Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 06:43
General
-
Target
2024-09-14_0377dae8b56e14612cd9bcf9ae8b7ec7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0377dae8b56e14612cd9bcf9ae8b7ec7
-
SHA1
d81ea2b3e2b0f78732a03112777ac038585d1bde
-
SHA256
f42bf14d86ae90a9c1bf61962cf600178e4df35f67cc59a50f8bbd8fbca303bd
-
SHA512
6d90df723f0fb6da2518486c5a7328b5b88fb52f0dc231b99cc41b4390ffb1488ab435bad31b0cc4afc3e71f5046f806952bbd0a9062f080adcc87f1484f2b43
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_0377dae8b56e14612cd9bcf9ae8b7ec7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_0377dae8b56e14612cd9bcf9ae8b7ec7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zUGXSOs.exeC:\Windows\System\zUGXSOs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjvABkR.exeC:\Windows\System\NjvABkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhROKDw.exeC:\Windows\System\WhROKDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHttMpL.exeC:\Windows\System\PHttMpL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQUobyc.exeC:\Windows\System\mQUobyc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGsKBHn.exeC:\Windows\System\RGsKBHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKvCRAV.exeC:\Windows\System\tKvCRAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUSlnYm.exeC:\Windows\System\XUSlnYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NoXwIbF.exeC:\Windows\System\NoXwIbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vvkUMuK.exeC:\Windows\System\vvkUMuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHkWYHl.exeC:\Windows\System\vHkWYHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjlyXTR.exeC:\Windows\System\JjlyXTR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPyVAhW.exeC:\Windows\System\tPyVAhW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poooEJK.exeC:\Windows\System\poooEJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDPOAxI.exeC:\Windows\System\dDPOAxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lajEcSz.exeC:\Windows\System\lajEcSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DZbayEK.exeC:\Windows\System\DZbayEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMptSEJ.exeC:\Windows\System\LMptSEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MSqlndC.exeC:\Windows\System\MSqlndC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HbavUyY.exeC:\Windows\System\HbavUyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfNVfdK.exeC:\Windows\System\EfNVfdK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d1e9941b2aae36a38ee8690be2826eb1
SHA1629cbc4eccf442dd0c7c7581b061c9e8b7c64eb2
SHA256274a1aa50778d842a7dc2b6387c42ef2834a570ff1d154d0b41752da872053a7
SHA512011ae32b78c6cf643c1f6bfd3743b6897d317e518207d664a9a2a08fb4fe886a9abd9fc8b7972d7f84e79bc8a3862576c85ee264ca9d4a16a3374ba738a4fd5f
-
Filesize
5.2MB
MD52c76d0b75c1af3aa1b89153f4b09c125
SHA183aeb231363c7ec6bdab93e36e2783ea38feb185
SHA256720920b3b3223f49307bdb8792ddf5c84103e92a2cf14b33b888a2f767c0a24c
SHA5120e47105711c72b26d0cf96d6b53df5d4b681c2637f8b9b7cda0df0426cc851410125399dcf9ab7159c149a3f38b7e39da3c3c79e3cbe81e0be0324390b291275
-
Filesize
5.2MB
MD5d7236c43352b681a5463074ab69fd9ca
SHA1faeaa057d28330af6e91fb6bddc71abd694ef7cc
SHA2563432fc435c6a066b0b20b174cb83310b0391535176552b70bd770803f2f155bc
SHA51279508f241b4bc3e5260de53fa8f8e47f40c74814a9436000006ba22dc7021b7f11192b34d5d3a157f26a3adae2a3a8582fcb9669e1ede0a7689df46cfdec7b0f
-
Filesize
5.2MB
MD551129fdb40b4eeb97dbeca9a7e476860
SHA1c3aff4b8c077e46eb842678d4c67af40d7a7fdbf
SHA2566ddee05fa16b2ace1809c2df7168b99a2366cd140cb5f36bd6f3f06a559611f4
SHA51223d095f5e502b1cb795289b9327a162a8038d80895a5cca5dc0a60c3af350441bb4ef6187e1b0029838ec18240431111b5ab6f0ea784d57fac51c040e8db76f5
-
Filesize
5.2MB
MD564f89287398cadc112ad09c6d7bc107a
SHA11e9c3333fba4e8a16cfb269ba527f9abb5e8e952
SHA2566870bfbe9b9faf441ab4e60242a7b67f89ce0f317f0d1f7b0556bd6e8971d301
SHA512f97bfe23094ae6f4fabff783f4340275bb13a8674f2f044a823f4586538db2962dc1050251234ee5107e616659dfe9644dbc6b2d456f1740c095a6d1937f1faf
-
Filesize
5.2MB
MD5720cbbf1ca11fa46bb184196dccac13e
SHA119555caeac8b65de4a19b12e6777b562caa6a575
SHA256f25fceabf2fb66e1aeef2f6e638c0cf866af89457ea252f479348f2cad555933
SHA512be8c111ffc4d076715ac517060cc9af96f1af8c79d1c3718178a826069a96252fc21b239b9e86fedeadc4b68e4b2f428da2aaa49de0f199f965b3e44e338f562
-
Filesize
5.2MB
MD5915a67c597c847acd9152644d828f398
SHA1b94c85a641c5bf694924672187df686667b277be
SHA2563a481d5f3e8f1defccec5e10eba4c1ebe45a140198bcba1d991111d20323de89
SHA51213dd480bc25cb749937d94aa70a6f71d98997a655badb721dd3aa39a107cd9dcff945b2d40e96bc00add79b4ec13d9cd7154ce4d8b59cea9e88b08e56f54fe3d
-
Filesize
5.2MB
MD5671a80622809925df0ad7c2353035454
SHA194bddd01d403c0a40c9f22a1a161bd478629169e
SHA256cf1f654a5b0f15b82edb509f0b653a6c91940f2e33c352cf6b7b39fc2b1605a6
SHA512580a35c7daafa2bfca4b83d50bfece924555cf7d3dc653e698db2ec786f112bae0d841fbc7b00b1393ee00a7282ed64af6107a1ff604ab7eb022f08a6b7841c5
-
Filesize
5.2MB
MD5cdba09d2b2e6342c7157b13b9b854222
SHA1bfbe1501651b23d3a76dc076247960747a067d01
SHA256c9b26aaf516b897620ff66fe489b5febd4d65e788c37ba650ef232948841c3a9
SHA512e6beb16bd2ce107461a857715ab4ace232a232b8e21a79fae75c3edf19ba71bb1039579e4549f158d3577faf62dee4a78d4ce5fa2db0453048d293cc574adce4
-
Filesize
5.2MB
MD55a8c00ea2cf76421df6fc7f8fccdbcd3
SHA130fd5cd1dfe997219fdc9d48d1c1bc4d1b25053d
SHA2569445d3ce8a8b8b2eff970cd6ec06648e46192e9a4a794803868043603a708c31
SHA5127c822af9f6ef2bbe168992aed44538d975394e1146f98311ba2ec01e0c3a8316014f56053ba4b849d9e76ab89ba3a60584ec55991c839cb98d32176a361bf16f
-
Filesize
5.2MB
MD5748757d1903358039b64cbb05216c754
SHA129b782387b7ad4da720799ea67b31bec51c0bc7d
SHA25610004440a54822fa36364123fa1ad2494efea115c1ff738298d17e9bdf828094
SHA512ddd479131f078991cf3be7c8c90b2a0a80a198b1905613d13b6e483625fd258580db9939856f43341ef9486ece64174d7e245e48d02087762edb99a0f0e3f8b8
-
Filesize
5.2MB
MD56dad446d5776813ab0376590d66b236b
SHA1754c18880096d6421f5b827e5986cfad3191e15b
SHA2560d252101a5e76f711074cf95bc4cadc66a6e0c39855f14b445e7e1e8fe7f1809
SHA512b52ab09d10e4b2688c5da8a40b956000a63baa1eec089a1c2790555c5333c0bf8090c30499315a243cf19d7e5fb0de66c62e0e8ab86db52a0e2b0dfa0368d34c
-
Filesize
5.2MB
MD5c1b6c50af396d63253742c9071166d0f
SHA141ddf8042a43b5f338e02e0e98f53789474afde9
SHA25629ace3182b167cb3b00dc4c096602b9932dae8b2d6067dfa390facdcaf632339
SHA512dbc0a803066b9f5b68b683a2f71870fccd5026d2136c130613afea32e85074a2a4cbb9b24de14ed3a68c8300bd1d91e51eb39ff90cdfc37111ac1d9eda875849
-
Filesize
5.2MB
MD58f1751f251fc66f55f0224fc57ebd64e
SHA106bc38b983281b85cae66ff74ac04d3725181356
SHA256bd8fcc0447e808d4b91ae9fe91a388275af59d582a634eae7ba9b014eb67f1c8
SHA5120e81db6307e7f4fb9773c7db750e8e455790bf28b27bd45f4157e93efedab6f8cde6aebbd11149b0cb42d6c13a54ce7116945654b9214be12eacd74fca53f0e3
-
Filesize
5.2MB
MD5592796238ce0082d40bc6e10c266d865
SHA157332a6f217dabdfb3787ea8298ad783d9377f9a
SHA2564da74df6924fde510b51e92070c86feb0b0bf52db4ac7607adc51722f43eba9e
SHA512c4d473cc52826e34274826423697ceed52a2f865df4ce72bc2db467f39d2afb176630d4dbf949f8d1728d39ddd679955f5b6c3f07399ff92269c4f64d3ceb2ea
-
Filesize
5.2MB
MD58acc6d31115c2c1e705e70f99cc00651
SHA13f72fceb7d1f830441cea85a189fa0a6514ec6a9
SHA25641c8eda1243580c490fa36ee8835801b756107138452406a096fcef186ec83b4
SHA512ad80529e431a284986fb682511d40d12d607e05f4e2d8948f0e05c3d2c0898d302bdd0acc926f03b2a7f4b3e255ddc6ea8d386050aa81e3c290a4fc5aed78af6
-
Filesize
5.2MB
MD54a7a8dd5ee145390aab240b38ea1c708
SHA11b57c6baa2e1d4f3278ad550948d45dd9f0ad386
SHA2567cfac196590717add3e0a5f123d4f1509a0abddefacf5179a1c3ec636da8af7c
SHA512338a0c603c401cf9ca01bd9c97e9ad7fa00751b3fcb971cf258f6238782ed29885fe73a5ced0eca17ba38b0eaaa0df71359ac91b138f328317fab27c96fdc49c
-
Filesize
5.2MB
MD5fc7d2abc5d6813564043b977309e00e4
SHA1d7c9b459143c3d9b716f443176d08c59440a81b8
SHA256e278ad17218d48f759d040d5ec4f7c71012f305285e637da22bf96af08b0c911
SHA512fc199540449703cf217965671aaaaff38b749914ad7a97d68fa54569e4732d39573820bb9b9283ed156d8f630d74efb135f3e7c03cfc3b8a04a8d31011a64a92
-
Filesize
5.2MB
MD514b30e5367ae57fd68ebd0a519f85f97
SHA107eebf8aa9b0c9fcdbf3ff15be5650294f4c70d6
SHA2569567b6ecf8fb21839e50d9dfc4954dae70eca8aa5673846910916d51e2562585
SHA512b590efc658f259879bfbe853d8722d4a4757c6286119f03574f36735a5daab29a0258503071a272d2666124cb0c48f5ca925ef056d854c1f4b3dfb3d1bb4b704
-
Filesize
5.2MB
MD54a8b9e77fe174b2cd6f687c03a25bc1b
SHA18bedca9f894a104c613218ed973d554c78844629
SHA256b893972d8a4815dbeb96d998e5d79bcae3eedbea8ce6b3f119e1384d5098b07c
SHA512fcb693c5c77ce696f070a6d9c980905c8fa129930f45255470a800772cb4c82a72ae2afcfa7321f3b58dbc7641515ee29b777976d6305e65508043fb6b8dc8d3
-
Filesize
5.2MB
MD54ae29d789d7a215a20265d827cec5707
SHA137786a96855083dab03b87ee4156296821b10f6d
SHA2564123c84d021f9324e7a42f5535d1e01e9c807a2ba5e2952047a3412a378e0686
SHA512a145a7a2d62642e6a7667efe94ed06370ad27bfda368194d7b1e04175cacf1df5b088495e7566e5612c240b60e313ecc2b654eb2eb0b9b8f09d395b67240daee
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB