Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 06:44
General
-
Target
2024-09-14_0d5b1a5547e152107e5e2ec63343fbbf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0d5b1a5547e152107e5e2ec63343fbbf
-
SHA1
a147dd2df2649038eb258c1dc38617dcec4ebe51
-
SHA256
d4459576d0974d44a93cbff1fc38e327adaf85af1c6803e67e69dbc054afb43b
-
SHA512
9dfd4c076610b9123065caab67680c3b86b2ddac211d2ca251f4e741b7aa269c9518d9887d9a3be4fc5988896774dc60a999991b7d7aece92db9eda22722de85
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_0d5b1a5547e152107e5e2ec63343fbbf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_0d5b1a5547e152107e5e2ec63343fbbf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gaCEEwB.exeC:\Windows\System\gaCEEwB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YWmaXXQ.exeC:\Windows\System\YWmaXXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WiHjOkz.exeC:\Windows\System\WiHjOkz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRMMDea.exeC:\Windows\System\vRMMDea.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aqHwzfi.exeC:\Windows\System\aqHwzfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xDKItXv.exeC:\Windows\System\xDKItXv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVjZyBb.exeC:\Windows\System\BVjZyBb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmjeYvr.exeC:\Windows\System\CmjeYvr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shwOudG.exeC:\Windows\System\shwOudG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JDiaiIs.exeC:\Windows\System\JDiaiIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKnEKxT.exeC:\Windows\System\hKnEKxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EeYiyvf.exeC:\Windows\System\EeYiyvf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PzJDrCc.exeC:\Windows\System\PzJDrCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUsQyaD.exeC:\Windows\System\QUsQyaD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UALElfy.exeC:\Windows\System\UALElfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yHkqRBv.exeC:\Windows\System\yHkqRBv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVuARTk.exeC:\Windows\System\BVuARTk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lRjjgaq.exeC:\Windows\System\lRjjgaq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVtPCkr.exeC:\Windows\System\tVtPCkr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOxDShV.exeC:\Windows\System\xOxDShV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDApttk.exeC:\Windows\System\NDApttk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5740a450ba5d58550cfd583257525c81c
SHA116503661b58dabcfe2580e3f374779599fa172d8
SHA256894bf063e8c7309596eca369319d0a34b7e54e995bb3586f1d1ad6ef9989cdd7
SHA512907071209513f0187aa9a36f86eaeda081504f580933b02ab5b162cec221bd188421a8b5b0a5586bd2e4fc8c6cfaaab639f9c0b730b86275187ad3551d229b5b
-
Filesize
5.2MB
MD52f1d593f8c239bb9cec8f265aa161153
SHA116a473809cbf606e7a129551728c7cd09837d0fc
SHA2565ec1aad6799eb77e9078983c291e73ec6d4cd6849f3f9798e58e07961b08a534
SHA5124aed4bd4adaecefbd810919ebf2277d507db2bf57b1e7f8fa60fe7c2d9db8ca297d20689569a9f2ae7c813c227481f94729729f79c395ae2130d6f710c07be70
-
Filesize
5.2MB
MD5f6beeed442a83abe9b5b679870c2b869
SHA10749abe96b88f2cc6215a9a5a04cd727849c5aa0
SHA256b3b2d210deab85fe593bb525c9deb9ff838e44fdbd38e727f4b7d574283b96fd
SHA512f87271c4786894f1097e5296ea214fb82e4633d012c7f5548ab49a73233e4b6cdf1cef9d6deea39e66b78a74752eb327d9731c4dded62458128f731f943fd9c4
-
Filesize
5.2MB
MD52b229cb2926c4b5a99fbbade17cca567
SHA1bfcb5bd49bcdc24a31734e4cc697c57f9144e9bd
SHA2567d16d9f03ae69f28895750d706fa4bb0046119a8ba22083c848eb7b1dbbad676
SHA51224404e2d48a467ffae047457b6e4f1300a05ac5a0894ec039d134114d1ab68d50323531bee46273c7e861ac153484f612dc5c622c74652e172ea3a3fd2f9df45
-
Filesize
5.2MB
MD53fa55fe1735ac58d4ffcef42882a032b
SHA138e39449c54c63e3a5b210137b2f58892f1af4fd
SHA25605b96a0039a9babf5adfe5dda9d2ee1c27f81f1e74ccf77af0729ff7d27c1e20
SHA512f6cd62ef7981a6f6c988891a90c4b834b3e328f42e0645e752570c0be800ddc0b07407da77d35481df494d7cb655050b2dfc1b4f01cee1b3c45e1ba4014dedda
-
Filesize
5.2MB
MD5447f16b2d39cf5ce75d35b429a44047b
SHA11e55d8171b139d631dd99194914bea75981404a2
SHA2562c17349c590f350e2f80d441879088f77cb443e368d0bea86ad59e99b6a1917b
SHA5127a97501b9c62db534fda261bc7489e31b17d219787ce5794dfdb4e2759701bb4d75fa3f0745f441f8bb22d28d65309e14a89b3d5832bac9a646fbd50c988bec5
-
Filesize
5.2MB
MD5eaa9e66b7fe236173a7f0e778e762ee9
SHA1979cabf22cfa13dd8cc746ac892197d339afc971
SHA2561b537d069e1cb632d282b01366d69bc09b072f8104a921d3ea3ad519e5a4cf3d
SHA512346d9ab58e2e39a0b8a6636a6e83886675cba5748ef74078ba0dda480566274ca4fb0312ba0080d3eddee239086950619a5dbca5ebaa4af00738c9601b393f92
-
Filesize
5.2MB
MD5dff110302a5584d13c74e48436793989
SHA1e729d42fc6be9459cf0d1e5a930ab5e425dcd320
SHA256b2fb25ac284926cedeba91a2ab5fda42a5f495f2e8676e9457d6d804d4c15654
SHA51202a45e7ed63329ae770c5a0b72c7aeb42971752bd9a14d3477a164b9160193a4c42c10d58d48a75236d9afbb367731da94051e470060f8fdc7e427e68d4d154c
-
Filesize
5.2MB
MD51591faefb485760a9d1d3822e3a8b509
SHA1072eaebeabe3296a8f2b2f80b5925b47d29c7092
SHA256f3fec1e9e99f906b926156337199ad3dfd29b4d2db4e4b151d55feb50c95a2e7
SHA51206280fb5256ff14e270b8759b065052acc7915f85c19c5eb777da0e6600676e4bab20e8cfe0eb817060d85a8741fdba4654ef03be8cf205212f6672ca51034e8
-
Filesize
5.2MB
MD5ec9280f0a22ab0ece45305bb8c3ac3d3
SHA1e8233030e528812e72ce07fc0e592953dd0a7ddb
SHA256c0c0c8c3ea527c0b2006e7f575aec845e1e5bbf25dd29bf5bea30be9f8215d00
SHA51224d51202d182fe647aab34e3a1828da393e4aac7252acea48ace7d619645296e3a973701e33af0c6fe0456e4ed14614468e384616caacd70324bf4d0012beb86
-
Filesize
5.2MB
MD5583b8146650527dec3ac31d703d805f4
SHA1fe47986edabce484533e0d921efe4aef7a383f2c
SHA256f64d8a107f4af27c2afc941c26e65464434925362d7f1894d0c635cc057624ee
SHA5124d1db95de38b38d55ec2237ee93122faa29981e5cb31e295cbae9d18e85a04803c2c27d6ebb896b3b83b6a721a559c1ab2b72ca31f80c68c6eb8667fefce73a8
-
Filesize
5.2MB
MD5a195599178e167a734c48311c5b2c67c
SHA1b16cb18f32a1f7da8c615d8f2eb17677cdc09e15
SHA256d1894ad2d098282d857d1181dc1936998926011294395d62d30db71220df1959
SHA5124834104f3a5fdb6329db591e7d825928246058058944e8bbefde8800934596c1446f287322c221086475eb7dcc7bd44ac0dce2d3e65ae179f5033459ba4045bd
-
Filesize
5.2MB
MD535d2525530ae3197a0ab9a681af4d278
SHA18afebfda0e8e04a723505100a8accc3856a79e29
SHA256a7bcd44311f4a0b9cbbd64a6adf637f9089461cc41290deec8f5a170681583f9
SHA5128f8a621e15712a65bd01f79ab885be47f9bca9b9aa710734ec14184b3473c3ce143fb47e09dc3db5e9e2385503ae6151e5522bf0fd48b25055cd3666a0b16429
-
Filesize
5.2MB
MD5ac5c0a2182df5a80e76d31dec3871980
SHA119b6d2d4ef0d2f1951431c8566ac0a338191785e
SHA256d1d0ba5128d578a1d8d133826008763aef0599b8ccc35a1c0961065f1d3826c0
SHA51210b91c8d62d43edd276d1ee49c5190fcd370ea3a40e42b615f02298ed6a8a162558d0a4676eee3b8a61c1c581707936e9e2b34495bd4432ef19d4cd89572a1a2
-
Filesize
5.2MB
MD576f96ed4e308ad154bb87e457c0b8d78
SHA15c059c8b1abed204ed7ab349fef3b94afc14c133
SHA25671825c87f6d84ee6c66720f29eb1f3269cb5bd016600f10ab44ae81638159bc0
SHA5123271bedfa4f241bd14aae515f5d998f5b9e176e585df38f316ea53b2d7a2cb1e9b8f75f983b9f6fa2a3a228c50fc319a11c5070d52397f265d675b69f8300c68
-
Filesize
5.2MB
MD5c355b3d855e263f22ef25632488c8f39
SHA192861f40786f18f8e875e51024d9cc862c754e3c
SHA256d6ea9447a752fd84a0b67f9a18a310dbb260a19cf4307fe1ae0730d7cb7bcd9f
SHA51208de2cdeb844832efa7abaaa9b8c7a0dd3c53058e42f2316e5015c50023853500f2acf11bfce0921529c96b7a3b03aef113aa4235817a35e338fb5d7c2fd9fc9
-
Filesize
5.2MB
MD594dc0bf6095ab21a2377f4da90ea37a0
SHA151c1d0dec1d9c5666213c0cc80437e84b19da37a
SHA256519f318c4012ee816a20d4dbe16bd399ac7d3fa10cc9f22f29c3810781143add
SHA51291ee35af6b9d67d30b08c0838c3a7f1ad51d6a59b7a8e6dbcbfcb906f82983403cf91e19da6c97c514f00d7d8ffd59cf2c97e35fe861b83a86d491d03d40b5a7
-
Filesize
5.2MB
MD57e13ef555f98ee4c9f0171553d39ac82
SHA12dc2f5c9c0f5e45bbbec9377714cacfc446b5575
SHA25681132567210fd8b66cc2089c890e841e6a7c4669ecf90a9fcfaa8f0066a7dc61
SHA51207c6f2c87166871835754aa6aa60bb9c764f827591325c6edd0b4ca38728834f81abafba242b12d5ec430cbaf22b288735ce53287dcb3f302f08999662917779
-
Filesize
5.2MB
MD5df5f545fdd3e63d0726c38b089965a3e
SHA10994990b1d2bada0266dd480d8e369feaee29bdb
SHA256a8c7b03ef19ea44b4a4525642567c3e034773d733d1aecb74ad3b64e0e999f9c
SHA512caf99976b82aac68054adaea1d9a83e3f2ae42fafbcfa84dbec5d491cfc112b4276a3864064a377378ef5019c86107ba3c9f8162c1013262a7a26cbd808a7eec
-
Filesize
5.2MB
MD56cef8fd4fffafa6bd32658d3a164c562
SHA12d79b3a6d81c409f2a062abf41ca53937857bf09
SHA25684ad8b3b8e0705875ab44a8cc932bbac5ea8e4d30c29544330f93960eb574dbc
SHA51263440347a978dfd53a79ff2524a203697f58dab27380832ffee674874d4de5f2c2083fb671505ea8067d5c3a9ee326cc48c8646b185c948c47880e7190460e11
-
Filesize
5.2MB
MD543546ad64ce8cf8fff70ee8ddb0c310e
SHA15715b528041583d5d1c83c57d0a5255d1d1c0667
SHA256696725068d19e88699f33f19b1086650544637065a70ab1ea2483fffbd4c48d9
SHA51267b3eed3f425fea3ae7140e8964a5f07ea913faea30e7a26b16186cb7885aa7f134abef344d67453fc62e79675cffefd00249ad69d2b39cb176cfd5e9abeed1a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB