Analysis
-
max time kernel
127s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 16:27
General
-
Target
2024-09-19_f5c91f6f6d830e4d1afe07f7856cc246_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
f5c91f6f6d830e4d1afe07f7856cc246
-
SHA1
12ad2f47241437d5a10c742d2ab8a5650561af31
-
SHA256
c20856c5e745bb9de9f695b13defd5789671ca14d119bb1d1c052a7e1257192b
-
SHA512
942b598ea3eed15437749b739e9613e3f8a753bccf1843d82718deb76f28546b30f2aa5126ed4d0b318a487a9175c51090cc7948e3b3f0383408f260d2ccf535
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUO:E+b56utgpPF8u/7O
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_f5c91f6f6d830e4d1afe07f7856cc246_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_f5c91f6f6d830e4d1afe07f7856cc246_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mcXYukE.exeC:\Windows\System\mcXYukE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaueCfA.exeC:\Windows\System\VaueCfA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oViKxFx.exeC:\Windows\System\oViKxFx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WnYVXYA.exeC:\Windows\System\WnYVXYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kobIDPQ.exeC:\Windows\System\kobIDPQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FhkPyVW.exeC:\Windows\System\FhkPyVW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zszsZvI.exeC:\Windows\System\zszsZvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZkSPJtj.exeC:\Windows\System\ZkSPJtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oqGwiqO.exeC:\Windows\System\oqGwiqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ynkRxzf.exeC:\Windows\System\ynkRxzf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mTluATf.exeC:\Windows\System\mTluATf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yuOazpk.exeC:\Windows\System\yuOazpk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\szMrAPf.exeC:\Windows\System\szMrAPf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQXkxSI.exeC:\Windows\System\RQXkxSI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNFIqmW.exeC:\Windows\System\sNFIqmW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvhvRAR.exeC:\Windows\System\QvhvRAR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ktekGYp.exeC:\Windows\System\ktekGYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QHtinSf.exeC:\Windows\System\QHtinSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cBELAWy.exeC:\Windows\System\cBELAWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TJthuWE.exeC:\Windows\System\TJthuWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lKznynp.exeC:\Windows\System\lKznynp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD59a76e3f49182aa524e193ef6c37281fb
SHA1653e9d2152e88b4d58d0310a5a6624ab7a3107c0
SHA2560e0e8c6616b08ddfb295bac4f848481b74f2d0a0c6ca6181c0897336dabcf47f
SHA512f072540ee64d7f0d8870062ffbd001096974dd9d3625f903bf775ec0ec6ae2f520035ce45bf7e2aae846bb8ebdad5b120319df6f6a33e9a7d74263b9f0d8fc49
-
Filesize
5.9MB
MD5602e6c14d5374b84446c9a00eb8ca217
SHA185d0e40052a8fec508df6a06f474ff08f09719f7
SHA256576486c7079fb82e1cc68527896316a7969d5a2e4b5945c51f41288c31ca517f
SHA512ddf74586eaf98553c4eef4cc8bd9d88fbb6bdad03226f53aeefc8464eaa373be09cb4f55b0e38a115fbb3af48b2ca8a08255deecc85e366a58e6c2aae1811066
-
Filesize
5.9MB
MD521f78b46e70a0a48d02274edb280205c
SHA113c2012817c5c9d27e13c86409d1f002c852b40a
SHA256680b076192f6dd186f2ac09fb0501ce2ce084b71c4ee90149df21697f0fa2ee7
SHA512c51448bd6a84b4939c537a036795c47dc4571e4db36cf34f6c3f8e50f1c95f98ace764fc223a4df7b65e88241a86ab190b2e8f9ba492df7ab625a3660a535355
-
Filesize
5.9MB
MD50614067beeaf8294c2b81dfc14549711
SHA159fdb6320228f199958bed850b83ee50f530ba78
SHA25612c38c133197c381f8759d95ddc65ea9a202f0b5d81a4aab3d364ffae307de5d
SHA512f90640ff5eef76e610702f1bbdf59e9310164551645e36342149e80fb0d6d0ad1ec96a61db3df3550a88b4eb7dd47c89d3c7ece518f71941ea312cb578a8042b
-
Filesize
5.9MB
MD5c831a1b6c3c228fbada9cd0860bb02e3
SHA15709b692e4969ccf7a1b564c04869ded8d4ea09c
SHA256cf177d71eee5a0fa3fae36260fcae4d2464c6283b0b66025a554b3aaf3705693
SHA512137bd4d9947141a00b4db082f1ce4b802b757d7b68c38b264a7b85e97bb2476b34e572b5ec546ed67be3422f4f6e5f1da71876d60a83b1556f29522e50212f29
-
Filesize
5.9MB
MD528328e7b1b27f92cc2c5012774c81a8d
SHA18b831f68cc787534aad08951e7fa9956f6b54416
SHA2567ebd042932af568c82e9ecf1a59d77641f7dd4a08df7f76a0438eb2efd5e45f5
SHA512cd55d881bdf146b5ac07581ddf7f8b61111fb673d5cfe26209d812e9e8127ea3da852868255101b19da2529fcdf971709594c62bace3470c09f60bbc0d2aa391
-
Filesize
5.9MB
MD54a6b68a75723d68e2eff1f3e4b654918
SHA191230c33c01154be063e4340a7f3dff4da12f789
SHA256b2905629eab040cc9c66bcbf4b61142f81740486c93725896aa2e8115312e453
SHA512433fba186b55fcc0aaf85176051603ce3c246245f125aa5b667a4e097cd7a79f89b0d2fa9e5893b0d8384be54af95b35e02f1ebcff7a9749880982e375861dab
-
Filesize
5.9MB
MD53d0280258ea529f7fac780013e16bdcd
SHA1ade654fd8580673eaa9735bf74102ff523ba2323
SHA256fc2fae08cfffd1676109a266dd67642173eafd79b703560718edc987ca50fd30
SHA51293879cf9a7c94d155499b5429916c9b0c0b12729b09139e59039633cf5292470a47cf22160e9e7cfa765b646e1e5d7ac9f539e906e67f01656533320ecdf8f95
-
Filesize
5.9MB
MD533cce1fbd48c1bd475a415ca848268b2
SHA17ecf1c77adb76ea4426bc59adb49e711300428df
SHA256f74249bfa2c9ef26ec3add90663c0aa005a778cfda5732dd50136286e544f37a
SHA512e4685e3b9750a4e16f441ee55d03b8d23ffc5d998a07a529aa29f830a915ebe6b9231f07e938e2778dd865dd80f4fc48bb808eb2dec0b4eaf7fabc1d229cd614
-
Filesize
5.9MB
MD54875c32f28d62d7f589998bd0d2db1fd
SHA17aa402009c6376fcb4951b8fda9316c8d1d13e3b
SHA2560ac90010bb6f7f634c536f63f4be0991a097fcebd7d00af140c865acdc2f0b22
SHA5124fbb8a8c6213f5e02e28805bbc6647e6a3fb2045b69189a5c515a774d07b5c7838d2ea46412f5b0a30efe8a5f0130c337c79d67a134bcb9f516cfba0ac9a5147
-
Filesize
5.9MB
MD5ac10a65d8010415946b0ab7d4cb612c9
SHA189b704880192858ddc73af15803ef6c733ecb01d
SHA256ca2a0b224f9935d617859aec7bdac6dba7eb6c1228a7a7aa733c4925fcf8ec19
SHA5127b6b8b1ae9c9ceecc66ff4b694ced6bbc241fef5eaec447cea334bf7a1bc41645f6df97ece4bd937d8fedb77807849e8aa9a56a4ca93ab52bcb7aa0ba73f8edb
-
Filesize
5.9MB
MD5ca4822328d4b5dbb6d19c78b5e41fc4a
SHA12837fb11d93edfc2154089d05d0a40b58fd8d87f
SHA256cfe1e8fa294b03c2cf418bdb78f95c02757522b69cc44761938e0dc211f5ef3b
SHA5120a351e98da714d0fdf2ff5f529d64b7f88c0b4f646f45740b10b53c33bcb6b5843c2c6a266f51957b46f7c4f2dac3793855e7caaea75089a5a2783260ad3ddca
-
Filesize
5.9MB
MD5b5b1cc839b7dbe0b0301a23fa3a84cc4
SHA1a79e476e46019b48c0e129f95903137f839b2208
SHA2563a13277b49b195240138442c9fc6ecc96bf67fc345c4d4d1067fa4300730c6fc
SHA5120d23d25e165c10134bb86e7ec32838988863a41ef55b0210e7f9dff5b96ef14d8bfa520b79aa997deebb3bfc30775f4fb9159c4536c13835f2b8a2cd3b9d6046
-
Filesize
5.9MB
MD516f81298509b29cf0a606d2d70bbc3f7
SHA10941279203a693efeafea4cc4f5b666c163472d0
SHA25611d4e8e136a1d3da7364e764872edfd3c53af3f43229e8982fc9947c77634ae2
SHA5122373cb43733998301469588ca8b743d88b1e3eb70ed27d380ced768c3d740fad20f7d0ad1f174559df3d10248ca451e374a547d16f17c7a174165b63f8848527
-
Filesize
5.9MB
MD5063195228b0f0f66a3db954fefcdf1c4
SHA105c262ea830bdfdf71e57aac8615f6fb0e541855
SHA256a536ec99f0f09c99b5aaa4fcc6ac8ea90498c57fc39fbdfc306ed7529cc31ea6
SHA5121546e6a3e27381bace1c68a0778c95629a8d103ac429f4619b3c4a8567eca379103063b250a709030847ff91a95220f060e25aa0fcb5a87dc8089e2c34663c34
-
Filesize
5.9MB
MD5024aa9d178df1f3c713e37c6b3405d3e
SHA1e3b65428b597906babbf46df790afd7ab2ec90c2
SHA25680a9ed3df89e3de0860ed012e2e44634fd4656cc411a7924b78cd1593a3b9906
SHA512ab06eec6c93090e4c60e278f17b64798220cc87a075bcf5eca07be9042cbb73374e448f860a49d1bfd46d782a96f556c5de608a326bb5b3e38c392f85d23c751
-
Filesize
5.9MB
MD5325574010f3200c59dcb1685bc05c4aa
SHA1d57e42fbf0f2f21740c4cf78cf3f55e38cf752b9
SHA2565978ed22d31808a213d76b317ba521716641f8888cb46f812aede2437abd83f2
SHA5122cdf817cfd0f6c7b0644ef8bd0e2252a671caf10fb2860aad08a632e19af811a011d5207c909636c2f5f650de759d637fc48a48dffe34efc3ca0852376e9ead7
-
Filesize
5.9MB
MD5c6389009e42ab7a2549e13597958ee14
SHA1e26254aae06ee0a5ce423c0c4dcd0b90ebf44e9a
SHA256158bfcb994528ed00b0747204dafe938285017e7adbeb8928e35f5389459b488
SHA512ef5bbf80d28b9ef7944c2ba5d342c00cada5cd20ffe7f40ab51fba1194cbbe45b0c52beae2e61d68751876886d052f1a6c10a14f765d168090bd670b54d117ff
-
Filesize
5.9MB
MD51bc1711927b12eefe54c532c566a6713
SHA1384d73c4f601f926fdc74ed335dc431057002f5c
SHA2562c232281cdb7eaacacf60c7afe3d78f6254acb701f36f31d3362a075121d0dae
SHA512706488cd8ceb77750342e05736f3ec9a94f33d7502a74f66c3aa7dabee37101263be8818c9af82799e504f68e735c1e7e4cf9f6c886536698a5b9b8f9f2eae0b
-
Filesize
5.9MB
MD5ab202fbb6eeb7aa112ee45718cdc7fb7
SHA1b37339b5dd40628aa80a45db8c05e5efd942ab7f
SHA256db1b8d8a4813d283922c87eed41a7a89f4dc6e762dd8108d426bbda2e38002c5
SHA512eec3bd4c94adc0cb9413210ee110d3b2bd2d66f5603161b549dc6e07ccb42dc685c0a7e4fb7aaa98211eb32ff1573a6fdbe06105068438ce187164cab87e024f
-
Filesize
5.9MB
MD5b0e20c84e43b523570cf2e26e059310c
SHA1e77397452757647a1f1eccf5c18a09a008c25362
SHA256d2f61915103949e416a245080ae8990062b7d23c1ff2070f1708597609a2c6c5
SHA5120cf0f35c72afe2ea79c2102b976bd091810036fe066c2a08031c0ef277d1e2eb25150701aaaf9318456df67f73cd13ac78a5651c8ccb857f3b6f1f09ca73ae9a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB