Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 06:52
General
-
Target
2024-09-14_eb9cc142ff20ff3f648675325c1b1ec0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eb9cc142ff20ff3f648675325c1b1ec0
-
SHA1
01e09ed04648dbb29ef317e5af99af0a7b5f7f31
-
SHA256
a422c117affe2ecd3c063d980b69fe510f1d9739271dc9a6451a9b75601b99aa
-
SHA512
9fbd6d8aa5e3604b95097a5daf090ac15ad030f89b3ea0f9928abd931ab43c210bbd41ba5ee879675a2fff5e51ae949211aa5e8294d274560993cc9ec1d1ac23
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_eb9cc142ff20ff3f648675325c1b1ec0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_eb9cc142ff20ff3f648675325c1b1ec0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HPefHrU.exeC:\Windows\System\HPefHrU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrsmhFn.exeC:\Windows\System\LrsmhFn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPRcVhy.exeC:\Windows\System\DPRcVhy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJyfWAY.exeC:\Windows\System\QJyfWAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpNxaox.exeC:\Windows\System\DpNxaox.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJxyQTO.exeC:\Windows\System\GJxyQTO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JCmFkYO.exeC:\Windows\System\JCmFkYO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fAfNvCx.exeC:\Windows\System\fAfNvCx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgDFAth.exeC:\Windows\System\jgDFAth.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cztlyzq.exeC:\Windows\System\cztlyzq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgBgCIY.exeC:\Windows\System\rgBgCIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePeuecs.exeC:\Windows\System\ePeuecs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uokZnen.exeC:\Windows\System\uokZnen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmvUqGc.exeC:\Windows\System\cmvUqGc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JcZbfIu.exeC:\Windows\System\JcZbfIu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZeKjvZ.exeC:\Windows\System\PZeKjvZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UqqinWk.exeC:\Windows\System\UqqinWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgobGVY.exeC:\Windows\System\QgobGVY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ODzgOZK.exeC:\Windows\System\ODzgOZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sBzWSxb.exeC:\Windows\System\sBzWSxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnaFkDJ.exeC:\Windows\System\MnaFkDJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53319fd8ba1810b4fbcc497dda3350569
SHA1c945e00abade17b8396758e40e4c81d8e3bbbaa2
SHA25666ecbe8b41bf06fbccfdb44fcf551e3021b5e75b71815ff310f3369ed95f546e
SHA512ae680e87a282a1826f669f38b4f2cf04ab5f6f7bcc255c928252dce4c2401b2c1c3ec193e0f9e51702f8fc251873971aeeb0064aac45f0608174a6f5e34b47bb
-
Filesize
5.2MB
MD52ea28b3a167e965d3dfb76e3b6de78b2
SHA124110389ab387eaa2ba68d3dc33424a231bc0639
SHA256e3e5bf97400997a8b86826ec959f222b05aaaacdc99aa542ad2e362a429885bc
SHA5126b6f8fb8423153da58a067272c2e70199afe25ea7968ef219efabb9e893ea9f7714ce30e8ebb1d6277385c0db371580ed3c8ab1ffb03b3cb0a9f6b3009b978de
-
Filesize
5.2MB
MD54e87ce2ab857bc9344321d2bfebd4cba
SHA17596833255f547e771955509e553c92707ca4aae
SHA2568f17070d5bdeb158bb264a3f58c1dd18af919136d7dbcea8b16466a20b407a04
SHA512a8b05d875e1a4ff6c5228c84b38c461a1b637faa651dab0fd9e031dbb62cadce937ad128f3fd5bbc856bdb0f2592768ae34bfdd0a2e6317118b7ba89149e14d5
-
Filesize
5.2MB
MD508a05ceff3226c50439648db77aca1bf
SHA1e7abe548f8f1a0bc1302074ecd46ea1545239d9e
SHA2562513761d84de35f0794be02a66b44433d45805d8b84975ef5864801969a49e81
SHA5123aec0823783ffb5322897b3f1b1dbdfeb9613726c1a56d3ec7f20b344ed3ded94344e641dc69a6f444d2009728a565dd74972a04cbd65738f92a13ffbc802b60
-
Filesize
5.2MB
MD5f64ee93cfd1da06f0e150257cc3f9ebe
SHA1a9a6697a20df2f0a66af546c1bb415edd6cfe94b
SHA2560d5eac8233ca586e37db5a38c3bd0c813a69c5cfb2eae8364fc2dd0ece1b7b6f
SHA5124249858ca826c1f885d63ec71fe13ce2a7c520e9664967bc0378c8810661c8989256bdef10c0c67b83a97d5a403960ef02151afbd4297208511443d2bf84d6f2
-
Filesize
5.2MB
MD595cc41a2d844843767149098fb9d10f9
SHA1a10082c982a252ec604ad6ba13a4a7b95cbb1856
SHA25672bb7d552ae0a34562b95a35bb1e35846baa44ad2942fb51ec8a5e375f40778b
SHA512d68af5d481098d37d85ab023368cd84381e0b00f6149b5e8213bfd7a3db0139d0afb6f3c8fd3007bf60d76a795972e2dc5b14198bfa40ba6c8687d0b6df709b4
-
Filesize
5.2MB
MD53282a81fd71ea4673305c4d7021f9864
SHA167736448c990c4ff3499c0467105c15808a49fc1
SHA25653262d32e22d49ecf6dbcb1b78315ad97bf8e0456ab57e0d8de1691ce8f36e5b
SHA512d389922792615e3f484623d509c47ce933adac0d12e0f6d5b8c8c0349dc5240b51712d78c99a7f6b78177fdf08fb73a89e75c4effe4040e761d83fdb54157e4f
-
Filesize
5.2MB
MD5ba001a625a0e336bc898a74f861f67b9
SHA1f267b0ab7627504c5d8cdeaf3cfe5a2050adc51b
SHA256c7890fcd9447e4b605de5783c3fb001c99056947a5d3c41d1a89c518d6d1b36a
SHA512cc10b2710d1f1727fb983c176729f6e113372ab0b1824cbb748a24ef81c07182749d0ac9da3776faf58c9ff462b221302ac401b11ea5ed5779173de9273b687c
-
Filesize
5.2MB
MD576103bcd712804979a4629de275e45d3
SHA19695c30b8c4b0578d431338717f81123987f8097
SHA25692cf73db9413b79907e619f27479cd2b033c502b339837852608227a14bed4b9
SHA5127c8b56c2ec5ecd1349c11aa959b18d404690041c1567b1d3337556de9825ce662152b1bd39743bce74077dba8e0b2d00875dfdb5bf651883a4c944557d49281a
-
Filesize
5.2MB
MD558a74877c8e7da08f563b82cff295ed5
SHA13bb6fadc281d5b57553c9c7dbe53d271ad6aeba4
SHA2562c1e3db76bce1c56b4aba31453a59da5d4da5f7cd1471fe6e8dd4276e1b8572c
SHA512805f956844ba28386380727583cbacd33c1d5c3f7865fe55dd01b842b23f261bb6a806e5d0b4bbea54c3249f816245f803d98a7bc6f03f64cb56aa65de8a0960
-
Filesize
5.2MB
MD5285774d9ce58f637046cb9d17adcfa4f
SHA16c13c9b5c2b788b1c29cc6445e9962f2d2364387
SHA25677069e943829c8672bda4c2886203824f1d7893ace32cd4ba568fa770fe44688
SHA51242f42cd52088cd21541bbe49bcdbaa7b473525ee4e4d87d975d4ab8db589a1a9ef8203d2033712a4f8ca6265ae67d69e4dfde6ebe3d120ed1de4719f41676f6d
-
Filesize
5.2MB
MD5401c4cebbfea7b819db2526b295825c3
SHA1d69ee3cb8046f9ea4506bd0257289f3cb371eab3
SHA2563bb0f2d59d1566fbeed4b2a937882c5673bb0bbb510eefe11ae6ac65cad448c8
SHA5125e98576dba2a9cb66e4b50991102b4b955cddf60cce6333a3233f7103f84fbbcc6944d394db5fc2edef1a684ea24f8709aecce0d2abffbd0a1fd4923d14663c2
-
Filesize
5.2MB
MD5d9614c3966089a5dbdd7bf13e720d969
SHA1beb29963c9ffef02e0327ab3a4e7d0b75ac810ce
SHA2567afeb34b4b6e1eb2dd48dabdc3eadef966ed4b8d8f815e180477b4492ddbc51a
SHA512d6e158ab5c5c70e49bb8b50e39785dc97985b0156dba3f9e09806ae1167ca257ac8ccc50cd92d72777e61842db1d236fd42b53d2442914d9e56a42eb471ba9bc
-
Filesize
5.2MB
MD557bd19956114e6a3bed8b0d266eefd50
SHA118d63f5d1598440a41fb444344fd29d342563a1d
SHA25693f78b549c571532cb280be9b697bb4cdb506ba31b4663e1eddaea0ad96bc7e6
SHA51244760a67fdedac2d6214abc1e3b0c628eebf0dc9c37f541adfa392d9ba18ca85b0348db696eb26466bdf058452bf6ef4c535e696272a4164854f298021c14fd6
-
Filesize
5.2MB
MD586cdc721a897f1b8f623000696011b0f
SHA170aa4cc5df487dcd4fd8e4051a78c2211ea0ccb3
SHA25640ae1e9a6ea2b1f7c64a35f2b13f6ae6fc800234a776b87935d13b6e35daa089
SHA5122a81115762c2a3de42cfefb761d139ead7154127e34a18b24ed4f30eda3c5fb2b9fefa0786e36c26e4f71f1c0033f5886551cbff1d72a80415b43d0795be6efd
-
Filesize
5.2MB
MD58551b77ec7a23e446c35bfcab5f13675
SHA14198d55ccca89b3c7ac7e9087ab6be7d0fc01876
SHA256580d0ec1a669de97453ce9956ac2812bb41876b1d56fd190a2a3f04c15da865f
SHA512b33ea8dbbc0bafbfb86c591da2842938cec2999c381631de1a37136af7646eb986883b9e60bb7b1e944e5a505274a9245f8e4df6a02616e332536687d2f5267e
-
Filesize
5.2MB
MD5b3bc9e82442fc8eb8de0b82452a7c76b
SHA1e72f4cc13f9e6c33cf9c2807f718beae5407d016
SHA256abdb5854d5493b741a05a656ab555eab77c75ad7666b67539a1175d64eab6517
SHA512246bfb1f425c2bbe5b5016c26b949065e7ad407ed8275acbab10070b7d83b2b1078e16cb7d19b2c5e8f9e5415f22059454bf174080bc9825cb679c251a62624e
-
Filesize
5.2MB
MD5791391dba673a8767f5252461e15670c
SHA104f219b7209ee5f19a9a212dc257350a45303698
SHA256c32cf2a457a3e12f0e9d15b7da69b3a6a8276a4adc88f651b8059186c4b9665b
SHA512b3f1b9d300ae6661f581b183a0707992a8d08cbac693ffc206c4fe10959f246639d626704032b80b8ea479b621face2fccab0dfe723f1208bd31a9782bfa1d67
-
Filesize
5.2MB
MD5384dca96cee12a68ad614476e0b1bc4a
SHA1609633a8754e85680c01d2c2bc325a7391ce600c
SHA2566db0c48305bfe7d1528015fc4d1e202064da29462aede05c8c54f723eba90e7d
SHA512fd62f3dc02ad95a5296a2d7cc8399a5886989e978cb5922aa6cb0e9fa6ec9625fbc7c4aea086536e6e72e86064d680343f33a6cdd87fdbfa349c6f35cfbca797
-
Filesize
5.2MB
MD5b6203d0eff9fa72fa5959e4ad5c750c1
SHA18d64de3500b6d16831d46667558d2633514576c2
SHA256ade855c7e7ff834126b000137a8b34df5fb314f5348cf881a55a1745b4216360
SHA5125f35b3c2dfcc7921020a4620c62b8ef9ee9fd136e86b0a13fc18fbe14a7b6f3b8500f95f55412529b78f1723f8c0b66097aee4d421a8c09b893aa1009601d728
-
Filesize
5.2MB
MD5087ce114e374cd94ed5534dfb874320b
SHA1996d03fe16e41906f93b57f358d70cd85ac546be
SHA2560e5452df1e8f964898d155edb0d5b938a3925fae3272bb28bc687f8ac04f1bc0
SHA512e32c450440cbbcee45447e0f654fcd989cf298c34187bff8d8e845a2416ed92313cc131e6d83caba844b5b708a82d81723fb987feb02dc357bd3d3f08b238c96
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB