Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-09-2024 14:25
General
-
Target
2024-09-27_1d37995345d6352e40648f2183ec65d3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1d37995345d6352e40648f2183ec65d3
-
SHA1
5a5c9f9ef7598fd758579428532764a9b8292817
-
SHA256
4089b69f302e22cb64ba557efdf928070933425263a12dc2bec2e0c7d3d05eed
-
SHA512
e055ea14888a83c92e6bf59078cf86a6405d086e758fe491a3d12132bb4412f7d1e87f04d6dfa2c1716728e26a14414ccbe70be49ba3b5b0af5d06f2fb0960f3
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_1d37995345d6352e40648f2183ec65d3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_1d37995345d6352e40648f2183ec65d3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tOMXjCK.exeC:\Windows\System\tOMXjCK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yUvgpIB.exeC:\Windows\System\yUvgpIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmkgAWN.exeC:\Windows\System\qmkgAWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHsdRiP.exeC:\Windows\System\sHsdRiP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgPaFVq.exeC:\Windows\System\cgPaFVq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VbLyURX.exeC:\Windows\System\VbLyURX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edvngdB.exeC:\Windows\System\edvngdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xonyBFo.exeC:\Windows\System\xonyBFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UdlQQsJ.exeC:\Windows\System\UdlQQsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSlOxHL.exeC:\Windows\System\fSlOxHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKnfsdP.exeC:\Windows\System\pKnfsdP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqEDTYw.exeC:\Windows\System\NqEDTYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtWwXxA.exeC:\Windows\System\KtWwXxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FqvJNIh.exeC:\Windows\System\FqvJNIh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAgZKeQ.exeC:\Windows\System\jAgZKeQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyfJaPh.exeC:\Windows\System\GyfJaPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTcuafK.exeC:\Windows\System\fTcuafK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QCDVNqm.exeC:\Windows\System\QCDVNqm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aNIIuSx.exeC:\Windows\System\aNIIuSx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SkBvkbT.exeC:\Windows\System\SkBvkbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXJgIZP.exeC:\Windows\System\iXJgIZP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5efa7eb42c95c7b4a095aefb71398511d
SHA182bf2dc24e5c934d4fbf439520e50ee64a14fa83
SHA2567f51f80e522bbc10e187d9c76df28885794d054447a8f8fde8c9eeb41253a058
SHA5129d5e70d8f40220b373602b0ce3db4ca7b70d099f06268ef4a2e621c179e6cd1bc89bfbff08ab1e18035f79e952c8a5774c0f93111a6e1a7b485fb1a3861081b9
-
Filesize
5.2MB
MD57a303eeab0aa856f12cd6bcfaa0a568c
SHA1057b2fa389311829b12a8fa0635fb66faf343782
SHA256c4478018efa5cff82c12277794c766bbb7c9de73b62bd79835c3e2e8c994da19
SHA5127731d59fc8af4043d6e6e00abc9e4c392753bdc99824e7a9090ffca926ac76a4ae8c3e93a34df0c4ade25fc9eba2ba01c7166dad0940a6db344f7782351597da
-
Filesize
5.2MB
MD5dd87974e02c09e54795d6c11ecb9dc2e
SHA11aeb12022b2493d400a4c9f98dfa3965bcc46e26
SHA2568e48615c1728a0369bb726bbf5f1c8ae1f2c4f62f8b96ab5ea27d6b2b0275b95
SHA5120a083c234acfe450122729a721daee70fb1025f1a89eabd6e5eb7351941f3fba422825f3763e18b0d3b09b03f9aa2944f7eb2a76b0ad733e7b3b86eb5b8fc71b
-
Filesize
5.2MB
MD59477af6fe56156445dd701cff9abacb9
SHA17bd425970846371d0985ad3d1b6f438fc9807fb2
SHA256558525f182933a8ab3f4f4dc8e4c8e3f4f5a31b029816b36279145bac3a36ff7
SHA512e452fbf721235dcbc0619e863bf0ddeb96139f9da66d134ab3da2a6a9e7b34ece50d56709aa35d064a39c461d07f4838c0996481967e065947383af7ad23f4aa
-
Filesize
5.2MB
MD596fd625f335410a42678f2586fd37c7e
SHA1b3d2d5ebd3148dafe992ee1496f762c1cadbee03
SHA256779ff232963f1ecdfba83ebb90e396c248f8b9285f4ab207d14e55df2cfd65e7
SHA512112d902324744e56f71fb2d59c1cf431f173570d1249ea9916f6e0f0bb1677d63579229575b91b1fd906ec30af66e031e12cb17b2e186a2021aafc63c1cf611a
-
Filesize
5.2MB
MD5b8b88744dfc114d548ce77920c2344d0
SHA1588f15a3a55eac9c9712863e0d72558975c3aaac
SHA256eec0fd46f1a72f7d99fb3cba8044a2dc0b4eddaf6f9ea28963a207462f14ff2a
SHA5125f0617826839002251f9c2daa802ab36de5152fad5b60c219fb96c8f0dfa27a43719693d9999dc762871e4c3ce4a6b7af103ba10b8f64d110714091a6bf7e36a
-
Filesize
5.2MB
MD545c2b340ed55cf67ddf4b8f744a6f820
SHA186f97a99732a41e104cf56c59ea213e6ac631218
SHA2568f0d7390e9196077e438fb84bbb2a19e860903de4853a7a7f878eebfe6533b3c
SHA5120b7f97db8ad95096e8bf346369cdfe4b688ab4af300f561e0786dd62c88b6581a2d8bb6c6091e4fa0429a7bf06288083c29cec3c43d74f9c6bd4568634b0d1a8
-
Filesize
5.2MB
MD590e154b8e5ea78d05aaffd47454f6cb9
SHA15936cd521402282a17c50f6bc421f44154838e68
SHA2564bf99f9959fc51b2414bd8b5d47c194468d94cf348821594820b8997bda194f0
SHA512dcb981d35080af23a4ae8a9df3261dd25c436a37537c10acc7fd131e7720d81f0c3114e973d994f3694f9ce70e1e0238d7fad0d26ab8a38c3fe5b20dd3485851
-
Filesize
5.2MB
MD560b44be89da3c546a89873ce543c2bec
SHA1674a831c9e5903368adb93d58f2055f48443b7ff
SHA2560bca758e588be184c2d190030b45a5b0b18653dab035b8962645753da75cec7b
SHA51212f4c17d9b89c918098aa28897f5ac6b3598a24b7125595900edeb24982cf7339d924891dff5dc162b380085e05f401856d23a860f165325a0edcb60d7ef0009
-
Filesize
5.2MB
MD5929d7da7bc24a863bf447a31ddc52531
SHA12661bd2f2e574db80350cc7b40558437b45789c5
SHA256c96a06fd96c292474cff1dbb4c6c169aea61e8755dbeb4c39c972927761c752e
SHA5123ad9c6f5216850dff00063171ac7ae1175b50aa4e40402b6184c6c2aee31c7dae8589b18357198572aba20236c853d1ac9757df0c545269fbcd27659792c1587
-
Filesize
5.2MB
MD56f1a22cbc92acb7e1ab77a22b096db81
SHA1ecdcd4cec10fc422895d8d16ab98c07604d49853
SHA256729813fdd6087aada17f5462c895b87972e4e4a83b9612b3437b971cd349f8d5
SHA51293606d16c8916521f41fe2bc1d6fcce22f6facee0d758b134de3c43e8ec9a5064b6b879a63122e9810235d4ceb0c66a6d78b641f20785d868ce6e378b8bed819
-
Filesize
5.2MB
MD50d6373c8ffa3cca0340983ab661e2723
SHA10f6eba562c517f695e5fe4a399a6a63d509b678f
SHA25674a0e8915a0bff24fff753db543dc25b6beba44d08670149088e7d107312dad0
SHA512c7a565a11f362358fede5cb32743a73ca746f6c372fca27678af99c24913002df64ceb84968177984fa91e525c041e1c746df41ba62831990eb5a852e7e44224
-
Filesize
5.2MB
MD5088306a89e461b687b6d0f6232a6424f
SHA123cdc68725b17b74c3b329bad44abb8c9953a17e
SHA2566c15bf212ab5c285c4338d9715b69a3e6e99d6f7231e95e6e3922510dea98925
SHA512c0d5f7a96f03137426356c5ef8e05488aacc7e3701889c82554c9e043f6321ac2d57194d270979ea78b1cfe46d362797716e5c2dfeb15991266b511ffd4e1c94
-
Filesize
5.2MB
MD5163738246365dfd15cedddca15ffa622
SHA1c7e576034fedae9e424a39c815dcfa2b9de4db8c
SHA256ccfbc9cb894832a291ff17f0988ee2e44d3e64635020c0ad165ef0f6203cc9a0
SHA51249af2186602eadf917057de347ca340f4bbaa88d9b6b74e1a77f86c3dc39117243200e70223edbb7f4d1814822a0b49700001e9277067c16ddf742daf47bcf02
-
Filesize
5.2MB
MD551e50fb484780b26d3eee15f647644e2
SHA11eca082c8462783bcb989605ac7b7f386d2a04bd
SHA256b73ccaadd83798ffccdccaa98b7e1d575f0d0ad01ae67dc6720a35920f860f89
SHA5122d1e5c70318033206506f33d48ccc3f18bff9154f60fe1ab4fc6f968467c9e3e2563eecc9465e79d444fcf7b8b7387cbfe30d2221d2c72444bac6899fba892db
-
Filesize
5.2MB
MD53bf7b37a4017e2924cc804cb5a57f775
SHA1c4a0a79dd209892b9a9ed469342fb23db0b846a2
SHA2566c246d7ca7c502f1e2fc2e0089090f2a476a5522699261e744f12ae610cab7f5
SHA5120e7265f64c98d783b9be9c29522201ea2abe9a3ee36bb0f0f24af01a8946cb2d5029d43f96cee3aed14905c0b684479a097b604719edef0809329abe8fde0b2d
-
Filesize
5.2MB
MD55e63f96c8d7869da18195bae6fb6eb42
SHA16dc1ef61a2cd2c3fb51997f304a1aa0105a588c0
SHA256cfd0f9fdf54695794536cbb8bfe1c3af43592471c1d165c9cfa85b8d5b211bc5
SHA512feb6d26859898f58b92aff6174aef78712f80f89b3d08dc965bbee6de96ff280a8949f1a99753bc532ebc2acba4441379fc684196873163fa3ebf00107546570
-
Filesize
5.2MB
MD5e8ccae17f299febcac6823b6de64845a
SHA15a97bb45d77816cafa9bdefa7c255b6877ef4572
SHA2568309a559475c55a3fa36d4e5a440385c065327dee1e2676cefca1704a56cc5f6
SHA512bf2c1c0633c71aaac2f37a860635992dde0d18f9b65dc0ac9fe10efa3d07b8d43d190b769cfb0dfeb0736ee3ba378034066010189a6455d89a0cde1b89d75187
-
Filesize
5.2MB
MD5278cc18bce96a62ba3ed4c823d0a041c
SHA1c02993fc634b7428e28df0aba9999bdf26cf2af9
SHA256ba1aa8d1414fb11a4b7009592fb40c7131e43adb7cbc5268645a514950f150e9
SHA51282246a44f0fa4b7eaed7cb856db8b4538e69fc896494b2f390ecd03a332491424b5a7378d371f31b64f7c7c8ed1734a5e70ad48a5f7dc8b2eefbd93fb846930a
-
Filesize
5.2MB
MD5bf80ab150afcd4200b5b5f319e4bfb93
SHA1de1a0f0df19b649bbd866d5e264d52a1c3a8c10e
SHA256b7b4d7feaa75f242cb407c4b676ab3f2a8cf715f776a62a274f453e12ddc9253
SHA51290cdcbefa513be297a56b31883bf01965d354ffb1a550f81493458995130c30e457a99735a1da0ffd7d03198d7ee55bf63b83d0a10e271d636674d6cfde140b4
-
Filesize
5.2MB
MD5a73fc7ed918387d2e8795e45b444b7a8
SHA11b08629e2799c90700c29641cf26cac9958abfe6
SHA2567d692ad67a96f0bb549a4236ae73de20440602b2eb32d428d436f4a428a23331
SHA51220e09c42f99aa2bef7575fd9ba3aeb3a5e14a2329e93295f1065cfa54ee3f21a83808e47ef2a21e4a25bce245040649409558d248d6768b381663ba9716c4512
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB