Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 10:47
General
-
Target
2024-09-22_e56c6344c76776f5be11c60dd9534b4d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e56c6344c76776f5be11c60dd9534b4d
-
SHA1
0cd039f31cf64a320f1ebb4291a507ab71e16d18
-
SHA256
90a862ca1de5c8b99c984f5da7fcdc154838e27539a3bfdb70ee23bce4d49fba
-
SHA512
8195b2d2660f024a92c912cd3205cc6833ecae5535150acd7bdb0e7cc488f58dcffd78abf5666145a43d38ca16d996f6f2de5fc4e0a49b18878716f575ebc9f3
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_e56c6344c76776f5be11c60dd9534b4d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_e56c6344c76776f5be11c60dd9534b4d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dmGFIeP.exeC:\Windows\System\dmGFIeP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWXxjLy.exeC:\Windows\System\qWXxjLy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wowOIeH.exeC:\Windows\System\wowOIeH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FYwSbtG.exeC:\Windows\System\FYwSbtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIQdXQG.exeC:\Windows\System\mIQdXQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqfKCBb.exeC:\Windows\System\YqfKCBb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huTMuki.exeC:\Windows\System\huTMuki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCxBNGt.exeC:\Windows\System\qCxBNGt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZfnepPX.exeC:\Windows\System\ZfnepPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oiJOEBd.exeC:\Windows\System\oiJOEBd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYIQjDO.exeC:\Windows\System\yYIQjDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWaNEnc.exeC:\Windows\System\RWaNEnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GHWpbiQ.exeC:\Windows\System\GHWpbiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etipzSw.exeC:\Windows\System\etipzSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONkNrLz.exeC:\Windows\System\ONkNrLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qTCVLgS.exeC:\Windows\System\qTCVLgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSqEqtV.exeC:\Windows\System\HSqEqtV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vugSAYu.exeC:\Windows\System\vugSAYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XqHkUOy.exeC:\Windows\System\XqHkUOy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOVgyFU.exeC:\Windows\System\FOVgyFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtxUwUJ.exeC:\Windows\System\mtxUwUJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51ccbc3b47933c41a9df35023a127d9aa
SHA1319fc7223f5df296405b7ffcfa7ebaed69538827
SHA25643d7ff7492de017050f75388acece8548f0cdc444d4c51127c7a52493172b70b
SHA5127a224221b05af95b3f53eb8e601bf81d91551281d0e654d13a84cf815351bc2fbf913a8a76955cfb340bf7fa645173c5483e91e657743fb1ecc8ec93e2016267
-
Filesize
5.9MB
MD5ebbcc2a76e227da1220c03864840dce0
SHA19aa07323861236923e808fa88b73548851389f08
SHA256c2e2fdc6e632b5ef42b94ec43ab2efc3cdd553f28bbcf35c094fac258b361691
SHA5122c3e59cbaff62f702dc94b70144894eeb743938828b0631136c58120b4c135a1cb016625be38650059d7577900cb92d9c137e1cb8610002a6e596166db05d141
-
Filesize
5.9MB
MD5eb8950d51efbe674e2e6788ab62feee4
SHA1e0c7a624a0dd43f9ad627703fd51f8a4b41e2329
SHA2568b6448552f8aa4cc3475b83e702d61e3a17f585e242782c6a07931076d1c68fb
SHA512f9978222614a89f1331905954a2d3c78cf0057d7695741ae85f067836cb39ee5f79cb21144a1c075e9df6e17593acf915061d22d2dd262d2e54b6d32a3966e13
-
Filesize
5.9MB
MD5c1661bf3fe13f56ca3a485ff83c2febf
SHA11f4dc0f80240cf100651c8bec2ef51184eaa960e
SHA25669c21fc0d9fef20828d4583c11cc23b49c8a9c73214f1f065df5fdafc08557b6
SHA512b1766c5965f9601a37af038e89f31f34264f13c00872d62e0aca4d53070c5bfab9b5344b9ab0bc851ca95e8e3be9e4fff27b1de3bb66270caa5bc9245f0430a3
-
Filesize
5.9MB
MD502a656d59b69dd6186fd53491f3da32a
SHA19b86a47f6da34df50811f02de64e03234fe0b228
SHA2562a97ade2d678b10fb764a19d0938f0c578aa6078d807e4c7b9cfbc7b43713db4
SHA51282b24117e037dfa6337cefd4e9df9de7366ea5c31423c96f698d960e9eafcc779b0c36cf387b5d9e160780fe70e5bd9dfd4ab5c47867a42ab9eb87f50031da5f
-
Filesize
5.9MB
MD53f2ecda78958ef28febc61094a902ded
SHA123f04058c1bdb56f61d24c108eafbcabc6dc976f
SHA25640c43e1349676be54cb6e73b9e90b74136b3d9bdf75a816aa177903cc1f3a707
SHA512d0210be6eee036d0e776d9aa2c6c8c5bca0dc4270129d724bb2f8f6ee8b0df52b0cecd2506b21a1658cdffc4d65fb21155d31a45840c1ed43d61a442b3343595
-
Filesize
5.9MB
MD58a38ea6f451c95e31c86f5ca65c71276
SHA19578ba31bd902a18ba7c588263505384de39b066
SHA256a34cdecb907b2e60885211a4045b05ec82c68409a270f5fd99f9b4bb065674af
SHA512090ab4e8296fb60997edcc17ee86246e543b69d6e1d72dc8f8fa53887d61d83104293ba46f2e8619a212cce81e1640afe258ceee3d9dedb886ac9a6347d5d788
-
Filesize
5.9MB
MD5f8c390273be70b3f9ae478d9c0bac824
SHA18cc1e81baf45624665d902f7713e47341ce74477
SHA256582a595e287351d6450b84909791fa3a7114915d8c61d3288e704d5838f92bf0
SHA51255a69921a7a1e36232ab10e0c2b3d8fbb0ee62b5cacc65ec1ec086295346f164775ae5767803651e3ef22ecca2c1c022fda54adb8c58ac405a34c7bba537bd79
-
Filesize
5.9MB
MD5f42eeb113730d47bd67ccb16de0e8d88
SHA144c2b6b43bdbd6a069f2db7c66ba9710a6585dfd
SHA256168736189cc5a86201938ff081814576ba52d1c152098ab721ad76e335291988
SHA5128b0b9b25fa49a0115d3685b956acc7cb1852a81e3633675a66786fea9a521944be298e5200933eb4c5a0dd0d04ed885e07af7b6c71ef08cf2fefd774427d13ae
-
Filesize
5.9MB
MD5a8aea2b105a05b8dbae819907045b1e2
SHA1dab13e0c4633e2afb8e046e8b433de262643fdcd
SHA2564c05621d8216fe3c88e9e0afcce4139a1bec8f772a026d4b02adbd90299120c9
SHA51233eb36b25f781faeeb6a0d9882e8abf09190192372989a858be02afdb822b0a42f8a00234ee496e7fb1b89baf4a13372ed6d1344f53d65ec7bf73267f0c507c9
-
Filesize
5.9MB
MD51d50388f3da9bbcf21510219c8e12913
SHA1dadd697388c9bd6791496e40d57334e9141ff885
SHA256732ff4a5e2ae24a3640300e9a428f6e65c3d7ada77d2ff9a053f2119b3d5199e
SHA512ca9ae7ad23f0a9353cc3dbf898b261c2e46eecfc8e1e5922d219300296805de7daf7cbcb082ff8120ca78e6e6ea4f9a48e2382a1bd94c8e72eb5cc23251fa54f
-
Filesize
5.9MB
MD5ded16f7c720fe0662754b5c97151e3ac
SHA134b42a2001497289791a8403d64e96b5499b96c7
SHA25668753506c104a42e1c649027c370d33949026d326776e8c8be97db30921748ec
SHA512e33f87df00beda25ef84bd038848ec1baac4b01a1d5a995ddc5da73c2da06454b18ee11ab8d42104c24fafe0b1dd8bbd29552b78c63e2d281a5e0f7a03eeeb6f
-
Filesize
5.9MB
MD5f1fef6f1fbdb8ca0a6a5777020b9cb00
SHA1385fa5577d4f6502337621aa8a4bb0d37cf75447
SHA25669ce62e2c7bccf804fac14eec58a59aad2688023246a5c45f74f36432e883da0
SHA5123082f5f695b7187e05cc6679038abe9508cfbafe234ac77fde953759faec1ce9cd17cfec35ff07d45508d69ce21457164126aaa3b8eb1caeaf8f758296e76f3a
-
Filesize
5.9MB
MD55dd769b43b6c8398bdb921b06e31ca86
SHA17fef4c80376f6210dbdc3c740694b23177e2e2e3
SHA256598a78d01d369ec2f9a10b75c3f046ac77b242034ac6759756d8b3165c65fee0
SHA51222104c000d889c4aa51897a84d1d651300ee768680ff1426f24058a36d9f7b30298bc9b7b70ae8f5a9f65df1d52108787b1c86ab90cb63e19fb615cd88b35760
-
Filesize
5.9MB
MD57beb67e1261e61372b84a8eecccd640f
SHA1620bc2d18b5d0f38a70f649fa7978c7561a52be1
SHA25624a6c99f8275005c6053333b4aa182c25e7309f001da1572640ff7a9260c9905
SHA512dec73f9f8639d1400cfef125e91dc8a8e42ddf48b97ec55d15edcb048670a3687b35071f4e79c0146305e8208990716df16f728673e72b9a28e9f377984c86bb
-
Filesize
5.9MB
MD5e790562f1c5e085f0385a349402b7804
SHA177375b32763ea538ae21387d5c4d91ca07e70f1a
SHA256f03f77cef61b4142d2ad9180249ae284ed2a21c228dbd257b1420d4f2c73b909
SHA512ff2b729bbbb19714b950ebc96417d5536e3df3a110cd1353869971bf935abfa55a283d02b983cd85babdc71103606801b4603b8cf4ea1968cd90989b7b00141b
-
Filesize
5.9MB
MD5ac1f3f6c68828a28edc57a0807fc4654
SHA1d91d217dd2fada05578b12b47358668c81c980a3
SHA25676f99d235b9ca102e7e34ad77f89359a78169eb434b3a092b43a65d23efe2fe0
SHA512eafce08cbb881618feac8540e4b8a0f19ca08644c54fe90cdfe7597734cc10acba151e9f8ee727345e627016c9874df3ad441eef991bfa3d0b0c4d3dbc5c25b8
-
Filesize
5.9MB
MD5b5497b26a46c8ccfe107f147f33a5bb2
SHA1f1b7ff14dcdf52fe16e556403d5aa541c536cb62
SHA2569e567ca9ddde68a96d17caa50d7d932cfe3f242bd62ddaf520fbdfa96527cdcc
SHA51244ee47c21cd4b5fe4de2488ccbddde9c28929fa22486192409e6d8185c42ad22533164d0b5d246a2c08cb22f173d1370e7b0cb0bcbeab049b34b9bda79496780
-
Filesize
5.9MB
MD57dd752552b4ea159e64117269dc8676a
SHA1487a9c9208bd0b96b51968757f41924297151b3d
SHA256d7a3a6b22b869a07ff4c6c575561238ae6ed4175d2879ebfbc29a9dab105aa21
SHA512a849eeab9d283ced9d00f3bd9f07bea316e57ee627f549d47e390451970b1fed2f70b6d1977769f1050e64530a7e2fe3bc62a6a63a4d3cff841f5f1df5d84514
-
Filesize
5.9MB
MD5a7e45a8f8158372c9fa627ef3d566f39
SHA156cc87a0018393729790fa1bb3edac3160c6f5b6
SHA25642609d3f50b2d7a78ee5ec712f94953dccdaf79ce99df35fdb74f2476d397526
SHA5125d650bb12b755579d336fa914acd326fefc6904f34c56ea1f3ee458d2091a5d907c8d923877e9a376a854e9dddd58cd78c6adb4d068f3b6e013f15ee0c2ea3e2
-
Filesize
5.9MB
MD57633bd13006a718af55e1295d3579ddd
SHA1add40fbfddfa84679ed2042c509812cf6d9202f8
SHA256873caa952875c458b179974f0aba8acbf6999366fa47bc36dd8fca22f5154d4c
SHA512e101c4fc94e5ef8b87388aa755241adcbb360cddc2cd5fe1779f877a3fc5d3282b2754856155fffdb50fe4dd931ed16c0ab87b3eed263bb35af0e1976d425832
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB