Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
22-09-2024 10:53
General
-
Target
2024-09-22_393baf922a51a00d7b2de54dd31cf8c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
393baf922a51a00d7b2de54dd31cf8c1
-
SHA1
13c94557c7ff6dfe784fb03143698eb56b55ffa4
-
SHA256
939b8c1dc67b2f1741d866041215ba4648d7d4424d3f1a5f0942681d723981eb
-
SHA512
06e431235e1279845494e64e0ede0064cf90a8d0fedc7b06288e32835d992ebc861b7119f2bdcccdc5e79a84586084c2a293c5de1345d596091d5ab4a6227248
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 52 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_393baf922a51a00d7b2de54dd31cf8c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_393baf922a51a00d7b2de54dd31cf8c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ivdgorZ.exeC:\Windows\System\ivdgorZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVIdZQW.exeC:\Windows\System\IVIdZQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PrCKnmg.exeC:\Windows\System\PrCKnmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CStGxGn.exeC:\Windows\System\CStGxGn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qtPQDTR.exeC:\Windows\System\qtPQDTR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZPKwOp.exeC:\Windows\System\rZPKwOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVzeaWp.exeC:\Windows\System\tVzeaWp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVqnieG.exeC:\Windows\System\MVqnieG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHYajWq.exeC:\Windows\System\LHYajWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDRVJBm.exeC:\Windows\System\eDRVJBm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfjtEXP.exeC:\Windows\System\CfjtEXP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSpDjse.exeC:\Windows\System\JSpDjse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yEUynJA.exeC:\Windows\System\yEUynJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PfBZCTN.exeC:\Windows\System\PfBZCTN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJeZtor.exeC:\Windows\System\zJeZtor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxsJKYz.exeC:\Windows\System\XxsJKYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vbCAJUU.exeC:\Windows\System\vbCAJUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zbhlMgD.exeC:\Windows\System\zbhlMgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnXAmKC.exeC:\Windows\System\GnXAmKC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YMDvaXh.exeC:\Windows\System\YMDvaXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMkZGbv.exeC:\Windows\System\ZMkZGbv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b1de1272c7957b1caa83ca9e6db807c0
SHA1387526a9b997a7dd6318c68a27f2c415904b0922
SHA256374389baa1f489443887293621e6aaf50c20ecdf078f4de12253850a8516700b
SHA5127579b5d88f344d47f22603d948e70b528d08ccf1f80d1c471f834bee177902bd6fc09b44ab3d315c5c03db9b77a4000898801c22e62feff69d8201e66174ac5b
-
Filesize
5.9MB
MD51fd1c0ab8782a0458698835fcf5c3499
SHA12f3fa01fab8f9b639ca749c86551fbc0734fd716
SHA256180f1a0d7c607ed0ad429294f146c1580fc54bd20419284af11de224016dcf71
SHA5121f49979d1145d06bf4924c963c50dd8d5eafa386c9c96063f29e72b0f4d964a7473d6eecb079cc44182e3deab2ff661cc8b6bcda0c995cb98d3c5d95b74b7bd9
-
Filesize
5.9MB
MD57bfbcc7212b00ec39d35c26c7833eff8
SHA1bdd6aa369e10e9f5a9d6b998d7248b240bde75be
SHA2560abca55a79921e7e09a422e6a11752b607a157d0e2cc3f8fcd0a872ba0158ee7
SHA512f0a950c8c51d4097e655e245f11612162153b6773240064dcb7d7ca3e1a65cd89c9b6704a1e2e97692ee436d5300acb73742c7c8c18d079bc844c400e720bb20
-
Filesize
5.9MB
MD5801a4ac427fc3017039b94c73a3f953f
SHA1fcbe001a1e9ff50a6495bd4b4f64d42d4231fd7a
SHA256dbd7f675e3630c691b3bf049d506866f98d2d3d723508dd45be0ee0d7200476d
SHA51294eb75c3f7c3cb0227dcd65552d76bd377dc7172608007bb1bd1b83b5acc03a56ab495b499e1e29bfbca536e3a96fc1e05071079daeecf1d4e6d0581d6b9c157
-
Filesize
5.9MB
MD5e612957f5db5152d7c0ba92f07f3e41c
SHA1ee68ef107e56d673f6fcfb6900f40dcc552cfbc0
SHA256203bd84ec104343d195ac90e8c618d83a6a42b68d6faf0baffae332bd3308101
SHA512c8e766dfb8ba9e08ba148aafbfa1ca7d035b2d09e12999928e2e7637691b3e094e5324de56691c7d1081c8bcdda93ff0cf88057cbab7bca3efc560e0455c849c
-
Filesize
5.9MB
MD58539d8a5df62cd26a4f2a3c83cc01515
SHA13ae4e2d35cbed5a65c3596e424e512b2ca9a2f44
SHA25675b9faf5618522c3a88077274263b23572f5efeebf1c855220d47e3853cc6546
SHA5127159f2a23a2cda578094b53912645a6fda719a9829c1eb5e5cf6e5be19386329b3dc6a6cbc36a498e6b264c25d907f18d03355787954562239e5aebaabb55749
-
Filesize
5.9MB
MD5c7c1aaedbcaa5314f51a235e58c371a3
SHA17af12be2c8be71131d24500969db7e6eec751205
SHA25690f6c1868e71fa5acc3c7975eaa9bfe17289180520546892a18c2ae5e3aa0e6e
SHA5124e2adcd9687b9b0e55296b308c0baff89940026bb493e0404101c8cd7e3673aac96cc05a1c7941ed32f91ca29aa66e25e69cd946aef3c23fd6754b6853f3cd1a
-
Filesize
5.9MB
MD5fefa5478ca16e0d1b1b5a0f1479c41fb
SHA179eae4c7d3d00ee69b99f4750413fad63372db7c
SHA256b13b184a6bda255b057c4a6ec9dee30735c3ad4c5e2b50560e2d967c1d020c63
SHA5126aa7a85ea03858810a27c17643134d9953e6227bc0ea33ff79b7bb43de573afd4c5efa235962175b8c6a915e96d84762843c45864abb18c4e3997a9916e4a8c7
-
Filesize
5.9MB
MD58c2962c80f174b2bb8d5ee25a05f311d
SHA10f78f9f508d53a0827319678b1dceb3132e92c71
SHA25650b4adfb818bc419ac62978a95c903cdb616374a824d6a4f8a04136e7deb26ee
SHA512e218f9edb62483a27c96eb5688175bc8755879fdf31d6f5fc874a3e5d4e45cba009b39075e6d9b4c74fae6701e1ac46344f1d37ad1de93040ba55e1fb9e181c1
-
Filesize
5.9MB
MD5334e39b10831cac7c3af029b4d4115e9
SHA150d8ef26d9583ed409ca7f5683b1c1e3fe21ff62
SHA25667605b2d23d8cb661c2d4f300e6d5d8286f93c7222cef35a56fec4f1a8b242fe
SHA512baabb4ea6b67a363f821743d13f0e6c00ab7d2917a85d3e41286b5d214594104626629d9c80654e704ca6e462978fd9c9b6661f51222542662e4812f64d2ec51
-
Filesize
5.9MB
MD594118694e39fdf0811006f0315fb12e4
SHA1a2f992d2807fcf86ef22053fc8262b6de52605a7
SHA256835d9edbb95a44c3f529b6c8c0b8ad0ac10cb1d3e00a04296641152f6656fe47
SHA51206d1daca8f64f54e5dae31f7ec3e23fc3790ded0cc78fe6303b88f64b8e7b6e61d1f22168b262dcd30af17c083a304aee8d885deb7a7f640b62731632b03d0ab
-
Filesize
5.9MB
MD550e2b8f917165f18d3ef4f7a06302d0e
SHA199ff9efcc81260165bb6fce2f70bdbbabcc7b581
SHA25634edc59d70936a38b860e71fd7366c058d87c82c3b2d604313dca56b09d4a6fe
SHA5126131e1e8ed205ded9ee90fa60179986f529febcb3670ef9b48d8681069f965b683ff6ff95714acd9f3d1adc514ba28d82cf9abd9c076453c18c2d36212ded9be
-
Filesize
5.9MB
MD5c61f25a8abb6aac89639e57beda92c9b
SHA1479fda9a8edb37750587a07759905d3de10b736d
SHA256967dd33d84f6eb2bce53919d818cd82a90c03993d21c0bf9221e9c0a7ef88d0b
SHA512b28d4472133d2bdb1cfd91b037d5e00d3ef048568340f71f97605fa9b8a01f26dc4fa455fda97e722d660c6c97d88b9ead682fda3ff09167e7f21aae1ac2fb73
-
Filesize
5.9MB
MD58e1ce1deb41bafef27ca1ab20828827d
SHA1071dd223b59ababb1a31b14c68ca2d4a81b359cb
SHA2565afffd2e5a0a28dabe13b8bfea582c8ea24e9a4f21d0dfa815ed90ec54dc7e85
SHA512d0ced2413648f4ff9d5cf1675540a4e6dbee878135cf10bf2fae0945bf48ffab1c738c00968e900bd2993b946a48ff42efaaf4589a8a5846bd8f9453bbdd24f5
-
Filesize
5.9MB
MD5cfa98f0af33ead8100816866575e84b8
SHA1424b5d209cb5a6e32c3e62c81600f89b0f3ec53b
SHA256a265b74873dfba268b972f42c566229eacfd74d182a0de6bd28be079634da6ce
SHA512357f564afb3a1af875b8bbee8526292362d7032d06ce6450c175544ad62a5a53d64c5f2307d4a8d211afecd021bfc7578a117282ac3e5e1f6640b8d682f48ae5
-
Filesize
5.9MB
MD5a320abe179dfe30b1563c6d811ccafef
SHA1edb267361108a1b5c7f0bb109d0c6057c4fece88
SHA256dda09923249699279cf1e67b2e09afca2c506b7ff4e0ecdac8cf7df9c2a8b945
SHA5127473c506949651f43dcea7d0bf1a45e076219cd5ed242583545caaf98029dfeeee2831d938a3dbe929b395ef7d340bd45768f4df8db7d61143fbfd7a2becbd54
-
Filesize
5.9MB
MD5f72801c8dc3774b75cc80e459b24bdb2
SHA1741425cd4da797b83e3f0201ac456c57688620cd
SHA256dd34365b9f81687ac6a47cafb103032c882d24028892daf5e038e6fbdfd227d6
SHA5122ddc0382d42743e18854e23ff43305dd101693433c158d05e95b33ccebd4edc6ec73765160d4f98bc194150748005eae8d6e8777784478425fe36c1d2f55fb0f
-
Filesize
5.9MB
MD56653406f476fe597513bf538ec9aeba6
SHA1da25e9ef4d586862a76eb09902fede88fdedee74
SHA2561e056c23786640529bf0b15ddf7238b1d7f0a1f2cf841e4cc3b1ed41c6ea55d0
SHA51200bcec57026c28d923c8c46f3f1abb43d07e35d380be097d061c1f7204127bd0050b0d5290dc6ea8d63ad920435895c2ff57e9b08da89ca6c8e94593f2c6b696
-
Filesize
5.9MB
MD56b4ce7e16872e906a3e00adc1e39a1a8
SHA1fe5a4fb72381fb17cc7b00ea1bde85c9efb25cad
SHA25664e102b9a5c7df5c19071bf89d9f83fd91d618ccf3574688e215d01791116afe
SHA512a3a3ace3bfe5cf4da1d8ee4ffe987838492a008cb4f03dddaa3856fbeae6c85fe193e41e2c1e766587b845f82a7a7a3542ad0cf8837971f1e533591bef0850b6
-
Filesize
5.9MB
MD5c55d73e166e923e49a24318b1438e92a
SHA1b907f1d460f00851607672488c026a69ec864edd
SHA25623a997ba5fd82bcd88eabea42418814ff03c29c005362a77aa8cf9d5476672df
SHA5126cc01a4849ac5d665bfd19eb98dcd8cc6d9997a1c8fcc34f43fabe0c2539f9a5a0828b12b8be3f978fab866d43f52ab738084bf6bd8cb881184ac4d7aa92d033
-
Filesize
5.9MB
MD530f6edc67e3be571ff6454f5255ca970
SHA179ecb7f11dd328adb875bc428a5740a16adb0f5e
SHA25653def9429ae259cdf2ede6be7a7469d1186cb28db1fcaad6985db9310704a0f8
SHA512b6d2ba00a01f1864405674cccb08bd0d5846f81771aaaf87bfd1886f7d361e754e6f139708bdbde1fc2c25fb9ef64be6661a7fd8522f654c74278c2ffc1ffdef
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB