Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-09-2024 13:05
General
-
Target
2024-09-21_7a8b1387c18b94a0981523d63f665674_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7a8b1387c18b94a0981523d63f665674
-
SHA1
b26ad3add5bdf0924c8afa78deccb10fd40344b0
-
SHA256
0032e22955d575f4974f7c7121d927ab018c3b6c5b76eda4f96720566d3ef565
-
SHA512
0147988e7083e007152a071a225ce8ccbb845209fc34ba2c13196cd87a1ab6e7cacad853768173271f9dd5dd4939f6e1f6da0f9926a9c5ec9a91a1ccb4043d66
-
SSDEEP
98304:demTLkNdfE0pZ3v56utgpPFotBER/mQ32lU8:E+i56utgpPF8u/78
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_7a8b1387c18b94a0981523d63f665674_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_7a8b1387c18b94a0981523d63f665674_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\skrqQOX.exeC:\Windows\System\skrqQOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GifwETo.exeC:\Windows\System\GifwETo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfNGyNT.exeC:\Windows\System\kfNGyNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\diRiKQV.exeC:\Windows\System\diRiKQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrbMFoQ.exeC:\Windows\System\IrbMFoQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OoAtDZW.exeC:\Windows\System\OoAtDZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jHgSnWY.exeC:\Windows\System\jHgSnWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UvzwQOw.exeC:\Windows\System\UvzwQOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uTTOsBI.exeC:\Windows\System\uTTOsBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kFoKOqx.exeC:\Windows\System\kFoKOqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZnoaxDn.exeC:\Windows\System\ZnoaxDn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WNYeSIg.exeC:\Windows\System\WNYeSIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HoXflTr.exeC:\Windows\System\HoXflTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbqUUar.exeC:\Windows\System\hbqUUar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XkkQtWk.exeC:\Windows\System\XkkQtWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztBxijq.exeC:\Windows\System\ztBxijq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNiAqBM.exeC:\Windows\System\tNiAqBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZYctFu.exeC:\Windows\System\yZYctFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSPmInT.exeC:\Windows\System\CSPmInT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KeIOKmH.exeC:\Windows\System\KeIOKmH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ANhDNGo.exeC:\Windows\System\ANhDNGo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD562431b3f576547fe2a3a4834d042ac5a
SHA15c136514a43f10d480b684e4c026ae422c6250db
SHA2563fadbd02044b99c78551a19ec31a0b2c207a8e07e0e5521b277381b72569796b
SHA51288e81d5a1af3eea91ce96dd58b156e059cfa983bb94fac7e9bb438f23604ef17e981f5e086c2cda2832ce825f856875be6e12fe7b846e48e0be4ebb8aed25e47
-
Filesize
5.9MB
MD53094f7418ae30156d6ab7f51f5bae8c2
SHA1664f17c70f310a50af2833ca6fbea772c1753655
SHA256966a3d4ce770cb85c5bf65da0176963131dfcbe7ccea0c3ad38dec99fb80d1d8
SHA512452a4fc0bb84ec3833a5e905ac3dd4a439e5a923c3859768b49f13db4f639400872b2af1236bc6ad02b0b19ad8d56115b3282dded615e4cb9956dedb1112826d
-
Filesize
5.9MB
MD5a920fbd1830105bdfaa05c5c739cf4f2
SHA1b2363cbce2474a96da8305f16ffc5e96a94d81d2
SHA2562736a10ddd0baf9794c4eaddd1ad466a3cd45788e6926482a8ea99e4a56566d1
SHA512fbf9e3802ae2fb97e5346fd2a16de58bca62ea3137c8e41801b0f5ea81c1e6e72bb8ebbec4d487c299c99ae74322c37beebb97a02553fba17e3b763a68b241bd
-
Filesize
5.9MB
MD55b9accd6db5fe1758054e7c888cae544
SHA1f4f7c266d06c141d03a3daa6d9eb6b03509676b3
SHA256f4b8817accc52972b4036721b53d93c7cd2cdc91413d3f9617c04abc32ec48be
SHA5123b6e50c043c9b751de6f781406f496d4d403326d1f2ab281fb7fdcab2ef06893cdf8925c90dc00c35904ca833bee2f2d1739cbeba8367d666710a950c250ea1f
-
Filesize
5.9MB
MD55ac4d53d64a598116014d4dacd9ade66
SHA1bc7003a33578994faa227a34bd69e849574a2b7d
SHA256fc5272640d959efc96d9f2a8006654c9ac15fd8ba4114f7b8921020cf162fac8
SHA512fd46e7a4697d5bb03a6c93f9881b9291b2577e6cf2c8bd086357223d8ee1588a6d55f503607b8355dc58d601f6e09ce8c8a254c9dcae5d0c919b504bc372603a
-
Filesize
5.9MB
MD522b2329189936ca5a7ba07ceb3cad484
SHA1f3b44e5c1d4f1ac67f858269168d32301678e94f
SHA2569148d427b68289269b73a8f1b26023951c84674e91317379cb1712227419a3f2
SHA512e89438d9a2b8bdd4281f0b1201a44fbe3c7ee6cccf7acbe41830e1d06d159c47192c76d6056894c9b092316647bd7f95e238f24c028fe3a195c7f8d00d54a375
-
Filesize
5.9MB
MD5aea03ec0904a798647b46505739ef1d7
SHA1480d832ae9970ec8ab5bd82c8c05d36bc437f358
SHA256104b9f4475aba01117d3cf62ed9905ba30e1cca4bd5553442543c99c90a67e61
SHA51251e6e5ec220c079c8fc194ffcb8c7b14235f958bc3ec29f6ae7bfe5467a8ab4f31ea93276dcc5a69c71f30aa548697f04f52f035dab0cce59ed109ce33826e7b
-
Filesize
5.9MB
MD5c3684c432c48ae3fa81b7992f42c7667
SHA16f1f082231eedb2c43385f4c631ecd473b08512f
SHA256f61d26c73cdce753c7e3ec698a37a60bc67241d9ead07e0c93bf5499556e50eb
SHA5123c543868af7fad3d7577a268ed7886f0e94d8fd5b0570203fe98740e9060e5da8c63b1ebe17918ca8bf4a09562054a786c72f42b244f7fdcf271a54c8e80485f
-
Filesize
5.9MB
MD543fa57301428d204553e9a89869fcce4
SHA1922b6df5410d20135a1dcaddddf78dfff76b50cd
SHA256bda0176a0fd86f3dd36f346e8b2e906e7a81165920feb244c682a7c1c2713154
SHA5127d1381d2a2b50ab30f709c834878d54d2b763530b6b1aa4f40b1b774ed6f697a3036ed7bbf04956c1b11e30b5ff6aff9f58acc48c0c2e5b41334dbc77bfaae4d
-
Filesize
5.9MB
MD5d42198a10947844011105f2b6218a2ef
SHA14a30b3f256e92f704991e3ec722a42a022041375
SHA256f6a7551e9dd6a404d532f5651952c844ffdc19f8ba590830e4ccfbaca273a279
SHA5128ca26da2e7450db968a6467a965a8ad859c6575cc942eb6c5d8357d6a3bbf14d22e1edf5da92275dee782466f283e7074900822b8eaa770538b7dc801bfe5709
-
Filesize
5.9MB
MD589c2d29698cc5aed7a12a61b1c286d17
SHA1b393e69ddd33c028a16eaf634de0e525e728f330
SHA256b8eb6c1258f81840aff8c3b6ba85ddfdce06bac0c375e781fe0261483787b8a8
SHA5121f4bb8b3d5158d896ee552e418f0d89932403c0d92a2432e4744a7ddeddd307578abe494cace393830648e46a15f5214194c233a8cbf0279dd9c6aa52e1c9d12
-
Filesize
5.9MB
MD54b4c918b0dfa1ad8d12b085ef897e842
SHA132df1fd3bceee1339cbb3a17a9e73028446d4fcc
SHA256366801929ec09f30922936340de1e718cd7130d2d89cd787ec51e92981300c50
SHA512ccea633ff0427c2b3fa7690977510be217913b276515a2c48813ed9029c7d74c62f6af04a7c77b838502f39f220885b309eb6bf9ca8f5f4faa4408cb27c4a15e
-
Filesize
5.9MB
MD57de19d04165468a2eaf25e8619938cad
SHA17e353bad496873236dacfc15fc4966f454a6bf8e
SHA25605b81bf6aa011a9b5f8203eca497384cf864eeb1b2d9ef063a7e789d5cd9af2c
SHA512f70fbc1f7e8ebe5e6084f3818cbe98559c50ed486f990eaa0269e9baed18ea7787bb5ec6aeff19d5d2535aab99dcf46164c5bf675c6eb8c2a1e7b32e0e68d905
-
Filesize
5.9MB
MD5fb4229dcbf1fe1048a4f1777ab5dc29a
SHA1659e828e6039ea5b3aad162277fc95c25307112f
SHA256d20525fc6d3240346ffbbb4d4cd073172983486e77dc78953b06903f5fd98472
SHA51206e7f89bc2456d72d4f15df34585a85ccc09a502ed376bf735f72a1fece9be82cc36fbcc1d89058ff0570bf59e4f73015c2a5141d26b905e220e8d4d33c08e5f
-
Filesize
5.9MB
MD5863284c02ddc1666c5e5a5a4fd482a1f
SHA1472ddbfdfebd1ff8a811e690cb21d3272a778d98
SHA2565cf4ff835a49793b0d97f9b928d9246aaaff5a438dc7c7452c9c1ba3c37cf444
SHA512a7ab7982bd707a0f58321f27f1fe5e5d9f49676610ad68d322b65c9cd2038624364941cc0bd8c6c101c6ce4b02072e8d270bb4620d51c40a84551d221426ddb2
-
Filesize
5.9MB
MD5e06c27b25f2126e39a4dd2b556ff9584
SHA1a3513ae496d1766affb125b07096188b3e23f8ed
SHA256ed71b2e4e7fb3ef7611da483ae8ce766de22e35741b2103d1e4a63f6b61a19fd
SHA512da6998a61753f36a63ba8657ef5f1c4915faab080591b6fbcf03dffa183a6539b63811a5915d792ba40d951d2bb1a0f77271793ce178840165c5d2102b97afe0
-
Filesize
5.9MB
MD569ac8358aead113993f867beeb10fdce
SHA1dc28db2554b9876bc22aeb3bafd627f9e769dc4a
SHA2567d7cd05da70d21643fa76f7b44502948f0980be7e62a31ca11e8a6ea58ef50df
SHA5123e73e83daff0628222b2ac6130cb62797cca7b65466467b25228c9505495168e4f8e6d66e49b96cd1bb11fbe474ba8bff3f66c5062fc00a8cae03e90526aa34f
-
Filesize
5.9MB
MD5bdeee0f75b25cf83bba5ae5862e90cdd
SHA1b31863cb021ad72b89abcc1253ef8a3c38c1be13
SHA2566d3972a0512db4c1f7aec40b53d2f263de3e4d1f36e04693909a6bc356ad050b
SHA5127d78a6a76050d52f031193c9c8be4763b7bba0a7ed1b7cb6a23ab1ba2217326372f392a20578e4b7f9278d24619043d33d86af1128cb2828c1be6fc423f696d4
-
Filesize
5.9MB
MD535e17f671bc32a89894683a51505414b
SHA155fcd93cabb881ed8a38649acf8c1d09493966de
SHA256cd7561920ddfa97d0480395dd7557bbe8a412f36ff325ffddfd2bb381fd796f1
SHA5123d00c8271032d19c254599cb2e119441ccca6e79e99572d072e050089022e18e9903bd3e46e3db55352dac8b9892078867cc9bc1473475a54212bbd7fa416f3e
-
Filesize
5.9MB
MD50dfd22d3229655b21f042f4fe66966b6
SHA1dc760e99908d59c2e4277f5828a53486cbcec67e
SHA256dbb540007fe10fb55aad5b1fce3d8a7d2e58bf8ae85e0832dd0f527b3163a835
SHA512ae9fd0638b45e04c511010f58c114808674c18a844df83d321dff98d062226348c500849d06c8f0fcf325dfc1c46f1e4dca740442c4fefea7bf2cf8839468281
-
Filesize
5.9MB
MD59fe990c3ef8ee6449a81f52ee767f482
SHA19d70e1bf2acdd7a79642fe1b3408f5debcf4fe1d
SHA2563bfad7dfde2c93eb195cf75d7fd6f8d21ff201ada0ca478f75fcc007dce70f73
SHA5122778e4e1f669a26697ceb783fe634cb7b5bcbd325cb16fb7125640ff404ebfe334304ae8d3b88956173b0832856795a263a3661521ea8837fad66fb0a352dc9a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB