Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-09-2024 15:50
General
-
Target
2024-09-19_c69fdc4cbbf5bdc7e3c996008d3549ff_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c69fdc4cbbf5bdc7e3c996008d3549ff
-
SHA1
4231055f5d2657f5eb704fc779d398fa41faf3b6
-
SHA256
2c18404bee30eb7523fb952a07b52b7e0b052034b9c37890c56a7aec0d1f091d
-
SHA512
77b9fbfdd8ca9d009411053ea41a8a924d05e0590adc60decf950eb1f6b3de6dd8d9f416577d5b5ffd383fe4369341abeb05099802605f95da28009d49815f19
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUW:E+b56utgpPF8u/7W
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_c69fdc4cbbf5bdc7e3c996008d3549ff_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_c69fdc4cbbf5bdc7e3c996008d3549ff_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cVmrnuK.exeC:\Windows\System\cVmrnuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KymbHhi.exeC:\Windows\System\KymbHhi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VXpekHl.exeC:\Windows\System\VXpekHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DuUaUgt.exeC:\Windows\System\DuUaUgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Fhvsjha.exeC:\Windows\System\Fhvsjha.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Grlpyga.exeC:\Windows\System\Grlpyga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bGvquDS.exeC:\Windows\System\bGvquDS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PpOLVTi.exeC:\Windows\System\PpOLVTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPXTzLh.exeC:\Windows\System\oPXTzLh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nDFjogM.exeC:\Windows\System\nDFjogM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZXgxmI.exeC:\Windows\System\IZXgxmI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsvGjwX.exeC:\Windows\System\MsvGjwX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OdJDyUM.exeC:\Windows\System\OdJDyUM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoXoWkq.exeC:\Windows\System\qoXoWkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XISCylC.exeC:\Windows\System\XISCylC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyaSIrz.exeC:\Windows\System\wyaSIrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlVREcq.exeC:\Windows\System\AlVREcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kThElYV.exeC:\Windows\System\kThElYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MslYboK.exeC:\Windows\System\MslYboK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLXnsIc.exeC:\Windows\System\JLXnsIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZuzFRe.exeC:\Windows\System\gZuzFRe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5430b3c892d71f915d69b3eec538d7de8
SHA11d5e9ebf6114809afeb58516bf0e7de90ec1c80c
SHA256ee9f00fd9255db0e8ead215052f37f26df19487d801902f50b55b651ca0014ea
SHA51225a067acc9fec1ff065cf5a5161f4e595a7f0b0982bb4549e65a4563ec31ee5545b429302c3430ca1a462d366d29568e44d885ea14a2f92bb60b2e57f0b35301
-
Filesize
5.9MB
MD5f871b3bb633f8a3cef111986dc9bf3bb
SHA12bb1b5d29166e0a4fe935d48b5947db5939c0c41
SHA2566243d382654a08b6b17e9e51747100c88919d247efb93e150cd5c0da97a16bd5
SHA512f58d0c7b7b447126bc2f868bbb67a448f4faa0f72f6b38bb34378afde0401a308af1930c4d2f44d57bcc67ffad614d2d7b3a57ef914b1781623f32fc49942b6d
-
Filesize
5.9MB
MD50b2cc2a3a106fc92492be3385a32b0e4
SHA169000350f59a0b50c553438a9f8c8f9d94f2c89f
SHA25632baee78937ebb784cc2738f0267dbee17a79ce5cea1a711ff6927f1c7786b73
SHA51266fd5d5d98ddd26d52a34c9ed2a3eab2820754687be87024c45bb391ddd85167f5d8ada41f6026286e82fdc6cf4e9af7d9c51f11f62dab8626940064a030c46a
-
Filesize
5.9MB
MD58c4a2b7179cf220b05293413bdcbc8cd
SHA1c111eecfd4b8c00a420315c6295263108e986c37
SHA2566a3145441d6fb33a6d439f1954d315afa0e8f4faca574e2abbe48e626d35721e
SHA5129442e5031952f8011dcaafd2efb7b1c14643d52b270b976278309423dfce7a6cd694b310aa6516de762faa22d06825e1f86d941fb0c9a412270912f502203b5b
-
Filesize
5.9MB
MD5c3df010d63e9600d50934a4813855874
SHA1946198e50c96bc472a6f9536df3b92a14cbe4fd0
SHA25668b308c122fdedfaf8fb663a57c291b8e1274d84476854aad1f92d6d4e2880b2
SHA512ee1c23ac64706b9ce3fee48dee5112da50c93a2e7dd79b2219160879d7e4103a43cbb53cbd3e1ea7c35e7294859f65426d5b5bae2dbf876cf31218ad5da5238f
-
Filesize
5.9MB
MD5ead94c4beb77ee856ab0193135aaa5d7
SHA1da05230c6a75d2a5a55d9d415d33884ba73da573
SHA256e6f49fd373085607bc766d4c0fba37c7ba0d360eac0846d57e6894cad30bec27
SHA51229994dfd03c05fad58e093266acb06ba088bc010cdd75b816c9e622cbba234f0b11052ef1eb6eaa991c702be950a618208abb60a8bb6f68052b26e8912bd0e8f
-
Filesize
5.9MB
MD5cac94470e4818c25072259323006edec
SHA177369677f6d04bfe46477036d00d06348cf8088e
SHA256b7a3d3f6b04dd6455c4a865ac084f0aa3e129b13090b5c3bbc702351f46ba312
SHA5122c3d7d12501981e155793629a867f21d323debcce370f93c8b6229699d1d55cf4fd5bad4fd60f27a6c1da996c84a8d6714ed26ef93ac72ba3d60748ce994c097
-
Filesize
5.9MB
MD507635b291b274564dde56bbb3d80b978
SHA10d29ed76fe80800b773e07e83cb0b9846d0ca7aa
SHA2561510b70d8e4e55f915b9f942ff9f68400c9bf19eb5d7445666aacf4a64a37bc2
SHA51229fc21b1be41ed9c66dcfed6ae8efb2de674fc5d362af66f370bcaea513638c99571ad0edd5050229074b7217af90de72ca8f47e3279fe136dc8ff2653c8f688
-
Filesize
5.9MB
MD5f780697013f98925cb7c12e4748aaf87
SHA14a5b29cfd55551a7d5f4b47283b7d8d8c423d592
SHA256c57ba7aa0546097f5d651b186217780b1747c5b8edec412f8dbb8e1db1c568f6
SHA51285ea53466de3b7e8cadcd78c308e3597afb03c147d3290f4c4366c67b681f6ad8ea016ffa6d0640aff1ffa272c65954a6545f722a9837454ec25073efd865f63
-
Filesize
5.9MB
MD5f1615e4a7521d6b1b2c2324d228ca1cf
SHA14609eb7d832b3c81d6d8f701daee51371f45c01b
SHA256084e3b82496d2f3f96ed5b4f09ebcd395f3ad652548c5035968d2b17844180a9
SHA5122d4a8ea24e59a119747e2d0ca58c0a33712c0d1490af51c723b8619e1e94789043e5f0ce39138e56721fbbb49e6e84a04cb05f347ca4ac7c15478468e560a654
-
Filesize
5.9MB
MD5238e5fc735aab876f8c7ab2239fbd621
SHA106ae419dc8e4accf88fe541cda0f5e0581ef6f2b
SHA256c0b55335ef866d61cde1abece33346651c7a4a7b8b216349f52e15faff8883ca
SHA5123a15b1c38bc8344be2196e51f0fefdae754196150577998a0682b405b2c3b88dd8d6e793b485745d1056c4282b02d19850adaac7e4defd6bf4c778ad4a5db570
-
Filesize
5.9MB
MD58910f22e9395a6058282a9b82ba3dc8d
SHA17a7c2da0fa5d29fc7066b32ec1b6f634ee05e844
SHA256f2328b1fab295b7e0f5ef0a37a521e3bf90bfaaf3bc627e5e794b0f6c3fe05d1
SHA5126f8854b90d5803e6c7cc9bb3e1e2403ad1b31d3cb61cedeb79f8e66f95e69b5ece6e7d209909461a1f783450f9844924960ee8238b32e19c68dccd1941f98d1b
-
Filesize
5.9MB
MD5588d707f29df8da45c560d1316ffe8ce
SHA17af2beeea0f66ba38104abc7c1b34b3261101c07
SHA256f522008084b2b53ecb2b334da276fb0ef7d75308027fc24b5ff78f556cbe8f94
SHA5129af3222a9c39a5cfa7d1b60415c1bb4569327b9a69e442429c90179c3387e260241c988364a7f42a311e8606f3b8e94dffac8ced95ce8d8b1481bfd8eb4e8a1d
-
Filesize
5.9MB
MD5cd8d198c87712e6d643ef66c8fb9a7bf
SHA168b51dfa9447832430f85480054613f0f6ec562d
SHA256e7194d8fd4bfa7002339dbb78b0d4165cb9c753a825ce217f91fc5a0f7b0f5d0
SHA512368d573cd5cc333843e9014cd3b89bfcfcaeea007fa7dc4973c27a57ae107422619624d3c96f28eef97711700496bc5d522e059e5614cea5547095378e782963
-
Filesize
5.9MB
MD5c282fb0110ed92fc1dc5ae67e7ec462c
SHA11b27b65cc62438b71c72e68353cdc1937f79af0b
SHA256c92b49465c1a5a39e26d9e6b018bb3009e4d35a993e7cfba3fe0831aef2162b8
SHA512646b9c12bf841f83f9d4f5b1144058b1b89ee497ff8ba3ec65a570e211e0eea3fd8ab60f381e5db51da4ac910786b221d5f4792db641625b11827fa8614e176f
-
Filesize
5.9MB
MD5d889d7971cdd484130ee56f9bd1e201b
SHA154a878fca258526b580f233bd326519bcabac8d5
SHA2568bf8b351792831d2e1c2d759f6b8d62cac16338bc849224623a58997f9445f5b
SHA512f6ceb0536ffd7eea42651c5d035c3ab8e7aad4c0be9f9d909b1246e4d124676ec8ff0f5e41ced5a321f5f262f03cdafe4d7f9df45dff9197f14d2e4153b78437
-
Filesize
5.9MB
MD5a7a840dc6ef4fdcebd1ffb28d705cfab
SHA1a80215ef2eb5d5be52cf961c878d7d8996c09f77
SHA256e75826af573b0fba693b75457968fd70b35e5e9b38c10376127c1e3a264aceb5
SHA5123b79aad64943d4e762b0ed82f0b9148ddcd9eb1ee586e36d63d26e26926e703e25c50f9c1d67c7c6a26350b80c74a7d9e967f087241dacb39f154e259b9bb568
-
Filesize
5.9MB
MD54d3a4ca6d7a779e42e7c6333e42acaf4
SHA1d1dfc6276dc99614eaf26190f783caf854206746
SHA256fe5f58ad6a07ac9243ff6b7b73f8246d616ea5c1aea74e5f6a7e69d230fc4745
SHA512da893a6f70c4f81f4bec96e8d434873818d981bc316e4e68073447d4dd61132319b6549638524765c60965aacf1404eea754de137a2599ee28b009b95ba56ba2
-
Filesize
5.9MB
MD59efc6bfb63a1c1bc3b8d8238088a8677
SHA1db30022450dac045c799f4c6a42bcc93f3d37d32
SHA256157c0c7038bc38a7a64a405863f06ecad826e9726ed33a9f2c6a50aa964c5189
SHA512196d9674b6c7d487e6b952d3ea3fd0af956a27e15fd817c8f914ac7e6b1136f0e0b17ddfee0857e97e4d93c719d566ce21d5fa45ac9a259bdb8d4b149ccbf724
-
Filesize
5.9MB
MD5ccde07c897d43563a4e36a4c32c55c1c
SHA10eb9feedfaeacab30b4e85067a7966036fe4f86a
SHA2569e59aa87bb09a65ff5597ead8f2585f3a75abcfebf8afd680d4824374f5b0219
SHA512ebd11a4d8a562ceed6b194f5fec22b40e4c07ed583475652a4d06949eba23cb05e5456c41d071a2eb65e42a16c70c3a092f91d639b32b109ac87909fff328204
-
Filesize
5.9MB
MD5d3a74e7f047de04c53851db2563073f1
SHA1f7ac793563b1672d9a9c5a585955cf22978d036a
SHA2563500f57b959814a9597453412a45579f03d4c2baa9072fd925386b33dbe04a95
SHA5129c2eabb7b6888b71a4f3dbbeb1a15824307503d33bbbe89ffecd5fe07c7da7675454b69049fbcfa1173275cfcb782fbe6b541ba9bef47e50bd4d259a20b960c7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB