Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 19:02
General
-
Target
2024-09-26_a64907eb635b107471099750a8eab997_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
a64907eb635b107471099750a8eab997
-
SHA1
0e12962233c889ccd338c2b8ce764ab7f391c4e5
-
SHA256
1e8ca3ab3df14340e4b4615ef6692e26e02bbebc8a0d0112e9a1025854eb67cb
-
SHA512
10da28821f7762755d8f90c6daf6d898e0181a54a3470233e35121c84b6c10e98fac1022a20156aa438b13021e06ef0a1a1aa6d46eb562bed7e3e41cd7990309
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_a64907eb635b107471099750a8eab997_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_a64907eb635b107471099750a8eab997_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SZmgWhL.exeC:\Windows\System\SZmgWhL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HmPthBt.exeC:\Windows\System\HmPthBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUrDARX.exeC:\Windows\System\TUrDARX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shfetWU.exeC:\Windows\System\shfetWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\avbnZDn.exeC:\Windows\System\avbnZDn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwLgexz.exeC:\Windows\System\XwLgexz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HPtfCor.exeC:\Windows\System\HPtfCor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxivChW.exeC:\Windows\System\cxivChW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCmlQOX.exeC:\Windows\System\KCmlQOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dPCubIe.exeC:\Windows\System\dPCubIe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJRdecF.exeC:\Windows\System\uJRdecF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fdVZGay.exeC:\Windows\System\fdVZGay.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDjzBJk.exeC:\Windows\System\XDjzBJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOatEBH.exeC:\Windows\System\rOatEBH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RomHHdX.exeC:\Windows\System\RomHHdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgZGzbk.exeC:\Windows\System\pgZGzbk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CJCOamx.exeC:\Windows\System\CJCOamx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oGsIVPe.exeC:\Windows\System\oGsIVPe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypcoypi.exeC:\Windows\System\ypcoypi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKIehpg.exeC:\Windows\System\YKIehpg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QCisKom.exeC:\Windows\System\QCisKom.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56ef8218bbeec968e8681cbb9f9554029
SHA1335b7b325ba6445800372cc686c4a5f130d7e546
SHA2562f999a3e34ac665f963ad5485d083254c4b6aa1630c871373668a0c2e8d3a85a
SHA512d25e40aaaffb6da7c3f09903be7280f319b059547608ba617961d2878bb1d6f7e0aa3109ef6e7f09d21b05cb13bb2477778cb39eb0fdc93576dd3e24b0ce5b1f
-
Filesize
5.9MB
MD52b4a43d89f5288ad77904725f229fcb5
SHA12d96d7652536e3212ac34eb36e14258ebfec4f5b
SHA256dc98b3e59c6e27243b7d0c13021ba1fd0a4cb99ccb340bb325118d3594d4a89f
SHA512fc6c6bf4dd5968a328aa04ad9f0bb74271237083d0ca3a8123753a27a3f88c5826bae740ba6df5b781dcb057564327ee58778baaf2146f6d53a9fdd0f856d2e0
-
Filesize
5.9MB
MD5aab98007c890416a6bb06aa2e425ea75
SHA100e4b7beaae5908dc0e5bdd2ff11b92056563a59
SHA256042d51f917becbcfd189ae2ac92d4b754c25bd2422fa18b16801c66252b0584b
SHA5124427c4d214e6b8dd489047a32265b539e643763ce00590fc48963600bac36255a1a4fbb8ad54e3fdc0dac79bf36c056c3b7d9890ec345f174a502fc09013fb23
-
Filesize
5.9MB
MD5d2a09fd98e34441f7dfa63c875d1ca42
SHA113224fceddb71367ced5eeb0ed96bdab21493f4d
SHA256b01d562a5745d1135a3d4caa52d91e6208a49e90aa5179e86312d7177d8ed908
SHA512e2e6d4caefc4e8dd396e46c698c90bc213a6b1dd81df64d46e50434509e96565eaa4f33f949c7fb30aa55d779b73a7e075e95df6efdd034f5ca693e426132e1a
-
Filesize
5.9MB
MD56f8cf6fc08885b53d2448818c7bc3e98
SHA1e6ea57da9a8ebc7c3a1502fedc8d618334e5c1f7
SHA256d461163749a7977a0f51693dc97293178732ae47141b03895cd85a2c64c5d0d5
SHA512cc71ee8c5f715eaf5a59d568d5fce2c04b26dbe514f0a6d1ea6b6c6ca52dbab6886a9a178a22e9dff7da40100367e1183799b94690d455de75a494f5abc56d4d
-
Filesize
5.9MB
MD56a01c5abf92e2de9ab05bbb3419546db
SHA188e79f657f5767e33a79a63f7300270d3b4f5664
SHA25656cb6572649a64000a2a20b5cc000f11f0479a52491409e03c86af3fa9c838fb
SHA512abdedf9e90b8e0b7033c4c0dafeace8bbd2db4207d8702ca67a58d25467aaa3c07c516ae4a12531a2ec3fc788862ba7f4d7119d32d2600d1d3f791340a416f1f
-
Filesize
5.9MB
MD5ad18511f40f3371489010936d51ec5e7
SHA16608a703b87b78b3773e2a3e6766c91028d133b3
SHA256c5b641b32d42a084cda4d1521372069d4894d90a9016444c13aaa2fe9b86b4ba
SHA512ae323cb633bc8597b5c36760e76e9b872998955d0946641aaa345d49e34bb5c52c54059644ac3e2bf463edd3dceb28c9176e8b084f7b8b41e6016f0cbee3602e
-
Filesize
5.9MB
MD563168f5fd74b0f4d4dc06a58b7042198
SHA14353b31242e69a88e88e658ae4b30f474babfe05
SHA256b6d73b80c1d569f6cd77956f316fe1e5f11865b47b054a278e1a8622b590e58c
SHA5120097c8c523437a09f6a5bdb234b87418fd2c2170a37f03a35f7e64038c772bc38ecdbe030cd23c9daa88f30319041762d1a8f348ec4a46c42cdd989a2b2f1f17
-
Filesize
5.9MB
MD52798d08f0aed01fc600cf99b334cfe73
SHA189be3ef331fb32333a130e6e81ba687ee44cfc71
SHA256e4b5f43608a7ba7ad8f1934943862a85f6954d37c5cbe4496c7fc9911039152a
SHA5124b8e1307185e45d2aacbe743f56b7a239cdc9147a727130f41d40686e78d315d6a6a4292d9a65b1fbd476c2d0e6b806cbe6801bd19e92c0acc59d603b5bd3f00
-
Filesize
5.9MB
MD5d7677a8e3efda1d73210b6f87ad8ba10
SHA1874d4239d979401735f9798f50bade68c13efe8e
SHA25627988f72134cb8b018570b4d38d5d47b888ccd881b0b7e8790baf1e9cddca493
SHA5129840d25d718c888c8156af6c5b73e3ad88149517cc4af8e5ca052dc4f83414e79a07840d31323e2f258b323530eaed26e165770ef6273e744e2b69414d39d16e
-
Filesize
5.9MB
MD54769f42d6dc27b5208b8a3813064a2cb
SHA1dd7136b1b4705d9778a253c6ac2001b939fc1d34
SHA25637a18fd05c432d6b27a6cb2beb7bacde1a028ce9b04b3202c17512a0e169983e
SHA512a6e2b5b3dfd66b99d0e365d31d26d3ff93e225efd639aac1b3de61ddb6b7f0b2b530900a9c9ac4c7f25379c32014c67fec4427d0119821117d047f2d9a2a0a67
-
Filesize
5.9MB
MD5093f74512c148be2ed24c40dd895e7e9
SHA116eb0cb9f18186d695fc968971b027b34f2f6f7b
SHA25606dd0344e9e6e7bc29c5cb0a8957cedbf35c7d9c1e3451e2635ae0700dadb826
SHA51284311eaca29328d9f015605f94c349259925560bfdf2e1c9f384ab3bda4091f404d817fe75eaba7f5fdc0e086c347357bbc1c62c162ad1f1346307162f8eb816
-
Filesize
5.9MB
MD58c59c82a9a2a29afcf6b5e501111492a
SHA1213ad222e8b452dd2c30ae88b7f998f911790f20
SHA256167bd1bb3b27aedc6c1dbff316d8bbb124880548a7ccc8e4d6522e57ac2cc85b
SHA512b44186054b9733c58600b0f4765aa1502a3cdfee4399f2f5e911333ba175d19aa5fda45a5497e54c95abb842a0cd1d8c4039dc7702e769b56ff85bfb62a064ec
-
Filesize
5.9MB
MD5df3880238d5fad86a958029463a4f752
SHA111d0613e53e7e54bb31da18e5d1c3af284d9cf07
SHA256b92b3aada08f11c6b67ffb4204211070e802c454a16c893fa41dd44c3140e5a6
SHA5120ec2926734c3fdead80b5e3663443c62954fd79fd74a4681bb7d71a5f2adf246b37b4b63e4e9d11c1cc35123f92eeb6e8e095071cdd1ababcef144eb7c0e5e40
-
Filesize
5.9MB
MD59804d1e5e8bd3c7bb9dc299f1be50284
SHA1e970c48b35a4f65e60c5c30254d64a1a8e234316
SHA256c910a73ccd44418e29a1454f4f89e555fbe9164c427bdb98991ab0fb63d21000
SHA5127cda4f09a577a12ea089404f2217de16bac9253ed8c73d1f3e944c5579f3678caa6b1b854af6ccfebd8ceb833d9df70df347a3219d176e38b07be8d10e3064dd
-
Filesize
5.9MB
MD5f9afea13abf3b6b506664a9972b59d67
SHA15df510e6626cd7e3b92952f34bd58a058430d7ba
SHA2566ea2dfb4ee46eddd17275763280d8c99b2de5129ce45d2bc63bff9832b1d7a93
SHA5123bd4f24ff090a1740fbfc180d09888857607a531ef02bf57cd2245886f6149f27ae0d6d7e1d8fb0a3b3db4437117fe917fd6320c515d3f90eb713e892294e6cd
-
Filesize
5.9MB
MD59a8ba0b48682d31c065a1f25ce1c44e3
SHA141fe1307c530b56984775301d4aabfd3415f771f
SHA2561ea1e5e6f132d5043f9ff12c4fc63092e994c09b68e67adc28c396ab2c93af15
SHA512424d9fedb8a955f27478f8c258f1ed3bb676de9f8499c1b1b3a06a45bafd88036ada74bc8b5252183116bbf8beb3a21c7b1fd05b774d63967bd4d504e1fc4add
-
Filesize
5.9MB
MD5a5b22129c6430a02cc5a3ab6cd5ac95d
SHA1c0ebf066baae7a647517f22d33024066d6b6e2e0
SHA2567292db0cf6718ade2fc927859db08f9e0019af7fb2325a60bacf63687bab2e0f
SHA5123e0c132070ab46f2887d70741006cbd706c25aff2b7c6c324f176c81fc16aec73806ff32d6d5b74059a4ae412a84e9901848e04f50bdc5f7f5a22f2297f29ee1
-
Filesize
5.9MB
MD585aaaf6a9c1314c5021ca113e1ce0613
SHA1c5632d33b58e7ceec63d38179f527c328c4e0316
SHA256d5b0059ea80077d0664cb2e3a7ca8979bc5cc39f11fb0047979cfe588520e903
SHA5126b874133903f0ddb4360a396c3b65c4f2ac008db2baa5111720fd2bfc17268c1c7aa4d97038982bf57015a872e44489665ef12f95949d3a77071fb6bd3cff2ee
-
Filesize
5.9MB
MD55b81129cfd9ab53c35d56162da1e5ded
SHA1aed800e0dd3a0710e86069490f7c156c384ce653
SHA256063811fe9f626e11da6663195a853754bf5a17942dc2e1bc03679bc905379879
SHA51288f6f8c267250ff36313967f391124ddab6ca5056ad4e32df65733bb913987b379445de55e077c2bf751aad77d7f782aa2155132e33e4d3175c4a43fe4c4e09d
-
Filesize
5.9MB
MD56b2e302269d5789d1a0c094b62932f7e
SHA1d1a0aae09ef823e86d7677430e94ec9dc4cc3ac9
SHA256091654ed03cc22c9c5b48a436ba13b7985222b50848685555fd34d10d984badc
SHA51211b32653384dd5e3ff86ed352373159926ecfcf00b248596854cd496798d88cc91e42998de36f318fbccdf6d2216fb645c3bbd8bf06d7dd0fb429b427269e199
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB