Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 09:48
General
-
Target
2024-09-15_1c47f47fb3ddff23be08b74fb9408def_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
1c47f47fb3ddff23be08b74fb9408def
-
SHA1
63f54f208e319d6cdf7b53b36ba7982ae707b08a
-
SHA256
f3aec3223850e74d8e947191d19132c64cfdf7eff83423e7f23bea4671dc3d16
-
SHA512
2c26e5d67f6458f2def8b7957a31ab7136a3f39000605ac922099c77de371ba37964e9c05837584c0df159b390a648ac03727ff65845dc9adc2d112454149ed3
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU6:E+b56utgpPF8u/76
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_1c47f47fb3ddff23be08b74fb9408def_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_1c47f47fb3ddff23be08b74fb9408def_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BQOcsQm.exeC:\Windows\System\BQOcsQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\stbLrGN.exeC:\Windows\System\stbLrGN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YuHBhzp.exeC:\Windows\System\YuHBhzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNDzHmM.exeC:\Windows\System\SNDzHmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRoHSLY.exeC:\Windows\System\uRoHSLY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RXKrBsR.exeC:\Windows\System\RXKrBsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQyQHlC.exeC:\Windows\System\KQyQHlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wYowYDB.exeC:\Windows\System\wYowYDB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MivyLNt.exeC:\Windows\System\MivyLNt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CJfnDfs.exeC:\Windows\System\CJfnDfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpabjbG.exeC:\Windows\System\cpabjbG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOujijL.exeC:\Windows\System\zOujijL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zzjuLrP.exeC:\Windows\System\zzjuLrP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgjDXOj.exeC:\Windows\System\GgjDXOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTZUuvH.exeC:\Windows\System\lTZUuvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CpmgecV.exeC:\Windows\System\CpmgecV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUMHsbD.exeC:\Windows\System\ZUMHsbD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TSKgQwS.exeC:\Windows\System\TSKgQwS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqEGmAl.exeC:\Windows\System\sqEGmAl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ybSulMv.exeC:\Windows\System\ybSulMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AyvplEZ.exeC:\Windows\System\AyvplEZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5543faa1a5c9851ba0682866b8fb6718f
SHA13cbaebb8249942f74896756ad1b79e0903d9f47a
SHA256807207478f829aec5437f089b3590c5e2963594c4a69254c384dbf576b215839
SHA5128f2e7950513642c786c903d1fe99b1591f847cff1eca36daf383f4e6823cd76be769eab57a35f4433d465fd78f456e1470e43aeccf8b5c29b60b751e96ec92b2
-
Filesize
5.9MB
MD54ceecf58d1aae41c62684d263f7cacd3
SHA1d17db8e3e2a8f1c8d388459535dfd804f656c2d9
SHA256530f03747b070c68813c22916945e72455dce2947c73801a681f97ec24cc4756
SHA512687208f8eb2056fb362597edb7c784f4c169a59ba97f6714e7544fda0a309c35933476b3225c22d2ca580691fa20ddd78ca1630388842995ab95a0ba9b2c24af
-
Filesize
5.9MB
MD5c818ad1c654d1a2c446483b2ccb560f1
SHA1cc50002f276ad6c92e06af0b533ae9a04d0dfc0d
SHA256793c66a44ad798cdabcc8df8e2783fd05d753aa4c12961e6feb0f2f924b3eaaa
SHA5121f19b5666f0bb45f30b581b2a68b2dec153f09dda2611d67dc934b4080adf5f1d1cd13e0af3c01fc818a502106dfe5c78671721fe40af79ba8cda64202b40fcd
-
Filesize
5.9MB
MD5a0563452e5e5dc245c81d2532ae84c41
SHA130be0df6206c11a454b5954faf65fd12b67beec6
SHA2568ae141ceee2225dd213b83b66f004f385cb81b5a64c75d906f460e6f4659d45c
SHA512667378e5d23725ce3ebc7a0c6cbc43f2edec519bfac3f3e3c72dca24364c4d5db0ffe27bde44d2b0903a37c9daa639070dd5e263f50b993896f402d94d31ac78
-
Filesize
5.9MB
MD581e69806200172547f2170ff007f31f5
SHA118b583893f4adce5112239d0f02e7a313c2bae18
SHA25637f1aaf89a6b06d04e67d48d043fd0e0d04315ae65c1b0a978b4617d22f47579
SHA512c161fe89fb9d208add27e94b39196eaf362a69ec323339ee892f4a1c366315913057838690142174f75c47fcef075f213a68a90c6c87f473fccaed63f3d9c641
-
Filesize
5.9MB
MD5bd0ccd08401d77c29d09f78e0fb89d79
SHA1f4d9669293bed5ed6feb726ef22730bf1c269e31
SHA2560d34a6200271fb04f8bf878eca5e2a0ee6695ca0de0ffaaf901d2fb05b4a38bb
SHA51271897391b309fb12aee54afc13f1027b37785bfa8db3714c62d45a232862b8db0c97bf55ebc70b169564fc11e6ad46b44a495e703c7bcfc5655ba047ac48ebe7
-
Filesize
5.9MB
MD5e092c6f7ef884c3d887f67ce68ccb92b
SHA19c69be01a8ccc0c811ca642537aad1101541b8be
SHA2568de54676cd731e0a6b6460ce99873da2266f79d07dbf4e8072b1c346fcea841a
SHA51289de927f1c564404fcd546c5f1c3d9435c9568742dae5392315b2b12428fcaa7c75d9ae06f3a697d55bee757043fc9f7c500be55d723cc5aad8a990db547d4a8
-
Filesize
5.9MB
MD54ebfd3a0dbb8afe3af4939dd69e7fcb2
SHA18bf1f29774dcc23a982eb17ed987bf336a91f2ec
SHA25604be5d670939accf195da6e31abaa0117d9ebb40622035a2c8a2d2c79d79980d
SHA512233a18eb25efdca6007e80182bf012a3f6aace0629eb2cbf9c955d825d95f3a571a561457e35c39550e7aa819d979d6e955dd63ff9da9e2f0a80ae20835689bd
-
Filesize
5.9MB
MD5246076378936aa8250884fa9a3f8f91d
SHA1be8a214768efa80bf258d91b054272e123805d91
SHA25654a96308cd1595cd44eb4c1d4b0378acf548f6cff56e861f8bf37d86dc3261f3
SHA512461016c495463b61eef1571d3209d0b015cddedcf2f50f91f93feab5cba7cd2fbe03c4ea58e03f64d49273854863fb15bc978226fd8faf698652c89956d67ba4
-
Filesize
5.9MB
MD5b9ed96f09c2ecfb61f58f466d227a502
SHA154dfb604b586de2acfdf7ca26e3c97d6736c752c
SHA256165ea61a794d41b61ca6905f81d5b1d0ac64aacbdd104a29f2a1159e99d6c8a6
SHA5121fd9d2df258c94c28771095526d8643af0f7a0db0674ec0d1600d5dc408e796d85727bda4a7aedc8d893db956a21b20881d2db8cba9f853a0ce843cab7a0d395
-
Filesize
5.9MB
MD54756984d6d53874e7b714441a69e8934
SHA1ec79bab4326cdefeb22cfe2ad1d64535e706a446
SHA256ec6f0984c9cd02968a0a8e7183a4fcff7442d74a97264423fdee86ac114f082c
SHA512f700bff078a599aaa9c2b93292b9026359d481e79d53a84c4ca24e2742087319a0ea7eb588229018ee4dae9482f3764a58ac3a610abc46ef0559cd81f8148bac
-
Filesize
5.9MB
MD58b3fd46096e4622278c8247f19c68fc7
SHA1c3658a265b15d61ecafb85cbb7ffb02add63b861
SHA256287a8875447cc054b9a15c2be7b740ea2043f9af81cf2cf54230cf321bce0da1
SHA5121f3a3ea7f618b3f1a094cd82c480e223efb92cbbf934cbd38224b6f77f6d1be05d206a5a7d41e40917d1f8353ee90b9605ec37021dd8dc034150d465ce8c45cf
-
Filesize
5.9MB
MD576c4e130f45f79709105351002430735
SHA1648f4874b46477ee20a7fea98f3cb80a56abb910
SHA25643546cbae3e1abb1a4000fdc080897b6b975e0d56059b8a69b9ff692c063b42e
SHA512c5a17a28154087326d6912a8e776177bd7d5cbc3609d3055bcf61cd684838fbbe60923d394c56757a0199bbb0bc700050b67d4b539df7e9a6d8cff1d7f84ceb0
-
Filesize
5.9MB
MD5fd86fc630aec836f0a62487096649e93
SHA18d9e1681c399579a0a64a78822b8653f4f72731f
SHA256d98f59b9bb3fe605833fde888a7b212d2d3396c9496f59ff179961021d6166f2
SHA51288602ffc7fe2e5f96c2ff25e76c8432b7975b17a749abf899b059faee05bd0715a5686f8e3755c5efa4087333cdbf52805bcd1763beea6d820707c21ea242c82
-
Filesize
5.9MB
MD5d3ee22119fde406e2816551c9027663d
SHA16afc00a9c67bd314ab67ceb3d60e73c4089476fe
SHA25643cdeccd204e81df0fad6ca6653daeb2f5a7f031bbac41404a7369ac74078cad
SHA512eb33e1acdba3473e53a756db39df0e90cc0fe15fa2085947c0f8dd72b51f3592abda714a10a91301555b6e81e790a830c658d6d4e080374b508007d1228be6fa
-
Filesize
5.9MB
MD5d073de6964c7c1187614bd123e0c6abc
SHA1064f2ba9f7835b5b64f95cfe642d295878e91960
SHA256f4a5f3341132329b059918c62d05b45ef7baf5e216698443ffcbe7959cebd985
SHA512e909e4debefb63b79c80fa4e8a46624c04e8c84d5f1135ed2d0229eba506e2170781d5068335f3a721fb24bb5870430265edf4b203005bee8b1e5d1196b95404
-
Filesize
5.9MB
MD524e171afe763179b5d90cae4ee01abf6
SHA168e03956673352fe1ddf3f76a523142ea6152fa3
SHA256c54e56d0631a5c2ead9cfaafc3b25d25d0ab9fa00f00de576e62509d8c58e92e
SHA5124fb52ce13fb8536c9f2b92118cda3b8e2413d1fc43e86f706b11a012bd9f7f5af7abf598f1fae510d1ea69ebb93bda5670f5837cce22d6f57cd9cc497ffdb616
-
Filesize
5.9MB
MD5f75a03558eb8f65039108ecb326c6b42
SHA1b49b6e46f9bc2852e5b7e428b047ec4f6d756f66
SHA2566223ed3fd2bd54de5bdfae0914ee8afac613cc26479dd4ed2a7c31f8e2602720
SHA512ceecbd3da10153099929f574e31dd23ea7d11865208941e699ebfa434c308e0b417553096bb72eee9b06b5cf8f72304ec21d5683612ddffae7dc4d6f0cec78c1
-
Filesize
5.9MB
MD535a234c31d3cd2bf4f28825faf863e52
SHA119dabd3d794479a4c13bbb6d5899c2f9318a573f
SHA25674bc0cf77b73d4b2ec4b6a9eb097f9a1dc5d299f6ac0a1528473097be2f45158
SHA512617939853003becdb64bc7ce54edf4017851b66bd130ce670d0550a7a012863c5426b8bc023c54dece9dc34c04fb4206a93be0fd56ce1e22a36767797ea6a12a
-
Filesize
5.9MB
MD54fe8a0546e3c902fba435a02615be244
SHA14d30c39d5e9afb22b293162a103e242c9df8d4f8
SHA256a515e5f1f4280d20e93871052326d9fa1468b340bf6a6728dd363263d4c7db70
SHA512ae66052bf75ab6c9a65bc26125b2164b4650acce79f303bc8c7749366bd9cf9a748f5c3525df1907b49d50dba1d09ac7e45e74c5c33057923dbbc35c715739d9
-
Filesize
5.9MB
MD5ee2824ae07d7c31ee32ea10c9a8a5fde
SHA1615a8eb809a18e57ad8f874760820821e1d34d65
SHA256c86ffa5ac9c2e560b0c4120f8b0a881b25c03395bccc26ee41ffbd8323b4571c
SHA51216b700f1179e5ce7609a1c7330b73858a9668542355ac2c689e5dcfd9cd7bd113724e192911e6d7db00cdfe81e7b2a532281ccfcf444f97bceb21b33201910a5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB