Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 04:28
General
-
Target
2024-09-13_d53d823b4e3e252082da4432512f52ae_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d53d823b4e3e252082da4432512f52ae
-
SHA1
632a9edd0d49aa29ac2a27586255532f7f70aa4c
-
SHA256
8a0011946ca15f6f45ee5748f8a1b61b31b3b20740f0dc693ffd7b45cbe9b648
-
SHA512
a8c33186822b86fdd37f6f4bbd90e7b8e713b3046b74d6825922e1138e533179c875d7e32fd7016c7762a450879819b3ac69fca7d5f70711b7913c8d1abde004
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_d53d823b4e3e252082da4432512f52ae_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_d53d823b4e3e252082da4432512f52ae_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gYHXKYx.exeC:\Windows\System\gYHXKYx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VgZtlod.exeC:\Windows\System\VgZtlod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ptgZNUN.exeC:\Windows\System\ptgZNUN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\szoLnQt.exeC:\Windows\System\szoLnQt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TYfvWye.exeC:\Windows\System\TYfvWye.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dforpAY.exeC:\Windows\System\dforpAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UUEQxtc.exeC:\Windows\System\UUEQxtc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOUMZoq.exeC:\Windows\System\aOUMZoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msXtmZp.exeC:\Windows\System\msXtmZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uscIobP.exeC:\Windows\System\uscIobP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZWbkzlX.exeC:\Windows\System\ZWbkzlX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Neepuos.exeC:\Windows\System\Neepuos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TosGQKJ.exeC:\Windows\System\TosGQKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KKDwkhH.exeC:\Windows\System\KKDwkhH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\enQgXHJ.exeC:\Windows\System\enQgXHJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZOViWJJ.exeC:\Windows\System\ZOViWJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfdotOF.exeC:\Windows\System\LfdotOF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcRQvXE.exeC:\Windows\System\PcRQvXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atIbBis.exeC:\Windows\System\atIbBis.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwpOJqp.exeC:\Windows\System\hwpOJqp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\roQJKjf.exeC:\Windows\System\roQJKjf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5648d475ce740c3582df332996e73fe9f
SHA1b1c2af1d6d32efd392a9d304e8e69de7297c9126
SHA2562899892a24a27e9d4da4829bf12ae711a55ed1944ce566d08a813a76648d24c7
SHA512e6c3bdc2f66df0a6ea0d88d5ee6b8c4b01fcdd86c7a221554f4c6057678b80b2ada23ab857eef881b6c6b705b9733b94ea528efea0d4ce1de3053cb738c2a628
-
Filesize
5.2MB
MD5b321af0b7a931fc47eccce44ce7f3904
SHA17cf2a75f253e78a36cd42235e6c4e8b6ad91b591
SHA2566473a7aa15538871aa4c9b14d472acda665f2236b311fdf376dca2899e2012f6
SHA512a0af232cff8e3d15a0982f44f1e50fd5923d36ebe3a6873f9b31d9139fa073cccee27ead4cf0ef78b35816bbfb615e1b72142af25e847545d5dba51b64146e33
-
Filesize
5.2MB
MD59c0d589328a45a9ef122113f5355b117
SHA11e6664a6716c2507b5791eaf3cf69a9f52c7856f
SHA2566783e64bbb88c5c4592a692117613743b0cd3a0bf5a9de711c05a315e850a825
SHA512745a66ae3912f2f5f0b4c78ec03f712b9e8e0a59d7b2a6c2fadf5af694c91a5a1b0fcc169b8600b44f320164cc3025e94b5f8a438d30dc86e67404046277b613
-
Filesize
5.2MB
MD5e78907608785f85dbe9d717cf243754a
SHA1058abab1b52f669264ebc7ed8a66df83a71a0450
SHA256ac143da2c1adf4051a77d02849a8007f8d6b49e216b50d0dcbd9d81cfca74cf1
SHA512ddff12b909f8877f48361638465070cca89d6ed3f31e0cd1331096ec08387e0672d326adc96fda62644ded51b87cdfa2d6f96f6a7c15d7effbb21b214e7f7750
-
Filesize
5.2MB
MD5fed9e4d38bc011f2ae0290aefd5e14c8
SHA11c8633acf4d3c9b4db6ab62b0104c113d098f7fb
SHA256a6b70f3beab53e74de5127ce6ace2c230dcfc94f680e2ab135061c5a6bc3c8d9
SHA51217801a5d2200b389cac6ee9db5e9c992c50f22a7b2046109e1ee0d836431b362e8fb7259c6ac432f743689c6ffa6bfb27c6abd49e99778e8494ee4a2b5bc6a4c
-
Filesize
5.2MB
MD5a97ad3aa16ee7cb5fe5750a17d2cc1c1
SHA10ca8a258a145da5c2421a67f81c4f679a75c1451
SHA25687017c3b7e07b610a658fc8a5a3a0ee71c94c98d31f54cb59bc21de08add9c2a
SHA512963ff1c9a150164e71115071799db5179fc04e971e4b629b0667f615c8a56be7275a3ef9853222dc04134e03c5ab4f4f612b9eb4244f7689ade9c75be5c20946
-
Filesize
5.2MB
MD55e519661aafb7de15df5796febe84394
SHA1ae678225072c91641ca4a34c97d82867d550ac93
SHA256914634d1f534b296eda75ed97a0bafc66d8ae7994a0292b46b703f13c08f3a82
SHA512dcc643956c56f3ffb9d1927225a87f97ca343d6118012aff895384e1e1463b3afed0802538f7877173e73abb4fff557ed8c1459e961cb1627fd1a949bc073cad
-
Filesize
5.2MB
MD5a18d3f2914a65a3082505127842c8043
SHA10ec9db7cb45f06bc2ce13949c1270a512a8bb457
SHA256a6a72dc350003782d9be3457f7726a15e9aed16f3c492ca615b12178b32853e2
SHA512258c6d03210010a6c4595af06ced0d788e2d6ba535698273c1a775e963b60e2a4b7c76d52053c3ceeaec339735c2cb1469cd9434879aa4d214b481398797c15a
-
Filesize
5.2MB
MD5b4a9cbd6deab801cb6c2aeffc2d23142
SHA1e65cb1f833ac4b41fbc374d70ce9fad7756a9082
SHA256b64f1091e0e9d412510ba4a5970b3d4d39837fe2dbf9bd4b161e712366729cf6
SHA51240e69c72c4fee7ccda7f5b63eedf76ce3b0adc9e9ba856c25d576cf93f2cd3b56f74dc8aace1e44b73cf4e896c6568eb9b929d14dc23a259783ed728be9fe43d
-
Filesize
5.2MB
MD5e5c3e5f9f39f7df884c85b7266fa07b0
SHA19a2cae3142a2a36e31c930d227f032b579869646
SHA2566694654b3e94760a296faa583842ec96cc336473be9c2b49b926296e48bd8d31
SHA51205b645fef720e7ef55eafe1d5121560d4d063f92f9b8d24e19fbca07b3927816afb511499c4271e08f0c669e6bfa9f259fe716434e53f01ac2abcd169d18d2a9
-
Filesize
5.2MB
MD562b8ecc33fef2eb8a80af051f7832d2b
SHA10c53c5cb1303fb660ed160848a9876a20064e508
SHA256492c857a96ffaf25180e4749a884a18e12dad57b4d84fcdb97e20efc2ee37a45
SHA5124388bd9b73bf938f77c56014efc1c325fac5662664f7834d72e4bb875ba3de364dd85889059df1ec9db3f7f46c6d5c96026fdd532ff6ec38b39316474a6c8db6
-
Filesize
5.2MB
MD5dfaa77a9a9b251a9913c7f4736eff9bb
SHA1afd55ee587ef09fa0a1c99d0464119475b8ff0d6
SHA256ae35911dca2bbe41ddc96a38d6a1b6f4931351537ab9869372033b11d2a41026
SHA5123d930e0e8f0140ac711b5479a3d1148c6bc5d4fd31456ae67a2a37497ae4b83859a8c48f1e9b55e86de031ea7b04f6e680c00c90c4f1ddb489c488b833001c99
-
Filesize
5.2MB
MD59010dfc6fdc4776724df89a1c0e0cb44
SHA1058a09007de745037240757c877d856a410ef77c
SHA256ebbfafee152142471b48967e1efc1fca16394ac0a0d7db38ffffefaa4572b29c
SHA512754fa15a5777fbbb8004a1d1eaf4bd383a6e7aa26500dac00e93fec418c35e326192037ef557d9ed964a129cd279a34aa17b2b64913470e15aa8e08b3a55b959
-
Filesize
5.2MB
MD5b2823ae39a8843eb19426c22dea920d3
SHA17dee490285928129a092ba6c1a26057ad643e920
SHA25661f6b74a8758090c1a5044b61cb11bbe7ecbb40a28ddf5814291554c14c58a67
SHA512fc977eebefb88e317d2196fa71e20e16779190f156b82105c06ca9054f56eee12e1dbe739c5615f1809a3789c3e4b7200eb6b5e76c401006d79426e618982bd5
-
Filesize
5.2MB
MD5b172c53a9db3640aa5038f73653f3493
SHA1f7f98c8ec97edcf1295fa61740df3adccef1bbb9
SHA2565e208ad8fd0b1ac0d96e539c2d0571c371a4257b53b44ee7095da85b609aeb0a
SHA5126b7a683ffd8822a31f067e60de1466ab877bf5582da3453f4b3b7c940b496d60336a504f27a6a52772fb889d5b1ae18012113a9b22a5c6dae35862eb6e3719da
-
Filesize
5.2MB
MD55cdd78d0cf0bbdce18abc1ff71b3e36a
SHA156b3706b0b6cbde2ffb3e0ba66d96d6a8821e4c8
SHA25643437412d4a0349462c80aa534b7ed104d1e69c3bc0db0cfacc4f93f2bd4f614
SHA512530d6cd15d343f09e0e988c831e6213238dfef256b9a9664b804ff3b8be62304a6996304ed8c518eb2dc4ef25e454b9f122aef54f538f752a3b9217e8c8bbc88
-
Filesize
5.2MB
MD50b79b223584fe4eddde3ed757af26c4b
SHA104af79c85509e41a89f529d2e86f9d01f500fdf7
SHA25634de9fe06a350db98780aacb932fa068412baba78a59f72ce2ffdd90cc0eaf87
SHA5128ccab4f4b6c764122303b60804d0d6f1e7e75d861a67fe1bc619c595ce3da43c026962ab0b37e806ca2c78e5ab0fd0942fc4136586bd9eab3331b38229ba6172
-
Filesize
5.2MB
MD58538d87d994e9a27e631abbb64341658
SHA1c631f445d1b83e40033669519a4210b9c0fe111f
SHA2560142e22c75be3a3bdf60154abab8b27fb224dfad26dfc7db86d4d7a4b40c0af8
SHA512e63936c116f899be6f6a0c9beb75da3a0bc294dbfd49819a58ebb962031de3aff669e6c19b65a85811c8ac2f0f3c7206ca584e5bdd901b16b6bfda2291fe5f33
-
Filesize
5.2MB
MD56a563059bb6a2a1c9351be79d6f286c0
SHA1f81e7984a334698f0e1bde4d11b6c9fd00c0a4e0
SHA256b354884feea95e7981a657d0438da1881290559b6d5e808b692b851bfb57820a
SHA512a5b2afee7a4a85db35b2b2394ff2bc1497b4682d2dc2235fe5aeef651ff43fe4239b015a5497652fe06506c1151a78fee3a68db4fa3c49175b69cf499fa7da74
-
Filesize
5.2MB
MD57c44513e9f6795ba86aeca0690cb2391
SHA102a6e0fc3b7f5250b00ba07b85bb46c2d8ad0363
SHA25686dd3ee7bb7d1dbf56563f955f4b145666a1035fb01dcb09cced9a7d86514bcd
SHA512013ff6a41b9625d73d3773ff23eb67f5c98ef023967d5686cd21c056a86eca0022f09e234609dd006ee8326bfc40c13a0623ca244bb65cd5775deb613cce611a
-
Filesize
5.2MB
MD5d6c9b0cb2a2368ff8ebf0ffba7c87018
SHA173caeef2110f68b0db1be3f7c0ee44bf00984668
SHA2567e501691624fba909307111fad93a5d18f600b6b82c99d12ae57234524fb8ed2
SHA51261935e1ca46bf846ed45ff95fb27b9d17e5286fb81cfa62305c22f8197f2d577b4ba72feabe84aa835fc8e0637380b197217d35751d67f2fe2e64cd50242722d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB