Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 09:25
General
-
Target
2024-09-13_e8661848c25e30e4aee55c3e18c58d35_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e8661848c25e30e4aee55c3e18c58d35
-
SHA1
c6f599f292ed6ca0874c585754d07f77b8503bb8
-
SHA256
35f19889c8d7cbb9d2656187d9529da7fefb6811e88806a28711428ee0aedbf2
-
SHA512
8348c9484826ea870a03f7b37ec2e79cdc36bcb6c9925c3854ea6a42b1f63934c6c696284e542ac996e85bbe813762c674f5fa084abcdc9662563c5dc8ccd13f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibd56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_e8661848c25e30e4aee55c3e18c58d35_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_e8661848c25e30e4aee55c3e18c58d35_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wnnnLyI.exeC:\Windows\System\wnnnLyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnTuZWM.exeC:\Windows\System\TnTuZWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TaZJTOw.exeC:\Windows\System\TaZJTOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPrvxnS.exeC:\Windows\System\TPrvxnS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CaLGCXx.exeC:\Windows\System\CaLGCXx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zDfKFiS.exeC:\Windows\System\zDfKFiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTbKETW.exeC:\Windows\System\oTbKETW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqPPYHm.exeC:\Windows\System\WqPPYHm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXsKTXX.exeC:\Windows\System\OXsKTXX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HWGMGGb.exeC:\Windows\System\HWGMGGb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWFCUYY.exeC:\Windows\System\nWFCUYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHpwvtI.exeC:\Windows\System\xHpwvtI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uktEKuK.exeC:\Windows\System\uktEKuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAjuyiV.exeC:\Windows\System\XAjuyiV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsMCJWC.exeC:\Windows\System\ZsMCJWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJKraDP.exeC:\Windows\System\GJKraDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMfQYum.exeC:\Windows\System\jMfQYum.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YHDnrsS.exeC:\Windows\System\YHDnrsS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PtQxtTK.exeC:\Windows\System\PtQxtTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhkRKzb.exeC:\Windows\System\RhkRKzb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUUAfho.exeC:\Windows\System\ZUUAfho.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52f322fff7fcb85b9a8b8d7af31caf8b5
SHA15b251cd3432c6ceb7b5a18a5fae6ada26d311fd6
SHA256bcc56cc440bcfe0f57df2033ec843d667c257e73fd2a60722cfa3e2e6e7420c4
SHA512c2ec2be57f9168f44c225077df35989ed5f543eab68c443a916867a0460e08b3c963dad37f64800adaa275915e3fc96cd34b1213c44e6e53b733f6b6eea05025
-
Filesize
5.2MB
MD5889b643d6bcf2ab3ee32204f80cd88da
SHA1b8e3febd8c2879cb4b6ab3e92217e26f5c97c07d
SHA256de09859f6d9480dd8ab7f352560a3187297f5b8d81548741b0d0b91a38585280
SHA512e2a26e85b024db50a5c3a266598e52afe34f78e8ecc3230450722edc44f0ab31795c400a03bddd35f9d96199c187e076099e18870a9150963e8d95dfc2fee170
-
Filesize
5.2MB
MD515ccc3f6b88e792d147e71154f0f6d72
SHA1cb3deedce423c6fc37a2a800ac06b224bc572646
SHA256726cdeafface166b23cf21662c6e61825fa49af6aabe2e9b1b30585509473f99
SHA5129b58624b4fa2d49363f1279ddc1fbac3433f422fff507d5cff6a7aeb1b0088a8623b5078c5d82f5ddd33af011357343f912469cb9df1aad8bfd11d71365ccb9c
-
Filesize
5.2MB
MD5cc65bfe1bf22eb9c2c4d8bf2d3edd8cb
SHA1ce447f0f8e0b7e15fd8c9a77c4d298c16c1ac7cc
SHA2562a61ea78ffffeff79fa9082252028f2d3916ac9a5a89d80f75c389bc0b3b4d87
SHA512d2aa5bad3b68d80063f1ca046410a410690ac0c92096b086d095e9a55070cf53f3dffe8e4895c3fe73e035f5d242681bf878ef03cb7ce1545d9716337a277ced
-
Filesize
5.2MB
MD5e79dc7f0459c90fdcb9fd493d1cd4298
SHA18ac9439fbf1902e4c45ec4b06e3010d40c09ac6b
SHA2561efb4a41dc618672d860cc396024dfd479af64c351f7e6bb1a5122dfc56a3300
SHA512afa97464b284392f490f54fc32327a6c4800d45239dfab719c7f4f433b49212a98d3f209889e8524cefc87594185d933e9070ac7e02692035f7934f53416b3a0
-
Filesize
5.2MB
MD503fcecff3ad3a8e1f879c37aa83f31cb
SHA170820be6491f263155f0b959ef97aa9d92352a42
SHA256315576472dae3d085d6b07243aa8b3a4598d3c963d9fa2fa96f160a15b8b7ea7
SHA51267f4dad13d6b0118d0b45d5e1b8ce6a1f5dfd0a5a81ebf59d834bb610b385bb7df0e208ff23410a7c5c9e3e1feb62ee894aa1731d505ee4dc1ce54c193bcd094
-
Filesize
5.2MB
MD5a0db3fb6d33d37c54d22f8bcf07a4a41
SHA1b3eb180ff3cd6d426f148000789aaedcf9ed48e4
SHA2562da78d237b175f9b705eeda5eae8564f2492893189f7864c4a092c08b903aa52
SHA51201ba800f50139fc83a6fe4f9a333f683ca64c2f6ce806483ce5ebf5b832e13d5b09fe0e49a6431b5f594a7538510371a4f3a125043d55c2196aa172e3683c19a
-
Filesize
5.2MB
MD50d3243987513ba3d2486b870f203be1a
SHA1925530b53b757d6c914f09e6c155965416fd6a12
SHA2560e5d745b40c5b6f6ba5fe906c4d4a2701cb7f853d4674030e9c018908f5739b7
SHA512299805e4b1085f59bea565ff6a4acc05cf32983ae964711094ae61f7602ff9b86169b13eb3bab56b3ea804ed34f349258ad92fdcdfbf16533e366ccbd713d9d3
-
Filesize
5.2MB
MD5ba4d40020ba695520d7e6c7570b5f71b
SHA1d7e897b9e1d5c5eb3adf336308858e43420f8c6a
SHA2561cff62defbeade09162ec8857672bd8526fe5c21262daeb7ca65504ee01dd2cb
SHA512b8ab77c7acf8caabca1a9808f383bf695f8161709ccdfa5c69829e3625621d643652a1cf498cfa68e04e5b301f048df5564d3bd74ef2a7b8fc6ebafef46269d3
-
Filesize
5.2MB
MD5155c61db06aa746db57bf59352f576d8
SHA1adfc2d9beef05e6906d7a19096f07ce8d88b412c
SHA256bf900f6186867e1270f7ddff4cdd05ff60105b87471f747fbb7e6b7f66356b1a
SHA51251bbf4586bc7b5bc8a5b57c6b7ab24bdf37c515939354b61e63dc7ef6e390e1f9b30df249cb6e35058148a78bd1a79d2353dbfa2144440b78d3812efb1522d35
-
Filesize
5.2MB
MD5432d1c7ea7112dc35a86ab3c63d48559
SHA166f15948851b3af97f7e4a06bde0d666cedf3e9f
SHA25680ae68d27b518c582144a16e5bcff9211418dd5466df35049085c66d6861f406
SHA512ff4f43f1c7d1a3f306e5b0128eff9a9f7ebfeb141dd648a4fe7a80f3cd3b54597c78a37f027ec79c4cc69d5034d46e5a40546f03f25b52f6d2a9ba77f3c0d5cd
-
Filesize
5.2MB
MD544209f31e18a9e0252862a24ed6c4a49
SHA10b35609ecf47ecc46da2c0569df3ce6fa9f6a9cb
SHA2569bd955b46a4929a62bb0c184ba8c033721832564b6168a9fdd6064f98b8a97ae
SHA512b0913aa291c5dc45d971013a0e3f7df6c00d456be3c7dcaebba8da68a89e9223969b4961a9288e7e35f8bf785a80744c5f74533987b7f95e7616dea8bb57568c
-
Filesize
5.2MB
MD565aee1842436bcea8493a3a2b3665887
SHA1ff31a4a9d05bce7a09847703659f10561cb244af
SHA256de3720e7b0287f40221a1c066a59ce5ffd2740c31069971f18e0a45d927403e7
SHA5126958d1d82aa278679526f2e11f810c9b45affde76424c7af7969778bede615b975171f98ed71c0edc4e0d6a859bf102ae13870835162dab522e8e2568ba4f943
-
Filesize
5.2MB
MD51fc4d04618123e80e33b35bde37e61e4
SHA14783cf69ba4cb0e294b7b9df40ecc5ac7560e1b3
SHA256ffc4c59d75dea895d1627b4b92b7952e664a6ebb4f5ff01d74f52c014ed5939c
SHA512c555871fa9ab984df0cf9f614548909b04019d5acf69007d39518694cf8d2f5812f8de15d45f705215953af4df1b7393592fc0909d1398dec5499f8b4845a1f4
-
Filesize
5.2MB
MD5aa6f54eac3b649c055a0f7f685f95017
SHA1fc34d9d014b171b2d6f3d98fd9fecc85b282edf5
SHA256920d0c21b7f16de0cb4e9996651f2315b0501660c175d92a8946cfe2a90f5a6d
SHA512d0d6c24fd30249388ecba40e80fe785fc00affeb739bc619087846fef86d540992a3c41d5766eb880af2a41c1f5aa8a6c44c8f24cd88acdf62295680906e2dda
-
Filesize
5.2MB
MD55b181428e9896aeb1e3589a23c3902b0
SHA18dda8cbcbdb36c0f2044e1c474c83d69d0a78510
SHA25670598f2076337b877ca163ce2c6f600181d3e71a47c93f4fbcacbc33ed7246c8
SHA5121cab9710cf7ed7f09e5fd1879c0ded58ce7627c174f9f15165265e2d7edcddf001cea3084a0e8c8a0fe28fa56b42e0f7f4d14dfdab122af3c27a74b342098d7b
-
Filesize
5.2MB
MD59d07d51f4b99ac38b936503d01c70133
SHA12cbd0e77bae421d63161ae5a48894784e75d7f7d
SHA256a53e6e98c2e3aac434c9bb4c6efda0c200821ea01c6a60b9594444e9aa1f75b1
SHA5127df9105718239b868a3864f9cb3c44462734192df2f18fc20df602e017d6f5f3c33356714edd816b6438d47bc3822306a1e95887ea99fc53036b6b9fac5427f3
-
Filesize
5.2MB
MD552898240960eec0e58c9c004a75b83df
SHA1ba483652e452153569683e87968e3f9f4a78c75c
SHA2568b6f72449239fca7d235979a49bc1e89907045d15c6f5576112448342d951a6c
SHA512f480b146c7dae851ed707403d6b566d107068da43522910119575775ac3d0b538a9af9958706017ca92eeba0e0fd55dee20b3455a3792031a9c4a0b76c930252
-
Filesize
5.2MB
MD5258941cc67231459b27e417e2c682311
SHA125df8d534060b6e196956d8dfd455c9e7c952d09
SHA2561fa3984fcd17fa7733b24c3740303cdfa06f0aa746abd2ba7807efcb9d8af017
SHA5125c9f10cdfa8c1c6d49da9d33828366211237d7f36c3a069bed66ed47ec08da35add79716628aecd77c1f03fb13363f9f3b03bd064c39fd75cc4368bdef46e857
-
Filesize
5.2MB
MD55b2c7ceaf6e79e729e56b8e2ab5839c3
SHA1fd6c3ddca01bbb50f2341017c682d98d4feab97e
SHA25681f9d53a35b1e53ef59c44c50318d791d8728bf966d675838dec9a8afb8c17b3
SHA512a86c1e0db2016e6b4f34b444efd0a0a6eadcc2957a7b04e5be35fe9d3082f8576f23103d12dcb7864fa5a597b33d95d7a4f38fd23206a47894abed2a48358650
-
Filesize
5.2MB
MD564422fbe40dfbb21a880c56c15df0573
SHA172338c7e90ebef551dc644f9d1cd32bd692afaab
SHA2565e62bbcd2610277a2d2fc9c6428fa31d1548e97e95c0a0b431ab7d9634b970e0
SHA512f2956e4936fc06f42ea4e9afd37ae1adc473b4ac536fd5c16a3f3b006eac929be9606afbcffd519496f14bf02e933acc9a0a6feb0906d5f684fbe89c264f21ff
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB