Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
13-09-2024 12:58
General
-
Target
2024-09-13_5fcca96595f491e108bdfdc9c5d66f67_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5fcca96595f491e108bdfdc9c5d66f67
-
SHA1
844089ab0eadb8afb3c6b8e91089888e4db73867
-
SHA256
21ca3f7277748891e739cfc7319935b002e977f268ea25f6c8720a0148b9bedf
-
SHA512
9c6d78b893fddebb7f5ae7405b486ccf5632af0609ece0bf97cf3a5680cac7c6b574e7ec5244fe4e5e74459115b51a98304deda361902a4df5e76d52a74187a6
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_5fcca96595f491e108bdfdc9c5d66f67_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_5fcca96595f491e108bdfdc9c5d66f67_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HzYnLQR.exeC:\Windows\System\HzYnLQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zqrsHSs.exeC:\Windows\System\zqrsHSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sotzChF.exeC:\Windows\System\sotzChF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfMphxV.exeC:\Windows\System\zfMphxV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJmSZmn.exeC:\Windows\System\JJmSZmn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DqAkGAK.exeC:\Windows\System\DqAkGAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GgVRIoB.exeC:\Windows\System\GgVRIoB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwjAAsO.exeC:\Windows\System\dwjAAsO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hCmFQNK.exeC:\Windows\System\hCmFQNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZuwKPui.exeC:\Windows\System\ZuwKPui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpfKwHs.exeC:\Windows\System\GpfKwHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QBLboLf.exeC:\Windows\System\QBLboLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MrfNzfr.exeC:\Windows\System\MrfNzfr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\elQcDcc.exeC:\Windows\System\elQcDcc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XghnImS.exeC:\Windows\System\XghnImS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjbQmBY.exeC:\Windows\System\NjbQmBY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huRCDyy.exeC:\Windows\System\huRCDyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgMIFwz.exeC:\Windows\System\wgMIFwz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SoBXNbh.exeC:\Windows\System\SoBXNbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zbdtlql.exeC:\Windows\System\Zbdtlql.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhlwMsn.exeC:\Windows\System\GhlwMsn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a6652930e6443c88a14a4b441ce0c1d4
SHA16c02ccccdde5c7bcb31942306972ceadc6748984
SHA256c6b18544ebdadbaad70c4db219f018bcb3cdc9118e1fba701171fc7093f9d476
SHA512884ece6bc30faf461510e4391a1bd933749fea7b3e2e1da26c4fb69f50dc1b858a9fdb5bf648dbbb60649e4010037a0a79e3e2ba90eed12b7a90b8770e3265df
-
Filesize
5.2MB
MD5f268222d6871be8ca80751e04a61ce3c
SHA12674e8134bb582856a4ea42b548b2b8b2a1a5f4d
SHA256a0f1282046a8b08aeda08a93ea918c114eae1a73a1a358a31f29395ed17132a2
SHA512d12c03ea1c29859f5aae93767d4a1869d0e122396ac1bc88580e83c619cff5688d849b51c22067d9761892e637bb581c64e4b388e237b750e2fbe723d8f61531
-
Filesize
5.2MB
MD5e873fb828ccc93917f1b0370fc9c1987
SHA17352b0bf4ef241e3e83cc7473574e6926aca2300
SHA256daecdce6436cf13f9c7952ea6e3a7519c74238338ed2e5fd0039c57b4055ddf3
SHA51266fb2bcdbb9bac7145461e05a7a840e3905288784ed838670ddf64d57e1fa62ef3a0f0cf2c99fcc2e12e7d455555762a391c400a48b30384390d0ff769d46333
-
Filesize
5.2MB
MD5675ccb23d7be97653496d3a75119ba05
SHA1b4dd58328be7e52b363efa36d4810ef447d88ab9
SHA2565e9e41445c313924ff26aa351da1fd03437dcd7c93bffe1006723d8f7310b851
SHA512e85578e65089667e9cffb1146a6dff45445358bea6c613772f389cd46df4de75276169cd48c09c20cf6f1814420ab5976826c138ef1ac6a04befc82954148e9d
-
Filesize
5.2MB
MD5f0c22739c8c05f6e89fa45af2bab2f41
SHA1dd5d6a123930f6c10ab45ef923e5c4eece0f226b
SHA256eee824860bf290d44ce188a7a51305419d7c32bba67cd01152cc66b47a5a7642
SHA5123c05ffde1547bd1ed4227c66999d13f9379edb7fa7d1740a2c6f8496a5e88b8102c76da70a5c97aebb04d693ba29f1a7c5d302bab9e39d6d40fef2dc244388e4
-
Filesize
5.2MB
MD5cd42da5292596754f2feb4cdcdeec7d7
SHA1eeb820f4bc527bd7cf42af04638c9c6d7896e513
SHA256c4d09dc0aae5352ce66cc3cfa952dcd3db472eacc69d6bde56588ca302a5d161
SHA512423d869851c741790109517fc87cdb8cc0101be6259fdbaa6594f816a68bb3a621e9bac07d497249c2660492a597a9208b2d848918eba42173e8b3c30b95ff26
-
Filesize
5.2MB
MD544c37c2a6cbd08af808545ab296ae4ce
SHA1750469ae5e7b0036625b3f5d2ffedd7c483c3d63
SHA256aba22572986056a40f2e8bcd4d47f82ef4cb8b0b595b83d81fe84ec17b98de4a
SHA51260f0a30c226b33a715e61fc32502366fea9f5da19d3a81ab0d91a6a50e8f2ca65925338f558d6918b8419e8a775ab7ae411190aeb5d68f42ff1edb5804cfa7f9
-
Filesize
5.2MB
MD565e805aac960f47c0df9a7e533893fcb
SHA1849dddd5fdb3d969164acfd4c1919247e5da78e1
SHA2563b93baeab946715e20dc0b0d600427e4bad852ae1a667d2bccec0b91684a8664
SHA5123debee3051e8318bab7839664f589e00f0a7b5355846e1a134e9cfa92ec00e275f6169039e5f78a82c91fff533697994833872bb9924e621220c82a203991f98
-
Filesize
5.2MB
MD56588cb1f5e3d90b1cfbe9f382cc6110e
SHA1e744b3e9ce8f1a834c30ccaaff6421da27c525a2
SHA256d72bf78df01f3c4c3aecd8a430f7b08766c241ef69256136d02aa34b2e5abdcc
SHA512e8d3607af9f68c4f39e44b1ff6a97e0b35e19ecc7660c29890666c8e300a041e16f8747b1d01ce2de5696531004f62766c3e4352cb254aa050f3dda7b0cf92f7
-
Filesize
5.2MB
MD5446f559c91907bf7c05db8898423bb30
SHA1f2a23aee8171ea40b6a4d4198cc90ab3c50208cc
SHA256c0d2b7dcf7815bf8bfff01ffe19945e0b23d010032640b93f1334bcf2fe9d83d
SHA512bec08f04c3d7280119890c48b400d7cf2cd6c312fedf1543c0da60f30b1f18e42f1ca2666b5766e22386116f0cbd46d763a3f62b9b0a88e71abf3b305a7b2ba4
-
Filesize
5.2MB
MD52fad9628bfeddf505fb4c6b1b98f9aaa
SHA18277f158e1869388da8e5d50831b0bd919a5f2d7
SHA2561ad4e63428461a3f4f9d94a9915210b474a4274062097e9b1a53e3e0257fdc09
SHA51276c52b4923cfac233c156a64fc3b4b85b9abcbc05a36da231399fdf9794146996fa2afe50a0d54f2f4327ee8065a5faf8b6f788f742ea7ad6a4828db8f881e84
-
Filesize
5.2MB
MD57f7fcf5cc4a6aca36d15af00900cf579
SHA11eaf12ae713a3e39a73bae83210f1e4366804625
SHA256785a7c6dc9e8ca46456d939d9168006d84773f115a03112524ea2e1452d639da
SHA512a538ec8f37143c925c0a0e1fc82c1f0a7fc9eb002e3a7453fa9fe8f72c43e8c874b28941876098d9ce2e82e3a95e066aba253c2c63deeb35d6d0efd3180ed526
-
Filesize
5.2MB
MD59263f7f19b9eff6ae4d62eb79ac468bc
SHA1ff75d675f41fb8255e1a0f94fd27d6e8a99bcbaa
SHA256088782a6d98a060bbd32915b3670ee0a59b0be159d7d4cf202bea02494a861f8
SHA512dd4d776544576057c7d6b3a1b2394382a64e60896936138bd5894589b24cd55d75ecbe6ace2bce4a89382c47d12be973f2a17266f3f26ec240c0b5e38bdc7be0
-
Filesize
5.2MB
MD5820f00f67953cf48555c972e43c42892
SHA12e096a08ce65294ab1c0045f09d5f845137a0665
SHA25674d762075e8f1315e702a5822778e6a847d8f64b3e5fddaef8a82bc068792e85
SHA512acb2f15d7aa6399807a7f9027172de2670039805df6e01e78395f597b3e4f10a159abbf671e3c93e69e2d9e19dbcdec7cd59299e5b690bdb502a11bfe68355f7
-
Filesize
5.2MB
MD5e61d69801fead0c0a82b2f379f6e66a5
SHA1d1c4517af84d5249ff7cd53eb44718322d3f699a
SHA2560312e8ee75fd72a059f8006a494487b015a113748a1bd8c899c0203848a12b3f
SHA512c35329da088696d0ba13820e7ca34bc142d525b85418f555eeb1482f13626be469b95cfab09c8e283fc052553cba20d019826f88af86a9d99d5f9f9f84a8d7de
-
Filesize
5.2MB
MD5a4968b1545c5da432f31910da12e209c
SHA1f640ce33d6e5617657eec763e4e007c05c474f6f
SHA256a8c07e9b8b226a9ea9840d822791595c57484e022752158b60d4dd45a899664d
SHA5127d11e415c74772d1e431d5087523b5ad1f09fbebffea94241543f84cbab977a306a319578dd5a964e5d9702ba01f3e36caebcf551aa3613757ce4cfd56589288
-
Filesize
5.2MB
MD5024e11f822a29be3559e887d37216ee5
SHA12e606fdd87948853597c9bbea5bf16e574dec383
SHA256440f5b37bb77409170d69dfb7322a64bdb8afcb4bc4026dce2ceab9a315c8878
SHA512318b9dbcf5c6aa28a0b23b073508b278c49cdc69f8a5ee44ce7edbc8b3ea66d6ce49a775bdffb8f797ba6a807b62e073b8afd2ebeecb944ac2cd7c207c72d142
-
Filesize
5.2MB
MD5bb042cf15c37a2eda96a1a5eb27a2e59
SHA14b3631f92d091cbb71b00c2238db2d1833c94d87
SHA256aaaea71966d39eed591a72558c6729f505fcf14b6360b12c8aba86222ae1080e
SHA512cd41eef233d1fcba3ee45190407057e005e9106b100d9af7457a09072d6eab9ff584ded344dd5c242c0afecb150bc6d53f0d78523d918793367f348872c82a19
-
Filesize
5.2MB
MD5aa98ce26814ac21c34fc597a122265fe
SHA1363d7e00c1ea7f7d179b6de01a2935c88c207b11
SHA25668fdcb34dc9995f006061d8d79b22510d86807584ad0a5d229e5e821a4775ed5
SHA5123439cf63b2830e728cc78fa5f07adbed8d8b44700df5ca28783450526eb7e656c330f8044409d1b492ecd76f09f0a2f606c25a3cbbbd7c7cce1e3fcf5ac6c27f
-
Filesize
5.2MB
MD5c7478fa5acadb13f5aaf170026930f22
SHA16aff6eefa0485f4c0fe3bc11a3c284824206b8a9
SHA256bc5064f10610cadad1aa41e292688e82ccab7a3ccbf5451e75c27ff90be94e69
SHA51207bbba62281d705e25da787cb8aa6fa72d0b7ab1f1a1d414703c485cbf9c14e2a0d64aa8f175e6945025ff76e87bd25ea8da6085230a448c1ca4a3a8587db778
-
Filesize
5.2MB
MD5366ee4e66c830750c634b9ad8888ca2c
SHA119c5cec4c1ff4da64cc743ed4fede2a9e7ff06d9
SHA256d3c5c2f8aebd11c19fa599bf2ddc72383e67f0d81f00dabaf8c32fa2e37f1f2f
SHA512caf9a4cb7d6629d480610e3e0224acf878f63bd9b2811d73cebfc9020373ea3e3be5dac7b156a9894e83e2631768ccdb61f858339496708aedc8f066fa6d1282
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB