Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 04:05
General
-
Target
2024-09-13_51ab7ea3c8cf0cc8b9185edfb3d3305a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
51ab7ea3c8cf0cc8b9185edfb3d3305a
-
SHA1
4111499fa31a37d498a1cd431e7daa3a26530f46
-
SHA256
7a9c71f6fb0da546cf51020c6342fb54e95b1f913f2aba822429803f1d0756c2
-
SHA512
02ec0394288ce5635e481525de77ba4fffcdb167aef37dc2578462a5601551d2126ef3a4f31b7afe4d9a72b498c92d5855fe1f961abfcf0df1db61738e808e21
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_51ab7ea3c8cf0cc8b9185edfb3d3305a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_51ab7ea3c8cf0cc8b9185edfb3d3305a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fshshbn.exeC:\Windows\System\fshshbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ERjjCAu.exeC:\Windows\System\ERjjCAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFnMglh.exeC:\Windows\System\MFnMglh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMpjNmJ.exeC:\Windows\System\FMpjNmJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQUXiAO.exeC:\Windows\System\MQUXiAO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXaPFxl.exeC:\Windows\System\QXaPFxl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SBlYGUt.exeC:\Windows\System\SBlYGUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sQvLMAY.exeC:\Windows\System\sQvLMAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXCXibF.exeC:\Windows\System\zXCXibF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Brutojk.exeC:\Windows\System\Brutojk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LClNduv.exeC:\Windows\System\LClNduv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\siAhSxN.exeC:\Windows\System\siAhSxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aWhibVP.exeC:\Windows\System\aWhibVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUenmBC.exeC:\Windows\System\JUenmBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tDZcbAe.exeC:\Windows\System\tDZcbAe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iuhEAhI.exeC:\Windows\System\iuhEAhI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pGMMZmt.exeC:\Windows\System\pGMMZmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DocVVVn.exeC:\Windows\System\DocVVVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ukBJnqB.exeC:\Windows\System\ukBJnqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XNbrrVC.exeC:\Windows\System\XNbrrVC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SpMBddF.exeC:\Windows\System\SpMBddF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a6e0fa21d433592cabe9500e132322d5
SHA1c2660d1b85c9d84c539ae96328de8a5c6b7093d2
SHA256b63bd85ddf60005a38ab7811de73d489c94b0c4603ce28e7a30ae654096b27d5
SHA5127ecbb6b01fb8658a4354a771570b3bb3801efc1041f7f65d85cb19ca641100b0d374ee5fff29bbb9e3fe4832072490c66d2b5f00a37ded06b5e5d3e1c238db2f
-
Filesize
5.2MB
MD53eef459792c139cf668bb756f64857a4
SHA19fd2521742300ff4e14bb5901655c2614241efad
SHA25667a1d1efc4d9cdeba54247392f2807101e0fb90199ced5120271a01b6fa5bb67
SHA512c15345d1607f261cffafd268907c573858da9cd51ae6958c0cfc5bc8f7a799fcc8a303b241d8841d6228e3517eb9ec97e7bb124aeee78303a1f17c1934837467
-
Filesize
5.2MB
MD5914c48687ea3472031e8aa4d62c10c88
SHA1cf8853e1338ad19713e9a9448f6c99464c52a7d2
SHA256cf609bc53e5e7ba86e24c3d1957d9160fb8594ddb38d2f4c2d42b0b7d1a42f68
SHA512898f4330cf53ebc3524e05c3d9586218e6628420a3a9991d6a8c2de85b8f6c5eb99a26440693ce12b3a83409b49b97b358d6b669b2145b7d35a33c454de43c6c
-
Filesize
5.2MB
MD55d59d5c11f1e87b0385724bde24e82c8
SHA13f6fa71031e5cb26ca2e9a29c46b8e2cedba2b04
SHA25628678f3c8874f28a2ef263cba17e9b9bb812d2b46eda810ad4fb59572b4482ea
SHA512cff75a02dcdb58918157b5f4a07f0f10890aa02cd7baf9869e693dbbc3f83f60b77e7725382c9957d58b7178567bfc25fe7524fe7d2ea902072a4ed73c7e3236
-
Filesize
5.2MB
MD54b3e834af611a4e13ff3ec2d8f05e36f
SHA19e700594e2c75c1b85aa460e53518ddbfc366aff
SHA256d773fc3d4de314abee6e345e81040bb2d353740b674cf62d0ea0646d33fc70a0
SHA512fca733f58561b9bfd52f36db7526147790b238e957ad2abd1f23ed67a01f6c46a16e392435934c46795d5fa7f050de3e4edd2503d5f24404e26a6d002a64183c
-
Filesize
5.2MB
MD5dd8bbef521f715dfbf88fb78602dbd06
SHA1510d634ac3318d0dc585751322f1e57d6611b02c
SHA25650020909ef9f49f4bd67f5c1fd78fd3ffc40192e1a11e18b722145d6815066aa
SHA512ec20d09df054ceb2ab7c6af280efba18d514e1e7c357f42aaeba79896bfaa5ff816c263ef57d5c5310c274edd102f5bcdc33dde68fc1fbea0a205b6687959175
-
Filesize
5.2MB
MD5b4c7ba97d6ed8bfb4e46e3c50a5b191f
SHA141c0db64318807fb6024d23c4bfaac1e216ccb39
SHA25637a11acd935ac6994429a766cfe9120c18a94f43521d56a1aaab7efc688ef6cc
SHA512543ec51ea752774fdc70769dec803747ee188d9645b2c278a604f2353b9a72542f0d71d0ebd779f0c2afc1ce756addb59ae676cbd7f95e7f5101669c1b8c129f
-
Filesize
5.2MB
MD5f032779f0375f5e7b422326123af29d6
SHA1a5d5647c9649a1163c07b5abe362cdcd522561fe
SHA256ae24d33818747d2f6bf907fabeaa9328182d09921f3e855058ea9ec690be145d
SHA512609fb83a3e8d10df3b6e9f6be8c59cb0d41de87ae98550d74080a8108a6718ab5fa5b8bdca5c44769a85fc23ea39bb8d434cbacbd47d552688f5815d69ff02a3
-
Filesize
5.2MB
MD5f99cdd699038fe6c663dadae522b99cc
SHA11569ff7f3dbaa942a454ddcd7e43ada1f4adc57a
SHA2564b0e2b33dc3f7c17e67a5fcc7ac42c2b655fd826f88589adef744e877c4b0141
SHA512ab88c15db43e1f6006ad66e4d61a40e15e57e941c23585c53e8522bcc7d2c09e56eb43fe1880891c9795dc80be95a0be9ffdcb76ef93824e4dc6d564b086494b
-
Filesize
5.2MB
MD5cfb6b0026e5c7eede3783ac537c96a72
SHA1a69bc5d85b4a21e10aa769a3f49c4ab88fbe815d
SHA256f0539b8e7ea4fc8ad6aa4bfd3b4e97e442f146f87479318ddb4187af0673ff48
SHA51292fadff25666cc26cb6bd574e3457d35b6bc7f86a4ca7f0ca4f5b18b5d20000bc6d6e978f305256adb5a07e9d839ea22bd31d945d8af66d1d212d9ab8947433f
-
Filesize
5.2MB
MD55a7fd17873ffc1069b6f07552a8343b9
SHA1eff70744d24ee294a235f9c979c20f4bc3e05ff6
SHA25616d6ac6fc30f218c88e497ac7ff481b7c4868ad8b233963b2e4a363875560b12
SHA5126790f9ebe589ce5a33f05aef65c9fb599158b5a3a701e81c0a77e6fee61e5a5af6d4c486f1b67607cf4809b7871d1b8d5db7a6726cc4345cba3bebf8cd2688e1
-
Filesize
5.2MB
MD5c99eab0f780a5d8b829367a981402386
SHA1196c2ec1868f4a0ec33f20f4798264f07bfa51ff
SHA256211aca8571ff06ae36f2df9b7d06641c79a4e9ce36f3f8e2e171f9f96629b312
SHA512ecc04c86cdb3f699127645d585e3d03f3ad55cd939d841e4a173199ddbbfdf811d4c5084c7f3b9ed163502f4396d557c5c9289953f4c953f5fa588be714a3cbd
-
Filesize
5.2MB
MD5acfb3f14e316b9c4183d2014d6884f1e
SHA14a3a21273af8682292e726adf172c481b5bdfb53
SHA2560c5ee27762d34b5d51090c721950e51e24bf8e62c7bace850a3dcc2e98f5bdc4
SHA5124136344bdfa0f3a0d6c4e1e9e17c61750f021c7d8be8f7493b9339731642abce2064b73028a80d9791349908ed28249dd2d7e641aa221a4adfad4e0505ea65c5
-
Filesize
5.2MB
MD5a9d3a7d12d70c12e2cb9640db4e91f6a
SHA1520c0b737e52f49ddfba82f33c9399862410b2e3
SHA256ada8d8cef52660b1db708c6bed7bfc1ef59b037e2ef261d26a793f200bfd7044
SHA51252ab57b4598bc35a8aaf9ed5b1825689636e1a36910f0d4824c308c20f452751b5950e3c009bedf0e000be1b93309a834f7bdaf76eb7fc051cd90b0a0b36dd8f
-
Filesize
5.2MB
MD5df4f654eca4bc37b2223465aad2e1cfd
SHA153f9f952e09539d6c2849518b479124453b6453e
SHA2566e293d2f4eda88d7e5342f390620d4ede9d423baca4edfa7eb40946986a2f6b2
SHA51200e1859aa5d90e6e92ee676fbc9f75ec0f85d585b05a96779f345183fe57ec2383a3b7ec3ff4c06563df5952f05020afad354ccc421046864c1947525373e2d2
-
Filesize
5.2MB
MD5adb3ae5934f187bf3cd37595e6bc4e0e
SHA1714edc264b3cdfcfeecee81f97c410814c1e140c
SHA25615aec67e97ee3073b38011e281216d56c821ec903778c1a04d92686eeb564c1d
SHA512c45c99f496447e59918dc761789994f5bd0ba900442ec41d0deecb8c9ffcfd32b0f1906eb364b343c0f434c52b3df1892da1815ae7b077b09d9f39400954e2cc
-
Filesize
5.2MB
MD5ca84bb57ecbf12b45fb28b06e7077fcd
SHA17802f741a5e687830b76f5cc8c4c874f0b822e29
SHA2562dabf46e53b32b2f73b0a78829e0ec26100074c9d370a0a5533d15f0c8247dd8
SHA5127917a2c01cc76e4f4e134c375e876392cb7f1a4cddb628d81eee6d4d7c35fa6401dfac6d61a2d3b892329891a8b73b5d329590d7a5a7005360b8d95ccdce62a1
-
Filesize
5.2MB
MD5e51db9b71463c1274391827ebafea118
SHA1cf29d5c09334d03a50ec1f9383fd63663ed8c81e
SHA2564a596b4a039a8cb095fa9f1a8f4c5d4906bad0cc6b2c3dbfd698af4e164556fa
SHA5128d30c057abfff4d9bf1416e69a1d7bba3ba27b3c681bbcc2b97b318bd05c9401da00fe8220898e5826501f9dbae5dcff5777c6d383968090642668b8020279d9
-
Filesize
5.2MB
MD54f6c3788ee69017fbf5b6a010df162dd
SHA17a6dc5d9f6ba0eab06c3a5db17a41e610f8420e8
SHA256b439d6f572defd0d70c834090758665ad616755edef8e427f267515e11b76cce
SHA5126a50636633f694d8a05bd0f4b24da98d68e55f949a0f5c2045091f29b9dc75ee429a067e71e6137298e9db77ec2b73292458c6c2e759bbd1a147a1e8990a2e41
-
Filesize
5.2MB
MD5d9d90540e545cec2f4f32d47167a95ec
SHA1425d350665c5392c8744568054e890cda788d0de
SHA2564cec3e26c7f29c8429976cbecd38501dfaf38c9708e1e504087d8220efb74dde
SHA51275caeeed307727ce8714624a0e4a399959c4f61746a2535b2f27a3e13f0f12895020044778f59a9a9552db786ba77045b7c5045ee42f3b7e7e07d1feb776c738
-
Filesize
5.2MB
MD5ba4c233ee56f80ad5b8fcbe75db6f794
SHA1e34b80392181b6064d584174ebca78ccfebda8e6
SHA2562c8ad05d495218807449f024aeac02217f913a82e96bbd3cad1692e0cd7e4a74
SHA5121079aa61027ecaa037b1115b1fc63ec38bd20bfea1efa301024972c11362cd2827820f903ee721d74839e045a14e52af7d58030441b2ef2cd158f66b9d78ee69
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB