Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:47
General
-
Target
2024-09-20_6fee586922a07b4ccef7c88b7eca14e8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6fee586922a07b4ccef7c88b7eca14e8
-
SHA1
f67569e6586c03b7d908ec7df1527e387d16104d
-
SHA256
bff3d9f9cfcad6a7436bb8e66ff1d85fdb936cea49c1bfd435b3f437ca888b69
-
SHA512
7ba0481408d455a00cdca4896a1c7ddbc0e9e7639d766ed4affbe5092e83a7c0c001263114a7b8d63eae830a698b076170a66aeab6948a4de9e781ae9b177a60
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUM:E+x56utgpPF8u/7M
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_6fee586922a07b4ccef7c88b7eca14e8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_6fee586922a07b4ccef7c88b7eca14e8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yMoVvsT.exeC:\Windows\System\yMoVvsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lNitJOD.exeC:\Windows\System\lNitJOD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFSpxbN.exeC:\Windows\System\vFSpxbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYNBbkP.exeC:\Windows\System\uYNBbkP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxmBvwZ.exeC:\Windows\System\MxmBvwZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UIgZfsC.exeC:\Windows\System\UIgZfsC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XziiKCA.exeC:\Windows\System\XziiKCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\goXdObI.exeC:\Windows\System\goXdObI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXyPVyD.exeC:\Windows\System\vXyPVyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtYpyMt.exeC:\Windows\System\KtYpyMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZRMPcv.exeC:\Windows\System\UZRMPcv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UTWuajO.exeC:\Windows\System\UTWuajO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ffLwgEq.exeC:\Windows\System\ffLwgEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GIjOtig.exeC:\Windows\System\GIjOtig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTSRGLW.exeC:\Windows\System\lTSRGLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxXohVK.exeC:\Windows\System\mxXohVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vzIavHH.exeC:\Windows\System\vzIavHH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amjJCxk.exeC:\Windows\System\amjJCxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaGykDT.exeC:\Windows\System\xaGykDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRENjpk.exeC:\Windows\System\oRENjpk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaApyVu.exeC:\Windows\System\KaApyVu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD54effaaddee3853b7abd57ce173862f77
SHA13d41a8056c6e12d9989d5d5bb6ae1bf0a70c6400
SHA2569f80a08d54b452b3d2b618e8d145c92aef8ebebb77315932769335b8281f920a
SHA512eaa034d6f9706822cdc29ee6d65f3eb863d2bb9cb0b36b3a262eca52d922b78aca32d31fe110435aba523e8fc7880ac73cdf994874828ea4b7eed66f97ad4b90
-
Filesize
5.9MB
MD57d897cdf3c13ec66fdcc0e0a5a04d994
SHA1acaf9e839ddd7570fb2fa3958546545e102ce3b9
SHA25675c663765b26636e13f64eff9b44268258e49ff8aace51e3421abcea518ebf5a
SHA512c432604bcf82f08b7f2e680ba8fba7b272bd6951e320d5ca10b32ade33633f4cf9a3d1cc7efd0515277cbbe24445a77fe20ae39a7cbbaf655219eb8e4cc83edb
-
Filesize
5.9MB
MD55674bc895d9321445ca6eeaf9d53494d
SHA15ad95206910a10d74f45b3a8c5ad1c0e8c7d26d3
SHA2561a2badc53fe5afe7a2b6d4913c483bcf2c3b45da78fd1c783e1c8eb75410b01a
SHA5129c306280392d106ba94f382eaf509da79424377b6a73fe4c80919862868cb48ac8859dca057b940439eb7c6ed06bf9d549799d2d3d41894cea7e088ed8f6e10d
-
Filesize
5.9MB
MD5f27b7496c00e02c2012f00bce203c067
SHA179ded6ddee678938085222649504e48aab57d624
SHA256206b0dd14c20dc8a4c5bf23859e094cca17b3998e876793764e3446ad27f79fa
SHA51274692870df511651e96387ab3f3d97c77e936abbe588cf20269ef94ba936a5076616a9b438659e75b9853e33d1c55e222352263fe9c66ef19c8da8fd1d8f507d
-
Filesize
5.9MB
MD50f336394dc679eaff1a4b15873cf8deb
SHA171996b5b6187f2f97b8b0eddb91e653b92bad2c9
SHA25678a17f1c93307d5b1daa5b8b1bfd6655e0e03679f76f9a9432d58e274043bf48
SHA5124f1fe2bbf9787da551758a88a7018c3e3792563132f2668dad4db72cbcd815b1b9406bf903ad0507ec5f566caea9b332275d69e8ccd6c9f43a1c5538e7c9856e
-
Filesize
5.9MB
MD5d4cedf3f702a425d14f5a3ed9d1d1278
SHA1ccf879b51c1adcc646fe21301a984f1b52f96ebf
SHA25649ac05c6e5f7282e84398c8f2e0b9c6371e7cba11ed53abf15d6c09ec2c87f93
SHA51282649f01d0075345ca3ee0764bb27aba3b193a14dbc8fd66247499d1f865a42bf6524c06292a07d058e8157a434ca98985138d6775df33fcbeba9b342cdcd11a
-
Filesize
5.9MB
MD5ebd7be3c55b4d6f70748dfc91d5bd372
SHA17c6fa068e373b6cd5ee229af32101c8b18ae52fc
SHA256bf71c31ec5225cbaba4978a394e52728903b4bd1600852538bb26ae3019b7976
SHA512d12712ae9d228b9d75acdb7a3c9c58fdd11d79f1dae0eb3995b15d3864262b96518b0d247ee4790f56dda0c962dee7f6589bac8cad8d9f82bc1ce5ffdd34bc7b
-
Filesize
5.9MB
MD5e72efb07d4e1510ae219f8430f3a04e1
SHA1ab2f196c9ce378c147dbc1fd005c05b92da693c6
SHA2569928c8c7e4d2cc4b64309faa8ea73c6892b22db6cac0da63d1e6fcc26bce77a5
SHA512bcbee708450c19b6305a78a0546f76dede100852a7e5da145490ad549dbcd7bad5ad157805c3f4e88b110c8e1b872bd57a09836b732838d6fe8ee1d1c1ea0090
-
Filesize
5.9MB
MD5bee5980ff6b6233c69c88bfececa25d6
SHA1440cd81c14fbcd8a681f0b15ca1cba34ff7f5433
SHA2568b9d6ed97197a0ae143bec6528396302c4e15487f0f23a24c57c54eacd368c57
SHA5129c6791b6bdc885369ea20ea5964ea8a142fe39a673ae3137c36cecd3aa38baa25fcbb42642e7b0e4f34102119caf380f56263ca265125621407cca86abf60747
-
Filesize
5.9MB
MD5365853dce5d95df0b3b9e19b67e907d1
SHA1e3c4a6696d8a510845d3bb1350ca06d223c3c86e
SHA256f2d6599b8a086f50c59e431821faf40eb1096764292097ea06a114ab0e40ca12
SHA512ff044ce11752b7f5624d29e4136f862e4dc5e7e8137117a6597d4fa8ab02007243c366c515830e71f75629ee767b142934731febb56c66b66a5bfabeac6bd9be
-
Filesize
5.9MB
MD5d792099e1681ff6bcd48790e2d54bf0d
SHA1f654f8079ae3cc40a2370e844ff49f6a6d737ff2
SHA256be3d8363404a7207d87d6090b607dd9fe9ea9426fc538c7dee1a6b34d0f00157
SHA512dc7d2964c79f372a26ba0eef7a164ab1b2205aab77414c065991b54b259f9383ac2c668e18e523dc28296453285a44c8b18e7f048e3d194e40e18585ea69f5b5
-
Filesize
5.9MB
MD5ea07fac1c8bcf14f332e45806b3f338b
SHA13dc295be4057a56754ab9d2b3834e7b8c075ef87
SHA256501a746af25f27cfd169e82abc95d6ddb2ca598c22c433c2d0d8e4b4d0d3fe77
SHA512009bafedd75368d95f1c3fff3a2f23e5d0da2cc220d4367161bf909e996512503de797ba10a03dffd38efb3c6bde4e17a2b01a095a65685bb9885cb0b040406e
-
Filesize
5.9MB
MD55b205bf11f12a9ad76b18ded9587bcb8
SHA151eab9474849f8ddcd13a6e7021399a27bfd9605
SHA25654f5d2760204842e665207def6ed806836c1830f684b75c552bd6028e94df3c0
SHA5126b69095f8dde112c66922f5a72aaad85aef975ba6fee709d056b66dfe2b14a50b6be1cf0ef7cc506e7433427d536949b9ea05b89a83ba8deee87a5fb42cbd819
-
Filesize
5.9MB
MD538873089e0fadb95dca896b3e56cec1f
SHA125cb4c1180a53cf64d3dc1d900de7d2f5f8969cf
SHA25693592e5848f6a5d57d8153b671f0477cb0d77512414c4f13983c0400e6eeb88d
SHA51213719dd5d276b9c4ee29364567a6e47b73136740dfa537cd523eaf2aa3245f91b9f6f68007b3c3ae5e7e6ef2bce1aeb4311679003c7461c9147af48defe14788
-
Filesize
5.9MB
MD5786118983183c9b14053ca3a726e1f60
SHA1cc5f7ab895a675fe2c4f8848af41621b0181e0f8
SHA25644e7c9022be9dbe8fdcc3392b3f848e8526c853a1d70f7f59cf77d9f68810542
SHA512c5fcb3692ae5ff4348b4a169ec77f62ff448e8ca312ed62be93387aaeaf48d1be1923108d28fca2a7837c61c0bf6d6970a722733901124adacf9720e0dd03212
-
Filesize
5.9MB
MD5e50fe39a112f914dfd6fc17a85f31e7c
SHA1424840759c1c1a0436aa9efd8a9e4507656dc159
SHA256766478428cf2171d90c3a0fcaf30046feaa7cbb48e807e1f4e23a2ea140aa2ec
SHA5125dafca80a4b8115f6e6a96b0f58db2ad7f9de6c732a37b43d023d2fa1338380ebe7afcb15a43ced8f79481137c9865ae8c996de5058559772935208917734543
-
Filesize
5.9MB
MD54b04c66e5e3074b508877d01ea31d564
SHA1f66e8e0c2e13e9aa41521416dc25b9d7edfe57b2
SHA256084abd1f4b068f97f5b4c8bf8d457b945a02788a54ffd7b726ab94628cb4bc4a
SHA512007492bb88c8f9cfed04ead990afc82ebae945b8dad494b65e98ef259a78953c59adfb0564bb4be8fd0e80e081781493b75ce06608e8802ad807a746b1b28f5c
-
Filesize
5.9MB
MD5406cefd1e3643413aa1e566c3b8fa7b6
SHA1744720b0fa932559b6a6f84e792d62bd1a2c6025
SHA25655a33b9049eab9cf0600b68d828150e905cd8fec1e5b38d79df0dc94d889f1ca
SHA512aee560471f27d942270119eaa0695859b6fc6d312df89206c672e81ba1608620b8d270ef3844c034d3bc0e1165f133f3425bff54b095cd8714865011674f1e95
-
Filesize
5.9MB
MD516a8ac9197925f8a7feb48b9a6f57373
SHA19842937869c48cfc0d32786fb9128573c9f26594
SHA25695c067ba06c54c2f0b2f0fa10dc35f897f723af0d337d64349ff9cb7dcdf332c
SHA512771ab24ea469018e5ac28f961fb3fbff8c586cbbfac3cb9b9e5af71e0bc23ee1a536235c2c471e8fd050e01d27dfad0df4ac588e35de53c5258b1f0b3279912b
-
Filesize
5.9MB
MD54dd19e8413529212dafb9cbca1d7dcfb
SHA1fc18ac3bbb2151cf45a50de0e4b6e86270e4e012
SHA256ef2a3107a6e0fbb7abcb0f3cbed1b2b84e2f5837d5fea6e4798cdce93f9a4833
SHA512dd9c4cc41f87ec185bebef6dda03400eb571a3e1657059d87812db75990e18b9e6b6438b7a6d5734b04da06e72bcd62f0e2c9df43a1665078dce11afa73a135a
-
Filesize
5.9MB
MD54f9aaf9e354595cfb5f8ddb2e2a9be81
SHA15c907654158288502bbcaf188e23f07d64f79a86
SHA256daf3af87d7ff6a39e4e3a1d530249616b5001b083514267cc8f01a533ce9f900
SHA512727ba803f88b56af4ff15b3f7251a09a23b0d54e54953c84c9753a25a89f09291afdddd1ff37bd6b2e0c703e5cbbaccadb4c817b73d7e555f2104943ecbe1894
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB