Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-09-2024 06:42
General
-
Target
2024-09-19_0c546c996e815d799a63214a206ae6ba_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0c546c996e815d799a63214a206ae6ba
-
SHA1
98e50794fc289ea161ecb8cda36d6b91f353355b
-
SHA256
8b7ad66431b8fe3f1f0c66cdfde9daa55fb08e1c50e3f711942c7e18984f4401
-
SHA512
b8477119d2e732a23848ac908749a91e8c695236b0c2c4a08596afb08bad04284dfcaff998bba514c6f565e5d5c1aa50ce281d44a7d3b83d54ab31cffefcdc59
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_0c546c996e815d799a63214a206ae6ba_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_0c546c996e815d799a63214a206ae6ba_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sVHDjyj.exeC:\Windows\System\sVHDjyj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMfxgNn.exeC:\Windows\System\iMfxgNn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OfVkEzO.exeC:\Windows\System\OfVkEzO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agHtWvG.exeC:\Windows\System\agHtWvG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mRzEPWH.exeC:\Windows\System\mRzEPWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvJwvkx.exeC:\Windows\System\mvJwvkx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\trUiqNj.exeC:\Windows\System\trUiqNj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IKZVkJs.exeC:\Windows\System\IKZVkJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDzDYHh.exeC:\Windows\System\HDzDYHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xjfqiLX.exeC:\Windows\System\xjfqiLX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwCLRwj.exeC:\Windows\System\XwCLRwj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVmlDho.exeC:\Windows\System\BVmlDho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aphmHQQ.exeC:\Windows\System\aphmHQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDhZytl.exeC:\Windows\System\TDhZytl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aCjiUCx.exeC:\Windows\System\aCjiUCx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyUOSAT.exeC:\Windows\System\oyUOSAT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IixQdNd.exeC:\Windows\System\IixQdNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXAAwUr.exeC:\Windows\System\KXAAwUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Hiytnrs.exeC:\Windows\System\Hiytnrs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdPUJCq.exeC:\Windows\System\WdPUJCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByEluBp.exeC:\Windows\System\ByEluBp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5494944909d4d74e23d0bb67673a36bff
SHA10e0af6d9422e1721958569f909671df54df6c209
SHA25617c586c2d6d974b85ec8cd47aab034e4a5fdbc505708bd7219008bcfac3f6cf5
SHA51202c9e4fde8d699d60e41d771fe3e682f352311994992dc443574f135a11ded5c827c2614fa45f9851268b3de9c1cf8899d1d8b06a9fe3d4811eb6e0356248829
-
Filesize
5.2MB
MD5734aaf456576d0a55303825bed2a9183
SHA1026d4c49ce94c62fbe759f9f1611b928ed6cc111
SHA256f5258a237de4bea3d2b2d51b745428a4b4e65ca1432aa6161d753e06a71f6cee
SHA5121af2a6fc584bdb1c9ae9bd86e6b71ab099d25ea06eee91b9e150c454a3b66eac006e50ba912c5158bd6d9e79afacb726d819acc8ce9225bd9a09e8ddb7cc0fb6
-
Filesize
5.2MB
MD53ee6587711aec4281ea8ef7236ef3f46
SHA160f819913a972b8f75915e0245172f5556d1d3a8
SHA2562681370f9b405c072959826461ad03d75b0686ee435a72a99437528138859ee6
SHA51260a8440a2dd5870a112106e8c5253aabe2e08af99c990c2a6b9b2d0d068ab4f24ede163d21f2b04223b167dfec7894adaa17598f291b8e077d7c062dfa560787
-
Filesize
5.2MB
MD5ae54a1ff953bd10ef9108eec0bb82a46
SHA14d9aeccb309ecf3e28e6a3bc9375f99140fe3d2c
SHA256eb28ff1eaa14830b7c883f9bf3296e56aca7d3d5e0a93cc240f65c379b4da4d9
SHA5124849e34b3eaa9c25826c4733d57eb16c6629679378b3e97815038a8a820a52a586c89807816da46e153edc8d1f41a65494d3ef57eec1962dfdb0036a2b476dc7
-
Filesize
5.2MB
MD5cb667774531e3e0ef384951690f22e1e
SHA12d4b8641ca50a5d0296f381e09604d5d34b468e4
SHA2569e57beabac478b79c774eb7bfe903302ad5d1d52a1c8091473c1d13245d62b4e
SHA51275a1614bd438cfcd94d4e209f6b3de8cb573776113cabad18ee4ce6e00d75788d8b006cff55124c8da47cd21fd05ee093bad5849c9f790093bd40fb73bc1f2fb
-
Filesize
5.2MB
MD5bb57c457c1b8e24ca66c4779ebaf9fd8
SHA1fbd224de83238c4d5a45ef3c6ef08031adee8313
SHA256db3a12fffbd0c1523f75bca1a735e76ba94bf690171b7c0a35491263d11d150d
SHA512dca5ceda0ba71ca32f9c259244a3dbfedd9320948a04910af93d6f1344976ff95e70f4e783f77fcf3b31116c6288e9e39b06ef639c771b1b3eae6ecf50579d23
-
Filesize
5.2MB
MD561241a253fbdea2d1a10bed104d40b47
SHA1d6b1d45ce18a2ef56d597ad5ddc8406e959bc7d9
SHA2562118a9efcf672fa528802b2448516d4d462face978b59a770880f1d9960a14d3
SHA5122712797d522a4f177f5b1f9dc70edf5e768b44d8461822d61b28837084309902c1f2341986fde64380c39f030c964de970deb004ef7f729d22bfea091700a388
-
Filesize
5.2MB
MD5cd6cb23c79c01b331f29cd77845732ab
SHA1e35ce9564a46b13d5a324671e7680662ec7fcd3d
SHA2561ada1c2e6bd29d8d39c092150868c970d613039ffe600e0e6a4b6b76c72f4c48
SHA5124de9a7621fcb0eda76a7eab00d02dc99f6fa144b40aeed057c06f45eb3069bdd2c916e56870f93dde492962712a6b4dc82be9caa1abc9ccc0e82b38f7d5beb8d
-
Filesize
5.2MB
MD596c1cf05f660c13a69a341a4789d7606
SHA12e9b525d027b98272ab88b448476dd4b33e454a9
SHA25638a4039d7965325e01ab14c2b5f55b3c70b2f035ae2755adaa53c54f1d6acbe8
SHA51243d52637a004141c1f22c335d04402fcd911bd3e1baa3872b307240524b87da1c8882dbd7961ea1eb0dffe2fa3d1ef6a9fa52abc72b2af0cc3331b1f9612aaf9
-
Filesize
5.2MB
MD59d52c11a92adb5fb616029a35dc1f9b5
SHA1861e35d47afbca9a944c72c9f390f59476b91730
SHA25669e74cc7ad97bbff286ce14eaa82b847bdbaeb81c3ec2ae5f0d85b2c82e1f0b9
SHA5129aace267285cfadb9e86a34b6d58ddf259e57c05d2b87ce7de16fe0442d43fdf01527b8e7511129d056611575d9216235a4536fdefd4af092c5c692ab8c84b8d
-
Filesize
5.2MB
MD575c990eb1299fec1834d6d9b56f59d1b
SHA154f627b59e10f5a33eec71ecdbad007f3e578742
SHA256ea9e67cc759665d08825ef4c690759554ad8abd8619e9146a1e0f114c13dab97
SHA512d659e3c0d028bbaae80a0c4f139e0a8487c46705da278222ac19ad0d48c200447c577881dd452c0d0f0e113d5de2094575d8c6eba5b07625cf04123be3e1234b
-
Filesize
5.2MB
MD54aba13ce90a480b1bffb6d9f890866b8
SHA1e7169114e37c59764c4e2887a53ef1b9385ad6de
SHA256ee8ed5420472d3892108967704121a5b408cdfba3fd972cc546850c5be742fc4
SHA512718da197e4fa61fb77be5469f59e5cf18487c493a8c8661c8fb919fe34bc9cb078eddb6c19c715cf15704d16b0d0044b8a707620ee0eb8775f2df581b7abaab9
-
Filesize
5.2MB
MD59e73bc34879ba5355f98b416b0dabb32
SHA1b132a21fb4a42d77c3fc9f6e4ce368341715749d
SHA256979981d0c6fa20b0605224b1093594f4e6c8e3c652550503e8f41ba6cc469661
SHA512453b3cc7136ed4795102bd0c60f96cc27353656cf32becf7ab245bfa938910bc83352e1650545f44fbc75489a067bb7fb811058470262602cf4fdf3c61ab7b29
-
Filesize
5.2MB
MD5dab3d69842eb68ed7de830092bcaf2ec
SHA17665416a58ff86096f2f42f77c83f3723e4ad983
SHA2561d2970c026fff38480ce8e82b7cc3ad671ee99351f93a4ecdef6be8f96828a4a
SHA51273a04b017768acd860bf4e557707541ce7d2de2ae3bf4522c8c7e30a8dcb61956c735453f669cef2b2c128ca498c1d98af1f36f228d2cfb6e01797cbf1bc130e
-
Filesize
5.2MB
MD531ce1d38d703a1952354433fe9ff2b8a
SHA1d9c9dca4eae304e5033c7f224192e579a303120e
SHA256b6a9dc98b57e3bbcae87c9dd70b59ea8bfe2799f6b6cbbe0f4fe891ce7c7a353
SHA5128b9355133d07853b9cbe3656ad7170039d992880bb356bf7572bf053216fe999c4d0cc0aa27d568061b33d7ba9656a19a9c6aa0b150d90a0aa9974e3020f1b32
-
Filesize
5.2MB
MD524b9c5c2d9bdde377469f218cf158c48
SHA14a009b15cc5d5ebcdf99b9402ffe16a53dfbb91d
SHA256fc65ab163fcc91ba1084b09c5aee7e6cb55962f2e0c4d2f3f30ce431e6bc52dc
SHA512e2fc01cce3009776d7dab0cb392c58370ae87043e0eaed6abd5e5653ca00c748160e2e627d6c5233784b3d914cb2207f74907940f1368d9d27b13b1603291a98
-
Filesize
5.2MB
MD5f1053c17421ae1408e87440d59fa4348
SHA16789643066ee26e507003185b7ae4f85580556d7
SHA2561650fbc0f2081ea6fbb8b4ef7c40f12a9c9223ea6a2ff9140dcf54a310da3a76
SHA51252f9dd2b618581129414d6e8176aaae63b350c0098ba65ff5163b9add2e32b349ed6f6216791b56e7a45c9cf2d6dee41b9f52d4ab6219876095f8c6cbc6d89bf
-
Filesize
5.2MB
MD55b0c471b4cf7c217dbd1dc660e843f6e
SHA1f59b040cd2ddaf47bfcd35dd2983238e067bc793
SHA25602e648a7eafe3b3b653b8b454c1aba80962c2637d6bfe9e72bb9692501b5286f
SHA51236bf2a08e53b56ed1d536a20b137931defaad273f7b35b9513e90bfa1a480966b8847fb0b594f10212422f122f8f4a6f9a6f49ad96bd60f940d4579480d8380c
-
Filesize
5.2MB
MD5fb18088813080a4e0d8b6c9ee3badf2a
SHA184d112db2c162b0b67a52d8d1b29a6066cec2100
SHA25681b1ab6566c6f177d40356e206ce176dbfa5cadcee2857d779dfbd1148b0220b
SHA512b52a34cafc48d9ef6af3ea0ba623850faa8dcd6b801301b1ad652d7fcbbdcad73df0a12077c0750976705031a577784026da7086b889ae2d7f3e35510be36440
-
Filesize
5.2MB
MD5aadea1fe35631ebaf4a0be6b84095b08
SHA1aa575bfe2bf9e37c331a2fbe05356031e57a4183
SHA25638f708ca8aff28b1bbd41bc8d2f913602e85c008b4a9cfbde97fb4ca067fcd22
SHA51234ebe53fbdced5a9c5a3d820e01c899978cc4a4393da80fb12e0f65473f4f2e3338f9f184505995cc8f263ea1914b1f43cbe6032392e9d58ba6a343a6beb883c
-
Filesize
5.2MB
MD5a13c5d5e19b65f8789b5d770222ae23b
SHA1a8a173536afb107ddbc1be7845d04bb02c998d23
SHA2566ffa63b5bb7548574576ba9f2743f250d5e593ee2b4cd22fc191e851b3feb701
SHA5122461592c321b8ba3e913b08461c859ca2b9d72230209d6a7d57b05ee058d0d651e724f3b698c4203a0286390356d9e39980a8a0c2bd01c7d86a0a21b72bd59af
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB