414988271
SHA163941fc6e9cebd184fa62e327675019cd3e54363
SHA256e8dfa4ac1670f8c093880dd8c692b5b0225fd1d8dc8f112e81fbbb503e6dc909
SHA5129d976911f844bc49439c6a465968d261535d096dabb89fa4b99dcb3fcc643fa4c164a0057be8ef04b792f0fff92e90f1f9d81997e581e97648dbf960559c99e9
-
Filesize
5.2MB
MD58656ae771c433787b03e7f2a25018ef8
SHA199ee2ce0ee19e9527143f8cca76f6439ad2210a7
SHA256b0359c19f47f626d5f262e47085f43bf85321c98cc0117ba989b0a9cb2f6d533
SHA51216e48a7605067caf13fea4791f46df2ded2d737ba31a1b6dd02ad3f1630844e227b0bd981c13ee04be0a976f43a1da4bbe54fb02885f242f697a6115d3559fe4
-
Filesize
5.2MB
MD5b3fae1f336bfcc9723179223e6e37c17
SHA18f4ec6f2d4d7b656a221b69ff82b3a0d92693641
SHA2569f957ccb2e92c53f50ce5dd714b87f613cb608bfd3c50d1ccda1b89774045cfe
SHA512ba728528175cb46a6bfd113558b7b10dacb16b0452bcc13d569634413aefa54def9a446afa54f09c7c0d626e884439b0a4038f1a91b524da752eb8cc33334ac9
-
Filesize
5.2MB
MD57ad9a71c2ab0d6db8d3838b5d95965e7
SHA114b5f2ba1bc166bd252fef6ee8ef30f66df965ee
SHA256813b22b6a25688a9e6ad222281d2edd552b868611bce8b4c020b475e67a06c9e
SHA512e5f4c671c1a111153ba038d84b05a034a2a969f4fe5378485a9ef6deefab56a45b8ba05fdec1ea4dde7a5200ed5e5f0def9f5129b11d32501d6a886f273f9a12
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB