Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:43
General
-
Target
2024-09-20_3427f550ce026e87678046c870882080_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3427f550ce026e87678046c870882080
-
SHA1
fb19c5cc703f13b71d19519d893fe724456f8c8d
-
SHA256
64e427c5190af5d055993f8ca3c1012a34bb53a20a33422b7d47acfba0d7f74e
-
SHA512
c869c656dc9543b5f568d7c533e6a170ecca40aff839238539730da78d350673c29f601e4107e973fc4b686123ccd2763143157a40fa74f015ad7e0305633f71
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUV:E+x56utgpPF8u/7V
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_3427f550ce026e87678046c870882080_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_3427f550ce026e87678046c870882080_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lzHrtZi.exeC:\Windows\System\lzHrtZi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TSedNpZ.exeC:\Windows\System\TSedNpZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KDpQUAV.exeC:\Windows\System\KDpQUAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUoVmiv.exeC:\Windows\System\IUoVmiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDdminh.exeC:\Windows\System\kDdminh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVsMUoX.exeC:\Windows\System\HVsMUoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxPvWWK.exeC:\Windows\System\dxPvWWK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeCSrvW.exeC:\Windows\System\qeCSrvW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vcpJCXq.exeC:\Windows\System\vcpJCXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PEixqXi.exeC:\Windows\System\PEixqXi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GOnsFHz.exeC:\Windows\System\GOnsFHz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gBkYwaQ.exeC:\Windows\System\gBkYwaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lblxPQg.exeC:\Windows\System\lblxPQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KilpOIP.exeC:\Windows\System\KilpOIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lWwCAdE.exeC:\Windows\System\lWwCAdE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVRWQhZ.exeC:\Windows\System\DVRWQhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jXAyTJZ.exeC:\Windows\System\jXAyTJZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GUkKZcS.exeC:\Windows\System\GUkKZcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvvZVgP.exeC:\Windows\System\GvvZVgP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZWaCTAf.exeC:\Windows\System\ZWaCTAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sdiVbvk.exeC:\Windows\System\sdiVbvk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5441fa88a1ccc59a65989259cf8188093
SHA18c0ecfd493cacfc5fc15e772994ae040a90a3622
SHA256af90c3e1faffc3c415daa2e10289d3e88d2b3bf926b998425d83de4215663fb5
SHA512b29b2eedcb2859f349bfc82e484536169d5e7589e08746861b0cbe7ca0756cc84449d085bfbf3e7ba98e40f40dce7f980e6009977184fefc9c6f8367acacabc9
-
Filesize
5.9MB
MD569300d779b1c874767be0e9d4d8e5ef9
SHA17022a0a0fd1af74bd38b71f5e04bb3e87bece46f
SHA256723721fae29aca72ec438998edb334c8691dead8ea6f398f2ee398b48986a5ce
SHA5127d38aa82bdf6da4c728382b6ae0c2886a4cfaa30ae790c0aec8d8050148010e8cc6bd0fef46fa97e8fd806116a463109bf34932dea2e246c58854d022b60b963
-
Filesize
5.9MB
MD57d4a0e07228409d1f27dd07c3717ceec
SHA1cd296b5ae4ed4a096deccf3fa6c3ed79ad289fb9
SHA256f03a6c4064040ff74ba7e8639e92d8ccf468015cbadcdf47527155175fa8821f
SHA512f77b96d74669fc417812c8b624de0f6997acb9f671310ca9daafef77dd12e136cdae4e3b4c63e254e9c880c548e95edbb2b23aac52fc22181219c1ce528dd686
-
Filesize
5.9MB
MD5d1c13bc64c3720ff33fb03b3491708db
SHA157088ce249e7e3cffcd6a6353580d1b84a5d602e
SHA256d9cc4dbb08547b07ee2c0b3e29027dd4416a2757ba763e2bb2da6d769baf8bfc
SHA512b1dfc2e572b67b28e11b97ca2a6fc297b93efef3d282b987f07b0e5ce2bf3d58236856e5334d02ecec4cf85f1375c34d180bc31b7092918e286d207ab2a56069
-
Filesize
5.9MB
MD5cb8a95e096a5534fe692d927f3b737ee
SHA103982c1566cf6bf57e022f9353470342d26f2b1c
SHA256e727a8a9d844e5779d4b83deafafa817940f3b5722231fbbf9578d982691c17c
SHA51262d030727960b9a6f3df593337c2980d8d4617936d3fa9d5f26838762e3ac5c557d5194bce1d0cc0ed43f4a08a68b022a3b157c7c032b5e3dbe9bb5c324ad088
-
Filesize
5.9MB
MD59372d20fb1427a84a40d3e8637103191
SHA1ed1f1f009ab569611eee25fe77016eebf3ed1d40
SHA25632ce7fd8db9f8fcb3af299e8158aa19ab10672c05340402e51e873763a496934
SHA5126ae5a150eafc2eb13e8b050c25670bc68898704184afaeb56724a0e27d26d853f97f9dc1e27d819c68046ac5de3da32cfff4c3f348a4807f97b925542280898e
-
Filesize
5.9MB
MD5eafd009ff020d2894e05a5eb605786b7
SHA1b85669844b06a2be89b5faea0184ed24d8ed667e
SHA2569d5ad1c504ba377b0a0207830804983b793d0359516519db94713e4371fb4f8e
SHA512008b9c90d6cfc480eaa8c9a2fa7ed570a53b1b71ba05695ce8f649173c4769794fa1d9bfda7aaf21c7eff34e9095d3b47b96578570ea076445f09bffc05be99e
-
Filesize
5.9MB
MD5eb1da0ad772d6867ddcb5b1701e45c40
SHA14b42c482b1a4667c9dda924532ae42c2096c2448
SHA256445289740038bd842f3a323c76356bee7d70d446d3a422a380f4db90c55744bc
SHA512bd7cf1261f3edc635018b9f4c6a404f6285ef8befe70ea2666806e3a8be856729989ac1b0c87c917ded5a76bd085c640f998e04216d652ee32502fb804cab1c4
-
Filesize
5.9MB
MD557b7edb5cf924a7957118a8b51d42ba0
SHA122fc8127b5d50b70e2e053beef6d6e8894fc143a
SHA2560956db7e15b78cbfda8c4ea3bbbb5d9973aaf6215005dd5e5a352d82b0fd8680
SHA512ef156f6fbcfd291bce3fcb29effd54e8c3a62e83cecbf28b4c40fc26df7b217e1dcd2b405b07fa84c6481ca787e887baa6177b824395ac5a95f5b08763c56c72
-
Filesize
5.9MB
MD521b61cdc0cc040dd1d4b7df5d18f8e8f
SHA11383a8d169801fb8cf8990b17acfc9437a6d2900
SHA25634dd458f4e91e0be3f051b586d48256d71fc43e7499f5bd9de2039ef2ac19ad3
SHA5127d152e7968b86c7ca41b0bd05db437504b68717644345577cc1cfff4d5a29226447c5da7434d6661ce5b888e456bce86c52a73038dfa67ace15f47e70567641b
-
Filesize
5.9MB
MD5d75e5c486602879d61b28211c5200fa0
SHA1f92604b0f78ce6b5c214f665fbe8212bfd718774
SHA256ac0714185a40e25295d7e0a61518680cc153a25267a144e1a8877f40fdbc8386
SHA5121d5f2e162032424728a0850bb4adae4e3ac39021babcc12aa0cdc374d5fbe51014051f523bdb1c5a9cb008eda9cf1aace2fa41160f9e143e4a93cd25c44ae068
-
Filesize
5.9MB
MD50cc18d9073106376dc3f2eb01d2453ba
SHA12d58c76da60fc3351eccaac7e4e177acf170e305
SHA256aca33414549c6310ee88f29b3dcd4c27b8775dbd0443986025da0201c31209a3
SHA5120a70b3c6eeab2e8b6a82dfa23885340d14d60467db8d05ccce472e4c2a7c0aa70ebc197df7f1f5fd91c79bebb8f4c292a72981ef4dd4835f5109c7ad28d897fe
-
Filesize
5.9MB
MD51d1b61e1ecb20063e0481c2a41368504
SHA12874fb2b1704ea7411b18487d94adc67eae7a866
SHA25660ff144b074fa63cf76d11feda2f797ec0f8c24857543c54842c1119cdafd8ee
SHA512e0b0215efa39941df159ee9be9397d9a87ae3cbd357ee8b7213c00d2b1965de7074b5fbecd105a70fb514b6adaffb68b5324de532549902d4fc8efee0839346c
-
Filesize
5.9MB
MD55ee4577796e77b5dd834f7f83792f1c9
SHA1ae3240af33eecc4eb0a117f2da5c033a706f9709
SHA2569ec08b8eca0531530954184f26cceb7c13d026989793d2c9461304949ba4b5e4
SHA512a21db093fd1b940857db13bd50b3866a0be0fbf95b21864a3dea1371d1773d8caff38270bd68d63925324b2efd381358c16b42b7892d175f65b8d1d1476eede2
-
Filesize
5.9MB
MD5abeaa1bb3809211397120f8ebb848043
SHA1842385e318f5fc26db57abfd1778bc8d2a9f2580
SHA2569385ca2c6c5a16b2f748ef5067e349665f18e8bc9b8475291df7aedefa297483
SHA5120839b5117b2a39f530da5c4679f4fc9233dc4c2cb63d76c72bb5293b52a7901f1aa7418dd3542fba49f9b640032ab3f44ea1a151d8d2ca670b7ce6730bde4390
-
Filesize
5.9MB
MD58ed7ddc5781195c3340d5fd0c4f1f389
SHA16e1b13146d65f9eaec1dc6f7503d12707f1541ad
SHA2564bf3d9a7fc83069f387b364f1aa179509df5c6b454b5294d8e87ba4c2658576f
SHA512c97646c5419967fd54856fbd79936964689a96bcf0489936ba64f3a806e77185fe9c0d33410dc9f97fdb0157e8f2d8e58f72aeb9b13cee94e7accaddbe4efa7f
-
Filesize
5.9MB
MD59d3e8d2c5a070471ab0237dbc820fee8
SHA14b5ea098c6847b000acf0cfb0f149a75904b40a9
SHA256f51ae024021df5ad23100d7d4a1402a4d1734a5066bb39a9a0a3535799ae8535
SHA5129e6d209e686088c89725b06a9245ce58b39a22a958affcabdc09a36152b9c1011b813df98e4ea2c1c404dd06cabfe3e06874675a710eb5fd57abde739241da82
-
Filesize
5.9MB
MD53d3f80ef33d0b32285ae49ae990ff65f
SHA1aa23623df27573711cdf999dbba6bdc3a47114ba
SHA256e9bd8647a7f26a3ddd6dbfa34fb3c72fa774877734646446b25e6d6e5fd6626b
SHA51244dd544d9608ffa49fcaf5b2a690202c1978dbb0e1b75c85cec0a5c67a0507e811c494e684266c610ce23272045ff8d2d18d8f0a3a825eddff4c89f375b38cc7
-
Filesize
5.9MB
MD5a1e92d2545ff644aa62f3f696ebdf1f5
SHA19b27a7e6f52fd17a4cf1810f53fd0a10d8cfffb3
SHA25658b636321cb1bffb7a537d2f0ddb6406a6fd929a801b029eb670a0f0ea1ed871
SHA512fc1cfdcbef12330b4aa1829f742beda3577371cc5a92d046b6d649e144a8d5247580367ee7465cc0a5ae6f9237300ded60e4a0e90666a3d049ecaf6ba8066596
-
Filesize
5.9MB
MD5a1492a17eea90e7481139879bfbfa574
SHA167c37374997ad0fb7a7cfbfdcffd9aea5592ffa4
SHA2567bb610f1e4c9b75126daaf3005baa2a2104478ce9c079ed1800e0f58204d2f65
SHA5126562b5117fd775b2ad5fefcd493e760677411ed6de9cda45940feb389d6ef6775a41055ae0c384e6cb1c27d486ec441615459b3cd042af31ae9f543b84d42676
-
Filesize
5.9MB
MD5fdc97dfd89e193a53294108e6c918d44
SHA10f6594f50aee74243eaf9ecbe0fcb6f2f3e5b08b
SHA2568b452a88bb7d7e0b65398a5874664c75c409c1cb4633717b59b6ad13ee7478c4
SHA51249bafdc04b748b15bea69ae7fe90f92bff7c497d87702cdfdb0df6517b7587805c6aa24020ad40d1060391dbe87a1c037a434f2c925eb7516381c16ee071c4bf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB