Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
14-09-2024 13:14
General
-
Target
2024-09-14_f95478a31d097bd48b9124f49a728697_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f95478a31d097bd48b9124f49a728697
-
SHA1
49d47bd330851a4c66b2d5f40eac83703cdb5650
-
SHA256
9fecec887d72cc60993e002b5e39b57a72e3de75adcdcfbb74525d732cd31742
-
SHA512
dbe883ac01240e8d1e471d437f5c17524e99002a854df305a75f4422fc2ce1d4bf338c59797371f3421be8b0a53dbd4ae200b92f470622bc9dc2848f532d3ea6
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUS
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_f95478a31d097bd48b9124f49a728697_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_f95478a31d097bd48b9124f49a728697_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eUBNJAE.exeC:\Windows\System\eUBNJAE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oYaJUhk.exeC:\Windows\System\oYaJUhk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GKrWojg.exeC:\Windows\System\GKrWojg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKnPcTA.exeC:\Windows\System\nKnPcTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etDDoNT.exeC:\Windows\System\etDDoNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnsoXjY.exeC:\Windows\System\EnsoXjY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kehUczw.exeC:\Windows\System\kehUczw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjlEapH.exeC:\Windows\System\SjlEapH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XsxQSON.exeC:\Windows\System\XsxQSON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdcZlUK.exeC:\Windows\System\MdcZlUK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHxcnkR.exeC:\Windows\System\BHxcnkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uXSKUwe.exeC:\Windows\System\uXSKUwe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBNeRnS.exeC:\Windows\System\bBNeRnS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBIIiAF.exeC:\Windows\System\EBIIiAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxfRssL.exeC:\Windows\System\lxfRssL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQgDddl.exeC:\Windows\System\LQgDddl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qzRAFiA.exeC:\Windows\System\qzRAFiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RFQdrhr.exeC:\Windows\System\RFQdrhr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebmPqXT.exeC:\Windows\System\ebmPqXT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGXBnvM.exeC:\Windows\System\JGXBnvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxpWtmZ.exeC:\Windows\System\ZxpWtmZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f6d63a211a9da4754e311c5f5dcc1c9f
SHA1eedb48464224b03854984996ea20e60fe5c95f01
SHA256c0f89c3a86b56ed59aaedc8f5134a1c1eac9b1c0032baaf11a62f273d2ca5290
SHA5127c0f9795f372eb45df5a8661f9f6c3af380ce84e30cb3788b571e9a09daabb5a15b144a8ddbdd9f5c9778acbc4e342352699c512949daf44999ed3beb8a6c56f
-
Filesize
5.2MB
MD5f493a1bec3e775883f957cf0b220db60
SHA12c455e5573fcf7eeeb7d9adb3bfecb5dc54a58a2
SHA256fb396d7acf87dd8605cab1f6f15a2047f18ecea17d2be2ef255acee6ffaa1a52
SHA5122aa0966c4872de2e75d6edb3b2a71fe4c39bebbbcbbde3d3e98c7ee7bc1d10eddf5e7d297b28acb4b4a578da9d017dc91683e301ec7d0b3881ca22fdf64bc819
-
Filesize
5.2MB
MD578ce60e9abd73ae490bf74a48f739104
SHA1f531f4067c6833c0b36088bc33d646215a5bc6bc
SHA2566080bec60d89cf1dc900a722cd5772d4e69c20b489fab9d08ea1296497762c68
SHA5129ab3cc2ae6027b4374475833eede11eac53a8d401c891ee456877ecce4bd947790bda9d32310414b880c7c2f6fe7653a3ee3213bb0910ed0ac2950af30781805
-
Filesize
5.2MB
MD5670d8e365bf6079c0ce5828e5fda52f1
SHA1f6d1a9573f22919be667b612c0e0fef3d2549eca
SHA256be0ebbeed46f3b3db75436e454d0113a8ccb4b3ef9607c2197a6613b4fd87856
SHA5121652b268c32526ba52945c6fea58b80c81c45851427baa3e258920a1dfd482bdc63b12e402c8189761e881df9696f2d0248cf186503a220d34bed3d4f8330fa3
-
Filesize
5.2MB
MD55cf0fcbbcab0cdbcf7036ec8067b3038
SHA1d85386521927f48c66dacbac07c9f8375bb5d185
SHA256d4806c4d309ee741d73695f7065e64ca730a814a77e3ace78609cf9564b187c7
SHA5128f037b4970b4c65dbdd01dc4aec498d428f4403d3985af804d4e02bab61a8ed791ddfdf0453389f4b4c8ce0693841d09687293e721c1798a4dc833d9f6edc27f
-
Filesize
5.2MB
MD5c440ebb906bb33fb13b9ce81ffd1e8de
SHA15b04b41215940e9c85168d8d58fee21b5ba73e01
SHA256eec17a538821a3cf21df7eb29c25d22309e351b6c27cf15f42d25e3749358d0a
SHA51274f6d2d3a5d0e7405d31b3573abebc20a60c1572d272ee67cd0d7118cd5b3037a83caa26580c39a30222f9758d2d88a2688f7d9a5abbbd4592afa40e37e722a7
-
Filesize
5.2MB
MD5601d0f8c6b8761b551a38d299c0a9058
SHA1b089765a41f2389678c7dfb74344cd53ce6666a1
SHA2565dbf9991944c2de4c5deb83df097a913f9b7ee7569079fe354582a5309fecf10
SHA512fde2716ceccd8be023d2fab92c27ec997ca98a48c600ac98061e7c32bf5c88457e40f6a83b2e51cc86119cf9db16e3d93f12ee6b03d6baeeed3baaa9cab14b06
-
Filesize
5.2MB
MD5efdd2f2d761fb94ba0639f4a3cf06573
SHA1a1e2aa135c8596b8a1a1233121862c7e9189cc02
SHA256a46010781f9f3818ff9a586aefd723583b0fac14f39b391437fa02cda7df3550
SHA5126a231fbf20ef9df1cb7aec799a74904ba5df9784615291818c07f484ae73b3da3de7e5a8272d3e9656e3f440f6897bb6afd10345e428d0a4d6a6f0c0ccdd8af5
-
Filesize
5.2MB
MD5d378f1abfad7f6a7565bd41f61d0a1fb
SHA1ad7463b5278bada44b486527c3cfa1cd007af6db
SHA2568a8cfaf4ac834ae1067f5d18a5741608bc8f1d28db690fceb6e9af042fd5991f
SHA512b1ae5910e1335bfd606bc8f0a407427b464955335cd2eb4350533863b60de082123bb089cac5a5822d2f5d7b1de5b63a301b6978307b9a85944c82b0394954b8
-
Filesize
5.2MB
MD5b3861201faa588d2324f8ddbfe8fde8a
SHA1a55e5c473dd8e8f6c42cd835b1d26343a435c29c
SHA2560adafcad6b72170aa0e8a53b4bc515b3441fb8717b9e887e7664f353c2f874eb
SHA5128cd239bfef0d5fe65b281e6faa60bb3ff653316afbebdd9eb434f61a0a433f95ad24c01097ea24fcf81ef2b179903ae4ad834a86bd1d8bf5c2841ca83e64cfbf
-
Filesize
5.2MB
MD54e498b5898d30234fe15d70dd828285a
SHA1cffe20eff6937c0f1c06daec44572ea86e4a1966
SHA256c4005f25fec73f6019922225e3f20a3e28e3875fbc89e2f51e01cf15cec5b5c4
SHA512b2b850af55fc2201140bf6067236ddd1da9060640cecb99cf9a0656ddccf40a2464d6ba5edf4c3dde5c16d0a0fa4b4eddbe6d78df69644ba17726d7f2d4b3c3d
-
Filesize
5.2MB
MD5f92159bed5990b4a80be73db0c66594f
SHA18be01c38f1b901c9c31c9ee7f9297112b61e2ba7
SHA256a7fcdb92b39b0024086bfeb0d203bade5303af843b6237f694333ea7b310c1c5
SHA512ff920f6f73407a9981bc899097f6a3a906d8c19b20fe5b32a48a0b9ec308eed468073127da80c9bcbd301f58824e43ff4cbea7c65e3b89f9dc0b60c84319c00e
-
Filesize
5.2MB
MD566f51945f07901ff8d9f34bdc13cfb1f
SHA1cfce1b09fc0cfc5e4baeabc79470b98c3a2d08aa
SHA256168bc7b6e7828fa3c63653b234a5c2612b5bfe16c5dcd7e75cc0457e1d2ee89e
SHA51282a2205e09af5443db371d5b46d7832dd5f132b5e987576e207c8852a2aa081f073c0a048cdb4a02f6ea64990b1331a53b0f905dc9952ab0d754fb9b3a5bd404
-
Filesize
5.2MB
MD588df153869d7a1dc06b89cd252390d40
SHA190353f5f912afdd71a32a5cfcc1cb20373b2cb1f
SHA256dbad6fa6fa00e059a43bd4a7e1b1e5b8e9a6fb7db9669133d166ffb8abf39742
SHA5120ca6238e868b1eaca44209a0366a554c606f43bbdb83c8d0c4d0826c0a8771edccda929bd1b2b80a2bef88ab01e5bf0ea74b7bb8d9846f4b3b2ab57aafd9a970
-
Filesize
5.2MB
MD5c239b2f3978c5d35f683338cb023b8c2
SHA1925424e0671a7932afbcca1cdb89bc96b8fb64c0
SHA2568161f8e5674f4e189cdfec4cbad22c6e8912767697d6e53b3f53ad012e37757b
SHA5121f461ad5bb848f8a277e2686909315ee1d4412a36bc4b5a9aff7b30b22f74e98695b6e9315f3d37bca33ec6dc9bd885e1d8db70823bfe30c840d1b5ecb9fa035
-
Filesize
5.2MB
MD549f2021f9b57ef1c64a8da7f94139423
SHA1ca41500738f725def870fc20e39681364f4df808
SHA256ac1b5c424eeedba4dc234559a029311e2fb840d351db743672388ecb2ce64de7
SHA5127ee27d3a83015ba510bd85244b5445109b1df76c35ef158d02591afe78e3f33b6b5a8fd6cc332de2bae3452e084fddd7b1a056766278e3704f708c4924797f11
-
Filesize
5.2MB
MD55df7f63da415cd3103930db9b6cc7f19
SHA1c4f0aa42c538027d324eb7c1fdd2071f80d328c9
SHA256ff1d15265b625f954965bfe4aed93b11a1bdd779f65d9419eb2676b0a87c0e33
SHA512b1dbd0690a05579936880b8a3a5d5d6f58e17b39b774d6a06ba8f0c804236534e65b013f7e5bf736a9beac5f8eeb628a86456b49d4194cdbdbb88db6d63bba21
-
Filesize
5.2MB
MD5b0e326beca941388e5e8e4e77c1b5d44
SHA13725aab3736e49ca700cdcafe3ccc32f96384af2
SHA256d7c49f6de17c7b72936b3f518d7bd4c1fa8486dc2725a9dbbf893e9673b6499a
SHA512790f4e6c56a2ccfa5678026688999a78caea14e10ed4623e349ac0e0168dab6fd47dd354415136cb89cb07d578d68cb4dca2adc0c36d8e0c59d596039530ca68
-
Filesize
5.2MB
MD52522fd14bfd84e1356611093135da2a1
SHA1087f9738814bb72c7b04c680f6c25e60420a6f5b
SHA256757da98ae0ea4e5f67e8319f5c8c9ad1937f20c6e08aa79c9c1eaa5b492eabff
SHA512744242adad6e475df3ab928f4236963eb282fe702198680f9aaea37d56aa829f78017c6e1886643070e7e06b79de41b571500247d7f14ee7e2b0c9cc8a078b22
-
Filesize
5.2MB
MD5b60a916795a84713d109c65a26bdf506
SHA1ac02aef270dab51a272700cfcd3d7fed83628ffc
SHA25695c0c842d334739d6ba3908c4af64f464e23e51f8c5905ca923f047b394eb11f
SHA5121de2a8c49bba18c216297cd8759cba2ec7382f05e460b29710eaf3733a3dabe9de4467673e53addf815137ae8bbb3f2c73db3b34a8bbbad469fc0121d993f882
-
Filesize
5.2MB
MD5cb7d6ca9836783e834070c246be8662a
SHA118e0244a74d93654e251a3e35386f5fc8253d2bc
SHA25600360bd87dbae4fd9592f00992f67d4df3b6f2444b8280aac3d81ceae8084aa4
SHA51289281d9f498cf219938568662aeb0de5dd0a889da4c90ea89ae182acefdbac74f86558173dfcf8b375aa5a8b45bca31f6d8f8aef45c1cc4b8cdfd1a518b31a43
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB