Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 18:53
General
-
Target
2024-09-26_6446f6424c578df6b3e82fff08c71a58_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6446f6424c578df6b3e82fff08c71a58
-
SHA1
68e4079a706babe1fdacfb3879080cf298d57605
-
SHA256
fab1984b7c6d39395ceaa6e28a471ebaeae967ff0f80981ed091f4deb873db2e
-
SHA512
039b1ecd81d0d37da323739c76df33f032b0fa07b17fb1465ca7388d6f1a0795de7a2f629573bf4c92988a9987462ac52a18ab74a8e3b5fdd5cfdb8596165f2c
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:T+856utgpPF8u/7c
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_6446f6424c578df6b3e82fff08c71a58_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_6446f6424c578df6b3e82fff08c71a58_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\JmOYYEj.exeC:\Windows\System\JmOYYEj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KeSHtfP.exeC:\Windows\System\KeSHtfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmrxpnV.exeC:\Windows\System\mmrxpnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rfakjLH.exeC:\Windows\System\rfakjLH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JVamaVL.exeC:\Windows\System\JVamaVL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isGsPlY.exeC:\Windows\System\isGsPlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfBbjIx.exeC:\Windows\System\zfBbjIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZdTCDL.exeC:\Windows\System\UZdTCDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKGbQov.exeC:\Windows\System\wKGbQov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wLtdpwy.exeC:\Windows\System\wLtdpwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zjAUAjS.exeC:\Windows\System\zjAUAjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KycczRP.exeC:\Windows\System\KycczRP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmpvNUS.exeC:\Windows\System\OmpvNUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYTNaFq.exeC:\Windows\System\EYTNaFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mHducSk.exeC:\Windows\System\mHducSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DZWAsGK.exeC:\Windows\System\DZWAsGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lAnGlbX.exeC:\Windows\System\lAnGlbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ketZqyQ.exeC:\Windows\System\ketZqyQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFTtXta.exeC:\Windows\System\wFTtXta.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkqDird.exeC:\Windows\System\nkqDird.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuUHGOn.exeC:\Windows\System\AuUHGOn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58d9e3a84287f6559d31cec34840504a6
SHA1d4e5be18da1d21e0535ebfd1cdd58e030d2169c3
SHA2560fd68f08c4ffa93efa6f23dee38a923e13c76ae3363ce7f4958034f6b6e0ca92
SHA512c2079314c970557c86f91e493add4a8ef6e71d6c6f2e9463bc7945e12dca49baf87a1a6b9d8a473435fd0858dca0fce9b39b8fb0a79e2a92cf75854d2fd5a41a
-
Filesize
5.9MB
MD5301f0ef87d8a91943c9a693635e82c15
SHA14b029850d518686778ce4e124c5e97796bd8c762
SHA256d5712940d1e2c8aa68b3dd8218b4589d5399c4eb50868c8cec3df576a6097101
SHA512a3ff2309f1a3145954e3a40da9ce6ea60bed7637675071067d6ac4a4ab596740089a55a53e245f11b63a03d76bbf9f6436ede74c4b806485a9bee7d55f01c0b5
-
Filesize
5.9MB
MD5bd31fa013401f8201c9b1a3769497a03
SHA11828d60bd428c92cb9b35f5a1f79b2c6979877a1
SHA256408cea67d05dba8ea88a9281e65108fbd6a19400ebd78a51ee1345c0ba4338f5
SHA51242db78a403e6f767df625e06795f52b9d9baa2ad8e228d95d5f1a5a07db451b6aff9e130731cf81cec57e2026fa190737abef10a16882d1f22a072a93e62fe31
-
Filesize
5.9MB
MD515e4c279599a6264a6073e939069e177
SHA14dbc37ae7304319131ae50dd0e2378a4e3eaa1cd
SHA25664d73f96572d8211111a7f02e68f802bb29ea2c5d9391a6a27e8df7f4992411f
SHA51229ab5b3831a8bc7cbedc12ab9f103151d7205d9d56f2e9050506a7caa054dfcabc0828227ced8084095488631658a0d5da5ebc3037c2b3f7463a4b9db182748c
-
Filesize
5.9MB
MD5a6ccf18f82f50013168992f3108fc7fc
SHA1480122b8617dfccf0dceec97f4e5ec695b97df92
SHA256aa7293339b9c68a6bfa029dcb829bddd03bee62d3860927458d3871eb568413a
SHA51285e4f0ca945010166b26edaa6642219ba0dcd8c0e835406d85b55da9f393ce43181a27c211d5b0e7881bf8fb6741e0efbbe5ef7e1c845552fab5cf7af2222663
-
Filesize
5.9MB
MD5e717ef43185503a35b745d6ba2a7206c
SHA14e4ba079e8e675ae5a3220762e42e57a6b5a2146
SHA256c878188c7dfb535551bd7a258c9aaecf3cb1786760fba300aa6a7d802c598a98
SHA512bab7e340a4d89d2e39bc6c60bd0de85d51b75fc30e9d52b2719accdfa6f213fbb74e04d5f09a3d350598dadf92b387ce7bff609dc164d893d7e0c0f8cc3e8f80
-
Filesize
5.9MB
MD566e217d0b1a5a3832366fddba97f34ec
SHA1958ca83d42dd5de6218047364eab0984cfd81831
SHA25628fadedbafa6030a4bdbf8b30c1d12ffec8bfc12b6d39c968be5bbc8828dbb73
SHA512d8922c59b751a3caa4f5ef9ea79fb105bff26f5cfbdb94a20acfc09f92059f6a5b618e7499d90e612039131703c7c8f729b7b9b62dfd5d60ca7b43f67a028663
-
Filesize
5.9MB
MD5b9e86cd531a936cbbb2dde3c0cab3b50
SHA1d2cc211b6840c0012e939999c0cc1575a38e8a10
SHA25609781be344e86cbf13f1ab8bf63fa5b60463b25486d1d31efde030e62fdb598c
SHA512af7b28e18315c0a7d1df22a94ea9354131c9df4e31ab38b004a643977d95c64fa0d11119982ce29323c07236d106fa799354b1478a910177380c0007d9763656
-
Filesize
5.9MB
MD5db669bb32018a6ecf054633eaf34d232
SHA19fc93a02c8a620a0c0500b4ade84a8caa977f169
SHA2566a5b41cc6f879520e9739548cdd064bf60bdb051c305213891b82ce75bf00a58
SHA51226e1fe95def2ce73ccee2fe2139b112a5fcd9092a3ec460271e9d33b137aab7bc25adf9d87fa77d33cfb123af325496ecf8b7cfda1c320ae62d2f28a5e33686c
-
Filesize
5.9MB
MD5e2ad81fc643c320bfe4e76abcf3cbc7c
SHA160c61b3ea3eae415526d75f9bcb895299721e736
SHA256b6242484bcd55b6fff0c862f5456886ffacb86a29e4e5a0ed117fa6b491f8a8f
SHA51219aaa2ae499f6fe3e658a0bd03d6b3e70d1352d089d675dabd7425b770fd87ff959b16a325e166154eeb2f631f559a89a0b89c6d1f4ef2c97abe0db3aa772e6e
-
Filesize
5.9MB
MD57b632d2a0caa0da49f12bf59b2c92599
SHA10338eebbbed6f8deb77908369237304bdb6993b0
SHA256a33d9e1f23163d9b732c94900d8b63ee5a46deffc5861a8edc745088c6a38e4a
SHA5125b6985e46c6edf17ec374928f7a81fbf33ed2f7a210abbff5ca27547f77cb96c2e628882c5631b4530af91da4a471bb88e7fe28cb3a173e1d01300eca18ba449
-
Filesize
5.9MB
MD5d9207de14c767dea4072d0975d75b101
SHA15104e0449f4d3d2e3db6fa5b134875bf535c5afe
SHA2565376e4d5ca3a21cc0bf7edb213ae7b9bb3bb51a1086011644c12ec09c5e40d7f
SHA512dde93c089f286194336afb1b1bcba4c7d2c6a8684e4dc4cec2ed3436e6f794397a93b7ca4be50de3ad8aa5d9bde63e1bba7afb8d0321ddbe75ba09086dabf4d9
-
Filesize
5.9MB
MD54a1c69e475aa4f68a355dc4a2c52aa68
SHA1b94a765e881486cc2fc5cac05813d52aa8b592c7
SHA256f4bf4c0ac20eebf7fda02c2a5752af2dc37b32e06c2267a954a9085b405a57bb
SHA51291beb72608986d470972ada056f044a5b2affd4286f9ee4464cea92670028c2198234ed7cf36b7db663515ae59d814eff4c330b734839e05774962076edd3c67
-
Filesize
5.9MB
MD58e7a20316888c8d21390556d61b554cd
SHA1d12cae7895e3e50bf9f9398c655070d8fbd06254
SHA256a33ace62c8e4daf00b334a2b257508dfcda00f190d9e30e5feea66c7779c486b
SHA512b239a18660da4e21c7d97e8292f461ef5c4a8aaec240b477fe525e7a9ede1b630c09e2563de34c2d786999ccbee2885f5188f4b23d571fdd8899f0e5ba3043d4
-
Filesize
5.9MB
MD582707eb2623c185859337e0157b920e6
SHA168c90c6969568bb7ebf3b1cf902537dc7f7d3f8b
SHA256c16483ec5a2047e727f29ad5df8776dd7b5d215848f869cd25f3547e50d7d597
SHA5122730d29a5b69eeb744a6e0f52f777501656a9627613100bb4ca10469b2382a63a66f7894d3d09cfd0b395a8db4637952cdc55aedf630b6342bd11e7f70876a13
-
Filesize
5.9MB
MD5ab0026f57f31e59547e2b63d8e658cac
SHA1b808a1bd328b1d22b63a64c706f83bf4a9bbb81f
SHA2566b72d85d851e1a06b2e7f2bb0ef9e1d55b483a340a9059a246a64b5a82ddcbbf
SHA512587a989f627240116c4a194c5647441ab9c24538cb4501f3114fba313faa2db8275e160d0b381fefbc618e19dc0373d7918052bfc88707e56561b43ccca90a4d
-
Filesize
5.9MB
MD5a80bdd1cc9fcf226f427d8edb9cac7d8
SHA15904ec496c13566349fc1553fdde3d0617b227e4
SHA2566c503e67cb541138a86147035fb2866ac022e7c963595e4867c04d3d2976b6fa
SHA5125adde6e526c5d5e731379b14a68f08cc03e545ff03b608e6ad4744e22a43ffd7a5fb0bea1e4eff76bd172fb200a3e1aa6a2905fc6f445e77c5bb6f69e584dc50
-
Filesize
5.9MB
MD564630adc339460c28a0cb120a48a4129
SHA15b6bb62f83923d224c843106343be97481902caf
SHA2569ede67c3dc43fb8d5b6f3901ea8d68667dadf74714cc877537b8e757c01e649f
SHA512a5e79efa6105541dc008a5e4c515ba8687702cc3569dba08b71ee7ed7ac64cf871f8e5b72f327ff0be3840c52939a6dd09ebe044dc372a79e46d3ca2e0927ef2
-
Filesize
5.9MB
MD50594489b1904f6d6d6707c5fdfaa7d9b
SHA156cc4c9b9c14632ec9842d0bed9c7e4f508f5df1
SHA256a66ef80fe276e7afa41a955700529ed217b3b4af35225f87c4bf4a1db1ff9fd8
SHA512294c99bb9ba328414be0e01f97d6a4aec6c97ccb650016b7278c8c3223a57cbaee05938a455b0cc18c16f774f6301765213f11c1fad630c8d00038741edbd3ca
-
Filesize
5.9MB
MD553b129f2e4e2ea2be02678d862d65578
SHA1c0871da5c53e423ef02b9857e4d9878804f3a57f
SHA256981ba84592f07af687a116df89c99b89355b1b4f6b61542c343f24bad227d7ac
SHA51274891a742f9a9b9a36784ef87f97a2560399bd9f240dbb1fef79fe09eba754cec2bda8f779df7d2e3770525665597133d2bfab0eafdeffbaac43d91db231d6e4
-
Filesize
5.9MB
MD5ba80726e519d2889bffefc243f33177d
SHA17c8a16edb8b6eb18cf5236126edcede701568af3
SHA256b3acd82cda195eed70882dc4ae38d0b0fddf7060d847c747b5c0dc4e1dbbb0a5
SHA51245e94fea415f30a4ca7de17ce281f16669131832a2eaa3972db77ea2b5968ae723654b86ca6e87e1e80a3a8840e0cb342afa116b291e20fffebe3cb434d337cf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB