Analysis
-
max time kernel
125s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 10:47
General
-
Target
2024-09-23_520d3daadbdb87a640a7fb7108442c3b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
520d3daadbdb87a640a7fb7108442c3b
-
SHA1
acb516f39897c25c2ba3510050a1c58ca92bcac7
-
SHA256
8d71809a792b604417ec79280564f8a687361ae12f3e4f705a04deba68b1663b
-
SHA512
2c6621b2a7c11d8d0f03fa18e5021ce724cf77b0caa729f1829d8495929408768d2b8be2e91fd9a0e47148c311588afffe38a97fdccbbaffdf059d059b63bedb
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_520d3daadbdb87a640a7fb7108442c3b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_520d3daadbdb87a640a7fb7108442c3b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wFcpdSB.exeC:\Windows\System\wFcpdSB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lfryXTa.exeC:\Windows\System\lfryXTa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HosRNXi.exeC:\Windows\System\HosRNXi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LcXsjTK.exeC:\Windows\System\LcXsjTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yvQLaqH.exeC:\Windows\System\yvQLaqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJGBBOc.exeC:\Windows\System\LJGBBOc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkDXYRX.exeC:\Windows\System\JkDXYRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtmgDBR.exeC:\Windows\System\CtmgDBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tkdmAjU.exeC:\Windows\System\tkdmAjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgCiOtH.exeC:\Windows\System\WgCiOtH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYZSHIT.exeC:\Windows\System\hYZSHIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXNvHTS.exeC:\Windows\System\wXNvHTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HDaepEs.exeC:\Windows\System\HDaepEs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCoXPwN.exeC:\Windows\System\tCoXPwN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeWqkgK.exeC:\Windows\System\qeWqkgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KTokZmU.exeC:\Windows\System\KTokZmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrBLCNZ.exeC:\Windows\System\LrBLCNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbjBcYb.exeC:\Windows\System\BbjBcYb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WUoVzIm.exeC:\Windows\System\WUoVzIm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WnbBkQl.exeC:\Windows\System\WnbBkQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcHsDAp.exeC:\Windows\System\dcHsDAp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f3269e6c9778363c28be7d2a205dbbd7
SHA1bc4b7c4547e7dc3a541297ca05e901f8eae85685
SHA2566453a68cb6e9bb583b98e614d5a33e903227e5cfdc41aa3bf14d09b352917041
SHA512959d5f5c4e445ecd43ed8d5fe6bc5095d22deb872ed3de38c6dde248af59e3f1ba2fb74a4bfe49dcac0f3475548ac1fe85e5640dd6cb614034432bb5e157c8d6
-
Filesize
5.9MB
MD5b13243e26190c7d7fa001316104c5acc
SHA110d6bf28326e9bc5b1104b7e5f2b66baf13e97a2
SHA25689a4a2c2ecdec97c8d73760acc4c123b0e124d21f326f9efdd26a137568b2875
SHA51294cf254521d26caa7c667366a1232d34db94a44fa480d731978e508dfdf922262f586d63787c69c751e1c2aafa311ed83e6e55fe0efcad561e22beef43bde034
-
Filesize
5.9MB
MD50736df2f2639f938c8d709cbe3cf36ae
SHA1d3ef9fdb64dd78f472143d3aa714a592d774a2c2
SHA256e69f6fd2499425783177eacf4be767d08df0501320f4d2837afed5914e88181c
SHA51290866566b32869bc72f5d71b916123d1ba2a6394aa8913d23d9b00358c8077ff452aab63e3f917b32a186a8bbc82495fe45a506e3757d7b7c35e26f622559db7
-
Filesize
5.9MB
MD5f6b15468a1c2450638a6f2d6c0d6ead1
SHA1416e7c7246d6bab377f8b479cf5dede7eafa52b9
SHA2565e1767c57879e48c486940267399fa809262983eb220631d66d64ca8e6f371df
SHA5120591aaab283df0e3d2ba95b39213b57c82722b5e9c0abcb36338dddeae0ec5edb8dd2e2601daebc92680bb9e7f3dae42db28e290b9ef102b7fe1ad2f67b9c030
-
Filesize
5.9MB
MD5a325db0f5ba37e733c495ffcee473847
SHA157a9bba74dc6d5dfa1e7f6fc1d4a4535c09069d7
SHA2566b08b919b3e8b6892bada9a8b3a6b0923b60f34794ee367a4873238bb98f24ee
SHA51224471d219610ed285c624923782fc1bc057614e4b80d8a2884dbc88b884d5ad77dd4bef03eee86d4a7329914bee40a85b4c2f7c3c28d5a6cda70f0fb07d34b20
-
Filesize
5.9MB
MD515c9abaa95bffd0d315a7d67dea869ed
SHA147d00d1dcb51c9e044564e346521a6b8ef96c2cb
SHA256453932fa950149fb9c24003af79536e8e8550005d11bc0a08cfd18740a558c91
SHA512015b97ae26cd031d7ad42e6414cdd80701580fd1933da0118104967a9e82f3e514aebf63dba05535d18449cdf928b10c5b8aac9b4a978410fe5328c217c1895c
-
Filesize
5.9MB
MD56b3d5bdaf41ff16ddce0b30920025789
SHA1397adec73d7ca44cc5d8957652dd1c58ee8be7d9
SHA25662680cef941b5dd29ad1efa1e3490861964d74c2cd456421179a74f1e9e1f7a1
SHA512f6323a5e414e35feefb1091327ad17913b7a5523141a98b001ac37b7dcbbfaaf47d0d822463038c2fc7f2d4104992aa60dcc6a8f447eff6d97694f5f6f79895e
-
Filesize
5.9MB
MD5cd6de374ffb94223d20a3a5c0a34aaf6
SHA174eddfd8c85db87cd72c6bb9e7a031ef7c2d6c4c
SHA2568fda6b61ff39b1952bab3a216f36c243a6e688ef4d165c260a23ed5e7ed762ce
SHA51226e2998e3f7cf531c81e95941dd08dde9636d72cf3d21a848117db5cc1b6cf286a73012b443611620b958fbbc7404109e53fb1f8012e8f6c2675efcb4377d7d3
-
Filesize
5.9MB
MD55521abef7c8c0949901741b041a4d103
SHA122b6f4ecc632d9947933a4e8942b93cf2b0aa570
SHA256550cb7ce83109009c307dba8ca929564e47fc940fd83567e2f994c5058c2b423
SHA51296db0defe626468c55de3f5fc152c8356a652e30cbbff9f448fbb45175af98432f4494d352a8b3c7f0a4244a9d3649c4d82cf8e2f7c943854806d69009524e1f
-
Filesize
5.9MB
MD5e34d58303692e8a71feceb877dba3c3d
SHA11e1f8a727b721019b3df611496736bb955d4be81
SHA256235175f23224752e1a1dd42c7e4e57cc092cca4859b11ddea1a57f8c5cbf84f1
SHA512d527a5e71bf630730e4878eb1e78f3a4a952d7685ed73891779188718ce04bd0a426c321aedeb4c161f9b92bb149cc4e34c464289afe59938f58423b89c761a8
-
Filesize
5.9MB
MD5bd68a34b7be48d0a2e1d31fc2a53336b
SHA12cd250fb2637d270ff7a0f9d3a63f9968b0bb3ec
SHA25668ef148ed0fa3ce79b611c4173ca2b11ea9cce8787b70f4d8f29806b9cb957c9
SHA5120fd4dd32d8fc9300269dc9f290bcd7d080703ed68bebb14628cfb2b78c8af8e7543935f09d62504ad38bd9576498281959037fab0d2c1f484b5fd0c39a1a73f3
-
Filesize
5.9MB
MD5d3c2947cf81e437e5bf774d06d527553
SHA1cd4c9373bdf34031b96f14ffbaa98e683e987424
SHA256caf2349dda85e79b6e7353d115ff9a58b68823cea2028692dfd025d02c6e27f1
SHA512d7e5e2e3d2816f7c1189afd33ca47dfec18b0e38ae79f95aa2121e71fea07c343043eed6fe0def2802d1c85639894844abad0eb33faa44a33ae2b0ea35480542
-
Filesize
5.9MB
MD5fc2d213181dee79e64d894d881ebd96b
SHA1b69ff3d05133feebb313de8dfd2d8ab6d3d58c5e
SHA25623e42394b86532b8253b20cbeb2d54bde58d794d1f4899a5767542bd3631dcdb
SHA5125c76039fe728211d577b7d191df4b0fecc78acf9cca0d4432df3337996ee75b232d2af2dd9facbe3b3d3b60a142f80d531ab850e32fef0811a23296ceb7ce1fe
-
Filesize
5.9MB
MD5f50f3f125460940344449b5b6cf4e795
SHA10c7430a32952ccd5b4f90f5bd148eb93af0cca9a
SHA2562a611bb7f39b231061d231331212bc303d93aa2eef4fab81248910120db6be34
SHA5123527ff106eb6b19fb99f37fd125223308ce1352681ebe6aac56cafe87cd4f099466264b516352298e783f404d784b3f2027e1077e45a98042faf072def443f19
-
Filesize
5.9MB
MD57da5ea8bcf290fe370cc410275889bfd
SHA1bafd603977c21ce37d1de9ef6238616631a0b29f
SHA2562baf862e59f6fb75b02c13c895cc465ad6ffd7c2bc495dafa7dde2ecea01824e
SHA512c33ac3a893bc856fce6b26cf0fd553524f722a61bbdeb6efec5f112c6ec67756b17fe0a307a86587fa5220311c508f6e209b24ad2ec1332303c165f4017e5852
-
Filesize
5.9MB
MD5a97995a40b83d8ccf6fe7b463c856978
SHA19e7e7046d70bae7e1b8f2ec051ae2b46e81ec64a
SHA2564ef0942fb5264c34abef5f88ab4938a3f9b950928e64e3e06986b76475be7cc9
SHA5124321af79392a07426b33eac6b8042eb0d8b880b76b4a820eac785b399ae29b3647e79c6ccd16d3df848ac4a91e2308bc16c4bab7fb93b65bedcbbaa5b0f267ee
-
Filesize
5.9MB
MD55a6a7acc37674c66efac54834cf706ef
SHA1384c74d6c94257c9fdd3b0071106bddcd2f0e71b
SHA256b151a18c19cf89ec6765ab7cc5d47abeea933e0496d162a905aad6ab718d6004
SHA512dd6806f8cfd5b840182693ce78ac91f7fb25220bc189905f3bb15c864e026dc2f0da564eda29c306eaf187f379ce546e6d7124a61ffd040ae8c2d6ecbc2ebf09
-
Filesize
5.9MB
MD55af1f349e6fc151bb57d5f92e3a08c47
SHA1857a7b25a517631655ed4a4253a669804bb03f61
SHA256c12326e123c5beca80c457a5473564d01bb6206469ba57ba1e991fa8d051c77e
SHA51238ec46814fa1894a671e764a07b52141e39d651bbcc79b25752e5dc1434e19264db50b67e78f8b175594c0fb3a3d19e876ac07ac7410f0cc6667e5008c54436f
-
Filesize
5.9MB
MD5133c24773c423da540550f385a897d35
SHA1f0eea546775d98530f51bb75d7a019d9bbf6280f
SHA256294abdc52153d3b9814c05fc75a6f1400600a80d5dd2a11ef4cbcafc8d14aea9
SHA51243de7f8ddbd2d000c140e3215604342ec7180ba925e3575f3f72ecb283d196dcaaca32fb47110db0fab0255c6d6e7274cdff07999622616421eeeb0d5cddedd4
-
Filesize
5.9MB
MD519e443e86e6d0c9c46b2310328053a77
SHA171cba09107a7b73130ac824fef4a156be37f6a4f
SHA256415efd7c1ed1b65da083703839c21539eb117d3253edf8b8e2574c8680a790ce
SHA512d4e3041270d06e9021ae501f5d9f16c945482b536f91eef4c4dd76bd10e8539b84c922d09b8f77150e898700731aa86e05861f3275cba249932e537841aa3037
-
Filesize
5.9MB
MD5349f376049852429f505dc53beed530e
SHA16853eff50c33748eded002a74faf73957e9f8d5c
SHA2561123152c04920493fea3b7d99fe5df4483e5470c7756dc99cabb641ed8b5799c
SHA5123aa76420cbdb9980d5b1da4efca36f310dc6cfb52d88f45e278732348290b66227e3c8639f1f8239023bb096ab0876ad10fd034c51112304c84511a9e924bf22
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB