Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
29/09/2024, 10:02
General
-
Target
2024-09-29_8571f6e2ce349ffdb2d78329e2f64773_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
8571f6e2ce349ffdb2d78329e2f64773
-
SHA1
1862e8fd7709c4d851d520a671ffc86f272823e7
-
SHA256
9c9179cbd2f2b080b57648ab7e781da05cd0a406cb0d0ee19533d9ecfbef50a5
-
SHA512
5ac2fd60e763515bbb6b5516e43015c6994137ee97c083a7408528b6068e829eb8b1280e9c0b95a38b3b1a1335071f1000b71f1839271f0c4f9254271ddac3fe
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU1:Q+u56utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-29_8571f6e2ce349ffdb2d78329e2f64773_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-29_8571f6e2ce349ffdb2d78329e2f64773_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SHqTLHB.exeC:\Windows\System\SHqTLHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\veFvnaN.exeC:\Windows\System\veFvnaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNNDrtC.exeC:\Windows\System\oNNDrtC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHGcjXl.exeC:\Windows\System\pHGcjXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KUYhjlc.exeC:\Windows\System\KUYhjlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TXOpkus.exeC:\Windows\System\TXOpkus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UqpAVDh.exeC:\Windows\System\UqpAVDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIEFiik.exeC:\Windows\System\ZIEFiik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dWswSnw.exeC:\Windows\System\dWswSnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WAotdlC.exeC:\Windows\System\WAotdlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwWivmG.exeC:\Windows\System\RwWivmG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kJHCnFr.exeC:\Windows\System\kJHCnFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JerlBld.exeC:\Windows\System\JerlBld.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxbrMUG.exeC:\Windows\System\wxbrMUG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OITbRXV.exeC:\Windows\System\OITbRXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfxWLCA.exeC:\Windows\System\dfxWLCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fNFmxCj.exeC:\Windows\System\fNFmxCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmkOVyA.exeC:\Windows\System\pmkOVyA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVrHTYS.exeC:\Windows\System\zVrHTYS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIumdIs.exeC:\Windows\System\NIumdIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nFsEHoS.exeC:\Windows\System\nFsEHoS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56a1eab38ba152f9d5fd1c8cc85150225
SHA13aa3cc00e46433a8ce4399dfc5fa90f8368d421e
SHA2565a4c5b416f788d01625b723e7874223a0bbad674c3a6131cc53c000b5558ac7d
SHA512989b601e2d2212e0d1dc4d1bf35144f05711be895851c5281a3f671414c424b2765ebc47a758211bbc0f85eacc5647f6602a4adfbe65acea2cb7c46c402e24e1
-
Filesize
5.9MB
MD5fb3ea331f785035b86149a6968ac24dc
SHA160060a584540d5fa55ee6851d137d945d357c6f3
SHA256f71455ee827c66d72de42f6d510542c5ae686e00afe057f9b6bc140a7d88c8e6
SHA5128c4e0031f3860d24a49b9447ba923d2e30af1dd4c3501f98a8394bab6bbb234e49c58f2ef4a4e6f18a9aba1333da596c3f1ecaa108e2e69bf68f6629a47be366
-
Filesize
5.9MB
MD572251f4d43d83505ccb639fade7c50ee
SHA15b034a8a7e5c6901c31aaaed6e41ee79ab859f48
SHA2561042086b2b5903aa1440579253e4e8c4c03cbb345fd729a53dc3c594e6625768
SHA5124d36459b1db5695fcf7bf4ca17652ad52d11b503028091b64527da5366412a966c6df0f11b3963fbfea037766b23fe7fc22bc7606f47d5f5992590aaf7deb3d0
-
Filesize
5.9MB
MD57ac371150586fe969a2d27273a627c80
SHA13e0a48d44cd734623424a45451c088bdad4695b5
SHA25627778fac6aef109375cae70aeb2ec33a518d5404fd42a8b78fbf21194a6262f3
SHA512e2f0b62b759888dea2add400020bf592281a1e51a37190ca766d4e295c22cbef20643d73bc68166dab93907c263cfc2ac74cfa7ac9796b836bcfed2b5f1b1ce0
-
Filesize
5.9MB
MD56cb3d094d1d7feb3290b062e96efb14b
SHA1e3ed525c840af85c1c21c72dd8f61d811b529542
SHA256a34bde4b9a6e8450cbedc3a2b6bc2487102080e4d1ffea77af1e56434be365ff
SHA51274adc259b00d1a85b59eb587359bd9e44ba5ea17b6d576eeba08dcb4837705ce94ceac165d3d28c31e1d79fca4d63ee73f675dfa2fcf0de20c0c2aa88d7e044e
-
Filesize
5.9MB
MD5a6b80ce2c0dcd0216673953c6999e4d5
SHA14c63c404f68615c936c1396ed358ec44d63dad70
SHA2566cfa7c161964db7d4cb5c5c62f0e478146ca6b9cadd0379c517a3da00620984e
SHA512516deaa18beec95aa21d2b991924ae62cb9e3f474edb8b0524cca674b6e469ef02222b4fa66037a41a95aaeea867b80f49d80181476de39fcd8c03357cc87828
-
Filesize
5.9MB
MD5f538dc474e91076e034e84bd4d5c5294
SHA1b15bed40dc6002ad8ca6e4350445254900a850c1
SHA256b9ab3c5f197da6a7a75972546b700b3d8e33425a784c40a64a659906a30955be
SHA5129dd6121df5a688115e471ee78c0164888cb623aa4731f888e8516cbc7828c8f737aa96f7d9638a2a66f8452bfb2b83f01bbce932a80496173d4d79171116071f
-
Filesize
5.9MB
MD523530e68693fc77820b6b1051489246f
SHA11ab0d7af643f481ce8cf9d347b02689ddd649608
SHA256bf1f44a08702ea56fc1eaa5af19fd81ef48fb0d4ebf4a18250ea5d43dc280b51
SHA5123dd5f176ec0c145a3dc696636c6f352c91a152cf843f7e1125ecdc4203630e1ac4c9b362757ab2831c095c7ecaed6a5959385d7eb4f67079ecb468dc12890c61
-
Filesize
5.9MB
MD5d17f965fe2f88264c1cd07f49c22aaf1
SHA135f27fa537b518b53d92b8e5fb3dcfa4a580ac34
SHA2566719bd0fc4222f328898ce71d55cbb46c8586d288124cc2561d9af88b1b8f1ed
SHA512b2fcf173c295ba48f7b64b45da2df8fc481250eb43338b619e2bd2c5850460456fa762c7b049155c2fac116807d020f7682aa3a65c298129e2c382771cec61fa
-
Filesize
5.9MB
MD58a91140d488a92d5145211b99262a913
SHA1653273ef91240e1cdba32ea2ba685e60fc13ede2
SHA2563e3c4d88c36b6a4b7206faa7fdb93f7d6f7954e6ca2b9bf984a34c512cdbe685
SHA5124395cad2b9e0b40d9055e07337a9a55c0e3ca24c06a6a0afa13e2343229aa90e901997a329dd200d485affeb6839884c2ae2fa25a3b604e77cb2d7b6f372e5f3
-
Filesize
5.9MB
MD55738822aa4ed3af14cbd426acf8ccac5
SHA175a008c8e94c36c27b97ce2154daf1582e20da8c
SHA256401e61f10a45e585dc0e34fb739c3051b8ca81de67634e7977d5ad74f07db4c8
SHA51219d34f504dc9bd7d664f69809f7ddbb3e229e4d801a4359eabb6a54e8707df6792c5f9e28f220f78d43db779b24dc5d731ba939f48a9e39f2bfe876527544ac4
-
Filesize
5.9MB
MD5d98dc6e2dd717889e9da78948091ed7b
SHA10259f6b590c77e2439924636144efb624b3c0999
SHA256f7a3ee05e2b554410ad3f87a207f56efee16324ceab1bc1acfadaf5c503f8e3a
SHA5121e8f421b620bab827c73836bbe47049d01a75b933463c22d33d0d8a95f678d36fe2a7b186a1a56d1395565fe531f8dfc92b5a6e9011b74ed09e26dde3de95452
-
Filesize
5.9MB
MD5f3babfcd4fc2812bc8f2c6eec1a02cdb
SHA1fceb04284f668d656c70635562665e868039460b
SHA2560f7acdc79d166d2988bfcdcab194fc3900189a18d4d46fc2f2cc6107745ed7c4
SHA512c369b1079f900b3374192012ec90804e0b0046d158c2c9c09902c85605ee6b827281fd5a12b7182c8e97b60ba56873300860c3c4b6b9f3359a6c11755345d1fc
-
Filesize
5.9MB
MD5c7c40a65335379d5eba57cef70e05f26
SHA14d2b155cb3d3ac53c267d2e4d7272db81b65c058
SHA25605221c9953b3c783f1caaa72a20d47db260ad15ad2b166ed3b93478b14107f28
SHA51243401e102b70ee40b1cfe39c51cdb2b57369e3598057cbaf98349ef532a334b1bcd5e69505eaf267931fa3c5fdd84118289df22850f2d5aecf6150398ab734e9
-
Filesize
5.9MB
MD5f0cfa3fc9d4db16e8d93180b244fa5bd
SHA11472d797d3134ee572d4ecb035f7051c16c284aa
SHA256b2c13c93ea5005131f065c73d5df98f295ced453b3182240291daa8024be34de
SHA512dd1c164b19fa033c58c1dac689f532777321757a1d6a43ac730d611a913c11cf8efe941fd38f8af8ad6c3799c95a6212a96c5b10e90e84e286c6e85f8810755d
-
Filesize
5.9MB
MD5885d2375e84936a7304d7899d0dfa341
SHA1001c050fef3d06f2151ff06b6d097df96454c97e
SHA25667883e7215d16042ea5d3bb5261081c4d6f94a14021822d92ca73d0cd5cb833d
SHA5126904a38a2de62a7057f91b03482ef748d1d6d1b994887dfdb7a2b9d5241d716fd82d92d5dfb9cb3fcca772b09ad7500ff9f7d15515158bdc9d9bf863246f78f2
-
Filesize
5.9MB
MD53016685543cfc3fa2b0faf1e06b2fcd9
SHA1b663eddae40d8a344b967a91d20e74b2930f55be
SHA256cca8990014f0249c73c27cbcdafdf95de2b15a4823565b72ae60ef201863185b
SHA5128a7588eb6566aad05c0d5955d21b8a4cc4e029edabe1a8f673c8f0d3212d09f5ec2cb3297cf3bbc517d3a8c71e58511fefb684e152347cbc0d6095f2caca353a
-
Filesize
5.9MB
MD5d971eda3f29682920bef9d619dd3e8a0
SHA1225b54ed971d3803edadbdce8636b724cb75083a
SHA256286666134bea0d7498f3338aa44ee4259b31cf0c69004f060c21dfd43becd9ac
SHA512b8df2864657e8608b89a1e27bafc4d563d5e1c74b0629cf5f57b28162246c3f1884f86492af9e62dcb5a4c26ffe8c44aef0dd8d95a338c766886640072e3299c
-
Filesize
5.9MB
MD5bbc998a53d5e1e6c01a715e541d99253
SHA138e69f699678f4312cdcd562ea05a94fd422aaba
SHA2564bf76f33f1717a7cf76ca7eb6b57d91cebc85a3387f96561ad0882dcd7d5a95c
SHA51255b828ffa04ee3348b12d225ebee3abddc2b298faca0f8d14f450170da6f950db96d01af9d7e7c55d465f3539af6e8aad21bf37ee793f0371084ba1251c21429
-
Filesize
5.9MB
MD5503aa7043eff31c05b33b9158455a1a9
SHA13631c55e39bde2f1a4be33dafdeafb781b1e05bb
SHA25681f5c312796d21cd827ea5fc236a861768d47d29b73d216d5bccd03aea817b87
SHA51215b8fa8daf324ebee5e8e1ad9fa98b05395c05ffbc31e2aa27ac0c5fc37772070d3b526ff10cd8fbed3eaa31ea3765ead75e1be6374499cb81426cb1d349ddc9
-
Filesize
5.9MB
MD538cfc9bda475f2baa9255734895dced7
SHA18d32fd7dafe39765655a4621f075f5d77543a706
SHA256d9b98aa7804f878d713f631f0be6514173095d43c12cdaa0923320191aa7c717
SHA512f06cf7dea578155764ed8cfa9f35fdca84d6c6c0d5e3b73ecd3ef2d03618ab655e79482226a68d6e1871c37c568c36ea867029070d792abcfd48cd4e57b06f3a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB