Analysis
-
max time kernel
125s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12/10/2024, 17:13
General
-
Target
2024-10-12_9b4a49fb6baf645435ef33b52c29fa42_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
9b4a49fb6baf645435ef33b52c29fa42
-
SHA1
808fcf584b673dc2a73b6fbd3ee56bde90157132
-
SHA256
b4715a4e11d48dca258bcd872256f088b3c4ea56086afdbfb5ed1d763a57300c
-
SHA512
ad230b3d261fe844599ac2576c87badf430c8f34171681d8c385e3116572eee94d06cf5025ce53bd2c9c3a2e32af517b0fe36741bc1268611ad9bcd2c3acd363
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:T+856utgpPF8u/7U
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_9b4a49fb6baf645435ef33b52c29fa42_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_9b4a49fb6baf645435ef33b52c29fa42_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IsdsRQx.exeC:\Windows\System\IsdsRQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jGuPuZl.exeC:\Windows\System\jGuPuZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvKawJU.exeC:\Windows\System\XvKawJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHlyFIc.exeC:\Windows\System\pHlyFIc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMQwyIF.exeC:\Windows\System\hMQwyIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EwNxPPB.exeC:\Windows\System\EwNxPPB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IpBRTUE.exeC:\Windows\System\IpBRTUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cwoMtTY.exeC:\Windows\System\cwoMtTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFBfrTw.exeC:\Windows\System\CFBfrTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XYcYEFc.exeC:\Windows\System\XYcYEFc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cJzRjdw.exeC:\Windows\System\cJzRjdw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApxdIKn.exeC:\Windows\System\ApxdIKn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GaDIbvI.exeC:\Windows\System\GaDIbvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OwglTXc.exeC:\Windows\System\OwglTXc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNwaPHX.exeC:\Windows\System\wNwaPHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVSgpNK.exeC:\Windows\System\fVSgpNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKRsJZT.exeC:\Windows\System\YKRsJZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AaFafOe.exeC:\Windows\System\AaFafOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTCrQJq.exeC:\Windows\System\kTCrQJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKUOnPV.exeC:\Windows\System\EKUOnPV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GbDKXYQ.exeC:\Windows\System\GbDKXYQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD520b1f1fdf3b6f5ad77731b6ee15f8f4a
SHA14dcbaf0e4dc9590b0689279bb2397f2564b34fa0
SHA256c83f6d481113f0ca0c901a52e00747e41f9224dc46831abf446950a4281d6198
SHA512e93be1d09b8aa2bd3e01dc8b24e508a75e08362f2009be9e68258bdb962bf9ac461bedc3f5576d22629473798b9fb4f57688b46e9a9741672fca3a79bc154a51
-
Filesize
5.9MB
MD51e140c0c88d2f2308a4b93cbe18a538c
SHA12a8845ab130dc470326990c8c65892b0c9d8cde9
SHA256fac7e47232047dd3ed84e2f43250c7e9efd4b916e991e56dadc941302ac25987
SHA5126eff08c8f4e5eae0520c2bc0787b2fd288640272308a49f2f3163e18ab7ac921a90490b0732aa4b57cba22a28482d60d2d3c82cb9083b340093618686648a878
-
Filesize
5.9MB
MD596ef55061ec42413cb4202af4965e5f5
SHA195f7664ce1d7b02d50c03bcc6ea5d5f366eaf790
SHA256f8b13f095b4503c43f18abc8448746ae537e57d7830a49f3d423e710e9c336e0
SHA512fc7540081da44de463a59520bb84459abefc02713c1a882c2349f61760a4bdffab34ed4e239c0716ad177479f571f5f7789fdcf2233bd0684ee300e61f0da8d3
-
Filesize
6.0MB
MD594020f55ae9a2fc5107a60ed09e64702
SHA1c042c95b7450df101bc4123f824a1fd1db2f7bb5
SHA25676e1ce307c310fd06ab3ba0f9e0fa1d89d84f5a75664dbefb1fab13bb146b5ba
SHA512765790bd506718b7373e71f1d181acecbce84f596de2043eb02c92b4affd52bc40900cd1a2a1c679c437a57eed88f8d212ff1e33133c656bdcd93af651e71b0e
-
Filesize
5.9MB
MD534c7949d7c5e1e86c92358b3fb772b61
SHA1c4efdcf834993a3fca7b14cd971a1f603e5ab14f
SHA2563339a3dab7ca9576c8cf56c34e55ed69c0bf297785445f85a95b8b3fdaac1571
SHA5123a15e4cfa0405baa7261dcc2fb4f83612a57db41dee9bdf0dfd3ea22fe5de2f22f6cdd8ab84964cdc721f3d4e20a7c8d2796d88049b45e335e9c3e1c33b80088
-
Filesize
6.0MB
MD5c631facaf8488593a25353ba49feb2f3
SHA1e8632e18da29e3aab9ef032b815e5011f92986a9
SHA256e6812441253acdcf19471d192079fb2295886e837508d9fa813f774540204703
SHA51256ca7b2a9ac35907223058d3bddb784bcabe0cd4a3182e73e5cd6291d60068121e10fbf2c0d6186444e821b583d6a8a647ea47e52944193fc1b8e551870163a5
-
Filesize
5.9MB
MD54ea18106c3bf6f7aef1b6f359c06d914
SHA1f5d57471428c2a2be71bac16a2bce5be943a37c9
SHA256f861c9498fddf2a31ad7505220c73e99b853f778797324d13a0195ed974f46ff
SHA512814bc349921f54d2d9d2d124e3816ffa2e4a94c403737aaaa8939db0cc4feb2b56eb78ab9ab9746cd5a81ef9a271b869d8461012772b43a84e3bfad7410d23dc
-
Filesize
5.9MB
MD52a2ffc9daff1a79a2e47c614d18f1812
SHA1a8ba24ed285bd63b47530290acb6f043000331ab
SHA25634f857338916b703ba90dcb2a83a1b4c60f55f30feb73f96de0ee63512e73738
SHA5124cfb95228492f22eee858662110a4a7da4c3c075a5dd1480558d9e61a89cf581c727a4018f4092cbeaa7c3b53d6f494cfef84a54a93a2fe65d6936a25feebfe9
-
Filesize
5.9MB
MD5825358afa1f83be69586392359662cd1
SHA14c9ddd7910c8525a9d828b1f051ad53d889127b9
SHA2562e25aec87cff777e91745bebf8be4971320ebf916d6f008a6fbdfbad2a8534c1
SHA512d957676da689f52e36eb479a09c290bd84ca79d27f7924a90b212bd1def8f10cc3748d7abda30e00b6fdb79b0776447aa625ee2c59ac4c752a7e92cc719dd0b7
-
Filesize
6.0MB
MD50a12eb63f859e540af6abad6faffdb55
SHA1d08eff2686c6e2463931270e146c0b8edfa40fb4
SHA2568b9985ee3c83d0db9f5eb49f006d777e0225b9b81385b278ce769e955c5716d4
SHA5125379dd18516a63af62c8a4004c6da16b5e683d62a054eb255c8d791214e68fd4c9e229913cf772efa6c51de81b9a5853e83b6a690f62c392d8001fffad0effd1
-
Filesize
5.9MB
MD583e2e7c26737e03b6223895e854c4a56
SHA10dbeed263fd54a2009a3a5198d8d5e15e204367d
SHA256d3f58e0e06ad90d4c4509353d61a7301ec516a914f9c945aec745c4631c5e943
SHA51245be9679c7fec209c457033647f47c515c3800e956d8ec63ead983928833a82148c4c59c58fb55c37017977f17268b03f651ddecec2bb9d34622b4660c23f4ab
-
Filesize
5.9MB
MD5cc72761189e94ad1ca86f0dd98f3693f
SHA1473d232a2842c13445bc20309f57fdacb68a6f18
SHA256d522155f977512039c103d41d60065703ee38b314643d21421bc0644875ceab2
SHA512fe876bbd179e054bc1b013c7ad1d02781087abf7494e0b4be7131bc35304d96610aa00426b942ab7ab770185fcf151f24e40c45a527f634cdadc4a7863e93663
-
Filesize
5.9MB
MD5d9cc1176b697c43a37b5e6c880012268
SHA17cd5a23a1f0ae8eec1c505052bb72cbd5b75473a
SHA256546febb197854a43630cc8d87f2efd54b9bd80a3481603138cbb5b7da587712b
SHA5125d29eb64c586ed312c7da3f151937a928a82f47147968285c5c5f7fee90b7c76bff52933d6d59663ec47fc440b53b384e9bf82feabda90cc6749f251aac67a92
-
Filesize
5.9MB
MD56654ee0864c99af585964ea9f9b03bdb
SHA1fa91d516dd256d99e0c5ce359ea9bbd848a7ca82
SHA25623bbeeea8d056bdb76d514b41fbd9c1501f799fa9d8827c94e360a33a270d3f3
SHA512029f7a2bc733b2977107fe4ded5a6f054a4d50cf4903e1908c3ca7b6ab9b7a33cb755f4bafadfcd5636733e5a297235a7d29758a83b39e0fe5c54b57fa7b4ca5
-
Filesize
6.0MB
MD5e02dcdae46f43267b2582dfe4ab72656
SHA1cc3135aa141af54668e50e312cb5d1115460590c
SHA2562296819a646df4c502a4b0c193a961170818c5253cfd718ff4b4620ac8cceeaf
SHA512858e402af7ea8e2ec80f5629cdf6977353c23373519026fcae881e383f467db2ea3341eafc8822afca71877fab78eaf5fa88e29711e17da5c026884bfd7c8921
-
Filesize
5.9MB
MD52fa1ae87c5891fffc76d5e2405be4be5
SHA1cf417b32a284c78788c310ee9223952d2db451af
SHA2568b911509fb5371667b93d024d0334c4a51bf52342be2929189dd67b956d43a5e
SHA51221a7dae5a65fafd5deea0e3fc9f88ab819bba32c72a7025fa654c1cae29368053e3acf0a53183b93e044d9733888e7c64fab87d8943bd7591d3a51ecdb1c5ee3
-
Filesize
5.9MB
MD56bae3ac64d7e067c6759889fbbf9932b
SHA1bc61a48f837c8a15aff2e81e27847b4bfd5eef85
SHA25630979b51558a131c8d231baf865a4313f4412d1bf4d7675db5668a6983da1b4e
SHA51253b997c20f4e726840fdd5dab9773643c17ec485f87298a8b3f1444e157b6cfa2db2bfeba8247313c2a90c04473c53ca337b95c1223cd948dfe351624046f01d
-
Filesize
5.9MB
MD539528b6520c6cef1be08f1a6816a42fb
SHA151fe6b229d7c3d7e585f6ef438b67639cdd7524c
SHA2568ee94bd9778aa13ecf1f0a9cd8efbd5e0c8e0845cece1622f9aba06d02051781
SHA512cb7ade1ef5dae04024a93bbd76f79af000f9b505949114351a2a3866b59c0920193826f9941ffbdb976a29c301392daced74cf9d318d5d4e3f8a29bec179c4ee
-
Filesize
5.9MB
MD5dc4910b6b23a26fa42792c6d3dfefe0e
SHA11809f2c430dfab2ee9afdce2e9676a383a7ea4cc
SHA25652848ba00f2347b3cdab705658bd1568f7b97b6341f7fae8c31bc4a3bce852bc
SHA512bad4f38e64bfdabefc55f797a004edbb9455ae28536fe27b178c12644f0bb90bbd1e31969e6694081d473bfbe2ccc5df6c1f09c8f5b622e6c6aa785c8d132847
-
Filesize
5.9MB
MD5b970cace49e460b39373af157fba505d
SHA152e85146eb17e19c10f097db440d45a8e5687f1c
SHA2566ff3830f664422ced4e06dcfc3e9a96eb9ecd4b1e585a6880463fd7a152237ac
SHA512487790e28dcc92cea89ffd86ae37a68363af57c89e6d7d6c9ec5539e81da58f87d2afa9a748991e3f32490de867d87a53b0b5e3db0a04c356e704f31b676c6da
-
Filesize
5.9MB
MD5bcc6cc597d36304002c182da107ae2fa
SHA14986dc9e3ceb95264c0b81ffeae64d9dfd4b6349
SHA256274ed39d1e626efed7b48c7b76eecc874f7841ab2001467c4de09d7f4bdcc475
SHA5126a4413063067ec4f8e355160f3084e4d7a5cfdf751730a5ffe931041ed1694a3f143ce52850b6cf22a9e75c53adf9c6d23be199620f88d188296df2f7178b0ef
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB