Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 22:03
General
-
Target
2024-09-20_f26b0ee24a5bfbb6ec1ccf10a1827178_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f26b0ee24a5bfbb6ec1ccf10a1827178
-
SHA1
a92155eecc4bf333d443cfe5742388623abfc76e
-
SHA256
10922e6a08be17974f4fe3237c46993df1aaa1f4f9f25cc00efdc4eded4ede55
-
SHA512
c07555718f14e52c9db5c03e9123b009ba81174e494a3bdf08d46e5e8dd17038c2ea6a1002f97452212ac34da20ce130c102937c78c5c6b6116344bc8b03a9f4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_f26b0ee24a5bfbb6ec1ccf10a1827178_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_f26b0ee24a5bfbb6ec1ccf10a1827178_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gjuETuI.exeC:\Windows\System\gjuETuI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NSFCqLj.exeC:\Windows\System\NSFCqLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hAfQqpm.exeC:\Windows\System\hAfQqpm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pojisZw.exeC:\Windows\System\pojisZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQEKDem.exeC:\Windows\System\IQEKDem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISSYHMI.exeC:\Windows\System\ISSYHMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcYnCvA.exeC:\Windows\System\AcYnCvA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kscrHUV.exeC:\Windows\System\kscrHUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XURZPQY.exeC:\Windows\System\XURZPQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYGQNos.exeC:\Windows\System\CYGQNos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vlxRkoy.exeC:\Windows\System\vlxRkoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYhxpan.exeC:\Windows\System\MYhxpan.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbEwQEV.exeC:\Windows\System\PbEwQEV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgdjfsY.exeC:\Windows\System\wgdjfsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwFUGjO.exeC:\Windows\System\TwFUGjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mezpJHq.exeC:\Windows\System\mezpJHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hoVFPEu.exeC:\Windows\System\hoVFPEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMVArTS.exeC:\Windows\System\YMVArTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvnAHMi.exeC:\Windows\System\lvnAHMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWPCogx.exeC:\Windows\System\XWPCogx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIpTtgC.exeC:\Windows\System\SIpTtgC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a50d1b56f9349d495ddb05d6300158bc
SHA1f3fedacb46cf96d740055bba939f2fc4e66449ef
SHA256b58496c06131d635e42e37a67f38be67776fa231d735b6cc6b6fe1c4190fdd30
SHA512888481a8841aaab54a49326607217800df041dd8f38102f8dfc2fa46190aa4008313e9065442fd6ec435039c4f6e337c95f27b94ac1020880493a63aa360ab24
-
Filesize
5.2MB
MD5210a1e65c19fb21b976121ab296ec1bd
SHA1c023736752663fe2b6391f142ca4cb4edb52815d
SHA256333393e1bdddbd12584ba78fb532c318907de115182f167de05b675a8c61ce33
SHA5128464ace203616363b885084c2b0d74864f6493c0526a2502a018ec9180dd1fc3e7c561cb4d11835242bf84924cefb5427c2e3a8794387fd4371e9d926626d7ef
-
Filesize
5.2MB
MD5b77d7a5d155f3f06039163d6c7f0664c
SHA1f8d83c2997382309da8ffe0e90ccf68f9f0cf910
SHA256df6c966d2bd1abd2d62f22056378ad1b5bb91112b5a92732296d805d6295c126
SHA5129c051e3d1f65ecc546efab95156d3bf4bde8c43e06cd0f622cc2c97a5dfb98ff1de14a483fefe0a9999b367f08e1f66b3af10168f2d70e742aa2f99a41ceb65c
-
Filesize
5.2MB
MD5de47b7a710df2faf3bdb437ed3c2432b
SHA15e3542d74608b4b3b8fa0710b34da5de8eac7bf8
SHA256f67579bf0d63c798e58a1f15f81c60e32469b3401937202996bac51cfb9ccae8
SHA512183e82c5c909988f3afa0f5b8da1af723c09fde554bcb1399e467823507c8fd6ae5e8450aad332b4c630c2ad00ef43a5f52259de2606a414226950dd1ce046e6
-
Filesize
5.2MB
MD59dd02518cbdaee472035284bcdcff18a
SHA1c317f1f388328eea1ead9fb2590945c7bcaa860e
SHA2563feb0f128a0e19d83b7110240a9118c090d16574b1dfe436df5633dbb812c0eb
SHA5125797b0fcba717be2ff5eb174a4dda8b77cdc1764855191ce6aef5d9d9002122d10c4ea32e13aa87e72e2295011d03b371be754c2630ff40cd2ed25051176f301
-
Filesize
5.2MB
MD546f2d615ccb7547b0f07ec55d94a73ac
SHA11daeac71a33fe86c8da23f443ab81de1d2df0ee0
SHA256e41265215b174a058856ff835a75a690402b6645820de43ef2605048a565f4e4
SHA512af03981b4506f380cb93ec600d0739a551fd462051cfa8143d8e3cc2c50ff8ee6e2615bfe7581671b183978478364e9c881df22902b57bdcb0e771f04680b4a7
-
Filesize
5.2MB
MD569f0223f70ee1a56bf40df8c4580211c
SHA1c0cdcb8e96561f960a229471f17f60986709852d
SHA2563b2078f90d063fc8a536404941107b2da4a800ad2ea9df77c2ae0c75cd4a5739
SHA512cd3bfff516828fde3d3bcc68707ff0c2040ea07e887b5a1bfacaba9b1ea2a95e8bead967565d93b134c4fbaa1b710294bdec71fdae10263ffc54db8d84e51bdd
-
Filesize
5.2MB
MD50e4e020b03e8aceab889ee74e5b4f059
SHA1017350370edefece992b4eb5d8f8c4038dfc7caa
SHA25651a191259325c153553cf308121a584f747847b95550a94ae5acddfc8a48e2d7
SHA512d3884b5b5f6a33617cb3df59406094dc025f59c02086b081f461166366448b998fe3b960d0811a3569d6f192fe77541acd4036c3ca76c5f1ffb2997e8f0bdea3
-
Filesize
5.2MB
MD53171f1418294339710d3ab30c1db360e
SHA1fbf622effaf27659ffc839be9544b204927c79f9
SHA25618a4bd04629d58e732227f4a076bd27a5430a4b842cc40affd2f5ac17e08a648
SHA512ac4090d184b97db16b609896d11c5f07254d5f21336dde417289a682b073689bdef6a341fae8d3c74141f42ed9b5c91cd2e34302943925ef4767eb9cb1ba77dd
-
Filesize
5.2MB
MD52b73a6021af837881dc8afb7c54f46d4
SHA1a86d6fbfefe373ce813fde4b124ed640883a082c
SHA256d9c766a59df4ab32c5912c959fdaa238b6735617da2e7b31844c0a4bced279d5
SHA5124a9c6ca284045bbfdd35c07d08c9ae6cd60fd83893daedbb3cfd7c664f68142ce189a6f5f936320df1514fadc298b2f929e719112e1d522da4ffd72987b4c16b
-
Filesize
5.2MB
MD5c1703be1513a6bb6ed5a5e035950bcaa
SHA16f8a2f5cd97cf6a925501c2e64559ce9fd78a7ed
SHA256025485b2d7a3e40ccfb3c01898955d81b7ee44870a155cb82ba9d8e93f748515
SHA512afd08d98bca4ae7ac575c04c60c8a8b3ec344266391ff3eefdd18c12c544fb8f2c1b897f368543bbc6c679ac1c138507aadccc13a8d92f4bb705bb77f19de30e
-
Filesize
5.2MB
MD5e7d0d7e0d54a8984355325232e2fad70
SHA1a0ade01d4be6ae1106baf828f3498b334e9f6c18
SHA256842f8ca4c2a8517de244edfaec285032e60106bf7500143579baa5bf860b3cf8
SHA5127f2f43d9e113269184969fb9a1582f9298fd0f2bd48842e8ac5ed9edfddf13630a02173fd4d0ab8656a13947d1ccb4675c30d9b47f3ebadddaa8bf29235d8d7f
-
Filesize
5.2MB
MD556014f01b2effb037027eaa7f959da61
SHA1a48a7341e03cd6e5e234915801599674f89ceb7f
SHA25629e2e72a6f70171bbede80bca6d1d62d4e15fc670d9ddb32473e1a99a1d33844
SHA51240c884d26cc30204ab9b0fc855ab09fb307b5e0d919090c089d26f82cdb27a30d75beb4eefd3c797099f75f341bbcf93ac5bba8f6e1b69772bc9254a1b498ac5
-
Filesize
5.2MB
MD525eec7257ffe3a4c9b1fd0d3ac2f2be9
SHA1b8f9ef79c45faeefbfb42b37feada8ef8aff9758
SHA2561f8f78e0120a086fff549a199803a282d8762cece76521ca672e8ec9ef18938d
SHA5125ac828e52c378ffdc10e65dedb649aad35ceaba07e6f042756db3122cf71fce70b0855ba6a8a1be6bf06439e9320f379c5b466eff98b981539287db4630ac995
-
Filesize
5.2MB
MD5c173af4e183f4d0f25a44d28c4ba5a73
SHA1980a98924239b5a27fd7bd33d15418d1027bbe52
SHA256e35731a1e81ccc953f99a5a7e9fc79a093adee3471cb4a5e78e897c6724e1617
SHA512e5bdac6a74f5478d605dac785f0d08c4cd6e3485858c81d6a78f0c331e0a7bd3c150cc1611d6c1bf1ddad00c5535d386d63a67b2e75c020b485a6edb09590b09
-
Filesize
5.2MB
MD56ebc4f53f01280d6ef00f0e916140f58
SHA1fbf43f09522008d827612061fcb3ead9f19d8320
SHA2561a42161707207da5de1e06b3d7c20fb8c9a74eae64870c82f0fac13635ce363f
SHA512b0fa60fa4805ee1c395fd0a0b413101f33873d97cf867105789c7a696cbec9459f53a910c1967b054f04980db418d214e24c26ef05924e285fe3143a3d1b3512
-
Filesize
5.2MB
MD5cdad39c2871bcc7db7681d41ea86acf9
SHA152e4610576a9b09bea6f87c5625f64a0672ee7b5
SHA2569cce7323a79741bde560d3a755f2c8efdaf58baeec06d9ef0f451e7bb1d8258c
SHA512822e0f9469cdefb9a8dbd42e8c6fc27613f4247f9c66eaf80d3c277041940180416d62d3d5d4cf89f7e45edb1e1f0c4e9bb0fad9477858607e44b301f744c897
-
Filesize
5.2MB
MD5552b0741c95bde5b95cbd16896638abe
SHA1083c4edaa151179884ec64965537489525d77761
SHA256b82597092c686e4f07956513c1f09e7892c6ef59c93a86ec684aa4950eb908ab
SHA5125ad77a49986bfe159bc37d1ac8d9e7b03aa1d120989420d9db5b8de78a212f5c34bd2ab9c38727f7ee2a548d5dad57f13a302002ea79c8189f413ef20411bcc9
-
Filesize
5.2MB
MD516c20cdf42001a78e4f3997090303612
SHA189124bec8080a1388a4699f9c3128dbbc8dca536
SHA2563277c183a325783374048b92b0263036bbf82972324ec8b4baf9a5169ce517c1
SHA512ce0e9dfbcfc8404179bc530446f35e44413721febb12e4e91d5452a7a5a9ec6414491b43f5b556d52c93d5c94b36360512e01f3771d08d4503ec7e6ccc201983
-
Filesize
5.2MB
MD5901d6e870a400195ccc7dbc8ce66a2bc
SHA1251cf0eb9f4e1d261a753a40a4c632002d0d4ef4
SHA256aa03047ee849240bc9d97eb835a265d6736b8f20e35828ec783a90daf51a65d5
SHA512b227dd6e18c749840d87ec78ad10ad5bfba39b221363a46089e20cc64a6be05a35725fbed4539a346eab38f89f3d44726bc9cfcbad1317b254d2a25c34abf70a
-
Filesize
5.2MB
MD5498fc8fa40d6cf1655cf7be47805bd8e
SHA18510acceb1fcb3b8abb0b2052c7d3cbfbe0f59cb
SHA25648c9217d0d5202d0cf0710e45aadf013c8e66c2335b823de65ca8c4ab0c1a7c4
SHA5120cba1aeccec52a320a3ae77ec9559b22d6ffedf28f93c81c463a6bfb0251be637cccde86c30db33da55d021f4c897db4452c54576d77dc2c05608bbc0f1c5c8b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB