Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 13:06
General
-
Target
2024-09-13_7b7aeb978c5f74a23680c355254cf9b9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7b7aeb978c5f74a23680c355254cf9b9
-
SHA1
64c317577ce98f98dbd4079a2e071ac7939afd80
-
SHA256
e84c8f48bea235425bbf32db97da026306d1a910ea67f05a1afd3616d296f323
-
SHA512
3e6cd03b4e5bef1506b78d3382df0a2490318e35c157b72894e96c82e9f401023668223778b89459957e6f201d60f7746e6e3bd5e116d07bca40eb30deee2518
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU/:E+b56utgpPF8u/7/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 52 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 50 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_7b7aeb978c5f74a23680c355254cf9b9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_7b7aeb978c5f74a23680c355254cf9b9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\luFojqB.exeC:\Windows\System\luFojqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fqpQlgY.exeC:\Windows\System\fqpQlgY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JpHntEs.exeC:\Windows\System\JpHntEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsvSGLp.exeC:\Windows\System\wsvSGLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPAyAPp.exeC:\Windows\System\gPAyAPp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzxBvcu.exeC:\Windows\System\FzxBvcu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lreGaGt.exeC:\Windows\System\lreGaGt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKVUcGO.exeC:\Windows\System\fKVUcGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQaEjQn.exeC:\Windows\System\JQaEjQn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ScfYNaW.exeC:\Windows\System\ScfYNaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OAZbwcV.exeC:\Windows\System\OAZbwcV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HhlQMeN.exeC:\Windows\System\HhlQMeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbsGZMR.exeC:\Windows\System\YbsGZMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeYnsZo.exeC:\Windows\System\qeYnsZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGubTkB.exeC:\Windows\System\HGubTkB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGbCDJB.exeC:\Windows\System\qGbCDJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYqjUWh.exeC:\Windows\System\SYqjUWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpEYgHT.exeC:\Windows\System\tpEYgHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqdFXgX.exeC:\Windows\System\eqdFXgX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBspSHu.exeC:\Windows\System\ZBspSHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GBPkfSf.exeC:\Windows\System\GBPkfSf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5eeb370502646dc4aa9dc66f81aba3b1c
SHA1de5812172bd83a6b5990896f1e3431ddb20a4665
SHA2560f14e0cf798414f40504a1ca02f2f57e431237eb2e8305c90208a4aeef7daa51
SHA5120d2fc47f94eed8e0207be01dea1a83408c32f66660a93303ad6a0646932f7c8e87f1403ec2a9d3bd13cdaffebd1e3b0f229d7946171ddb687904cff46fe88d25
-
Filesize
5.9MB
MD57391d0142ab8ddd0955e0fc913708035
SHA13e38e4638f17996564ad48cb23ac084e8ce828dc
SHA256b8d7f6ae84bc00a5478bedc5c8185c61f88740dd55d3271668fdc7b334eaf6e1
SHA51288831e8af2f94a3b82cb4aa6f1351735204ebd887cdc7e7c8db658d7058d85bd2575f4e1f2925ecacc2fd0f63d4c8987f46669e8e93760c91157a25339a3d01c
-
Filesize
5.9MB
MD5756d3c7566e2a694a8ef97852bf600f8
SHA14739e7693e40ec15c1d9574a5cb49ea0c47243af
SHA25610bf871d56f4ec15bb8af638eb79b6dee1374081af61bcb10624dc07a2c77d03
SHA5120bee9982c67229568b64ce4edf4a9f19d89c60cb7d8fe19f5eb2e8c6c0c8f7551ed95b3c770ba22778c3d3ac090a7a79373c91ae00c1a4f4446d45bdc4783106
-
Filesize
5.9MB
MD53acb50d595b9e29e0fd2855ee107b2b4
SHA1b1a2ce4b2859fcc52714b1bf3291eee37f83927b
SHA256e70927f86e6853ca5666eebda82ffab49028d855bebcc41f280dbe18d6f4a3e3
SHA51226a84f88587ae0260691887d3ad35552bc1ef4de6ef407cbd190b506b030057d571a267f4496e604b7696591b8c0150722e55a181cd927744568d5b6bd3286ae
-
Filesize
5.9MB
MD50b4199488738bddc9d6edb410b679c94
SHA1bc8d1fe0a994741b90c219130ebbd5bea2b98eae
SHA256350016924666102553635fbe548103b29b5d18119f22d2efea6327958b01898e
SHA5121d95b44170047c9a1f16046eb311a697c490b01ea08a895048444b83d9ed7ff5901a866f17ea4b2917981bb581788612d51fe60bd8ea7720d4cc7eb7351e6a39
-
Filesize
5.9MB
MD565f8361b5597dca7502c282a8e91574c
SHA1b403cbe23e1ee21963755bf3cbdea07c002742cf
SHA2560369af1c8aa4b8aec83abc9b336a100e0c8bd373750b7e0fdaf90ab251a7859a
SHA512fab5167dccc2c5c5b86ba33dc059362231a142e71bb968773800ba230c1eef00cc3b252be7a14f338409ff8a853a8e531978d749fcc6b2786bb0e91c73759211
-
Filesize
5.9MB
MD5e31179ccc6855a71bf005536607f2093
SHA17b8eed6af12ce52addff6771d0c91ac7aa719117
SHA2560da5f8d105f5e44de8f8686ef47f79a1383b281727d68893cf4e65e7b8a6ed60
SHA512eb0e5e3cc9763b3d75674980d60564611ffb3ad5434f1ed67853509a28cf3df21f8d0896ca6f1c418ea13e129f91c1173c480263510d7c2d1e064d63d38d0e1b
-
Filesize
5.9MB
MD59841e5485331a0110df0da87cbd880c9
SHA10a6f427fd0fa9cd95c594c49de6368d80ec7f450
SHA256669ea6a5f025492d17d405580e1158e91697c9bc50f69b358acdbae2ae72ec34
SHA512c93d7cfa29cc621ad8676cfd9975318b18f6675a67382400d733f351361c7f44b7d7f934dd25bd857076a41aef253c2f07c923dd4d977b91c8cd0de69cda7845
-
Filesize
5.9MB
MD5d6545a70f48ab7a4d969ff5535ac7187
SHA1120eaf2dbcafb515e2977857c108eebc4d9ff012
SHA256216ab11d1b5743b802f14cce6187d813298f394e14e4197fb91a59bf543512b2
SHA512d6c37e3339938a6b3813ef7a45d1d5fc2cd9598c69e8e5e74692668463b53749686499901ad9ee63cbd9e7a92975b106dcca5f90de4fe676b2910b91a8033a05
-
Filesize
5.9MB
MD5a1277d5be9b317c5f48d924cc0fd6644
SHA13c3a016786eaba91f5e219817212066a239d5871
SHA2569e8aad19525a0089e2b9a86ceed668526fc28027205f11a94038a8109a86e95b
SHA512a9d0dab747ba71c6e3b4a311f648064e089bb461653b8f5e2be5e996243499662206087e8e0658469992469064f795a95f67f69a362ffcb7d5d2d143832be41b
-
Filesize
5.9MB
MD59936b3d71484c9fa77535c33800075bf
SHA1e41111443f46ab294b1f18a5601ddcf2544e1aee
SHA25648f818c3161d0de7c0be4051809b3177add0a45c7b70bdf24dd892c941f35788
SHA512e0a5329136dcacd833f59dadadcb5b311ee2508468500226a1a9c6c5b8c7f0ae919f839ea38baa2e459c52f6f7a30ff3c10fea4f4158b8a5b49dcaa850d0e648
-
Filesize
5.9MB
MD5c93b83afbcb462c1a30991392660f287
SHA1a7ef8959538e6d8d73c5f43fb272046ec2ec8f3e
SHA256ce7bb0464010875a8edbaf0fabbaf3dcc822a0e710b8de584320661492698b54
SHA5126d5f26f7ee2bf6c540d17fa81ec5a9a40df78e8f24e834fe76c46c091d9e7ba9886460d9b4f4fe32cab9b25e16a1c1a31d8c493a31af7e5122a36cb6ea9a12a1
-
Filesize
5.9MB
MD5d1b80babd54d2827f10c80072c6eb896
SHA10daaf7d880501611ddf79513fe36b154be4ae05f
SHA256ee0ff47a1783ca335f05512782ff7ae66a28f251dbc36c1e981cc5535147e6f9
SHA5128e675606f58af676232c0902b3645125ad718e78e5731126ccaf608ac03cc2f148961434dd4d5c95f2338b358123e0fce3a700c64d204ccbd27fcdbc8c5af3bf
-
Filesize
5.9MB
MD5566fcd195dc9307a643c4e9afdc1a1d2
SHA152374bb9c6670bd0502c3fa0b974c1eb37fd9d58
SHA256dc4b81bb2f286470054c94c1c361ccf081841a6b26f6da76c898216a3f428c72
SHA51229a6a18eada4dcb4de9bdf6129057845fb4731bb4c9df2c6fd8c66e54de4dfaf300d9b38108164c807438b96ece6a707e32a9ac380e6ef4208ecedcafb66cc56
-
Filesize
5.9MB
MD5acd634ca77a5e58ff538428e85305798
SHA164f7ba8e8886834fbf7097426b298f6b9f8bed4d
SHA2567ec8fe25744463c7f06cd6c39e133142d64609c3cad90c9664304c8c8d3aed66
SHA51280126efc5014eb00270bde9ff37dedc26961f72700c4f485ada3bcbfe5641cbd02f30fa6a6f6e11cc2900967cef252507faec7cea531acb4c0269f6d43182b30
-
Filesize
5.9MB
MD5473c977a8bca5accd8da59c9133ea483
SHA18bd3fc103867809c2683bccfc5298c54ec2063e8
SHA2562f8d94b37ee014f0701563320e97c05a15d5bc1af2396f353ac6b2c0b9a35786
SHA5121491026a6729436be93ea2ce8057d5fec3434ee752ccccdb5117c89504ee1c84e8a378f46b36afbf36becfbb8114fbfbb9d1300b691850b4e28889df71d7bedd
-
Filesize
5.9MB
MD5b5625caa3bb5af5fd88527a666e5776e
SHA1ec0ba684198e4112e9d6c027c78016ac2ddf9f8d
SHA2560bb3ac8bbed65c79b2fcb0318a711a464245d59e453c90a0163dcf88df3de5b2
SHA51251598412bed12c8ca90fc3e50f26b80df275cbfcaf3a62e1604ceaa876e39a9ccf22c211707cc0f36b2a6314ca46a921b521dc0e4a32b7162139c482e773979a
-
Filesize
5.9MB
MD50e8289413df3f107635d95817a1e3ab5
SHA1fd2a693ba21cf241e5bc212528b4e062cb742530
SHA256c1b8c62ee412b2288a40b05fd196b7d728b577dffeabb898d44bccb26f7b43c8
SHA512f66427a838ab0a623a184f7b5282f7240e6d7d8363146478a88966454f38d8a3bc773987f4a68877e705e13332a2e5bd0b2af64ef6a5dc48df9723d79ee18259
-
Filesize
5.9MB
MD51d64441fc1233f3185816042e793134a
SHA13febfe206f9b4cf35e793901d8d59f6c24b1a423
SHA256266082f41b0fbeade9e9948c1e5c9810fce2cebf6b555e8a15fe73392b205811
SHA512ef4ad104c72537a2547480b0c112b431438adad2a1f55044fd36affdb6de9c6fbf9b2263c95c0588efd1ac3a5428c768ba105f326186c1992aeb2582d1362c8f
-
Filesize
5.9MB
MD56473dad0475a122d58755628d022ff9f
SHA111aa6b43b036a6632a1c445234748b33ed3f7569
SHA256cf476bedfa9309f61b3cf112df10a1fdb7cd4efaac001645e7b1978dfe02e4aa
SHA512a4467b4a90a59c57284f62b74424876fe38a0fdd60bfe993f213717e8f278faa96f432ac6fa9e34abd78c2f2e68ad2f8d92d1fe4d73da239b2638c8028487cb1
-
Filesize
5.9MB
MD57f1697e0ecab1687e73689b16515b1f6
SHA16fbb1d1a601b554d848ba1f939b739d331a72abd
SHA25683d10ce92c3c6b041fb9a3da773d79b70db23ce0bdf9f19c5c5fd1def40b423f
SHA51237594aef1c05de104b4e0d24f08669fd4a41b28682ca1e4eb1942ddb030e947d05a3be8f03f20f76bd41468664ff884e736ae8f9ae8285fc23a03c5d92b7bb32
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB