Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 10:45
General
-
Target
2024-09-22_0264c522ef763f53c7ff174fb72beafa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0264c522ef763f53c7ff174fb72beafa
-
SHA1
82c2736db5a89583dda9df30672ebf67a30a2839
-
SHA256
9396623ff39ed0bafe9e2020002105bbc82425917724fefa024393d31b4009c2
-
SHA512
533091a660b18a503f7778c9c68d74b554e04005395bb896db2c6a007f823c84687fdc503c20fa6fe86657a7ac9f28d822b98d89144276ce35658d0931245a05
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_0264c522ef763f53c7ff174fb72beafa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_0264c522ef763f53c7ff174fb72beafa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\uKuPZFR.exeC:\Windows\System\uKuPZFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwcWXJv.exeC:\Windows\System\mwcWXJv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrAVyXy.exeC:\Windows\System\QrAVyXy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ahMxtfV.exeC:\Windows\System\ahMxtfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGxVZsJ.exeC:\Windows\System\fGxVZsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSpDJle.exeC:\Windows\System\HSpDJle.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxIqGCm.exeC:\Windows\System\MxIqGCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRxslnc.exeC:\Windows\System\KRxslnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNhEkGQ.exeC:\Windows\System\UNhEkGQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGNHjXq.exeC:\Windows\System\OGNHjXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcDBQlH.exeC:\Windows\System\qcDBQlH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLRejxF.exeC:\Windows\System\JLRejxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KTmlJCy.exeC:\Windows\System\KTmlJCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iHkfcMt.exeC:\Windows\System\iHkfcMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NpolWUZ.exeC:\Windows\System\NpolWUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNRnrnW.exeC:\Windows\System\KNRnrnW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XEihejn.exeC:\Windows\System\XEihejn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sIZAIEQ.exeC:\Windows\System\sIZAIEQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iduyonI.exeC:\Windows\System\iduyonI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVALnLO.exeC:\Windows\System\LVALnLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VthVNdC.exeC:\Windows\System\VthVNdC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b97f5b05d2921ccb10bc553a7cd49f86
SHA14a1cb62683c727323cbde366cd7249c8f039587e
SHA256f11a1f43c94ddd553c7099f2331de06a7f24ae586b7d6303f776472e6b9a2cf8
SHA512045dbd3bfcb135abaf7b6c5df3db2cc4957e0566543f9fca40a9a5af3259d29721e7b4b9c9c598e9a1d69cad609febbdb4f19997b1f4dec8f730253a408e4c94
-
Filesize
5.2MB
MD5e1527b2a72951fcf2e0ff5363e65e097
SHA1aeca3be1313fce41e69ef18bc449717f00db417e
SHA256c9a64b2ffe1bed1b19d57557b804c974ae0fe571df130c239df672fb317e626b
SHA5128152997bfd52a2bf1a48829a70acca0d7894579d06de49fb99bcdd3bf4ffd6de4adee1184380d55bc1204e7e4e16e7f8514de57a91b1427ab94e042a63d0bfee
-
Filesize
5.2MB
MD500024802ebf0fb5aee95dccea5889e2c
SHA179f351e2aa85c752a7a8106e958de4d45306dcbc
SHA256c6dafbc872d07c355a67cc6fe607737a838318c079b29a6bfe2ee77b7acfd0fc
SHA512d02de1bd411969468117480b552341c3ae496b163c23f1ecf86231ed082555083c04eaebad419b5120615c992b112a019de13ac23b770c4378cedf2308182a45
-
Filesize
5.2MB
MD57a38fdfcdca340d4df639568f336be4f
SHA1cc6abf5d49cc7f35055d7d407c1d7411a7637822
SHA2568981e18968b46e748768d93d5e0e5ac24d6ec3704773e004fe330facd78e3fbe
SHA5123198ed3de09043078c2151857a5d583d4f6ffdaf04299d2ced6e94853f42b76de14ca1caa051038878aa02709118912ea51e4dc910e155c5352f644a51a63b9c
-
Filesize
5.2MB
MD574c3bb267c148c54a1eb3e64a432a23c
SHA1b6aed41b51af342925bde18676f04b5f9676f082
SHA256db77bd184a3dc1f7a7b8d8e7ae288c8535da6d799e682c0d620161899bd1b39b
SHA5120e70b754f4fd28650966ba5facdb49d794e953c6d334dd0a3eb67bed7b0ac6645ff2ccbcb33e66f67865747c31a07b702c43a2942fe0accead3312327c895725
-
Filesize
5.2MB
MD5e31bb9c89dd6a80f01a1344f621e3ad5
SHA15c4c998aeaee209de6ff8bbb00a23a4a5fccf2a8
SHA2567d50894d48dd98efe64b103ff60fb2fd667d6e9927ea79b12e5c1c56f0935e03
SHA512e188ec9c9b56addb582d6d2ddbdb07a643509dadc8d415ca574845f06ff6a39d55cf1fa73d1e7f2099ae6690b277dfe95320ced8a256303e0b7f1b8460013950
-
Filesize
5.2MB
MD5adb37078f319ca13bb04f32e34584123
SHA1af4224b2f9caa08c12c08a08530295c3e3180676
SHA256b98975407cafd0cc151f8f2af83c82d8e0c0ec5ee9b9e904e4b26b3748951e8d
SHA5120eb04237cc704f923dcca72defae403e207d4c2886f85a19e90cd699dc3e941815e8b74b91dab99346ad6e6d3f1e128a41f35951ccb7ea042d79d1c4b5d86a63
-
Filesize
5.2MB
MD58c7cca6827ce18a8923b7f409024efe2
SHA1f723611ee99928d189e130556cec91aa533fa004
SHA25674615e40eb2eed16fde94723e1308795cd9ff854bd9e6089288ea5f5a4684589
SHA512ae0a6c9b4d292381ff17956a04ae4c791f53c9e197a16fafca00abb6e8ff3699e5d153132cc3ff940c778e2df50ad3e366eb815c7c0ff648b6fa82b808bf5144
-
Filesize
5.2MB
MD57241ec2251c8a339326f0b4896580be1
SHA163d7d4f883a3114c020ecb90911142d2b2235af2
SHA25602ae7c8cd305024c1d978d711e5e9fabd1621218198fa08ac1a05a1523610911
SHA51254e0e6bc7b23f602d7b4df3b1d55883dab645156ee57520f34767d981a9af5642dd17c10f0aadda793c5a85688ccae8c0e63b7d50aa93a77e75619c463171733
-
Filesize
5.2MB
MD56bffb9d8e686eb8b6ef643387d670f82
SHA12dfa981338bc4b8e9f94504525e0afa45bd429ab
SHA25664315bcd988cffb92f6724d2fecc67f8f7b5b60b420de39db9d587123ee679f9
SHA512e2c1d5e4dce152f9af6fe8d6cd2666397c92c442d4140e4fe64870714d05935450bbe7137664612781969c5ebdc9d4f4a965d73c0fb014689a979e1203d7f7ca
-
Filesize
5.2MB
MD5a14e2172769ea3b3a3132277febbadf8
SHA1f57274128e9df71bce9decf0fae7b0230cf6c112
SHA256a89c6f15499395d00d2e392486a20904b954bb1c8216bc15668c2ef44b62a24f
SHA512068bb30d3eb15b049c5fa115203b131f45993b290b5ca8c22134e7652e0cc3b7f4cbb3ce8074cfbf7cbbecaf728c3a0a2f163ee48292b711fd4caa57a9775b9d
-
Filesize
5.2MB
MD52b0ba0dbbf8386ba455f8aea5c8b37fe
SHA177e0304507b7c6b1668a42cf1103cddfb6fd77bf
SHA256e52786e52a58c8ebeecbab7a364cb7ebd88d94d3ffc2a11be64a672379d5467f
SHA51282f1c5009d81056558ce1dfaf0bbcd44e0f5282f82a37783093680939f6648eb06b81445c2c67a21e4636c5cd6f8d2bbbe0548d3af1c4ebfb35cf58f0800de5a
-
Filesize
5.2MB
MD5dcda3bf07c36fb51024df21e15992074
SHA11a1ae7a8052c0560b64161964603bed339ff439f
SHA25648ade6ea4bd023776060d77f5475cb937de692eb508018495882699f82c5e6d7
SHA512a0cd67a931e3de6df209ac254219b553b57fd733b2d1862614cc7718c9cf9c7ea956533e3f0c91048f8d86dd58e19f39194a4fcda190d02232f69109a4bf1562
-
Filesize
5.2MB
MD555ede04d016eb88a998054b9493cb3a7
SHA125685fc266373a882614aece509a111c425d8b15
SHA256cac8a692bf07ea6130fbd092e1ae1e7b005ca5350261c506055d126726afbb77
SHA512dffe8831cf9f133720c9c702f35673f3fd04440d9a3a9918a357098f5ff1c8a51be644ccd3b2f9f36197eda8bd461e544282a3ed3b58ac501acde31c678a1fa7
-
Filesize
5.2MB
MD5193a3c2270b74a2aba7ba652c3c90a5d
SHA1c4e669521c7900a13d1abf7770e3505dedad605c
SHA2560bff59c42005d0f8b1075615634ed65d03305cf6e4a0698be702bdddd8facaaf
SHA512e28d66aa2c21cfb5e74e47aaf9945224cb21bf8372324d3e745e16a4e151856ce77b2614e2cb533031ccc48aa2737c4c18de5a1d5cf168bd4a7e2d0ae50ae46d
-
Filesize
5.2MB
MD518c41bdd9edffcf531cbd7d34fca9f56
SHA1cdb80623414869fe9374044b81d204e3d88169c9
SHA2564cd087ea94c92422dd959877fd15707d7810931f8076277a892004aec76fb592
SHA51296bca4086f7b8be4ce9ed571e1a29bfaac48585b61e64dd814b4f158fdc49e08d0c9495793e0011cb51d52cd34e097526f68c76c321d1f04ba58f390c845a018
-
Filesize
5.2MB
MD56567f7c6fff5298ddd5a327dc471f94c
SHA126669c249ed964097c286fa1f0fc55e888df9a5f
SHA25665e8cad1bf847547a1ff8d2d8e5843dd0242514f41732194a6508dd46d5b15e4
SHA5121656646693b0c4cdddad03348c632df751502360b99bffa77426fa4dcd66db2ad5a3a689a471f61745d03b59a3562008de9e39249fa4814b7937c258dabfaa9d
-
Filesize
5.2MB
MD5397aee3b5a2c9b21875d7e2766319b9d
SHA1b9d392c37770b8ae9f591021154d91755a87c7b9
SHA256267b5ac5b7178df14f3f1528264e2275e694edc9b2beaa7ee168e4079a4e074c
SHA512cfb9f2e927eb14832fbbedcb8db2766c97acabfd86f89c4ad38d25efa5d7df1a47a7c94665bad181adf8dcbd6265040a4f0b6809574e3c31ceb04dcba417c4b3
-
Filesize
5.2MB
MD544f11ce20f82355d63bbe13c87580c07
SHA1ebfe7011a1241ba9c8dc60dde088ae592addc1e4
SHA256e0e8d21943eaea2f71e56644a2bf5b4bd137d261e8eaf203cfbdced20328037b
SHA5123a82a63d6a4fbf7b357ffdb2545898eaec89fcc564532af62d75f25600252b45473000f6ceee8f596b4925273e2f3a77ab760f555c8ea113a4b8b7c5ba48d747
-
Filesize
5.2MB
MD5e9888535c3959bcffbe7fe4867ab96b9
SHA18fad8eaad26dc0296d1931e67bac6497653f5f6d
SHA256c2c5f342b35830f2fda3a974b9e565ddae521c6d44689dc55779c608d149f881
SHA512058bb305f10b241df0371717e23d8cbd1aa7b6bc294dd821ebacc39cb94ee00bd69d11b7896b9299c1b63e12982ebe9a6debebf0313524a17c25074dce8d1a84
-
Filesize
5.2MB
MD54f29d5c2e290168dafb28ea66b3cb185
SHA124500d4056c9e5c700c0f7da0aae05e2fbcdd147
SHA256a6dd092a17c7bd737d006affd7ea8b3ea86b278c7e819e75fd7defd218eddb54
SHA512e45d1ea669f908a9adbe6d8d1080873dd2a78dd83a5cb82c81ca49c7fd996ffdb9042b6d260aeda0d69388c9106dd081de8a7f0b01f1f100b42c37fea51a19f9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB