Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11/09/2024, 03:42
General
-
Target
2024-09-11_3f2cb286f2518d8c169c85d9b9fbcf8d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3f2cb286f2518d8c169c85d9b9fbcf8d
-
SHA1
275310c52ebab653b7023b63261adb35425bf0e6
-
SHA256
92a39fb2a12f364289c4c0470d6534671c89267ebefe49204c9e77f00f67f8b2
-
SHA512
fde70fe102ef3bd5de11ab44d2cd3e94e1a94fb862602f6d882e83f6de92d9bde903acc24df96e17f6979122681c55c2e87843f9ed52af6a801e1e80b6197703
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUk:E+b56utgpPF8u/7k
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-11_3f2cb286f2518d8c169c85d9b9fbcf8d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-11_3f2cb286f2518d8c169c85d9b9fbcf8d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sVFnqdk.exeC:\Windows\System\sVFnqdk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpXscDh.exeC:\Windows\System\BpXscDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLZInnA.exeC:\Windows\System\gLZInnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKShBtY.exeC:\Windows\System\iKShBtY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQzDdmO.exeC:\Windows\System\MQzDdmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fitUsdv.exeC:\Windows\System\fitUsdv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzVGGXY.exeC:\Windows\System\QzVGGXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YmkmcCD.exeC:\Windows\System\YmkmcCD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SgKDRLm.exeC:\Windows\System\SgKDRLm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxylfFz.exeC:\Windows\System\XxylfFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WTRwJkV.exeC:\Windows\System\WTRwJkV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYqjRnV.exeC:\Windows\System\mYqjRnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MoUZfWb.exeC:\Windows\System\MoUZfWb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbkMeHf.exeC:\Windows\System\wbkMeHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wblIFPv.exeC:\Windows\System\wblIFPv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdSmljE.exeC:\Windows\System\zdSmljE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jEgWUgV.exeC:\Windows\System\jEgWUgV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mRtlyAZ.exeC:\Windows\System\mRtlyAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsCvUnb.exeC:\Windows\System\PsCvUnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mSlOCZv.exeC:\Windows\System\mSlOCZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaOeQDb.exeC:\Windows\System\xaOeQDb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56b4615a98d7fa34052c1525d5325feda
SHA1f2e083160a9c5ee7f00aa11d3e68d67d34e995ae
SHA25697e0f5921862a300a1957283d6eb403c0b702dfabfb1959e04f3b4c526970412
SHA51270f7ed17bd375be76c8b6d1091a7956dfa1bb519467bc348b5f0ad24efdba92366c52032d81da0fa57f6b779f858f20861b9a5fe54c5199266e7554c15ffd7ca
-
Filesize
5.9MB
MD54e21b184228fef0b0dd9454d63f5e76b
SHA14c6a68957fa56eee1399583ad1bb1bb4d60b6b45
SHA2561ae814de1397ae043fe189de1dbc1572139493a9b82a723fb318a165c4b0a021
SHA51294bb7d6a5b85a7d8ff1041729fa143529c030ff1a963496aadd367ebc31f3d37b41d6723c4525629048f3609349f3e13723744723dae82add8268fb973bece17
-
Filesize
5.9MB
MD5494ac5d71702024e9de674dfe31ac60b
SHA1f092cc9c85d1f4c33178d0c453363d4271f32be9
SHA25657791040aee2a22930d009d34faad15727423225a35bc810ba52e8f263dfb728
SHA512c2c804afdb5b82b0be106e2cf76e7f13b0f972dd44bfd6a8e826e4c9e1a4bf5d33764dc7793545ec323f0bfc13743c23cb43136f4a080b35f677edd959fc7895
-
Filesize
5.9MB
MD5ab2e30877ff871c89f6514a791fe3df6
SHA14ae8261ded39e8c7684e552a173d407ffba3c8a8
SHA25643b835a25fcfec5605a17b94917af1c0677d3669219f640bd171525e3f9b6697
SHA512859ed60f6f9ba290f8f2047c3f58300b9d61ec026e9136497e620cd7a98be1938fccd430b67fd881f73dab0995900bef0687e9c6429a5e18817de7b3709e4449
-
Filesize
5.9MB
MD559593923f6803ed1b0626489ac711411
SHA1626a831b873bf8eb0415f50e2fce68c648d25440
SHA256c0bf59f11e83db73485e7617681b70ab3597d47d4b909e2f3cbdd15baf7ca9e6
SHA5127baa8375eebae126abaf9174ef645e4ae1fdbdd986817bc12231ce39e687d4ab9840b3b85dadb233e100810b46e7669de806116ce9aa2155db60e464f4e1f481
-
Filesize
5.9MB
MD515b3381907fd1b6fdb05a70ee83b65bc
SHA14e1b8e060b6e49abb07bdc16afbdd95a2adfd76f
SHA2564cfc8d71f2b6c37c3e6e099fb7ffa74307904c10d0c1cd03336f45dcd2baf23e
SHA512783aae1b47c5ecdc39b500b3103a6a9e2c8150ff5631c8a3c0a4ca7a4c5bb9cbb2e46b4e6c071157a6cf1b5a1ec66a0a7bdf43b376e4c24e352e78dbc806cee8
-
Filesize
5.9MB
MD5d17b4e1305b0c8af5e0c3668df01aab8
SHA10770555aa114bc7e4ef2414b7f99a61be6ae90af
SHA256e79f285ba0ca9ae4d80d8eaffc84862331dac9d66672470cc12dd5e8610560db
SHA512e05bc081bd476d17623c20f3f37cf589cc103fbec1d56a5ccb7123ed99f775c3e01c9b0703afba4f640c26b89929990bcc076e9a0d293114adcfd492f5389406
-
Filesize
5.9MB
MD5fe436e4ed94a84c871afa74e85c6be5a
SHA1c88334aea0577f6abd484334fb0d4972293df9a4
SHA2567ef45a31c5e7e509bc645a05d67cf724b969ec96e1d01a06a522fc0267592553
SHA512fd36408e2c514100e95f4713c176279bc5ff2f8f6b49dfecd5c41813bee4bf7bc3d105f9f7bc8cc8efce6d2c7d1bd5f7216e02074eeeec41d6467b29bc104e9c
-
Filesize
5.9MB
MD5d4523248cfd28814bf60bd5955053463
SHA1f9b2c221daf50f05dd3ede73cc82ca8f7ec9b16e
SHA2563fd07e000ee853b86de31472d28125f46988ccc2ac165e0ae129d3202ef2323d
SHA51234d2a7b1289681444ee1a36b6e789c661a47eb4309d81f7f3a9dac36a75ec69af40f0558ff934ee0e1555e3010a65389f4fd1c2d008792d99b0ff89d53496a6c
-
Filesize
5.9MB
MD52f893a1ef6d4fd3a843a22cb2fd3cc86
SHA19328bbacde3733b4ac17657366ba3d684180da94
SHA2563e93529c1855fbc38967eda9c60eff4466c2fc583514dac46bdb51fafe948aec
SHA5124f6c113ee7723173b350e52b0b7bcb918441f21837e0e03fc88b9fedc67b8e7225683a8453f2370df70d8747ce6efe94f43bf2257f5e161b9f21a6b56af95390
-
Filesize
5.9MB
MD53efb429af2647443f76f502c92fab6e9
SHA12011ac50c32eeb462ec3765ffb20896fd0088b8e
SHA25685cc7b315ff47468bb2f91dbd76facad8e54e741077cc702257bd3d0b13f94e4
SHA512e2e40f5e34e089f41e3477d3f364ac1b5535caa7bd65734d856ae48f23b95411908338ccc7db62e00fbb118991b5b2b308f295e1c96aeaa5a10c36ce7ea0a05f
-
Filesize
5.9MB
MD5f78c7a392459fcddfd6fc48b0c3ace6d
SHA13d98adddfe8691b524dc86a897874b9a3aa8900a
SHA256b298d4c511d3027c5ba359d8b71e767916a542121410b17a03bdacb144960131
SHA512680a7657ab7e7a90d372232123b50bbbae1b033965e6016bc7fcd40eded41ce02b22e58482894c2953ef00d7dfa1744017d2169269f5af71c03239d079afc8e4
-
Filesize
5.9MB
MD5a3db5aec653d036364a8902d8940bff2
SHA19241e278d5196db2bc8ba2b9f0236da0026913fa
SHA25638c859022e3599715bd4827c0c95fe1467391fbc47c66ff8b1570ce82019302e
SHA5128fb18bf2bc9312c8a1f7ae1ee61e83ef33309705741d2f5bac1116a379fc34f226852d1188cf68b9124affd9dd4d3f32b478f1f5e6f7504664bd8927592de840
-
Filesize
5.9MB
MD5733ecfef7de2026d95beee35581fa777
SHA150cf51c9463eb114cc3f69f341135643789ed932
SHA2561b1fcda419366dde9d3fcc2a5d33a0c576d0452c67880a8f75c1ba9be933d781
SHA5129c250e6cc3ee69602f470239a2ae9af3282b273a22ef2a190bc204b6e2c458d8e6891a12970393ad220eccb801a6f78f80fc757d4dd12f2d7587558bfea3dd98
-
Filesize
5.9MB
MD51a4013e359bb1280e914ca4c2b8e0ef7
SHA152dd9fbc9eb1c6d0b1cc9cf2df4ef4e654d39b39
SHA2563bdfcfe29e6ca41cc8485c1540dc716c1daf17fb059e3a7641b1a723d02ffe95
SHA512ee21d50ccc8448cae4ebae8825ef6ff27fa8bc9e1afc7eb8d731d6da5eaff79001afdbc394d0fe6e82d0d55b8740d228db0636ce756ea8bea873a8c2cc2006ae
-
Filesize
5.9MB
MD51cf2c73ef2197bf98bf329a347466ccd
SHA1ab63b14d4d868db8119860252b8f4faada0b8512
SHA2562ee959585290224e54d6946d95413d866dd4d758c90860c55f9a30c848dcef3d
SHA512e101606120aeab697585bbfa5d9803d7111004f5514a2234fd2f3af738d6b6171c24be266a2d839f8bbd9abb6c8912b61392b8c9754a7d48987c14164701ef78
-
Filesize
5.9MB
MD5f13bc0b801058fe8dfa99a99b71e2c00
SHA1b57be6b816667863d3f24c3b3c5bbd2b2e9485e5
SHA256a281c7053ec616bc4d6e278422c0cd37c21b03b8c833b189629730d67f75ba64
SHA512c0e9754528ab9c1b48b5da1a79f924badff7a8a9ecafd2dceeee7991bc38165d0ea0309498c00b9818cb2bd1b69f3edcb601b462417db5ea1996c655355d54bd
-
Filesize
5.9MB
MD5b5380f2874360c53bd6181517e455ecf
SHA1138c0aeca1913d58a36c8a8d53bceeff1a8cd62a
SHA25605b0cf92059c96c0b0ddaa1a93673a3a75b1a3cfa70b67682c9c35fea6e9fc39
SHA51272efa6623b900f5a1da7be5a2136a74b11181ba9bb492b690358f38b9b719aaf026bc8bed233c8dac8ee90b873cacb7ae258e7a340514ed672143d5689020fc0
-
Filesize
5.9MB
MD5613914e75eb34a04e5a2965975d805c0
SHA1e5735c4992da2a67407dbfe39d7139b7639f7edd
SHA256de6922ace860d476d51297fe1248076a7172bd9443810694289d144ef97cf146
SHA51209af55d84f5c78cfad873294683dedaa218094ccf86d329a24c858b69c3a3dfc3462b2f8c81c2da880bbb086dbc39b8d921534d761fe50a5d3d832eab8634bc2
-
Filesize
5.9MB
MD5dbde5cc1c39b4a1f5e0e6f32675f10b3
SHA1550214ee60dd7c2a880f0c0ec57d3b2252e82900
SHA2565b72024c2456a168376bd7ce0504c9a83fbae368fdcb3a1bc6414fc4b46b9aa4
SHA5126b35c530ac37793739e671aaec7a0c545335b73796e5ba646918014a606780564a2e4eb971cb65d842913a82a9d9e12a9216b1fdcc501c14a9112497e679dc3b
-
Filesize
5.9MB
MD5a76adabccac591bbf641a55a5b510ee7
SHA1f03ba26594c8389edf25863453389e39cbff189c
SHA256bf1d593386b960e756a59802677249ea52f878a1e4cbece60a266c1b85125cd3
SHA5122d056590a5ee4747321422806528a6fea0e2d46f8adc990fe31782941d7527112d3a3db343e6415fd59074687d43b4632c02d4b40114268c1655c78dc14a9212
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB