Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 06:25
General
-
Target
2024-09-25_1d95727cad9237720969f525aa65d32f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1d95727cad9237720969f525aa65d32f
-
SHA1
2f94804b6ddd31353947c6a1caba8b7cd1c4398d
-
SHA256
49f8a0f1b1c633f141853bf63be959e56c487f67997c1ec03f44d24e6ed5fa3d
-
SHA512
90102eb58816a8f561ed623ca17e8ee55086dd1bd2611f08bec3fd5eb3a1114076ab7d8ec3e7b89595891c70ba6f4729d69519141f3147e1fbd9e15a66bdfc2e
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibj56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_1d95727cad9237720969f525aa65d32f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_1d95727cad9237720969f525aa65d32f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MGPbYaQ.exeC:\Windows\System\MGPbYaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kwMDBUi.exeC:\Windows\System\kwMDBUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zjHJbmp.exeC:\Windows\System\zjHJbmp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euMUloq.exeC:\Windows\System\euMUloq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xxxuXjv.exeC:\Windows\System\xxxuXjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JdXhsLW.exeC:\Windows\System\JdXhsLW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNOZycf.exeC:\Windows\System\DNOZycf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgySGbe.exeC:\Windows\System\GgySGbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvaRByD.exeC:\Windows\System\kvaRByD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HHXSLGM.exeC:\Windows\System\HHXSLGM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LcXOjTL.exeC:\Windows\System\LcXOjTL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GEaZVcI.exeC:\Windows\System\GEaZVcI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AEqROyR.exeC:\Windows\System\AEqROyR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qgHfmYI.exeC:\Windows\System\qgHfmYI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfZOMUF.exeC:\Windows\System\qfZOMUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nbtMyUo.exeC:\Windows\System\nbtMyUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ftiTOKh.exeC:\Windows\System\ftiTOKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txrzvGH.exeC:\Windows\System\txrzvGH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NbTCHSl.exeC:\Windows\System\NbTCHSl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PmFtBWQ.exeC:\Windows\System\PmFtBWQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EDQembG.exeC:\Windows\System\EDQembG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ae59758de2637daf33465cb77f708ea1
SHA1fc790c72a6a396fd77b63ed3ed7c89ac4194e1bf
SHA25660e6c199b47dfcb7350fd4bed3b123a7aff4125d127a78177c3667e3b37099b9
SHA512d09dd81dd0101986d913634efef8a07aa9a0fb88ec5bf513b46d6a0139663f8d555f36cb3daa37c4c7d6e71ee1c5ab0a255ce178a0edfcb9fc1717e17f5d45fb
-
Filesize
5.2MB
MD58ac6039d24cb6e7f7b20baeaf3653df2
SHA18bbc2b4da126321bb8aa4e3f6572576c7b0445b7
SHA2569c3911b3cc84b962e63c2b2df46448e60e22d5a2f9d3a61e09fd950af8ad64a4
SHA5127e86162aefa7848b65850be9482bbaf071e3e8c1945e3f82b1ef4b06414e11fabdee185c34969d0e49d306ed39019ee438ad67554d0f59025bf90801bc627c92
-
Filesize
5.2MB
MD532cfbd995aeced018379989e5927c288
SHA1b32a97effc6ef4988fc7b1b6ec739666820595cb
SHA2561874a31032b9d554fc8de23a7ef7288c5a50982860c26e95ea44409438b0e046
SHA5121cd8646683415daa5f22b042b16ba5b887e0277e19bec5166fd147ab507ab9de062aac712bc320088d7e4ff2a0036e9892eeb1ff3980f695f7a1f7a7fa51d3a3
-
Filesize
5.2MB
MD5a0b598b32abee962ad3dd9e7c2d35535
SHA1c563e2e65db5465a78f9ab387d2dd7c971f8d37d
SHA256e606fcbc36dc8d3f63698c4abe97a8e7f7b9e92c2ecef3fbef1b7407393dc535
SHA5120fffe8c60349a4e01570956f3c5b53d9bd78dff40717925279623f701e3cb49a925e50c203531d1e6e0ade937fe87eddb55b9fc5f2f0303ed90d3042eac6df30
-
Filesize
5.2MB
MD5fabc0cc41a6b1c4720d2e4656286cd54
SHA13698e69a9c002c6ce740df2383542b3ff072e439
SHA25667efbd966cc08f974399fa0609215da7b42d8c89728219fd6bdf945060f1ec51
SHA512b13337d324d7143d0812a8d46e756e6f2051c65b04c29c722fc609fe71838e7be9d04a1d01988eb091b7718dc0109809c163d7f0320a2396eeea4e5087f227a3
-
Filesize
5.2MB
MD5edb2e2ea854d7c7ac46fed19321ec01b
SHA18f64b02a43ae818bdc73282ce355c0eb0451d19e
SHA256b3f2d4e8ff1082c6e3d895492a4c9e199273e7ad86a465a79a91fb28a22a6b19
SHA5121dc175861981ba088a52f6262767d03a0e2f3a228040970d3e04df837738bbd77622ad68f5c338f2802324f9dd3d69c3992d9ee029a59c2b56be4948679ed3d5
-
Filesize
5.2MB
MD5d625795c671209a52c3e303ca49fa73b
SHA16a1582dd7d72e1899525b1fe50b16456da34dd0b
SHA2563a8f5a2b5f0abce6cc10d92d5f0fd85518d0d793d67352efb269de4c36c1d463
SHA512acb61ed6a471b24cec7aae0eb8591c6a1753f81fb27bad4f3c9f24977f65b6772d08f033f823c57772cb5991103af363e8b88928f7dfd35ea2a0ea973026c8a4
-
Filesize
5.2MB
MD580de80e2a872062f1f995f7593f1a34c
SHA1ca29c1ac94992780e71fb83a52e6dfcc69b38435
SHA256c1dca28c7e5784b4064cd9680a10d829a4e32d00fd57e267a38b483eb3f370b3
SHA512436802b6360e061b96ee1e2595296a34dfecff9222424e18950d91ba51c050166359e96670127a985656923b595b61a89725ea6164e22f75247e844ed17c1aa7
-
Filesize
5.2MB
MD5b35f10a69dab1603165b7c2214dd3651
SHA15622ff8467f10d0a6849d002e1f6e6717cb1e243
SHA25617d50d1f1dcd7e131076e7a0d637f4447a6022f3d672a8ac39e28b22230be646
SHA512ac3a3cd69b421f0128649b712a1a11a5703bd376229d8262cb9fc16c9272ecb694a0d6d27284f66787d704b0de3304d3d889cb17d18f092904c30157ef349884
-
Filesize
5.2MB
MD5b8fd8b9995eeb65579c959f99da25ba7
SHA16190b7fd4aeccafa1db63987d79b32c618060bc1
SHA256d19d032a62630608e4684dedaff5204e951dd484e50fabe0b8000d0bdfe1c231
SHA512cb077d59a486215267d8d4b284032e239581e9234194f5075e27cd16495cd2e9e09bbfe1eddb966812fd4e3d545ad03ebc4d97b5ba4df5ad3246037668f19290
-
Filesize
5.2MB
MD59a79bcb5bf64e371532f4d5babeec8bc
SHA162454876e122240abbd15ffff2e73ff14d28b3ac
SHA256fabd13cc9334081f21ec95624a2c703b52eb85f8f72973423ca409882d1bc119
SHA5124585b3fdaedf38bf44d255cb8903c5b3310ccf5f5632b88899ed30df34e853cb55eecc5d46f5d403fbe4bf9bc229e89155bed9b0d41a3fad9fa03d1cd968be5b
-
Filesize
5.2MB
MD532cf11f8458b9570c03af6992d6df74b
SHA19475d7b1118b2a41574f9fa988fd6ac220d3b1ff
SHA25639aefbf221d641a5381bc2a86471d3b2730a6b99ed088cc6ddf880cc0af966e4
SHA5120629928d6be6d00d4dc6d850179f11fb89e9289c49d1910bc61632682fef2170b21370623ffa13aa65ec9d5ba7d74fbcb18f2a7c012ef912de45f34b10e4b369
-
Filesize
5.2MB
MD5a2311f51796e486462c57ac4c438221a
SHA1ae22ab6ecb7cd034ac275ab3bd8cb52c98bac8f9
SHA2566f4ecc6573f9679b81348ab51f8ac1f99a795c2b8a829db175b62ca5acc41f9f
SHA51200c649f1714bf7f7d13bcee3bba1bc1186bc6aed02d8d31bb5d3e94e70bc163179534c24b63b6cbdb54813dd9948fd635dafd6a9b74c8c5dec0edfd1f340f200
-
Filesize
5.2MB
MD5aa19c8d5561d70e07dea1eb99dda8ad0
SHA119b1c50ebc2fd296c3910ad847b14e70a2bf5eeb
SHA256fbf8b4777f6209047d00d4a14230189adbc58eff068b6b52f947de8d00253d2f
SHA512f5a2dadbd507fbd10c46fa92af452901b99b5dfe2313777e80163111ac88dc147da235181dc91fd95338d5797921009cbb55f4ce7e6d535367ad525a63b56bd1
-
Filesize
5.2MB
MD59fad0c44209917a5ad6f19ea4e34203f
SHA1a69ac214bcd2a43c6007a990ced7728b8b0dd08a
SHA25677e06ba47c77e52dcdf14402755ac480cfc282c207bfe0ae295a08f0e29f6194
SHA512136344e88cc1c6b330799ed7adeb3221bfc5839d0c4f32839afa438f479e3b688fbba9ff9426cad532b26bdd58db46cc4c3a0a890c3244b9eaa20c791abac9ed
-
Filesize
5.2MB
MD51d4c3ec92430fe3083918b1146dea399
SHA1db7ed181ddcc1f1a9c97f3fffc27a7796c807087
SHA256d3d062d1e4529fea37dec6a0ed19ce8cd5f66d519aa821dd78f7fccb77a8b03a
SHA512eb272d9beecc75a6a4a4d57caf1bdf86a88303687c5a0010b451b42adfd61f770fafe68321e90c8cd9c3158f6c3b12274ce2eedc6719275d10dbf71ec7146099
-
Filesize
5.2MB
MD54cf5276599ad1234e7b585f75c271b84
SHA10ca5d512a348d2c4eb7e091f6311e2e86de6ef2e
SHA256df91aac4cc50baa076e738072857f502178c286a8a11398a51590ca8786eb59c
SHA5128b7530cfd0221576248f473cd3d54ed5781dd818d1ca3357b8d612b140c29b07b08658d55aa6a82309e42b0208e8bee423ee228bafd5ddd9c01b19b4de90d874
-
Filesize
5.2MB
MD529b944e4ec9bebab0582ae0b22392c7d
SHA161c8af342cf89b21653b691e7e1c5790dcab9556
SHA256d08f21da5552087ca07ba50c894aec33b44bf2b27893637dc443f2f602658432
SHA5121a089525a3e608b30305807422348a3e145ff9ec4972c05b29b7f38ebc285729071b9fca9a2f6766b1be1801b4e5f5f2233b032142a1777b0500b31735b6c62e
-
Filesize
5.2MB
MD5d821da3a95a1fb40baca2b9729f1a4c4
SHA11d3456129c2351be6eaa14c561f90c6c56fdb50f
SHA2560163a38e1df900e7d2f1cad1f020f0748f98c671a78af9270fc1f6ba088dbc3a
SHA512d8a2fa238dd5469a95cc58a7aa67fd9b981d986f0711b690407e28d035abe2b0b6a00a7102126cb69cd434db2411998d4a172e6d3ffb451be14049f0b38dbae1
-
Filesize
5.2MB
MD5c9d31195926edf0a90625b78f3f72717
SHA1ae71042cd1b9edee7e262ff6fe19cd3bc142e543
SHA256fa8140d85a05a6e6732d0ca94a34c853f9cc577615badbf8e0bb6ff91629bdc7
SHA512c9f0517b8852b7e8c5888af4ccb76e6c51ab9bf78dd782c6761d4073b42351ec771012afaed834c3d50826084c63b25841080be09547cf9f1061d50bda323657
-
Filesize
5.2MB
MD55c39b57c5edfb64663bfd3b946da17de
SHA1ce78d965afb119351b963ebe548daa1b1f4d8c85
SHA25641d23b20b83404b269867fbfe2fa13e41b8658ab7d4e2057a0ebe69007527302
SHA512fe38bc12095c7738fe3364aaf5ad46c144cf66cf558eb8f725d23c470666f16af2d635a898cc3bc183e422eaf08d5775b2ede56f4a2dd60142648052b4f59607
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB