Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:48
General
-
Target
2024-09-20_871248813ca71e54f8f2bd71f1b00575_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
871248813ca71e54f8f2bd71f1b00575
-
SHA1
8f63f72927f08f16fffa4262d3f559c8762789fe
-
SHA256
22174ceafe390c29190d06e6f5dc07acb964603b3cb90ff56c0a6992bcfd1c5e
-
SHA512
1bff8b0486f8571ce087f4f3b910821d298c31ab5486ef86aa5a978565be8080193447072f7086b1a2c2946c14c26da0387caea4896c8e0e35625e65963b62f2
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lU8:E+x56utgpPF8u/78
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_871248813ca71e54f8f2bd71f1b00575_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_871248813ca71e54f8f2bd71f1b00575_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZNCCKhx.exeC:\Windows\System\ZNCCKhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RMkrAbv.exeC:\Windows\System\RMkrAbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oHCpUbY.exeC:\Windows\System\oHCpUbY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XLMHInJ.exeC:\Windows\System\XLMHInJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kZSitxU.exeC:\Windows\System\kZSitxU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VRHNwpu.exeC:\Windows\System\VRHNwpu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WStrYqw.exeC:\Windows\System\WStrYqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eXRrbXx.exeC:\Windows\System\eXRrbXx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVUaOVK.exeC:\Windows\System\NVUaOVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NKTwKfx.exeC:\Windows\System\NKTwKfx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\goPrzFt.exeC:\Windows\System\goPrzFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONzbNKU.exeC:\Windows\System\ONzbNKU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fWRfoNH.exeC:\Windows\System\fWRfoNH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWjnJcf.exeC:\Windows\System\xWjnJcf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZBOFRlN.exeC:\Windows\System\ZBOFRlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxlCjCI.exeC:\Windows\System\XxlCjCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEnvffG.exeC:\Windows\System\OEnvffG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fdilLaD.exeC:\Windows\System\fdilLaD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuAVtLV.exeC:\Windows\System\vuAVtLV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZXGCQSM.exeC:\Windows\System\ZXGCQSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TtNACgr.exeC:\Windows\System\TtNACgr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD57e711ecb5040fceffd2cce2708372bd8
SHA182bafea8eafc3e6411ffdf87950cdb922c414d91
SHA2564f37429b62b8b90f6b89eebafe234ad9d86452c67917c0d8e067da603c11beb7
SHA512e02dc5ac635129cbc28762d7511342e058406e9ffeeed10071f61706a70640cc841c03a89d6ce576497f48c18577f4786f69132299a939bd3b7e2ba41756f347
-
Filesize
5.9MB
MD5a6bdf1181b58718c59721b89a640aba7
SHA1395af3667f4c69a9650123e8db7867bd1d0ace41
SHA256c477c65827f70056f470baf1ab0936e6d1a4e514d111d747eca06e29d037da00
SHA51263052113e0f79830b08ad7e11ddfdfca6d544a518fbf7fa3d0991d8f828cf2b93ff3d241731686e9deeaadfd12be3ee54b07f40def9413d9d091e2dc5b3f09a4
-
Filesize
5.9MB
MD58e496ff6deb9fe48e9a7398090850d81
SHA1cfee972fcd2c1b6f66a88b9be4437c0830be02a1
SHA2565c7a7993d098bc0996c46ca83d2998d62125f289ffb3c3e35e0957521f9147bc
SHA512984ab86f3f739a42b77dc8037df1d108e85d71e7cd50fd9e7681c43c8582373d6fcc74192f67860ad1068bee1e0516d1a1bb3b08cbcbf8628d075ca0dbef7763
-
Filesize
5.9MB
MD51da002a7a1f6841a478eab3f62d454e7
SHA17c7aea62757ca9691ecdad7bb3fa15a2a35e30ee
SHA256e1d043374c616fea224c67d2446d34e8e1471ea38839b1d54fd581913bc482a5
SHA512744836cdc27b7182a6b1a4d277f05a08f58ef332e1e51ba302c5c5a1e15bb1d5d31bd1b74efcb4d6fc3d2eb2eed9cd737b846ea529f1f9227c09d0f410c86210
-
Filesize
5.9MB
MD52b5f5c5350cec05a6ae1ed53b336b2a1
SHA19a05f5fe15c700017e333387ed57c08801903e78
SHA256e96328253a0bc95f1d562c549440eb9886527a966c32ea6285f6cea68459cdb2
SHA512e90bf44cbe20b186798d91e837a355f0ce78a88ca96be05ae10aa368b2b03af1fe82516f49b4b60c308952083a2188e799d25552587264a82b30f8c9f4560b0f
-
Filesize
5.9MB
MD573776bce676050f7f9ac35370c0d4300
SHA1bdaf0bab082e11559da9e94c265544b1c6df2961
SHA25617aa6e6c6cf2b3aa82ac1a00c72679f726752498b9b82a6108a80c2938e520e1
SHA512f76c15fe0027cc527405bcad02149d2dcae85e1aec347eb0a1d340718862bdc80c8d6fdca341f32ac207c3ec49417e26bfebad2ab4326d3bcb6ca06c54f8d052
-
Filesize
5.9MB
MD51e87cba281499f08e2b6fd10d51e1a37
SHA1b620d91d7a26c9ea169c5bfebe2519caf2c33aef
SHA2566044678f3f3a3f7ebdc485ee525d627668a6df8c2ed883b316ebe7ec3230150c
SHA512abe6cbc99a6945d81b9033494dd34802c9da8fb14a3b295330c4317f009f26ba620d3a08870cc620137480340cd30d5b5fd0ba29b06294e02be06fc970c1ab38
-
Filesize
5.9MB
MD5716945208cfce341d81abd50d7f70f53
SHA19e99e78439230f88ce5a0b2b340e2906b2cc311a
SHA2565e5576f07b1717074ca6e85c72c69498598dc690c1a2ff596fa8b10bcb03c5cf
SHA512041cd8348df5821ff35fe867907690a0560342d9fff41239128772fad0a50583c8a8c5afc7c9a1bfd9780c906a6f2462030228aad083c02fbe3ec66efd76bf42
-
Filesize
5.9MB
MD5e57cbc648122b32ecb44142edb390aa1
SHA1bb2799161fa907088d19ce990245beb1bacbf286
SHA2561f516e705064f3d116cfa954d4aa751ce67dbebabc500071588dee59b7dbafcc
SHA5122e68c03b21d8bbcd451a043c1349d66cbce17d3f650a852cba3d1cfc52df4f84f0b818cb6b93581df6e9d3dddf8cb65bca10909a828b29ac5aa7020614559d86
-
Filesize
5.9MB
MD56ad4792ab2b25322b75c3b9850077cba
SHA12aa8ccc24bad7538019c03bc26de873dd48766e3
SHA256ed65bdca81e1c2e2ba659b169685a056ede50de8e195c8c181b6fe79f111e815
SHA512becb456fc87c545a9477149a6f215f51f266d116e0b96e25e09e91e56811e34fa39ce6374ef8bfb990a2b05e2e192cdea9ca709186c355a33b4a9120ad0db24b
-
Filesize
5.9MB
MD5d8170c6af0171c9691cd7807404ce104
SHA1e1cf3dd0d2f839a9251b9719d17daeb365194a7c
SHA256446c20f88099ab22dbf5a17cb73cfd146af87b6a4f9f5958327d65e225cf70b8
SHA512dd4a02fc6065279250abbc9ce3616f497d31bd479cacd96b6074c6d1c844e430a86d533e7ae261202af17e3599b02509e54e2f2d586dc073ee5e94a7bcf14350
-
Filesize
5.9MB
MD5af143c3ad47ce5d8731629ae26c6bb87
SHA1c9a51c0b52c2ea69a21026398fc082b128c46511
SHA256db8761eee21056d10ef72f76364f0c61d4521ddc5c7483b0faba6eb194dcbdd3
SHA512393d9c38e4b210fcf3a7e08d77eac8189b5d73b607f8fce8a3c497c4c3bcef8e289213c5254e3001af44efc6a8b3ec12bf0c4a7316415019cc4130be5e1819af
-
Filesize
5.9MB
MD55b1cf325c9e47221e7b4ffe0359b7cb2
SHA1dbeb389dd9f5f4c450b144b979af35784a869423
SHA2563165ea69b45014004b408fb8d25e8288e7ab5ff8765c9d479e8ed7358bd22cd4
SHA512575cbfb2104dbccd7627ecbf06a6caf2712959fd5f94cb6954c3ba0373170cb687e576ca1a641ed32cdda8a856a4168636b59718e8cc7faec097d4c61ce590cb
-
Filesize
5.9MB
MD5b3712e7c8958c2928992d035720567a7
SHA1dea5b04b61196ec0d9d36f88f98f59c49bfaa869
SHA2562ca7ae72ece600b4b435adc8509e169d9bcf874e59425b56b68d9ceddcae7ade
SHA512b1346f0d2e5f5cab4d32107acbe5a88f408faf6979226497105ab9af954081c0697f38807c73163306e3f20dc5a7030394eebb44747d1c1f6508953df45fe537
-
Filesize
5.9MB
MD5ff3dbda716ad8e98243d1772d09e57d1
SHA1502fe37f248dbe2b2cb2f93a150dbc866a118bfe
SHA256985694fecdae87baebe66b382a2f5ad60ddb4a4fc2612c52a5ab6fad12626818
SHA51282b8d09ba15f8df82e390a47515478a182013ab7c296b7e6f13c4b214acc8962f9ad5f4fc7249763bf06b26c9342e423b2908069ba6522f9574a080f4dab8287
-
Filesize
5.9MB
MD5f282a40a6b85c327fa6c7ba2b61da07d
SHA10445498a65792cd5f7a09796cc33e671753ef9c6
SHA256d67152d3c375ef4739f32df647ef19e73181dda9bbc496f7d69eb4afe4408c4e
SHA5122cfef8f8998a555a47b480821849573f135023513351b08663a401a92aa0356326ebb126ea40b3167d05a01fcadfc01956b30cc50baf1f2d1b6f1abde9c924d9
-
Filesize
5.9MB
MD55fd0d6154d53754b9138af2e41999d59
SHA1ea4a3c312999a725920691c9dc1e252e05b7462a
SHA256f241d7ee364488acc78dd622f2745c74e38446a1303671987fe41790d5cd15c4
SHA512d023c1d0a5672bf3762dfdd651ddfd15dc38ac322358f90df57afd75c1e253b7e81ce71d9e0abb2d60de95d00e86128934745497c06c0e725dbcd67f821f3f67
-
Filesize
5.9MB
MD5043ef4e5a32c17ccc3a298a4c6adc90e
SHA1274f8b50afec263b0f96a4c94130ec6c49e31545
SHA256c55f9929a2be255f8437c3229edf62c95b4baed47e445b8e841bed1651aa9604
SHA512794920f5ce8a1cf4bfb226a7e14e2b81be1dd699365349f4d0ae2c54d1e80036fef8d39c9004bd49d73316908ba5c65d17a170e21df41d76951d3d30fd2ebe6a
-
Filesize
5.9MB
MD5002ad3171c9fc0101fd822bffffc3947
SHA18e96392cf8fb0e278241b88204c0bb7045294ff9
SHA256c9e207c0271365ba2747fa3e549334fdb081cdc77fec060da018a2e1daa891b3
SHA512d802327389fa3979748422b53520e098be4833c2ff793a654ea14bf6b2d91568708029c00a64baaf8d26c3d0e793db4a09eb592e392c123cb06e36a00f39c9e1
-
Filesize
5.9MB
MD597643be3106e3a9ce4f9efadf722f987
SHA1856bfc940d3ccc1582996b455e0ed53c52e540aa
SHA2569780247386bdbb16fee4e79df889e69e1d569c0b38670c990466a93093c0347c
SHA512e2bcd9bbdf4ec02dfd2ca4988a43b63a84cec90d9bb45e5685b77bfbbd59913bb2197ca8446fbfe609104f7964d3b8cdb526ad66b3e619d45777c7c9ddb1ad11
-
Filesize
5.9MB
MD5c4153a6b36d335ced0ebfacd49210cc6
SHA107827dc6eaee01be62c4d2486d8286ff57c224e4
SHA2561fbd22b2d6de8daa36fe871f0f45035adc9bbc297287f29566367798be7e6713
SHA512f77e1d9997410cde58a4303c1224ac435c9fd28e9ccce25043f5bcc2733349c3e9499bfbaf8cf6413f9bda6ea9ab743df05a70ccf3bf22ba7bd413c8dfcab92c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB