Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26-09-2024 18:54
General
-
Target
2024-09-26_64484c7afae991825ecb111e736e9a4d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
64484c7afae991825ecb111e736e9a4d
-
SHA1
25ba0dcaa8d4c8f56a415b4bb2884053c2ef8068
-
SHA256
702426d16bcfec8399b80af291248415654c977f19884cd30822d2fcd3364f82
-
SHA512
a03ba06f5c8ee4ab0f8dc63233db331c093d5df5fbabef9431bf078827307ea8974e89cc52d130ed89fbca8de60f5a949c14700db5bafba9a270f7d5783d2d78
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:T+856utgpPF8u/74
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_64484c7afae991825ecb111e736e9a4d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_64484c7afae991825ecb111e736e9a4d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KtOTQrw.exeC:\Windows\System\KtOTQrw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEdWJyg.exeC:\Windows\System\bEdWJyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aRSlVbN.exeC:\Windows\System\aRSlVbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shTmTkN.exeC:\Windows\System\shTmTkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Odbffzn.exeC:\Windows\System\Odbffzn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RMJnDrK.exeC:\Windows\System\RMJnDrK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJixets.exeC:\Windows\System\aJixets.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlRRIEE.exeC:\Windows\System\TlRRIEE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPlTYXt.exeC:\Windows\System\OPlTYXt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WxGRHFR.exeC:\Windows\System\WxGRHFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOuRAjc.exeC:\Windows\System\xOuRAjc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vlXVGyK.exeC:\Windows\System\vlXVGyK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcsUyWz.exeC:\Windows\System\GcsUyWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBMfugh.exeC:\Windows\System\FBMfugh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CHsqpiW.exeC:\Windows\System\CHsqpiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ReXDYCG.exeC:\Windows\System\ReXDYCG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hakUEVc.exeC:\Windows\System\hakUEVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBOQUCt.exeC:\Windows\System\qBOQUCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vCGNoKh.exeC:\Windows\System\vCGNoKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtKPfzj.exeC:\Windows\System\gtKPfzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVkentf.exeC:\Windows\System\wVkentf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5da075a47da01752c13e20e8417b4bc33
SHA177979d935cfc5c6fc0a312b991e58bf2c0fe2a10
SHA25652f97069836d004b36f9d953cf7a56c724986c6a0795daf2fd78229b7975cdfd
SHA512ecb750909d70158ce73c9b302fbf0149f9df49d726253bbcccb96fe13c4144a08df24715275521b7a5c2c954aceee8b35ab390887b4aaed1fbc12d8a098cf142
-
Filesize
5.9MB
MD5178fe969317d35e176c4f36b7647e654
SHA125a07b3ac747f166ab640e59613306b139380f4a
SHA2568949debd84372608a8c93aa068668de18203eba11e7c78699d7716e532b9bf55
SHA51251dba71fa7abea15cbec841bc77eed81653234f38391630b2f4293664690a093afa8314be93cc3a7f8057749538a37ed88c57c63f9d26e0284fc9e666ad4179a
-
Filesize
5.9MB
MD5a23837dfa35644c757211c91d0459b72
SHA1432ec3ab5e8589c233b4a5cb99b9efd31eb061d1
SHA25618b95c707eea8c28d592783f1a29f5b4592044852b46641a91d524838890fdfc
SHA512f8c82873988c9952419dfb580733bb7ef850eb811bd053229fa53a7941501c3344a75e4aa61993447ccd9ed0125feeec70e31e01ad98fea00d3bd9fb1000fb71
-
Filesize
5.9MB
MD5e71b438cb04507f43484c7ddfc4dc9e9
SHA11a1c6d23c77b53429f8c07c30c2ae07b5d409024
SHA25623b2fc07845c0b1d2f7a51ad1a1f96b2396b52250997a11ecad488851140ab8c
SHA5124e9855d50b064f2ba943339c0c8170e96746111037652cf9fde770ab4f4b525b9c7a59e2d7fdca323d2ff94a8da07a66b593ea7c7741d4eb307d20da555588e1
-
Filesize
5.9MB
MD551b4c64e0afa4997d818200fb8f80e32
SHA1e1d53d684863cead97c779d8c8022731f3f18976
SHA25691996a92a20c87f0714ac23e6b0e38e4b7e881b1201e0f2ea2b3f639daf62434
SHA512cf5b822e6908001a349b80898df887a31f9b6a4d6800b2fd182bbe956329a7eaa078d60b6a334b65014b9cc30af9bf8e18840fd8367648ed81d0478dc5fe9889
-
Filesize
5.9MB
MD56b38769cd8b7ab2d24ab2c74e1f5381a
SHA115dd2dc75f47106b4bdd8eac5e55f66d21c27c58
SHA2564abe6472c7b7b56f9e4947fcbf6e615cfd563bb6a0efc227b1fa59e5d116328e
SHA512badc4f4cd9ebf5bec9cf85ad42c816d2bdd5a9e18aed9ce464fcd4c4427e194c1c2239a25b9297fdfb6c929495e587c36d65dea6a0a1809d5c29ed42118fe970
-
Filesize
5.9MB
MD599f2ef0d0e2d92733fbfc88926a70cf5
SHA1501597092aacf9efeaf5cfa0c92efa5cb73e3598
SHA2565051b7147009950de0b0298974653d75bd571cc0e50f97df22471b4206d09bb6
SHA512eb54906641dbe4d8202c73c5a98080c00dd80196d429843b068cf55832c91ac15e789925c7e7308d42e61afd229bf2abf161396c11dcf215e6af6bc9343206ae
-
Filesize
5.9MB
MD54882b08d09844899a00d6bab5930b8c3
SHA11a5bd21e2f8f831e71aabe610a2ec95f5cd9336b
SHA256c42e8a8f3b0dfa343cd1bf9741808faddcc73ded1f5b8833354ca4932f107f82
SHA5120b43339c7e8b9d23eb3d3e684e966f85e42b904830fd32fd946962baebfb9157155409e5bafedd4c0d9fb5eb043731d168a406b8149f4d533b2cf1d5bfe3d53f
-
Filesize
5.9MB
MD59254e9dfa01929325cebbcd56ea4279b
SHA1f4e6a97c01af055a879eb990fde6f2a9c7fe92a6
SHA256d474363ffd1c96ff92fa3ed2defc1259f51ab0207e1d648d47ff321de077a3cb
SHA512f43e11d61559c050bb8be79c2eefa42ea3e4250755147db95c18d2fb61da6ed4a4d166d120ed0ea732aac1b1496823343a75434e26b3903150b9d1fb03f6837a
-
Filesize
5.9MB
MD58bf07431a728b03148f45b1cf7b1ff5a
SHA1eaf8e63434ecec1b8f94016ba41ba1ca5699ca59
SHA25651c538cccb25f5012342b72a70260696522a64b252978bfd7609c0ba599ccaf6
SHA5125b16b774f82b445b7c796afb01946de46c2f0647a22168b90040ee681163498028eba937985cb3b77c29df3380f555448dd0199342bfe7cf2d6b714f7d860c52
-
Filesize
5.9MB
MD554603d6fb48f9728a1fdf58b35fcb7f9
SHA182da37451aa095e494392d596d5b85fd41248ff5
SHA2561f2f2f45d9c372fc151e9a7bfcb59888ea9ed1431209531a5fa4a9a4d5deef9f
SHA512364405ac80a818c50d2c26d8625e10a577d4f45a2ee57524273edffe64301b37ee0b81c99148b1ac6e76867ebf8ecc3dcb5cb357a8bcc2f8261e63db3311aac5
-
Filesize
5.9MB
MD553b128f2a328c9b554fd411ce09f9bd0
SHA114c391cd397dd13a4f8cbd0283774a282c819153
SHA2566370661a06d268a272e71b18971c03778ea14420847bda6cfc52a7d25b97cb5a
SHA512c518854149e371b53a7934845511df209329025eb77c478ae418785d828d0737bfa511e08acfff2c5e0723391610b55fd15f0268242166310772d6b03272808e
-
Filesize
5.9MB
MD5001450589831dde069086cc4b77fd2f4
SHA165c0a77f59eaac1d280ead8eb339674842392b1a
SHA2563470d72779795b47a7a7a05b209fab0d6014a3421b2774c481f77f91678653df
SHA5122c27e56d87ee54069c8882259990acafded4b7bb7154fef8c883a9122e43675bbda869fbc8f3532349c9fcba8961b2bb65cf4731a7ea1df0d1974aa5680eacd3
-
Filesize
5.9MB
MD5507fd7ee051347e7b4a1c348ad89bfb8
SHA157d90ef0d306f8612ca84417267abcfdfcb7f307
SHA256d4e48e19b4cd850376f573a54578c0e2168a5f8fb1bb8002b1e473507c3c430d
SHA5125b41377f16a360a3e546bd8a608af2c57a926d0303105649c0ad6007866b810c022883959920cf134ef6181d45ad55aa856cf3583a3c8d4a03edd775f59337ad
-
Filesize
5.9MB
MD5c95d59e5a6b565cb9d3d05572543413a
SHA1d088310e84bdbb1421427304018e7ae768426714
SHA2568bfdfdd09c4e0154528ef1854c003646087314deba1ce20ef58339a4d476a828
SHA51262515abaaaf2584c7a6a8323e6bf3a4b6ca388d645fce9956e82340003eb8adb2fe894e44f961828bf9828d28cc261d8f038c0c0e9bd857275e3a51b4ecff788
-
Filesize
5.9MB
MD525246b3e607c5925de1a11a5be0216ae
SHA100a1159b8b15cd33884193f0e412ce5a5a059518
SHA2561eef02bf2d5d3cb1e11cf6cea6b16b153985b0392a174d2599b97bc51c91933c
SHA5124d7885fd2aa1fa45a9dd47b39b72e716689bbfbc0f470cc05922aaa6f005a7b1ea170b89be72ab1cb7867e0103101be499a8dbd7a32ed19d207486ba22078b3c
-
Filesize
5.9MB
MD50b9b99ab1248fb1f1a5911004de0f48f
SHA1402b81d0c0d95e6dcd2a74a92b3dd742b51c0ca7
SHA256c4139802520c4a473a29abcc161857c4103e0a036c88f751111b2543322a5e10
SHA51229494d127bad0618982a65907dcfc2aea3a9655b84048c8ccf2b9bab56a0a51de9ebe3a98107872e976b5cd514ec5728165fd24a7b9b4b6e329707435f50d314
-
Filesize
5.9MB
MD5710017a071c4cd2ad88e00f701cb7fce
SHA14e1e7bfbd6754604bacf3ef3e5ed5fbdbf5cde01
SHA256f8cc359e1a2b97accd99fb3f6e7f48f938dd16ef00d40989826e4c2f53649c13
SHA51284745a1cb5fd01d138ce4e1af7d8a7703764705ad87110483edde45d916c282bb0bbf014b2560266648a39ec6ff45ac99c6ccb301c9d043cbf8fc2c04d467aea
-
Filesize
5.9MB
MD508e3e629621a481c9fe81616896155ae
SHA1a67e25af466f6ed615fd7eaba5f0cbdb4e8aaf8f
SHA25695f1ab276942752ea41d265a4a5708733bd96d26e63fa48c3e6c1e7159b0994a
SHA51288036c0fc9b0da72f27d81fbaa9d7378f89b40bda37a073e0c56f81dec2b896a98796cc9b2d1cd9ee99fcf75697958c2fa0c51fff8c01c17f65dbd2a0be2a4e9
-
Filesize
5.9MB
MD56857f4e60c687e8ff89a5803daf5f1cb
SHA1a23ab520935a976a1cd693d62a0a146a4aa52c6d
SHA2567a15e24613b5348e62b384244e05fbcab3e7a3ee67d98e7008c2780f3b708775
SHA512046df7b2fedbdd22e0727f6c0e9e8e0ddfdb64fe2e8c5d1725aa2ba70d4c055132ec40c00a4b34e2b5be6694084c898a58981f1033f84d50bb7872d481477eb4
-
Filesize
5.9MB
MD567bfcec92c84ed6abbc8161b3b3387cb
SHA1c603278476225822ed3f730c6b0f96b2184effbf
SHA25601432e95ef564a493f8874430c55d5e619be8367f83a707c2dd9be495f099834
SHA51266770011d72d73554d4939b9ce614845d4742a7ad6a3be287d9a8b42162843354865ab9848905f8a5e229bb449b81c80246e5900eca33de377c719b63931ab98
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB