Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 12:22
General
-
Target
2024-09-14_a5b425a39ea488dc9fe42294d8f516bd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
a5b425a39ea488dc9fe42294d8f516bd
-
SHA1
6ce4fb090f77936ac046717bd847d798a083e1e0
-
SHA256
77c6402bd30d84f1d4a8de3365dd2dc2580e3a95fd16a2edcfcbbbb4f5ae47b7
-
SHA512
bc708220dea75df81677320d1cad77b7110774554f71dee302961b6ec21cf6b3f3d19e4f435f4c9f307353fd95b2efea3dd11a1c1c68076664f00f983751eaa4
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_a5b425a39ea488dc9fe42294d8f516bd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_a5b425a39ea488dc9fe42294d8f516bd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vQdtAda.exeC:\Windows\System\vQdtAda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icAQThL.exeC:\Windows\System\icAQThL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBLMazM.exeC:\Windows\System\BBLMazM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtXcJJn.exeC:\Windows\System\AtXcJJn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GZwqLmQ.exeC:\Windows\System\GZwqLmQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIQTszS.exeC:\Windows\System\NIQTszS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HLyXwxx.exeC:\Windows\System\HLyXwxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwyXaRO.exeC:\Windows\System\AwyXaRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxSwyuh.exeC:\Windows\System\dxSwyuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zirmddG.exeC:\Windows\System\zirmddG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieNXJbF.exeC:\Windows\System\ieNXJbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUGiNsn.exeC:\Windows\System\FUGiNsn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlTuiWN.exeC:\Windows\System\GlTuiWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrVNXRq.exeC:\Windows\System\KrVNXRq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRjLyaQ.exeC:\Windows\System\NRjLyaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SoasYzJ.exeC:\Windows\System\SoasYzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izfYKYy.exeC:\Windows\System\izfYKYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\phKFlsx.exeC:\Windows\System\phKFlsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmSnibF.exeC:\Windows\System\pmSnibF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvDymRT.exeC:\Windows\System\HvDymRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKdkgHI.exeC:\Windows\System\yKdkgHI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5505e21fad6739120e8bc86592d458d75
SHA14201880e1e6e366e7f2012074028121f21fb9b11
SHA2564785ffa89a65e6c716dcd2327ce2d9bf29f5bf7c2b02623736c00691d5e1fbc0
SHA5121ad01fb879c8c6ccfdad14b5872deead4298bac8bdb6f52ed1af978d81ed9de4b6fdc27e86e7d7807e38078eaf431dad38ed676601e7bf63c23d936eea5a8c23
-
Filesize
5.9MB
MD549a6377298cdadc74e156a3eb28412ff
SHA15ea3601fc489c28d7ad61170867e0455a50e5734
SHA2565da8d0a2edc058898e16c72ba4af940c4e4a791fe3936b43bd14b4c1c5f572b8
SHA512656e4d8982d8e4eb859f4f3d6b83b3e4444755fe3c92e468efc8b948b6c89dbc694fc3bf0c2dc956ba046848ce1d06d03f50e295d7fb32ad00a99f434bf94020
-
Filesize
5.9MB
MD5e2c9d713c0323d752415a478c422d84f
SHA18ed078f7b34b24dff12f237822b76f5b63d76e7f
SHA25627a4043f537d79edf5f93f3c2773f6edf912db2aac3e6e2b4626907784caf6c4
SHA512d4a491ee011527d9ba78e819c1384fa1469763f2bca06a9b06416adea33310780dad478e70b694b414f6cabba964e7671158acc36011d1c1d2620323d93d195d
-
Filesize
5.9MB
MD5158b1eb5b65e707237e724ce696656bd
SHA1b0b23e021ab184f777824fe9aff88662fa937ac7
SHA256f2fd0a66176a5d19e9f951c99b08942bf0d0b3240255fac20ac3930889606ac1
SHA5120dd70dea092fabd4a321f6a1168de199faaef34c0b70f275ae582b20120c5840bcae3e33f0e276ae9e0a96d73635dc680e90ced529b8dd756127d86aabb7c003
-
Filesize
5.9MB
MD50cbcbceb9eb75a53336c0f02df8b6edb
SHA19971a5ac0ed090d72fab74aa264b785e42f5c536
SHA25676e4f1913ae9cc40573de0b903bb7ea97066abbc44e4adb1a65280dded0b881a
SHA512e09bb34f77f3dfd5471527aec6aa94c234c556c0a6f37a60938fb778d5690c79803bc8d38b3d0be2d3b9123dac191e9a9038f31bc5fc1c124ef40babd478a3fe
-
Filesize
5.9MB
MD5cbe0daaeeafb189c97b0dcf304e49d4d
SHA122fd640df90594777231553bb3602ac3e3619ae5
SHA25643a7245ccc14001d6ecc5bc767f71f7cbc669b2109cc56e5c223edcc11040581
SHA512bcc09a1a580bbf2b6c9cb1c7a5058a1381c73088126076f0e10fb326e1690726e3d93a12055a3f459c5b907e6f2fd0a43a5f6e0fac1d5923c22b2108be846867
-
Filesize
5.9MB
MD5b7fd18fba289d6319b80580e1d48e8d6
SHA1ab87b1308729d0c37102dfeed2a78cd1ad9afe26
SHA256a546b71c40a4aaa1381b636fceb1d328ce7a2b6a3913293ea824776df4d75a4b
SHA512c021a9cd3007cc784ded6a6541cbaa9689aa810b547e40a1b0b8b443c767946fd8c0b6406e00830e76e29a349d67daeefc7f47db289f89f92d5c7613877b73bc
-
Filesize
5.9MB
MD53a9e2ac54cf93c5412a07e1f1e0fece1
SHA154afd227571a70984f65d7b183a3827ba0579395
SHA2565a7be1dcfc9ecb2fa329b4e6e9c867efe07e36d994d14ef60ccd7a18803aecc1
SHA5129508293f7d4277410411ab1a25c9f2e4210ab4165a353494d87d1df59efd0b91cd6c80aebb7d380254991c773ae829a9d6852d693e74592225827e51031b06c8
-
Filesize
5.9MB
MD5a809dcdd101bd7be3e905ea199e52879
SHA12db2a90e3c31862fe1a32831f30b693614139954
SHA25632da78542708ed142b7212d010a066b2d44e80843c880f172402bee3d114e158
SHA5120725e2a668e9d0efee574d410bfa8a0478a0441a4f9cd60b122e9424d37cb5a1ec35ae8e9bc60c40be8a482b8138c72d8dddfa0aac1febf4f434de9042649f3b
-
Filesize
5.9MB
MD514320564cb640b7580a9dfa2241adfd1
SHA10a032966982b03b9accbaaf29faae3c77ba37ed7
SHA256b8a21284cc1009657f4a30f2d151759dd96ecc3459cc2d9e5962d0c57851e80b
SHA5127e6f4e32bb998243c88e664ca8c8eae98eb01dad927f4b0be9f7f0f9e4a2f1884ee229f24ca6da9019a0bf187a56585783c4b216f28b64b278dd2607d0863cc9
-
Filesize
5.9MB
MD59ead1701d10b2d70cf11c51031d39d30
SHA1ea22485e61c084716ff3cf3f94c4367043f8f8ed
SHA256b3377734654e6e436cfe7c236021018ff1c71585d81f8eff11e18884992eae35
SHA512343451905f2c09c9176fdee0d3306070612128a324377bbad337e840df9468e52e30c4c686f53598982ef2d56469b7bd0476b66cebb82e3a76dd40f573217ccd
-
Filesize
5.9MB
MD59ede43b757f07689141ea71a8c660160
SHA14cd0823d4e5b6dda7aabe2c712b79869926c046a
SHA2562406bbcda9add9b8b82a2d2f3eef81294f271b349d9466376289481d10bcd034
SHA51298b0327c781d6469d24253bb95b09d676207fe1ada34af062678c58db23d83a0ce54060016f440a126586b757ea47e0fe177c04977da633c176014d9f3ac0b52
-
Filesize
5.9MB
MD5c0daa154fd9ca7bd237334e6ea20a883
SHA1d5e597d6b77a8d6900666c62ffb56523ec7b3963
SHA256e4587a0894b0192b146867de9ca0b109f763f1ca902e64535a58a6a62fbf0567
SHA51227d17ea6279eb058e3f42e255bd464820fd19aa020f54eee6d2511527e0e011d69862da2a0014cff32454e4aa256fc6fd529a1848c5d14b310f8101997585fb2
-
Filesize
5.9MB
MD50e999dd1be623d271bdaf4daeb584f28
SHA1e0d007466912e0af4cf561b208bebbfc4efd94a2
SHA25639fbc64bc003dfab09fb822177ab71d68d581a6313deab44d91d859c3c7cc5dc
SHA512bc86b2a9a4abd02ef36998a0d4c85665a76098f131a1090b23cae1811d755c3e0fc9ae6e02b3fe48bd8c19981a56fd8256465b10648e317c472f0465b9e5db52
-
Filesize
5.9MB
MD54d4c804be9bf96eb82c9fe78ea0802ea
SHA1f9fee6163945891e3950074def948dcc2774774b
SHA25699cbb4149fffeb5fd118604e3ae40d44a78e0f87a07e631dd44beea9d261baf4
SHA512fc71643a77a7d73e152c3a08597e709b23c1d7b982bc832f564ec46f75c87a7a7e6320941c5b2d902e6877f863359a98af28814c034ca11b765b68fb5ea9998f
-
Filesize
5.9MB
MD5d9e29f1d2408d5f3df5403f1722e268c
SHA19c6cd2cfe74ddb980641794b2401749ebc2488cc
SHA256c8bfdbef4c64f12d76d7f40ac72d3bf4de81be2c03628eb1d28bda5eba26d9cb
SHA512570af0090aeaf3740c8aa91ed070f95cf12c614e050992f4827f0b4e7190381effdad83c1c7a7073eece1ebb3fe8c6031f749fd3e9b9ab9780bf8035df511157
-
Filesize
5.9MB
MD5babe740d0d587f45bf12b786421fe122
SHA1af4350875fd1d47c074e60f691d22d242f964f53
SHA25659f212f819eb7e3419a8c07d4f3fbef3115f6feb155f4f892cccda4eccf090bd
SHA512af8744559551d992b55cbe1103da1c5599385207b0fa7aea24707f074f327b8e4d5a4d3e6ddafecc64d283f40f36194b537bb837cdce080a21ef28fc27551c75
-
Filesize
5.9MB
MD5b121250ab33d183e89b0762f7cabd015
SHA158b4bb9f7ea4dca22a4e9e62b096b8c6eda15d36
SHA256b3c806b3953c413ed02f653fdd7aaf4243f52cbca2d0187bf49773931aebf893
SHA51257ad483db90329c6469911b641503e0620befdb93f4f583dba0640b03836214b0ff0f79e7d7c2f3b09095b9e68477978c36c115a10a46eb2e91626b11b722017
-
Filesize
5.9MB
MD534aa6516df14cf8c25e8683ceebceb38
SHA187f803d2d035d45583fbb49adccb248157240888
SHA2564f4d8c2d8b8092da1af20522bcf8d914cfbbf31f6915b3990a847b641177413f
SHA512e97185ba155ee577dc7f7e413b8cf4c7e2c96c3a34c78cf0d49ffa36fb5146977492c343ba5e900161f5d034d82065dab225c8a1f056b85a80cce5671114eb38
-
Filesize
5.9MB
MD5d1bbfe09ef13171391acae4523b0c763
SHA1b5dbf2a130c431ed875033ca433a23fecece658d
SHA2560f45e51ff78d736ab75623fb387daf0b718dea9fb98ac9f4181be7ca330c3b21
SHA51285b28fa3aee202753a6af8cf3cdc6761295741fb87dd69bb0dc16b547f9b212e604a05c206d3b3ff718dd50cc500e49e072409483cd8322d2c57141e50fc0004
-
Filesize
5.9MB
MD564034b5a4e2e9370c1f3f5f6f4334f19
SHA1859f6290fe564072e83088089f6f7caa414b3bb8
SHA256647dafcc6760e19754c8bfb769d48248e7c9bdb44065b56be14fe30a9deeec33
SHA512ef645081f77880e54b21210f72b914947cf10aa0238d8ddba1aa2ea8458a387c53785a6aaa0c61a4e1d19e6f0d6699733a7bb0f17ed00abc017552e7c3c34158
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB