Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/09/2024, 02:50
General
-
Target
2024-09-28_e60e080ed7de57cbec6feb1d23ea48a6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e60e080ed7de57cbec6feb1d23ea48a6
-
SHA1
b259c6fa2c925a9e59a052206a87eee4ade8c961
-
SHA256
9cf6d55310173ac63918da88e258576ef3d39f514bd1fff23216f199fd4c9748
-
SHA512
ba9fa508bcd7ef3d70b02cdce3319848b7da71cb17afb14a479a05cb6944b443ab305a4cc69593db72ed97e8d57c8880aab7a7a9b05ef6d165afbe56d8b77d45
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUZ:E+b56utgpPF8u/7Z
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_e60e080ed7de57cbec6feb1d23ea48a6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_e60e080ed7de57cbec6feb1d23ea48a6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\afzseac.exeC:\Windows\System\afzseac.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMLJzRc.exeC:\Windows\System\yMLJzRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJNkkUL.exeC:\Windows\System\VJNkkUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASMzYTs.exeC:\Windows\System\ASMzYTs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPZSzXt.exeC:\Windows\System\RPZSzXt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OkUSvnf.exeC:\Windows\System\OkUSvnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRRYwIG.exeC:\Windows\System\BRRYwIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGcqOnf.exeC:\Windows\System\kGcqOnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ypjFDRy.exeC:\Windows\System\ypjFDRy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvgrUYg.exeC:\Windows\System\MvgrUYg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TJcbyJA.exeC:\Windows\System\TJcbyJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kWQGaoR.exeC:\Windows\System\kWQGaoR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Bawtbuu.exeC:\Windows\System\Bawtbuu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aKhuXYQ.exeC:\Windows\System\aKhuXYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KMpDFhz.exeC:\Windows\System\KMpDFhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kpODdxD.exeC:\Windows\System\kpODdxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntPZhcj.exeC:\Windows\System\ntPZhcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKyQSZE.exeC:\Windows\System\rKyQSZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YCVCEnu.exeC:\Windows\System\YCVCEnu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vAhoJAk.exeC:\Windows\System\vAhoJAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnprMXq.exeC:\Windows\System\GnprMXq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51fa46213f2d077b96e2cb6fda8af8a3c
SHA1f61822a05b1e06aa5f35efa633cd206cde69a8ba
SHA2567894e0461432bfc8162c286c3c730d4d6ab7f895c72dba0abf01e47fd32f276b
SHA512223ca730335de76ea03dd4481b9e940c7bb081e4132956b1f1ed32a6317605d80fdf5fd807adb4d79420e21713d711241e48baae046cd94eb3c52af8da346774
-
Filesize
5.9MB
MD52d6246e29429afb3dab91a30fe0de72f
SHA12c82e648ba38c752e37ad6b9a08d041a07702be4
SHA25601cdb1438ad34d9663b0e2aa96c03016c89f1d03191abd84672515ae29a7ead5
SHA512e7a60f77d74c9e51a5002d2a64abfda49cc4e3251ca2c16df4a44fe2bf64193f8e834a3fc27aad966380962addc4b19527f817be1744a5cbaaa57e312d21aabd
-
Filesize
5.9MB
MD50385d4a4248566ba8dedb7324ce1888c
SHA11fab586217ec99d3c2ed2b54ae12d96c7fa7ed44
SHA2563220a6fd150fd5f997bb67ae6c37f1c0df91ff87f8d1e479d75e573bbec860f0
SHA51292ddf22eabb7ee6782edceb8ee41b862e0e479b02386877739baac20cf3f4b3223db7acef471dff2c377c802da0819f2df5b5ffd04db3919d318882a7b47920b
-
Filesize
5.9MB
MD5a7c90854156cae47e4f446f7d378b1cf
SHA177d978c2d1f16410ddc268956e5f5984a8cc6973
SHA256c17b4f561dfe9ff5f30c36a3e2074dfdea8fbbcf329f261282d83236eea6cc91
SHA512a2ee1ea0fedfade475552352f06e1f254f31b39e32102be0b0ee9d1a1253c1f5fef67b5062025838e3d90c30c8765423ad0a5e5a391e92eff94ac5a04430b46b
-
Filesize
5.9MB
MD5ef4964610544dfc014acfe883a3ef6d8
SHA15440887e83183c8a52bdc622cb798d4e7c482462
SHA256e8b3ad70ea4ea7b8f47ad729efb6a44ab1b5128a9672c1a409b2df85c05d6052
SHA5125811c0234138436f89a77a29fb39d2e81213e7027c2337be14e61cc419e78549cd0618492b17db70465aee8618d961f21a8fee587ad1174480a08b608de629fa
-
Filesize
5.9MB
MD59668d1642937642d248ac0c35b36f68f
SHA185b7830156b1cc31277a84790155429153c86ea8
SHA2563a2d012531173dc3c9547204ecf456d30e8a8040b671b46f596eff20b60c7d73
SHA5123b92c559ceda06dd6275632b31988019f448643824a193bd81c3ca40516137db118fd4b686d464702c3f1fa609547802a3517f1e01140d6d14226b5a1515160a
-
Filesize
5.9MB
MD5de175f6b925424575cda46b37462524f
SHA138707ea138e12e623bb7e70d4c0154b0ddf81ff8
SHA256b5b711ac91adcb6405bdfdd4c94ba6fc306788bde8c893ca33c4c0c4f2375adf
SHA51204915ea40b2737e6485aff6508cdd94e3940786cb69b38f3d2e5a63a75fbeff0451a8389935ba0b9e762e542183ba9f7aa56d7e1e523bec370e239b9d20855b8
-
Filesize
5.9MB
MD529e72061d4dd6c8800f7636b9fdb0c60
SHA1c60311d27f756c27de5e3b0cef0f14c3774b8caf
SHA256bffda76555f8011d0a70aa96017216c23733d2ac97b189c62e8c3cf776597a3b
SHA512a32b1be301fbddf3c5e5d253d7247de7dca609be6e0867dfe0c890b38da0481f56ccd4a34085a8944963a7c5da3554a949366041d1a1b366701e308a4f25d7f2
-
Filesize
5.9MB
MD597847eb98d93a050e189a586d9e3b5d4
SHA135635d14f7e52cc1955f1a59c0fe0df16e717b97
SHA25671a4fca96295a587278daa6dea75eaf062dfe53c9d18a03246d05aab33ac79dd
SHA5124aa5a0c8c8c946634af6208b71bf81f63503b4015cd07d8e9f2a9d4f4a5fc736c56f7b1f8d8579f899edb9187daa0f00637dbf3c9a0e02a1374057870fa797c2
-
Filesize
5.9MB
MD57b901ae9e841779d8ff95580cf92703e
SHA1afa95b2058eefb61ea7f5dc6dc65218d65a66927
SHA2564d2ee904de8699b936ac5448965109caa646e1c894dff77765e7d7464343a790
SHA51284598fc3ba0a39a2ccb7d99291ee4eac8c35cfd785d5f1ff8da82633df57a2662eb19e33d1dcb8a51e795d35d31d4f7d3307e2f53d96199c33015931ce8cadab
-
Filesize
5.9MB
MD5eef5c0805d454a6ddbc2d2ee9a6ff29b
SHA17d78ff4c7c44033dbd7121d89947c03415d38801
SHA256385848609f26fe12904fd8424f15a83c62323fc677154af1bc8776759f59ddde
SHA51222792a4c93894676b87780b30adf7908e9140e87c23843a0befa7aa6132fba8389526a8f44a14755feecdafacc23f6493828fdd8cae6f172008ed6958fb26d89
-
Filesize
5.9MB
MD5585f23e2c8c898fdabe22b789e8b1afa
SHA18548fbfb3e7d222fc3038f0abf707b0199b1d064
SHA25652e61e00afc69ac4e6c0a0b6c01952a4b488798db225d37dce856454cd43b1a3
SHA512b8b47a5dd3860630a2ab54e09028a373487e1b959835ecb15e14b061fc591cc024283756df66cf125a6dc34217db7ca11bab85c58713288d9c7dc776829fba6c
-
Filesize
5.9MB
MD5238f1105c1ff4a0a081422afa61a335e
SHA13217fafce1f4920721cbae0512321a1fc91f506d
SHA2567261b907b454691388798229ccfa672b71b58625b5517795e9213940fac5855d
SHA5127e15c1c004c89fc7a7d6620b89b7e1d19faabc77acf1ca2187c0506c20424e5e0cb5267f3daa4e54f8e1f11be391ba8178d84ef3a7fb8db197683929a35df95e
-
Filesize
5.9MB
MD5c0d3e3cb95efc1802ffb5305989a3582
SHA1f55e96bc6639a91bc2553e5bce413caff79f099b
SHA2562476d79d63c5fb67207f415e2e2b7ea81e4927c34a2b24650ab14a14140482c6
SHA5120b7a2c6e7561cd84ee67dd67bc87a9aa9c12d2b4dcbe45e409d4410ecdc587950e16081452dfd3c036c56d9d3deab816d35a5792b6d6a1c4d706f9efe9ea9792
-
Filesize
5.9MB
MD504a773fd83174044ba377f44a4279ee7
SHA1c34c82545411d7f62b5ee8c92a747f0478156644
SHA256c22a72ffbae48994ca60755d4433aeaa8375d2a7aaffc8398ccaedbb1d1d2d57
SHA5123f04235bc214abc19acdf8e977db7b5f9a247ada890023883ff850c94768a20a00fb3ee9611e222ab4fab88685f6bb5dc47c730d12ced4f3043786a4e1b81274
-
Filesize
5.9MB
MD5c7f45b2c1faf49730c6741834179b13f
SHA1335e00754c35e996b4921a4fd1e37304484afcbd
SHA256540b045ac56d686ce986e2e1fe5364979d75c6b2207ecaf9e5b4a8036098c841
SHA512df35b0488b989859fbb8ef8219dc38d29c830bb941ff7bf0794c7f85e9e229293c6b17cf28f9df31a55ac4314ba20d4bf37e324dfe1240263f290413ed279266
-
Filesize
5.9MB
MD53d52517243eb9940083830a21f51935b
SHA1cba36d7ae747dc6c4194e1644a6cbce17075df9a
SHA2567dc11b035a639d8e2c773752c4f449b4e8c52463b793c4abcd59e8038e520d11
SHA5120bac8c086a9d01e1846b7bed2545d67c90a6fd082e2b13b44195f170524a917baae44a3bced8f0ad5e80309bd732a2ca404503441453966f45cbbc42b34c0f73
-
Filesize
5.9MB
MD5ba65145bc1d848728718d25fc33b9a24
SHA175ba874aa9992e341897a9a78c15c6807eae42bd
SHA256136a761993314e042c8eedd56f4ebfd86c6388210fb26dfbe4fa7ae9cf568a4c
SHA512c3cf545ab28780469de23ab98d7b8043404566d5b3b302b59048896aee2c82042fdb5ccf6cf4caa299d8f770d2c86e325882a0cbcd95a5b77aebf90f028fbd1e
-
Filesize
5.9MB
MD597b5c4c8e7d244c1e96b3b3b8b822591
SHA164bab311f723553300a1c1bb90fd97be1251107b
SHA25621b2e9eb54ec8f4f576c03c754861e8910147c76019fb778f8061af254224355
SHA512b6a2806dee69e3d38748d31f89de9fe8bacd61c109c4885b6dde690fed4b357dbc0bd89d81e1542dfccd5225003688bb48b6eac054663fad09656fc395e86ef1
-
Filesize
5.9MB
MD55dabbe7066d0195ddf480ac60cc4a6e7
SHA1f0e23ff18a1d238302aefcfbe7e3542fda62bc01
SHA2561e6e8738e0bbf87a61fe065a563549e1ddde37402b1a65cc19647fe56132d407
SHA5129e98780b91c551f1bc569ed66c438dcd7714916b75bbc43f9de31730252b26ac7dbf625f4971eb47cc3ebe4aee6e3e24adc8a493f264353d9c7849588063cea5
-
Filesize
5.9MB
MD5132424f31a40bf020f8d9d4e5a5b5269
SHA1995c5f995eb4b44ff50b57af1bab652a753e1bf0
SHA256c472aaaaef95ffaf05563b07195a2ae099dd963ef1548eb056e9a06028734423
SHA5121b87898e5927ff6c4c15c5361eca3a6b6d3df57ce073d93c72482d8a679247c31babaf1ad4b453e8f84cb6fb545d4a8153e080d2d6ee6f4fb5371c3e81f8408a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB