Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
15/09/2024, 09:44
General
-
Target
2024-09-15_07b9ffbff7bfc1fb191b2660c834880d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
07b9ffbff7bfc1fb191b2660c834880d
-
SHA1
54bb49281ac102eb5e2f845bc1c6c926a51cd4f4
-
SHA256
f78e6b8096a5b5d1625d94e9df78af6771f89da39888bcfb71f3ac310d4db76f
-
SHA512
1ae6aec7c6a23ddfb2840534465ff9bad5fe09d446d045375d6abec9ee2b24c398258d251e45ce25ec632b8f04d1f353032c790bee1c366cc476b24724a24e70
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUy:E+b56utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_07b9ffbff7bfc1fb191b2660c834880d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_07b9ffbff7bfc1fb191b2660c834880d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bzMdQlc.exeC:\Windows\System\bzMdQlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FyBqlbX.exeC:\Windows\System\FyBqlbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUIYBzr.exeC:\Windows\System\yUIYBzr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OifPluM.exeC:\Windows\System\OifPluM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgXcFek.exeC:\Windows\System\YgXcFek.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WIbjWaX.exeC:\Windows\System\WIbjWaX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygOuXjb.exeC:\Windows\System\ygOuXjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpDKxCt.exeC:\Windows\System\jpDKxCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgjafId.exeC:\Windows\System\mgjafId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HndFKxa.exeC:\Windows\System\HndFKxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kbSAGSM.exeC:\Windows\System\kbSAGSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMDQTXg.exeC:\Windows\System\gMDQTXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYWNjiM.exeC:\Windows\System\xYWNjiM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaIAxIO.exeC:\Windows\System\VaIAxIO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HoUAjft.exeC:\Windows\System\HoUAjft.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\meSdAch.exeC:\Windows\System\meSdAch.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\syFmJqI.exeC:\Windows\System\syFmJqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eoVCbmS.exeC:\Windows\System\eoVCbmS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RHayUSC.exeC:\Windows\System\RHayUSC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhFpDxn.exeC:\Windows\System\mhFpDxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EDhUFUi.exeC:\Windows\System\EDhUFUi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52ef17d812544ef885019ad06e02fa845
SHA1b913aa95475aebfbb5423c636ea10ece8b0a80eb
SHA256b207871fc7f2428972c31b4c11bce55711db04dd79ff0dd3ea0cc1e1a109d7ff
SHA512c0823d41b602c0f55299b5a4f13a91800edb43b6fc09e852467f0d58197f7440e5ef2aa4ffab95ecf0c66a526debe8a223b72966045a1099f837f26b6c3b5d32
-
Filesize
5.9MB
MD5740cf70e0c4554b5f030b9fcf6146980
SHA1e863221100ed252c95d1c7903fc8b54205bbba15
SHA2560d8b19f32669d1bd8fe3e8b27eee44ed87f28019d1a168cc04916f61ed31e1a4
SHA51299bf1cf5e3ccf5d6ba77eb1d1f3524836c98843ef51d893f54d4706540b2fefd251119c573298c32661ac887ad8f94f8e09d4b6d9a3c94a32fbf577956f34474
-
Filesize
5.9MB
MD5ff7609fd0008e53f844304b6f0a09617
SHA1066eb0ac37e13ee1f63d424d28f5b19b9452735d
SHA256efead17e85c61348f0ac379ed8c668a598790726071989a844e021fda7da760e
SHA5125a4d88f5bc1cbe7f7cd0619a96345062fb00f52dfbb1d60b697d8b01a3af18dd4663ee60696703e8b0c712618607036d913fb1ad0c7006ed9d6f3a24258d3c8b
-
Filesize
5.9MB
MD53c69c033769fbe0eb55e52c1a178e643
SHA10c36bf03502720981811f953228bcfd129791227
SHA256ce6b62501b1ab459ef4de3c684d710263d3b5ea7f65ba9d81bc558961e9cdb2c
SHA5120548cb5fb2671ce3b57b2c8e2977500a84ffeda784304e563ea8c57b286d4ae68f4a91653de0fb4453caf37c791d06261047d92dc9cca867af3c7ba6f152eab5
-
Filesize
5.9MB
MD57ff1ad0baf0bff814069a1562c37b846
SHA18631c81a7a0169a4c578c29d53f5fb2d959e474f
SHA256bebd09f2092b59eabd9185ebf1fa3bd9b6e3042570e5ea3a4189b11bad573eda
SHA512343655729572af586b6e4e5e04bc225f7eda86b2e570bff755c3f89a4969dbe0d982a3e24e7313ecd397d82651b1d596e38d3fea16d4e35987909c1919411fa4
-
Filesize
5.9MB
MD59368e1bf880c5f24e4ec64ce5be04a81
SHA1dbddc82dbb36bff8295f0a2a1764a363fa8861dd
SHA2568f7cb1d6fec759343ccd4745737c46a8ae869210cdf1a3f688a53511355b259d
SHA5120217f8524082bf76ed296bbf87bb1977f4187a3ce44bc21c70cc5a6cc46b3a6154b7e28d4409deb7ee1345195ac447444a6371afedee1f2e6d6d82f1e848864b
-
Filesize
5.9MB
MD508152928c256fb871805ecf5e17b9fcc
SHA119d1e47f1fb79c077508d05d99365f5673dfd8e7
SHA256d7689922dda388e2ecf884ce4a9e228dc1b4ae18912cadb01764f1823808b030
SHA512915429862d8f933fb0d2c0f67a4a726b62423763527f21cd57abb394d8d54657f30b0b88ffd949a661359404eec308748df03612a2233a2a89fe74b427bd46aa
-
Filesize
5.9MB
MD52e6b02db206eb4dd1cf0c984cfbe4afa
SHA1f9b6692947335a1320a51b28071b09a600ab77d7
SHA25602bfae37604f8e3d3e402ae9fe6a54480226273729a21784e6b70f369de62fc1
SHA512aba464da4b6908a3712e4cf3db4494abb5953e528e7502bae242bdb648352abd0123404d52e987410762cc5ee265d5651228342114c1b9fbe3ba55e1e0a69168
-
Filesize
5.9MB
MD5569ac4bbd325bfdef219e5139ad3bbfd
SHA1df23556cf9a2acfcfa37e63537e69504185c34a1
SHA256fe67b69ba977b1a817113341ddc53b04b0973aacd95f9c71873517fbc12184fc
SHA512bad2cf107ed6bb4eab8baa1e200e06a2e0751bfe73ab01e896e3787bcafb10132119e44c5915434590f78afb219c10acb71cae6ba035bdad8a1934e375d1ce8f
-
Filesize
5.9MB
MD58ef6f72f1c5636f66dc5d26c1fb3a717
SHA1ed79302e903e7defad72be5940d7e4ad5bde7e8a
SHA25607c1528e318e7fbe0f015d3321ed124fc34afb5d6e25951c7553fb25a7866710
SHA5128ebec5caed0c8c503ac91a543ace12cf8c944462b712adce9f498b143f7a45f34a6c4ef2c5a584f1a627a0ebbd8e03cedb75e58545dc324a4eb4194c94dbd690
-
Filesize
5.9MB
MD5b83f8d8685a5ca81c2f99c76baab4c04
SHA18d46c18bceb9c15e62e3887f9bbe63544074eecb
SHA25686b1a7dd05a4a918c76cd124f77c0e5a45ba00774b6708b66792e2469cc5654f
SHA51247beb02baad98021d57b1844e46fbc08cbaae0577e8a15ca050082ec481f3b90dbf3cff313e2923eaee4346671206ea5a48d3e3cdddef472715d71dde960aa64
-
Filesize
5.9MB
MD580c5db9742cd17b28cd0e2791bb7b825
SHA1f72d38abf998d5a32ebfa0574933d18ca7c60efd
SHA256313415b2b862bad73e728364dea2524deb972d9cfc88746ed1cab4b7965c19e5
SHA5124531d84df53c40b66b0a65bf9e06288aeba687a1e518d262193db3c058c56870b13122391653ebc51e653942482695a4d30c66c82e56d92a52f237f991c3c78f
-
Filesize
5.9MB
MD52dad0d918f0a759937d6bcec07077a79
SHA17a62824791d95ba18db5743e62b9f4c8fb7fd60e
SHA256d589775ad4e30372df8d56e284014b464a20626b9d841a80fcfddd7f4dd1d5b4
SHA512d452d2b44e2b5cb1fbbcd34faec58d5c1b4dc09e4c9ee972e742069e87754abd9e7c23b5720531a11709eca8b5194498a28a26bdfe1d558162ee8f39b1554044
-
Filesize
5.9MB
MD58846258251e1888aa5b4e7bb94a4a448
SHA1445f4610ff7b6c93b303817034a867371476104b
SHA25687d738405337ca9148d21e2301c3bf69c4a133a9ca51e13363fa61902639ce52
SHA512c815fa36623713eb60613e820e151f8936ed5a42a06f6ffa0b5f42172ba1fcb201ee136452495495866e8bdbfb40ef90f598ae4ff0678c05699108a9de867626
-
Filesize
5.9MB
MD5a4b9a656325acbb191576969ee6fe671
SHA19c05b50eb30a914abcedcb1875718560208fc8e8
SHA256533483e45c4a485872c8517086f4fcd3505b6dfa734dbe8a6eb09c69d13e0d1a
SHA512dbeb6b938f933e587bcde84aedc467bf84e9a0bb7fd299cae7811975eedc423a2de073b1fed64f26d89390c2cc1415e466a600741691b713b116d76a062045a1
-
Filesize
5.9MB
MD536fcb12edf08982ba9e8735a91b3c4ad
SHA10fa027dd8c8103f2eab75c01f5aa1ab00be3d252
SHA25686416418b6ceeec7a620a1489a0c798644127c2e2dfc94bedd8c6cec3a99e314
SHA51235bd9a40d2e9fc5c82d5e39d66b19c8ebaa33541365f6962a65a4d737919aff38314515a95c09b9288f8a5c4aab69c4ca82e113c9fec6414d9cd6c59a7f1b46e
-
Filesize
5.9MB
MD5b95efeb295ee6c8789556631799a7136
SHA14334cf2eb59074fe16d277fc3bcd262296e925b3
SHA2563d4c4f725792bb1d4b6a607bdf5d60220e796640fe48a3b61cdbf27a0095d705
SHA512858fb848b2f6a9bf2e87820eb3444ce5fd58446839cfc8c525fc966ed9b6ca70e1facc4a575f70ebea956c9c8de787403d4a003fc240e4fb5b114db98270cb8d
-
Filesize
5.9MB
MD5ed6ca82093a9b8446ad631e5c72f3ac9
SHA13f5bfd497c514d2b16cf898295ad1356a433446c
SHA2561df8f19b5b799ccb9e3784d42f8f2cf195d9ba26b294dcbb83f27aa6bba3827b
SHA5127768a080ca6094d68b8a5136bf1da86b5267a634d18a01b11af518e347f2edf98b1f6463e99354c6c4c7128236aff6653bade21ed18a1416406027198ea84db5
-
Filesize
5.9MB
MD5e9418ed0ecf0ff8a0a49f8702708c11c
SHA1f417fff9f2913820ebbe43db2e2fdc42f8a446ac
SHA256765f9749bfc24c13372e276eb28ec166e7aa39b2121ef9168a113c74d8073d40
SHA512f9fdd790b3935440a5cd934878c9823b7b06d0f2392b38a4a41ae922b7c802b51bfb65aad9edb72c583bf66b4998d0a126a33bd18de47ffb83bc00a3aa34a058
-
Filesize
5.9MB
MD53b7a5fcd00dbf4d7d478b5bf2a21f4d8
SHA1bce8b2b9134fa34fea82a5e490377701bf6cc54d
SHA2569b0271ae179a1e62b2084390ac135fe50f649601a554a864d47ffa89a1f2af68
SHA5129d0228dfbc139a14383f5ddd9643fcff6551a1a699e11b8bbaaabc469e6b6758bda0617ecd408ad78d891c1ccad9831b9266c7b4b236604075761d569d9e3caa
-
Filesize
5.9MB
MD565f5119a61aa22cb6d81a9aa54c33f86
SHA1bad00582f71f6e3ffc8ff83f8574ec0c6136ba1e
SHA256fc777492f4eed067a8f862f4c34d1b3fd91838c8c92f2a9a8a40957a91570f88
SHA512f569ce27cc1dc9e632f9376093765aba6ce0975635d18442498fe0c5f68682ff71c21d110afc227e436621fad95d2c161ed4b0eefc8fcf6b40685a6f28fd3955
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB