Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:46
General
-
Target
2024-09-20_1c7015d9f60c0915225ed021f53d66a7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1c7015d9f60c0915225ed021f53d66a7
-
SHA1
6b2f6b5cc71e87e76da68894727d7070f1584ae6
-
SHA256
59c374befe40652df52b85b2aa3b0fc4a59cc234542e9b99a88162615d99131d
-
SHA512
6337b5d92aa295632fd440407f7a6f81b9cd97cf80e8908bf5c30bdaeb8f1b7e2d8e2367048cb40da5db0088ad44f98c1cf3843bb66269203a6c4d5cf92fbd26
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_1c7015d9f60c0915225ed021f53d66a7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_1c7015d9f60c0915225ed021f53d66a7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vWgQGkL.exeC:\Windows\System\vWgQGkL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbEmNtW.exeC:\Windows\System\XbEmNtW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zimmDtb.exeC:\Windows\System\zimmDtb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buppZLa.exeC:\Windows\System\buppZLa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMSsvCg.exeC:\Windows\System\pMSsvCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfVQYHS.exeC:\Windows\System\XfVQYHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcufCAA.exeC:\Windows\System\qcufCAA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYCQpMg.exeC:\Windows\System\YYCQpMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yoWwiAf.exeC:\Windows\System\yoWwiAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\siMLrth.exeC:\Windows\System\siMLrth.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGEwwiV.exeC:\Windows\System\ZGEwwiV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\snjdKFu.exeC:\Windows\System\snjdKFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvEmVkh.exeC:\Windows\System\TvEmVkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hgQACmv.exeC:\Windows\System\hgQACmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WUtcqGR.exeC:\Windows\System\WUtcqGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OebIjWS.exeC:\Windows\System\OebIjWS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHJfedr.exeC:\Windows\System\vHJfedr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBCYNlq.exeC:\Windows\System\aBCYNlq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgoHExc.exeC:\Windows\System\dgoHExc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yrlXDaa.exeC:\Windows\System\yrlXDaa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zHkcDVd.exeC:\Windows\System\zHkcDVd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD585f84fb35efed2bab5c7b09aa6154cef
SHA1ef9f87c1b9970e549f6b0dece3bd488134a15104
SHA256f702c2e3107db54c722c2ff04b121831438ff12fb2b7cced8fb4b6a09c7bfda2
SHA5121c6a13a3885c53ef8a1ca4aee018fb3412b268c74db97ca1abf600b3499bd4cdcb37de0faf35c5462120ed5292ea320d82996d021e7253307735db6a01ca936a
-
Filesize
5.2MB
MD545529ec72abc70cf4ae57590c54aadaf
SHA1690ef7f6903a99087ab2667ca7fc748063bbe4f6
SHA256266444e6018fff5de5eea1f96a56ebba6ea16de6430249037cdd2428ec1c5169
SHA5125c91b3cd01597726d750b9cdcede185770b0e89c1a5a38ab6f4b097c658770af58270a5ab631223031b8366ac24bcb7ad9652d7cfdb1902613ecef0500564923
-
Filesize
5.2MB
MD5d72902ff87660b8109a6f9b62a1b8757
SHA1c648dc07c923b91ba15963131e71cf903fa49fe0
SHA256584c3412978fe84477c1d12ff66cd3648911127d8d273a92503913125d27b8d4
SHA51264886633c06b44e3196e9d6fc456f661aae3191cccd60dd66a7b389693df8fc9d49eb3ee8e04e53f12ebcce41e9c8a6a9e08a3f49ed965c7e3637802b45382f2
-
Filesize
5.2MB
MD5a5a03e35053c22d67606f70d3031fc50
SHA108b6b92bc2e2925156f5b88be70168edba80ee97
SHA2563d538958354a7203517abac6cd396b290be0f8ee6433cbb60d98b23cfd67df18
SHA51299a02867e6c6bd510064970c9780b807cb3f408fc6897439c0d2b6b06a98cd14970c423a538faf6e3fd522ba3cbd53687ecbcbdeb671d50b99adaa5f56117273
-
Filesize
5.2MB
MD524b59ddbd6c03799baacab9c9ad37e6e
SHA1b47f462c8ca2a46b93853b855bc8777ea677d876
SHA2564a0bc6eb9f529a2c031abe20b0f018527a25a1d3b85fd2d09aeeb2d769172076
SHA5127996c39382e87a0610cbcd615c9481c14d7e2405f1f8413efde5fb5db976d9f742809173277e55cabc2f44415ae2c14874e837fbc91b8b73639a4fc5bac96a47
-
Filesize
5.2MB
MD5a596e65b2b1a5d168642c6d3fe8a1dd5
SHA12879d64d9c719238d5bf4542fbe98360b73e7623
SHA2566e6c4722b679db02bd4f78c0ca12773e230ba932da9e871d112ee0bce763e655
SHA512e0b80964da694b4309ced309d993f6e52a3894e291afc7497a44f9b154e1d4c12b9a4ae3585183b349053a121f60c17a8631f8e9795479d79d119403a4a00007
-
Filesize
5.2MB
MD5d52e7d7992e5cf213158ce9b8daab9a6
SHA15ecddbb01ab337b63bc1c0cc10f5f618a7c7a4a1
SHA256ca05f22ad3810e34da3bde65324c5202dca4c1042c8847e4bc379c254e2f7bc3
SHA5124f6d695ca2f79466648a8d0d1da00c8e5aece15d5cfbc0032da88897be97ee5534d91ca8463be1aa0766589fbe2ab73913301a4312068d460185d0cbfb6ef5a7
-
Filesize
5.2MB
MD5a6c921f1cf1817f68e1503b3402250c6
SHA1b626e852b609d529666f29b57d2fcece1c4d940d
SHA256ea296727efffcd6446df6024e5101352a14b7ba4909213632f30c67d6e78dfae
SHA5125ab8ffbb8c1b4240630dfd14cacfa6314e4e58e8b2ed7085a64c6b5c8f29e509232044360601587145269493128baa01696f45652b240ab4d04cae4a861fee5f
-
Filesize
5.2MB
MD53a687471b6192d358b77dd5c884a578e
SHA19a1e05cb2c0ce8bae18a969f2d2db6ffa5e4e427
SHA25660e0e45fba0130172fdc36fe35175e3a42665f183ae60b04210ceabd2e22f213
SHA51231142d03bdd8ce4ad318c9b7de069b2a2eb2cf5f1a18928ae75709f038328e085ffe7f68fc5a8f32fd78854bc7ba6f4277b5a13d1fd4b37adcdbc8f82c448716
-
Filesize
5.2MB
MD5e0ea1be7bf7fd85ba581a5f9a9111e6d
SHA12a7b90a87a455fb71d70edf577cd4a892281282a
SHA2560d8f2160c9c173f2c62113aaa9b5ac5310cd335d44b9b231d1eb5cf685e22092
SHA5120e562b48eed246bc85bd9a9f745dd791f4ec0e9d789d3e57ff6b7ae0346c4551eb36e26476a4e93fb4f1c19cc3edb247247104f91b449d24f4ab4e12268174a1
-
Filesize
5.2MB
MD54192e37c18d9579c62115a199dc85562
SHA1875da0988a3bc88fc091939af66250937bca3625
SHA2569b649679a4ec7debfcb9b0e5579151d929ed6270036d4994d2a5db555d2b88f3
SHA512f7057129e455df1049a0a40d05d2565a1c58a558345c3265f6de1ad7790dd9dffa43aae6aece8616987eb4a7ff28dbb39c4e271bb41d34faca2db07c79b1fb35
-
Filesize
5.2MB
MD52fa7f738dd820bf1706dbc104d1893e5
SHA17bff2a11aee51fa92f871162dcaea5d7acaf32e8
SHA25683d3dcbe7debbf0d78178a96be2bbf6c34b2cfeede83674aebe968f0e200edd9
SHA5127a79cb33eb23d446939e3822b1fafd0db22f3182310c4a829334f631c047cb29f78800eceb0a25bc1e15f3e88eaf28f29d907a71e9fb942642099281ceec8bbf
-
Filesize
5.2MB
MD53e4042893332e0f33aa644b6e82cc27c
SHA198603444e0dbb436e7f7830a8310c4cc2db30fc0
SHA256887a783d9017350a786142f093c9fdab15fc5bd8bd2350ecdb53131f75f62d88
SHA5129788e7a1a97a52c4014ad93d8e2c731caa871a1d7c20b7674e34d014d7dc402851cf02ac532ae1f53e70d344d77020e352a181ec017d4afea4d01cb13667b7bb
-
Filesize
5.2MB
MD5d965cab18b6510fac58f7205f341a984
SHA12bffb16c1593937fbac01f8bb9bde648966a67b8
SHA256a6e1ccb6a77e7402fe5e7a2b181741ba3e3e1b6a1d009d7427fdf466404a2451
SHA512ae4497b28178e17d97d92d584884283e57073893db044ddc542cdec66fecd5efaa44dc4e3633862fe7f8d4bd3472e0b9eab101ddb93abfb2194b8e40be84f2a6
-
Filesize
5.2MB
MD5481a9f2bee6bb8f99b12a2b03f31e395
SHA1dfe87cf5b201e4920263ddb8992c4ee2dd911a90
SHA256620513317641d8850dc9565291801334f788a054a231ab1cc95c32edbc6734f6
SHA512ea1f2bc613deda78f1f992e7c48bd822c24621f8dd9f777a0fc87183c1c8e6f5f9869ff657c3f15d8971bae74d4e1878f5571cc3c7af2f1e4718644da7c2a973
-
Filesize
5.2MB
MD5403a0b90975353580d320aff11f9ca52
SHA1f7240ae6090097ae3421d6d6cb73fcf7ae1b3880
SHA2560dd55b9910da9ada25ad9b8bcda2a07877a87498df59c5ea3a59579a8c09c1c0
SHA512d77fb783676cffeed3e501f7653d5c3f2e484d0158c5fd51ebb4577b3311156c5015a21d8399663f10640a990f87fc12ad69eb8deb0cfeb7d38353a92d56e44b
-
Filesize
5.2MB
MD57a34a9e471661ae944b5455e314fb715
SHA17d31513bfc76dbdfb029ab121671541428d78f8a
SHA25632a66fad2260b2a4de5106b7cb2934b9a235a56ce452c1879661fa8bccca6deb
SHA5125208348922e87ab69943a411a279b890d0223fe3e162688f05bc8c81948079aaaf9cc0484a2b0f533399991a1c30c9685cee1655595607a934d6d36f6f6738cb
-
Filesize
5.2MB
MD539cc61cb9953f6892b0a8651866edd03
SHA1d338fde623ffddf33d5e04858386917418fb74d4
SHA256a11ad151ab5806a972108a3848ed7ce95f6a49711134988ab2ce20ea7d971d5a
SHA5123e9eef56ce3833467128b74f0d51e6f9152bc69164970d1ec1417fc44af679b4d487de6be8ba03ed585dabf548007071f1c804d30e5fe1e8e564ea3b5b190c53
-
Filesize
5.2MB
MD5ceefb25b88df084e53c4df8703aab9fa
SHA1af319b77400d157a4f66a104abec792a6506009b
SHA2566f88d7059b2a3ce34b01a283af546969bad017a4360c6945de3c7964f9ff166a
SHA5123f89c908d649ab3bacc5b2c6f5b98d77bdece701d1896ad0f7c12d7fdb5c8a44d8458226c213abffed53f3398f98a6528d43c8b8a288fb354142482bb3e71085
-
Filesize
5.2MB
MD559aa7ed7b99c2f52c9ac3d1e2b34af25
SHA16af028bfcb4dda8d19a8ffacffc0f417c0eb9ced
SHA2568321dee393bd74ee30ddf3d58ba95f2ac4f4efa51ec2787ce56bc58bc889621c
SHA5120ee347c97f2f0bf00fa32fc75269cf55327b067e12024cb4140f4466cf5fb8446e2a3bc3d73eef317f61514242532e9c2916274249627c2b28df029d8677acd0
-
Filesize
5.2MB
MD59ad684be1bc2bd17e4ec3d5d6cf23626
SHA105b3bbbedfa5b427677258144b3c08d6fba28411
SHA256ee2da86a7865fe7afacea37ab162362873738b923f794e222ec06f2b5583292a
SHA51295f095a24ccbdb105bfa5ee40f279df50311f188a3b787128183e76905749b3aa25b46013500b2dc64039d83a4623389b45ae3625f10c2de87a0eaaa019b5c0e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB