Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 13:50
General
-
Target
2024-09-19_8c6ee039d92ed4292fdadc52d804fc92_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
8c6ee039d92ed4292fdadc52d804fc92
-
SHA1
9a1785145fb1fdd967e6ee537984d1843233d83b
-
SHA256
a8f197d180af1e68aa82caec4c148f78c4ecb5f145d48ef1d086c48afbc6f3e2
-
SHA512
5ddacec5d1ba0354f85b9fbb7ebceafd49f4d30f48bacafac4f05d614732fe51dcf31f708cfce26524e019ad98e3e586282f5529740c4421c66b29df90e5d59f
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_8c6ee039d92ed4292fdadc52d804fc92_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_8c6ee039d92ed4292fdadc52d804fc92_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XBJPxCA.exeC:\Windows\System\XBJPxCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJtUvKQ.exeC:\Windows\System\xJtUvKQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aemAfOe.exeC:\Windows\System\aemAfOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjoePmU.exeC:\Windows\System\cjoePmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipykWZx.exeC:\Windows\System\ipykWZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zbzPXKx.exeC:\Windows\System\zbzPXKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\liTejwk.exeC:\Windows\System\liTejwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PclccaT.exeC:\Windows\System\PclccaT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DgfkFjQ.exeC:\Windows\System\DgfkFjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSbqWVV.exeC:\Windows\System\oSbqWVV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bUsgbRe.exeC:\Windows\System\bUsgbRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xNXnkQt.exeC:\Windows\System\xNXnkQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJITOBi.exeC:\Windows\System\tJITOBi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzkdjfR.exeC:\Windows\System\QzkdjfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FhuYQVi.exeC:\Windows\System\FhuYQVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrnriEa.exeC:\Windows\System\BrnriEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hxmHySY.exeC:\Windows\System\hxmHySY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZFPesTb.exeC:\Windows\System\ZFPesTb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyqejFm.exeC:\Windows\System\eyqejFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fvQZiep.exeC:\Windows\System\fvQZiep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ivILWMD.exeC:\Windows\System\ivILWMD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD561b6dd0cfb3229dc0f0a8406c1c2a3eb
SHA1aa77cf8e3f730d6cfa2c0bc0de04cb0cafa20c7e
SHA256c1657f7bc3cc7d965868b6b6e29a4d3307a0eb98d392065b5728df57f1a4eecf
SHA5128d76a551994ce8633809babb3ce11f9bf0d426384b032ee95f5568dffdb4e7d9e59993d292b3c43a6a898a74c45c4fe94d649348343531ee6c0d4e92e95bd3a5
-
Filesize
5.9MB
MD542c05cfd290d688fa6b60894c28840db
SHA1d7ef00346ec346b44f44d9d5f117855366fa33ac
SHA2561550fe7f1b9f566377b7f05dba0a94c8f12e6290f08041039766f7f248b72b5c
SHA512c50adb12ed7f73310280645386b25f997754ce4f2d652d603d0ce97ab81e2cfaec4c16f34313527c905d8437e2d89024cce15eceeeacf1e55bf659dc4bc165bf
-
Filesize
5.9MB
MD5aa20ad90146fe29c1ebf54955530de42
SHA16999411cb476a7dc2e2ff217de85823922120d5d
SHA25659f4babe264d5caf4f6861269b914b095b3436fe35c522e31aaae47a4df222fe
SHA512ff41fef28f76bcf51b964e41a7d5c9cb03e30cbc6a4052ac1384bdfd1d487c9b8ceef6483c172361fc33debf87aacb89978f91d66d275479c380e8838de7d791
-
Filesize
5.9MB
MD5c8a7bb6994675b716fba2c48a7528980
SHA178f3f0ccd2a7dc56e4e885a43aae168184424b5b
SHA256ebd394eaac768bb66cf175a214fc2e4d0e670ab81a4324928a77f3fd1a67aa26
SHA512497cb8aaf11fc2bec53d9b4ae355d5acefae009bcc55569007324af603e0e46535b6ad8de934b740d29d254d51072059f073f5b9f5d4fe3d83282488de02a975
-
Filesize
5.9MB
MD50c2acc5db584ee0459443b1ef5b48b2f
SHA14dcae6f6aca371e10eb68a6b8912592e9944ce39
SHA2562dc0d2bec215ea69b3b48b161252f36e2f2465f7ebc3ff78194adf9263afc5e7
SHA512c81c67b6111b393fe93e367bdc437a5c8bb43428ee6e57f74ad8ef9235abeaa80ee7f4946d312e600fdde77a2e2121c17425cb9be0b9423c295d0b0ff99980a2
-
Filesize
5.9MB
MD5795f20de00df49b9d7e05eb8107e9f94
SHA1ea6deb27363c9d7c84b68cd9bda9a246a0b95e0c
SHA2566f24051f462a8f7cb1436f9d672d77b3c8a2fd25cc25981bf5f03f2bfed3d27b
SHA512813611c219c92e563a166aad602c47e08443bb381b07d92bc5f6a6b4c2c4af87040c14705fe48f96102e4ec64ca1b440d9e7648b6d8b36792803dc236d226da8
-
Filesize
5.9MB
MD5b8a4f06da5394e62dcebcf5af595cd36
SHA115a92215d05ea2cf6026b58247c29eadbdde99b7
SHA2562d024518aba2508d57bcf7869bdf90d5a589e0e128d1cb489b7e5270dbf541fb
SHA51264df31fa2c723e2d340f63945b6d820eb6167bc6078175d2c77d269defa4cc88066ee1919602067ecd72632623b4af09f16b83d2d9969cdaf04c53b28716dd3f
-
Filesize
5.9MB
MD5b74f84e23d8df4f7014086bc8e2eab24
SHA196ee9ee89aa5d12528b5c4d278e57a9c2726c1be
SHA2563b8a19cca0b5fb9a21e32e49e564d268df8d6a3c3c01ed547539b52da617d094
SHA5120c9472c586b8999702f2f5871692de1184a3ca494e732208c28fa9794f119df95a13e6ff11b213b42e993d2fedeec3f17962267f9f8e8978ccf91520bb45287e
-
Filesize
5.9MB
MD58020bcaf24e25e84ca2dab54612afc9a
SHA160c02e173f01125404feb5ddec52bd9c7761e2d8
SHA2568353beadc15f6824fbf73de7466eb010d3511fe0c4d80b20c99ad8722ae5cbc6
SHA51243036bc608231b649eb5da1d421cc788925b00c370e60c65e90d1f1928b0fcb880e8f38da0d808a9cdc59c68a2a47e7fa463f5017938a491f34f8e400a72b211
-
Filesize
5.9MB
MD5bbb643d05d72c878fa774ac8ccea93bf
SHA1e479b6ec7b229f49098429b265d2f86c6e7a9a98
SHA2561224d9d6bb8579a6325f612cf481ab0b77d4a91f96bda5966eae9455a5c75c0f
SHA512bb53dfb9f43efa54a8bf1e49a4cefff9df884ec4b022cd891e4ff52b2fd4141392149660e16fa0facc473cc8e0ad60170c61e6eefa0c1945567048932e67d12a
-
Filesize
5.9MB
MD5d22564777e678938f5e0b4cd517554b5
SHA11df0617c894433c0febc45c87ef3afdd05fc4828
SHA25663b39aabb754510b089b1730dcff94c481011bcf4c5738d59ed79ae1c4b7a87a
SHA5120719a01e96fc7dd80a709db256b0c7f6de7d1b1f849348bb08996345636bd321a1c674f5e1af8d760a219d408292dbe36cc840e5ba954dc342793a9801caef6e
-
Filesize
5.9MB
MD560e1050909fbf7177897b2d8fd14b98f
SHA1d96535ca0153b81a726dd252ee0407cf4c90d505
SHA25611a712d274b6b69cdbe7e6b4ebe7455a7b025618232d9e53f4cbea1d90c8c1df
SHA51211ca5508323ffdb1d45ac84112d90e7c6590239f7f7e87e3fefe28bf5f83aa54268fe6f60e11cf2b45196b0ed36cf41104a5d1e475162f19037f8615e6e881e9
-
Filesize
5.9MB
MD5e2da4a84f11c98ce747dbe8bf7b362e7
SHA172eca1e31e4ca8024c91344f919a1485ce7a8800
SHA256432e549ef3ee4ebe30b937f2e3684f78a556305b4a37c321904afb86ed57ac4b
SHA512c67599545fc501c9ecc2cdab3d84178284b041c5c686fafd4733d6a4c62f881e6cf8929b2964bf9af3e8dd6b70de29ad985df7290adf553c13bb62b848283ab2
-
Filesize
5.9MB
MD582f07dafc0c26577a73c6b91661203b3
SHA1d711dd98550738facd11b3dca9fa11794e1b6a33
SHA2563d67dca984f78c467daeadaac7e26db37e5fdbd1fb269a5bddad1385d0b7eca2
SHA512f544ae96fcc4aa95907cdb92949c75e77ff7fd238bec8ca9a61efe79a7ab7add34c526c7ff09d0b6d07ab3e0ee8871e7dea8be50233df8587185b0e3d1d81427
-
Filesize
5.9MB
MD5627b0047afd8250e7913874071be0707
SHA186ce5a0ce4e32d0c1e7f7671f4651e370fa1a534
SHA2561609ff82cfe52ea11ac2b058aa69537df0b383483777cf9e957b80cef076264d
SHA5120fd61e75b867f515082521e83f842ac9e15d1182d87b54eea65db39060444efa3abeff38207f85da44544adbe859e0a5eb9f5030cdfcca8890b25d13380c9a36
-
Filesize
5.9MB
MD5ec1d5a04c921a4f448c35aa1a07647ee
SHA1a69e715780d6af6c817fe03f72cc068baaec328d
SHA256316bff022c44db59d5ee9aae887d633816ecf9c9a8b4da7f6bb88e693dc82902
SHA512b8df018002dd5163b0d2c0af3e88bc0bb9d0e530c8d86a5580b2275c01b8ed101ad94541d93992308aad332dc83622f73fa2166c820352d864ac7a77eb900e10
-
Filesize
5.9MB
MD587f9e90ce2b983e6bc7d9b2506877df1
SHA154e3aaab57f6485cdc82067e2e66c7c1958a41c8
SHA256eecfba728914f2ff095cd6cd57c3a5f26c8665d9983a1e65d5be4dd3883e2dd5
SHA512298c187b57d6f6efa715afe2ddf6c4372ab1b4c4eec573f8c967e99f8a260ce5d4b7e1400b1135c712e61aa037ed715536c07844b9b2492e4696c75e68934c6f
-
Filesize
5.9MB
MD5bbb631d39f5846725e2a3dfcce9c1869
SHA13326975b31ad97417d055855ed0b94b521197c09
SHA2565c01c2a6ca75f20a281b1184ab95226bdc0afd3c2bb6faa1eb9bb44ea363fc56
SHA512783aa13b046580713b9f526cc23300f1f8bd60f86ef8077d2db8778f9d82b0fd8ff4910a1adff5a9d13ccc7cb3284f33c9eb136b66b39f46b766fa43d2575637
-
Filesize
5.9MB
MD544cd9d7aceb8a0a89f896c62028dcb4b
SHA1c4bc8dae332b220cc97695da2855e818e8a65def
SHA256547406691fc63d42ddaafafc6c76d677dd7d49b4d228f5ab1e5bcd7f0dcecf24
SHA512edc59affdb13ca1e1942b41d7cd886c0f9382a79b5cd31d907629d519771cbbab462ce9bdc92c8622ed52ec819741a03e7596780354ed851184d7fefe5e8ca19
-
Filesize
5.9MB
MD5f19fdea2e538a516c34f562702c237f8
SHA1f683c392d4865443ced27ac6ef5440fe947afd80
SHA256e0ed2f7375f3f5614cc92f86c6141b0a7ea747962f54baf262e7630048060193
SHA5126b4c87b433963649f76f485544d09ca3f1bf0db9b509800f0c18f3ee62fc52dc2e2866daac98fed5452b6d347f0a3bc8934e6cf30a6fe94a30d8d29392e61d1a
-
Filesize
5.9MB
MD51b0e36cec1f18cb2854f3e074b86c3bd
SHA126ae70ba84d4e248d764df63eca7f4715b607641
SHA2567beee76ad1b94f833eece5d9ab87eea54ac009135ae3a89e8e0470520b33c5fe
SHA512a2c4c7ef66b0fa24162d2fbbe24f210d0bd45f420333325a7ad252df1106e4e7fdf29af06638f26459af180f398e07946a4ed3bd6270098d1131137038862fcc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB