Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 18:47
General
-
Target
2024-09-26_0633a429664570671662a565cbc93efa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
0633a429664570671662a565cbc93efa
-
SHA1
642441451ab05af235717d2429d0ad8225a3f5bb
-
SHA256
875c86bcbca4ae8b4a0aac2c9f14c70fe42c91358a61931621a1b000a585fa9e
-
SHA512
e18393a6ac0d7ca1f1345b1f4fdbc98ba3223d3043df8edb2022b1cdcdfb4fa6ec0c697d4602c22071b3d5078203db437c1e72ea73e48f3cb19b037dd6971d74
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 51 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_0633a429664570671662a565cbc93efa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_0633a429664570671662a565cbc93efa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KEguNYX.exeC:\Windows\System\KEguNYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qffyQwu.exeC:\Windows\System\qffyQwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyNzYom.exeC:\Windows\System\QyNzYom.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvlTvbD.exeC:\Windows\System\wvlTvbD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruOqpCa.exeC:\Windows\System\ruOqpCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFpOltU.exeC:\Windows\System\DFpOltU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwpzrfw.exeC:\Windows\System\hwpzrfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apDgiAh.exeC:\Windows\System\apDgiAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIjurIW.exeC:\Windows\System\YIjurIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MegbcMO.exeC:\Windows\System\MegbcMO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvfdExR.exeC:\Windows\System\mvfdExR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CpyEDCi.exeC:\Windows\System\CpyEDCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDaiiGm.exeC:\Windows\System\bDaiiGm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZiEEEpA.exeC:\Windows\System\ZiEEEpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYURehq.exeC:\Windows\System\OYURehq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vDKXoUW.exeC:\Windows\System\vDKXoUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSjHlto.exeC:\Windows\System\SSjHlto.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gVWFgkn.exeC:\Windows\System\gVWFgkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEqXLyK.exeC:\Windows\System\qEqXLyK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQkHoaf.exeC:\Windows\System\jQkHoaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpMLlIk.exeC:\Windows\System\gpMLlIk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD516b6b7fdba65b56d92e2434167c87624
SHA1928a3d6da116320b7aef71302b7759581c9325d6
SHA256667c0499d17f9751b1b82cb833ef97b6f0dface6cc6f7516a3332f380941edd9
SHA5129dd40cd83897ede3ef3e3996afe54e900bfc988b55b7379c0be2ad01fc20366d9fc34d3e70ff6c9bb5ac6aee2a1b76489e6b6fd90c987849d3f3fad420c1a635
-
Filesize
5.9MB
MD53772a92908cbe730063a9afa255005a2
SHA18c9a64f275ad9c989ef0227deabcafaefb58993a
SHA2565477b164f9f949597a98a9213344cdf23b32da98319dead7468aa3413ecdc3e7
SHA512b1bf31295719bde6e9818c7b9f492fb50c907502001284c17add05e8b80f56a0b0c1b5fdc756f27b117905aabe47c313180aeb9c357bd694e1bd9cdc484e5d69
-
Filesize
5.9MB
MD5916eb85cde58c85a6a5830daea066fee
SHA12033b879e4e4d21d62386382c603c3abb56f4b68
SHA2565225783768eb90bbd7a9a369e930ac5a63703f5d80bbdaf7fc9b6be7cdb4c128
SHA512c32ca7a37991ef8db044c864d280c083a92170407db18953880f21ab44d2ef8f558baaf04f2835e0e3067f76577a00e7e4bdc709e19dc8e33b31953435ff832b
-
Filesize
5.9MB
MD5def9a07fbd265438ed0d9ca2f5836042
SHA1f36583fb3bc313141446cbf0b0cea7c590fb91ff
SHA256df43aec8877d4286c63bc53f036144568705e764ef5c3571d16b11805e5258a3
SHA51290e110dc42eb269be0f1e35160a9e74e25c2d508baa6559635e3cb025f069c32ded994c972f0673879996269ef4589fb1cc673c77e898c296219983dda682353
-
Filesize
5.9MB
MD5e581c7ef40bc05a510b7a4166f4a158d
SHA13c2aa397c72c3c79844aae3fbb58b37747069e76
SHA256c823282d327aec63f4f2e490daa4d1c3cfe073200404c81719faa0d48a6aef91
SHA512751da75cf3c0ae7811b60ac52005546f32a05796c0f0e0364a23a9174bd05931c3fd7b4a77441d48359c40796d7b078a3e7ef2bd99bd0f8ca0a9b229930a6bcc
-
Filesize
5.9MB
MD5a8f964917c339558d7c7d1f1451bac4d
SHA1e613d875ed184af9e52f3a1e139b9b4467ecfc9b
SHA256a54415e93671c2947a18169cef4538f9a704439e727436238994c86e4a992840
SHA51239ed949a4ee3d8d3a149743b7548cab3596fc0eb39eb31b19000bdf2f6b91cbf84c61b396be79caf696ed413209773cfc177d3dc325c12cdb53de7a52c6baf8c
-
Filesize
5.9MB
MD568f79d9d5d00ef2a45fda10480557b72
SHA1b5a45b39744c47acccb296c62b57258c5b5a2cc5
SHA2564f36f8ad489cdcfc30d2f44533d862aeaf335c9917c1d88218e0d988280592ff
SHA512e103f78b66bfde15282fa908012da6d6ba94e34021e3f67a6ef01be230972448d8fdba0ff157a573aab3932d4b07b6912a60c5cc7f27278c903a1baef8ba86fe
-
Filesize
5.9MB
MD517191b351a41887b2b5ffd171e0d90ee
SHA1255a6cd8117a4652ef79e29dbbee4444eac0fb2e
SHA2563c92dd8a5fdab23eff7afece3257da85834c138487b125dfea5e49584db005db
SHA512e135b35c1053caf958d79e1f85ed228dc0c996cc08d04786906b89da7bf2ac8ac6a721c1ad4ef04b08466901367ed8b7921661389d9eb44c4079ed96ff25209a
-
Filesize
5.9MB
MD54d89660a68e82a04fdc1d1fb65bc2edc
SHA1babffe771f6866993ebe2d9a7dc0edd902723b8f
SHA256305eb74c4f4e56bca859968de00adb4a31607c3324105a2cdae09e733108de40
SHA512999e7b9016640dbb6f14110462d41188582e18d96f6db049cfc097579abd2b3a88e278bb53299d0ccbfa76a1457463b2ec5041b5fff43acf3955f18dc5cfd5ce
-
Filesize
5.9MB
MD520a212525c3cd9bc9532e1e21c7b8b46
SHA15c4839122e1a08a1c4f8d7bf761e5266aa08dcd2
SHA25658b8193d6ed5cdfbe77fa788648f22d98f28dbc2ba1466a46eb6d92151f81a4f
SHA51222a67971be527e7f630893c09c75b4c93a87456d21ec637b30a694368489232d2283a92a636e472bf2a3c8947d79d41065c7078713fd58bd3e638ec34c436f5b
-
Filesize
5.9MB
MD540260f6ac0343d9b2fc895241a036ecd
SHA148fed4c9f0361f86fc3c85172b6b01704f357e7f
SHA256f92140d1c12d3a1f63d38e4471769c7969197b8513b11937ebe29c01ac5ee466
SHA51225d37ab709b79c449767e1a2d3ea111dcc7ffaa38f21912da3e1ce85e7a413ad9dfa7f7c1851a50d8c55fcc92037aefaa499d096e07e7d559241a4a352b5b222
-
Filesize
5.9MB
MD59b6f767c8d8ed256a5d25f332231e37a
SHA10f9b7d6f9067a3aa4d78ae262203d4f92d558fc0
SHA25610668db4c94f2c07920afd910fd4f423cf136d12b2837e3cffe09023cf77e9ad
SHA5129bae97370fc67099eb17f3e08c00ae6d97b1fa82a8c516a7c147a9f5f761b9db6fa026c6fb6b60d999b096054fec552487c79753cb6111f1acde1d27f74045e3
-
Filesize
5.9MB
MD5dd9481811b271d70b38f6f0094c69bb3
SHA19d81d62e7a556d62b7aff5e6cc490aca3e78d5a7
SHA2566b9a779bdc534103b36aa72afbdcb78ec20a0535775263deb87175dccc330109
SHA512ddca7c8bb2be7f12d19f46d360e1dfe24d0bb0e3be6711973e4d19a40f622dd97cc51abacac02877bc860cc1e089ff69906c9c9008865fa2cdea436614b9ccbd
-
Filesize
5.9MB
MD57ecba6364a2ceba3590b29dbaf9fab38
SHA1713478ecb11d7bfb41ace8d91d6c809928f53b56
SHA25629b3f25c01298be87e79ef9fbb74dee008b005b44a215c4b1a62732b0765a5ec
SHA51216169e035b8d438b61633e65bd4cd153ac758dee512b45b7af61b420ee9f8e051d3139bcd58139cffc8686974a15940698cdd636191842cfaf8e45906eb07bc0
-
Filesize
5.9MB
MD569d59b81cb51c813601074f4cee31848
SHA1975eeb3849630f224effbc67ea9f09bb5cb70160
SHA25603cdba5f98495ea4e60e397a27025bd13eb43222156629d1e8a0eb15cca48df5
SHA51232e737688b913e4159aac9a34289599992b84f40840090a88916b00c0f89b3058604488cefa5c51055d31eb35aee2adaf16f24970571186a355f615a4648e791
-
Filesize
5.9MB
MD58f5a5fa0e64b510fc36b59ad6d48c780
SHA1b73a89896dff3f6cd5a115f403d44c9bc0afe9be
SHA256970e5ab5d2ed2351750a9171b0a294ba292c46e84305a5894762304f246ad984
SHA512575a5ea8c22f9db32212f489acd11c4f99692a3591d25f300181d0ed3f9685a083774cfa9969591ced6308a93e30a0b08e534c7966aec67951aa0eb0e767feb6
-
Filesize
5.9MB
MD591d899dfe9aa522d2bfafcc6bdf2f2af
SHA14b8e2e186f5d77b3739add49190ad9e11be7178d
SHA256678444a20ea21faa5d5628dceed18daec6dad5903864d9349a1ccd211ce1ac04
SHA5123e5b43898f4b4171b2e672723eabecb6ba7960d1dd61ed81baa0bc097a3759e2ae771cdc8d43a77c09650a7ce5914d2fd4100c610de7f05bf3dcbd4d1c866cbf
-
Filesize
5.9MB
MD5bccbea22af9e17c1d694aeb25f466cc4
SHA116e3e08412a4a4366072e85b992d118245055909
SHA25660926eca8646ea7adf773229fccd47e830dee4d3da63174ff11a5dc478e4f28d
SHA512dd6b94c2226bda71e4c1fb390ec75790c1ddee8f1f2e423a5273a7a61dd9ee009de0231fd3dfeb66f76cfa1b47d82c969defcd696695677e9a8134fa6c398cbc
-
Filesize
5.9MB
MD5cac2198d7ca8f4dd9e4f94164af3b716
SHA1299a96b5095e73662c2402500b19f7f625bc5e3a
SHA2564ad116b24347402e8b1b5a3eea648c16f9c13ac85605e2968cba9ac3b7f4f086
SHA512941f3b6adac65eacd07dfe075fb44f3819e23ec793122bb955f32665a54cfde60cf2d3bc2978d1b79f92c72310a0923af96298da2029c0506ba702ce5acc8bfc
-
Filesize
5.9MB
MD5bc161aa5f2572c172958edcf4a1bd146
SHA14c6fbe1a5c48f41935be942f42942a95a34dd51b
SHA256fe100bf1f4fe995fbbe82c29f493e1422492210f4efc96cd4ced196e5c89d6d7
SHA51224eba11c7faa0a20662d4eb6527790d194bf583a0d9f1065cf95523fba84d935765fc4f04f53fcc4a4573ac150b8dfeed57ea3da459280e1e82620c82f7c7d1b
-
Filesize
5.9MB
MD5bae3dcff8bda033017079566a3564211
SHA1aa2b48fbcb6ca5407acd8e40041ae712956175c8
SHA2562ae6c85ed68c1e582e9b246159eabc62b700604cda54f3d18c6e410e86fb38d6
SHA512c67a5510a0e5b286857f75da35736249192a57ac92f9fbc3ffc65d4c9f95d216e6d6734df9f10d40baa5c36c27b835446da96288a31fa49d97b6ae8bf1a3f7d3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB