Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/09/2024, 11:01
General
-
Target
2024-09-06_47699abd8f76109283884f46ba8bbd06_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
47699abd8f76109283884f46ba8bbd06
-
SHA1
04905ce48ec3f9b95245a5fd751412401ed2aa1e
-
SHA256
3f6aa87721ba5344ffa5ba7586f569127c866df089c358c393a3c44bb5084926
-
SHA512
478359df446cd38b52dba86cf13a86e10805b5dff8f0d9111bfd4213a06877558294c65a55c43a6831bca1218210877cbe5c3409aded7555030146cf8b2e3b70
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_47699abd8f76109283884f46ba8bbd06_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_47699abd8f76109283884f46ba8bbd06_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\edxTPXt.exeC:\Windows\System\edxTPXt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQWaLNY.exeC:\Windows\System\aQWaLNY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfmDAjS.exeC:\Windows\System\JfmDAjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuaMLKA.exeC:\Windows\System\vuaMLKA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\orVjuaH.exeC:\Windows\System\orVjuaH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYrRsBJ.exeC:\Windows\System\IYrRsBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubKVWbT.exeC:\Windows\System\ubKVWbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nEOssHb.exeC:\Windows\System\nEOssHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\joDNfRd.exeC:\Windows\System\joDNfRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmhZHHT.exeC:\Windows\System\BmhZHHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmCTzvv.exeC:\Windows\System\TmCTzvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJdBfQO.exeC:\Windows\System\hJdBfQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OfzHOzS.exeC:\Windows\System\OfzHOzS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfWrWRc.exeC:\Windows\System\WfWrWRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFazUzF.exeC:\Windows\System\rFazUzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poovkgK.exeC:\Windows\System\poovkgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HaqGIYr.exeC:\Windows\System\HaqGIYr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EVOZpmW.exeC:\Windows\System\EVOZpmW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shVduNn.exeC:\Windows\System\shVduNn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwVZnOl.exeC:\Windows\System\KwVZnOl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raFIsBn.exeC:\Windows\System\raFIsBn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e78503143c9faa6a877b1eda00a57936
SHA1f89535fc9221834aab227b0a73bbd43591b84b51
SHA256172758a04ca86a67ba3a62bd91035960c5ceebdd32c3b841f83242d93917bc43
SHA51285293ddd113a2b2230b08d367b6e9f6cc4f52bc194d14375ef99eb010582d7ce2aea312f71dd92f99178fc61be55d313315e93938369b7b37c9017adf83794d5
-
Filesize
5.2MB
MD5abb0a099d2232c08f75c2a53842dcf9e
SHA10b99d2abed37413bb6d5b2484652adcabf78a41b
SHA256d8cfca5b4b42bbef060db0a384db020e22f19b369afa02b29a0f3bd59dc6489e
SHA512958ed8e7707226d9d83d9679d06612e17740cb422b561f19bee536bbc7fd10ea1735d3e14f3356ab2a9623bc0d030c94342748be4030a0deaf78093eb5474b84
-
Filesize
5.2MB
MD52c22f9cc9e161ec27c04631a9f571cba
SHA1c1996574e2901db7fceebfaadf04d98eacc54850
SHA2565fe4328d2f9c79702db3c4a3ab54996c2a5e9c663b138af3be9fa93841af401c
SHA5122c701c7082b3b49257291d86abd9520588c1d83d74c4e26de13bcac83f00cb186cb424b93ecf923f860c0211b31a3f091b2a12f54ad23a2c7928c203cf8f5d6e
-
Filesize
5.2MB
MD53b92c0dcec4f000732c677d39365bdb2
SHA1f15e1a1f885f7b895e43d4413ca38f08e92666ce
SHA256287d44f886fc3d66ca084e8c655e1a925821f258becd8691b4966bdfe1aa2c80
SHA512705329bac0b2ba9e240efaaa3ea123ea4194175996405178e760d40093d14f1e6cd874ecb7aa1765f4a92fb7540b98b3a1a3ff28b330714f42e6f4823c1b4b53
-
Filesize
5.2MB
MD55af203b89ca4700f55c78625a12c16b9
SHA17a17f2670a19979cc39f11d8980d5729deb37937
SHA256a3dc0d1866dda4cb010bb6a9dabf0d59180caa4eb8e46de5ca3e325f54a63797
SHA512bc6c7a93bdcc68b2b24cb938bbac711b71a743b229bd9a2ab7921aa9f5a740fc9772e52e9039c375b5bbdd4b7ceac234b5f8bdb475462b90da6fb9fcd69c7f0d
-
Filesize
5.2MB
MD5fd90e7be1bd9a7cf48b7e7b2faca64d7
SHA1896d3b875c56c8c7e3383dbbd6784cabc0df9d96
SHA256dc147fd42f6f3f076079eaf7b28a2e193c9b59c944a1f8ecb4f8a1e938938fae
SHA512ac8a737b76a2e889cf646c582e95299206da983a91261d9e933f30f7ed07a3d6ac85be60146059f0b7ae263b442f3af8bc096c5f2b05791c16e85cf0ebd767c0
-
Filesize
5.2MB
MD57d7e1ec41b848d502874d6a2b59ee5f2
SHA1150ffc3572a06a73b346b67b7da34e144bfc9b59
SHA25610063774f8b43019d8e7bea1795e9e850f631c918926203406bcd48157c7c912
SHA51255371c6db94a90d677d1d70d9d8d942a3f0b941057f404740d3266eb2967ef2ceb16e67ed44bb1a4f3e0cadb09c0dfdbc3d29efaa375cc00720b741814e349f2
-
Filesize
5.2MB
MD5935ca53e84df1dd27daa62541e8785f8
SHA1156cdd1236ac043d27365da697784d1cbdb13205
SHA256de7bdc76f82a3d675e59d344fad00f3062aaaabf3b5a897da20379709ad9b1a5
SHA5126fc48ea722c53f9de611a3baa3391bd11e7d4025bc6edc4634161e4e87b4992d9cb4835762e505cde843956efd745208055b8f3e4f5c81d3879eaa39c9e24e7e
-
Filesize
5.2MB
MD53f4901fed30ffe45b622beceef7f26c8
SHA14f3f2ea08bf9922471222640a4fc4c98998cd9d8
SHA2562873bae5fe7a60b89479f5fce7965f624277bfc921fb6c89c554f28640d896dd
SHA51264beda6f1d3a129b6d7531ac28de0f6a131e99d31b97eecf5b4c8e8faba8a474254a7e0ad308d5989e789d3a8545fc4c80886efb01516253a51abd605c060f79
-
Filesize
5.2MB
MD5b622f8a4f8af8dd8b4037b4293ddeab4
SHA1d95bb2a99cf7cbaddebc41c2fffe86c558940658
SHA256e26f87aaf236ccef7feb16ea6c5652dd2cf043b4892e2181d51a8616ad00b977
SHA512e77f271bffa6b1c30e8c1ef519986daace0ff9b40b12c28f1a427e74d56d427148813fb48b8183f194e586d5904b64d5dc9f394aae41091fb9aa102960f2b945
-
Filesize
5.2MB
MD524f146bf6baae56d0d67477a090f74f9
SHA198a7788be9e5e6db1e23306aa65b625ffc1632a5
SHA256c519c1db78d7e96c848bb5a6cd5fb64d7d13b951cc1a907fad74f281f90f11d2
SHA5125396ca2d0eb13a699e35677b13a140ad77fc8e1598b395c791c77e50dd8cf7026375e9b39b97f4838546a47091fc1c9f85c18207a76d3e8420494a9aca6f93f4
-
Filesize
5.2MB
MD50dcddc1b2b56f9e94f7eaffcc118abee
SHA1cdaa083ff920a94c0e4a795f5a7abd27edae5e83
SHA256effded35f7669c4c42384679e998d17832e4150d4f386d13c948b56b87b900b1
SHA512f7447c84df0c7461c46642c63566fbd6426ebdd93eb6db05d6f0cbd45b2841da82ff0b8c7ee103afbfc3caebddbdcc73f5cd6e97ceee87c1e88c42d19888e537
-
Filesize
5.2MB
MD5d36cf0aa7e696350575a52ee2660ebbd
SHA1d99015fc24b359dd92d36a638bf63289e39e1af8
SHA256c1c251f11f38198eeb966905ee3841a3312ec533f026ef54d714ec567fdace1a
SHA512dc5a17bcae0659b6ec6e5a0a3256b848c4d13cdfddad3e75693ba962eae712fa6e6769db155d46163f693647fc977bd5cbd409c1a32d5805c7e15b4c4ad25ca8
-
Filesize
5.2MB
MD53c29a49c9708fbadbe80c5ed03ef5dcd
SHA11d6d9ea8cce91903f7a5a7515b6e933a3f4d8709
SHA256972c88afc236bf16add4026b9ed6d0a57f92f2cfd6273b16d58fc003891192fa
SHA512e1324c670f679f8b3493282d970c0033f8159b36f302cc80c5d7c108def0f9ae7151b2b78ab6cbfdfc21392494e1d7e04f68360e9a3b2fa2ed21123e79277f40
-
Filesize
5.2MB
MD51c1050f4d1c4056d8bd5fbd21daa9b74
SHA15064bd4355548478fc307a7a940485ce1029eb3b
SHA256a4dce23024654707e3ea746378a61db5d34acf51e0c99a96e210d8fd8e389b16
SHA5128b80b5580022da7d5545d0047cded84c72fdbec145120b6f39c282b51772436df0337b926c9c564dda22a9206785a2dd029a37612d376a4d893bd1af86aeaa37
-
Filesize
5.2MB
MD5acafa1e9ac5ee8027ab8f7f3fffa73ef
SHA132fc3147d71a2f0de1000e17d34b31f440ebc499
SHA25644eca5abd03967b87ab480f325898e3323d6f68111a1b21a411715ccd2fca344
SHA512fe20d388072a7f51266e24e51d322ae6bc572eb72a0689aaadf76ce28419b5287383f287bfc5f6a1e06b2dc13eacede2df055c7c86cc966df444b22a4c2c3f55
-
Filesize
5.2MB
MD51a3e7f7254559f3fd34c6069276c244a
SHA1b27b118c06c5d02cea8ce47c8dc1f16b0f323d4d
SHA256678d3cc46d3839d1a857b28b779d34debb8701c3bfb04f1aaa96e70d2c4a9cb1
SHA51262b1b21be93bc823068233f518b62fecd30ddb644825a58009629d13e5295c895e5ae3c5f04015ab8342b9a53eedc88fd9a2e12cd535c9825b5d1b1dd08970b0
-
Filesize
5.2MB
MD5979ec9f078446901fdbeaa0c97adc8f2
SHA16fba4c9a5b117fd68992a2724c7829e039400e99
SHA256ca64932f9eb221c79f124146bffda236a9a86c485afaf7d3ad7d214f5dedb7cb
SHA512f5318df6a5c8dc7cb09e180dcd3726cf4d8b70c2a64428fda19bf71e8efb8a42e24958a99485d71b15a9d0d5806cc7c241c7d852ed3a478d1536c1fba4efcee6
-
Filesize
5.2MB
MD50740d58320666b49784eecaae9347446
SHA174e4c90f49fa3174c70dc24bf7a14de64da0a67a
SHA256170d1c1afc3b0595502c4d414b743422e3068c61a22e390dbe04ce106fe9ff08
SHA512458e15100c184afe753d3241cba7ef81ef3467b2917352c4869d8b3335c360731add12ecda12369c071de634d71f1359c4f1467c328fec32930639a907e5131c
-
Filesize
5.2MB
MD553332cdba16beaa046d9f33dadd8dec7
SHA1ab5e04468bafc5d9ecad0b519650d7a04da6d3cf
SHA256d1831cc31c67d959ed14195756dbfe9f2491d72a8f3d3e982f8301d7e3cb55b0
SHA512cb84d813e56f989c8f6288e4477186ed46173872b3962b28c7b679a06ca6a2c97f95da1f85e1ca95b237ecc6e187e52dd2b90b326861f7f0af3e28f1b411d60f
-
Filesize
5.2MB
MD53c681729b0dce735e333bb2fa47c4711
SHA13f82ba4b521dc4547ddc0904c96b35fe716ad045
SHA256be2f5958e46fae8879599f10c59d528fc8e68478dbf35cd051b624189e2fcf75
SHA5121705518bb2adc16561b96617b5022c12730afcf8baf5820f4dbd8dcab6396ea08b1115330621db3e3133a585bdafeaadaaaa822ba8574487c0fd083361919553
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB