Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 10:45
General
-
Target
2024-09-22_d4fd4d5bb3cb8d844562a6dededdd8e6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d4fd4d5bb3cb8d844562a6dededdd8e6
-
SHA1
5edcf2cc3c7da634575ae48535061d07636ea531
-
SHA256
92d5395b13668f9bf257678bd2faee874441d9e84c4ab2bf089a071fabdb95ca
-
SHA512
bee2d00b692d531419832276b5720d0d53b71ba496a290ee68ddf364ce267aacbd7c0125b9e7cc52e50d62cfca6df2cd668f16598bac6410dbb2bd4aa2842887
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_d4fd4d5bb3cb8d844562a6dededdd8e6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_d4fd4d5bb3cb8d844562a6dededdd8e6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xmOvsgJ.exeC:\Windows\System\xmOvsgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znVWZlk.exeC:\Windows\System\znVWZlk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjjAHhB.exeC:\Windows\System\rjjAHhB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AhqHOGH.exeC:\Windows\System\AhqHOGH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpuQuSE.exeC:\Windows\System\vpuQuSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RbTrfTq.exeC:\Windows\System\RbTrfTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WiFaqjn.exeC:\Windows\System\WiFaqjn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgioixy.exeC:\Windows\System\dgioixy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WpZbQYK.exeC:\Windows\System\WpZbQYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\agWQsbT.exeC:\Windows\System\agWQsbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UojZDgC.exeC:\Windows\System\UojZDgC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlNUXYo.exeC:\Windows\System\JlNUXYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RcCxdQk.exeC:\Windows\System\RcCxdQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUqKirI.exeC:\Windows\System\KUqKirI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MNZjSjJ.exeC:\Windows\System\MNZjSjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blGrzWZ.exeC:\Windows\System\blGrzWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFwQAES.exeC:\Windows\System\gFwQAES.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEDAYdW.exeC:\Windows\System\pEDAYdW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDuLeGZ.exeC:\Windows\System\bDuLeGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aGipcIT.exeC:\Windows\System\aGipcIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmpsVoS.exeC:\Windows\System\hmpsVoS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52ba3c362d272cb76a9dd22b39eda1d3c
SHA146c73bd9def32469f1495e03113cb115d229458f
SHA2561692edc6cb57261595858854764a547a7425a4ab20261ffb235c6890fa1e508a
SHA512dbe3b0b51dd707c33085edc409c1922abe6f41172539c4f483ce3c1137fc6bbcd3c38918d527a6f3cf626ae86382aae3c261cbe066554cbad5d5e50e54a04015
-
Filesize
5.9MB
MD598fcc0b8b30da0c84b304cbc40cc3b5e
SHA1f4bc525d9ec67e71a18c75976e77139c0de4da4c
SHA256f48daa096b6e077abaa0f96f00c77bd39cb97838b9d4b5f6e281e80105763934
SHA512b443edf900613ffc3d5aa12f62868f4cf7daf02c3401735146759b97e5c5183dd72985ee713a0568dafec8cc33b0354fd0d4ad58f4a32a828c8d7daef32a64fb
-
Filesize
6.0MB
MD56de9891cac3b4d85051ba638a105b93e
SHA18519079ddb8d559775f025cb243c571e1d368720
SHA256922e7cd2b878255e5850aec5b6ce03b1ba627e20d1d66a7c7a746a8d77b69ac1
SHA512afa2f37441219a6f46acbf88b543b5afb27dfffd0bd720984dea663733f2c0a7e0e4e9efa8f014f63aa239c9685d95314e71d370e41cce16c0ee7a1f244b98a2
-
Filesize
5.9MB
MD5fcb848b9073396213e1abadfdacb1c1e
SHA12ed41c72d3aff7011f01a7fac18fbc29c3a86e92
SHA256d635e715c705ab04cca92c249c58ae3d8f157ef8aab973072c4c067b7b586662
SHA51252479f38083e1b63104ec2f3ade945a04235a273f1212c70ae28ed7a1b8f620cef16a4a09a82b496666981fe90ddb5d8684b2566663fd6ce01e5a2076f16bd5a
-
Filesize
5.9MB
MD59f0f70cfd8ff70c5c9d6f19855648334
SHA122aa3dc0770ac6cca0116bb335a021c6ad4694b3
SHA256fc8df0e4f96ea06e9038647f92c79d11d4572aba84d9fee5934185b05da830f8
SHA512f2e88e6b5a9a5b2bca617552355f5379cc64bbe037312de3c2e0a67dd0fcacee797688053d7caf4617fb8692ad80137abb643794448f255105931b1e75c84a69
-
Filesize
5.9MB
MD5fe1a56a4aa75c2f2676ac1ccd4be1a1c
SHA109508160f51820aa157838797b71f6ed4d6e3507
SHA256c5d675603493a37f6fe27bf3e678fa195ab30ebc5eb224b1cb429057c7cee03d
SHA512c4c52c37fbe4a0ceef42ab9293db0c9593cfd964c19c83f9ce3beeda27d0ec33ad2d1d421182d90369804958d5822d5a97984f59ff9167f697b58da728cb54b1
-
Filesize
5.9MB
MD59ae94c884efa355300cdbd1d562bea74
SHA12af2f5b0728ddfbdc7e52b5db9f69be9dc9f077c
SHA2564c059dd3ee8a4048321aa7644d39ee840bad0306f4d531fde65c8d238f4e5eaf
SHA51217b136b76cf019cb3a7ef2d8a5277309bbbcba682a2bd33118de25aad0432cb483d3648c367a091f92378706522f6e667d80dd3c6c7a2837ff4b8b76119b23dc
-
Filesize
5.9MB
MD5b1527971c762d3b5fc296a4f3dfd3bb8
SHA1d8505d1aaaf9015cf75616fe7d00636b05add05c
SHA2567374bc7130baa43c6ca4b6906630668d6ae3155c76cb6715400d11593f9ba7e2
SHA512c4622089682945a1acba081bd6851d6fa5d360050f7a91eafd25f38c0fddf6762834471eeb8dcf943de51c9437f242eb123e6873ded66fb59c83350869edf49c
-
Filesize
6.0MB
MD51d45dccb8c2293d05647db6653cc125b
SHA1a1a276f14f4c5936136cd694a11e79899ddc88a1
SHA256e8335fd5c3a48a1590aff735ea25c29ab07f94c5471e0f47c3940575a19e184f
SHA512f7470a3a2ffc7035d370954423eb876b82ac5dee0c1349fed063f984696ba9ee79d581681e7ba18e134874756efe4d3e23b8b6a6d1e81c12db69a8ee562fe4e9
-
Filesize
5.9MB
MD5e7232237f9838a35b85b663a36fcb67f
SHA117fca00b415a310be2c261ff1da38cb20fdea128
SHA256c146174e2571ec2adaf22d3bffad5ce36da5e7ee4677e41bb4adc8d3d6d037ed
SHA5122d84e95f873cd46c8f64689a951ff7121269047f70280c21f76f5d0d177743665052cec8475b30dd7867502179b2928042331bf7e5a767303b1f7ddbf2bd9057
-
Filesize
6.0MB
MD5e94bcf3e43e1a0c9f2002e9fcfb63456
SHA1d460d5b4f773cddeae96a9e9d54809e6d7606cf5
SHA2564a212e3b00db6e6a095b8a30082cf4b74a435da4d1e495f8596a633cabc15b23
SHA512aeb144a59267cd325dbc5010c46e3ec9ee9e45b81f846287088f9896c80ca948753d708ec00836eb239d4d7fe082ce923eff1765924915587b80bbcbe83fb1cb
-
Filesize
6.0MB
MD5d758a59ed4f0469fe1fcddaf266075c2
SHA1004868b3a10360eafc2b42f29804fb4500b89e8f
SHA25680b979337d917460824769739ca225016602a8f7721fe457c3d7980bc405963e
SHA512ecd34559455504e480d1bf7ed22d840aaaea807cd66921837c0de5b85ec441be14b7f765724747c527545347907a9daa60cb50ac6727f2d968471fe438051e52
-
Filesize
5.9MB
MD52ccf1092e5638397a9bfc8e127a593b2
SHA127c4b0f0111e0ca982f8910fa4dadf31ebcf7bb0
SHA256041d76d5605a0d6998deffecbd9bae543ec91f7d799da56298cfc4b0338d164d
SHA5125ebe08ddf65c80987f14b2d9e86fbd76fc8d41ee8347246cd1016906c827261efa78a8adaa1be4fc2e1f3d4be71f274e340b8bb11a0d85c5727c11ac519d1b10
-
Filesize
5.9MB
MD552493d4281edeab2ff5c3c1614542e10
SHA1c100acf6d84656e7cf58a88b20cfcc8c069fa811
SHA256995168b136e9dd1d814d218b3934c8799da49f0f0c692ff0b1ef863dc6afb803
SHA512ffa511893115cc22e20448de943527c38773232af950fcc420cbe27c2498e0f7a6bf30dfa8ba9ac731b120ce955be3ad6dd87f85bb3e2a2f4f756ede6fb6adff
-
Filesize
5.9MB
MD5494e1961e5d5c9805d76cf1aa2492cf7
SHA1c13034f3f47edffcc8486347dd068a06b55f5664
SHA2565f3c6143e1ba82eb798553ab3253531b4d4c4640e0305b8958493908d8d80978
SHA512644f038aa8c956ff35bf38c28735b2ae2b1d96fcaf7462303faacba693459c8bab88830941805ac3c322a03dde1586faa7be1f50807a496bc41d88cff4d7b90c
-
Filesize
5.9MB
MD51c7f35dd561f4d9541de147425c1c331
SHA1be2b3ff8d37344842bc47c0e47b189144177f05e
SHA2564c9791f6c8d70c93443dca99d8a3e89261e37cb6beb031fe50d5a73ca1cae38d
SHA5125ab85b2a30b38c078f5fca2dbe0dabe095853578f4812c8536a00e198c128cecdbc49701b39301791fd0b6a445404a0d529fd5d3247a0b30bcb6392d15712274
-
Filesize
5.9MB
MD599f5d7b7312c137f0014dcb97aacb099
SHA1d91d2814df07703a18ddf6b38d987ffb92189829
SHA25621425c820cc0d520aaebefb2b917b4de53c0f86af886221eb6fff29d0d310cba
SHA5126ab90bd91543abe75503cad625714cc2105177c98d0c627a1b138047e605ba1ba56e4c049d6c5f033098cc0798c16c3f075f1e70c6561bb9bc70b32b5baf0c73
-
Filesize
6.0MB
MD5393113fd94efc5bbea56899bcaace6f2
SHA1e3096d2c99f1bb6850fe0436a75ac645715795be
SHA256e65d3fd39c6e582c1b6d6c40537c5db908a5c74db3c68f3e89939cfc74eedfdb
SHA5126f3a0073f73f61569f79476f4ad7447bff5330d02b5a0414decb8b619fe4b42f74cea7fd22dca914b7d45a9554fb529d4ce6f8b79a001cfbcf5eaf3288c6c36a
-
Filesize
6.0MB
MD59a53208fdbfc5fb9bf9dda21e578848e
SHA1d1e35c8ec834e2245b4eeab90e146bb51f02ef7f
SHA2561b3debe971d8e099dd5bdd60a7dd8020e27036890503f2a4772017859c91ca08
SHA5127d9aac5036757969e15c1d1796510da35ae547184762933639432a82d3b12a31d504cafc4701c61dd4847151b43122f04d735121349f1b4174c4b3d0f85f7e3e
-
Filesize
6.0MB
MD5088a0259adeace77efa09e99c2448be9
SHA1921e44cffa7a978b055a10c6d23367385d545e4c
SHA2566ab05d8078dd4cf05da1d6c41345f925feb483b9b8dab87850f05e64b5d6eb70
SHA512626673bf9db214f64ab10d57d2f1a179eb034418736e3a50f7306e0facf6250d3b41c38fd40181eda409e9a152adc74ef9b6a1b0c76c5d0a1475622025c3ab21
-
Filesize
5.9MB
MD547d53ea039238cc0556f6e56c28cdd12
SHA10da914601a332bb5a85f9e3b52d70e6856d6b959
SHA256c3b19541929d6e27d725ef1c055b990fc66358a5d9ae7bd550c2fea66f62548c
SHA51289b1b69d7629c8d77a1232b7756bcb01c09465a9628b140dff851af8068ccfcc86dd0aef5070d7227b2f04858aec945b223b518457b681a4bc4b33025463da2e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB