Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-09-2024 09:28
General
-
Target
2024-09-21_4c4c8a66a204dbedf869a0e01ece4561_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4c4c8a66a204dbedf869a0e01ece4561
-
SHA1
93f8c9d51f7a0eadd83ab66c277832d6450b192e
-
SHA256
a9e8f70212f7f0e9cd682977de9f1e8ad25c33998bcf79834cb5f8a2f6cd0706
-
SHA512
540dc2e0ba2a63e06009677e2d83b08bb0dfc676dbff91ed72d222acc8493fa496ea599bd33173c3eb26cc32298e33727c9523978fbd5270f75f0a08e0c46b23
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUP:T+o56utgpPF8u/7P
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_4c4c8a66a204dbedf869a0e01ece4561_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_4c4c8a66a204dbedf869a0e01ece4561_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\REcuIyM.exeC:\Windows\System\REcuIyM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMLOOae.exeC:\Windows\System\PMLOOae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfFpttl.exeC:\Windows\System\qfFpttl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rAZyeTd.exeC:\Windows\System\rAZyeTd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XHiFVwu.exeC:\Windows\System\XHiFVwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTgoXfi.exeC:\Windows\System\DTgoXfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPVHPhq.exeC:\Windows\System\IPVHPhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FXWQGxo.exeC:\Windows\System\FXWQGxo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieSEIhF.exeC:\Windows\System\ieSEIhF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzbQPho.exeC:\Windows\System\xzbQPho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fUFJMgs.exeC:\Windows\System\fUFJMgs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xFEJDEz.exeC:\Windows\System\xFEJDEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OhgABok.exeC:\Windows\System\OhgABok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OgxGnpg.exeC:\Windows\System\OgxGnpg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKCAQEI.exeC:\Windows\System\cKCAQEI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pnZoFjx.exeC:\Windows\System\pnZoFjx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuKnfXr.exeC:\Windows\System\RuKnfXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxlcsQR.exeC:\Windows\System\nxlcsQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYxOkjV.exeC:\Windows\System\YYxOkjV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCYzeFq.exeC:\Windows\System\qCYzeFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASuXhEM.exeC:\Windows\System\ASuXhEM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c6aab4dba4b11dc2d7748e514565bd5f
SHA1c3c56c96bd997246190bb95c7fe635321f8454c2
SHA256262b5e079880e45eefeb81982e0d690a00768032ecae36e19ff461890db676f6
SHA51203798b40da94f79eb3c6e7db814ce4890216650a0664ed95820b646ea0a6c56ad08e608f0fa35d745ba90de28935d4d61429447c52b811bef3415f2d9ff3046b
-
Filesize
5.9MB
MD5ccd806228c25b0fbb2ab1e2abdb78f76
SHA12d85abe97befcc5b13db77f77597710751668e27
SHA25608c27b9871299113d146ae5de6f3b2320fdba8728247ce9e511da5708e7a172f
SHA512728daba7f2ef421531ae17198a54963828816acdd0c2376970547d1fa74b4fc7e52114bafc994549dfeedf284c0557a1929f107d4a8055a83727443e826c9d4c
-
Filesize
5.9MB
MD53fb9bb466496e9fcd17bbf836e7460c5
SHA1187286de9405e86725c849d81f6068a6f8e3c609
SHA2567f7b26183b98a665d3aceda0b55109ad68a1cf6bcbacc9272e9f7776ab83dd53
SHA51253c0759d2781dfff55948bd8924a92fb919c63c7c763288cc30eb6434d459c87a838b6cf187254e50b77de391191facd162ad33490ce8f1e09639c39a5339ad7
-
Filesize
5.9MB
MD5acfb53e48e8b63cd2130d7f2be2c583c
SHA181b0bfb7e35b148b566f0dbb24e133eb6abcf6f2
SHA256dffc43c67c7a29ded6d55b1ed0c91423e209c826f9592b19b0a67caf0b803ce6
SHA5124aa0e8be3965e7a1861c738ce04c99055095fec3c063adc9b9350da74c5c2a1311c2c19551cb3dccd1be9c6aeabb5259dead56dfa106d75123ae192814af9640
-
Filesize
5.9MB
MD501df60a9294500ec340a0f2736499281
SHA10d60817cc1bad3ad989cb0cbf253303a9f75d87a
SHA25632ee3363a3673121815f8f0c2c0cbcaa2a6dfbeb2bef2dc41e893a4e65bdda66
SHA5123d1b5165a4afa37d885a3bf4af00f70956baa0e64c052139f138e3b176f3a97f62fa7ea9e16ff59c1520ea28bd26f3c37e323395fb2f4c424fa82009f41cb927
-
Filesize
5.9MB
MD5ced9b72520da32836e6a489515e6c79a
SHA19500b8795c87fcfc777a12f800b344772d13eca3
SHA256180f1324c6c14a438830bfc83c1ced5bc15d7dc9593cd0c881379064b69b23e2
SHA512ee81075a3e59f581315a9b301f9f13dd2ece90e36aab70366c7b00a49c0faca69c217a7128752b274e47f803c4ed0424e8a5595d5ad2203ba8aee218d9bfc636
-
Filesize
5.9MB
MD5d92b6a95d9a5116df7044eb319735989
SHA1b064a8e0cd5a96cfb5d6fd19f0c98a881a7013f3
SHA256d4892264431f1cd5fa8612ca50bc45e2e6ef4b09cdc1c65d11cd91ac1f6d0023
SHA5125c9255058d0ff2e2d0f4d6abfade948c9f54d34e73a96e621bf4c4c8597b18251d307bea92515d7e78ef9912ea4f018eb3641de81774092e1fc6952a2a14d296
-
Filesize
5.9MB
MD577b3dbdacdbc4e49df4bc33cc0a6f1e1
SHA12fa1ef4182a5e504bcbee4caa08b9b96335512f7
SHA256185976f174a4db990b8efd574df13a50118e4041ca18b553488a4e6e7ac7e2d2
SHA512e8832ff2e5dcaa2362f7b48f95c129878f684d0664fee494f54452349d1933a66b17f25708da312f93bdc5b3c9c7de986575927e1444c33016c0abd8162b0885
-
Filesize
5.9MB
MD5d8dab6ecafb74bf09f94cb03a1c96970
SHA14067c9e314517e64f3a2dbe654fcaf5ca962d5d7
SHA256c4de4aa26c1ea2605c2b1c90cf48ce67fc5e55eab2570158cd366b07ce9e0be0
SHA5122d3a61727e3d39438fa212d5e0ca1b861d6c221dcdac6e738acb72b7f73137067e7c98f5efc55a62f9aa3e4a8097abbfc2935fe44d51990e435b92207432d517
-
Filesize
5.9MB
MD584b807aeb6c0d94947fa64d53de31e5b
SHA1aa205a98bd01ab85a3ff61a5ccd63e8b2d25f314
SHA256f2515bbeba26c9f1ffe648f8245fbbe84cd08ea770e8fa06117d31db32add83c
SHA512442314b3b717c31cc0dfb368c1bcc1d7c2622dff73e8cebed43b5dfa45b6e68a0304f3b002c293b3a59ef98f3fe81ce73f7c1fed6ac8739541f9404ab66de48d
-
Filesize
5.9MB
MD5c99a585c1b71b08de1c0bee83bf7d300
SHA1511744bb3f53485dc24a89e760af503928a30a4d
SHA2565baa44681f874658147be642f9f13f44841e82087a3b48fd07da35ee41fdd982
SHA512ec5b4c43a60044c391c823305447c135c7b702464ff6de913043ec70d4c5c2d9e0d9662a2a7e213bde68c50dc44bc2a2c4cd477f1d7d9c9cca2b6b3d7080d6ce
-
Filesize
5.9MB
MD5704e2f76c27f29fd715c814e08448229
SHA1fc7353db395243234beb417c92fc69603581ffcb
SHA256fc389b002d85a448747161da741aecf4934a34b4f26c86ec31b68cae9bfd773a
SHA51222394677d146d2dc4f7ebe72c7523bdf2bfad63b5137bc18ac11b66d9585ea37b1fd9680cc7c7b81b3ff1e546bd272a56f97899b1eb6c482d85bbe856934bef4
-
Filesize
5.9MB
MD51f56c30a100425794fa1edccfbb86169
SHA16ddd9f6edcf9a4b3241deda0483f719aef6c7630
SHA256c59202c5134d3f15d6bc7ed6a6f3e69205d084465a2de3d06f7aea2c39bff1ef
SHA51245be895150d94b3ab5c0302cc4be6fee4ca497b6e542633e515f073b6cd97f429d9feacd8769904e242e21d7ee30fc4b9b2a24395ef69197b60a8026ef6cec45
-
Filesize
5.9MB
MD59e05cd98729368ab6a97012d2f344f01
SHA112e2bd1964cded248b8ae8159332b5cde05f4e2d
SHA256ddaaea6b351fc19b49ccfd15302684e8e9b12610031af78185dd97c393d35ca8
SHA5127a6a3356c252c85d705f1c499cb9895b3dfec9be27f6b724077dca91e42df29388532300263620c16a39e0e3da098b1fd7826b28ed85fa04d41c820244d55fe9
-
Filesize
5.9MB
MD5e2dd1fb709a3d6e87109f9c8d0d6ba19
SHA1798dc096b133108aa24ffed8440081dbb2337a6d
SHA256d74d4e00fde11a8d4c4fac0980887922fb5ff6bdff4563de8a27e3749632239d
SHA51220c5c5f91a4af51364c3bdc8453b1be548b982c38cc6b4e1f91bad2c46af96a7a10ea53fb7604ff04513aace63472325c9da7e9e87e9919dc145bf2f7a597295
-
Filesize
5.9MB
MD50d16d6f4102bcb16b5030f5fb3434782
SHA160de0742396c2ce079c588e9bbee183db056bb61
SHA2566a27b72d8d44edc5a292ffc1ce80dd9359c3f3ddbcad5a929776f06caa11a740
SHA512e600cb0cb35759bee637d81a2373ed06be44559ef059ebdc039c7bb5214b95bc41317241ff857149b7e280896aad8bd1da4157be7abdd87530801f3d358275a7
-
Filesize
5.9MB
MD5cceb5fa69696bd69588bdf2f0bd9d498
SHA18e76a9f2741115942adc333ed9de862ecd42e1af
SHA256888ffd0849dd89b203cc68df80df408cc8f6e067c2fbbd9737b209662d552eff
SHA512d8bab306000ad9bb10efd234259bc23a26cc8890017a72bdee106380e75931487e3a7e1555319f581cededf62f3f03e18eece73c7532ffc6f0ca499634adbdd0
-
Filesize
5.9MB
MD5211c9fe4a5251c83e4f178e4f398fc09
SHA1cc21f185710fa90ff08f64c4686eb7afd49ddb1a
SHA256a36eae907fede0968f70e7c0a72878ba3c3adecbade9c2a335d012e058ce696c
SHA512a8a38df5f1cd5a8646bf71af0200ea07035eb34d96e53e97bf51a18f0b21ca5d05dae151efe7780d2f3d45d86559dd287a00f2f962d2fe5bbeba168d3349d9ca
-
Filesize
5.9MB
MD5ab913d9d81e52d34d066717e12d18cd5
SHA1a1dcd795ae89f22e81a737e05fb8c3c422393288
SHA25677a7f12ead8e14dc7203f56b5c9f4e51a367df20d41e15e2258ba1713f80cb8e
SHA512c0ef2bb6e7a7df3b345575925a641c370ac5340dd22da45b2549017f5bea255e88477f91b3a507d761bc4fb523d1859ccca1defe01410f5e044eebd658c2efa6
-
Filesize
5.9MB
MD5c6374792ca34391003af1d66bbaf7752
SHA15703cd5ce2a2bc495f2b9a518750428b1ce1d8c9
SHA2567656c5763d661f6493820f46b22b9a265ee5e2bcd130ea051256bd7fdf31e550
SHA5120afa42c17993a4e7fd3face777bb3c02eb275428e717b264a1ff3a4b8569c68602b3c1e3060293abbf5e2b73d5ae6c537590a372cf48729306e5e8858d73b1cb
-
Filesize
5.9MB
MD5177998c9a7440fcae7d5e1b39b8d5d2e
SHA186ab743d20771f68559a8dd938075f2aab07eb8e
SHA25698043780bb2f9dc9f1f693cfa1ccd1d724ca202f380057214da1d6304c131c43
SHA512d2347f30faa5d71f8152068553ce1343aec31a545ebc93fe0c6635fa41b5b910c970ffff6570b52b2965aa68dcf5b77911cf9445edb4845461a6ae63ae60b71e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB