Analysis
-
max time kernel
125s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-09-2024 03:25
General
-
Target
2024-09-11_086cfe4258f9dac7ad5969b7ed7c1955_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
086cfe4258f9dac7ad5969b7ed7c1955
-
SHA1
8302685d3be279ea728991eedd45cc92c234a0df
-
SHA256
77b0efb658067deff62fba5bdd8d39d820c6b1533a1c6bc884949e33b5fe5f29
-
SHA512
e387a72a044abe62f1fbdf4138d2c65dee7a4ae713562acc63765f0aa6b9c42cf905bfe5e532b7ee84cdc089084dad106c1df8ead14ed9ffe9d9be25e5debcce
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUN:E+b56utgpPF8u/7N
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-11_086cfe4258f9dac7ad5969b7ed7c1955_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-11_086cfe4258f9dac7ad5969b7ed7c1955_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cgZbbBq.exeC:\Windows\System\cgZbbBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QstmYCD.exeC:\Windows\System\QstmYCD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXxzKzw.exeC:\Windows\System\CXxzKzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gobEPMr.exeC:\Windows\System\gobEPMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCntJqd.exeC:\Windows\System\LCntJqd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOKCtKV.exeC:\Windows\System\dOKCtKV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gnjTmke.exeC:\Windows\System\gnjTmke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jVypYAs.exeC:\Windows\System\jVypYAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iSCbsAd.exeC:\Windows\System\iSCbsAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CEzzZND.exeC:\Windows\System\CEzzZND.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zQeAoat.exeC:\Windows\System\zQeAoat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lKdaNXX.exeC:\Windows\System\lKdaNXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TAYDPnj.exeC:\Windows\System\TAYDPnj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXRrMWx.exeC:\Windows\System\rXRrMWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LFqQtYb.exeC:\Windows\System\LFqQtYb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JzGSljt.exeC:\Windows\System\JzGSljt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lVgbCzb.exeC:\Windows\System\lVgbCzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UamemUe.exeC:\Windows\System\UamemUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UfwqBXL.exeC:\Windows\System\UfwqBXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EiMBznT.exeC:\Windows\System\EiMBznT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kOfCCJM.exeC:\Windows\System\kOfCCJM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5bc4628cf8658f220074495baff231100
SHA154960f3404336d0dcc2d7ff6aa6d8d297abe3a37
SHA25643728c698b606d084d7e9648dd02c1ae9ac2cf04a27f0f06496c153f1a0528b1
SHA5127079b3aaa71a91beb3e1cb46efa8233cf5e403c3d9d1b598cdc32ed719de8a2312c5753f705c33137eeddcc6e342fcd772e9dd2ef6a921b3146c31e701848018
-
Filesize
5.9MB
MD5be2df9a25feb8e17a86a44dc59828eec
SHA19b4ca094eaf4f8c34c84b92cb023846c7be2c7ba
SHA2563c018065cdf6e37783588dc7ce9aba74750daa6734eb3dad60aa75941a833d14
SHA51285cf009a0ceedb64bc4758bdd66aef1848e2151f216452e20c887f549e8c7c4bd0c7105b654096524d718410fa4bb46e65e1b8878cd3ee1a8963c5f683dff8f1
-
Filesize
5.9MB
MD54bf9866704367ac3586345a0bdbd46d2
SHA1c2fe4f5af3734e0a9ee6e88bd5cd7ea1c8982201
SHA256fb0dec7cad6e1323bee84da8d971dd511f0e71473eb5c4d1c7a9ff232dd41444
SHA5126647f98c59f47fc11869d6c9ad3df4a398a28174b25f5af9510404fbe751ce15ed4a8ea8360eb5f87a67a7e27b31f7564b8408fed14ed7a23e4e496ba77331ee
-
Filesize
5.9MB
MD5b707d23ae029180932e29eb0e8b21d86
SHA134e42dd7a1724e1c478f78fb46d6934b61625b7b
SHA2568897887aa8e3f5f0726f68223e04f798935542a12fd6691e7e43bae5839184ab
SHA512372de61319ad9bb3d08136fdb1137c8d105ce83ee04f21cb4ac6a226e680d388c98141d45a64e3fc9d53ef8f394e116fcef5e3f9989440e4627c565108de71d1
-
Filesize
5.9MB
MD54f9bb045ff0fb1976133052f9d9efcc5
SHA1c088839cbec7be908d2ae58ad7f9e6122679c6d2
SHA256024b24bb60efa9a807bdd19a34f36d77026938180a8c35ed1fe123487368b121
SHA512890c64bb5358a05ca480e0150d64328d90ea7a30a09bb26917ee6221c125791b193ba270bdda23055fbffc391171f373e113f42ba8f01ecc524249f5a83eb145
-
Filesize
5.9MB
MD5c3ca223c09c4cc94e6da5a664b84f2bc
SHA14083751732a8f11d0dfaadf6981dbb26125a961b
SHA256a556165139ee28637fe30e87a914f8c17a39edc74b510d958877ed19482bf181
SHA512bfec6cf437f980facf046d5f6b4bc62df6db4ccd36bf372e0aefcd6c5322e8aa5cfc58ad3a39268bbdb98b18df01f148491abdce508127a94cbee0f4ec9a4166
-
Filesize
5.9MB
MD513f7127f041e5b37e8c42ac67a9ecba6
SHA1273b800a6692d83d9ef4509ad1d4a47920ef811a
SHA2566a33f7e3d620a338bcecb86b67dc54d73b57f40c8d78856cc79c4cb90c00d61a
SHA5128ba3f4a6439236b27e8086582319c860f0b7d0810dda2e327ed1e58ab3bd56b67c559943c6011dd43a7f50ff878347fdd6f49116bf7a6c0373adf091bcdbd6fe
-
Filesize
5.9MB
MD582ca586cbc1cc59babd244b06587b1b9
SHA11815a5cff25efc4ae3613ba0e1ceb745e2757410
SHA256a231df914b0db4833590ecfb5f30903006a8fa54e0d33482d9e1b29140191b47
SHA5123b5c03fcf778086dd62e3b78007f7b8b82ba11767915959a9569a3ddc7c19a1592e0f83d0fa5b57f724604673a700d71de59d0c3fc9e5e0c44a177c092530a57
-
Filesize
5.9MB
MD5a166dd39691a2fdbf851896f780fa2e6
SHA18f7c9a243391842370566728492958f5af56edfc
SHA25697e98403bbb2121d4c2abaf26206bae5a069b47da113081377da24246267b1fb
SHA5129c89440787ee4a2a0bc1079f7dde92ef4b5f9f05dce9615622afc357ccc45d27528e52eece7d069ce2a86320a7a3949d6ed57ba29fe0cce9d3d6f6c833da1da2
-
Filesize
5.9MB
MD513180b6befc67c2b01395d4c959dfeb7
SHA1746cc75970bfbee2095ee62128b7d4bba302b49e
SHA256b2d188910e4dda6c34f9805f48675e40acf1976686f9722742c89e6c19a225ec
SHA5121373e8716f5ae66b1ce9c1317b3caacde5fa9e1351049b204f614cff99f38fc17f624efedea46cdc40c7fd4c4e4902e79be9ae1e46b80d0467a48bad98d425c0
-
Filesize
5.9MB
MD526d0a0f622b9f53afff9746ee2f38071
SHA1ef57abbdc2689c02b83a056a99e148234006b847
SHA256acc02cf471b15c48ea79ed61ad400ff055c8d694cb57f31354099a816e18892a
SHA5128fa6145f5d5171929457095bf12a77c4efb0b4a9d53800057ebd67d86af50fff94e0aaf25e7607e4fc5c0dda5929339903a041413d4c9c24d6c5ea3bc16754e8
-
Filesize
5.9MB
MD50c260fb33baaa4a9d26a9c52be892462
SHA1398123a48b4bc16987988a31245e2f1c8373f7db
SHA2561de08d7ed923bb17476a54824c6bb99322109d9949931e6f3f8aba8b4127adf0
SHA5127a827ac22e254247e39e7c6533ad820dbdbdb841dc868b3dbf007b144cb54dded04a5a0c0e4b924257ace58491b01fa4e1feb5b2d4d414c7f4e5033b1826df4b
-
Filesize
5.9MB
MD52df91fa64c865468965ee0781b6ec11b
SHA103763485ebf7b2fe4e3dded6c05a83fe82aee3ec
SHA2562eb32e5214ab67cfcc1f462c24fdd5c72668c0989cb9bd5f980b0c4796008072
SHA512c335e90b61d24ed2a57e6ad85c225dc71a0be3aa9a73d683e3c3a2d4decc098fdd52fe04dd088054b315473ad9dfd5f902aac324627c3f46feab3ceb67fa3f41
-
Filesize
5.9MB
MD50a5ae8f669f8765c9bbedab1ae0c70d5
SHA14ab36abf19060b248e3a95179ef63ebd8e3300fe
SHA256276246f4d802544dca89942400edf539284b56a85333f634f95f60aa0a76bb6c
SHA512cc7d4b3a91467bd304811178b1a74a786a59138178dab558cc9dc94dbd7ddb1cc26b64e670d4dd3986cb233e9d336be9d0c8b188de3ff22342c830884d7db2bc
-
Filesize
5.9MB
MD5c27e9504b89ab9ec7da82467dcda97f2
SHA12ad685914bc1dfd1a0ec50b036f493aa9f1332ed
SHA2563828f41d7d926a6d29649c4b987449fa351c43c6b4c2238058425ca9eb047f0a
SHA512d9b8b966e514868abb9864c4c9236c0d4ebf3c456e6ebf88e78f8f532a3d7e0f3c4adc30099303d3268c2ca791c94624a0cb420dcaa6b4959aac7f14502eb033
-
Filesize
5.9MB
MD5b69f68e97aedb56adc58f66fa908c945
SHA120285331a1472f174fd098da3589a8ca83ccf091
SHA256f595eb4ae2b410d73613c724e365c610f5a335dc910290692defe6e17178925b
SHA512389aa9a6c04c74b011d14e4bb711a420c127bda5dd192ae4d9e3c17e5b996d119af35bec532babb9d8505fb9fb6ee2c0a4e0ea0cf90fb59c23c7ef7a923c1f6b
-
Filesize
5.9MB
MD535dab029aadc08dcf93798ab543f0739
SHA14fc9bff16acb1efbdff580641b770befad697265
SHA256f96463284c9814cea5b7a13d8602b7b5a30940057c0a68f53076b13a3ede0437
SHA512362648c9deeec3d425fe05438063c684b4d88092c176bfb758066a297d955ae1fbb1cd11038609e6013d1cdc5b41bc228f26e08210dd0b18a26707f8fd3c4caa
-
Filesize
5.9MB
MD5dafb279a8b2881616088cb973e1d7a3a
SHA12aab3bce249038af8d21522b2c4fae6468b70955
SHA256f86588efbe4a5dbd6fd2591b498a3748a4bcc1272fda07b44519bab094f87fec
SHA5121772f1109e0bd11bf296bb36ebe309b5c65fd28e6c50fce5501c69cc41591e6780e429e418128693900c7b2741cc84f15b87111f9e411258b5f45db9731a6c1d
-
Filesize
5.9MB
MD51d3b2eea82e24e7196a94da508c5f447
SHA14059872968755f1558d9c55839d431406da39101
SHA2564649cbc69f4b8ad1f945e52791fa70437fea9664cd945a355c164e317f841fa7
SHA51212cdc431600b905278e3d30e900f15a62ad2bd8ee154f1029017ace47cb74dfe508358a9e11e59a2ee3423b07bfb70b3c02a22035b60446027e3ce3b792a1be3
-
Filesize
5.9MB
MD50754ec2fa53cbcd299ff6c225050fb40
SHA13600464a1ed92a572eac86dff1ae3d81bef41260
SHA256031224abbcb52227111041afc3b061175e5f9e82a244d4095585a33361f91680
SHA51243ee3274d5449d794bfb412edaf12a22a26652b378602d62f3155dac19f9dfba3e3c49be41275332fc088b3c7c75ce5d16e78e89206f3f875981023b6d550c47
-
Filesize
5.9MB
MD5ca3daef08f1ae22eeed7cb0fafd6b262
SHA1f3fbd9b1c4d4f84465f10cae4ddc7df467d6f348
SHA2562aa52cbe387896f7dd149f310ea4e2539fbfd62be006842bef758281befd0959
SHA512032890cb80f227d09fb704867e794473dc13a037f5f52203406bb3ad662687fd98429b8650d3b20ed7088435110df6b401ecfe1ebb8d3d67abba8e4f6eb17c14
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB