Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-09-2024 04:11
General
-
Target
2024-09-11_b8932e6e5e7fd426ee3bebfbfd703325_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
b8932e6e5e7fd426ee3bebfbfd703325
-
SHA1
6d3d17dfafbcf8fbfe89cb8616d28630897e3bdd
-
SHA256
0443a2fe4df5eaba163f1777296db40afb4dcb03b869ad38131d211510e8969e
-
SHA512
68678e2e64e511835932ce8c44279cbb4f09db746e928797e3e2f106da79c581116b6e7805dd4bad945d336f24b8379d79466142e0719e2ea5e0cc7322533c9a
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUY:E+b56utgpPF8u/7Y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 62 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-11_b8932e6e5e7fd426ee3bebfbfd703325_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-11_b8932e6e5e7fd426ee3bebfbfd703325_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aFsqqrL.exeC:\Windows\System\aFsqqrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOEyOkS.exeC:\Windows\System\wOEyOkS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwwviGo.exeC:\Windows\System\HwwviGo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rylXLCe.exeC:\Windows\System\rylXLCe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XniaOIa.exeC:\Windows\System\XniaOIa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBMjTfh.exeC:\Windows\System\pBMjTfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\drDCZIB.exeC:\Windows\System\drDCZIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKZIIzW.exeC:\Windows\System\sKZIIzW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DXiYArk.exeC:\Windows\System\DXiYArk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xfoWeWw.exeC:\Windows\System\xfoWeWw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\heaRztU.exeC:\Windows\System\heaRztU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jKSMYhC.exeC:\Windows\System\jKSMYhC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jumpGTx.exeC:\Windows\System\jumpGTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzKRXDJ.exeC:\Windows\System\mzKRXDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUbCySA.exeC:\Windows\System\wUbCySA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hlWlWAo.exeC:\Windows\System\hlWlWAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGQMGHb.exeC:\Windows\System\qGQMGHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYxFhgy.exeC:\Windows\System\CYxFhgy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcKATsn.exeC:\Windows\System\BcKATsn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYkXMjQ.exeC:\Windows\System\uYkXMjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RFsQuWs.exeC:\Windows\System\RFsQuWs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54e93f7ece6c23795cca550c504a87575
SHA1b245469790786373259b2c15d83e74b1ce569ffb
SHA256fbb7c095152d6c6e17e3b297c413f229ce0d09b27679f0e31216a11e5dfbf6f6
SHA5129bcfdcb06f5aba1c85495afdff04bbce80345880294fd6670732d896873b4ea758c265ee303f7dcc9b5bbd871f7688f39cc56422d26158a6927e6bc6c1dfeef3
-
Filesize
5.9MB
MD51824b41b5610d0e9b5defeccc204cda0
SHA16666db895213a3837dec075e4319a0936517b0ab
SHA256fe2074a3423c5da89d700e4f2b94678501b00fe02b1b242a1343afea094e888e
SHA512dce03b32641fa1aeda9666b53619347f1291aeb1f3d8a2874738fd0d63f2f48be20e77b2b3cd4591ece4a4811c6d3729fd778a35c274bb59b80ac8defd696a29
-
Filesize
5.9MB
MD5ddf4c5d43cfd0607f04146d8bf362735
SHA1d7a83484f8725da0abace0cb9b19caf04f3c6639
SHA256c170df3615e62a56b997d10bbcd53c87bec851cee1ea085cc67859ab678173e9
SHA5125fbe127c2369ddb646b156632cd9cec8f63844afb707fe6b81f5bce33413878ab17190615da77289e3085cbb5774e5bc31c3744e629b896858fd7457ddc50dee
-
Filesize
5.9MB
MD53dc3ab2161de13e53e0d0be989ccc2c6
SHA1d2f35eddee6dd3f6d450d7d868bf869c8574000d
SHA256edffab5a00412de678501df05452c3fc539d4725316aeccbc35c11bb8513e372
SHA512402c89e94de7c38118be0e55a55964a5c71c69e617d8afc620a5f8c267d4b33b7caa785126d3ff9a2bff9a473255865f86582055f84416bda94ac53bc09039e3
-
Filesize
5.9MB
MD5302d4cb8137fd2a7a195d1d96b1e1649
SHA101b4b0b6ba84bd786736528c280ff090b2d17dd9
SHA2560ab53b009b24a075ff6e3fa0bf263adaa8e203953562716d35e958fd7f2cf8b2
SHA512ca3ff9a17bceb61d9f951681f093abf813897520ee9f1439ff7c4bdb2fd022178383c27a1d70104cc910de1388675dd307a13d53d2466b000f882f451ae8fe52
-
Filesize
5.9MB
MD52134c145bab526f4f0b518ca1a13b864
SHA1a378031f4a832cb9b057b5af9f47ab628b4dd523
SHA2566652980c63e8f6162cdbff3a42fc6e342190a88ffaa084b105915e524ad889b4
SHA512403a3e0e6f7d9a49727b5cb1872511df1e30d10483bcc010758f09a1bb3a4f30e08e89019f305651e46b6db7525d3901e19d49e60c9e5860fc8930cd918d2919
-
Filesize
5.9MB
MD58094d548e0588b0fbc14af0e0ece6612
SHA11773365907913e9ca627aca92315125faaf8699a
SHA2567e4ca50c2aeb9266dd53893b906c6baf3e9b8d6a51a67fe8aa44b11643619951
SHA5121a00a3aeab328e0b56c7b42b2625c5924be80704372abb2473ba1875b7885bc02f4ca0479cd5a23d79918a2dfd5bca1c341cc6894e2bd8a3b543409f6a7c01ed
-
Filesize
5.9MB
MD51bd57757c62e9626e79b6d89d8eeca6a
SHA15e2d05e1571e4eab1c4694512b4c5ad37d2b42eb
SHA25609e320613e752dd7ece18d1bd8b5b69a3c8749f98cf007c0f1eb4db5840639de
SHA51253a93f39657e7a619e4629db71896c77a8ece7e6fbf942af8106aa267ea811e82b6895e2a8209f85e99bff0584bf8e14fcbfbdbdcd03ae6d49ca6a2a011de629
-
Filesize
5.9MB
MD5ffb1984ed660c72a3e0e3a367cf815d5
SHA148166ff4ee827fffcae2d1647d084789f61aef24
SHA2563ce1973983db5e01165ec64e97f2064a5c100416db758aed9b07061b8866eaff
SHA512e789c0762cb55097fb97216bfbfed160ea5c9f8616e61d32fa69ff05fad5f8e46a060d61f768b6bd2205c1b9ba477b624cd9e83432537a80b62de5be7296d18b
-
Filesize
5.9MB
MD563f5c125bd84548798668fca0b921c5d
SHA127a3ecdf3108dfccc6e74e7d8d3cb484e95f42a3
SHA256d9a0a3c712b8c4e96f327969295ae70d080d05881aa86a10895947a847a656d4
SHA512b60e1ab13c788276026a9927364084375ba973cef9dfeb785f8bb2f9fa5cad4ab9a5137edb1033933d6a365675c63c7a139ddc16546481ba463f94c08c6db231
-
Filesize
5.9MB
MD521964eab327381c939a263f9857c096c
SHA1f55e493683d173b3abadd9d68cc7db14b0ece79e
SHA256f814e11b9ffe951e5f9a831dd5c1630c58af9697eda8012e31842c9da1d32916
SHA51214acd63c04cfd86137a77770c9b3bc367cfeb3bc8613fe23baa7adf1c26c23b8ec9935f0193a463c5bf749c10c65336ff89d548788a12140908e0f23f81b8407
-
Filesize
5.9MB
MD55a544a93aa6f9b9323900e18ffab99a9
SHA1b0dc90ca0a1e5477bac7b8f1a4a04ba3b1dd7537
SHA2560092bb399a42920c1f54f57be30dcc378032331dd59ab13c61f34ad99befb432
SHA5126eb3b7835d15a44933410f1d144120e2b1045f68a1d883f0ed639a11a9497528cae90c7bc70f6b4ee7b99bd6f0c0f7b970e944f773f5b3bf90879954e62cd666
-
Filesize
5.9MB
MD5ba92bdb67c5d6f786ac47a4e79263e5a
SHA114eb97a1b3b850526a839cdcc5d2c6f790dd2afb
SHA2564a16c8f6aad000f0e31ff9bac0412b82a85efda751c00f50d3557d0995eefb69
SHA512ce6e8a0a82cdabf2e2298ab073aecb87c44df7f076893b29fcada96951424bf6421f5c460834e8338314745bc47b54042eef779cc6893e603a099a08333aa968
-
Filesize
5.9MB
MD5c5fdbdcfcf1192cb1f879e9c483bc6cc
SHA13e5e8d7464d51de23707dd098f360853acedf9be
SHA256a6375d1771fd15f37ee780838d959ca448f3f50c9798f3cd4d3bbec5fb0c8bb5
SHA512e329ec68225f041a36d859d6f75b1a02e175de0ce54e5626556b31c5ed3c63b96c0c4c86b52f785db07355f0bc2f687f6b91629ff106f50a6ce7ad767cb539e8
-
Filesize
5.9MB
MD57b4e6f134c2189da18261bde08704442
SHA177e047568a94e271a9144a7c05a960688a5bdae7
SHA25667dbdb485f0c952b4728a8f3951daea24c5bb361bd41481cf85a44835647ac5c
SHA5129890fca20185cbbf546f47766496519abf47414c6fb90516e1821e2d3a2850cc3c4963c1a85302227ece9689b8faf33e3309e4e8ab69fc22bbf83037dff07a64
-
Filesize
5.9MB
MD5d003e1604a5a6f09bf915da5d80c6668
SHA149934b9c9299b8b9e32a5da672f143935690859f
SHA2569a74ebaee04e8650258de87a3d4bd9b0cd83a4b0b2390e13c29c921adacb93d6
SHA5124bcae89fb740edfb810c0c8ed70a0e540d2662364e4c6f9048dbd32c096c5a4c5f65796d477757681cdc586bac713e9fbf01a37a2f0be95a319f4b501419777b
-
Filesize
5.9MB
MD5c8a604e9108c59ae8e04de3d6f39b9f4
SHA1e573605e79cf9bddbebdef36a8a494503332d269
SHA2560cc94104250701388e3d8ae47eebc8724f988f44438fa90993f71f66c324a1dd
SHA5126e8f85b2e640ac3fc9043fe088dacf3020e47f5b0ebc77a697cfe64b43296bb9afe91f78350f3ee5c473aba1ddd9817890906d0fd83ec121f988282aa002373a
-
Filesize
5.9MB
MD59bbe17b22fd0eec149a91d2853a24862
SHA1c4ae974bad917f88785bedecacf080ad69975637
SHA2566201306be0b35dab1f889c2f3f64c659ce9dbaf8b9c81bddaf755db79d695676
SHA512b4b7beaea8a9692848d496cabb3722dfbeb1c48580c175a3abb6999f00d926b8e44328e7cd5f888042b8fd229339c2c1a8975fe005b76b1caf4a02f408afba78
-
Filesize
5.9MB
MD544d4725ad52a8d5ae6ef7e3db9cbe49b
SHA165d3c1ed9e974522d0b2877561286df72beafe68
SHA256c3cf8c9c3a774e301d94d20eed09f6a9eb83b1c90925bc95d28047ac74e8d20e
SHA51226bf2d4d2f846c29ce9cd4d06bf165dc54d51ff330d965f5e46e46b47c087b28ff92ad7929006b92ccb1cf1a745abd185824fd673470b4af72760b024351c774
-
Filesize
5.9MB
MD57feab43694a044c86bac14ab927f2d87
SHA1ff7d73f9cb02befc24145ada2720aa2897bdcd6b
SHA25686bdd048abcb2324ec3cbc83c16034864e09f46238b2bc2259e90c842a718b62
SHA5125038b22f4a9bbf534b794d4e31cb128f9c55e76935ed3df3935ae98b3ebd76638cdb409da897584540364d9a941be9702cba332240f9f14d35a8b940dc4349ea
-
Filesize
5.9MB
MD50fc7fd6e0403790bcb91943d21f6c05e
SHA1a82b482cfa606bb3419d8165650dd65373bb297c
SHA2560eff42ad12287dd14f62aa8140b136c1e6e3c27934e87b86e7fe7a08768ace25
SHA5128e2a23f2bed825871bc0fe249e8836e0e941ae72e3a0f2532ff349424210e3c6f4cc3eb9fe82a6a823c9b561ccfdeaa9977a73b3684352290b1809885f7012ad
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB