Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 04:06
General
-
Target
2024-09-13_57923ceb7635bf48ac49bc31c0594da0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
57923ceb7635bf48ac49bc31c0594da0
-
SHA1
8f20403595715c756523db9adf2c36310686cee9
-
SHA256
c0455cd80d89f5c56b3e0191f32039387e29b83a13743f23cc3e72deeba9811d
-
SHA512
38186127faeb539b7318323061e18cd5c55afd79b34cc40810a4a08f84570523f0fafed2433920daab20452671bb437e64327ba13a8383be4bbc72fdc9b80ecd
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_57923ceb7635bf48ac49bc31c0594da0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_57923ceb7635bf48ac49bc31c0594da0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AuPaQSH.exeC:\Windows\System\AuPaQSH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XBzNfGx.exeC:\Windows\System\XBzNfGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnseCtA.exeC:\Windows\System\lnseCtA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XdNMLew.exeC:\Windows\System\XdNMLew.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCvlKHa.exeC:\Windows\System\SCvlKHa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUEppgt.exeC:\Windows\System\OUEppgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVlvFfb.exeC:\Windows\System\AVlvFfb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjOAInF.exeC:\Windows\System\yjOAInF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VVrLbWH.exeC:\Windows\System\VVrLbWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SqrwIRU.exeC:\Windows\System\SqrwIRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQPeTAb.exeC:\Windows\System\vQPeTAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VGMwZDY.exeC:\Windows\System\VGMwZDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vKkZsMe.exeC:\Windows\System\vKkZsMe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QtMhyzr.exeC:\Windows\System\QtMhyzr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIsCcrH.exeC:\Windows\System\mIsCcrH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCBnnRE.exeC:\Windows\System\GCBnnRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtPBbUl.exeC:\Windows\System\YtPBbUl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AxSbFKO.exeC:\Windows\System\AxSbFKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YChCPXP.exeC:\Windows\System\YChCPXP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxyaCPe.exeC:\Windows\System\wxyaCPe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWXipOC.exeC:\Windows\System\XWXipOC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55c06ed62c5e294cb32a7ea9873ab9216
SHA1506310a9accf8b2c0aed58a65d50e60f7b474ddf
SHA2563e704b061175f45cd7d2f458d03da68867b715e7f3868e57409e510bf429d761
SHA5126a46c89a44df8eaa8badf14195be092110038176d5e722da36de8c002bef420a7cbaee462b0c370a3ed31cbbe6da2f9891eeb7720185bc887d042a40b7540ea2
-
Filesize
5.2MB
MD5b37a144b3aca085d8c8104d5db675daf
SHA1e4875422d666261c2a4388c0e40b1b04507806d5
SHA2564280ed574ca181ff31c52d5f41da86cf209b711d18fc625f838ec113ebb1f463
SHA512af86ed549c2667449075923320856d557d3aa1e35852776543e8f8030c5c2fe19ee9539010fe7c7c75ca166952ae8f5e6dbdcd568128374a84a6655360e02695
-
Filesize
5.2MB
MD5f430d2323155123ce38c1f4badcefe8c
SHA13e4ba74d9649bf2f483ab76e5fa86e54966c3ce6
SHA25681eb72c266ae7d375bd7af83dd314c0522f88cce1daebb231eab0c7e129c393d
SHA512ad36725ecde060c96f60d2c972c405c296ce32180621d31c89cbee9ca981a80d17122c0d7f4e174fdbf48d0c0302258a8a9a869cb14eff088c7a774805f56e4b
-
Filesize
5.2MB
MD5b50818827b4d9ff401351a807604246b
SHA1c2a5855189691841631cd606b8867a13c7558fd4
SHA256bec2ced7f5707c0d67ecbec7df8c56dbf50b97a49bf17d9dce79813c416c544b
SHA51267ff4372f065218cf2657c4ae14f5f24418f72c391c1b53166fc9bb737cd50e35629ff47c97c94a56822c7c5291a2a34c870f3401e0d23d3b6c5471fab5ccb32
-
Filesize
5.2MB
MD583f05f199b8f575f89b30257da24edef
SHA1878ac84964a9ee0f1274044fa79b6d0711e9b2ca
SHA2561d33fbc98004e597931aee248ec44edb60b2cbaed12783359a642c9f48d6ff76
SHA51228f8f40fd816ff310a859ca3c0b723d7fcda497594cab98bede3db2880f5374aa4c94cca8a5ebdfad67b980ab98e78f08f54e47780c7d7bb49ab36cd69dd8368
-
Filesize
5.2MB
MD5895709f32c0298179de258123c82650b
SHA16f1cb431153c16e067b2f41948f658d687b226cc
SHA25602bb2dcd9e3b637429f97266709c16738536df9b39bc79833ceaba2917470dae
SHA512901910b7da6601b4356ce9d185dc0b8ab70ac8ecefd86d958f93ab5d637cde1430b7709996af39ff60c34e24adf5a9665ca250a2cdcebebf270e47a32f2617fb
-
Filesize
5.2MB
MD578d98b7b5b580bb2b13759a2af893902
SHA106d159a355070628f1d2532ba9abcca8256739de
SHA2567e2127be71869405871ac93c73e1588aa7286d57204c3eced84bc7aa2c92af07
SHA512a83d48d31dc0a5e5732d40f3f7b80e058b82aed04d5163da1b8d32e65b4efb6159a98830c8480a1baf1851eeb4fffed53ac038f95e48d71e1bab37229ed66ed8
-
Filesize
5.2MB
MD549e453efb37aaa4ac6b41ef80cded13f
SHA138c0538d930b1bdb4acd3d8392cecd170aaaa76c
SHA25684dad883823b5f2d138363aa3f149ccc60b6fd01d06a0963c7bef100e42f37e8
SHA51202cfdecf53b8fc30bab69b6b208bc224c1081b4e5c4146f673519761ab172e89a9322d47c5ace3c8c62f20ac86c8496891b6318015012234dd59aab65b1fe803
-
Filesize
5.2MB
MD561e223870d22c8e60f05e19213f145ca
SHA1266a9d9d9a096934e3c640e31c2f6f7a0c0d66bf
SHA2565ac7b503cd720a22f348b361c9ef6ab13a7eedeab4bf1363c754fe8ddb4f7bb5
SHA512041f47b9ae81c83ce23741c7655fa7f6282124bf6e0a47af5d91ade12da079014722d4355612dfb1e1f4233d2050b59c9babfffe40867de6510e71d3e5f16dae
-
Filesize
5.2MB
MD503392fbd72fc3e082e82c8b63d1a0bbb
SHA1d56c6f7626754be1e19fda0ca975df9c28fdc828
SHA256f6e1f0a1039724bfbcc3ee3b71fe01c7baeba155615d5f8fce993ac7eb1e1ec5
SHA5129211588e0ff5a4fec6ed4731837f5dfef76af6114b6cb9a0708e0f6b4d250e0706008f70a5553d85b6269fe0eb3a692139818662a5e5a208ffc322bc0e9308d7
-
Filesize
5.2MB
MD540c440b082743704fc6ea107e346e6b9
SHA1c46259eccc4a728eb71807e32fa4e6141d1171c0
SHA25600b7ecf2916781313d11c96ff2d98228c08bd9740655391dfc610d455c636127
SHA51291d4b0c5937972b336f85a5befcdc34113365cbe252f7a6c8ffed728ab6453fb7501425f66d3e931e8718e6437b1817cca046f099d1de83cf292cddcdd7a77c2
-
Filesize
5.2MB
MD59e84c70b68b91ce4c975324dbe211fce
SHA1cf4437dcaf20c44f4d8d9e76533b0e5c7ea45804
SHA2566767bf9f32829ff4cdacab900a0a36243380d114ffa38d741dc9db7d4d2fac53
SHA51260f8b8f4d26f6e06e419d8bf902aeaa1ff6ec1d37b7a1c9b2e0f57d1c1b01f0114e246ca5145eb45d9a7407dbaf01dcd8912536779efe636426f4fcc9c2e2157
-
Filesize
5.2MB
MD54e9efbf6debb98f9aab4b9cc68a3314d
SHA179a94b26caba319aeba6ac4809cb5f718879039f
SHA2560b14d353a6e1a1990bcac849f4bfba1525ff7dbe9c5d43d9cd33ed1b5cc2f61a
SHA5122946089bd653f5bbb3e1213066e7470886eed331e6435fd5dd905551f2db64e3e4160d360db46bdb42d9390243150f6678f1f7e307924c199d187a08eb42d60e
-
Filesize
5.2MB
MD52af9ddbf031744b98f1cddaa26a35bca
SHA160827b33d397127362b982615f725bc6c5a9b086
SHA25637d84bae74d7db6454a494ef79986fc2b391d40983496dbcb478ee6748667324
SHA51255ee178d4292806fa96b5d8bf99a97772bca88791bdc752aa9b8c993ccb71d675f8cb1287bf5eb4c9ffba735dc36ca586f230311d76f2fd24bea920901d87348
-
Filesize
5.2MB
MD5c680f984bbbbba4c0b9299aad1a7f226
SHA11e2a1276ab36bb20750144c2b34f9c999c2c86bb
SHA256f36b2cf4bb8576410035f3514d9e04ac5bce46c24fd1a099ee62f0b3264f4958
SHA512b56941d2f8cd4d123d6376a7a7a11af3ba88f00c4aacf41602cc2abb4e5a69a9d73c9c8bb5a4438991cf48f2c3a34074cc269b7fd2542117d2760294818fd19a
-
Filesize
5.2MB
MD51702fb31e43c22c5676cb41970e68a4d
SHA1b8bf7c14acca1575670c16d0984292916ee03f60
SHA256dd06957433ca9a8d9cf706b14cf79e9355af9c1e9703e36fe471faeb07fe5b2b
SHA5123bab831c9336c5e8225ed004e94499ce1c76e8c5e220f8ca7dc3331fffcfbe3f753ddec6d99baac8a65462ff34fdbcdf5c521f79a3e6e56060d8b305abc024c1
-
Filesize
5.2MB
MD5b715f54623aaf1d69bc01658f0a9091d
SHA10468d3201755a67c65997a28e13ee8ca0ca0e68b
SHA256487d82e95ec31a3c7a841cd3b4a3e6cfe9c913bdc4fa34804fb46ba6081e3644
SHA51217be9abab0a339e6cde52f54bbb909e6d9886fc7a970123c1793db72350c370e966d7400ef03fed33490b600419f44449ae8ff4241d50c3d7b7aa19fb378cf91
-
Filesize
5.2MB
MD580e2b1073ec4758ab9a70b04dd02260a
SHA180849c745014a163ff91ab2ceb0416d720a7d852
SHA256893113eaae0e7d3deaecfaaf3004732b80fb75d0fe22b9a4e48811e2658f01fe
SHA51207ce9b1fc5a6cf35c10c2e58d4f1cc50a37fc2622b6ca9bd13fea47d6a00769f42bfdff035704e28cffc2beb7345d72389afa4f27a6ce3e05ddc2fd6b9845904
-
Filesize
5.2MB
MD56fac383527a52c39b29dbdf2658c6a23
SHA11fe5089614a5401d1c5623da379390d46439612e
SHA2569c7f931a1062a00b04f60406337a0035390ce47407839b320e2cdc89aa003735
SHA5121469951ab63daeade1ed3dd73fad8757640b1e9c8ad9e7384e5f1d74fb854384cf4805e059531926861976fea16a47252829155505130ca90f43cd8f347ae2fc
-
Filesize
5.2MB
MD59b0a3ee1104096cfc0ac61dd230fc5ee
SHA15f8ff9198e5371eaccbcf711e27893f2cc886f38
SHA2564977027d3b2b042504e93832e544ec2e86360123e151b62ec7c4189559deb3c8
SHA512a195ced4d9c30150ab433e6b7f1bc7625bc61631cb0d84ab9ea71752da1c08e5fd5ffcfd6d2d9f3483f5860a07e90451fd0b0036f2f013dc75bf29b661ca3e11
-
Filesize
5.2MB
MD59dc26d94a2f7d1785ff66f15737f9e22
SHA1c3aefec63c28b451b6e01b81641cd14aa295b645
SHA25672705f175a733bfcdbfc5a85e8412e0bea38845b8d5d616feb0ca0c66e2dd0aa
SHA51218b0d23ec4696d08ea6ed0b0f9789023adba05e95208c7b578fd71d61037ec494c70c5dcee66c5b9722d289048a3dc446920796cde592820d86ee54fe8fb1cf8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB