Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/09/2024, 15:41
General
-
Target
2024-09-04_170e8e11adbf6e99f7d77b7433e347ef_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
170e8e11adbf6e99f7d77b7433e347ef
-
SHA1
abb4ce815a248af4b9cb294b01894798d3d2d95b
-
SHA256
ceca52b85e07b4cb0cb04a8a32f471553d9680124f27518b5f510d0c9a7bfddf
-
SHA512
fb0749947ccdfc667be047105921516a0aee47f0a22dfbdb2f73766ef113aab104fc0a811b371c1cc08cfd61ed8603505a210dd73c80d9477b110846e53ace70
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibd56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-04_170e8e11adbf6e99f7d77b7433e347ef_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-04_170e8e11adbf6e99f7d77b7433e347ef_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wqwsquW.exeC:\Windows\System\wqwsquW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQNMVwR.exeC:\Windows\System\tQNMVwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iDowtDX.exeC:\Windows\System\iDowtDX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCPZISS.exeC:\Windows\System\XCPZISS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHePdvx.exeC:\Windows\System\VHePdvx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgTkSff.exeC:\Windows\System\rgTkSff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfbQSSY.exeC:\Windows\System\hfbQSSY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPKtzNV.exeC:\Windows\System\CPKtzNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJgKHZB.exeC:\Windows\System\WJgKHZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHEIJKc.exeC:\Windows\System\IHEIJKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRqKDNg.exeC:\Windows\System\gRqKDNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VjpxLlv.exeC:\Windows\System\VjpxLlv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnOCfbv.exeC:\Windows\System\VnOCfbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ABAVrUS.exeC:\Windows\System\ABAVrUS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lHYAHJu.exeC:\Windows\System\lHYAHJu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PGjMQuz.exeC:\Windows\System\PGjMQuz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sTENVOv.exeC:\Windows\System\sTENVOv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TRseoic.exeC:\Windows\System\TRseoic.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wdXuHqs.exeC:\Windows\System\wdXuHqs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\upaUdBT.exeC:\Windows\System\upaUdBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aaFmRiK.exeC:\Windows\System\aaFmRiK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c3408fead4ad66cba2a21140648e107b
SHA189d27dcab25b5cd7ad5562d9a9a90b08d0c334b2
SHA256353ce2c4ce9f1144d1a8b7a912494cb7b803dc305329b7a79982a30795d5d9cc
SHA51245b6359dc2a08a6d061f32bbc4a302a3a7d509cb91e31dca481dd92263d8aeadd4cc1ae1edba143f6cc2d90dba4818abfb45af078190629ded3e03e529220883
-
Filesize
5.2MB
MD59b39b1dda58dc055cbda2a19b3850bb5
SHA169bc5c90aa206581b46861ecaa8df4222198b12c
SHA2566cc580cc1a93d3a17f21ffa6f1acdb486f2b8370d2a002619e4922b6a71c9464
SHA5129798f28b2971b10ebe1db1f7db6a0b6c00ee50b1a474f8371f92142152707896571563179def11e3f266e70763384e227429daea9fa592e933ead929598c058d
-
Filesize
5.2MB
MD54f99eb7b5676793a9a8ad7d9ad740a8c
SHA1b491f4256e07f6fc8014bc01eb0a66b02f555b39
SHA25638acf2b351400fca9dbf21e3bd13e8bc78995ac9ef5f89ac545c9ed0e5de7730
SHA512b819491be6f07f238d06fc70a31d5453630188a687dcf73bbda3e32c92c43419cc3e83c5acb3ff7c7a6c23be496d47b5a9905b415a7cff111859b9e027662787
-
Filesize
5.2MB
MD53d396f35c23ff2591cf5917b548e84cd
SHA1734d33d963d621844ee0186f0b2b423d552ebd41
SHA256aebbdf57258854515ce8a9087c4573880c728b4b481ed381fcebcf0de6bbd242
SHA51206d137c43b7827d99e2dac5983ae0a34d0afbfd442a09d4fbed3bd0d8d855ef732f8d3a37405c3292dedc61c707ac691b6b7f968afb7f87266385cb8d86627e2
-
Filesize
5.2MB
MD5f06ff7843cabdac4bb7fcab9c270abba
SHA1bfd547771c7780b8ec533dfce25ff61823adf143
SHA2563c1e9fcbb32a94fdb9646a4eb054ac016393df92671fcaf1a7df460480eb939b
SHA5122cbeb2795d9d7fa83a7de35a15adee8bfe73ffd663932fdbb0636e7d0db641788b05a7ff57b5e04473420e1686e099c45e77a5db060d3e25e43a7884e32b1a5f
-
Filesize
5.2MB
MD51659cd8f67ac74904ec741ba0663b01f
SHA10b24b2037be624cbf54086958d687705604684d9
SHA256b4c5fb6c9cd0ec7759e1efc782b2e7c34201645332d2435a8bc87bb472d4dbe8
SHA5126cbc9aaf6865f73cf26d6d33a300230bd2cb70f23ef69efa098df41795e83140c70954def53a9da00ba3c18e4e3e1548d40dc559060c74bc46a12c03c0ceb2b7
-
Filesize
5.2MB
MD5c79a80d9477c7adf28339bd488053fbc
SHA153f228542cd8b96eb9fb3d8f6a2e7083a61048c8
SHA2568ee219aaf4e79ab69a14bccb63c17a77f39275f77836db7b6995acba2577873c
SHA5121b0b677f10571a6238a2d1534dcaef957b97b62265bdfc49f36c3f90f08deff8c145086ea8182d88e8bd8b06683b7dc10d9ba954cdd4b05f72e5f0fbfc442b2f
-
Filesize
5.2MB
MD572d4a6344491c8050def2b660de00f11
SHA16f0e3329d4de192dd2cd61615b5625946ca4ce63
SHA2566400d5100656b8f715e08cde3f60b0998b65d67663bdabca569c1d29d2e3c387
SHA51226630a48acbb0bdb4d29e2d72088ccc0ff6fb90a3e5985f38138ae51ac5cab328ff5938f2281e44557f1a73b0a37e7c28000ef168bf19ba2f9bf4735630c0148
-
Filesize
5.2MB
MD591a1f0248c28723f30bef9182d22ae0b
SHA1f34b5ab7c92681729637fea3936deac03d624cce
SHA256e00321621a866668262ffc6838fe88c008ff8cc678975e21aa148b252de207c0
SHA5128f0212c2e47b526cf7616bc7a41f185b9a41349434743282116d9c6d7baa5d37bef6c2bd88d7c2e7558fe55f6abb38f45909fb5d0f1855c733311499dae75038
-
Filesize
5.2MB
MD528a86fe98c0154a1df770ba2b868aa3a
SHA10ab8811ee386440872dbe0e83dbdb329c0e70b99
SHA2568e49801e67cbaf165c994be075173553307d3d7d976aff00ba2171da2b669e39
SHA512be8e4e844686bc34767da4c3eb4c9b600f4e49dbab72e90e2d4791de90f3c6348e4a49b36b593a8316322e940128687eb0bee58549a92d3c4cc51a3d61b0a326
-
Filesize
5.2MB
MD5a3bfc49ecfe7c03a2ac80e2598b33000
SHA1beff0ceeee0b146511b7f335ee8c535cb834f1e7
SHA25665513d54347a6276c752a3c4c844e44515033c1b1c3f5e1c14d3618066ab3e48
SHA512061c7046162c99042ea3c1d0553d254c2794507368679dd57749d7c34328bf76ba122d855255caf3872d585a4a4876c004588d8eaee95d0097b9a4a8cf6bcf6f
-
Filesize
5.2MB
MD5be6424e4d23552514c3420f393079555
SHA19876fdfd80e30b558ef34e4040e0d755906cd269
SHA25616d3d73784cd9f21090b473b2acfa30bbf5a2b8481fa090fe3d839447099a388
SHA5127a96866065a89595623f9f01c6882f7709547863280c7066d346f957c35a59aee1cf74463bbec5884649253dae54c0909c912dc71d5b96530cd80297cf0f542c
-
Filesize
5.2MB
MD557a93a8d399bca9f53f8b381ce0683a9
SHA1e1d34d6f74a9270f54236898f21087d84bce0e7a
SHA2564a1bec3fbb072598cc54fa85416bc6cb1ac0ad476997c1f9a8494e2a71f6677c
SHA512e57e0ba3f0a0ee4f87b7ca8af4f85c3b7bd0974e81c6b2f6772a6fac641fbbea99c49b1ec5fc4b17392d0ceba18c0e80c913727e6bde1b739250c2a5970c3f37
-
Filesize
5.2MB
MD5a88bd60c05ff563d5a605b5d5999305f
SHA12b61a35a54dde61fc51c02a302ad9f2ca195853d
SHA2562493007d6c0e2852ff56ac94489ce74f35e8a36a878c420c7e2d4f6ec2ae9512
SHA512bdcd4001ca023d39ebdd3e362b5e1d3bf98f9eac0de77a38eed271746ab716f609f94c7a0aee5da9d19c4bfcfd285c3f4d1c5b282f7244e62adf3d93cbc638ff
-
Filesize
5.2MB
MD5a7f4a7c6c0a01a94739a9751a9cfb42b
SHA121a4e4055db4c71a939cfd5711ddf6b367960ca7
SHA25638f2296cf93f5bd7804cf5f6280ff5d28061f89c575dcf354326291f13d9dc3a
SHA51299a1cc8224195928f86b931bbd9606909a1208a26a4a3d852a3bbb4c89a97049111d064e62178cabbfb34a68db78c8c6edc81b005b4a958480215034a02fa948
-
Filesize
5.2MB
MD5ca6db060f0c2fe03188f81c30fbcd969
SHA1579f33402b68989c7a73d59fcee3c7120df83097
SHA256a432dbbd57d27d8d9f22d6dd516fb7c87590f7385a074ea6f139cf9741948d97
SHA512cd539941f58a1c926160180404645478535465121141b90f30e8226e6a0fc128dc6fe14a6560f9a734c1ea391c3e798c2f615911ce1eecaa8555db330373d73b
-
Filesize
5.2MB
MD5caecddb4ca39a1ac1c93063702df06d6
SHA1df0ca83660060c24a49ee2cd400aa4f4ee2fd456
SHA25664c1cf577dadb5a8a4ffb48d6521c116f0da9f61987192903356011962c67ff3
SHA512140fa0ad49076698ca686bcc2f7d040d1a1ade28a7b18870f8c4fff14c8edba6f5f0f7c4f35690e895c63a3ef5c3aa91ad2ecb883a40380067d3785cc5705de8
-
Filesize
5.2MB
MD53ed5b38dba15cf9a0af6314c3d59d6c1
SHA17b3294f9476fdfe3ce2c21976609d979ae02edbf
SHA256a47bf221fd2c6b0859acc3e8e0bb447304bfdc6e153bd432e761ffb903fe0bd3
SHA512fec62f5a85fc258c339f49bb02c510b3876289deea51da70208c7a943f4b90dadd3ea7a683cf4f025991568eb712b324bd13d0265903bbe50e47291d5ab9c5dd
-
Filesize
5.2MB
MD532d91071cb67dff2fb8216a607f244b0
SHA1943ad8c396750c230b5427676edbca8dbfe539e2
SHA256f31c12595ab7555a05686fbb7ef943bfe05e8b1eeef1ca64ca9da1e8d3ab9908
SHA5124aa2d8e0bc74b2193b4bcd5765eaf1249604ce509d9ff54119213bcd25c44238268cb10af05910a7bfee5e66a8337f1e5522df9fbe7b2b6b3ab71b56f7a32489
-
Filesize
5.2MB
MD5ba7fa1029af8c03cd75309c6a6dd4ef8
SHA1eb17dc149b8b045b1afdd3470a23c858491f3119
SHA2565d5927b9eb7cbfcdb07f00e43bc5a690e6e5038236d5e573b191de64d2214073
SHA512a963e36a3ef53ad72bab22996d0cb7fac44672a51de914e83de65ce03ee93ff8008938401415d9c8dc33f903fb6bf71340cdb5c0a916ab90758c00164ad966d1
-
Filesize
5.2MB
MD5816d216c6be48e4d623f2fae1bee3fd8
SHA1f922535f16ddea35ffafd8552dafe10987ebc66a
SHA2568b296cac4b29dac5b2557bd611358cbe8a6d2c90aabe67e69d41cae0e0e72895
SHA512a7cc0b78b7619bd3fd227aa0016cbd5ca68cb1e7cfdabe2aadf4115561a9e508c75183109cb15fe3729ca7cca40baaac7e6d31d8b76b28ef6d386162d9efe8c8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB