Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:46
General
-
Target
2024-09-20_6be6faee877602115bde7ce38d1ea756_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6be6faee877602115bde7ce38d1ea756
-
SHA1
7b3919557f0991e190202c74780f3886f466f4a3
-
SHA256
853a823afa68f860057521ab423f557fc46fae3307cb70cca6fd2a75cde638d5
-
SHA512
56f566408d136856f46bfe7b308edd5b978a53075bc88b60ffc945fcce674c7721e033db4f365b04c4bf50ac499d2c3902abd26d7f624d62dcaea6f870cedfec
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUj:E+x56utgpPF8u/7j
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_6be6faee877602115bde7ce38d1ea756_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_6be6faee877602115bde7ce38d1ea756_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HCEYAZa.exeC:\Windows\System\HCEYAZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NoLmHxG.exeC:\Windows\System\NoLmHxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtlqISn.exeC:\Windows\System\AtlqISn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ceOvCxZ.exeC:\Windows\System\ceOvCxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Laclvzp.exeC:\Windows\System\Laclvzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZRthjA.exeC:\Windows\System\AZRthjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RMsJjeY.exeC:\Windows\System\RMsJjeY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxyTHos.exeC:\Windows\System\mxyTHos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bQLYOhD.exeC:\Windows\System\bQLYOhD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kyDjAXJ.exeC:\Windows\System\kyDjAXJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmQdcxW.exeC:\Windows\System\tmQdcxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jHPYTBa.exeC:\Windows\System\jHPYTBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HOMHMTU.exeC:\Windows\System\HOMHMTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eLGlsow.exeC:\Windows\System\eLGlsow.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SDBGCXg.exeC:\Windows\System\SDBGCXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTfynTO.exeC:\Windows\System\HTfynTO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xjlVyZs.exeC:\Windows\System\xjlVyZs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cEmZvPn.exeC:\Windows\System\cEmZvPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSLPyzb.exeC:\Windows\System\GSLPyzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odamUWl.exeC:\Windows\System\odamUWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\woAbfQI.exeC:\Windows\System\woAbfQI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD584bfb353044b3cb8dd98a7a1e59f2e0a
SHA16e39bdc61259ffa6fcfd5caa6b8342b07336da15
SHA256cb664abcef113a07599fcd2c45e27c4d3ede86bbcf79069d742e117afd4a0620
SHA512bc3877a926253bfee22c7d71053e3155c39ec7d9163ff3bba305130ae8bdc6324b70e4caa9f448e22ef98ae1fe5442e8fceaf6737d1e887d93df00ed4ecdd15c
-
Filesize
5.9MB
MD541ed2bed73063b46ca6c5d618fe6c8a7
SHA1563ddb6f31b801cf0161c05655f51cd96c75379b
SHA2566f9bd50d9d70482ae0140268c48c0689efac200dbd6b113392b4754ba39f42a6
SHA5120b48563fe6d3fd3dcd1adc92e559cbc942625aa30f2cfa3b4acbdeaac5dafda0030260c7911540900a002f351b0216956583cbf658d4b8a28d0af6e70c021e8a
-
Filesize
5.9MB
MD58469a165fbc43cf21dcf97472aaaa4ae
SHA108eb07dd72790c81172d216da40efbf243ac74ce
SHA256c26fb489e6e90905d5cbd567a2a577aad17513b1fc9733c6ea2118437f34d886
SHA512b4a7c14541d9ec4b3cc5534f1687f64cf7911e592938db10f54480906dc82462b912df6217187b9c032846c86bfce510c12e4d3316754876f501e96bb8783fd5
-
Filesize
5.9MB
MD5f7d9a2dd8d5bc39096ff5dca5f89c901
SHA1f12e7278a05576017c804bbaef7959d93464b6fd
SHA2564afebd6585a93273817edba515fe2c6f7e9d32dbc860535b8dbe03dfabc40c42
SHA5120dfaee777a63239325ec6a27d2fdcfcfed09c3cbb6e146d10e011308f7b76394dd8ef7be5af08ac65925b70f252dc953f9fde65ab5b5fa0c1c520278bc5aae80
-
Filesize
5.9MB
MD5cdf464e2d44c7017048763ff203fa20a
SHA12ed1602dddaaa7bb015c7f4361639cc2e9a1b58f
SHA2568023e731f7a40c37726af37cfadd9d44dcc03aee28f61c3c28eb0dba4831d156
SHA5127231b523fa2c96c7ea6a1186336aaeee103bbd58b4ee9df1cd70dd94ab404fb60b41af936fff20dbf71b97cd75a30b3eda94e4c7e99df61258cbaeb435345670
-
Filesize
5.9MB
MD5695dad3cdfb75c6d18884261159cc166
SHA17eb6bd7a5165a6367b67ee38f8e3a2536bb165e8
SHA2564789d201c3757f96c259cc96c3a003100cb19823834cc7091a866375cf017942
SHA5121368c3e25a8efcdfad46441094fa733df1f2f6c1817fda18baba90e952d09f57c3ccdcb617010235dfbd1a336a49474b12f5bcb314f822f4b73db167d628eb72
-
Filesize
5.9MB
MD5d2f7668a0b45a70f6b9ffa8414105869
SHA179648de2678ebd03fefc57f499b7386458aa2bcd
SHA256d59dc5b7a1567089b7602e78c073763a610996da5c9440600a76f8b18ae1c8b4
SHA512cb443407f59a59533b0af9045398c29a6c1d6888c03361b5f829231ed285d35a815c266d2946c1216f9fca907e1f939e13263047286d78a7f5c373a91e5f8380
-
Filesize
5.9MB
MD546f498ce6ff6eeb1b0edeb81f2d32a4d
SHA15bf4348c85a5604149f8956eba1fe44171abeb06
SHA256520b87e4342ee6b46fd0e2f120b16b98dadc6e502212e721987033dd7505fe6f
SHA512d4fb0cea6a1a198bb74bfc451e1d87516f39baeb0e1d5738d59b9791bc62494fcb2c56d410df3c96b15bb59bb345252c8ce5acf95cb3c917f76ef7e259ba66fa
-
Filesize
5.9MB
MD5bb8b08a2e61413a36592265976c48b2c
SHA1cb06b1b9405fa7e9aee2fc995e224b0ae063b70b
SHA256af33aba9e1e66aa840135646b5837ba23c0f64e4607f1204547a3bf2be45e5da
SHA512d2c44b72ef63cd0f47cd46895a5a32aed04ec1e02ce302be66cf386f0832efe0c8d4e17196a15c3fe39ff2bd367cca6f6e112200114b28c4392d63d36165d086
-
Filesize
5.9MB
MD559f18d938e12a46061e4d89b13abf2ef
SHA10644506d361d7df0180a62ee04998a687008e9d5
SHA256b9248f7e3f2276aaeaa7ed9f5a318fccae01797d522d8cc542158b63def23773
SHA5122f17a3cfe579f325f940356db9457cef9a370f6c1632787a680a90130990d1e20985085bb4d27a90595c126a3f8eaea4d14245546cb67037fb60ac63f40fd8b3
-
Filesize
5.9MB
MD56f3f0a35b6c82bee7cdee76f203d42d2
SHA19a5225b43050bdf10e8a4a09b913b24f21d28b5a
SHA256d15f170af77c255059368869588748ee66a8a2e98acf08c26bde464beb93c399
SHA5125fdf9f7004337247ea1227b7452c517199fefa03e67c23fc0fb80a381926cdc497908601163b14a17dfce8fb6a7e2e5aa23ccfaf5014d756918ffefd490a9c66
-
Filesize
5.9MB
MD59d6c99570b285e0910b7fcbd217d27c4
SHA1a682dac9bb04a2614a86d5644dbbfb212dffec54
SHA256e1d995ed9f6376cfd3037a8f954d71c547ff7d3105cfe275a1289705c51428cb
SHA5129d189a25e0f40069121def54b1a31f23a724a261bc565dccbfc5cece3c3249b2642dd3ffb2fa1a78d329ba9fb859d94ba6223044fb1e42021eb28ab9e0d68147
-
Filesize
5.9MB
MD5ca2d9dd6af3d1a24e5f806823caf4c63
SHA1c17417353b35db730dcdcefe297481b606a15905
SHA2564bf3b009c171eeacc9b2f265e4abd210f066c24b9723d137cc2252754439407d
SHA512952278a5899b7c260dd58f8513d5688ca9f82ad26806c823a094a4362fa88d4e6370144cd3e0d245bd090ddbb790f35ce9c37ffc81d23709e1109fda9344d499
-
Filesize
5.9MB
MD5988b9ede3997dd71ffd93f666a631fa0
SHA14647fa44e46b01eed656c738712650620c07a57f
SHA25694e765c3cb3e8790d5184a93e22be999209584a92fe0491eb893d8ce1116e768
SHA51275c3a76d819d986310ff874f1f00b8a3c4039acabeb062a5339e8b4516f31bef8c49682430290bc716ca3d5f307353659369a06c14b9190d92050c6db68c8114
-
Filesize
5.9MB
MD5e6f31ae539507d2585dd66aadc4b6603
SHA1b61596d40872cc36d9653c41c58815e46e4f1fab
SHA256e5ed96451e0eee9a3fe3d8626d6d13d9e549dd41e3069db339e33381df1263bc
SHA5121b20f1997182c34a0c6425347db9c052aba37c625db21f19e78a521c3c8ce38c0f01b2dfba64b4031abe94f6b54a1fc6381b8a8dd0ba8d201507af55629e8b7f
-
Filesize
5.9MB
MD5976a485d8caaabb8d506424256b2abf1
SHA15b34d9cda7e2720b21fe8b4aa79fff786ca7c5c2
SHA25637a18b647708524f833c0f50d295f8418d53b9a450f14e7ddb19da6edfe2f6f0
SHA5121f1885d3dde1d856b0fc93caaa0e2a67325c363f2a7188cba7b937c7ddb83b329ab88b1798f2563f17eba3024171c5d8fccb3aecadd4a8a8d6f43892629ceffa
-
Filesize
5.9MB
MD5d4bf7347e3265ffe5e4c2108ec4ac976
SHA1241c119e22c4ae9f6dcb1e025923bfa76c93dac8
SHA25620d3c0075d3be489fcd68dbed73842f3965d1136b7303aaae3a3fdb6f4d6e78f
SHA5124ef8c8187c8e0ae85c3059986e34065775410e24ff7feb6fced3af04ac97a09428e6ff891a61102277c2268f6bb6748845fe988de274fade4aa1b5cc3015c21e
-
Filesize
5.9MB
MD597b9c48457d5bb4847128175c498fe02
SHA102a7613823c3f722733c7efbae48ba6664ce4476
SHA256ac8b266826e7d44a91f43a212332ca97271c1aa77b48d0137a92aaafc2b9fbaf
SHA512ccda033898bd2cdc0c36373fc734f84ed5e1a1df93321509de08b29866e4b59b9eb33ff02da26663015eade5765e8cefe013b9739daafc1c4c2fc265ec6fad7f
-
Filesize
5.9MB
MD59095d8862efbad2e477a9b1070a52164
SHA1e2cc43b1a54837a2e7b84dd2aafd3e72677132a8
SHA256c1d9f3da020442a4bc9a9333ed7901c381fcdd0fa5c8a4df1d2596f694ac33a1
SHA512e8e8cc9ea09cec6737c5a681351602f3e667fa6b73bb888f3ad825138c7ea7f15da68732c8196d0ce594383c592c9352958c17bab399034aaa3eb038db8f4b82
-
Filesize
5.9MB
MD501e146d4fc4797c6ca77be52be020332
SHA12981c07fb960b5f65a7e2dc2f8951e5a397893a0
SHA25694d019a42dbc7322b2e847166c8c9f9e62d4a602c6729a5f1d75d6641327c677
SHA5121ae255040bfbe45e0ba5c2756d8da0714a546cc52b69ca8c8a180390e6666616f9935d70c5e6e7198150715ff0aa9c7ad16a2ed6d81fe0ce6bd3f70e6ffc86cb
-
Filesize
5.9MB
MD5667da59fcb1e58e0d56fe51b3848907b
SHA1ee85d9355bdd50254a8a20bcb3bd214382e86718
SHA256d1446241e1dc12e1636043d64a03643bc993015b0dca232bbdce6caa5438a3a5
SHA51235bb54e32c61d50064156220e86553d601057b1bcc553e4b89eef6fdded20f0b5897cb87c81ef61f53e84b2902447d2b8691d4d6fd21ad5e522a1b0791fd0345
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB