Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:48
General
-
Target
2024-09-20_cdfd0d4334e30d91c1e05d0268003d46_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
cdfd0d4334e30d91c1e05d0268003d46
-
SHA1
7725719398ffce9287db8740563e1e5c63cb98e8
-
SHA256
dd9f6c52b7e2ead2f45044b67b50d6a314abb05ef61a8e6b714929579e59b9dd
-
SHA512
6354e3b6aad6a73967358fb6569690b2a1a93fb34edcfa3db4468e4554546088c14b53163f0299b5999045ff249b2c9d7bff824acf2095b825aa61b96b0d1fcd
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUK:E+x56utgpPF8u/7K
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_cdfd0d4334e30d91c1e05d0268003d46_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_cdfd0d4334e30d91c1e05d0268003d46_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QXezGAh.exeC:\Windows\System\QXezGAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdGyCtt.exeC:\Windows\System\gdGyCtt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMjoJkG.exeC:\Windows\System\kMjoJkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNLMiiy.exeC:\Windows\System\iNLMiiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lobqmuE.exeC:\Windows\System\lobqmuE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iBXtuyw.exeC:\Windows\System\iBXtuyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFaQzPY.exeC:\Windows\System\TFaQzPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNxBqKN.exeC:\Windows\System\QNxBqKN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZcPRNmK.exeC:\Windows\System\ZcPRNmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFgKIUh.exeC:\Windows\System\vFgKIUh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbRaekR.exeC:\Windows\System\PbRaekR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zZGwUsQ.exeC:\Windows\System\zZGwUsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvHUJqW.exeC:\Windows\System\LvHUJqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RbMQKNP.exeC:\Windows\System\RbMQKNP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRfQdRD.exeC:\Windows\System\sRfQdRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTdjdFM.exeC:\Windows\System\DTdjdFM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EUSAcFV.exeC:\Windows\System\EUSAcFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lLXdSIz.exeC:\Windows\System\lLXdSIz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mCnMeQU.exeC:\Windows\System\mCnMeQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZTklXkL.exeC:\Windows\System\ZTklXkL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfNOUmV.exeC:\Windows\System\hfNOUmV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5101ed0bd71f28856187c4119988e8194
SHA1a6c184d8d24612865ea6f0761885563b902391ba
SHA2560a293e41eeebab19b78c9a7111e0db2c393cc4639615459972d0a4a2776d771c
SHA51288ae07eba7cc9bcb891d5e0a227b33d6d770315526e73b7e91998e20647aef700be0c2284a9c364870fb2adbd7edcb0e67bcfbf320b567e789702d90fa2b5125
-
Filesize
5.9MB
MD5414bd10966a29f91f674223101dc5408
SHA185446a25a1dfa4d56ca1d6ff5db84c333d22c013
SHA256feeabb99d0b91378b6fb12d1e45f43465ce7e9656e6c521577aed29940edaac5
SHA512396ca46691ea39cd2154d1a9950380e8d155a57ed69ffa999ead5cee124913806d3d00397c76494fdc1ff7a7cd18463c6c7c5689bcec1661872314a737059e2c
-
Filesize
5.9MB
MD558e2a033cf082e51b9b35152a03bd5e0
SHA11eca6f60dd151b3ec7330a6f4be3921a96b69a2f
SHA256bed2f4d110d9f8771c5064145c5ef4a1caac31365014cb1f18bab26c596cb1ed
SHA512dce0207c4c9ba8518696d6bdc55ba31fbaea3f7e52adb286c6ab96b90b39845aeaf2d7d1fa19cbc631c8805246b257bde28eddc75a46f2782e42e54a9b7d2d1b
-
Filesize
5.9MB
MD5a75c72f0ad8a0f338941ad457ed104f1
SHA178c0c440de0780a81b4bfc6a77caf7676a0dfda2
SHA25604d8a008f5647920d0b09ad3c1a6ccaf159aa66af35a041bfde495a2191acb62
SHA5125b5d881a038f4a013be0895242013fbf04297504a7ee8cc863fa95b3676bff0191bf94d5c5679d282793e98e61c0126b8bf7f9d232c5328d99d81ddd475c1b24
-
Filesize
5.9MB
MD5a192705d4ecb09b45ce25e73b1365661
SHA18d9a1b629904251b40dcaaf709dfdf56b124eebb
SHA2566260ccfe14c7e6488d7bad84c4eaff47cb55d3d3ccbc733a22ad049bd53f55a9
SHA5127f1024822c59ed5939d041faebaadd94c8408c61579ca660ea73de23cdec8f968b1fdb2db30a749dbbfdc844fcb3063e6644c9c4f27b355fb6e64fc931e73a07
-
Filesize
5.9MB
MD5d4930b0dfc4260d087b58c81042b6ae1
SHA17bf55b77d1564e37d84c5c11691e6cc09df4f8d6
SHA25633865fcbefabb77afbec73e7d6b20daed748945b212470e0fe3e404b2728c952
SHA512624bc228ded31ceb016d86e0751e3594d9afb7c0ba1bf0543bfa748f0ad315b8d8f41f3bd23f3fa626e7f22c5c2d9e4280065a53c9cd5d821663e6dacbafcc3d
-
Filesize
5.9MB
MD5bc34b52c68412cd44140c0aba6c7d3e6
SHA17f6bd95e7b4186b88dcf10919c42949131581b07
SHA256ec79c079ef28f34bf6cc3e767abd3e6e006eb3645185635c7ad10d05c59f567d
SHA5123ff6ce7bcff3c93e905a0548e2eb0a96bc14c22f4a56f05bd6f50c1e19a4db01b5407e91fa97c5b02fda97becca70f8033fb62bee57f9a3b6a6b05113efe69c2
-
Filesize
5.9MB
MD5af77cc3d6f1d9ec5dd1ed8e78dca37de
SHA134e60af830b7d8279507028f5eb8d99549c1ea16
SHA256e7c2ff793fd209ef98dbd99a52c3aea2e3904083313ec99107768d8679efdf0e
SHA5126ea9860b0cf0f8af09e2763da692138b1a6cc6002c0e2fd0d61754457ef2c080d4b885d3ced354fc0091916fe016e16a567fa20d20c1c7ed4c024c649ce74c32
-
Filesize
5.9MB
MD5b1fbd679ee03c550ec9c31013442e6c1
SHA1a560d980ea9864d450395b6b1dab0132ce106e9b
SHA2562e8e322b21f6f8810b54d92c41f3d8339232cf85066c78e124f5cc7d7a33acac
SHA512cbdd9da3c903941eca2d6030efe48620db3cbc7b88e97bd9327a57af6e95e9d1f7c38386a664d86325a7daeb73678e028557d63a1fe7cc01a318b80ee3d68411
-
Filesize
5.9MB
MD57cd321802016c46b97aaa475ae7193f0
SHA17018554510c87bb72e76c31fe498a758bc04f088
SHA25631e84be295fcb0ffedf308cc77fd46b1ab26023488ff131c2f69c64e1d0de99d
SHA512a7d23ee54b82758841377d4cb31ba7552b7bbd0b93444e3053ad9ffa77c8797c0da3db0653cb04bcaf91a5c38ae5b893df6a70cd8be99dca5f1f164a56af9b1e
-
Filesize
5.9MB
MD5e65035823d0c18c1ad83c13f26b85e89
SHA1ed48ca3363683a45908644b767b80a0b3636755d
SHA256bd3fb66f5f61b66f40dd33d99e0df3e1db49b20d39889e9d04ab3bfb390d995d
SHA512ee988cdd81d153d396719db0f7eebd2377b9ae70a6181d33aabf4111ca3454c211645576750f540f93ddf0f2e8b614d09dfbd62d591ae56f17dbc46ba58ffffe
-
Filesize
5.9MB
MD5b75e5e334d418da2fc8a2d4382ae3f48
SHA1d47a74340f3393d5419bd08afa93d83f06016f05
SHA2565fed347f5e63e7c5d0df6d215f8edaaae44cfcd28eed778f9152433231887347
SHA512ef1dc8f5b7fa7b6ef39e871ed7d50615f8beb8c8bb3964a838244c8eb9fdc53f85229f303f2ff2eb06ac337eceb91307b5494358beb3714fbda8817e9f6675a2
-
Filesize
5.9MB
MD5d0d0ad1c21cfebd1b050d6cfc5b13c2f
SHA1060c6e70c5b64d3434dcbd1125d2f1253323af9d
SHA256e0df5e9a717f0be9a0373ef0db07115062810a1e7c7fe578509ee1ee3187be18
SHA5121b4d93ca39b2eb818184dbcaefe20739c776a8e0c64b336f1f9072dfd4ca16d0d921a0432150b57b4e8c635107fb143be53e4acc1d0005a4d0cfa9a6637eb0f5
-
Filesize
5.9MB
MD59fbdd2ba1ad4db609c5fc6b7f4c92eaa
SHA1d82408899f86278565f1914a0717604824dda868
SHA2560a9490cfeb18146f52ac5582e063f9cb2c6b718eb8d9488c37442cd2f3ea1b89
SHA51293557d172766082177658e2f15cbfb7f6c1dcc80f42fa72279b3b7d8f2e6b1b4c51c10c7ed3b075ae86f3f343b255aade8c617572ac8279ddafd69755fdf0774
-
Filesize
5.9MB
MD5e5abefea88a40b68f04d85c2f59496d8
SHA132499f571c5251106dd27171ff3f4330b157eff0
SHA256d3ccad4530488ede159c3bb74fb25d1ab3aa62a021d46515809ffae46dc913dc
SHA5121d0eca95cc91a3a1fecdf80e158fc26ff034e243117b0479ab9adfb1e5e4009fb6733b1641dd95cde214a2099b2aa4872e0a512ea2704658273f15f971cc7421
-
Filesize
5.9MB
MD50e16210493523de1ce6ca2a800ea151c
SHA19afe80ccb6533be4bb64afb67561024a195d1738
SHA25643ac8adf4b3ae43c6ad04c64c678a869aa105249dd178bb0215af4257e632f89
SHA512a4ec9807e1d4ccf0ec62896a0eedd7be407fa5468b078d2179c6313f4e1c229e4a73bb6a96fc38e9693985f4a8faa0383d30e8efb068f01726edd82756390381
-
Filesize
5.9MB
MD536953f0854aaa8895c8c0447c0f4f8b3
SHA1ec2536cb167f0d27422bd7a742611b43c87a852d
SHA256213da4f20685c9adddcb771d366936f2ada3cdcfa1831c857ce79117b34323f0
SHA512159787d0f71a24a4ff3eca89539e687a748d2bfc562cdcf37f22857d2141ab21126737fdef5590c4c3ad683e1b46b4120809c56944e797d7f6a31a35fda3457a
-
Filesize
5.9MB
MD5c28a5c9be71812629daa27501c3e2b86
SHA1bd6645d9496db6653bce1396391c8c477aea8f29
SHA2567ee9646b0d09a3dc1696785eab3ccd9559ca6bf2fce24a28b44684f6ea381092
SHA512c9a2a68dd049e34fcd94c855f2268e7ed031477f5213f2f84dd5afae694b5af1f788d9a9d754e0d71dcd87a15c3d88c93db5dd17368a95ed0b250bc12bc2cd9e
-
Filesize
5.9MB
MD59d8c0529868afa07ae9ac56952d90126
SHA162da0bb8f93c0864d077c2a1ae16f61d12835967
SHA2565e5cff21c69d76164d51cb4c16fee8b03ff47cdcc5387499e1327975d6eaaf7b
SHA512b589c4e147a9339246f85a25ccd050bc607838cdb5d610d0a37b19ec3b53eda198f81df9681d2f9b88c24e0cb7dc9c0a02df26e76214fcdfa981ad12c7da5b96
-
Filesize
5.9MB
MD5b6537535899aab5ef29374160cf16331
SHA1602df9feebb4695c3df505dfb3daab3fc095f340
SHA256ca128a1c1bfbb26078878ae74c5ca4d93e276d33fb0d7b4c823cae4e42a55bb9
SHA51226c7c6d2f2364d0e7c39c7787daa9c7be087dd474c3d1ec2dbf06b6395cf64ee58fe294f9b832baaf2dc776a847ce66766c8044bcc16f3f07b4cb38c0422140a
-
Filesize
5.9MB
MD5d955b29c6990c412e6e4db7f865a544b
SHA176a8f7735951414dd0a95aab09540f0d0d175f33
SHA256d6e14890c5af1ae8710a23ebbe0f2d54a253b91d186ca57987b592a3e0414975
SHA51207c3794591120a5f2388fb301d3324bb93e4c6ff1c3bbc4b2f56f7c508766f3ee07ba2a0634cdc6929e3dbf54a8247be70a83f609eb7414d7e37859e0321edc3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB