Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 13:13
General
-
Target
2024-09-14_de87c129bde72332806586e49e91da9a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
de87c129bde72332806586e49e91da9a
-
SHA1
03a05da84fcd2487a83fdc95a7405c8de874bdcb
-
SHA256
2d03b85553c8b762ebf19e4d27a4e7b47b8d4d6f9b31ae9fa09410088b8c2112
-
SHA512
88599bf40bfb3fdef7f052f04c95e9c650e9f3e2c201058e2a6f4997b541c8c6fc7f6060224024df1c0067d514194cbb26d03e377835a1b0247b3f73967c2a42
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:T+856utgpPF8u/73
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_de87c129bde72332806586e49e91da9a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_de87c129bde72332806586e49e91da9a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\muZdVuy.exeC:\Windows\System\muZdVuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYBoBwe.exeC:\Windows\System\AYBoBwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WSkbTeG.exeC:\Windows\System\WSkbTeG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aODISzw.exeC:\Windows\System\aODISzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YOtCjnH.exeC:\Windows\System\YOtCjnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrSNlcl.exeC:\Windows\System\IrSNlcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MMLYGpb.exeC:\Windows\System\MMLYGpb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hgRxFJG.exeC:\Windows\System\hgRxFJG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lZnpMOG.exeC:\Windows\System\lZnpMOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvCgWeH.exeC:\Windows\System\MvCgWeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqBwIFj.exeC:\Windows\System\cqBwIFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXZwGpv.exeC:\Windows\System\YXZwGpv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MeUQMBX.exeC:\Windows\System\MeUQMBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cbnVMne.exeC:\Windows\System\cbnVMne.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpAJkpj.exeC:\Windows\System\LpAJkpj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShnKDmt.exeC:\Windows\System\ShnKDmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBpZqGg.exeC:\Windows\System\EBpZqGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VByvGvS.exeC:\Windows\System\VByvGvS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oeLMvBc.exeC:\Windows\System\oeLMvBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJhHkUG.exeC:\Windows\System\PJhHkUG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XkRllBv.exeC:\Windows\System\XkRllBv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5a000b18fbc2551741ac2ca0080f39e9b
SHA1012b2f7249e9380743f9936c2bec7c1bdd5e4a0f
SHA256ff6feeac36304a872182c0bada3571805f29ad847c088d89075c1476cb74f6bb
SHA5127d143f161f434ead1b2ea52edee0dd2b3a9ce04dc02a0d7bcff92e71df42309a92fe95446b4d355f9f1ab8f3229899c7115d2bfb9e67ac0a7f74bf1990a618cc
-
Filesize
5.9MB
MD53a76171564a0aa35cd07a59e5fae03d3
SHA1ab23c3c2f1f3a6ead1688ab05c60df5bba033dfb
SHA2564238e27a9577f6c71beb834670ec22e05d4405503c4fe394e3bf54ee629d435f
SHA512d802e7cbca6b3c1b06f3f215b4ed262a8ca9cdc6dd038c65c490be4b100a6cab7b8d1eccf0923896a0eaf4290eb056cc346a4c21ffaeb25a8f76ec38f04dc14e
-
Filesize
5.9MB
MD521fb025679659fc700204273ef16156e
SHA13e1dd417aee5c948a7096cde144069793f3ed0d8
SHA25682e7067026f51fb6dc34caf16fef05bd108311b11d007d5a9d0988991836d1c5
SHA512964f50304e990f5e9d270838c6b10c7ee809fe20354171462552061fb4f5c046e37ea87f10bdecd03878d384e703790fc27b915caba1293062b15beb0d7c154f
-
Filesize
5.9MB
MD5bc72e9407205eb8baa5550d7dbf8187b
SHA10d43c9d668c767ead0e158ed4098a478dec8003f
SHA2564264a847ab64f10bbb4126e9e2d463ea0d26d7d08a2bc28f5b847b4963546ca2
SHA512405608faebda216d69da858d12a1df842666f4e35af90da3e189c451fd3eb83a1d18e549d373e2538e2673a26867f9adac3a335bf1a26f68b25f0dc9b1c2ba7d
-
Filesize
5.9MB
MD5ccf1b8a191938192fb6b9162cad0754b
SHA10f1763b6d21e07571f6ff79b5f6f388fb45c7cf1
SHA2566a1cfa7d7bb8c4d30022206e26d1c6a291ad64dc0327cd7817c552faaff0c53e
SHA512d917b9fae36887255c3698583274ed1f9195fa7990bc32bc829451f23f02c4c53955ee6fd091741ce6654a4e9f3b29549c4a0edb8dca5fd865cd50e8139dde1f
-
Filesize
5.9MB
MD52ad8681cf903110e354d88de9c7160a4
SHA1bd2706a5146e576e0aa801f4039c1a32b3a26da6
SHA256a019b5d94a68a120a4a5509823c9153614681da584b4772adea925c4c3a5ae59
SHA5120c31204110bfebb95cd82f43a26bb1f6ef3715ba4de2dda11598f2aaacaf513b74e3d2af238c93da40adfd8de9350f16ed3ab580690d1146bed302c2be4a3031
-
Filesize
5.9MB
MD570d3fe45dce3a1d0e1b202d04d8ccc19
SHA11e0d958b461735ecbfa380d982b2169c46259086
SHA256d2acd5bda65b89e1b4c31f1725f3da5089015526f4541c4c5da3623eb1cc11c6
SHA512fdbd394424f8a22bea0aa7258d1d20a5d77490603dd0bf34302d161ecf1fcf06242219523377b1663afa4393dad17a6f27a5eb15ef69bc6e643dc11be87deec6
-
Filesize
5.9MB
MD5be437e87c937b3d2cbe3b9098bf07886
SHA135660750a45ac0cd71dd99f5f14f9344bb1c2306
SHA256af686cbbf13c76c6ec0fa605d08391f2c97f337e44850a107fad8dc978b0e466
SHA512e5d959aed008418905a4cd83d9e16cb9d4b29dfaa6670fe5d5ce8b339719dac4626384a1a077bcbd78e99af3d146d27f4f41a57f3457d00f6b9952b077f145ec
-
Filesize
5.9MB
MD58f89bd54bfd743820bb89380d6796cf7
SHA190521b32910d83f3aecd6b814ee7fe28591dcd9f
SHA25680d67e3aaec92ae003e2ffce816fcea056a8496aecc74c9721fe6372cf6d5522
SHA512d98bd5122ebf72451b38698aadb094b1b1e5fd8c8e2b3a5127ad6b95280a89857ab25974bd514fd244561dd2a2c0a3407d477776eb6c265b5ab758e31fdaf975
-
Filesize
5.9MB
MD5fecf8d8009405b5b5f8f2ec8a9094539
SHA153be9dbb43c3cb9b845811ffc82d068d3b06c831
SHA256a36600da1e7fae7e84f3b112b2db030502b478b5f0500d902eaaad42bae43299
SHA512154f10bc33d7026c86f91a480d6dc8ed9e50ffa7973fa46b51967b58b66376c30dd8c0dc29383b33bb5846151f4814872e465862394a3013a103fe52e9843ea8
-
Filesize
5.9MB
MD51918fb898b6eef6b9a9682e96e9100a3
SHA1ccf7ea4f042f22874a93f9c7a5a709a9ba0122a4
SHA256af58d990d968af3c78c773b3884c0e16b992aef071224ec8e2c90f990f8cb600
SHA5124a4b115eb96b438d78f16c9b979ca1dada474d9d09e4f4ac36ceb151a872cd31895a8733a3d9062b2fce78f57e0556b58df81007b668cb3d3391bea23faef282
-
Filesize
5.9MB
MD52f2b514b941747b090e81861cc65be3d
SHA172ae5954a10119598c527f2926b4cc90da74fb1b
SHA256ac65c63e149c1340a7f6e12f87f22675338e61c36924b78d624adb524f8b35eb
SHA5128d6e11f530cfabcbdd801f9398be2a4d121e3fbd9f7936e0fc728378ccafc1806dc197aec575d986377e864e6eaadf9fac6546e5cf4dd166df9a321e00898b5e
-
Filesize
5.9MB
MD59e924e707e64601444cc28f7fa3d2bb1
SHA1b030e2a466e910913fd96a4ea85dafed95fbdd9d
SHA2565279d5107ed8c79d172605e1a13bf25209098aa92dccd232e838953faa591448
SHA5121ac2406b334a1d54ddce0cd5048d41dff5a771d34a30a39a70d6ba7cfeef613cbd0060af8d713834afba99763ca6e00f598a6d3ee30b3ce28da2b1fe47b536c7
-
Filesize
5.9MB
MD5e6b95caf742198abf17115e541a3dfb6
SHA16216d4266b1d8e9ca9838710a878a09d8254f3c2
SHA2560cb55d5465372c1c78594335317927f5b1956857fb64fa5c82bd34b6153f9fa4
SHA51276f4d2d79f6b8601ef4318969d366fefd32a041c508d5ef3de7522f4d6f5463e2afa2f0a028a6f074fbbd367f2bddb1f73908a6864621d4e8434701f653d7647
-
Filesize
5.9MB
MD5f11ae19ee4582489abb6b9be7443e678
SHA19978e1055058706680a799ed7da99c1269fc8d51
SHA256bda11af6b61aceb21824c508f8025c590deeaaef6316d849e663a22d535db5d5
SHA512706dfe38612cafa3726be505dd67c5315bdda30f62d13b6f41e937a305a452731596bc7956b141c7669a73392446693e470e88536b70e2d9848e58c8f2c8d662
-
Filesize
5.9MB
MD57f65579eca9da4ffd8f2905b2852f28f
SHA134d940d40ee353781b964065d4b022dde819cfc8
SHA2565455b725ab35e61c7adc5ce9c43bb6f508a769cc9d9ac62bab5f5c70cb9a0ef0
SHA5123cf525235e7afedfa307ecf679ffe439e7bf948116f41cb6d8ed7d023742ebcafa99e363c0116f22e12a161dd15d6fa81cdfdd15811a9dc03b7f9f3bc1056cfa
-
Filesize
5.9MB
MD5f77a0aa8006719d5c7771c89b5eb29c4
SHA17b695fb039f291b1d3bab45e71081168073d56df
SHA256429ab2ac6b96fd9fbf136eb90ff782eedcdb2ccab64d98c0d66c1389513cb6ae
SHA51267383b3df31b323b62f0928ba4df1e1f0c437ee8b7c46cf159c7b5dd229530ab642d42571cf35c7dde3329363caeb5d6d70cef04d5474d2e1562a78c07ad95c0
-
Filesize
5.9MB
MD5bc34769bda5490dfae51eea4cf00ed15
SHA18cf74366b8d2d497a4d5342fc0aa3da5514acf89
SHA25697decb1a3c9d8a624a22b0bf003a82c5234e57d6b32db7d825a9bbd600efe806
SHA5123f996f328d1f53fd5ec7ddd4dc37eedef03248937ac20e6d5a2952b30c6c4d6d254776c0e9d36cade8229f661386d5fdf25e5763b3617524d5c03592c78c4ba7
-
Filesize
5.9MB
MD5900704957dbcc97ccbb2f6961ab44bc4
SHA13cdaa10c725352da2deefe29cfb89d1cf22c3631
SHA25686d5847dc8411030ff53a6249ad6d13c25b8a1332757087db37b5da72393995c
SHA5120ee527973d7a5af752757d93ad5b8213c19085669f61d6d128e6f8ae646ad53299b42f4392ac5b48e209473cc0a6d3ca9e69fd1130ecfd0507dccc70917b87ad
-
Filesize
5.9MB
MD5205adefd00209ab55c5f813da0959d8b
SHA10ec9ddef173a34469b06e234dbbe9c5bf0b36f10
SHA256e4bea597169329aac8ac070b07629a4ab6a92cbd2bf01dfc567ce6236523f8ff
SHA512c37e58cba36725d35969b46f47e5a10bb8e32e47c6c71938444095d84fac3a9444199be496a0249fb6305ac640fff58f94f6c5eaafa4cb08ed473bfffc948972
-
Filesize
5.9MB
MD5513a06bd0d4074465bba41a5a899ac6b
SHA10252fbaa2a3ba10225eadb070e8eff80fca5e15b
SHA25683b73aa73ee79aa82a9eff8d442af8dd87b745d39cdf7b087ac14611548c786a
SHA512da1095ca23a2c776e51e98be1053d9c46340bf503f08e1f438a9d5d52e7b5fda09db72a75b98ea458d90c1034dfb1331e74f265bf8f91f9fbb29dbef5edd3060
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB