Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 09:17
General
-
Target
2024-09-13_c6556d2b67e9dd88f46a3ac8d59ec3cd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c6556d2b67e9dd88f46a3ac8d59ec3cd
-
SHA1
68a8042ff29e3ddbfd7644f61839757b6bcfd3b2
-
SHA256
f4d4361d5079d72c44acfe4b5c81e263b83a88506e09cdb5930ad25488d77bb7
-
SHA512
b784697d5080ea02cd59fd06bea436c4cc3bd6fcf75615968d280d9c26551f80f577acd4c470b9c62b6cff30b61b15f207f9019d5ddd7a0b51856b012e67c820
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUl:Q+u56utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_c6556d2b67e9dd88f46a3ac8d59ec3cd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_c6556d2b67e9dd88f46a3ac8d59ec3cd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zaClGhx.exeC:\Windows\System\zaClGhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZHSzZG.exeC:\Windows\System\QZHSzZG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aHIHEwT.exeC:\Windows\System\aHIHEwT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HIwrxXB.exeC:\Windows\System\HIwrxXB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INqphUE.exeC:\Windows\System\INqphUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLlBYSR.exeC:\Windows\System\RLlBYSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMrBdgm.exeC:\Windows\System\YMrBdgm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPKtOEO.exeC:\Windows\System\KPKtOEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZuUJoNq.exeC:\Windows\System\ZuUJoNq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lenenej.exeC:\Windows\System\lenenej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dGigrdD.exeC:\Windows\System\dGigrdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gLFOqxx.exeC:\Windows\System\gLFOqxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ewkwNXV.exeC:\Windows\System\ewkwNXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dplkPIU.exeC:\Windows\System\dplkPIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BfJLQEf.exeC:\Windows\System\BfJLQEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJBnlei.exeC:\Windows\System\PJBnlei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWWYpqT.exeC:\Windows\System\DWWYpqT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FKGfNvh.exeC:\Windows\System\FKGfNvh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lIRwQuK.exeC:\Windows\System\lIRwQuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cbFxxtE.exeC:\Windows\System\cbFxxtE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdyvCGe.exeC:\Windows\System\GdyvCGe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56cee6ba2262ce466d1cd40e6d9013e3d
SHA1892dcd6d8efda4b3cce77f32bd200f543f66fb67
SHA25659f22314898b0120c720522141550ffe51a242e9a835a2529a02e537118a7e44
SHA5121f07f91fe4968f5f2c4966eabcfa5c4bc8823a22cf5a258322a81e7edb63c0a7f659b199dbb18ea8ab99f3340222bc5f921cba1cfe73e44dfd7f7f151e1f223d
-
Filesize
5.9MB
MD56d2c309a883893b1dd8b7f5755ef36ed
SHA1ff60b5a5aee2725dbee80c49a0b8cd75cdafece5
SHA256974dd4008cf67131407ba4c97f0c58329472bfbd446879be055f9598761a60e3
SHA512bf2d78dbc95cc2851a6113b80c49fe925c8361479a468fb6b747f1d5f6592b34daeda874365db13687d5fddbcd44066910a2ebf521756e9482709799d32b2a48
-
Filesize
5.9MB
MD5d4615d893d360790470a46a4a08dc0a6
SHA159ef83f20374ceb73b367b0a69ca158461e3fbe9
SHA256d6afcdc1ab7794f4d0cb6f1e60a32112e6c54ba51701468fd13d0844cb011f32
SHA512fd0e4b41bd0a1f72e5fcd10ec7de6a19e287a2f5764cbc55da1c054510c840b8fdca3a3d76cc5d06c50ad8fd0056f1c484484d2d8a50d5ff214b3b7c06667daa
-
Filesize
5.9MB
MD59eadd7ec32d9fe61683e4e72acc936cb
SHA157811700054f9d0b417e2eaad06a60c4c74744ca
SHA2561fa667e081227b826f7271e0de4352be7637d3c73615538bc0e8c7c599c04e9c
SHA512efd95d72906d6c359989be5575a29d075074f8d27aa3981fb9fdef2e01f63768cfd61ecb51f734cc2cde177c7c97bdfd5c9f168e747ac2ef0a878473c8422564
-
Filesize
5.9MB
MD5675f385c9a324e2d42cace7b5967c54c
SHA1aaa9e9c5923b41d26c2ea224705bfb84715217a0
SHA25673975f42a875d260203adac33d7845bbbd99ddbf3bff03f01b7033844a20ee17
SHA51292f44bd488a9068ff8d8f00d55f8c7154b6d73cefa807790133777a01911e18110a9305aeefad590842cff53d833d445c374e1db9c125257769e34734f3bc72f
-
Filesize
5.9MB
MD5c3d62f0a43d18e836daed43a33af3fac
SHA1283deb4360324381970070bde07c4c8a9e7e4a18
SHA256eed3dadf343ada6dc262e14deb091513fc19bec5350b0ae6817ff70143a6435c
SHA512c925c5f42958aafae38a1fbb42a7b8d33182425807c24b468f87b876d3fad7a1bfc81f6dc45304e330189cb192366f1a6c5fe506f102a2557c0c8e28493c843e
-
Filesize
5.9MB
MD587534f099d52b9f611c86cd9328311c1
SHA1586938d4662c312f93579f5a9fd9b831d21e5e46
SHA2563f998075648b349d586916fa37c2c74be9a6006d5d35bde782741c1713f0e92f
SHA512c38d8f47f84e9fcff14888c234f8920dcb9916fb5141e19acd69e9310c554607bfa6148cc990335d4babd1d177cefb161028128e4fc2531d362ae187e8bfa923
-
Filesize
5.9MB
MD5990f28169177e36b259e01e3602d9a0e
SHA16527fab80c16331151deb96523f141f5b39e072b
SHA256e9107dafcad6a0fb71a4210204551b4b0f06551fe8e0ee1a979b455fbfc7737d
SHA51289e8e43d49cddf57448d3e6e0f841006cecb0a4540eb4dd68fd8f128ebc98b56227ae27d9319b9df73bf5f9be20dd67c6fcec60c62b687dea7e214bbb98383f6
-
Filesize
5.9MB
MD5ac17e77cd53f6f2fc8fbed87faad36b9
SHA155aed03f6fc3202d7a57e029918fc65aa535968b
SHA256ab55145473a754c186a4443423abefc4b94e0e3b0d8dcedfd57f9c73133c488e
SHA512f9f5f826fbd840b2ba0f3876d32294931a725ca55b50afa2aea2741e3a91e5041bd27e07cd0762ddc36afb878ddbca301e9e26e20fce99158fd642f5ebb8a3eb
-
Filesize
5.9MB
MD522061b38ce5d8adbad917164cf1daff0
SHA1ac230124a0f6bf3f60820852bc34847a2cc99e28
SHA2566dc9d06df61608c52d446addba2f8c97795104e03a7bf16016a6b59e9ef4894a
SHA512269cda3669cd06208daba89906be5115f5d5cfd5cae271ceb7e5d5cf94e96a3995281712c988fe49303d894fd9c1adc5a57707da59ca212e2d130df7e4758c0a
-
Filesize
5.9MB
MD519d4a8bd21ddc2361521c9ef56c0a6a4
SHA13df5ca1307a4b415a3931133a45cffd946d11ecb
SHA25616755f65ca990307639fea09306f3f071fcffd67f6ebacb8e92dc3e7fe6e063e
SHA5125b8ac6a655d7f5d7b98f60bc1186de8d27612ac72c8d8fb2f7d02aa1b2eed22e74550d8847eeb0c77b012a87cd13044eee1e4f8f3ded094459de99b2c32ab5fe
-
Filesize
5.9MB
MD51ec3a015cf5f5704e85c387c0eaa9201
SHA16bc90787e964a3410d10e059163b71771529eb24
SHA256a719dcc94dd1af8da8bb713725d5e46abdf0c857999684ecef72aea245aba693
SHA512ef796c8b72c36e4268712e6247b47c1044bcc750a699bc56232dd1beff2bcd0f837bdf482abb055951eaf512992702c022bc67fb81710f77b78bd8e8338e376a
-
Filesize
5.9MB
MD5b86f0c7f77d2cb6ca15df3591b7ec1f7
SHA1de5a0efa5aa043fb56b68766386c455cf63cc499
SHA2565e89ce5f85bad52c0ced63debd5106c776d242d4c25cec8092916de18f9cf8f0
SHA512277e354957ec7e9e957a1972dba2c3f5e2bb88348aaf27cdf37fc8d512428ba437eda4825e67e3d350247d6bf0231dc28144eae524ecc186eab290c2464a1cf5
-
Filesize
5.9MB
MD565e21d5949462dbb745f6fb4837719b0
SHA172b2dcd689fc12864ad4714b6a1b05d51502ec5e
SHA256ede203fbb0b846c226fd852be6b130374e92f8f8798ed8ee803fed7df532d05e
SHA512db199da26395dad0d82b8980d3948e7d0857b78395913c1b5e6c889d76b5ba1d5a4dd452d4fb02de5991991459a2910ce36ea8492fff1f0b531b76c68b268345
-
Filesize
5.9MB
MD52e886989e87f38a6d7981fa71aef8928
SHA1b9307703f0888113a7d34b8a79bf02745ecf9452
SHA256c94b194dabae7dabe28c9000078501d51bf88c4d0f8fd7177f195cc4437d71c6
SHA5126685a8e433bc7a3398b8f36142ca4c21ef7749ff9d47b2acacba2a3d4d7ad55831cd03ec307754267463c55bd6b5d3deda86b4b1887c4072fb19cacfccf87d81
-
Filesize
5.9MB
MD5c9308c08461dce33f02912a64f7cda51
SHA14da6c5f6665361c3c0f3025e038affc5594fa6f6
SHA2567177eb47e4b72a6ad51b26bae743b80407b0c295689e37774584ac1b31c263c8
SHA5128af418678cf736470d2dc5153e65ed07b77e4528f262b8472d706a3317da555d2b97044dd6ffde7be767ac95702e240773f81933590825b4bafd9bf91d8ce18b
-
Filesize
5.9MB
MD5504f11d315e84380385adcf9b22861a5
SHA1fbc40f53c3e139d7259dca694a872222dbe1bb1e
SHA2564be6f4af529e207e0aacede0f31f995dac6bf740282a23cf507da72cb6b2bec9
SHA5127025be73dff5f226e7a12f3c853ea59a54531a066b3e9dd05349ba2d54ddebc44b5b986da86251d321c669e7da0c5f5ec257224c36d794e965a27336fc7a3c4e
-
Filesize
5.9MB
MD51460810ef1759f7111699728dd51d377
SHA17566157e944609cbf23a6ae489905bb71b85374b
SHA256c56eb53a19ed3c02634967c1b18d93e97220f19fe90d6b9f9ed109108e331004
SHA512aee63d8fdb50a21d89f43bd67e38a28a05631eb33899ae3d5783b731f4671951055bbdcaf477f8894aa64d94c40439fc6b55e4080b9bfd3a6c5bdbc3690169e7
-
Filesize
5.9MB
MD5313e1b4ad2f08657d3b67b2ee938406a
SHA1e8ccc71b54590826b532b4175fc0d8c74571eb6a
SHA25615d432037a854c16e9720b69dc2d62807038950c328af6271f38b0af2cd9a726
SHA512f9e6b13d07f68be6e007f001fed89a74398f8069ada938f023edbab68c8e56aec384f703bca0f8f5961569348124b070fc88c650c6391924e1566d5d098d2224
-
Filesize
5.9MB
MD520d4ab913bb79d7450371a82134271fb
SHA13af55242e45c528b692d4535688027b01bfde790
SHA256a317c916c72243f48ff8f61479e17299ed5c76f45c869b27f7c51732c1661942
SHA512ab2d5ea708e2f9834fdaf73492f398b6e3fe8a206f0b9ece1b11da3483164b5d19e70159f308dbee0a709e1325271b3af1d682e34d7fe5fe320db0855f12f4bf
-
Filesize
5.9MB
MD5c5ab7be3b0127f1ceef240344781eb84
SHA14ce32fb9c3ae7182936e579938c951efcace5e67
SHA2565f12fe1edc213c91f2eff25bffc79d3495dcbc5b1da6b0bc03674e776da70e7d
SHA51279b056c085690756a586366b0dee746f13fd53ee29301c644fbf1208061e6f6eb38919cbf9d68f2b55cbbe0467d7d78fdb00c90881fb8543f2134cdda362daa5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB