Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 10:09
General
-
Target
2024-09-08_8726882b7c0bcac8a0d5a85f95ab8e80_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8726882b7c0bcac8a0d5a85f95ab8e80
-
SHA1
2509ffc945702365ab7ec8d55501635bbb258167
-
SHA256
b870887edf730f6cebac8d51dc5b3736134a3da20122de9338daf5fb936d3846
-
SHA512
1b9f6abfc2c6f4bc31467bdc229254ddd8d72bb727b3a2f76f0d2d4c9447bd0a6df6d655bdd11aedac22bda74c92edfea7ce6465810baa7ed761cc86a3040dbc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUF
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_8726882b7c0bcac8a0d5a85f95ab8e80_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_8726882b7c0bcac8a0d5a85f95ab8e80_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nEjVXIp.exeC:\Windows\System\nEjVXIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUtKJKb.exeC:\Windows\System\DUtKJKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oKTgfhj.exeC:\Windows\System\oKTgfhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ymnHJWH.exeC:\Windows\System\ymnHJWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKlybrg.exeC:\Windows\System\rKlybrg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjTgxyi.exeC:\Windows\System\JjTgxyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HavFgnm.exeC:\Windows\System\HavFgnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fpKCvOb.exeC:\Windows\System\fpKCvOb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJZPYQp.exeC:\Windows\System\lJZPYQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WtviSja.exeC:\Windows\System\WtviSja.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mEMXyyl.exeC:\Windows\System\mEMXyyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EzzrSrw.exeC:\Windows\System\EzzrSrw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FaOjbYi.exeC:\Windows\System\FaOjbYi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KgqTCXa.exeC:\Windows\System\KgqTCXa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cstakvt.exeC:\Windows\System\cstakvt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcaifNr.exeC:\Windows\System\kcaifNr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOrdPiR.exeC:\Windows\System\nOrdPiR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JaEZLTn.exeC:\Windows\System\JaEZLTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCQkVRa.exeC:\Windows\System\NCQkVRa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CKdtCPi.exeC:\Windows\System\CKdtCPi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SmoRwWC.exeC:\Windows\System\SmoRwWC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c2b80fdf7627c32e7c0ea9325f2eedd1
SHA18bcd39a32da9149c3f1ccbeb1c240e200041ea4c
SHA2569be8d19c444cf38cee1a1a0a8a97743183d462330fc14bcd99ec43dfc3f0cd7f
SHA512e7a4d09e9ed80e6fdcde60fd4831ce10f6703cb7492694f725d3dad9e5536b299a0e3fd8ed8b2510a73cf29f972104f03f5caaa1ebc6cc1bd5244aa45c6e5d30
-
Filesize
5.2MB
MD52c60366042a768b3043e70584e5ff0ad
SHA17c1a7575d5bc6a053c6c905b709f4110bdc93b79
SHA2565c158228de58de81b33ead60c56cff10d3d9ab48edfad22524c506ffe12849a4
SHA512088906cd651745dd722c5f027de6a253e07eaf44f265e6f73f847483cd6360a6ec67124c512dc4add95648bb50fc3067b854387a83fa4a2e598c7548d6e20942
-
Filesize
5.2MB
MD57db5f11f74c785b85f8ffeab391e14a2
SHA14ff96f5bbbac8a495291ad9754a84b807997f169
SHA2567909f559d42ad5efa731ab72375a703ddd4b2194a7c8e01ec04934d22db7d122
SHA512a255773175b77d76dcd112b25958270520f22442c67cbbd1c4900513609e7a44990cec735559e26974f7f1a1f32fb0501adbe649404bf249784f3f1f17bc8232
-
Filesize
5.2MB
MD56273a3b6ee51bf94829f1283f43fb2d1
SHA1481dacb16e43fcfd27bc6dc0939839c1de34ef54
SHA25635156384a668185353577fe3cc6a33c58e17eaf506fc9149f04a06447b738b9b
SHA51240f0a0ed258ea87ac39c06d75734647dc4acdfcada77169a6407faf6a3debeb745af464786aa3cd2912700cb4075abc7f0fafa80a3dfa8e80fadf246b41c28d7
-
Filesize
5.2MB
MD59319ef03f62ac6dafcea889da3c90eb0
SHA16d1240e55030c8eb48347a26ef5fe872b4f586c8
SHA2567a6c3b4122778a9c38efa1cc134a43f0ba2c0795e403c28ea1341dd6b125d486
SHA512080e81300b120a2ddc0addcd6567d40dd57c79d6c96a37733632c29a468954db29bf7efb4aeec79ae4b1fcbeb5f845eaeb11e86be90bd141ab157cf05ce41b20
-
Filesize
5.2MB
MD5cb1a8f41e57fe08654439a114b5184d5
SHA150d8bd793170fdb88ea471f1ec1aa27ab4dba8a8
SHA256880bb10171d4a20b6f834778a424ff3db6d59b36a0c945ebe47a9bb36ab6fb17
SHA512ebdfb59c7b020b6f200a101263efc0f702f82f04c4da55a100e09ee4ae6389184f8d50165f3aae2df89c098aca828a108a946f6c5b57082cc38a78b138368404
-
Filesize
5.2MB
MD5e1f35ecebab9eb7b382452555f947540
SHA19536e57662d22c1b19828eca028eda48c5be73c7
SHA2565088b58930e40c347d69895e29d2acab667f665f8df3d9fe57912f34152ccaff
SHA5129b9cbb0ba837afbb650911e26a483c84c7e59dee6dc45b962db3f95a6b5356b686bcdf85c012fc208709d1d356febca5196522a541ca79c9d780d018e05f91a7
-
Filesize
5.2MB
MD51e2e98609d6a474b2a3261b0508fcebc
SHA11917f9425f95005a0fc2fb7627f272eec703adb2
SHA256e306eba5ce36a551d5b9555624dc9b2b4cfe813296ef8252f70cae903e033b00
SHA512b97848d1aaa68d492303c58df76cb06657ad6e5c6c1c604cd08af20bdb89f699cba6e4c8387ca3145294964553395323d4e09396b33ced742dd8050a9062d56b
-
Filesize
5.2MB
MD56da8dd22ee85c3c5bc72e999d829fb7d
SHA1cf3d2014c684aff6bbf55b50b715dd367b5af7d8
SHA256d5d19f79dfeec87d14016bb38dcd3ec6f1e1378a2debafde19fb93a968af77a9
SHA5126d104abf5d0a80421bf06b0044c93ffaccd1290474a310fa0c1f163b1a96d116ed0b367b6a2599e42f5c1273702388c0512d883e4cf2590fb56851861a1ffee9
-
Filesize
5.2MB
MD58d354aa2a0a5ea39901fa6a20d5023cf
SHA1c0f0159e35fe6a5741edf84c89bc2404803ad4ff
SHA2566708c222607030b72ef199e67fdf23d1436a8e4b2c589e134a773f320947e1bf
SHA512c18b526460a289c2b3c307c8f69c6067a8f53dd3653b2633d3eb5e959240ee4524a9ee40b792f827a6e49887b7210b61b9a5327003d77ac3eb66c58ee044ad68
-
Filesize
5.2MB
MD5060cfba4701b757bd59d2aa142d1ed25
SHA1efdb8606d91c83fba3a1d8579e901d63436eb0f4
SHA256df5d200f17d28e23190c1aab7555baff89648e75b0d48ecd674f7029b414c7e8
SHA512723cc09364c7390150c17494fdce02d9e00ef90807edae5fa8a42f2071c54803ff341e11ea66dfcec7b110a0fc822cc7f6165f9121ac7296b09157c21fc88ceb
-
Filesize
5.2MB
MD5b09b863dd72886c0e1ed588cbd4d178e
SHA155a32c88d1c376def53ea79a77ca9f9a5a9c847b
SHA2565af9c9551cae1ad2f16174dee5aadcd55e0b39c1513ca48068ca323ffa4a760a
SHA512e60b164f47ce257cbe4f2543b9555282acbd5957e6d97c58c8c24ebeed2a7355e7680c7745bb9e79e4cd386bbcaa521ae9a2712cdb56ed253b01e9cf90ac7737
-
Filesize
5.2MB
MD53ba31dbcc7af2ee4fca8cd1f3c933736
SHA190c4ee57765b2ffff06ade49bc32c08dde3455d6
SHA2563a5f32c1c3b9ce86007d11fa856e5319eed0c32da323d6570ef8615e9a0627f8
SHA512d3c41221e8452a64ef3578825ac5b2e96fb96908a3111f633f15987bcfc7bc8a126e9eb0c9b99ef4fc51099732ed214b8b267eae4ef52f1d179708e7955d951f
-
Filesize
5.2MB
MD53b360119349150476f70ef53b4a3bc70
SHA1cc52715c11955e6b0dca96d14eb3ea43aed41b22
SHA2561346367fd8ec13618e9d79fc9906986ab2d51c4ce69cdae077202808d6e06f89
SHA512d7a8f2ab10e82f3a9f23caf39b9a710915bc20810f52252ef6e3094f3a92a948b386d0810a8a3a43963750050e9f55f94964b4a4377562f3b7ae4ae72441a78e
-
Filesize
5.2MB
MD57cdcc676e1269e5c06eb4316eb764582
SHA12e55489332be5f6bc0e4e7874ea13be5988cd073
SHA2566ef864ef3dde4d108e0ca07c8aab315c8346fc38d642a3a4bd249d48ee55052a
SHA5128f4c20f4e119c90474bcc007e8bdc627a402f3f052fa6941272374f4c165d8fce23d2b0c4c5b02e33ec8cbc9a050df1178232cac21244b45a44e144e24bfbe14
-
Filesize
5.2MB
MD510393b5e5819a38b16e5c2e6a5aeb7ab
SHA14991ce0b39d468d66ad635af5d152db706accbe7
SHA256c91d6d759ebbeb72db746aac622bd9242824b8833b6521f872f0227b5f75b3bb
SHA5124dc200c29f23ede505e5cea14cb29ddabac2264a198abbea459483ab2b4818cb0a50cff29cddc14f1fcb2d6e1c08584005db842f93b5e8d0413c2db9115ff957
-
Filesize
5.2MB
MD56351702060c76f50e907987f20a9a2de
SHA141f127720d35b0b1d2846a19a9781f5b7edf603e
SHA2560d91c325b5a356bfdf09f529a7dbb49647d68e1e43ae913e0d5945aaace108b9
SHA512c857b0fbf936f3a294f9747d490bfa635059fd116f7b141acbe780bf8b04d95a60cf5531b3291826ad1238f0cb788c33b6f02407a76106b72ec5bfb1ffa7e106
-
Filesize
5.2MB
MD5bb929f45e2b4763ea8aaf4ff1381563f
SHA139fdd09aa638c25eb3f4302f59e2cf41ba5b3e05
SHA25615351014473b6360d832b4f893b94451f0c9401399d34c62b1c0e13e0719f2f7
SHA51227d66eed912fd884489c2819a5c07614f01e595b209e95e6a4bd6ce9dca35d6aa608321bb95af424aa034d5e50dab45992dc855072ca51da324d959c4e2173f7
-
Filesize
5.2MB
MD560b7d6ebe7b07d322bfe3d45b948d92b
SHA13223dabd890ef03e4981d5e848d250f71b4e34f2
SHA2568025851687a2150bbacbc06f28af49f86b859086bc3c692361c9ac080132f11a
SHA5123b02d3658bd9e568e30a0f0c2fb85680dd731b06698e098709f923ba41229b48a3f7d7c55fb3c1d251eb99c5c1d4504e831cf2519e03ef96db93186657e8cc2a
-
Filesize
5.2MB
MD56b60c7185c692df67cded6481d988c95
SHA1695865a354dad8fedf1862b09be78ac762776dea
SHA256557177e09c4fe2352be9786c4f214f4db2d5028751d686ede120dd72a18391c2
SHA512c95310423d23c20f77f0708dd2414f31ddadef0312b43017038d0e4c97d18028967688536f6c744734eaaa54e6a83c81e370dddb6ce8ff58a38a8cbf3221f32d
-
Filesize
5.2MB
MD58d911972f5a60589d5e72cd79a1dcebe
SHA13a9555d7699bd646c3be079e050779e1bbcaa2b9
SHA256dee6d6532b5bf4f9d0a48b6bd5ef2c3e9e2d8da94f7edc70aeee4cff8d672df6
SHA5123acaca89718132c12a1110bd4c56c6b3c369854c5a1007f63e87d60c5dbfdec5304ac580e25da0452141814aa272071cdb461b060bed79694bbb18a539ee9580
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB