Analysis
-
max time kernel
125s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 18:38
General
-
Target
2024-09-25_8d34ad706736c6bbd6418706aa8d3fcd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
8d34ad706736c6bbd6418706aa8d3fcd
-
SHA1
51cc3720b63358c95b3afcae9c9c588399ac30d4
-
SHA256
2bcc0e839e5f635ad4097a3087a7114fc6d5abfd370250757fcff344532a4f12
-
SHA512
6ca5fc8c75599dbc2d63f9a34018b0db7370dcd3a3c26b0dd8edb08cd83417aea2640d992bda271c4dfe8ee4a1dc59e7d827c9ad9c1f3e4cabf79e4ef117f238
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_8d34ad706736c6bbd6418706aa8d3fcd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_8d34ad706736c6bbd6418706aa8d3fcd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OpitHHj.exeC:\Windows\System\OpitHHj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsAJBjO.exeC:\Windows\System\JsAJBjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGOcsUU.exeC:\Windows\System\wGOcsUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvDfBYp.exeC:\Windows\System\TvDfBYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjQWJNy.exeC:\Windows\System\HjQWJNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vrNjeoU.exeC:\Windows\System\vrNjeoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRoQkEf.exeC:\Windows\System\pRoQkEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMjXRni.exeC:\Windows\System\oMjXRni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dolSjWt.exeC:\Windows\System\dolSjWt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MaCWETt.exeC:\Windows\System\MaCWETt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERMEgYo.exeC:\Windows\System\ERMEgYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jmRYNio.exeC:\Windows\System\jmRYNio.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MexSJwf.exeC:\Windows\System\MexSJwf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCKyJlk.exeC:\Windows\System\FCKyJlk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmjPfpD.exeC:\Windows\System\TmjPfpD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaUjwcq.exeC:\Windows\System\iaUjwcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYahSZS.exeC:\Windows\System\MYahSZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYPndwa.exeC:\Windows\System\rYPndwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QylgfhE.exeC:\Windows\System\QylgfhE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lmgmIjo.exeC:\Windows\System\lmgmIjo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FboePBE.exeC:\Windows\System\FboePBE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5204a05669c7069363e29fd6118e88de6
SHA10134c7bcdbb9a6cb0440dccce6759fca5eff4cb0
SHA2561b94782e1870b1820ec40d27b83d118ab85e0a2c5cf11eedbb152032b196af15
SHA512f6f84cbf3bda85ed995aac6fe48744596234a15297ad8f041e9913aee6d189848ddbb825e7924e9d01ed8fc08db3da94655c5a03beefd23a6fdcf37f3866101d
-
Filesize
5.9MB
MD5cd34f510b1e64f98b68fb833d06cd8a7
SHA166de7838a408368be451c654b2bb6a166c57a321
SHA2568e9b17aa7d8b24298513e69948b21ba9a4eb3b60afd6d1bb3341dc143cbcf879
SHA512674b81dfac14bd29407c8c72977c274ef4075e7f45df9d7c70ed02e9663bcf4ad611cca122801e897227d10cd2449d4230fe53c834eaa24137a75bbecd618fe2
-
Filesize
5.9MB
MD545c9140602190c3b0679aa07a4915580
SHA1aac8dc078b2b497c4e459ce54962dde252b79694
SHA256ed35ef6fe698b3af90e5c1838d818e51ed3675f90fec00dfe43dbd3266f9aefd
SHA512eacf95e8f110f0bc6ae1226f64c51dcd32b2fd9ae55a22cec665986d990c4e6bfe6bcc7ed0a70da81b521d03c28e7ba60feb48f8bde273913ed89ed055982d30
-
Filesize
5.9MB
MD50bf4cc4cae5c9c2e465da4f8ed0e400b
SHA1f5a72139856cd6bc61ff48934c35c40e0dd40ca3
SHA256a079ffd85d1c9f09a4994b7eee87a95bb543700d6c8b3ed3900354e3dd289264
SHA5121fa41d3eaed4fbbe1253f005204641b79378e699a984e0bf9f719f286ef1371add69ef1377ba7ba8c078df6f59a8a0db5f733e557b260878d82a339dd6924c53
-
Filesize
5.9MB
MD50ba80f906ab00a83123000a0af53e05e
SHA1fc8ce1cf2b00e7302c32d0fe6a65ed1087396e03
SHA256233258bb883b92897d6c52d2acd13a6b82b39efdb8914de8f8d3f2063dc244ff
SHA5120ba078b5400cf69e5fdf969872d1b592b9fbea5518ffc9136057d50a88b9f44a1cd17d04115bc9065dc3f198ed87d38dc257f4c7fb549565b2dffd593d7d3471
-
Filesize
5.9MB
MD50cf7d8793aa9af1066786a8fe2597a34
SHA14595e04ec0ce40f64e3784afb94ae8e4155bab72
SHA25622782f76e39f1ee277fea1735d4c92eca71757e100b12c4c1a0576a8d19f1f86
SHA512528a644f2d33002a299f519c3b6ac5a464e874cfeae184fe8ddf726f644561dfafafdb2308a8408f9e7abb31b21ecc40c8bf2c587898d928516a4694cff17ba8
-
Filesize
5.9MB
MD51f8047f3ec51357c84c7e1b7f2ba1c28
SHA1eed363d73a72e111ec559f7979ffaa623b148ac9
SHA256737edf7ecde47864f503e9070d9f1befd50a880794bd4b94fe858b6314af9563
SHA51206ec462df155450229b52b6f5c517a39276dd6f8c989b08241368faacf0be05b5654faca709c9967a3a533acd3492b1aabfb79b9f265a50d715920870e5d46fb
-
Filesize
5.9MB
MD5ce1bc753d898d68bf9a960f3160cdc76
SHA1f060419ff1c1bc09c2a36bf70f0911b579085704
SHA25684633421df6741de6507ca484417a65231778f9111c53be3effc707a7fcfa83e
SHA512f29561148ded7ff2b602e4c7edea76627de9b198c8c30e6e43dd96f180ed69195c08f4f42138732394c24d01050b7ef2ddad776509b5d00cccd319198e028d74
-
Filesize
5.9MB
MD51df694caae86d30c5cd7d1abdf185f0d
SHA1c4f80c784d6992d1d9512d4bf444e7141fc17d9c
SHA2562baea89d82be5186a1883c26200564d1b7a0a223e5924a8260e125966b187a14
SHA5122c7ed5d5c32b39a612420377a71d6e32cf0131647d6586cd7ff5c926f0c156bdb5830cfd1be78842caf6f1d911ae4f84897de0b77182a9927392be3f98e0a457
-
Filesize
5.9MB
MD59c4e4e552eb28cd14d5f3a1aa71012f6
SHA118f22316f68fb145792665c7caa1d534a6dc0d28
SHA256a30e416e6162891ed846d3d5eda57a30535c20f2aeac51abdda574759c165405
SHA512ce6b29f2a37aad409073c0ef37824ddb1475e0372cc27b8b9f891c644b6c49e501b5fd4b965c6fc42ca751c829581fe26c3b6a4ac58fc34dc6571aa0f5d58e03
-
Filesize
5.9MB
MD5fd9fc135a0fed613150e33f721255ab8
SHA1572be9a403384f6843a5e3610cd6e5e2a72dc2fd
SHA2561005a021587c0a24ee7472cb88d701ae7090f5f8e5c0fae0e72a86cfbc7117f1
SHA51261f25064231037376eff37d50b1ff5b9e69884142cb932e1be4e958d09124adf0e12407043e0dcfa44a38886378e95e8d77e1974b48418c4e2a6d41c748baece
-
Filesize
5.9MB
MD5a4b4dbb70eb0b5d79295053ce41d8759
SHA1e8d229365adff46ba120ed15beac42f03c934cda
SHA2565606671f4d28beaad4883e977464848511457debfa0646e8a9b1274d25512b5c
SHA512039ab35e5c6fb04d1e05aae8e7cdd05ee4020cb092cc7672a6495b009be4e06ef8c89874616b873ce240bba60f0bc2ae47ee720fd526abb4d1b047c0b06ab22f
-
Filesize
5.9MB
MD5c637ded5a2f56b3c76ef183fe7b8cf88
SHA1c91d950bf0000dea3580158a7a6cf274f58c1e4e
SHA2564963286c7660c1cd90a182017b272fc8c2d0040bd8c57dd324e871af273c5909
SHA512e5450d6dd71b7603599993c3241441f67f93254286c5dc75ca2775e305f863f8c97d12985461d8e0317739071ca70a460a8b8b9a6a6f783c20dbae7dcabd5c08
-
Filesize
5.9MB
MD54bc47c48c881971a307a1759a28985d5
SHA14885abf82095ed2e917427e0da185aff99026b53
SHA256b69cc752308a1663a9f6d72c89a162a210fe4257d942e3e4d714fcef8f994632
SHA512e919ddcee351faae132e869f31a723a4e3949e9c3e444165ced278c79a950ddab7c277b0a77f4790b88827521d22fb515fcd82cfc41a7017274ed9c26049add0
-
Filesize
5.9MB
MD5c8bf9757d3aa911ffea4974ab7ab5172
SHA1c474811ffd5639369e98be2dc9e7cd16e66e3251
SHA25677027cb4b1a9fcd22e43e364b8785889faf74b03ca964d4090bb3d5e04eec621
SHA51266f84bc41dd5ed5abf34f3edf49d85f67d7b6d9d08db79d1228dea4c97b8de4bb081cf0bd8a36299e45f9ae75055b4c4ed5144b50f2d09bb2c7cc9ca682cded9
-
Filesize
5.9MB
MD5f6aa8e3655712ffb144acb8ddf8ec441
SHA1639031188e471deaa4018af82e295bb7e27facad
SHA2566f17717e9610456e980d201c4f0ec8caffcf5f2d2769a2f7d050ccda248c4e79
SHA512d9e5e36197a823b0d0847f386d2434bca86b10272ce83634fd2d55e4bec464dbf157211b07869ac599c3e098d9214172761888f2b6c4abf598e5d6119bf23859
-
Filesize
5.9MB
MD57ecfc76fb40399bf7e495c4dec52e6a9
SHA1305e4cfc6bb1e7ffe1d2de0069383f7879da9be6
SHA25632015ca44a3bf01a0a59e8eedfbdd2bd7c9360039eba9adee2e6a4ce81ef8ba0
SHA5129bad5e9cc82c3f284dea7d2f127b836918a3c30277a07577aa623fb633c954bc6a00c983f0db0d464982324f264d64b2e50aa7e85739aa11664832d088d63f0c
-
Filesize
5.9MB
MD508549ec853999bdf4eb7a30c2d0885b8
SHA13d343d50f0edb40fb137c7e56c5da824ca6c305f
SHA256c08c488ee3ea4921a3e43e2866f115c9e757b892a95f2e7aa8f76526651ed440
SHA5124e43133615654568df008bb020e8773f65b590a296dec7b247429030b339e87a9a4fa485b0e2d37a4ea0c7d4148f7cc9e7580b752a2e6ad3585035e5aee3039a
-
Filesize
5.9MB
MD5a55ca12ad215192e531306edbf65ce9c
SHA11977e5cbe641ab49ed0805c38861033da9192996
SHA25619ecdd28bd01909d88f0a438699b373ac53d56756dbda8728f66f3e97c3d321c
SHA512f1581a0750d038b24093e184a554523f34d53da98467c928e41f04d111163b0d470922ad22406b20b02a91f403d89cb6935c66f0778f38cba93f255465b903a5
-
Filesize
5.9MB
MD5da1d767f9d46c6747eb07d4bb67591cd
SHA13656b728e5d6ca3373f620706d6ddd1c72863c4c
SHA256dbb88f2e3005cb0623c64cdccfda693d45483e4ff22e0ae58096737005ca9ef0
SHA5122106ecc88dd432ac9ccee5abbb447a51c2395b8b76ea9a634444ce0382deb6035b285f6dc5ba631cf0cc1640e134533e58384c6b7e36e3507472457427585032
-
Filesize
5.9MB
MD51408f4a441b915454edf32a2ae9f7463
SHA16e4d60ffb3fb4ff7dcaf22631d3c782084326016
SHA256cb158845a18eb0435a8ace80d571dfcac373f7797e9b3ba294f0a38f1b17246b
SHA51247050f131a2d0f4c6dfa03f0bb192980a55bb2fa73b9d49f7b253295ae8ab52f40f51d9154912c3474bc194e1e5a6b2b9dba366d93704d264d4d831a341fb6fa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB