Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 08:30
General
-
Target
2024-09-13_1e3eff9d6634a4a0387f6014b40881a2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1e3eff9d6634a4a0387f6014b40881a2
-
SHA1
ad379d20d99ea6155a21ade94a07eb0e1152546c
-
SHA256
36651c4cffb23dab425ff8183bcdc35ec1bdfde92bc54caf027af30c7fb8fc34
-
SHA512
923528321f6fe5c66ee9dfde96e18c8e3c2a710731acfa81b2ab57286ec96a0333bb9e10b61c77aeeba22016da97c7289b298e6251ff3279660ebfcd2e8b43c4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_1e3eff9d6634a4a0387f6014b40881a2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_1e3eff9d6634a4a0387f6014b40881a2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WAsPRok.exeC:\Windows\System\WAsPRok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SwxBAct.exeC:\Windows\System\SwxBAct.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIPkThV.exeC:\Windows\System\xIPkThV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJKGYVM.exeC:\Windows\System\tJKGYVM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KZSnEih.exeC:\Windows\System\KZSnEih.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TmbEYNO.exeC:\Windows\System\TmbEYNO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iayDgsV.exeC:\Windows\System\iayDgsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vIRLxxh.exeC:\Windows\System\vIRLxxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SDFtGOc.exeC:\Windows\System\SDFtGOc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZgwvwy.exeC:\Windows\System\BZgwvwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlHWJna.exeC:\Windows\System\HlHWJna.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFEUyES.exeC:\Windows\System\DFEUyES.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNGASbQ.exeC:\Windows\System\QNGASbQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJthGbK.exeC:\Windows\System\PJthGbK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dIbszFB.exeC:\Windows\System\dIbszFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvpAaIy.exeC:\Windows\System\qvpAaIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cGxNNnc.exeC:\Windows\System\cGxNNnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YAxdVkK.exeC:\Windows\System\YAxdVkK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdWhhiQ.exeC:\Windows\System\GdWhhiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ulODLHE.exeC:\Windows\System\ulODLHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AysjZsr.exeC:\Windows\System\AysjZsr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52e26647ba295043b802c08144e13db36
SHA1c0a9daa82ae9e901ea6c9465b9a9c7d131092074
SHA256aa2928091ca2355bb2cd66c6a8525ec2af9837e0d8f1285653648858fae9216e
SHA512243d888bf28050aa9a43b0d313f27a5569ecff8ebde7d1830eb4930f7de45c020df3878d746ea020471aeb265c3912b3eaba406779ec8c16a04147673b48a6ca
-
Filesize
5.2MB
MD5f041b99c18ce0396beeff4c23f4b3e57
SHA1c79746debcedf9c4994a73a03a149ad5e93e3703
SHA256ffd00430e5d74f05066bb3cb8236c634eb25ba3f3be605c005baa0a9e3c537bd
SHA512f48597e15f31024a1ea5b46803d914382c5a36aa3b871a541ce79759b6e9bed7a9b8aa33d15acf460a518f52112a120630cc7a78cab5548d60906ceb6ef894f1
-
Filesize
5.2MB
MD5960d334ff4bd37c88265a47786055530
SHA1082ed43c5f3f3123ce8f06cf3cf195c194685dcf
SHA25640522f74121ea7b09196d03dee03c598a2826c93947b5cea7b84bc16e4abc88c
SHA512864b287f11e25a816d0b812d1883cfb42aa688052fe3356110302bea21cf7179869b26d092f44acb7764b3a13ea2d9bd41a200f32da4f3610e6c30ac093b8b2e
-
Filesize
5.2MB
MD54d20783101caa8758400e204360d8966
SHA177c2c3cf0321a8fc89efbd4b9badbcc57297842a
SHA2569484a8dc6ca590329d995aa9eb95be38aeb61e77639996a7a91c92dc57eb1ec7
SHA512ab0756782dc0d58bda9ff5d9024b37c655d81af18cbc5d6e4abca6493d1ec5617366bab5d7d71f55791968a8f445f3cdb6db0ed74837d54569f017d33684ae86
-
Filesize
5.2MB
MD50f17a90f69a51cb486bb7e0a38e831e9
SHA14519a26a5dfe38b3b89dc661673c90cd6ab9d9ba
SHA256a0c7694ab3776070e746c0aa02867a30fe88ceae2fb05c2f1b1366215caf7e3b
SHA51241ccafde9ed7b5f92094ef0a9eb14996cc67a08bce6d18fb6f2909b69af331dcecbc214a55ed0bf059cfdc4d4254c66bb8d4f4c1410cb4614d0fbe695708cb8e
-
Filesize
5.2MB
MD5b09394b24ee2a60e79fbfcae3d0a5f81
SHA118ec28a960671ce40ca6312eeeddd07ab421e9e8
SHA256a51c39db1d2a70faca428b08ca05677c6e028c301847cd139d4af6350a9c1e9c
SHA5125b9bb96da1fc2c6040346e31207fbde2d0e5734de09e6d18acbc4ebc2f198676966514fbacb9390155c651dd29e77d34ef9ef9952d91f843ca51b41b99845d28
-
Filesize
5.2MB
MD5c918f31a17356d9e1374af06cc984879
SHA1308d1ed64e2d8590ef6c87bcc0c2857bfb7788d1
SHA256dea5b7a863ecd9ee270c0d726a67147450abb459bdc5b83ef518c45ca291acc5
SHA512922246bce0f17184ce1745f327ab57c0961aa7d2f963d531b0eff2a1433045917c320cb4295d07d8b6396ac7f4a73826668c7c7a18675e2bdf1f3d77acc9abee
-
Filesize
5.2MB
MD5f267a53e1a8430410a505fa688bd2693
SHA141133bfc09594e2507d77f14164e7fd6988048eb
SHA25678e4d5e17a461a08f545cf5ccb7aabd028c989a7c52959bc9824c0255b2a9365
SHA51265b1d53441dc9aafa9045c5786769ece7237ad1aeefaa351c87a756cff5320949c47d9ea0a2d01c74cbbfeb8e2398b20fa463be3c3099fb019173895aa4c7a08
-
Filesize
5.2MB
MD5afe9dd04979ff749384f82b40846968a
SHA1616bd34561cee716a52bedf9936d57716be75cd4
SHA256c0e0af5de2f83f65b1f200126eb66a21612b443862020586dcfaf3275911d9d8
SHA512118e620ec5eac6a5bb6abf779c1e6970bd7020958c7509365dece3e1af535dfb3d0dcd13a005362891f885e147a37e8d2b79b6ad7e856fdd835444627ca11546
-
Filesize
5.2MB
MD54d185393665306d197fd3a4e57fade4b
SHA1fa5d717117b759249de915177e552807106103c3
SHA256a321fd71a9a3ad8c85b243e7c2ba4edfb65f33865dc72a1dcf95f5a70ae7653c
SHA51228b3192eb8d4cdb5acd512a5098c140488b444831ecbf532da6eca0dbd2f1cc1da4607c4ba3ce8a983a444f87e70d356c828b43c2a78a121ba0895689cd9103d
-
Filesize
5.2MB
MD58c810ea6ad3f877efe49c246279eacec
SHA1be1f1c3bebbee5a5cf95ac58c3b39206934cbcff
SHA256d3a2a07ff9ab7be621979009259a7cbbc85ca69dbcc2bbf79bf6b93624ffe29f
SHA512c9443f26c1cb9231f59abbe8c0b7f8a14e3d1ebeef86ed1567cd3a572be376ff2e5f24700f1011be0cf3e51ccdcbebf0a520291ad9882e26607a4dfaefa5c978
-
Filesize
5.2MB
MD50881715135dcd6523005c9b3b4498183
SHA1bd5ffea3bafe7c812e67159018bb4c7f4bbc1a00
SHA2566cf1a8fc11f932f9ae8497586ad7d92d9a969b36732a74a1c076f31b9c9a0d7b
SHA5126a7ee14b1c3daede25cd6d57c7c9d174573571beb25e3287ce88e75a0b699c447418e4785d6c8635df45574531427d875eb6651953db272a28f0644358797bb0
-
Filesize
5.2MB
MD57d2718ee3731dcfb604874ac18877336
SHA13f10c2b021c86dd4e3a412c860e6672faeb71f49
SHA2560c96a73ec0da03942a74d83dd2bf5b097547f078d9bd37c41ca44cda1bb140d1
SHA5129932c53129b7d49a421d7023ca8116e2f66f06127c07886376e0d37f59c81f4ef67fc057a3b60004c76fdfaac1feae8336482f88ce4e6d4c7f04d2216e22f899
-
Filesize
5.2MB
MD57e03cfad1232f82808ad642e4b25b474
SHA1ea596076663d3131566936d74eb86ab598454e67
SHA256545f9d77da97594832a0510a79491c2427dc632fceffb02f43aeba08bcbdcea3
SHA512227597c48093280b6fe79c6359e9c05b415b5b4e7ed9779ae6fe6898f6f43fa3c26333dde3b4a86fca142b1329d9acc2d9f03962cc48b3da82d791497ad9d3b6
-
Filesize
5.2MB
MD582a779438dc36b1b1face85716783e8d
SHA132e9079dea98b17f0661b1d565a70a39f91f8040
SHA256531689baf9fec9303051df69771d9c175b5e61d5f92ecd22070c372213d8be4c
SHA512c15e75c2df35eb2a0c6e7ec2c777f01c6833ab6db609d042dfac8487636cac68c15990314a86a469c61a53ef1795fe0e0a365c72cd3c59353588401975295447
-
Filesize
5.2MB
MD5aabdf0c8423c8d1dc242b30ca4293d2b
SHA1640aa65715bdba1afb1f0d4f4c516a65c13f3e4e
SHA256fbcd336e60ac245608257e61b8a9338a61477e790a7e25effc31a5ab72310c23
SHA5123fcccaa603dcf8fade9de2bc90f94b37161e1c8a13a9ce1890eb44d51a03c6c752bf641852eca9929bff456e7a84f8fe153135d6fe38d028ace1894e0d6e5576
-
Filesize
5.2MB
MD5357581121696fd26d923accb7b6543c3
SHA1a4e2181c3c714bbdaf099e700526f11817c8e89d
SHA2564a5226f1e28531a8d938c33a45480a8fba3f481e8b87de2e253d561fdfa526d1
SHA512381be41e1ef2aa056f996641e11a54a599887cd5a20324ddf3258fcd02877e4b985a3e20acafe869b75fa980f08eb5455545bc17a5fbe267a03a1448c27c9876
-
Filesize
5.2MB
MD5232eacc16d4947d67e96af370e240c0a
SHA1dd767556aa324bd0506719387b4a1156157b0f9d
SHA2561e86df7e9ca2f7d6ebb1eb501fe44ae24ce15f40fb157a5ec6ec8c446d4aec4f
SHA512d37dc968fe03e072a3eb0aedb05050c87902285422ea89d1d79b313a631ca68ee30badddad6bf236358f98b21b88e37baf016e45df84463b54900b70a0c5bf09
-
Filesize
5.2MB
MD5e169fc37470e800a7cc1a5723f4bf529
SHA1a28225f4af7db9f7fded228e7e560af458773bac
SHA25604e2e51f86164f47d7a06741d1de8cfe4289b68546c3688ca53afa38a8fb4a2e
SHA5120ddaa3100077017535337f5af6889f0fe012f956316ce778ef2a17c39e0370152fe46b9a131bca577fdd9584c5df5c662d93bf4d69bf7f276467c0428e7adc2a
-
Filesize
5.2MB
MD59de448e01f103b0f2061b3ec4d96a9f9
SHA1ccc16406e47d311229893dda2011085b4ad6e898
SHA2561248bdd9ebe9fee1e0929325d8f71a957d7bc5fc2a5dad95878d639692a677c1
SHA5125140af70a272c65be8778df3531c313e83623c41fa9f833d22cfb259e48231428f641a786755563061801d64b6445a428b5d88822291d7c78c47cd6e7ebe1405
-
Filesize
5.2MB
MD56cf2c1ecb2184fc0c8116ed7cce84a42
SHA1d888ce105ece1d7f0ba89ad25f2e6709ea4988ec
SHA256fb348e424c25f0e2208c768596cb090db3e68d32703152c9f6f13d6df330e941
SHA5127eb750a0f3a62b319ebcb18f46ce7d87ca47bd2c74c56b038ffe020dfaa89d1ed106069ee1f60de94aedf6f018eae638395365d10413507950726f8dcee9d5c4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB