Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:46
General
-
Target
2024-09-20_6bb7b571f40728d12ff670c6bbf25811_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6bb7b571f40728d12ff670c6bbf25811
-
SHA1
78597d56d7d2fb6cdac20db4cedda99234a95093
-
SHA256
6320fd20e1016897daeee764dbb97a2ebf8c54370c6d4c985a7d58c5aac692ce
-
SHA512
8499f21d5c3a47624c8d4dbb073b87fc2bb2f943d9c06256a0a082eb60fce440991fe4938282c073fc6511d18acb3d5c45b11459422715115ffc9cdd1b280bc7
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lU7:E+x56utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_6bb7b571f40728d12ff670c6bbf25811_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_6bb7b571f40728d12ff670c6bbf25811_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UUwGWpa.exeC:\Windows\System\UUwGWpa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGbgHHF.exeC:\Windows\System\TGbgHHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nYfOlTH.exeC:\Windows\System\nYfOlTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjssqeV.exeC:\Windows\System\rjssqeV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amIYXkz.exeC:\Windows\System\amIYXkz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOYBFHL.exeC:\Windows\System\qOYBFHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJALAvH.exeC:\Windows\System\eJALAvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWDOpMx.exeC:\Windows\System\SWDOpMx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KlPEviw.exeC:\Windows\System\KlPEviw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VVHeLnC.exeC:\Windows\System\VVHeLnC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTmTjNs.exeC:\Windows\System\oTmTjNs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qNDlsBV.exeC:\Windows\System\qNDlsBV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pymlMwz.exeC:\Windows\System\pymlMwz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nMjtwii.exeC:\Windows\System\nMjtwii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLWsuyS.exeC:\Windows\System\rLWsuyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUcVAAN.exeC:\Windows\System\lUcVAAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUTzXMI.exeC:\Windows\System\QUTzXMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTcqFyx.exeC:\Windows\System\TTcqFyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArZtLMB.exeC:\Windows\System\ArZtLMB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSlhKAq.exeC:\Windows\System\vSlhKAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvIcNVv.exeC:\Windows\System\tvIcNVv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d3c410232c701e536ae3adde90b7c9d7
SHA1dddb5e4714dde3e7e9e23635ec9f41a2b47a6303
SHA256c5dbc7fe1e2b28eb59dbb01e3e48f0e58a6eb7a163ac20743b7eca552065652b
SHA512989ce1f6da2466f42cd5c8334c9339e6b089b6f501d49b0020a61bf4035d8045491f3a338b63b9efbc4a77198d08dd75baa5403646fd32cbf236e080befb9a1e
-
Filesize
5.9MB
MD5695d3ef6edbe43be1630dfb64d46a4a3
SHA1a64e1ddb68254a3fe843a5b5ca16b285f1e94311
SHA256429e4fabf7cf7e7f9cc547412b0b02bbc54ec766c5af3e39b0d1ce01b9b47059
SHA5120e3f5717006d095e58487c7c2c90042c70c1d90571cec3f9cb8fc72a53fca7212c342da1fd7936d334ac13196a59affcf8fdc5b01b89c17dce666bace470dbf2
-
Filesize
5.9MB
MD5e829a6b7c9f99139e561f2b32f2c4e04
SHA1dba9c25fbb270b9596e16b3e11866b53ad2768ff
SHA2562aa9e733ebf6c8e7465e54b5bf8a272bde6ac32203e8659bc6d0af3594b2d62e
SHA5122f1c08f299aaa234b7295c531540ed9f0d971251f7183b4545e33299cef0cd5019261a06bff981b6e5d8e6d15fe95da9a2942a1f1c27143f47ca8dae1a4037bf
-
Filesize
5.9MB
MD5996b4933ebde927642fdb3662e785591
SHA1c67915ccdd32504459b4b981644ad814548311aa
SHA2567366c263f595300c522417b93986974aaf0f11386ea38d15e6af462d358d0576
SHA51253d811e3034b8d066b3033a69d481298503e1a3a57e85aabc3c3b20b33e205afed1278918d315a941e4f52afbd7034b72adcab90363260aa60433d657ce9f1a2
-
Filesize
5.9MB
MD51d42311a7072a2c3eb1a9ffc845a7dcc
SHA177be4f2aaed73280a013b9cead32c4ae1b4f996b
SHA256158a76819aa96d7f0e73c49739ddfad4da67ccf9e4470a3a32f1b6557fd8f9b7
SHA5122d9b63816605064b42e1841a7f03a0360c2b801bbc70b1dec0e78577b2e27df3f89237f3829770eb5ec0711b5b0dd4909fc0b14c96ed58b4504ce71279187a76
-
Filesize
5.9MB
MD5f2761c03038b5bee8075cdfd324271e6
SHA1af7007f8e395502aa822919e962e5b19b7f37dce
SHA2566d697817f30eba1fd18abc6900abade21b0360ee9e1eeb7792aceefa169324dd
SHA51275c06e19d9cfc7e45d566c4da0980c91ccac21a870228492f906b277f000a8e059b74655e52bfac556b2a02482e62ddadcf9da5559cb9afe6ba45396b1b8021d
-
Filesize
5.9MB
MD585a1ea5a23e191d3378bd8aca5982c98
SHA15ea6e02195780ac9d649f35e39921f8d598a911d
SHA256c366d328b4c03e6148ec68941f3771f3933e9de9c017918a4d0c890ccb5b89be
SHA512de4482ee0a7268525e425a308760f30d4fa35a9f142954f17bf9ede69ae1fab4a69e1fcbea6ad4f20bd72d6b1cc01c35000b234cb1876b5f603b7c0d5fe650be
-
Filesize
5.9MB
MD538848c69aa89ca23433f81297f008882
SHA19a12750cc50293da31efaf412ea17a3f96ff8af4
SHA25698a6a9e889eb7875700cc91f9059e27703bf7a57b96c8bb97f5b4ffc2416b9d4
SHA512be0dcfa813fa2f6d0d2929f765b4a164c24c7bfec4c1d8ec40233fcdbcec9cc85fed796b53d658fc1e9ecf19783990902f23a51fbe7b05f2e26b6fdd6c78f719
-
Filesize
5.9MB
MD5783390ec2ba39f4569a614efc2308896
SHA1b23fc429b448fb74414bd24dd05d641a280578d8
SHA2560888d986c372b58a170b92258877684bc744fb098f6dadf6ee3d443666209698
SHA51295b1720e7f00f42c7e8da534fdb9d73bbc20f2ff0da9a5ac790ce567cba444409f9bd81b09fbbf564fab148fd0edc7a53db1c67b1c6e5aa480629bff582fd774
-
Filesize
5.9MB
MD546ec0368e84db35b6fd798a84c966c92
SHA1b624a51b8ac88e5895cab36909b870324287184d
SHA256a1addd16935d2b9f5d12c4f9224123828317a83e81f8e755c041bc05037cc853
SHA5120830af91e5de04506a4089eebb2ee31b6ddebf061f3654f46b344727e7917afa7dd6ac6f748a0263a3e42c11df66a2ff2e093c4d36cc0f28f546660676bf5bc0
-
Filesize
5.9MB
MD533c7a4f999e6c7887b86c505f986d7ea
SHA1f2d894bebdab7b5fcd2d043b2f41ab9cfb313c27
SHA256955dfbad94fcdfff8215d6fbdae5ae2edeae1921fd42ca0e78d2dc601743f3f4
SHA5129ead56fd1a9cd56e088eef40301071408b3ae0bfb0862fed6e9a5ba77f0d06c00c52c5c30ab8215fa3dcdaadda5d580f664a725555623b0c634256ce7155a073
-
Filesize
5.9MB
MD5e7af4a4fade4223df0efa5686d67b8ca
SHA17a1745b11715894fd64459102e7673e77caaf0a3
SHA2566dc144aadb94fa49425c45fc68bc74b1d81a07c0eda4d852f29b875c8447dcd4
SHA5125f91fda52697ab1d95b4f49bc51ad7b2954980fd09ac63ab4407521d22a5a9f9aa1b8042f84da5c52768ca0083279734b63ba8485d1588a239a7f48db10998e2
-
Filesize
5.9MB
MD5751b563a28711411831a2a83ad3e4b0e
SHA1d33a9cd7122d320fb79eb29b9d5247655980a58a
SHA256512a98b7f9f21b5e28b0bb1e1bc448bee52f19fc8133823b0f6fa305fe46c1d4
SHA51260a18d4ce0beea6892b8937e28b40d8308843b07327818754e8cf209100fcc3f273ac38df57f0ba872aaf1ab41dcf29b503652d5bc23caa520f3b124881e96bc
-
Filesize
5.9MB
MD59c5ab41582bd6dd1f9733d90f8a2b5a0
SHA11d92c44f7c7cb2665e719358c18071ac3a3f69f7
SHA256ec5626f26b1559d0d9706a86751932398cb9c81cc5635d90be0547e538bd902d
SHA512aecb6fe52ea6964cface1dcf97814e40178e6efad8fd696b6ab163727c93ec39451c7ea6c78a8060ca7e5c3ea034929b9fb18dd5f9b60d66d9fdb4bca8dcdff9
-
Filesize
5.9MB
MD55ee7796cbb58b33453de3efd0523e139
SHA16515ec37bda9dd8015e4cfabb3b3697880af1c47
SHA25649265357558fd1a12af16c13c648b288c3133b1bce53e2c937244afa2c384d4f
SHA512587345959955a523f02bfd36c172a24820de7d6940dcefadad14af1611e6cf93266518b9076965f0b1f31930a3847918ab65b03897bf36fe3f00b3c5efa1d79f
-
Filesize
5.9MB
MD5726a7b56ed278864fc1e6712bfc838a1
SHA117aa46882e99f543200c0d3dff759652ef8f43a4
SHA25644da005a81129f3dff20181f51f7bac9feb6cb8948269bbaee73cd91c74d547e
SHA5123f787099d51ac7eed5d24ef163fe1d1796afaf45c52d9394f88cd3b682c22fffca5eb878fe57c44bff9f28ca21e8a615fe5d5ec2833b63e17695daf3d034b2d0
-
Filesize
5.9MB
MD5ff3fc8fbf157f32f97860182b666382f
SHA11fba5349ca4be4c981757eccbf8b0b487f6adaeb
SHA2567ad79f06b9a7a660b9082add83d454f3c034c1dbee4b6bdc6a23f0f9c540a9f8
SHA5125c2fa46cd72151f4e36e9500b6c9d1d3728319cd5754b4d0de3e5999582301530912a0bc313d59494862abdd3868ad102ae19f5b51ca22be2b579291932ade96
-
Filesize
5.9MB
MD5ef455be7c5d17a6a2eda4cd18e7d3f6b
SHA10aa5311156f5e09200b8c714b1190a1bd9b08c1c
SHA2563c9c6702a4b1214943ede59c69a7192243c5b412def699a936508c7d12d4125e
SHA51240e2277857d55e5c598f2e07b2c3158e1b855019c8e2be7bf11cdc18d94dac3b0384311100836aedea6fec56b8305585ad7262f23d0bb1f8d066395da078a5cd
-
Filesize
5.9MB
MD5193dec4f782bf52b5560179f3e10f92c
SHA172f21f427a0d9920b12399471805ffa61f991694
SHA2566eec3a38fae6f023c89246964652ec6d1ddd7f2d25edfe918f6d04c6a4e1cd23
SHA51207f473919dc4c17db6530603b7b5257069bfcb6fd2f1f5ede80d09ff0a0e54d9a598879695b951e1dcec963b0fe98cd5ab2ad6fd1f9b8d75d7ce628e4328c7ce
-
Filesize
5.9MB
MD5023ffadf9e1b92e7d2ee9b843baa11ad
SHA1b7f14a762774aaa93c57b2b17eb9b68c5ed656ad
SHA2568e8e9fc3da844f7edb1ad932ad18687cc0f912054206aaeee35a6f4a9fc75cda
SHA512041667eb9171422aab3de1aeb957105dc34d5bf9786bf1ba78b1ab28c0fae436533dbe534c61526df9acb019b5e1349b30c9113ef5eaacced2075ca68d881ddf
-
Filesize
5.9MB
MD50f003868f5dd6738b9db1b3b548b1fb1
SHA1d6d181a23bbdceb5d305e4c99e0ec0da40ffa0e0
SHA256cd61c690edab5e0ce18e2c769c2f9b3d63da8782daa6812ca01d466e2fe0ad62
SHA512bcdf3b1726cdebbbf9439b6982d47653285846c9fe510f00f42eb60eb94005818ef2fbc42891b7299daa7438de0f660a75ad8a6e61802195b747f656a9e9158f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB