Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 19:03
General
-
Target
2024-09-26_aca83aa39a4d2f4baae704878516e338_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
aca83aa39a4d2f4baae704878516e338
-
SHA1
e38f24a053a66a7f77e38221509670a273c45fe6
-
SHA256
09385865d8e465d170f2beccc22181c01d2a4a0da54fcfb43fff13639bca1581
-
SHA512
d19c98441830db5ff081df4e024bcbf6c79cde06294a6e24f37ec2e827061a8587c93db8e92743163017421f8db76b3ef6ed9b6a240599ef21e03eff5d87a041
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:T+856utgpPF8u/7v
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_aca83aa39a4d2f4baae704878516e338_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_aca83aa39a4d2f4baae704878516e338_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vKVrDxi.exeC:\Windows\System\vKVrDxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JULrapb.exeC:\Windows\System\JULrapb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNDihcl.exeC:\Windows\System\nNDihcl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vUHmnKz.exeC:\Windows\System\vUHmnKz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GywXtll.exeC:\Windows\System\GywXtll.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWQBRkD.exeC:\Windows\System\aWQBRkD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbtXJKp.exeC:\Windows\System\YbtXJKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\svNNVnp.exeC:\Windows\System\svNNVnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ekHLqvg.exeC:\Windows\System\ekHLqvg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\szOKogL.exeC:\Windows\System\szOKogL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkvZKry.exeC:\Windows\System\kkvZKry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YxuxZjv.exeC:\Windows\System\YxuxZjv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WCFtlYn.exeC:\Windows\System\WCFtlYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KphEaad.exeC:\Windows\System\KphEaad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvTkVLy.exeC:\Windows\System\wvTkVLy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jETXIzl.exeC:\Windows\System\jETXIzl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOubffj.exeC:\Windows\System\lOubffj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quWsnKv.exeC:\Windows\System\quWsnKv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaWYFXB.exeC:\Windows\System\oaWYFXB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YBzqSXM.exeC:\Windows\System\YBzqSXM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kODiOKA.exeC:\Windows\System\kODiOKA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD563117d907f3b38ce1f87b31851e62ce8
SHA14a008000263caf7d3c40943966a9c75073c7ef7f
SHA256728f54ebde37b16d2fbb45a09a581373635ce484de67c70e01eec882b5f7ff0e
SHA512a77f4a8270e4b179ca1cda1bed4bdcf0e324ebd84bd242f05ea0415f34863aa34b1cf2195db75bab80ead4586167f0d9517c7376655818f5a0f0e7d2d0d8bf54
-
Filesize
5.9MB
MD5d59bc9b7ff63fb54d786ec103c735af5
SHA11598c05771e127e96f0c4482a3fac4b52be85a9b
SHA2567aaa37ca090ca218ada16c971b04bc2548a82de95fb4a7143b03c7c2bf17bab3
SHA512a2f0d6e623699d00d1d68226111a4de4968fd851f2d2cfb2cc4a24d6d3c775880ca09a36762bab2c8c96fdd817969a6e4cd119b571a204ec996177a64c90e791
-
Filesize
5.9MB
MD596a467f512f58a3d34b7ed8defa888b1
SHA1ae568b962b49078c080e3a2fe04540968f27cd09
SHA25679776506cbc7f9f96ae09e25b9262a135227206d7864722803766e5192fbde2f
SHA512c60f1292877d8ec794ba677234e20871957447ccb7b12efd7e9afcb4fc606c677059ac6c5738db3aa2d7af799965883697bd18fc8fa7c1eda32329f6c06bebec
-
Filesize
5.9MB
MD5b14bee2877a2647d5e9299f6357cca6e
SHA15a00d57899249c28990b3cb4ceb81b1543c0456c
SHA2564c8968c6a6366e484fe6fd567b05be53fb0b1541ee98bf7393846514f17942d7
SHA5129cb76a72ab78979dde073b207e11464175916645b0750a6cb9fc34c3892917056c1214864553283d15cd529ef6dd92b0e38ce17f903dfb72c030b948b820501a
-
Filesize
5.9MB
MD5a656ee9c7861ce6a2f1adc9c9c19e12c
SHA16ba0ff9d15ce6eb1874b43c8744f02290b599be9
SHA25601c704f5f4634da7b7d7e641d16ee128455451bf9ff4e2c613a1dfd12f94a644
SHA512613be1c67b85133ef667c8a06ca166661a3ec9164250d2aed01540b50d5973e975ef7c6a93c285b2817455d258117e80ee73304f8b537ffe59f54848dad59ab9
-
Filesize
5.9MB
MD5b0630512a131ece7ddd5d9076af39c87
SHA1e2eb9bdc46dc016e25feb7a95432ee982f8ae846
SHA25669fdda99b425a68b88b6e1ce5084115f392a7b0de7f1950cd5cea44ca3bdcff9
SHA512e9bc47d89a32805e4b91080abbf8515ebd46aa505c684476f22f9d1e4cf445cb0ab4a2ffddd2baf55bbb1ae2f1144e77224ae35cef145b5e51c42483fc4227c8
-
Filesize
5.9MB
MD561d9a4bf1163e932ca5f1b1742138eb4
SHA1e8ec00fbcf85830d1170e26296d3dae14a0eef89
SHA256f787a168fc10808b7c0d850fd6533523c08d036228388e50a5d5a54cd14a2226
SHA512a16b35c52c783d824beb472a0a18b73792bacb33f1a1b7b794995c5e630107c67b127e456ae5ea8810557ba3c7ce2c48cddcc7087b8361eeb7e526c3e27656de
-
Filesize
5.9MB
MD5e297be6eefb2cb5823dd02cc0615afcf
SHA1ebe891f1f1ca871addf1216e6c8df6dd69d6d553
SHA256bc1670cba32b221d6bcac283d3116e696bc33327214a220716a823da521fec54
SHA51262b7b93c7a8c7ca6970df06cca5453068ebd0dbdb2e22d0c4efa076b8ff1e9acb30efd8a561a4033ce6488ca67f12509221c69539d21390e97640ef30d120174
-
Filesize
5.9MB
MD5c5d7fae9d618b6fb28761ab191468ed1
SHA19c5a17420862da0626356133941e675c9011135b
SHA25605416cd015c8c4acf60959d36a969ba977f784a319e3509318333eeb3497135c
SHA512db48b765b7656e2e7e7e5398310625c373c9112f40dcf30175cd10514b372851ccc1cc8ce8f3a3c66b864bdd007d1be7d7780cd9bc3b6cdda644e8e89e4ca337
-
Filesize
5.9MB
MD58d6773094b97f9b1c34b523b7c5841c9
SHA1cc5cbc76424ed577022140d11449836ba9a13d5b
SHA256caed34ee8a115dd7ef742bb53dcda818299e9e1d2225217b6476c9c494ddfb95
SHA512dfc6d72f6fae24ead6d5c9611743aa44b17f775f8e65b23a7f3a3fc5762a2b343e547aa1ccb742f47fc00fec3ff0f93d802abd3f02c928571b936f96e410bcac
-
Filesize
5.9MB
MD515bd63ccf41656aa9a7ec8acceb6c644
SHA1b09c19e0560e1395613b5d2caa3d91db2abaa7a9
SHA256df4676691547364851a7284e2ec78ca6ccc741dfb2a665a0cb865da8917c5d71
SHA5126429aff8e784da3ec98e8252d21c4ab4a124f262ecfdb7a3a6842315e0a9dbd775d104e7f75ba58ae692fa2b9c9c4042d92bc02343ea0a66076a40fca6a66f21
-
Filesize
5.9MB
MD526fbd5a6d3b32910d3d86dcd904c474a
SHA1d026d75c27b3966b2a37356486f4da742065269b
SHA256785a5640ad067b04772f57614b829d51cbd544ce05c86375470c4190be69c66a
SHA512782abdab91963d17270a2102cad48cb2b3f41f8707f628f02f1a1995fae9b25993deeb99f013451a9e53329590e52b72311c4757d2867308f51372907a882646
-
Filesize
5.9MB
MD5062d8f5393dad1f4ffcf154e48241c4f
SHA13111ccdee1a140244fcf9bd780ffd7974665cdbe
SHA256f28fc7f78a3a91ccade60e92e9aa43b92bfab63b4b1635d66edf144d5d262e9d
SHA512240c4fd7b1e51aa6fe797f125ab59dfe89f30d350871417f27393e2ecf20b41edb2691776109071906f2d14fd028cd2836e8203e68b4ece2e4b6dabde167c345
-
Filesize
5.9MB
MD56b3ea9778798d66163bcbd5628030fad
SHA1ccaa1531fe80b395879739c1e0e142d97b5cbec6
SHA256d4e47691c1eec4c4f71add706aa8b0578534c2ac5484e97cf5e57b72f6fb596d
SHA5128a9db2e5e92f01bc1cc0e9227ffe9dd67fd78067bd5f51120004bdb8bac5b75b3877310fcca46db45b0cc942932b47dd2f0a7b3ffd69605828c3da142a7f0734
-
Filesize
5.9MB
MD5b5dc3fd9d06afbdc9c2c2f99773eeca7
SHA1fee273bde18b03fbeacfce05f765f9c6fceb4e60
SHA2568707c197883c411ec5a24ca3a3eb2b0c278e262dacbc913a7da13ef39c8b716d
SHA512553b2219a4a2c170bd0063f1eaddd21790876f85bc1656033bc7473f7fb72f1a2c3934d29404aedaf4d1932126e8341bbe125ba53969f6a2d8a0a74cd3b3776f
-
Filesize
5.9MB
MD54a1b689678144c8a677b0792530451ef
SHA150d25afc132680d43b9ad043d2e3845099270fe4
SHA25671b9d4ddc78d5cb2d36ac939fcd23a1b4f2d7fd279892ab24062ed5516113a8c
SHA51202aafe330dc790558166c83385da5372e25cb4c0e8e1b096babf571d8d0e15a1be36f6839b4d9c05aaac3dd876c9729772239630a10f21bcbd02e62fe8551850
-
Filesize
5.9MB
MD579b49c39fab51467af409dddd97479c7
SHA1d9fde01fd15b1fe315eaad4b68274e52bea974e5
SHA256968c05fae2d223be83f9e2037efbd85eb184e274a9ca1c7dae3fa8efb9d055e2
SHA512ad1bad234f55f47ee5c3f35ac309e22e90707f1161b42f59a7ffadb7d2a197fce7c4eac441c12b08c8fdf93d75d91f03e00784348e79a12212fb84fc98d5f964
-
Filesize
5.9MB
MD517c2ce1a9c617e0398d6cb3e15a84be8
SHA1ccc8efc297db89e19d1898b3884f2b5eda3fffc4
SHA256cd8a6cf0a43b5b25a28734bebafe3865b527682be0bb9734a4d83ec5f16a4364
SHA512e90f6b6e7cc1ba2a1d8c32f3a5cb1c3005fd94034977a1c6855166efaae58ecfdcfeb97184842e4078312ac7207f2edfc218657cda59bdc72b224ebb51fc213c
-
Filesize
5.9MB
MD577f8531fa9c0fffb8f140c66ef81604c
SHA1a5d19a95ffccd04ce0d1d710cb53a175a8f6b8a1
SHA2560c3b44f115107511412d71062ad826646e733fbea5a01391ccedaade1c7c29e3
SHA512a67648eb9b7c929e57f8273637acefe9a72a8f6af3b96ec2a854e8731d15825708b62fff78f971aa67b4fa1af495ec587ed24a5474c47844ba18a0b011254d07
-
Filesize
5.9MB
MD5841df1a593bd6a016edb1f47553bdc1e
SHA1cc2b8037d710dcfb36868f8694263ec393ba2c8c
SHA256da176b2e620e8bc0c0e0b35e58eacb0369761ec6af43fda36083ff9980edea05
SHA5128555d3b9a32cb4fc6c13d3445d3acbbc7331f7e8f433b6848e36397199f2166b4edd61d19c49fcdc2abbdd9efb51cb6af1ad67d2d33f1d3b938bbfafbcd2ae1b
-
Filesize
5.9MB
MD58c3104cd4636fcda79d759182e554a35
SHA1d425d272ab73043f339fe9079ca6cde1ba7e3afc
SHA256572e2cead21fb2473dd50803bf6109343cae4b56167f3cdebe518105e610833e
SHA5120451322344e64452dddeeb382b6776bca112daecb5a05f2b81973d171fa8e0e60bc2b304ad89e163beb0bd4839d8f92e677747f153ec9edb4f5d643dc5c7c618
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB