Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 04:01
General
-
Target
2024-09-16_c1e661dcc2b57cf15d8fadc996dd28a0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c1e661dcc2b57cf15d8fadc996dd28a0
-
SHA1
538dba122e8851fcb715b65b2a34d4aef3795d76
-
SHA256
cc93e91aecd3671bcd6b36e2c0cb7131c16c79ea86c3aee1920a0e7859e064b2
-
SHA512
608610e479d12803a32d932679e1410e2b12e2e26d8a1c4ba5af837aa6d27e69de25f8cd0298dc2c9e0bd1f6edaf0d98d3fef5760733d0e7154c9836defd4bd3
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUX:E+b56utgpPF8u/7X
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_c1e661dcc2b57cf15d8fadc996dd28a0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_c1e661dcc2b57cf15d8fadc996dd28a0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dbvuVMr.exeC:\Windows\System\dbvuVMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPCWaYH.exeC:\Windows\System\cPCWaYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YThRvZQ.exeC:\Windows\System\YThRvZQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SpHKiyW.exeC:\Windows\System\SpHKiyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gJWwzdl.exeC:\Windows\System\gJWwzdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GobDtiD.exeC:\Windows\System\GobDtiD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcojLrK.exeC:\Windows\System\AcojLrK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jIGbEnu.exeC:\Windows\System\jIGbEnu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOPazbi.exeC:\Windows\System\FOPazbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qFViKkh.exeC:\Windows\System\qFViKkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kdRyILM.exeC:\Windows\System\kdRyILM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msXiKGE.exeC:\Windows\System\msXiKGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgCAgAy.exeC:\Windows\System\cgCAgAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WOsSCgA.exeC:\Windows\System\WOsSCgA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZfbAqXK.exeC:\Windows\System\ZfbAqXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yoviZjh.exeC:\Windows\System\yoviZjh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtgFuqr.exeC:\Windows\System\gtgFuqr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KMARzLL.exeC:\Windows\System\KMARzLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ITkelyi.exeC:\Windows\System\ITkelyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zMxONQs.exeC:\Windows\System\zMxONQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCokVrw.exeC:\Windows\System\PCokVrw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD537a0b84a4f07ea5d2379bf3af41023ad
SHA143792f298cd4d1a91f50099e9efd02c3abeb169e
SHA2562152c783727d107fba0c58001fc5beb34997e37839f3bb5f2938f9038352ac5b
SHA512880144d40901f69c9ad5736b0df5200a658772cee05bb02a3948f8fef96a8e3b7d7a9d00c668903f242505246d677715dd23dd98f5fb6880b0b3ad455a4c2042
-
Filesize
5.9MB
MD5b5e62a74a222f49b4f83072c5723faed
SHA177ebbd6a04a1475c33023bddc43093a614d335af
SHA256aebb5f94b60bc2c622f4337eeffd813a063334a2a501963e4feaac8167dbaf8a
SHA512384f3a2bd9c25c751f92e0b69161c1d5e3101caae33896c7c83a0df866ec066a40e35c3da241320eefe52a5f59df824f93ad98196ad3c9186adfe82309080b80
-
Filesize
5.9MB
MD5c4e1808be5b325257757793cab9292d5
SHA1adb16189faba992635c596fbf2bf55f0a872b2de
SHA2566b4b804ecb98de391d23dc47179bd796f912f44bb7200d8ddc6e890f218058d1
SHA512b0494e9a651abe0e732ecc94ea8c5755a47080eabb38d348cd9ea03d09d3331b30ebcda8537243bbc71aa318f950991af5bebc3247dc217c0154d1f1f3d3a44c
-
Filesize
5.9MB
MD5b05eb25a97b2cf21a262cbd57ba51a8b
SHA1717264d43fbcc160bef1e8741622757b5103c115
SHA2562b6c951d83dc7b48b6e929022df4ab75505e518f4b6b78223c5a70ed730e1469
SHA512f6f66ba1f3657384431d0e81c218d9aeb3420cdd28b6eecda946a91fcef6c2cc829e0a557dad20b9342236783cee38c31b64803382c0f396323d50de7325034b
-
Filesize
5.9MB
MD5e1f6ede9aa863b9433459864aa84e794
SHA194e176797836a7bbd189c308774ce165e96103c9
SHA2566046c7e166ec067736b97a4f8893df057547a4ac8eddfbadea7d00ebc036ce94
SHA512b8345d3a96e94f5139224b342393a3cb7ad93a12f22634523ec96141efc1752900a8c522b6357ff3a82b083b106587057a612b29b98b7e412073ec4e0ade3d12
-
Filesize
5.9MB
MD5879aa4257d3a76bfafe198379f5a77f9
SHA1cbac1a4471d8c89abcda5bd50510de8137f8a53f
SHA25668f2b7ecb2d6a8b92a2b3d366dd526b946ae9f02d10a24c4c4d5382d59b47c39
SHA512c20c5a5f47aafaab162b980b0710da649ad10c5523f69fb4d44acdc27fd7dd21cf4f6b5b8a5e0203c7bcb0c7d4499c7e6be455e211f9948b1f030f3de5caca26
-
Filesize
5.9MB
MD586896f4d2d7ca6f8e707e66cf3b384eb
SHA13480017a0cd2483e2e080ca851e2d95a3efc79df
SHA256cea5f3f33af4b479ab914e9494885e927fdead1f7abaee12419c80ad1150807a
SHA5124a46dbe877548db20e0dcda277ea634b410eea5f4fa239f71a8be47b56416d69f83b4a4f5b9c0774fe6aa7d3f1822070e7da573720088a0c23a8494779e71918
-
Filesize
5.9MB
MD5ced6090f345ed26a5c065380ef09064f
SHA173076561bd286e555a35b872aa71bc1b50b7122f
SHA25604fc7deda02031ff64bdab187c08e6f41b1b5df8268c266b12413c48673f206d
SHA512a55a8621fc0473928582693c1a88983ba7ceca9dffd4b7eb627ff4e1af4724d454c4d5d3006d20b7c03fcb51a4e1346020e7ad35aaf0c9c6b70416b03f6905cc
-
Filesize
5.9MB
MD59a5a14ad4ca7827eede02da4cd3d28a1
SHA1736a7f38b610601b3dc914beb21a7c7f64600d75
SHA2566768f73cb469cd7a2bf15b7b30cad2a7a9896d7fd1a0edb7aa202cae29d33ad2
SHA51281323fa30a7a8a8b58fe55dc9c1b0cb24c83da04c8bd5894f45b4a859e073a9c7b43f5edcfe3153d3f6f25bc7eb7557c50407de58f2954fd6d99189c36285017
-
Filesize
5.9MB
MD59c8ae81e6161bef2de9513bcc1fa943b
SHA1500f3d48fa03d682856e2171d9958c74b5a5513d
SHA256dad46f8dc604b43bbc909bf21c6c76e5f8df67c3399b335eac59f6bffeb45aff
SHA512fe78780b953dbc47684b44ede934b17daf990b61aed13feb405f836af449f22cad09594f76b8762f62e5abcbf1693a60701f6298672cef1c883af62c5fdb88e9
-
Filesize
5.9MB
MD5d0fc327ce8d0d64645d947a835c0df7b
SHA1e4e1a40f4b52541434845f32293a1597254799a3
SHA256db47f713537f5832928b587723322e8f8ca1d16d0f1205aebeec24aaf2e58323
SHA51214d0cb6d7e2effe28a5dcc70551fa98ab6c1895bde30693e07809c2940d9cdc5eb79c2bb242585c4fe4bd35b40f60b9bec2fd3e61cb12720510017b97ae0a649
-
Filesize
5.9MB
MD53c6cb578027f633b682c24ff2e0940b6
SHA16f2cf54056bbacbff5a381446a50ee0b0a793580
SHA256dca821b8bba5e4e5939fe6707a681884bf0d4e3d4f965fb3749e2d41faade933
SHA512b91796999ba71f65ec62faa2c8dc430106b48f440066e1262c76ac4d6d49b21fbafbc2236ff5c844054f38fce7703d53ea99ebc8353bc49e0b1f891a7006a710
-
Filesize
5.9MB
MD5d255c3e6276387d3acf5cc620be7c94a
SHA11ada9bd7d375f5918f9c094fa744aa8224dd4eb8
SHA25655adc66492b2ac210b08395a3edad88fd7057c2db96aebb7228bb41574b2831f
SHA5128bc2e2c75196cff342125a36c24aa8614c42031d8180672a4f55396a39f4e24cde6b5a8e02e522a47f7fb545bc4aafba0aa55420578cf4fe2fb575927df81655
-
Filesize
5.9MB
MD5a9bae317a4ee912abd44186857f784fe
SHA10ad7faf6532123e879df4417ef186be8a89bd15e
SHA256eaf512a107a44d8d62e32c076243467cd8443fafd5bd63c71b1f2792bc4308c9
SHA512b01df79d66fd89ba12fa8c99bb8fb82b27534f0985be8b56c7cbf4b48d34e049874870f4d3baf3dbe3f1b55c60e8cb5514fc5e12655e703ddc613d830f8ebc2a
-
Filesize
5.9MB
MD564ce9b610b3cd6742a8179d96f0e7581
SHA1d6d6b97c513ad04065fa8152004d2c1ed4e8a13f
SHA256d0cdd34077fbe75276316ef1589d1acb2bc3b8eee051902090e967ad700c0f63
SHA5124972658aabbac273a8725e0d5f8a4e153fee6f188fc7b5dc65cea22af541209684dae2bcba27737c9a57b63a9e84b79da87516b4c387585014bc122f93faea23
-
Filesize
5.9MB
MD5729ba39a80644fe50e645927a7f10bee
SHA1df6fc3d7cfbcc7b4cb3324a42bfffef00092436e
SHA2567a19dfb39acb189371146548d993135cd925e083814a156645de6e672db534bd
SHA5128b81a7aedeb48398aefa818006828828bbc6738d032d9697125b8fe621b607cd823156c8321193416ef0ed1785444e4afe03fadc85fe5f6bfb03cbddac115fbf
-
Filesize
5.9MB
MD57939194a955431a30385ac292a312e7f
SHA1d9577f37277b937efad89b2123e9d977664ae1ab
SHA256b4def1c88f124008e51868165fc31a51ccfae20fa3f4a527aa5249c53b03351b
SHA512687c357e8ef54085eb58ba428443b616e88660f26ba431286d00f505bb1fe8f0de14784a647b75ecb11ca93b1ce8f99145caf4165827a3100e393ef2ff973ddc
-
Filesize
5.9MB
MD505f3fe16e259ca5f78c1c495289e7e47
SHA1dbd91a81984031582dc9a6248d5a798fce162ee5
SHA25684478db393cdf221ff4797ffd9f04191e4dc572511ed1ca7991367fd21405d16
SHA5127b612badb34152dd0d0ca2c8d59d91773215e93133a6754e859c7941acefca07bc30a8b52950c63795f77b8261e3c02312d6f3ef846066bd632b64b33d2d9e7a
-
Filesize
5.9MB
MD522afa46153b123f7c820b91dfff53fd6
SHA1d197755a86f765616bbcd8d2228a9e236504f510
SHA256af4bde56439c1fb3e452ced7c7c4e8003d6039694d0eed9a98519c9ac5d3f46d
SHA512ff0ac356c94899313f24c43932967bb401727c51417b3b36747e21144390a1857aa154aa1f02c263574b2394cf53f6fa9fe335a4b9e40ccf3eb69b2fe402e791
-
Filesize
5.9MB
MD5bcbe45bd4ea3c40adfebf6c48a41672e
SHA1c8374e417f75a14eb17d7c0e053c2dbe132896b2
SHA2560fbe0de1007a306ea6e725ad8e7261a8cb6808607ad29e255e68984bb39fc3ff
SHA512b0fa087bc7b176f6d84892d4313489b7ebe33ad97f41836ee0139478aad50cf6963c1c386ddeb0fdd316cca6109643bcc3580719d494781cb1ffad25e0e2ab1e
-
Filesize
5.9MB
MD50ee812d33b29ac044f7a82fc09f264c3
SHA1d35b0b35432c1f2116ba8d73b8c62375698504de
SHA2560520cddfb9455c114be10b51c0f1bf7665f6286f41b0fcb30f1bf77bff4fdd3f
SHA512c4f4c1d17026ac1762edf1161ae493bad35c6231a4bc7a704cb666c0d6500451a10df05bc94799b45fca278ab6ee31e6fa9fddb2e32d55d5e70e299b58df45a4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB