Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 04:27
General
-
Target
2024-09-13_d5094982bc8de82fd5c3b394c5704daa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d5094982bc8de82fd5c3b394c5704daa
-
SHA1
b13023d30bb50fd1fe271a8d8c5e968c76b2a921
-
SHA256
41f7635af1e0bda8a4521d45f8908268dd5d47ab69cb592081cf0375463b57e7
-
SHA512
3d0dbaf875a870ef2b6961e3a53b76df777af6365b17b48504008b346c1c8f3a2ac6646451008b4965a3995200912e57910cf877e13dc70d89c5519395bf3b0b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_d5094982bc8de82fd5c3b394c5704daa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_d5094982bc8de82fd5c3b394c5704daa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gnWpQhD.exeC:\Windows\System\gnWpQhD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YJYSLhA.exeC:\Windows\System\YJYSLhA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVdNGIj.exeC:\Windows\System\rVdNGIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbbKSiE.exeC:\Windows\System\pbbKSiE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjKRnZJ.exeC:\Windows\System\jjKRnZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSGRxwh.exeC:\Windows\System\LSGRxwh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxXNPDd.exeC:\Windows\System\nxXNPDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dBbhDqg.exeC:\Windows\System\dBbhDqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UKDQzei.exeC:\Windows\System\UKDQzei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEIipxj.exeC:\Windows\System\OEIipxj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWZPfxd.exeC:\Windows\System\rWZPfxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWTMbEK.exeC:\Windows\System\DWTMbEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KMbWdJI.exeC:\Windows\System\KMbWdJI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLCCZMz.exeC:\Windows\System\dLCCZMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdmRFcV.exeC:\Windows\System\RdmRFcV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcDKGaJ.exeC:\Windows\System\PcDKGaJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxRKANE.exeC:\Windows\System\OxRKANE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIgKGVC.exeC:\Windows\System\xIgKGVC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKzBsdo.exeC:\Windows\System\WKzBsdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GsqDcll.exeC:\Windows\System\GsqDcll.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OeGCzzk.exeC:\Windows\System\OeGCzzk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f5e6446093d3ab2124a70c0aab138d08
SHA16d3314e7d575a4d414a5d2f3e1c78723af0f21ef
SHA2562a94b0fed0ad1dcc59d85f6d6dd3cb489bc9cddc911f1ea9b82bafd2c698f73a
SHA51206e4748b6b47178213e3edcd366ffcf458d2f2eb9ef52d65e67a9c198b3a651610aa70f8fe3256d1e14f0cb9d8cd5bae47cc1a6290f195786ad19fa4a0d965cc
-
Filesize
5.2MB
MD543d791b16ce2ea4361c7e4e233a016e7
SHA1c350060169a173036febd36b6a3fc4d57cde98b1
SHA256a64f604a31333f3ac1c9021e1ce698873a3eb8bd1a18fda486e5a437a66411da
SHA5127aa37c32025c9a54de9fea6c1f193d6a5782e25d2d6d94c0cbb8a9acd642d167496c1bb685bd80e03d1990cbd6ebaa6921df1a7ab58ebf43d26f3f2c69c88163
-
Filesize
5.2MB
MD55233890fb42a19960bcfb57e243a0291
SHA1ce9ab62f890c34f0e54ace8b82ea6ccf07423e5d
SHA256d6b8fd3de0accdb09424842344172e99332be300c50a43e02dd1f0d81dcc62d1
SHA51272670f96e99276e61078c9d84acc30f9a700c401436e3294a0779ac6fecc276b1e33be6566e016db8d79778d3b07e21164120094805f95dda583f290ec4ea52b
-
Filesize
5.2MB
MD55edf1a05c8433ae0b3e85bc43e4749a9
SHA17ba51ef9a24b6a302c3bd520b4ed27d9fd4b802d
SHA256879d8c4add9302f61801f426d42ed5fd2623192344e26237afb7a87a225d7775
SHA512ccb1dbe11b773b82eac8db6f624eabe0480cb641bbe296e54da960ab96a6df46477c54945a1945c12cbdbf057c6f352c43fc4f5f0105d924efaf4bd3f1e2b89e
-
Filesize
5.2MB
MD5620378ca2720761748ee749e522ce536
SHA10851b3a02b3eb7866ff2cd5215d78f31b5bcd429
SHA25689413b5dba52a1d1311c1d4707f4e85d640180945a6f4deea86d42f077d8db27
SHA512e5343bae331ab48e28ca4c06bb68f38168e893565790236fdc5784bc6759209d3722e83e42fbe3ee3adcc85fa4ed8e41f81428c476426c27f3f87d2b4afcf324
-
Filesize
5.2MB
MD52e8394b22fb91a730b29be32e75d96cb
SHA10d0443088ddedc993dcdaff998034ceb5b6d74b0
SHA25608b67c6caa469f98525939001a1162d137259371e891fbe32b3b0a46beb35361
SHA5122af1081d679e7782e74cb0527bb089f1b298a6dde912f4dfeb33caa17fa15059c41452a8635dab4e0edcea88a5a0bcbf26d8c666e70957ced377963f823b6400
-
Filesize
5.2MB
MD59ae4df440b5212845dd7c1635fcdd993
SHA14a64873a048b68ac601de56f9e178bc641a1b028
SHA25604ae3839d697cf05bb436ff1f801c9513ef5cc2a6ef7821ad17c599088a2ddec
SHA51297b499367b853b5b83113aad1b120a483aca47f30f6c621db1edeb92ed5c496d8300add2d81177642d3edbeeea3592ad0e5cd29e4524a8e2e063ea873ce9828e
-
Filesize
5.2MB
MD5d65c481aa8a678f90fa8fdbdced870e4
SHA14b6e785cde86ac7ee4807ee8d8d0cf94025710a3
SHA2562bc31c3d6b5e7294975658dd73ab67c29b624366930a5aeef644297e3def9281
SHA512c2ffb4a9a41f78a3ff5b2be643c35b23cdf27d947c503f38e77d32e72d767484fe6c27d0ec228cbfe7d6747ae36bf9bc6a018e168c5d1f2891bd0c442d3f44ca
-
Filesize
5.2MB
MD51101a3dc446a0a27767aea10764abb2e
SHA1951f8ac3cfec37e7e3bd55a94e12d3430287b156
SHA256724d3939b5e9e31134d91edc7af32e977727a59ecd540af04860b67201f18ece
SHA5122cd9a0122d19e30c8934b746d13a3c01aa3788b03ccac0e63b6ce77062a7c628ec229922a69895287a862d89e028595820253cce41cb758d29d4faf4094e0d80
-
Filesize
5.2MB
MD592218068fe12226048369a0e02450d53
SHA1d8774bbb5971c0201ddd6f55bdf980400281d37b
SHA256bed10f560b49d7396b148e4b0c80bd7b3bf788c8d41e1455220fa79e73f06ab8
SHA512314cbbaac19b365ec85cb499a0578a27da2bfead05258fa89ed7af9208a0f28b0f6484a75f7300726ba126792dc6f355547b61f2baa4ef1e6c15ea236964fd8b
-
Filesize
5.2MB
MD58d336eb1011ccadd6e4d206c3da74875
SHA1296e9f2f2c69e3570ca591d811132c2fa88f5fa3
SHA2561b49bdf29272cfee4f12d62559df5a0eb4b91457a67b9686f6e944a5a805a48c
SHA5124a62043e3606c62ace656d0d21a9232064b65167af85c9f1cbebc90e190852f575b1d3ffa40f9cec2f4611ffbb32012ab7b6f4f32c313a71b815066d77350f65
-
Filesize
5.2MB
MD55013046301dd0e0f0600829bd693e98f
SHA186a940f4683bda49a3b3d071f446ee077b09ce91
SHA256d88659d8a3d43e100d134f1c38fc3c5dc0bf336dc061ac60f7977a691b5da148
SHA5120b8756d62d2d36caab415f02bcfc21edf2d4034c7b064b13b0cf6c789d5555461adc0407eb6faba6588616c69860f2665cf59829db5df818093e4b4a479e88b2
-
Filesize
5.2MB
MD513fe7d41f6e787b3b23356395af624a8
SHA1c1cc6b4ccc1e6425143383ca5f9ed6d4f9853fd0
SHA256004336527c37d4e41ff9a6ebe5cc564980d92cb48028a15d089582b05b98664c
SHA512d257f4e7788e36bea8127440599296274122a89e1834fcf1a4c62da90767e32659dc4c91c720a25d5da795b196495005c879bf2faaa2afbcd4d7a9699865817c
-
Filesize
5.2MB
MD567f8e40f2bffa5f1e02082f526bc79e8
SHA16a7a12665fd8d643901225a146d72703a8ffdad8
SHA256ee95404d0529354c8546a1f1ea4817cd57e704edff6157b6b7793e4cbadce83c
SHA51285fb2b1ab1c87a610076d3ced883f4a41d28d538d016e0e6709e2aaf91a8216a75bd0c7839cbc226270aac16b8ef44ac29528558d491e7d8488939c807d14f2e
-
Filesize
5.2MB
MD5ac5229fd06cf9540b43ab0812d52b90f
SHA169d36acc24069a34cb18f3c38384d232820b96d7
SHA25638245c1d2bb7a7dd3c97eb36c2c27684b467f1cbeef2fecb6eeb76a5b5fe2f0c
SHA51261ca775120ea77ccd8a82d63aa4c80295b0e7b1160d2b467111d298b536c49da08e343233518541a69662974849476f2cad363a6cd654257e09fabcef80d9440
-
Filesize
5.2MB
MD5a83b237bdadbb478ff7d6fa32a09e37c
SHA1268a3db2ff318d873fa97b02e50e543543219dbb
SHA2564f3bce868b91ce5d6a52d817737bf5fae541d069bd83dd1144d092861830131f
SHA512ba6e6cd1884b779c0bd2d5e37a789da5f19264fccf66fd66a31243380098184e8eed59d6575e6d2142953117d1628102e800d0c2103960afe32ea0c3bbffd2bf
-
Filesize
5.2MB
MD5fe92fc60d7f73730f15907c4b15da71f
SHA166b93aed778501d3a24de022f87e9d896dd1bc6a
SHA25603bc7a7efc9fa415a2e45c0631a3c7c37090824b3653131d740d62db9b2bea1c
SHA512b0ea395655f1114cf061a56e64062d6711fb809adc7f1652170e2dec1d1d0458c32f42102409e22a1c6674d34610cb583e425edf2f104e6c1cbc5e45cf5baae2
-
Filesize
5.2MB
MD57d57e5af5b772d59c646aad2bf74592e
SHA186b09e69bc1dab00f2e63a7c87168f76b1c848a1
SHA2564fa281ebe91920e1f62c6c44cb9a0fe1983555e20e7f15c27e1005f68ea3a834
SHA512e6d8a656c86527d5a3ec2e601d8c77188e712a0149b0a7316b0bc9bb2431914367cc4daa0a7f93ee107b800ab984d103cd556ee797349713a0a4becc7675948d
-
Filesize
5.2MB
MD55b5d038e795c6a34acdef2f15de24ad2
SHA1f5cbc6898aedf73f4afbab409b04f154df760741
SHA256a9bcdf6a01285af136eabfd6b9408b1386af8b2169ed0d6194f3837eae62be95
SHA51269a431d70cc055f73fcc12cf02930128475f7abfd36a66823db7e92dae993454abc4d4edb4bc78d0d288c57fe2ea4211b01e6257c9a6617a81dad2b8faae8e5b
-
Filesize
5.2MB
MD5e20b77f798c45f31b94cd41636528d6b
SHA1bfeb8bd6b6ee146c2e7f23cd81bcc52d3b1f8b58
SHA25666edcfe9e97510131919c8ac072d55b55a76a1931d39fea112fe19bfa21a3f41
SHA51290b5c171b45050b783162ab62a8a154f05cd7df3c2ab7c7f52f29795884edce761d37d91b27bc46761a6c6620ea61ed6bd5c1fa91f4b4929a3c080cb8ec822ee
-
Filesize
5.2MB
MD51ee558ba08c4cf3cf53b6a71e403f4b3
SHA10ce1b7d544741b1e68a6d274d515e90d6f06d049
SHA2565e4cfe0afd812d1151abea9b956350089f327ad95826b6fd2dbdeb7f4c5541db
SHA51280c915a366791e789237b8accf32b2ed9b84010c948e4e98f357e52c25020d631551c32b08066bf97a950ee99a810e609b348c5ae4f55e01d187552e356f24db
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB