Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 06:00
General
-
Target
2024-09-16_eabd878d23e3cfc8ace84db6f6f164df_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eabd878d23e3cfc8ace84db6f6f164df
-
SHA1
e049e08d8c1ac3a55f51dc4e62a076695474fe72
-
SHA256
eacfabc4033cf437190dd4749f25f8fd22cff273445c5b3e5a6c0bacda0b1ae5
-
SHA512
c9960c0c4490a36f55d48edc5a9b56566499fd5d47ddc52078381eeb736a8441550348bc01f5f444bcdddc4d5eb8e857da0e58d48b6dd3c0171d93b734d2906a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_eabd878d23e3cfc8ace84db6f6f164df_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_eabd878d23e3cfc8ace84db6f6f164df_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MkZmQSr.exeC:\Windows\System\MkZmQSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aaRMlwE.exeC:\Windows\System\aaRMlwE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MGZDlwE.exeC:\Windows\System\MGZDlwE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lMHOIMP.exeC:\Windows\System\lMHOIMP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFzRMZl.exeC:\Windows\System\PFzRMZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkXKPau.exeC:\Windows\System\LkXKPau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfLPuVh.exeC:\Windows\System\qfLPuVh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MCxJCCA.exeC:\Windows\System\MCxJCCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzsltUt.exeC:\Windows\System\IzsltUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZukcBHH.exeC:\Windows\System\ZukcBHH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QVdmiwm.exeC:\Windows\System\QVdmiwm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNiviAj.exeC:\Windows\System\pNiviAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHBcxnF.exeC:\Windows\System\FHBcxnF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TaIdfzu.exeC:\Windows\System\TaIdfzu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPHTAhX.exeC:\Windows\System\lPHTAhX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQAEjkE.exeC:\Windows\System\qQAEjkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xEwQYRe.exeC:\Windows\System\xEwQYRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uIuIiff.exeC:\Windows\System\uIuIiff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oocShqg.exeC:\Windows\System\oocShqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYczoqD.exeC:\Windows\System\SYczoqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NeZNUuJ.exeC:\Windows\System\NeZNUuJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54a15d0da8723f3e4a7d246daa9161856
SHA110eed63798ffc4cae7a8f99e330238b043c0285e
SHA2560ec611797fa4175ad0e4cd44565c4810b4a07a7e3614498622346330e472c4b3
SHA51268a9350613291b8d005462486c89f1bc88a4088c1f733aa2543166cca9a96699ccddf70e94a515d747c3f9246355a16999a3a1aef53eb254adb5e072fa248582
-
Filesize
5.2MB
MD51c6a8d36ddef223e16839667241d0199
SHA14dd2bfbe90393a545af73a1f741d9a595470e945
SHA2569167d1ef91a542a03da1c489508bab232389447d2f02e621029475e7f5f1c0ba
SHA512021c3bb7ebbc02862e25279bc758f2d0a9656ba8d0c1d95aeafb471295b974d44fcaca8fab27795b8ca4bc04e0194e5b36e09527bf32a8fd09344b4554b5d283
-
Filesize
5.2MB
MD5e3f2dce28ddf201a94bc1384c1e0082d
SHA14bc2bba06eb2e1493d737fedb5d9e7fb04360119
SHA2569288ae45947527ca2e900ea24621d69fc2492d5ebab9fbf12b04a1900c1d460f
SHA5124c99b0d708bbd93cfc9fcbe519ee43a2f3dc2337c8ec1c1ea555fb48908e054d7e58f7adad9c74033c16323ae1f7ac19628f993abe787cbed759c3aea4ef18d0
-
Filesize
5.2MB
MD5119ba295696c76983585f4b732591de6
SHA13000db0e803739ab060bacbf9b6ff1a9c06eda44
SHA256d2e9765a44481ecce63892e8b4f57ac38d26dc468563ca84e09c55831a1c58ed
SHA512a05b3053dabc61c30f5cc610fd910186d40f26583a3011e38bc83c073b7c0061f49a504e179d727efde037cde67ccac99253f11e2835057f95325896837b022f
-
Filesize
5.2MB
MD5464bd5848e3004f8d5241c408853f620
SHA103f3c3e80b1794a2c009a5b2c264e3b8e141065c
SHA256f108b148c1ea33e7dc79a852531571d0d7e216a6ada2f2ef3fe15b63b5bde910
SHA5120ba1ab8547ee54d916273b8ca8ebd73072cea61d68a2994feab52499d82c12aeef821251192e57a1683b03f9c61b5b74faab930949d15b35b134b0f617658e24
-
Filesize
5.2MB
MD512fdf5b1dc7e9c03e943b522fe349e91
SHA1e16dd74d8f552011bad31cba210048ab64a9c339
SHA2564a0f94afedf92760b14265b7c9f7d0f0f68a4936cb22b5154e1781d6d3c2422c
SHA51261e887458cd9f958df753f708c6379072122f26ce4f33debe15dcd1616d051070c4e969819ef9e3473be82cb10651ceef910deb562c113b812f0acbdb59848f0
-
Filesize
5.2MB
MD5f3de334e73ef38fa323227530c8ae01c
SHA1cc85de981dc8efefe5e9f980df7deed383f411c6
SHA2564ec6dc4291f7b6548b6e293da716ddb8ffc9f49aa4d536e44b8dccf9b5a719c4
SHA512bfa0037c97f694a9ea94439e9ef140f3dc836de23975993fe087db6d4ed762a3fe057548f477319023d50e0b56654d3eb47c6a044fc97801f9a4bbf891d6b060
-
Filesize
5.2MB
MD5bd1dd0cc35a9afe55be9171203b54ec7
SHA103c6fe38da33aa55dd03c3f6ca266f3a04816388
SHA25655942f29409e776c60dd41a76ed8aed19e01b93339e630b45016f9471c4c46ee
SHA512816c787007af6e789844eb39c53fa1c68f66dc26ee5074ff97a7fc5ee1fe5d7c12885dbe3e6c0b428b0db59b400fbd591594a2ee3ec37cbc8346eac224ef9108
-
Filesize
5.2MB
MD5c2ce3f03b0ef754daa1bc406ead06d46
SHA19c0b8a1d1738c5f278b1bea1b7ace69c77d25bd9
SHA25670d81c4e81c834c161291687606d199c5b681606836591aacc890986079647c7
SHA51245a64d2d841c6b3cfecd98f44e13216b7a86ff00f695d81d7921d16323df11843d6951eb413ea65570b2ff0997b9f556a789b176f8f9023de1b9ef7ce068e8da
-
Filesize
5.2MB
MD55f1b07140473d408655396db21c37365
SHA1585bd18511281eecb7dfff435c9c5883db86c6a2
SHA256450c9352eb166223e5b91458d1a8900470a79dad52bbb5dd2fbb2a10d027ba2d
SHA512290f40ae5fe64a35b07e3f41bc4ca07b227e1545fc3eb9d74124cd44af4c76b6973898b5d30e721ab77cc2d9ad830f11231b1f0bb0364a573287e0a1839b1ebf
-
Filesize
5.2MB
MD5b393c0b5a8f378347e8c6d79f7fd7d9f
SHA18bfd3c63c0433bc9655ffc1ef4528642490f3536
SHA256613cedf030d963d66ab60c31a320825bcf726a436b7e856745feafa3f373a062
SHA512a82c6dd10ef3cbf84404947bf98bd2bb300f0249c484bd2e8268e72f8d489281d6d6f8b43cb75f6b2e0d47db1c3a7297137f9b9248d0c35d878c87f577395022
-
Filesize
5.2MB
MD552387176b7fb2227b45de028500959d3
SHA1c06298dec5db942f6dc513588dcb78d5d49d7d3c
SHA2567e4ed722764934904bb3dadaa207fc01a0b015f0657e23996761ea20695a6016
SHA5123c7030ede4b7d9883a27364ba23170c8463efad93991f34bd5edff650bb447b7297be3f0e59d67a2ba9ad7c1d521127c0f0df1127fc5540c8c3b9a599cb98611
-
Filesize
5.2MB
MD595c656670141e9cb79d53505d19e1c80
SHA1ffac96a9f2509d09625d3c71773276b546ff6e2e
SHA256173ae7f81ff7de0102d8b0ca6ed71103092f138160ea2d798bac7dbd7f49ced1
SHA512763d12ac07a4096a72ab946df3edd90295726dc4a6304b776e0eecd19941ce7a0982f4db1bb5553c3adb208c7daf98c9d9ca4a4651e070aad04ca9064252fdaa
-
Filesize
5.2MB
MD5a65a04fd41d3498923b976c3544bdb00
SHA1a4da1a5e99b1cadfb5e0d9b7b0a9e4669f1fd57c
SHA256bc7254ee1fd59df4628abbf1f3c207975ebd33c4eb2cd846ed8c203f627a9be9
SHA5128f241d53c51e0593d6d76d1d91e8cd0aaebe26fa34559609d264ca64f2a0c9ca72e2173a5b24aa350fb4914c881fdc05b5aee3c0347e9028f8fa5688ea5fc535
-
Filesize
5.2MB
MD5160eef4191dc0fd5dec3f2b042d56cca
SHA10fa3867d0a72dfdea62c71f7af1cc8f6492f3191
SHA25623dc5fa5405865afec030260850987a3810a8f3dd57c7b4dabbc6940c99650bc
SHA51204e259812a7b3344fb69b3063d647286e48b409a21bd6078d7300938dba246d0b3a1d45a1a66850b3dc05dd04f844da6e4a594b329f81e631c87f31354829af7
-
Filesize
5.2MB
MD510dcd941ca8bcaa747c86a655a2172fd
SHA16ff362ae8fc66bf853939cb0803007e2652a3112
SHA256a853be3641b07a5b6455c0c23bb2e7b10f18c773507f7454fea437cc12788dd9
SHA51234db1b4241959e92117342b6322446e540c1b5e265aabc433558d11f436c34ce05d267d95ffd473ab00b5637c4b795f3cddcf66b301892fd38df12c09f6eeb5c
-
Filesize
5.2MB
MD5fc16efe8f9f07c9a772ec4a2203194c9
SHA1c0df522cd17dd679f415d702e90c3ae02e90b86a
SHA2567f43133958c2ece15fe2fd92b2747826fe8697c9d6f568f9c93a7837b50c9ff8
SHA512a9648920f75939aef3c1da1430e88677635ef457e1e4fd6ae428b69409b4418847eb5296e455594af9bfd8dc513d975cc47284c65e080376491548b8c93a5ad1
-
Filesize
5.2MB
MD5ead0769a567b530e633350e2f3b916d4
SHA17b1b43ca2d1b452bc55791a21ccab98df06eb69d
SHA256f0e071fd64edca3c4245e94154937dbe6721bd053d9eeb4b90d8c8b08de0a1d6
SHA512d1ab4d48793cf6c25f0f77921cb05f47eea644c36cb2c28585d313eb0cd0971e968275a2bf6efc0f7ab1d07eb2bc6513d8233324957c1abbf5a36a5dce81125c
-
Filesize
5.2MB
MD542ef3642c01bf3c8e7d58df4fa07f337
SHA1fb7a8e5f88c96bebbd5aefd10806e811353c6262
SHA256aebe47b12a2cfc96de3dacf9f77f7c6bb0db4fa1b9e9fbcaf99883c4efa51c86
SHA512bc88c28f8f654a76cea4401c3b7a9fc39a48b61e870ec5407291065fad48c2129f278ad493b2d6ad14b1aedeae48fd979e7f72bb611128c091c3ff0ac790d7a5
-
Filesize
5.2MB
MD55af21d010a7af626154f8d564e0d285d
SHA1dc2a8f08acefb5b1d72af5653c4be690cacfb821
SHA256969fcdcd4bd8d13e856fbb9db1be4ac5c8a6950a1fcf65949682b37bc3e98ac8
SHA51289b14dc2771dc43d11bce080a604089ca2c71f89b3363c996a6158aa3dfd7caeb2545ce057e543c40de43c055355bfd9055d92c9423600fa10dc25c5652fda27
-
Filesize
5.2MB
MD52e9e2660836a43f3a77718acc2e9944c
SHA1da7b6ddb80ca680ff064f341a523c822fa43c9b0
SHA256a812c9fd853ecccd7b3ec0f52d810be7a5c629f45abe0766d0710e5e410d42f4
SHA5121fb3ca450d05f10b745cc4aab9a3d76bef14b115ffdc7d94f4b961355f8b94e04ecb8e2c45581b07e9bf8379e740774021928a61b6cbe9bfce35c5bba319c5f3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB