Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 04:05
General
-
Target
2024-09-16_bc483a7cfe4062430c7910439e9dc785_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
bc483a7cfe4062430c7910439e9dc785
-
SHA1
bf8621cdc1fdb7d189aeb0b7e2dc89a76b84b0c3
-
SHA256
3fe5fc94224825e42974cc0662def15428af8584b72356e7c453f41afe5184d0
-
SHA512
bb7a845b582a14b113a2fe72f38e0ec41dcf555bfabff5aed7f715126ef47a5fed93462c3e2649a870ac3c7d1743c2410bf9d5524015562eea1af5e859786d7a
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUk:E+b56utgpPF8u/7k
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_bc483a7cfe4062430c7910439e9dc785_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_bc483a7cfe4062430c7910439e9dc785_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hOaoZHS.exeC:\Windows\System\hOaoZHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNZRyzy.exeC:\Windows\System\NNZRyzy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCvkOxO.exeC:\Windows\System\PCvkOxO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UfTDbEq.exeC:\Windows\System\UfTDbEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmcpOSs.exeC:\Windows\System\hmcpOSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqxNCst.exeC:\Windows\System\OqxNCst.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvOtkFj.exeC:\Windows\System\LvOtkFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnOJMAn.exeC:\Windows\System\QnOJMAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IiAtlQw.exeC:\Windows\System\IiAtlQw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIDGQbE.exeC:\Windows\System\nIDGQbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zaDplXu.exeC:\Windows\System\zaDplXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWFCTNP.exeC:\Windows\System\IWFCTNP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\liKMXRO.exeC:\Windows\System\liKMXRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCZaQgz.exeC:\Windows\System\GCZaQgz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nbjUqGf.exeC:\Windows\System\nbjUqGf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KIaScrW.exeC:\Windows\System\KIaScrW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sCzRcWg.exeC:\Windows\System\sCzRcWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SrDuuTf.exeC:\Windows\System\SrDuuTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\meaEUVh.exeC:\Windows\System\meaEUVh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAzxESs.exeC:\Windows\System\nAzxESs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KbouHgw.exeC:\Windows\System\KbouHgw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56929baaf0c72fc4bbf2cd98de586e727
SHA1ae79c28f90caa11bd6c48902e197a33e9cab6139
SHA2561ba5412361aae018db86e8c93ac091c81e776f0c1ddb711e655b2b8d3992d6f9
SHA512766c60d12cf3c31257e7c4ce8966189d38b6661543ecd610c76ecb9fe951c58de77fcd9dee0455493cc17627fef48844fc6ac97e4e472160d19b91b67e347e33
-
Filesize
5.9MB
MD52cb5e18616ed8a3caafa5e2d2a17cd03
SHA146d6f1ea667ad50129a2ecbeeea4717b5d37fcf6
SHA2566d0d8fd4e21617943fd88d158d7d8a128634514e2d73d078a9af90261f39f587
SHA512d5f33f3d7ecd0b2101a944cd1b1b3df4a685d01b28bf1106e6427e32ee4a60b6057e35ab1f3cb9e46e62d3e1b331ff4d90a8055c371f5ba4ea15813edb31fe2f
-
Filesize
5.9MB
MD59832e34aebbea6ba997e33600a33eea6
SHA18c3d6f78aca3d4291e2be1b475a4f223c19bdc7f
SHA256ca2659c2d18a000b4a44112b0ba0348741ddb0bc3e1e5b434ce6dd1b2ce8b37d
SHA512b3a818e58e39286e0d105aa5d83dfd0adbb0060093b6ade525c5969ebe789377a530b03ce31dd7d8f52e46c23c8e75bc78932c0797c43bb39eb741964c93f2fe
-
Filesize
5.9MB
MD5c707d70c25057405c53637b22094da8f
SHA10e7f6233793ce0c05f250a9c3df3c29253a1ff15
SHA2563a3cfa7d1d8745a1f78ffb4325d7d488bbe3de1b8a3f11ba49593644e6aa9aa7
SHA512109887b602704a2bb12da07842ec3f8c1a792ea8c32d5157ee6c1b085bd557fda9575a08ad963370a6f1ee3fef143cb6d11ff9fc2acf30026f8c53e25cfc9cb9
-
Filesize
5.9MB
MD5ac0d0f682181072b89d356f7a3dc52ad
SHA142025c26bde4c96783f17bb3524157c23ff4f9b4
SHA256935b960eab0279b489dadad0602519933838b506914c277a0533fee44dc668f1
SHA51267b1e85bd624f0995027b3841b30a8026ea8697e23bc8559a018f5de255df0d3628fa3847900d1016467ed53c169595117335a5a310d997d857d3003cb2ca90f
-
Filesize
5.9MB
MD5e57010de25d4eb478bedc8493a39d678
SHA1a583529bb993bc24ab918cfa48be0b9776c0a58c
SHA256cdb3bcfb6592cb9ba0920b3f653875581e13fa3dc4dba0e3c53142eef0a61f9c
SHA512adc841e427fbcdd064ecfb77fc667f98ec5b05b21ab8ca6278984f881dd0f7fa4b74ced3f3cc63674bafd17c5efe11eb72fc8672e20bed040b88b0f2176c87da
-
Filesize
5.9MB
MD508ab35388a6496e0a2a4779ec6874974
SHA12792331a19beda85ed2646a57b2708b8cd143b41
SHA256bd70a10e95e8036e470e39d2bb9d5e028bf9dcbc7f7ded01e3421fa71e53a1b9
SHA512dd018bb300b9f76dc1670f16661451c6048096710619e293ba4dab5c9d4f155165bd4be9e34529093d4d568bb5305ba7445e2c6198fa4e9fb74d76c178f55d0c
-
Filesize
5.9MB
MD5c28c56bae8eb242924b53f5efcd75a80
SHA143bf9c5fc4969122fb7000738e8f749c0b47ebc4
SHA25693055c562319ccd691e9b6123967ee10608ac95dd161c8845da12ffce4f8db98
SHA5124257a4aababf57895aef975bd378e8b02df0b0d7495777aaef7af3038d4ef146f7c9c75b88e373dfe8bd0abe131a2cea7e6c951840eb456e1c9d2db3240348d0
-
Filesize
5.9MB
MD5a17d977e208e200bcb4029f9807e88ef
SHA119d8c8823ff6d1d55d2fbcf19b4ef4d20cff0ad8
SHA2563633533005fe0e2470d570094f9611cae3395e5a3ba3703e57f2817e0854cc8e
SHA51246bd7f436d353e1695242a0b22a17e1f84c2ba81332ff2db8f46f549cea1788bc55ceb2aa3802fce5215ddbe63ff4861cc474fc9f76d5eddd62f1fd34d5b8e61
-
Filesize
5.9MB
MD55b14aac8e91de29c5c18bdf00275bf8e
SHA1e80d5ae35b34cd37092e9a648416035494c6913b
SHA25669e362ea4328560ba7b3a34899d9a4bd5b47983e3685b8a2600eb1e25a03dd2e
SHA512fb8ef7c35a00b60e952cb8eb83d385f3119c53d0ff3b64f3c871090805cb5a1699d527b389a3f21ac9f4ec1e3dd83d7088fb34b9a0212defc6d3ee4d3f127bbc
-
Filesize
5.9MB
MD5541d5cd357bbcf903ee7fafecc05be19
SHA106e525ebfd25e75eca2135a6df284170d7516acb
SHA2562334669e37fda19369769db3f5d725dcb08a49495cf278c0913619eb00093a12
SHA512790d2347deff45c3368ef57680228e62bc49f58ace2e51827011348973828c09e5a815e1f3a118cc5187372fc78f083a8278abe955f8b9f54d0a0abf72b4eb74
-
Filesize
5.9MB
MD5f10ff747b26a3b74487b0d03b2362355
SHA1b5977c9a5144aa93cb6ecfaa07c3d55095ab49f0
SHA256bd25c92a0066cacbe3c999cc9c0a0ecd2462fd2848bf41d544688f998f9e6b1c
SHA512b12a32fec67c8a90d3f9bcf3257a2c0a775def75881a2952c191467dd61c8b025e1bed0bb9296726d090b28490a9169c3818bd7ef9442b0dfc20bad74c882abc
-
Filesize
5.9MB
MD57ea45d95a73236b1c2c9549540e69a46
SHA149a54455ef35d63fac28ac07004fa55acd64740e
SHA256fd4808f1206b36b3529fe3a24c3cd06e13c3f060a84cf78069e019f3c2bb5830
SHA512b008d73da8706ce929546543beb5c901a1fa3585112b9a4e7ae565573cabc49abaf568c42490228be2120215b1fd434d60b2ddfd724d093e5383d56b91d3e26b
-
Filesize
5.9MB
MD5c3058e602cda0b062c1baa8c06ed8916
SHA11c2ff530c71ebb73bcfab7633130019c51f0c6c8
SHA25633f223abab5cfc14901ac87d878bbd7072963b83defc880bb09fb0392312abfa
SHA512fdff929d1350ce1d37b4065535af3ed10acc2074bc5072c5ca7f764d249ff32d5122a568701e99ff38953b0eab58108484db387f9dc56f88dccacb12ea390b99
-
Filesize
5.9MB
MD5fee31b090f0ba75669d796852ab7c34d
SHA16a1c51eca3b7df637c015574e2230db436982df2
SHA25610a5d3edbdb1e637a35c87432e4cbbb668e0e5b89cc21cb1c56425b4b3553404
SHA512acd657e5220ad68ea4df782518d8d557df9f0a0fedbe840502adb69c178bac8e762c008a5464369b9bf5e3e544d1f2e41188bf6391e223bada203686fd6eda2a
-
Filesize
5.9MB
MD554a03b2f355122a54d8f1774afdf56c0
SHA1c6deed780bb8aeae1be06430185ea3074b75d8f9
SHA256b46ee2a3e376511fbaad3ffd672136fefd1d1175aace9aaf61be3f9fdfee241e
SHA512a5d46a6fe94e2db56dd560dce6d838ecde4a779caa097a691ce8e830aab2259afa859ecd1f781abc152c0599e87c59a230d83340fd47bccc247c680007b265f2
-
Filesize
5.9MB
MD547f72a16d58c0ebf46231e19e5b3d677
SHA1aabde0503a64e1b20e0e0b276a36bad58a6fc598
SHA256a1046da75b6a1ce1bdde88ea4c365a62cdb9d91331ea5fc47691e431b182b32a
SHA512d8b691d64ed668c992520e6d75532b82430217bd4c2a4915d81b256a78423de336dae6ae531e8f0cff547741f9069d62cf26aa32c66084f0cda2d078e18ff8df
-
Filesize
5.9MB
MD52c9d2ce8f82e4d49f20984ce61c58170
SHA1b07a9d70d0be3f0ad85a5e33b296b8251b8a28f6
SHA2569dba8918e7eb962e01578a724cbcfa567ec94d82ecb17a8871425c60ee0725cf
SHA512f0187699d90a8995c4ba174c0d07ba42fce8305451995b924457e2b4b4d451450268462683efa264dd8453f1e021ab1c949a25e95fcef1e866e8f4d5884ce767
-
Filesize
5.9MB
MD50bcde4b8188897aa28f941547bef3714
SHA105825602f3a1eea5b0b551d5eb2b334874161950
SHA2568f4a8e8789a2bf0aa3ec26e00bdacf460958adbdc5e06a9842a4a1fdc9342b0a
SHA512dd4aeb98f38291e0b9fe07f2b1ff28ac999c4f324b800239fb0198904fa3e235f487fdc75c9a991829388b8c6c88afab58a5fc8db8b539f5122319c9b4576135
-
Filesize
5.9MB
MD570d52c2c90bc413d01a169a9a36556c5
SHA131db2b95e074ae2a23cf834bfe70b91ab33c26e7
SHA256b281683940b1f29f54919ba73675d39812285d80308f6b401b1fd8f22934a4ac
SHA512771052fd0ef406f515e188f4276f0ea09babc62bec951650e900696a1936f4e5bb216308f313210e99d6291d57bcfb04c0ef8317782b03ec9364eb5a95fed8ae
-
Filesize
5.9MB
MD5444614462e293205a0c34d59faf21817
SHA16afa4f9e4f25acf336620ecebe58111be3200d4a
SHA256db119d752ff4a4bceb2847dd1c6eb650bd4d31261c9e9819080d0189246f641b
SHA512ee5a29262981bebbc4563826f27fdc40459826ea9e7b5e936ea40ec5109c32b00204a04ddb036a21d14cd5a3ea7964ac68c9c31ef01906e63053ca1aef9b04f6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB