Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 06:26
General
-
Target
2024-09-23_1e6406c39856aa567eac977d4c14e5af_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1e6406c39856aa567eac977d4c14e5af
-
SHA1
018527d327b551d95d2674c93ac75c736a827704
-
SHA256
4bfdc7ca6319b800421e2c402fc0df58280ba90a39282ba49cf2566cf4266d98
-
SHA512
11febe9160202a9ecab107bee1cf1e6751a4fb14e39580c312d2b410101a7979b9bcb1a46f05908b51e3ab44aa088b37419013750f128aad4d320c7352652347
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_1e6406c39856aa567eac977d4c14e5af_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_1e6406c39856aa567eac977d4c14e5af_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MZtqSrq.exeC:\Windows\System\MZtqSrq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwyhAmK.exeC:\Windows\System\rwyhAmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXQLpkg.exeC:\Windows\System\AXQLpkg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgbfwJp.exeC:\Windows\System\AgbfwJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWpcNhG.exeC:\Windows\System\qWpcNhG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ingCVYL.exeC:\Windows\System\ingCVYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUpwzQe.exeC:\Windows\System\zUpwzQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUZtYPT.exeC:\Windows\System\xUZtYPT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\waesiFI.exeC:\Windows\System\waesiFI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TzSKgLn.exeC:\Windows\System\TzSKgLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwKqDDt.exeC:\Windows\System\IwKqDDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\noBMXfy.exeC:\Windows\System\noBMXfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJsPrbg.exeC:\Windows\System\HJsPrbg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fASblTu.exeC:\Windows\System\fASblTu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYEGPQI.exeC:\Windows\System\BYEGPQI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnPwekd.exeC:\Windows\System\MnPwekd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcIyZZt.exeC:\Windows\System\HcIyZZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIaKJkh.exeC:\Windows\System\IIaKJkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJrdVum.exeC:\Windows\System\QJrdVum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhbpHRY.exeC:\Windows\System\rhbpHRY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKOUgLe.exeC:\Windows\System\uKOUgLe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5484537c201f2f96140fbeec26b708ac9
SHA153140092e15e4c1a24231a59855a379eb81ce8e3
SHA256fab5c09315b5b1e202551673784d0dcf335f423628cfb422120291fb7c857ed2
SHA512274e9d2d88661a0c118cfdc12982f712f079f4f7d444ab6bb78ddcafea9598ae46e669c5c81b870d9da4d689b9a68ce0c28f579bb7c707891de373489803aed0
-
Filesize
5.2MB
MD5eabca0e774d45238c732adce2afb3a61
SHA184066a233ee025fb23079129afef9edbcedf0596
SHA2568131a8d5ed58b945e094be02c84e043898065a7552c510dba95847c0a9f06787
SHA512e2e7c5edbbde458611de14f2275e12cf704ac6866b0d15cca33093aae1374732d586cf8cb2a3ca45c6316bfa76cb6a8f44a816d2784b439075ed67801dd29e2f
-
Filesize
5.2MB
MD5fcdb6df9983ef50a5c76b9bde17595c1
SHA1e1f6da716432f40edd7acf5d280a9d9345cc10a3
SHA25611c65f4ba00f604f6dcc114cad3936ffde5dc156b936bec053172a625cedf719
SHA512005bc3362717d446ad53e9294149b2d8178b0be5779f42ba63b02011007f5f1f0502784bdc4122b25a9d15d2d5bf42bf2de0acfcc1055a47dcae2ccaf2f0b04e
-
Filesize
5.2MB
MD502ac36e35da0fb6d402769359a2f28bb
SHA197e7fb3409249618ada5ca33a83ef1f75e997b01
SHA2563dba6b303827eae91daa47fdba7775e66d8d87e07091051b049f8cb1bddea82d
SHA512ec438649663b6b492a1c7caf56f1dad6c1c413f47949b78defcf70bf8ddc2b06cd1fa30a6964181350049121cdfef48141134bcfb129ea40af81571351977914
-
Filesize
5.2MB
MD533715ebd5931f11a11bb49b4f487cf60
SHA18d07fbf1ae08a906dcb529ede36cd4eff2001d0d
SHA2560c5f1e6148115ee766d9ff02604a49571cf0429b34f21ce34bd40b0b18699960
SHA512fafd08e723b802413eee6ebfc7b685d00e6d01749e4461ba8ebb8e3f7e4ba1b0e4f9eb645ea6be0f38f074b844f46f14080a9868d373b9a243240eaaf5930943
-
Filesize
5.2MB
MD53e41341e5482deccfdf93d3a6d0b523f
SHA17d28e662f3c9a293d53064e1fb7d5fff9d1a21f8
SHA2564536c5c4b1a5ada8bfbe1be3e548a940b47cebefcb3d1a3e01e9bc08c71dfb56
SHA5124a1ebc9993d76c04fe21b832c9fa21d0bfa7f91739cd2e139d1e4b37e216eb2b59e8fbc80729aa51811e76ebb50e9c935d00a231f339a2c0bb3ae67a595d3d7f
-
Filesize
5.2MB
MD5513444fc2731c1fc927763c15e8e2803
SHA174ab570cdd6800b6737ff5fe688a359e55b639a3
SHA2567a46d2f222dd667a7e86686fa69c99015107a0c7d563d837827af491cd35922a
SHA51244e92ef5f227cc1d774d97002305111926b41fa185edfceae8f5fc3aad9717fe58f4a61a4fdaed4e851f92b55e46d10d07fbecb268c5a1e7a4897bf55a79796b
-
Filesize
5.2MB
MD5ccc38c1b1ba114cb08d489145f317612
SHA173e07e65f84a28045fcdf269469ddb871b3f1548
SHA2568aa4987902d174b9d09c760d1cdbf603cbc2421144aef64a0d55a2d9c5fa26bc
SHA5123f05bd61f8a0e5a24ae9288d48c7f7146265d5e58c3742702f430a4cfa09e9e389efd0bdcd1e45ea93ee3f4b363166f46d8f3a4e595d3b998640d33a80dc7912
-
Filesize
5.2MB
MD55013fa688f8d7d71e07d325308250098
SHA16599452da8bc1fe9d4c7d302da3e0accd97df03c
SHA256ef43540de8541ddeb10f46a7a85d6273c51b1c365d6ef7ffb2c360fe0a016191
SHA512636427c3f9163cf907b4071a0651568bd2cada7a382db5910660b09bc287d18a4029de555bd0b21f519b911fb0ebc09486265d3c14215d890764c2c3b71df908
-
Filesize
5.2MB
MD559b9a4be3221f4c9189443aaa9ebe78e
SHA1a2ef716f16a4cbf337bbdd9021c124fb0e072e97
SHA256bd52f02ee4836ec14106d405a68bce50e444ef88613451c04caf054532c38e4e
SHA5128d9455460e8bfdb55d6b3c69e7920c2c2a8ffcb1f973947bb20bcb5f090cf6f9336879f6ae33d0f182e490bc35d19a29898bce9a648f866c3d6f70852108b909
-
Filesize
5.2MB
MD5d8527da6cbc8b755bf6c83eba46c4e2e
SHA142b0d7ba0606168ecf0fb6f6ad670275323c4527
SHA256844fc9fdeb1811a7b1beab3795fbc17f79641e4df4d584394781bc6faf9186e4
SHA512dc6045f6046a13c3b1e1498bd7c67129312989f62310ae2fe766218f4fcf90e09341b0d5cb12875b8a616e7280196e7dec7f3b33990a8206b78aeecbaf156186
-
Filesize
5.2MB
MD52e713d659eadcf56cb3e2a0656158469
SHA15a08fd4e57806e9b7e3def3740a6c57108fadec6
SHA2566339ffaa0d5836a108d6f47419d98c5db26b8e8fa9c560b4377671bd097c1aed
SHA5129ce98c114053ae75d31f016906fe7317e9578cd4f7a60733fbad124aa3aa3ebf9c5b103e9061c23c2889f9a1cf9a7f1896f32f1dfe5e8d684919091306e348b4
-
Filesize
5.2MB
MD5564db31258cf51c74c7539a82d2d31f1
SHA13abb4cd57e0b14bf5dec6dadf155536d822f3c15
SHA256f101454c0b16278d9c0e6d5cf049f8357391fc4a2db233f96be0483792ab4663
SHA5124d7cb9383a983dcb696d05009ebec2d288aca0e0eb24972ad3ab3d037f2133f18a45c7da9db5b8cc729519f657bfd6b99443aa41f48f2aee7b8d1b30de57626d
-
Filesize
5.2MB
MD58f7b17c49a715756d7ea54522cf3a824
SHA163979c7dea8cd48039ea2eee5237c9b9920b7cd8
SHA25679f90d03c78d53f3f208354739000ed767b136d6073022118bd6741aaa657933
SHA512d3bff2d1f75ee2f0e93a71928144331e39bac5651e3ecbb16001708f138de726ca0ddc1944ee077eefdf934c60bfdaf44f03dd0094ab9d22b4ce3235ce50106d
-
Filesize
5.2MB
MD5d633c90bf6055c7004fee601f9137fd7
SHA100d57cbb95c038f2c9c9f598ace88360fa8ac1ac
SHA256d40678e6cfe035fdbb065b72c24837f54fcfd11c4e4f5c98ef732ff775b3e36b
SHA512f7aabfbabb34ef247451320a3a6df0e428acd1d180dddfb5e36d55e3b961b596fa68af6b85b34a4868a10fef4cab3c795ed0634c458d4203a686bbc022297b22
-
Filesize
5.2MB
MD52131c1503b8e77aa65baf31c06844064
SHA1481837edc2076ecd944fe8c3bae1fbc2d5508600
SHA256dcc072351f12e155beb00ec262b1caae143f0822e5ab9e7c393f0817d4cdc36c
SHA512f2b3ecd5c440a0a3051239a03a59152b1995c15c7241af3b27d5ce60cb09dfecb2887c7731a85f75a7706c50c49a1796fafdfc2f2554117dcd43aecace348470
-
Filesize
5.2MB
MD59ef498166705f79804ea3f170ab07d23
SHA19375e48daabaa26fe997e7a293e4d551378aa120
SHA2564af83446d93202c717a2d1e408a668c00a09d06653c091e78ee17daa408fcc7a
SHA512baf798ed441912fa667e376e78400ba6a659121aea7cd0c44f99f3b2af33c10b63ddcba8f689969f4eb5f05af1eaa9818e68f3955eb716803d6ff5921f7ce7c9
-
Filesize
5.2MB
MD550ff453f606f2ea249e9468d4878b0e2
SHA115c6ceca23f644bfb6aab7420287071e5f6c5baa
SHA2567c8214ba25a5691298aae1343d235e7f6fce6f14fec4a3ec1a76b6ddccb82d51
SHA5120fb9a64dbd3076221dc283804ad6654b792387fa10c96817b98e0a793d9e286936703a2f390e4a6e061d1c0552c71637b0cba0947257e8d1e9e464bbb89bc6c9
-
Filesize
5.2MB
MD56d29c9371332d0e6bc09476f0668eb22
SHA1f63ac831eef601119e6c030a1e0efc48c7d70312
SHA256f4613938d1164b4fd5fcbe06310f665aec776ae80e849ee26e2a2f168ebaa6d4
SHA512187dd810c69fcee60bb1709888e261bd8cb64aff502c367e3cdcf3d2e2ec74f49b4430367a979857cab9ec3aaa7c3902cc94b2ca24780c15849d852dc1b22864
-
Filesize
5.2MB
MD5fd6a5048d6bac17e77846f0e45402abe
SHA10b7c78456b89123f7b5d618798a0d42d6a623910
SHA25669ce911b99eb143a2dd4f89c4c8fbab29cd87a782c7c2d73545f9a2513a25a94
SHA512bcb7e13a4a95cd599a6e22e61e4f2a2a49245882e3397c58bb525cbadd2ca89c72ac34056104ea025b430d18f58dba3f9cef42d166b93eb5109843e0381bbb65
-
Filesize
5.2MB
MD58a8cbfbbdd4bd88e93a80da97ef6767c
SHA136067a8ed82fdc5cc18a39e9d4527e3d6576cba2
SHA25638a5fd551d5056c9c66fb6f4abf35e23a77c80937c9cb18581fec9c2f42d93bc
SHA512b7ba465322b93a7fd61b75d0b191df0699160efb15dfb80066edbc48133961e19c2e6a2ebd691a5dd9ca676a701cd1ca981919c94d48543dbd5e2cafcb9f86ea
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB