Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/09/2024, 03:48
General
-
Target
2024-09-16_190f3fd28665ab9fa976ffb3547a2d29_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
190f3fd28665ab9fa976ffb3547a2d29
-
SHA1
06e0fcaef26217fa3b680acc6f54e99c47be1e5f
-
SHA256
5702f8e307752bd9ec2ed69c6a08f9776d6d321f997aa85764ca62d390111dc9
-
SHA512
cfc9d6384f5d82f30bd9de47a14f10fafa442615fba7260a18e8fbafef73b00d8317e5200fd35a32600a47d5fbb6379e008dcee1dd4eaeee685ce07def447714
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUW:E+b56utgpPF8u/7W
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_190f3fd28665ab9fa976ffb3547a2d29_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_190f3fd28665ab9fa976ffb3547a2d29_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OoZwrwf.exeC:\Windows\System\OoZwrwf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HitLkXe.exeC:\Windows\System\HitLkXe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CWsvTqH.exeC:\Windows\System\CWsvTqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rJyQdwQ.exeC:\Windows\System\rJyQdwQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QwUkZpM.exeC:\Windows\System\QwUkZpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFjHijH.exeC:\Windows\System\KFjHijH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SxfeZdg.exeC:\Windows\System\SxfeZdg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPrRLwy.exeC:\Windows\System\JPrRLwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WjBCovm.exeC:\Windows\System\WjBCovm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhnMAmn.exeC:\Windows\System\yhnMAmn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yDkUVbX.exeC:\Windows\System\yDkUVbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZoDbHa.exeC:\Windows\System\IZoDbHa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmrWnkk.exeC:\Windows\System\mmrWnkk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlsbrPC.exeC:\Windows\System\ZlsbrPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYKejJr.exeC:\Windows\System\LYKejJr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHauUQQ.exeC:\Windows\System\LHauUQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eSunnTG.exeC:\Windows\System\eSunnTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EDaoiWW.exeC:\Windows\System\EDaoiWW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrUeDmz.exeC:\Windows\System\FrUeDmz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfkGMkM.exeC:\Windows\System\qfkGMkM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mdxDlaQ.exeC:\Windows\System\mdxDlaQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b2455a489cd54bbb56dd3fb051d8cf45
SHA1a63412ecc9d9d7cdac0c19ad3b54d95559d4a53f
SHA256ae72ce16c8253508a8ba52cf0b6d6eb54d1d2b28603b77f246325e640a064f0e
SHA512392b17ff487ae6f4749fb1b9ac8bd47955adbc30afccb2cbf91f8e086be6738a31373f93e87b3fd4033c84511dd1c4ed7c88d3b82b1aaadbbafa25058d416d04
-
Filesize
5.9MB
MD5dceafa8fb357363717b5293400f5cd63
SHA1caba371d38bfd93fc1989e932c158937c03854f3
SHA256d3913205a23fbad301e4d8968c1c61286400a7ae0ecc2ab326b4cca66be72d58
SHA5125a03fd180f05e592b8af6915ffae753b226b374e374bba1a2fcfd2bf9f3a3ac21980adc479c8e2b2358edccf29fc4d27ea3d6b2a3dce28dc5a0625985e14e772
-
Filesize
5.9MB
MD56ef30c9eea93e62fae12dd194398d3c9
SHA1e84cf82b645858bba3ac9fdf39dc6f8cfe888bb6
SHA25603b86559fdb10662b4ada9b6d792018aee26d25c0ed8e2de5ffe28fd7cff9d5c
SHA51274f0c8571b87d978116971edafaf5465e0b7768578716bf5ad7b372d9a4979b4f67cbff8aeac1b8864aa3f51f8500d7332b927a24b107ca2c0c1825cea1ab52a
-
Filesize
5.9MB
MD5afcbd177d2b4949a1663d2a0d0e04b2d
SHA1f214d09585e85c581962404f0dd43290e5638476
SHA2566901fcfc44e3509ef9b272bc4e6fc51cf526b3b10a110f94c7b120752d437436
SHA5125be92d7904aec888d72da92cf54d362a6c8553d47ebedd303b63fec878b3c81cc39374f75e1f98375cfe3c768161981be4fade14d6c52a559a184e74bff78ecc
-
Filesize
5.9MB
MD58f6f0ecd199ecde078361376ae38db5c
SHA106998c0a656afed733f284df352df3e4f98d1def
SHA25675dd76299062dffb09c9bf535e4d1a71e911270224ff4ada1b0b65533c33f52b
SHA512fdd8198a27f013490032e37592e209ba2d41a1148401ba05ec7e05e9f4534173559273f665c85381170c7a42fabe6ecd4c506e68a5c00f6820eb00fae3d5b50b
-
Filesize
5.9MB
MD58108dda6e19908bbe0f8745b5837246f
SHA1c9403b9854e8573a636d7e500d5e4d95298ad1ed
SHA25698d08769734aad62531469371d629c8650b5a6c9a79bf0ccc66d1bbc683719ae
SHA51219916f2bd481662d02002d9e018ab9c31bd724817cbc777e2c9b1b96edf7a3e732fd5551a1a162e272842aea2149d0ec072f33505fd79b451f51904a5b936122
-
Filesize
5.9MB
MD591ad25d2b233a16fc1ecb2a9b952d53b
SHA1f064b0dd0af96d174415d09623067880c18cad74
SHA2568ff2f781caa5eb23afcd2c189e1b5f92c6621f1fd8582e7b1d3bb046eb2646ab
SHA512355660a29fa018bffd90b5fca90ccb30b4f002162c54ab95dba46eefb68a03be02a71d590a6434eda7c82ac3a8f7f7f88977fec41d5c9f737a4cd8ca41d506cd
-
Filesize
5.9MB
MD57f5ad211a4eb3073bdb8025e6f763af1
SHA1137735187aca93633b51246105252a207f3bebb5
SHA2569d9c3f00eff3988817372cfad42d4e00a5614ec84961ee3b1f569adfc4438c76
SHA512680d538cc8221a0b56f81f4c9b1af25de7316ac7249e2aa96b6eb859207e07e4f81b95f4d7acbd485330bfa4d1585d80b1ba934f0a66a4cf9b5580465a9af448
-
Filesize
5.9MB
MD5f1b4560272fa22b475ab32ef4f21b98b
SHA1f9328cb5ede0857091a60f69c2e1abd009252e05
SHA256983a2d9c494529b8cc549eca91577e397eebbb1270be22adbe85184a5d7ec901
SHA512bce9a3dad4fa7f08aa671d0f399e58dfeb829e3cdebf50d88a2d670301477647b9ad5db892e5d3c9fade51ca0b2e570360fc2a7dac6e153826e101e317c994b0
-
Filesize
5.9MB
MD56c28ac32beeecc4241876880fb5a58b8
SHA1e9a6450025a3476baadf7dd36f1f51a70107c09c
SHA2560505b0abf6e92154456d9892057853440539e51821394078a4e6d754aa5e8982
SHA512bcd7c47ebbeff53fa2aa5d4e4628229140612254bdc8a45bab01027af55290c2991f887a67fe1c2f31c44d2eecc951317fc669731b7f63c579ed8a098bf471b7
-
Filesize
5.9MB
MD511b042463de9feff9b95556fd6a65913
SHA1942ce2286e6357f55b0d9e6ec9bd4da24ad686d3
SHA25647b2c5e129847882a02ed19c2e8dda8bc3c48c189cf42781df15a9fdb6f1074b
SHA5121b391af693d7bb219fce951426a457e44714e09e2f7219f8e8c2436e788e7b480a24abf312cb501d1d2c66915e8d9df995394ecb1f23352082fcde9a339bdd31
-
Filesize
5.9MB
MD5b2961913c3e0c0adcf79d03bd0581777
SHA1e1e5dfb716c92d0cd81086a81e5c781ae1807caa
SHA25614d9769b722b0aa3146594f1546e5fd777d2e6ebea7b409da20e02f42739a8a5
SHA512d3da6b059f235a26b5f55fdd420dfb7a1be6f82f5f49438794a09bfe268da1a44a5ce506c3362b162ef68759b3deef52a203780bab3f474b444301a5977c39d0
-
Filesize
5.9MB
MD5b8b60627c27e2c1c69bec62073dfa9d6
SHA1c2a6954d5f2c80a478a6291ab0eb2aaf57e8172f
SHA256778a809e39b46f8cdb0439f2e6c899de8913baabb771cb2c822093556a0fc75b
SHA512b9966206b8e7b0c01f16e42a0ec366e789ac4c655b409242ccbf427002c8f4545ff83f62a3795da6552bdb5e99281f38d96348e40486956e60a2151f66974ac5
-
Filesize
5.9MB
MD56f95bd0b96c9d87124f97166c784d5cf
SHA14695d41fca2a2d50d5621593602a8d919228f7b6
SHA25607d41cb7f316a0f8b535287b2b0dd01168129c17ee676f507fc37438f683a39a
SHA512767da9b3b90c0937602b448e342a31b79297981b53e8e020fe0a65dc4e169d08e882556d5e1778b104f662ba8f0d146616985ad71961d38877d0d23ec3b533b0
-
Filesize
5.9MB
MD538a9e55d1fcebec95db4136664d76625
SHA11cb2d90aacec9f32a53213bc186730e109036926
SHA2565bba294e2c70f7668939b5090b40c52cfdbcb760ca285d6f5c371b49ea09c606
SHA5125419a836715c63d97d2dac705939f1b0a495aeb4585f775223d2fe9be628158f0cc7cb0df57f53991a89fc61d8593397c8087f56c9ff42f5ef7bf65c6a98842a
-
Filesize
5.9MB
MD5f052ccfb6e2fa4d48061b2eba51db9b3
SHA190926bd59c625e04f3b40e1e2b2d4c0ab1ea598e
SHA256edbeab2e6997dfc3fab740eb0a71d3c0f76ab4e074e73944c855206c40e5f296
SHA512137ee69427edd46ad242db83c0242dee05c2bda867fd3d41ed85e774a011f5cb7687918905aca226683d526680925730edadb4c5071451e436b36b6a74e8345a
-
Filesize
5.9MB
MD51d56a6a1fc215eb26430401fd3a34e66
SHA1ceaee025d28e249fba8ae958ddc2dc83328c4e52
SHA25696de3ce1e0aa254aae92c67ffbcb96d624edb26e49279de9012aa7ccea8fab56
SHA5124a68edea57d07db0af565c4bb7df5566d0d6935fe5f24e16adc40422456cc229360e6d1f3fe7a6b87404fbd0a6359cb1ff5b268a0603ad76ea15c01de2799d88
-
Filesize
5.9MB
MD5b53fe264a2fe2339731b9e5f80813bb0
SHA12abe726f47f6e291e530bc447216af234c7f0d39
SHA2565511ecc642132115b3ac427a92684b3060eb10717dda3e7c57c62ae8243039a3
SHA51231a13aa9e8add246e92711e22d946328d8feced5ef999fb9fda816648a418f8f45dde78d3221ab6e1d24fe6b3f2e9960f3339e63f24c2ab110309701577d17f7
-
Filesize
5.9MB
MD5a3f720bd370d33222c6fc72689512d49
SHA1b96696213b3ef0d01bb5fe0df54037d7507f48b8
SHA256fe2c1c81f6cbd4c0256321d51b41f21ae3ead33332d348015d1a49cc1fbf87b5
SHA512cd6b7e1c57f25c2c773c6e49c1affde4f128e375c56cf33716e66d1239d7d1d0cfcd96f92b3d15775def99a714a9e1ac35e9d8d3e0bbbe87259b1e4a7ac04f41
-
Filesize
5.9MB
MD5585ae61e2a77e5eea81f9412f3b00b86
SHA16f150683154a21e381f9e6e83bd5f8c2ca9bdaca
SHA2568d6fbb51cede4b2554d3263b3c20462427b514351a6a93c0775578dd6306b3c3
SHA51254adc35bcb3f29004b1e2845db92a50c6f2c4b9cb9166bb8555647cf7a2b90b7caa92b42f61b35bbb4a255baa78fc8e3d4f3727360aa8b6c31fa4003d72f935d
-
Filesize
5.9MB
MD5883fc7d2930cdd4de12f013095ec15ba
SHA11cbae5c14b4e95bb1c1428126c16c401505e9cc7
SHA2568614850d14b042ea8566e78464013af4149ae7d378c534c4d3c22e931014ebf7
SHA512db3ac011319c61dff8f6c5fa4e7a8499d9de58e91ee1b47e4c5c7742d8abbd557f675276e689470e71ff29183dab6a7c42fe07e2121c86df08eb8f8735bdb351
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB