Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 01:06
General
-
Target
2024-09-22_ecce330ae6eeac65a3dfb73a777205d5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ecce330ae6eeac65a3dfb73a777205d5
-
SHA1
d5746eee449e33cbf5df1776a0d987ef20be9828
-
SHA256
98e23a269c039dec6e2da32705b2fed25df041590165b73baac680742d44a29b
-
SHA512
7deb67afe45e86fecf7053d8ed0d2cc6c4feb9b5bd689c587647c1ee7f58a45bb116727557a4107a7cb58bcdde53e4df34b2900d56377f310bf88529c1590430
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_ecce330ae6eeac65a3dfb73a777205d5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_ecce330ae6eeac65a3dfb73a777205d5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kAtgqyR.exeC:\Windows\System\kAtgqyR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvPRrPK.exeC:\Windows\System\jvPRrPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVBmDyV.exeC:\Windows\System\rVBmDyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MbhKUQg.exeC:\Windows\System\MbhKUQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uoIJWkS.exeC:\Windows\System\uoIJWkS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGLVsgb.exeC:\Windows\System\hGLVsgb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgkrFQv.exeC:\Windows\System\kgkrFQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qKyRAsb.exeC:\Windows\System\qKyRAsb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YzbsTWD.exeC:\Windows\System\YzbsTWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOXjOok.exeC:\Windows\System\yOXjOok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOefOzJ.exeC:\Windows\System\dOefOzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fDmSrhz.exeC:\Windows\System\fDmSrhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDzzvQl.exeC:\Windows\System\kDzzvQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYrOxOk.exeC:\Windows\System\zYrOxOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qakIbWe.exeC:\Windows\System\qakIbWe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVWAyhW.exeC:\Windows\System\ZVWAyhW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAGQCIA.exeC:\Windows\System\eAGQCIA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIdszZg.exeC:\Windows\System\OIdszZg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfZLFPg.exeC:\Windows\System\sfZLFPg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OkCokVA.exeC:\Windows\System\OkCokVA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRpAQSK.exeC:\Windows\System\MRpAQSK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54036afb48eca0f836ddae53446a55d9b
SHA1400463e4a89f35db6dd407edee2e735b37087d15
SHA256a8e244761a51479b1651548f1c7eb3b30fc9740750277f4841f99c8b3883e6a0
SHA512737d305a18f76ac2548f8175fb3133f1bcbbfd32c929465bc82784a4484607b4d74199424f43065dacb5e0fdc247bed2262a4ef27c959d7519a8cc789993b2c5
-
Filesize
5.2MB
MD571cdf2df6a1e0d2928c49be9a690bbce
SHA175526bea249301aa6862c97d5baebfa6b968fddf
SHA256f9fa985f23a688a0432d092d6e6f68e65a74497a8bd1da59c43d4f12dfb7e7c5
SHA512a53f6d3fbe70c159213de33eb2c2c9c79eb09bc8e04c931fc44b8f4f3aabd27a632878992f758800269c5e1ee979f8d7c864a4a8c514d639e8caf2c5354eb07f
-
Filesize
5.2MB
MD54c2dae10fc7830954b1c4797fce85c49
SHA17fa234530151441c8b492fa93962200872374a8f
SHA2569c0fb035057a5604e4b671b0b4b4016f1707c51b93dd88a55039cea46de246b4
SHA512980b8df8e4f4a3793dfa3a319c36c1194067c2548940d9f328f612b9e8fc2d5b5a7f102ce30131e4d0d4828c7b0a132a44b5c23202a66b85e637d0bafaf62706
-
Filesize
5.2MB
MD513431cf112b0bd6674b4972d59c4ad6e
SHA13a300c8c9e085afbaf59e3d798ed9ad4dab459a2
SHA2565a5671aa4ad5fb841a7e02aa1b853270d32dd254bc9de6308d6b5e251ab05753
SHA512939851fa4237aa92bf033e7e86d8aad8e66721c53c0141eddf7ec4e791ff5b4dfd701e3966fd8fb86bb558f9793703b507847e3dbb0ec1d8a81dd3846177d589
-
Filesize
5.2MB
MD541c3b317ec36d8499f4ee98c322afd75
SHA1bf6cba3deaa819f3674c801d23cda1dd45305f61
SHA25632aa75746289b1da0eb2c8d302c934af69ad627756ce77ba205ee5f5e7b7c96f
SHA512a18ee7fb9648ad1554efe940b37bbeb9cdcafb2be55dae53085ff02c67d4e2b943c1dc81d74aeb1db8269d3b88f8ab3cfca17a4175de471ca5e60317289aa5bc
-
Filesize
5.2MB
MD50343cb1febb5efb6d6fa40d27684524d
SHA1359b39f8b2c587b40df1b2779a448d21b28b43b5
SHA256e742801f77d1dfee9aa6b1bb53970dad88615720332139c636707de5378f713e
SHA5122c6d90ef705566f79e8036b23499fb49a78a34700e9ff44663688b2c406b4104fadc4ef2e2d25ef4388e342ceac7c98e355508e10a5bf515543e41be9501079e
-
Filesize
5.2MB
MD50f7de0fe65f772e32baa9fad6b02fc83
SHA1fcb6da85dc60aa5e0a6d752223027947da408e73
SHA25634d2d1907cc11695ac29d161fc62d5dde934ac64d4ea7425ea1337a87d3d9ae6
SHA5126d97da313585b2ed5197723885c8dad9e608bd1647500e3cb6f1bd6f35f67900936364bbcaf5b17158d306aed40d0e990824f6dc2c38aca1237bfc057936d222
-
Filesize
5.2MB
MD5261c55affda69d439b4dd6311423c15f
SHA130da54d05947facbbbe8621fa0f40b0dbb32e88d
SHA256c4c0e60789d8ec9ab791764d76a33936e1e09ae52bc5d286a18bf4e079fd4983
SHA512aca82667e296d76d89d3a39259689ce94e447ea8d03a092134d8c77b7f1606263b3e7ccf378beb1b7622650ed16f87fd01ef5fb7f87921f21e725871083caa69
-
Filesize
5.2MB
MD55ba360c08bbe81c6cc6e3db8d74dc1e7
SHA1a8396ce69dc579beacf35b8ea72afec238f28d55
SHA256a2fdae1189cef7f4d4dc12ea84b0112f3cfc1bb762527660c069759fd7d34a83
SHA5120f40a5eec600714efb9cb74cad19d74829a877c7379c94622ea0c0fe7e4294f6eb1967c7a064d39eec2fcf27fdc889a0038854316f153eb427e7f6bd87d9e4a5
-
Filesize
5.2MB
MD51ec746190002c2baf7f01bdf940f9afd
SHA15e042817f5c2e361ab55041df6d5ad2748815006
SHA2561c892f253a0b6c5777dba522e90169f2941aab14a7b6d7e858f46d365d38d972
SHA5129df1a120644dd45720f0e5961dcda6bf82d8581bc4642def5a07cafd91cd1c6d08ffa5fd77ffa0916a2daff7660101c91691a46ec68c28d9e78e624b7eeb74c7
-
Filesize
5.2MB
MD5002962108ec40748fd8ce9eb74c99fb0
SHA13c40d16ebf38e0fefe1ceed7f7e3c139974b3a71
SHA256666522d89c9d0325220311b69a836919b0d90eab492e8dc12f7c500c4cb51760
SHA512816ae5927e8eb9856753c37cf4a46e899a58dea1a1474c0b56b0fcb0312d457cce629bea6f3c975062d1d94f47a8ba33d0ede3a19f80cd21b3f9ce5ef59381d4
-
Filesize
5.2MB
MD565c8a005aafc5a44580b08ed599f0909
SHA1f9b134063efa596550857dd52ddd43a9b793aa4d
SHA25625b6df431d90f7a91dbcd60d128a806c5249999482c6aa57b291c07bff7c4034
SHA5121707edf76166f64187d1aac00ffcbb42ceeb5693eadc58550531ec9168decd0e1baaf67b4bf910ec3c19c22506126102adf379f4ac6a761c152e61b04a714205
-
Filesize
5.2MB
MD5b5830c46d9399d8d0b5e3ed37053eb21
SHA12fe198912226eefad8fc4dea118c004264abde5a
SHA25607a87cd6ae6c60c5a97c15e15419e68448afb0cb854f9fb067404630a882889a
SHA512ef57a8ecff556d75241f30bc2c6f7d79268390b7f4b236f04566be0fd590f515d7fb5b91129f62cc9b798a28ff04fd247296633837eeef378292436417dd6252
-
Filesize
5.2MB
MD508dab8e78d987ddb305742429584515c
SHA1d41bf0fc6777838897c6948aaa7885d6df40a120
SHA2562c4d7b6d2721b581795f57ea0d30c1e7ce5d1e4d3991b325dbe82166d9f25f71
SHA512fd8c5097a674a75c84a33ed9a8dd1194fc175d9158353b389cb42bdd4c34f6ef1b9ca0e3118aba296b7c72269e4dc39a322fb97131593fc7ed03145a0445590c
-
Filesize
5.2MB
MD58836898fc282f4ba13589d10425aed44
SHA194eba585323f46a3ec9bae76989cef20fafcb41f
SHA256d07dd11864d2bbdfd2dc08c60268d7d1e904b613944d147c8d2eb9600e6ea82b
SHA512a7834f79817583c9614f7246c3f57f167999b17a22600852d2e60c6632a99b5354685eb5c92d92c746d1d845b8b22cadb6b3dcd91436fed8173bcc2b6a4563f8
-
Filesize
5.2MB
MD5b8a70569eb3681c49c5009dfa179ae2e
SHA158840eafa8955f6c0baf4a6f88d4a95d2a9ccbd4
SHA2567d108918b11a32ef8131893fa319bfa20b055cad388bc17f12dd3682623fecc7
SHA51215b63ef37796645e72e31e72185cc94c3bbf621daabb0389cf82afcb6337d54fa269db91923cfdbda5f53683ed07fc1af27391286f67d7c3cc9c47abbb6fc016
-
Filesize
5.2MB
MD57a9d23f9f2e4ca17e2e44e675aef0345
SHA165b36f19a248ba9b1d1ce3f8522a854122af1c80
SHA256253c8b6d30e145b3bcb9528dde4b31560695af412ad5058ba790ed186b08a8af
SHA51221a8911e547a3ade6dc88abb236a1d34b03f8ffadce2316fa46dcd31ed469260b2e8f75a5a4491f6b50793b6e5926ef7a9ef017909426b409f26a7479db2935e
-
Filesize
5.2MB
MD5e1c348af734fb14ba2aba33e760d405e
SHA1e50a6316563006a0068cdd4283cdb6bcd4725eae
SHA2560c125229216d362f987d3e88b380fd0a46df4cc1392a9394b09f169c200976f1
SHA512e1f03d2fc9d156f470b561f5711ee5bac097fb73a99af86f1d552c946521841f38fdf9403db04a9c82b016a58bf40df18c56933ac7bcb39c8753f77f6e11458c
-
Filesize
5.2MB
MD545696efaff289ab8cc4f536d62ab8291
SHA1c32401785bb478bcf84a3606f69f7584e7968b4d
SHA25641bea3ec4f20cd99d37cb2d0e41e9efa02a961742772f220ada5aeaa8e07b78e
SHA5124482625a6ea542d91b9d900aec02f70df7970122328c2def016302a7e694cde3aad8ead6817effceb3f729ae731e9fdab2dfd2cff20434b37e3765cbe49783bc
-
Filesize
5.2MB
MD591f0d7dcd537547de6be11c791809110
SHA1899c2a6476f19ddaa8d641f6bd88c27a2a1272b2
SHA256d30fcbd6896bd7ce09fbe6384372ed7d3409c6d9557009af6f691c2064662697
SHA5128e127a8c74242656eea5f42a21557e1b2bb224d0f0f6000daf2f0c2de0f6dabd5046bbd7d9b8db7e24f8fbe1f27833b47be7e6aa20c32a32a1f86e9967d486ba
-
Filesize
5.2MB
MD535c01aa459241c975249d14d3c7788c1
SHA14748f59e446b3ff61e8cd73bf00fff7c54793910
SHA25611c208fd407a3e14751194e2702d5c0d3b244eb99ed651cb69c3f643b96de680
SHA512350644d4dd5c86f6349322887dbc299a2d74c75b44ab9418781ff16287c282b0bc05ea4df4187dbd4028834eb1e37a659058a52ef6ebe9a915700ffeadb8da5c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB