Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
13-09-2024 12:29
General
-
Target
2024-09-13_095a2ddda2f001900c22a50e695fb267_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
095a2ddda2f001900c22a50e695fb267
-
SHA1
5cd8bea21ee12887f23674870104430f022e288c
-
SHA256
8cddde4d830aaefb56bcab67aabf1f3879cfe8e6a90cd06396929a9dceddb83d
-
SHA512
d06f382a4c0b7e2751df88806c4e8f091a7b960a8187932ae1cc5559c2d5bf03d00372f755d05f16c77e8958e457b3aa985b19a063b66c1ca775c3bbedbd5c3c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_095a2ddda2f001900c22a50e695fb267_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_095a2ddda2f001900c22a50e695fb267_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hAQSFBk.exeC:\Windows\System\hAQSFBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BgMWvtk.exeC:\Windows\System\BgMWvtk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HTQRGbv.exeC:\Windows\System\HTQRGbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mHGAtfF.exeC:\Windows\System\mHGAtfF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hTPYfpw.exeC:\Windows\System\hTPYfpw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlQDfCW.exeC:\Windows\System\LlQDfCW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YTUYftX.exeC:\Windows\System\YTUYftX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmuQitM.exeC:\Windows\System\OmuQitM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NuaNNkK.exeC:\Windows\System\NuaNNkK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntiHXPJ.exeC:\Windows\System\ntiHXPJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ceYDaeo.exeC:\Windows\System\ceYDaeo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYCUIBZ.exeC:\Windows\System\VYCUIBZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FOeqTbf.exeC:\Windows\System\FOeqTbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMjJVBz.exeC:\Windows\System\UMjJVBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cFVJhEt.exeC:\Windows\System\cFVJhEt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMxhZLp.exeC:\Windows\System\pMxhZLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QaBqRYB.exeC:\Windows\System\QaBqRYB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HttuCLc.exeC:\Windows\System\HttuCLc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\loCAeka.exeC:\Windows\System\loCAeka.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYdCIlc.exeC:\Windows\System\lYdCIlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDRhtRJ.exeC:\Windows\System\PDRhtRJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD580d3c3177f1f6d87b682b6d285bae317
SHA1e302d68b25b5c3b8fc9de28598ec743c044fe5b1
SHA25610ef7a097e58b08b6c5546a0a1a26e8e1f4f9cedac973282f5c5517f3155b512
SHA512e8cc860d2c8503c02b6594a6059b76f9a8befc8839c234a20ca277b17b554a16e95aebbc94697ac39f88122c01f98a99f56b82caf9b462bbde7176b9bae723ac
-
Filesize
5.2MB
MD59e79203a0feb5b9a6773b2cd49118159
SHA12d5bc6267b4566d24aa050adb304640593fd4905
SHA2563b45c0c3127a46111d032f8d9c8abb1d310c2711a270ad249099feacb49d170f
SHA512002d33f49cc0e70d9761a9c2a29dc08e93346cdc256d32e9ce83890e2554ee784dac4ae2690324784d478ef38d4913211e8601446bf06e519783833df10fa99b
-
Filesize
5.2MB
MD5ac8fe0310ab123f54c6dfc66e6af4753
SHA138e1990c4cfb2480e792473b0104ce80a97516f1
SHA2568836d8c43419016f70e029ed664751e428a15858b914e02260c50210c031650d
SHA512a5623671df17bde36c25e32ac8016358ace11545f832f930777c249ae9f0977769cf400d0f3df6725e96440a3b8ebb060e3b6ff3ecae67726f245323ed548b48
-
Filesize
5.2MB
MD54d1081e480efd623b57f5bd38e3479e8
SHA160037d10b10a0f02788446b27e0dccbb0e7b9eba
SHA2562bd49feaaf4c6bc17a64e73a5bd8ed7ce60c89057c275bb2dd7c17b022a45fae
SHA512d66fb093929e31d15de4c4f6646366e9e79a1c389018434b348bb260f3ed439286c749ec291466b5331909dee7ca9a35b9d9891faf2e494d3fbbe6da39bd050e
-
Filesize
5.2MB
MD508127dd525125089127174de72c954cc
SHA13f77f070230e126c027b540d2a22c0b898906ad4
SHA25682a71aacb24556d86600dbabb285fb8cd63f9ea43b693e9c9fa594270f73a735
SHA512528dbafbfe760dee7c1b304a3db1f569fa3e0e3a85a100308cbade0117e3dc3b7457c5f52b248d29dcab38d5a7b0019af2fe7d3da4a5a0707207b4386f072890
-
Filesize
5.2MB
MD57833bbfd75fd4ade820037852ec778ee
SHA1ed622852a6083245a56fce7ceb66421b85417be4
SHA25623fe66d0aaec37e07d0289d8c991989fec3d1327e7995c7a75d734e80fa7a067
SHA512b018bedc890d7b3cd7757476edcecd56dfed0d85a95c1d63bf2c452382b7a406e9f528270eade181634a6f81a47da2706657f52d0697cb0ec529885ee2267dc3
-
Filesize
5.2MB
MD5d7afc8d4382110a199cdc585c9285f07
SHA1462acbd587dd1f723d3d8d8ca767992606320cfd
SHA256f33d26391509aef8d8ad4cf8a4a2d48d35495e0531f90a7d35ab16746020ff37
SHA51247e95a892d60329ff4cd1d0277c3aaeffe4bdc8d442e487f2c8d2332cc58fa4eaf16d890b4fe8b6ce37c3cdb2e30baef99bfc4b59a96e886b5d951dacae131ba
-
Filesize
5.2MB
MD5826ebf1fa91d9275c3379b844f28b57f
SHA1f626e39c9b8485ff06991d60bfa479faebe85d0e
SHA256b06050df2ec9b1b0dfb5b73caec40499da896d151da4178095db7d14092863ce
SHA51288ac13292dc4734fe258a81b8108463e905a496d0b83275c254ad8e28002b2149a9acb3af8281475c4a4493b0c4f4390e16e6167585b77cd69ff6c33627635f5
-
Filesize
5.2MB
MD56436a06171d11fa205647a3cd57eeecf
SHA1ddf1d3bbb31b7f1e14de66e4a18047bd21507607
SHA256b8bcd0eeaf81d1b3b3f88487689a2d741b73ce3d0d418699a34575d82785a52a
SHA5128f90d6813dedf02f02fa448751219f157dfce2305abd3b5f4aeb99044be1d761c501a78be7407c3e80dded168d654015f00b159918f681592accbc0b909662d5
-
Filesize
5.2MB
MD5e6b8ac9dc779b764a711619a64ee652a
SHA15d54049df6f32bc33b579e46dd8aafc412114633
SHA2565bc54c5fef2e439b342f291122fce7c14525b54a534416cfc222c0ba95f37f21
SHA5122ee942f8e331548fb897a1b5838c16c5692a64779a8bee88546d483e4dd7a76157132c87724c980c7e965107617d73518b55becdcf047eac3362a97b33f8f758
-
Filesize
5.2MB
MD55afa61da8717c73c5481dba8923b6538
SHA1801a44efbd3a877abd877cd637d58ffaff061185
SHA256ea08e75b0362b187f365c45c33edede7e68d79d5dcccffa05af11b6a367bf4e6
SHA512c77b24f7c03ee2e274433fe89e955ef30cfd8f7fe4783bb3648d0c5c882e6fa9c5458cb07e177ba6c6f4bd1b6b35d9faee2d8fcd35f7f116166c429dd4e33f20
-
Filesize
5.2MB
MD51a1890c5d27f9a06b1e6fb4506cc545c
SHA1ba9961e81bf72191d8f6568805cc6534f962d1c0
SHA2569e349f88ffd54a7778763ef3c183abcd3568ec886c24160ef5252b77d28d84d3
SHA512fe5c8c87d41a2bfd367f7a4891ca2c84a5f08b54ee398386d4dc73c914ebb0666e4b354fd747204b453f5599bc09cdb745910b8c69e48a5da017afb1d17090a8
-
Filesize
5.2MB
MD52079f3834588e3056f5fbb4461775258
SHA1d9cffc823635d29a89b67de5afb27204ef356891
SHA256bf0c80d5ad91dfc8a3242e4aae9ecee247c7c188423d16007c2117682574b544
SHA5121631f023585c5403fca432b38ca9c8dcacd93a12f364ba29458dfc56f95064d0af31c46fbadd0ee085e3b4aed738eb1e5fa11622b266cd0d52787deb90098bc2
-
Filesize
5.2MB
MD5a392940a12d4fe6b57557b9de1b082e8
SHA103f71f6546c13954c6c4efa807084de92a06a0c4
SHA256d3decf524f3ea3329ebcec6415c1c43288bd9f1e19ce4f69782ecf7cf53d9f0a
SHA512b906737e6137f9e419c6652e6b7d20f85a033fcc267c773185703f80d5bf87361f11948f999c7e65472da90e2bdf2eb975a6f800beff49bc1046e2c0de41549c
-
Filesize
5.2MB
MD5ebc464a6efa557d5f44b08f48fa6a1c8
SHA122ccd6fd5562cb34ff2bd7a2e44c0cb943246b12
SHA2565cfda780002daf0988eeeea1aef7cdc6897c98afa675e7a98431fb9c11df238c
SHA51290511138cabd3404faaf42a987524bc917ef0342115f3b78b4f965d4f04c9fe699e87cb9754f0d0faee5c13d113761ccc19a6448930af011ba1e1e8e1534e998
-
Filesize
5.2MB
MD5826778421ad7088a7f73f505825502ca
SHA1c9bb32a6d8fe3ac0a7524d8870e3ef65fe64be00
SHA2569b6f35d54c3e4ca935f81083a79862eea17a6ebf508c27af16a138f60b4c6c34
SHA5124188735eb07a4703318260192935523f56141dc59a81e99c563cf84a0eef0f3236137c5f0b20d3673d2d626aa39519aba4caf4d28bd73394a415dfbd46fb0521
-
Filesize
5.2MB
MD581a7b9e4962c02125af53e243aed582a
SHA1ac5a8a8d5a869596b10cd1d9648865a488c75479
SHA256597cae6778c97563ea4168e3c4940d10973cf1652038c248cb702912a9e1b011
SHA512cdcc7863faf0c70fa638752e992fade8c1ebda2d0a24fec54578f6544525d02067cf16c4b029e79aa00f375b2539b144a204cab236c8e3f34b10dafc996c17f9
-
Filesize
5.2MB
MD55c2a09b00d078efb3651923b1ef2d58a
SHA1c2a17ce0de9d61531bd798293c43d8ca6ea9f9c8
SHA256d93e995bef6882bf91890db09979bd8baa76554baa1b646f6c125ce62124b98f
SHA51289b1ede8cec504212a3aeee2f27a9f52bd91f8599f3a34b31a9ab59244d822bb5a469d1ccb1681eebace15ee77bf0337c513ea04848a487186ac860dd1a70afe
-
Filesize
5.2MB
MD511d937e519db3eb1d05b6d2ce4f75fcf
SHA1bfc25f3db109450acbd29ab982430278fd418a24
SHA2564b4a27f4ea2e7a966d8e26873c2087e60047d78071efab34be1b25c3be1437b2
SHA512f2a79dc0ee460ceaae88d1f312a5f54f844490b860d4b6b05c4ae9659897c0a37b636a7fad9ac5d2c5b266dc5d4c34d637a63f04778a0b76a22e0a8469fa4f8f
-
Filesize
5.2MB
MD5996b256338f8d6e1d55e85b58923f545
SHA1b0da431879b2c86d9c39bf1e03eb13314c82791e
SHA2569739c68832467659da60d82066aceb88d6dcebc5c8bb84934af1296df433628d
SHA51234251a5a2a0dae415cb2ea8c6526331d2a42a49d7c8be63ed394c7ef816d423850e5e9a6625232e66808a1f0d64f76db594d7b52b70fe0d12a8fe92e77d6094f
-
Filesize
5.2MB
MD5fc45971a8f8673fb1a5c74fb4619fd11
SHA141e991c1c974610519a70bbb3f6f6368bbc3250c
SHA25681abea72f6fb76734baf18b3cad9e9ad9ca134268e7aa10b3005ac9dc8819d2a
SHA512c881d769508b84695d3d1f249b673bc7a3616e66042f63d0497296ffeb2060254f10a94648422ae7eb3ec56bf4af5cf3c9d495a13af4cf34b2e524a98cea1387
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB