Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13-09-2024 13:35
General
-
Target
2024-09-13_d4d6762542965a8342131c1321a767dd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d4d6762542965a8342131c1321a767dd
-
SHA1
c7db5cbfc93707bf53ee0ca2e4121ea3db9ce073
-
SHA256
913f321d055b43135d95d56b160ddee91dc8967997009b98aa7243cc890e59b8
-
SHA512
ae831bad682dd97cb1cb93bf579c77e30e0337924fabef4ac6e78dde940f94a5d7d2c8a42a1106af6280a32153ccf814ba34864b7f740766fc30e869ff3819af
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibd56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_d4d6762542965a8342131c1321a767dd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_d4d6762542965a8342131c1321a767dd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DUeaLaO.exeC:\Windows\System\DUeaLaO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jouGMJL.exeC:\Windows\System\jouGMJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXiaXGI.exeC:\Windows\System\pXiaXGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ORNzPez.exeC:\Windows\System\ORNzPez.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzHvrpM.exeC:\Windows\System\GzHvrpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vzaZwSP.exeC:\Windows\System\vzaZwSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVbthHt.exeC:\Windows\System\BVbthHt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JiPCOVO.exeC:\Windows\System\JiPCOVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sxgtNuj.exeC:\Windows\System\sxgtNuj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NYvDTOn.exeC:\Windows\System\NYvDTOn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CnVsris.exeC:\Windows\System\CnVsris.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsaFrQV.exeC:\Windows\System\MsaFrQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XrRHohq.exeC:\Windows\System\XrRHohq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DLWEGWh.exeC:\Windows\System\DLWEGWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKIocjH.exeC:\Windows\System\VKIocjH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fktZoNn.exeC:\Windows\System\fktZoNn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CHqpkuf.exeC:\Windows\System\CHqpkuf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGSlajH.exeC:\Windows\System\HGSlajH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fekzupl.exeC:\Windows\System\fekzupl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RRVwIrz.exeC:\Windows\System\RRVwIrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNOUmpH.exeC:\Windows\System\VNOUmpH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ba20ab57ceda4d12e4b473bf35715e89
SHA16615d6c0262cdeda6264fb9ab63d76722eddcf2f
SHA25666d548058bcaa15369cc7193c0fd67f4338dcf559f684f27698bf8c7a0cc34de
SHA5128615738ee497a472ec1ab1d49b6830b0e371fafe35e14da8d525262fbeb15ab71089261d6f43c34e5c66bc8296d3bdf4e114f162af2c6605d7e2f102855e58c6
-
Filesize
5.2MB
MD52db9feec46c277e62fa5c46cd11bad83
SHA1dff2ea156134687bbdd03d5a20f629b41be5e956
SHA2568f612bd8ace9015480ed9b2003e021b830529cc769b2065f278d93aeea437572
SHA512916801140dc26fbfa9f605299aceeac50754d6312c88bd13d95ed75c09b78640909a0847f1f1dafd55334bf1cd1f1c992bac09b958392c44401c4fe90302f04d
-
Filesize
5.2MB
MD57cdbf036c8b590f4d8c1e762ec8dc922
SHA1973fd6e119e952e2edfb2981d535b048c6ab71f1
SHA256581880ff03d1c839e39a94dadbd9b44294e79c342437ac258a3476f435b7e104
SHA512e6c833a5fb839868e7b49695242b903a96d56ef84111d0acc749dac28723395d16e0f8a533ec4b7844891240ea68c7a5b5270c089b5cba6e63d50ff190eabe47
-
Filesize
5.2MB
MD53809b415a5bf1505b0532d63e16ba0cc
SHA13163a47152e9ba221617e6f674d20ddaf956b966
SHA2568465cc0656903a21ed0763b819a58c1648b30c18b5fbb28dfe61ee31be81aa3d
SHA5125e21bc301b2d13e370af466d9adcbf14ea6167e8906f11b89ff5bbe0e08656a14f12d1d4c6098ad8604ff9ef96442113b37a85521a291b10b42756ab3ea37b1a
-
Filesize
5.2MB
MD56010439381f010cc0889c4114c0a7f7f
SHA1e763e4d8eb53e69b7c08568f17fe7873d7b989c5
SHA256cfee6c66ddb72ff8a4cb2abd55e3ed801b650f0e3ed223f13c9e71b4b6a049dd
SHA512ddafc99700bb229e94f5735086a019c597235f3f9130ebe3cdb84c8c1f1d1fbfb658a8d8610888bf893e02917005671fc4d5dd6a602c8195c8f9028c932ce175
-
Filesize
5.2MB
MD5beab721ad2e0e7abcf35d7fcf83cd2af
SHA10ca81efd4e1c77725b09c9bb3edae0bccf65a3ae
SHA256fda0bfde749b7088e707d38a8e9d2da06b14b8fb309d9dbd248415289939abc0
SHA512fb960fb86f8780f0806bb0f714c25006b00e017e9b730e2071fa5f11cb71b945c2ba56d40acc362a47232ce88e7ba4e24c1f5bebde36076687fd220b4efb1c79
-
Filesize
5.2MB
MD5de6b804c290ddf797408c94b79516a4c
SHA1c3df63c3558763e1f1d75d0aad29b7f9b939b6c6
SHA2562ccabb638535abce839ccec46c7672290a782f95e497c74dfebf6d38b5416056
SHA5123aae91e479fab5fa1263f4b84fd73d010750f81d17337a46e6b7464c809b2355f269b3fed0d72a2a90e9dd576388fa4d52a0dea8cd06b481491ff135bd151b98
-
Filesize
5.2MB
MD54214c5f930732bc3f3a5bcf019d28684
SHA1a4936d57d04cb156452431e59e7a341e78931274
SHA2561cd335b1a9c43268ae5727318069e669082657620f2ecd9477183fb88b15e583
SHA512ba0882232f75bbb0703cf9b2f0dc6d0a12f79e575b4a90cdd9a1866235e8a4aa27209bab7c4da994fa49d42d826b35f9fdef329c3757c5709d55be0ec3e775b2
-
Filesize
5.2MB
MD545b1fa4fd33588bb6b85665f5e9658dc
SHA161440a73d01241398c532f9cfb802f7c20e3d47e
SHA256bcbc8a6a14c5222ced5a072b9445ddec2388775cf86fe1f3d284be94e7d2b4c8
SHA512051e4bace8f8fd8b124ba3397de4c48cd271fbdca611f01f2eb12796c318065871dcc33c1e00ab555da57a55e0c2f0f7aee9c757986a8e39fb706414600755b7
-
Filesize
5.2MB
MD590d4fc8b7b0d46dd0f753f9baf5d2805
SHA19ea4c12292108b41e5028489046bca97ccaa4dda
SHA256419a7b3b5c2d19b9ccd4addd62b49723c73bdb34d231c60a4343311c96e24e3b
SHA5124724d57499e1bbb4f61d9f135f5cbe8f986476b73e6865ef767476b5998dd864abed999614df0a4dc108877a5e393e532d90c3eeb18b40649207ebcde38b4ffe
-
Filesize
5.2MB
MD5cd0a054133b3a5ef534cbfc3a3cae315
SHA16f022f84377b7f29ac8093da3cb69c641e51613b
SHA256e830614dddae43c1d1fc843604b4262a61099497a47d0cfcab5a708b8e84d50f
SHA51230bc99d8757ce8832c54d6241056420def0175296e1e4966f163c507372203e457a8ada22faa4230f87623a908a10afdc211da1e9e86837b1f465b344ab3e327
-
Filesize
5.2MB
MD54a89e3da7b8966aebe0cff6c84036af5
SHA1f96ae90ca081510ca4c5a563b2e6d73e97de7b37
SHA2560d98ddf578887637bca392f8a1548fcdbb602d3a1816d0e03db1f4e11f4fd6a1
SHA5125e470fd15c73c7c5fe9825f217ddba6d3e4f14b2160d1a99037d16997c7d2b3b0ea41228dfb726ef75ca0c12f79c6c355336b22eda4f7fbfe65fc1594e5ffe5a
-
Filesize
5.2MB
MD5f72f5ee24f04205704d553fd622af609
SHA1ae8b0d4b0db8d800c73290fd6bddc4784f2ee727
SHA256ef14a61d3350ecd6532502b696a2707a7385f47c0aa503b354c40c9c98e1bfa5
SHA512e2f23144d62b5f4a60985c8754267cf147d1ba35cebbe04c0577d047179b8f3fd57c90099c3138e2f3bc868f2740e4578836c63dd70941278714b20894e83c92
-
Filesize
5.2MB
MD570e7f0fbd6c733f0effff05e78aca80f
SHA161a1173096012e66ba6f0c2e634b4c3545315fa0
SHA2562850cdcc56e635426fa40ce95fa3e57fe61598ea4d38d1c14737520e36511756
SHA5124a7c78513e3f44df2c786bd761d3960381858745731b621979dedf1da3d2f91127af1e0fc69d3a8d63055f367b4fac9846920e5310c5af7f7cd714b63cacc389
-
Filesize
5.2MB
MD524e6442940c9e3b291b8f92b9162419b
SHA1f8ad9368cfe00cbe1a9406e8b75a46d6b92bb4fe
SHA2562cb26c4541b564ad500e6caaac802b89ae2bdd973654a02d1771a86d2e520781
SHA5120f6cb8c6ca4b8c85357595e4f666e8590f4ca1c6adb5d80a011d703cb3fa3da9ddac7b80d068a8b7892a1da775da136925852436b31a04d0aa68014652b8b7bb
-
Filesize
5.2MB
MD5894dfe9cb30c6d36da9708880eb83b01
SHA15d782286bcda887f675284d5c3a0147ca32c556a
SHA25695f8bdbb05d23e667f91be0782c4e5bc63d86424199a96bef13c930b561b8403
SHA5121ce441bbeab973bfe22a271304881fdc23439efd52dde37e8297c177340dc01125be54275e7e7976e2f79485a1103651530398020f2d9f71ef1264175ba328b9
-
Filesize
5.2MB
MD5365b5306e00a348cf71abb25f7f68840
SHA11b83e27501a1d6b4a03eee9cf11cae33dd76ba01
SHA2564e826d3426dfb87e3cc2da9ea5b3105e8799042326eebf64fa6349b8e9163160
SHA5128eaa789e5d9af700816b55b40070cc34bd0f51830920acc8a70eefff196460f2a723be10dfcb378527e656051127006ae5ff66e3d3fffd799fb8c53613b09d5f
-
Filesize
5.2MB
MD5a56ce529aede4dad76ae6154953c1ce7
SHA18966f4d6b16843567629077477ebc1a7ce592e97
SHA2563ac3a8550178738f5c331555a8fc3d557b71b2250659287f1b6510bb9691ab53
SHA512952223822c7ba564ad45ce48a91cb6a76006b04cb489c94f52950e219ae7ca68bacc2b5b4853806268b9f6fd15c6bfd7072a63f7e58d5a3d9aeb86a7c0eebc38
-
Filesize
5.2MB
MD5034402cfb0814806d40c29a4e0ffbda6
SHA19c74257d965bfccdee6110ca6b0ad5cbf59fba35
SHA256416fcb0385a0bd7fd95aaaf071ac987e948bf0224f8876602a3896de7e3fba95
SHA512455ae447eeea78f37676f1fb4ba66739ddff767af94912e31584d2a5bc7d9fbeb79719d04b59a1ffe6b1454aab78b3403837731072ff1d84bbc3efe950e9b401
-
Filesize
5.2MB
MD52ea28942a546e5a1e72262de17879735
SHA1784a571677778a3ca8dc7d9a4b4129473b5635cc
SHA256e36bf4561b9c57dd59e0512af9451734d508062e9965ae78fdaaf937aa244362
SHA5126f6e7aae0853eae80eb89bfa4bc805bafc9700fdc1b9d6879d16bdaee448d7089edab2732e8e5716ab4912f2ddb93fac01994ae4921aa030f6bf97476ff1bf5d
-
Filesize
5.2MB
MD53c4ea6b630e00420031c9e032beeccf2
SHA19b64d605c04e71c5b786e24afb4789526f1789c6
SHA256021e714b67a08dfa7795081d055324e997a351e563bfb8b7ca19c5611e7626e1
SHA5123f03e66942e0a2fcf5cc944fe4648ae41b614e9eff98cacdeecc862dd5fab62fa04c8083af70e66f55597c43c847003605b0312548e7afac27eb207014909ce1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB