Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 00:52
General
-
Target
2024-09-23_9c583759e4ec4728e1d8e7d6b8b8fa74_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9c583759e4ec4728e1d8e7d6b8b8fa74
-
SHA1
8adcd5ac075736bcac31edbd6df0e0fc92c4a17c
-
SHA256
816ade539cc0351766c79e45c66f4d2b46ac420ebcd6fe738f94bfcfe4e0737b
-
SHA512
45cd065ecb0c656845a25edc4d756db40957598a7ce8feee80c5c33489b00ea8abf505e85137d9532b22cfa1ecc88711d1a306ddd1e8434c701c09c8f52c3c29
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_9c583759e4ec4728e1d8e7d6b8b8fa74_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_9c583759e4ec4728e1d8e7d6b8b8fa74_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mTcZuOz.exeC:\Windows\System\mTcZuOz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zorsaSZ.exeC:\Windows\System\zorsaSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZxrKpd.exeC:\Windows\System\rZxrKpd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZMAckH.exeC:\Windows\System\IZMAckH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVWuawZ.exeC:\Windows\System\hVWuawZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hmDMDzI.exeC:\Windows\System\hmDMDzI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hOveRkq.exeC:\Windows\System\hOveRkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qSUrrZy.exeC:\Windows\System\qSUrrZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYxqKSI.exeC:\Windows\System\lYxqKSI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WZWLWVb.exeC:\Windows\System\WZWLWVb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZMHfjX.exeC:\Windows\System\NZMHfjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DoRdEGI.exeC:\Windows\System\DoRdEGI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shrCXwB.exeC:\Windows\System\shrCXwB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLnzQKG.exeC:\Windows\System\sLnzQKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sOkjGXp.exeC:\Windows\System\sOkjGXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZAcLxeC.exeC:\Windows\System\ZAcLxeC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWBRKzZ.exeC:\Windows\System\vWBRKzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMpAqRe.exeC:\Windows\System\QMpAqRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwCxNkf.exeC:\Windows\System\KwCxNkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHeEACR.exeC:\Windows\System\rHeEACR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUdLzdD.exeC:\Windows\System\DUdLzdD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59f4afb05bdb4fcbb9254bc2060afe973
SHA1c1eff6579d41f3cb1e4a6e5cff45ca546aa3e66f
SHA2569c6427a1892fa73558884561c44676df21065fc56799cff64c1494edf85b815a
SHA5124c9473fe67cf30acba834f4cd8c49a87df9224e740d9f41ad42e1a9b84861182924fa30ab31a7497839b9b5c8aff2e27d75a7d21f2d7d621ffc88ebb5065ad57
-
Filesize
5.2MB
MD51c484ae8111cf8db131a663a2ece3932
SHA11cec7c917d3f0c231626842a7aab4873e60953cd
SHA25644a784138d41cacfac8117dc89b298d0557ca6d4bd3e13560bbc1b11e3114a9f
SHA5129c7684e4c166cdcccb18aa66b64d74e71e7daee7000edd23e349bf368b0755f6c58d9d3f23c9a91ccb6eb2db3052735144b3bc77dc98eec957a61e3214e7dd57
-
Filesize
5.2MB
MD53e0c8db57563a9002d356fe33d92d1e5
SHA1d470fe6944efb7afe388ce47d3a93bc0db012ac1
SHA2562596952d2eaef0609963e3882b57085beb400e9a3509520c61944ac56a63b2b7
SHA512cc28517ba14277cc6e775d1a178f611097ff207044de7a7e5b1db7798da6e8be80baa65817d1c43f8f0adcbb16ca13a03b6405e5a30a1cebaf69e863dfa99633
-
Filesize
5.2MB
MD59969a8dd637f268a64fa0e66b98d5df4
SHA1d6b5dd2cb896e50e3e3c864348971a549d8a5eef
SHA256b3f8509be5ac4ad1d0ac46abe86acb43c018fb9093ca91606b8d1938bc464021
SHA5124caf806d59d18a0d55a4c523b1a2f31551fa8ee1cf5bcbeded5f3e65ba4d3e457ea42ce425f986f7ce87ff7443d91b90774fab500032c4710083ea062cf0315a
-
Filesize
5.2MB
MD58dd37106005ab8a8315e16968633fff4
SHA127cf932b99a3ec98b08d4d8011dbf61dda75b45c
SHA2560dbc90f136b99321d3909f20722fe483dd11891ba91075b6ac7351d20d4ec2e9
SHA512d9ff1dce5a02142c17a8dd240b894a8c447fd411accdfb2a9bb9cc71ca341ae798dc5238214dd03eda8b99f354ae17267bcfa7893f3a3794a05bc60c3671b0c3
-
Filesize
5.2MB
MD593752f5beb6b84b9e5fd1c8eeedb6216
SHA1317275c13ebe8459614c558043a965bb2c9f60b8
SHA25673cf6e154d4e126c739c92f5ae47eb097617e0b512892f9f408d2bf544e12f5f
SHA512d5e997ad300e494771f4e00d813c64394d81229a3ef345a848011e3e886aee44b8b5b6657b2f4d3f527d70927226fdc7ddaf8f69d4b09f285f2a807eab40d42c
-
Filesize
5.2MB
MD54177ecd141ce2ada47871016bb54103a
SHA15d2f1939f12f6fe6d8d8bb4b817708db5adadf5f
SHA2565353f3312d712b2a2cc81b2df3c2cdb87c0ca57f92c9f9d85bb6c2fde065499e
SHA51238fb6a92776d9603ea1dffb12c995043d444bcda50ee4996a2fc61385c50859860124e93608fb9d15323c1a137ab026541806a55343144ecdcfb93635573a9b5
-
Filesize
5.2MB
MD5f31958c66b2e520d6c35b0e8bc5fec82
SHA17bc501761515810f2c0325338fd65ae3f7041c32
SHA256600bd344151f125e135e55a7f28322dcf5b6d2cef885022e4c10475ae2305634
SHA512023eb592e1660be14ca9c126d50818661a54726f33a4d55c3811eafa7dab8915a647b2ed8b3776b7a1a7d1be6b8963d462eab6356d9191fa040d6758aeebfe0a
-
Filesize
5.2MB
MD50bc8498b2095ebc6fb4bc08eba0bd382
SHA1cecd82b8dc71c1d7ee7915a16fab03a19323db1b
SHA256bf6b2a4361b458639b1cac5be5ca939b276a6d4e45fca91b5d989c91d7271429
SHA512b63a74f6005cbb5cf22c402e224446cf9f4d4a6bbbe36be7c783534f32bfb3db8e7e4313932a405e8829f9bf77a04a41aa8903310b1a8162b7b1e1a1fde40881
-
Filesize
5.2MB
MD50645da6926f449603c0de3de610ff17d
SHA146853fa047b24858d8cd51983128fe3322c30781
SHA256d59d67d4bd7a572030ef0fbf43c28b99b6ede59b8ed8fa0a9c636ba8888ae3ea
SHA512cf1f88a4927379524055f9e0b657063323cce118981e8bc13123685ea09f29063c51cc81780d09a7fcb2f9e9caa3e60855e2713b5e109001269b45228e29fc82
-
Filesize
5.2MB
MD5a32db8e69d852860f3216d1863a7374d
SHA116fad44e3f677d018b4de7590bd9022c5b2bdc12
SHA2569ee33135d163ba5398ef58887a050bc49b48e7fc6db2667556b2bdda16e4bfd0
SHA51221408e0e20d63ead25be591da09e2418041b4f39f7242770df24a3d54731798af514bf0b3acf988f7829fe141ba7c40ebb48f4cd8d7219f3296999595af314df
-
Filesize
5.2MB
MD5540e103c78a4016c7a7191c58cdfed10
SHA1d3b5e049d43486aea23ccfe4d91f0fd3a2b86759
SHA256f570e61ba63ee5c41691c754bcdad90ec3e0012ddca2be7b3891c7f0a5eed50f
SHA512df3a939dcfb8426dc2d38f7955c385326b26b661dd1dcbb53166a15cd484b70876df5f2dedc71a1fc0602630a8ed817b352f1f1d2186f4b7656612039e5c2751
-
Filesize
5.2MB
MD5e2b60711421dc809c58be45fe7deb9ba
SHA1dcab583cd654c43f69e34e3c1368f214e0ba81db
SHA25659d0acf04e6935a0114ac4c481a56a2e2f90f11b3314421b2ed7963b8894f1bc
SHA512d831d2a1efc8204368078b7a6af2ea40eda533f7b7d7e089eabc31e49d7a04d2b98241832520288d80dd6810f80d99231205730ed7c8e45178fc777313c681aa
-
Filesize
5.2MB
MD543412ee394134e7a494400ee7f39fa29
SHA144db12cb2b5dfd0321be203b0559f277aa45ec40
SHA256c8b071014b0f1bf0c15286162b45b6e83c7acf08a9aa796c08cd09f80c258921
SHA51249e55d72bdc3459ed1b01e5e0f45c8cd316b1d40604b96e4b9e78894d79690283984839de3ca157348d88920089e570f794d7de3dc75ddc62d95460382d7c806
-
Filesize
5.2MB
MD52c62d43f0e24c9730a4974e10ac7b26e
SHA1b43d6b2cfddac44b9046202909c868e8cb338dde
SHA2567dcd84f86451413b9ad9a6de179b00ea7f9723db133cfe6d73b76511b8c2f9f9
SHA512d4f004571e7b1c7b9890288d838d26ea75c34caa9834f64abe1681389f054b88537509222cb629cb660cb9bc2d1d6c8d318d24cb181be0f4aace8fabc681b5c5
-
Filesize
5.2MB
MD5fcd4c4c042ab8bdb1c6b4ce6a9b0b398
SHA154ba29cce54b26d6139ec7c54ef82338e673cc99
SHA256df40895b5a8ee690ca8d0aa90642012e4a7abdd37ecd248d22e87ea59fb326ef
SHA512dd831d6a754f4516d6888d8cd9ea6526f249559b2477e0dcadcd72b553e385730c9c7aa2fd8a1c4e75cf8ed2055a75a4ae44083cbac108b4d2aea8fa3ba42a43
-
Filesize
5.2MB
MD531e8bf94f66d592887e2023fb02cea4a
SHA1e94ad7cf3bd579c96ff7ac48b731bdc1bec498dc
SHA256c7cfaa159d8a2e6e83971db2543d124cdfa57b67b185885e29be82abbfc12e98
SHA51291ea51de7c7efba4d59a01dbf5b73cc3e67a9d25461ee5fb6e6c0ab60946618ddfe1a3a545dbd1ede09832197a843466ce21420d4815cb9684193b7fd5fee731
-
Filesize
5.2MB
MD56f92f4537d1314adf3ea3b8e73eaf0b4
SHA1e96d2fb4dd19b4375ad3ac769666a0da57e91d60
SHA2567383c8b96cb7a02735f6022a5bf655f595e57cd0a37fb7f77e0f399ce4cf1a06
SHA51271a46dcd888027d0c107801e413abbb3d6fd1229952644b9dd143c7025ba4bed7e8e510bfb679e5f3abd60c8fae4ba068dabef502e0b647b737586333a07f9a1
-
Filesize
5.2MB
MD51f86e29807b7c1094432cb171c379f53
SHA1a19b3aee459650bf953446d58a4dd3dab5d3ca09
SHA2565fea20ed971fb647715e22f637237247bc98c0e9ddbdae6e5c2623fb7df97ab2
SHA512c271cf451335a5efb9097bb6fd162478376e5df1228890ef2af1b2155b8a00de6b8c1028933f06982eeb4010bc83a60911de82bfc2c278fe229b016c7d48beb7
-
Filesize
5.2MB
MD5a892abe33baaf7dee4e6e731a5c45868
SHA1a96286a63e2a71df8bc40058cac41f43c70af030
SHA2560cdcd88579c716b88ed463812773adac6067fd30811b16419be5e976babe6a88
SHA5126f8b840cf5bc160c0364b9ce9f52d661669defefe0f57db66a651af98d7cdb6c2d7dba3c457c7f490cb64d6cd0b047a892eeddccf6f9a515f8ec7e72208d768f
-
Filesize
5.2MB
MD57e0354ed842023b7c07fa6902baf0311
SHA1d6df622a93afb42fe828ea4f2e6831203c877190
SHA2561d3bf29738d9184afa6d55f77e5675a73d2d92d1eb0373a01fb1b7fded1e80b3
SHA51205f9efba9795d52e8f03cec52804fb45877cb0073bf14a44f0392f6b2172bb5028d538dbc8fd94fbc714c9003f063017310be78434792cc7235778ef6b799eb6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB