Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
16-09-2024 13:11
General
-
Target
2024-09-16_7d161686a474232a0464bd3e13c487ec_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7d161686a474232a0464bd3e13c487ec
-
SHA1
1ab7cecd2c9b569076677251ecf8dc8a9f9d22ff
-
SHA256
7ecab2cd297bc06b35d70462131e739a3a79ff871d94ce8f260da74a9f41ac2c
-
SHA512
7e371171e894680a182e8300030fc8d534473d6685479f6da761a6a064d1f78de32fc6c4a947b4eeb67f2aea6d7ee0abf58d02cb824732399dfba6d122ae29da
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_7d161686a474232a0464bd3e13c487ec_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_7d161686a474232a0464bd3e13c487ec_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ObXecXs.exeC:\Windows\System\ObXecXs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBEsntV.exeC:\Windows\System\tBEsntV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Onfssce.exeC:\Windows\System\Onfssce.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HYGRaTH.exeC:\Windows\System\HYGRaTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHyDhoa.exeC:\Windows\System\vHyDhoa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUeJNvY.exeC:\Windows\System\SUeJNvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esoZANx.exeC:\Windows\System\esoZANx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDxSJVo.exeC:\Windows\System\PDxSJVo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\szuptHp.exeC:\Windows\System\szuptHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfIPyYp.exeC:\Windows\System\lfIPyYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSvtWzM.exeC:\Windows\System\HSvtWzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oLzpeBy.exeC:\Windows\System\oLzpeBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uPLTJbT.exeC:\Windows\System\uPLTJbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssgcuKG.exeC:\Windows\System\ssgcuKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ybgMquk.exeC:\Windows\System\ybgMquk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HIZJNiI.exeC:\Windows\System\HIZJNiI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgWeZml.exeC:\Windows\System\lgWeZml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YaKCJSk.exeC:\Windows\System\YaKCJSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EalsGfn.exeC:\Windows\System\EalsGfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pplpOfP.exeC:\Windows\System\pplpOfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylwssSD.exeC:\Windows\System\ylwssSD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53af81a9fba7a75941614664249237cdb
SHA1d960fb3014355af1d27b518fa047d7f88a911f3c
SHA2567f7f68ae7a14c952faf322fb3aaae31800ebc0621e6276804c5dcdd5cb5fd10a
SHA5126acc1e2c01532eaffc131176efcd24844f55295ef4ce0bfd073871fbb619f174d9c20396cb78d4446dee7d677ceaa5cb4dc84905731544ec07e6c4f9d7512b20
-
Filesize
5.2MB
MD55b2415a51b1ec834fb4481693974395f
SHA1a3d728b468f2944aedd1a7b80173d8fe32ea7ab6
SHA256fb926b6ba3c3d95de06aaff299c8c4e3dcc116ec0d9209d447c86c88d2444806
SHA512e2a59cf99c1b0c509e430ad610b44e217a86698a123a3cdaa0a1e391ca8a05aa9a4d98d9d16a4d91a6f6025ed6beeb5e531e3f06d2bc24cd1050685feddc424e
-
Filesize
5.2MB
MD57cdc30fa442887adcbeddaf309846bcb
SHA13fcdb8dc56869a18d48314788235c346742e3306
SHA2568166c65ed5472317283906ff6202dba75ca9ecf59f5fbdbd54dad99aaf71b940
SHA51248a6ef9fb0d78466622f6abccfd6cb3b0b6104640c6d8ee365ae7036483ca905d7b25bd856cc55b9b6b14d09b998e17f03b43354e674b317b4cb711fa7602b46
-
Filesize
5.2MB
MD57a9c49751d3897e9b5c767203b145d2f
SHA1f160904aa9314a8d13864587fe59398ca39d811b
SHA256805b9c960a3569d5537bc0d40f51c5feb7ab850b718ebef83d04f80b0faceb22
SHA5126d13d34ba5624c1b17d9c73d7803394be463c61045f443421c41b19d31e50025ffe06baf403757615a8379a409aab04ae4ec8a6e2899718b80265c49057caccb
-
Filesize
5.2MB
MD5124bd4514f3b9e7e41d3a927f2944cb1
SHA1142694117ed8b13b9633457de533e2d76d9261df
SHA2568d9de79b289ad1905fcc14af0db8c12db246e2a279c359549469826107c99eab
SHA512ac437dc7eb3defcc68051f70a68707ddf85a6087200385258418c1433044cf3296a301c388f8cd3ef4cc76d7b1a24656d9ffbc11e7b80953582bb66edd1db3a7
-
Filesize
5.2MB
MD577c442468d7dbde4524281043079a0bc
SHA123b52b81dd2a5501cc390580941e1401a00273ed
SHA256c331e88d65b77b66fd8da7ff305669f51d69638600afd75a2cc94e20c03759ef
SHA512cabe0cc36a545aaafe1b2ce85b808c0b4a1bf949f36d239b0d725da69483d3994e7969be2db1484e2a5ea1201cda95aae53c9a5d570297efd6c830b0a8a3c96e
-
Filesize
5.2MB
MD5ee534e0efc42a836904dc436b01a9907
SHA1e7d6b2cd3ec65cbab9e6bce222bff271d5e89183
SHA25669fb4597dff3d8014f41ff78179b177c6cc061ea23683e457c662d364cdcfc0a
SHA512e922d4e34b1d7743f6411c9936071984f56e6a3c744cb43a0370d0bd4745c300b817d445deec4717a40c3fe35418dbd18e38eb45de3d53940e78000b5e55b9d7
-
Filesize
5.2MB
MD58137d75df54fd9e59141ab84c02b9b0f
SHA16b4bb509091d3a110b19da44ea2f42df158825db
SHA256a93b7b2f82d73213bc5435a5041f7e2a1ea880c32b1bc914ee73526861cf2d6d
SHA512fbb1a5e1c4961e4588ff14370b664a253f00165c71e2a085d8e403dc317fabc60e40d65686b2221cdffa8e8f480a91d7ebd2e5150605a607a90c095fc1e22409
-
Filesize
5.2MB
MD50714c52f7a762b309c5d609d8b004eaa
SHA1414c17fafbf328983078f17b566187db557d8a98
SHA256c4f92c90d7beb7050f43d921b8a69ae8d3b86496f926015a3faef69753dba762
SHA51207de0a766f40c8179beaaf7a9c769a37cb6f0d54022eb282454aef593738f1ffc1576d2ebfaf9db3a19aca3bdd7a577dde845e084b5a8de23a91dd4e9f7d9782
-
Filesize
5.2MB
MD55432aff88106c84e1a27863a0158d275
SHA12d1c5c1cbd916eb2cb13691b0af7a8f3dd823248
SHA256545a4080bc819033647fb9d04899553650d6e7e91a1c1b6c714d9064cf2a4e27
SHA5121eb7650b7a7352c85693d8e221a81a3d2c2eb19cb8d62076a7dbb48b2081d2b16a356fd30e9670dc55ba003513beee6b89699569227f860c9bc80a1f0d2b17c9
-
Filesize
5.2MB
MD58e8c9b37dee773f16cf2fd4b30440ff3
SHA1f4fdce9f72bb4772bbd7e2afa38835a7007bdcc0
SHA2564ef3fbb69178db453ef71643f7b0bca3121efab67171fa279750e4eb2cfb06ca
SHA5129b2c6b9178309657cd11e9691769aa8ce56b5cdbb4402987ceb840055d635c6dbc7bb0887b52bee97b2895289432e86ff9013d5e232122508870ddad0be296c6
-
Filesize
5.2MB
MD541189957aeb32bc536337f9a7d5c6926
SHA1b379ffce3d5342bd86f177d03843e7dcd5ff6a19
SHA256cf2bb0a182230663a13c513a71bf6c63b61aedf9afb492abca091452534e8d55
SHA51246233a8eb9fcd761bf5feddb16514a2e1174714d84943c7ebc5a1f23059827bfb3a2f22ccab2e82f327f4b4302aed882c69eb3bbb4507242e37e5ff45e2dd2a5
-
Filesize
5.2MB
MD5d9d303f9e1e31ac4956a3008fabd9909
SHA18996c08d523589170e65c6adaa067c6a2d574a33
SHA25686ab37147e678f6b906646c834ea2c957327c284d8d809fd5c9cf19dab7165cf
SHA512e42c4f1399265b542a2cf355f913f7895e2f74fe5afd343ec3350bed5f9e4ee2dc4428abc3263d7995ffa16a2e6ca038199e72f7009371ed8b6cef1c79daf7fc
-
Filesize
5.2MB
MD59a00b428c985d8e0f77c781ee3407380
SHA106c0230cd2fa2eb1cbd24bbe5822c50e939613de
SHA256adb94533096513a96784b4c6156ab74c5ab80fa527a9eb979f62ee592e11aa09
SHA51268bdc2f1bf19fd6ce5d0025b6f1ad0ec0cf9e3852796eacebad90ae60453135138fa48b09be6b2da33c4308d68204baf10fc28235e08580d6f2c7de3f34e7bdf
-
Filesize
5.2MB
MD5eeb440834cb411bc3866d871eb6edc10
SHA144df529382eb71052d18e3e72273be3b09364efa
SHA256cd37d0e2bee92c09744503d3ecc01387b70b7a6cdc8ea737edbfeec4f0232f05
SHA512c55f753ab65e783b86cd5aa458cdb0ed46e75c3c630b3baa47f551c268effc7cef33244c54155d1eba3e9e306b59d4751e9d3edf8ecfddab296005764c639614
-
Filesize
5.2MB
MD5f71bde823a1c1b2b2e59325003dfc9ab
SHA15dcbd6cf821bf5bb22ee047a039dc3306ce68ccb
SHA2569c1690cf4ea6a0bd6a2d310d2027c25c8d5088d2c3497cece2dbf786baf23d57
SHA5124a5a6d541d781bb697001f6355f4cdb0b2110cf1bd2f1e81d590322c6c0836420e723c02ba7a91a65f703927c9bf6083e6b82b9f1e711c72caa07225bb1fe072
-
Filesize
5.2MB
MD5a8b5640375dec50022af3efd0d652fa6
SHA1f7309a78436492dc692dae3bd7c156441ec31528
SHA2564135f7197196890f25b6720b91499e8df70526fbf595ce7c1ef45d85e1ee5d76
SHA512b857006c21e5c08ccfb1dd4756d19878280c67a522d0adde1b5e2f10e790f4e0f1600631c831ffe82a4303531ff2994f87b2bbc5882a3417f2374794c0c62948
-
Filesize
5.2MB
MD5f16cf5c090ac2ca50b7adddde617385c
SHA1fdb86cc3aeb6c5f8f08a3436dd50a75b050e0e8a
SHA256b2c85f1af5d794eff14d8afca2e065c30ab4129852909e90ff60828c4a46b954
SHA51249335347f2ad6948d2da62f071629a65df323fbb9322f8afe9e942fe2dd07090c8ed7abfa2e93bb7728fd1ea8670a5db8a399f40677646adc11f29cd36568394
-
Filesize
5.2MB
MD57d8598739c9562bbe60227df792122bd
SHA18eedb156133dfcbcd79f26160dc5392fe117f437
SHA256f58349700bd4fc2168e3708dba0b91ebd8681e82d85c8cd313275ed68ccd9519
SHA512ea449d77dc2f190d5e1552ea07e4649c3e344c545c16b38fd1f17adb24141224149692734f447bd67a2059ea226d85bb64356d20a1379e55eb6cd40ac164de33
-
Filesize
5.2MB
MD576fa8e4e0a92c4d7fa30b4ca9a75a2ae
SHA1829f702e9da5441311d1767b28b9df8f2cb7a6bd
SHA25669e581e6b3ff356230140d04726cb4a6cfe28a34862c89d98507bc4aca0db744
SHA512b23ee6ef7dafbfe90030793519702dd8eae3ef864027e43bb640688d1485484cd341558865ede83a3b86bac3b1c95943edd51514e53dc863e36a38ef1738defd
-
Filesize
5.2MB
MD5ad90dd74c6d85367dce459e127063b3b
SHA12bd41a79917af97799f13345a8931afbea641eb9
SHA256c22fdb2cc1e91ad3af0c3aca37d7a158851d53e59d436bbef62a7344dd1bedc3
SHA51227d8640bf7c6aa381ffe8e7702d29a6a1ab2ce42cf2bca7dbbcfc24878fa25a3930996793837e18c90721c0aa2f031c0b8fd3e7c099b43cd8b1277c677e7eb1c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB