Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
14-09-2024 06:48
General
-
Target
2024-09-14_328db1ffbee2b626e32a9cf3c8882054_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
328db1ffbee2b626e32a9cf3c8882054
-
SHA1
a31c06b29b3180a1df3054b868e6656fa1ac0e14
-
SHA256
4301c0c5eeaa6cc857a1d2d3cf25b340ef92041599b8b711293fe2411fa3526a
-
SHA512
b4e0c3a7fa3b3d5b536d723ddace7bb32aad7a21eaa67c27057492a8fe6da21550cf53e1cc6c71bba5d17658163d9419ead30ee24efa381ac1ff778f09d5cb10
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_328db1ffbee2b626e32a9cf3c8882054_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_328db1ffbee2b626e32a9cf3c8882054_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HcqebbF.exeC:\Windows\System\HcqebbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PnOeCJa.exeC:\Windows\System\PnOeCJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mfKYAxa.exeC:\Windows\System\mfKYAxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uNvxENH.exeC:\Windows\System\uNvxENH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQkFulz.exeC:\Windows\System\nQkFulz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CfapZtg.exeC:\Windows\System\CfapZtg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ucAzQuu.exeC:\Windows\System\ucAzQuu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbEuVuJ.exeC:\Windows\System\TbEuVuJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTUIOuU.exeC:\Windows\System\jTUIOuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVEjbbi.exeC:\Windows\System\kVEjbbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYvrICI.exeC:\Windows\System\OYvrICI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipafotl.exeC:\Windows\System\ipafotl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJnVGMp.exeC:\Windows\System\SJnVGMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhTOrAh.exeC:\Windows\System\hhTOrAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wommOYA.exeC:\Windows\System\wommOYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QEWQDkj.exeC:\Windows\System\QEWQDkj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WZVytFn.exeC:\Windows\System\WZVytFn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIIjJnl.exeC:\Windows\System\kIIjJnl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmpFeYX.exeC:\Windows\System\gmpFeYX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lLIbgCi.exeC:\Windows\System\lLIbgCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQfScUW.exeC:\Windows\System\oQfScUW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a0c68604406d3b25a469a3bc4f2de68f
SHA17c2b9e27a6aaa008200089faff04f027173dfb5e
SHA256272887950f0dcd879640d2c157ca2e16c3e4889c78b840e1f9146bd44b58ea3c
SHA51298d7714f0b067399eceaa24dfabebf4990bba842c587f5329a55b67b64ca5e5ea27fd1f5c859c6f70a05fe3e0e6ce9aba5e1091cb240d7ac513644c22ab770e4
-
Filesize
5.2MB
MD55f4367bd4538faef82eccc50c0956472
SHA166579d1c60d12ce813af9af3a4b92d93ed42dd00
SHA256f7067fbc24eff5d75e644c1c9bf31c72b4d7b33c35c0c2b9f04f473d12c2815a
SHA51277dc071768708ba8418a69eda8fd3f6cd1990f6fbe424f7ba256e1e102b1c2995a7ee55f98c645617395a6dcb2f4600b622e3597c3ad7fbcf8b8be6f2b58f64f
-
Filesize
5.2MB
MD5b96d22aa397df5b510366541d9cafdb3
SHA119aceb1f7cd0eecf8953da4e9e431a19ee238bd7
SHA2561e9b8ba7359518b5f7ad2268541f8b757c46b150bf406f41db8b0bf3fd1f502a
SHA5124e4c6f15c78b94dbd8e1ed344b605d8bd02214171a3be4a31212063455a66f2770c5a2ae3d3ab96ed72336e405766e68afe807cf4bbceb4ce22fe4b68ff67119
-
Filesize
5.2MB
MD5c5fc827a143018ce212aca9d6aba6e73
SHA17cc27ccc48f33e8c5117397ce2dba374811bdb1f
SHA256576647692a4bf5b92eafe798e92143da0f0d524951550a9ab5df74a408503781
SHA512818e779d273d1699d1b6d7045316da8ff727d9afbf93a63d464b12c957c7cc998b38293de8126b95179f9c08640c7ac03ecf0c358cff11312e0b7157dde7aa55
-
Filesize
5.2MB
MD55934385f935a6076788f3fb53e959cdf
SHA1b2084bb0d721037b20b9297ad043cb94ba6f3b95
SHA256bf12a568185c74a89927ce13d2373962a1abcf5b46cf57ae9c5d0675ed2ba9d7
SHA51231cf9b44045cceeb49f65c0b05e6f10618fd92881ec64dba54344970d55e058686113a06639d13f35682eaf4b41907b3271f70c7257d612e69d438323d48da80
-
Filesize
5.2MB
MD583b674dd987e52d64d5b26cf0c84b534
SHA11c71157f0d641d637fcf10b3ddc9478388967a07
SHA256ae695fc0145a45fd4a2f11f473b10bb2a017ccc52881af096a504ea9f03cb9db
SHA51268a0a9acd0087219b6fdb26111fd84332e0d252a849dc8c9152ce3964b33e2c8a1364f0c10c3ab37a4c7f22bd228fc3b800be41717685a081d3d0e6d25244c85
-
Filesize
5.2MB
MD5698038be670b18a195421fcf106649b0
SHA17d77f119ea3ca1278d9cb1649bcb0f61160daaa4
SHA256e57f16632864348e402859d2c207e4e01b8b5e9c313cf0bc9a646e53b39ab7bb
SHA5127a7d3e32e35fa47c710b9cb36760207f9931341c23d2a7f90c991bfa137a59cda357513559fee12347e19bc860d5dcff78c6323c47c15daa14c6b344f8483f72
-
Filesize
5.2MB
MD545b15137b7ca397f2d348529c4cc956a
SHA1fc8d5bd53dab00fbee6c07c3a92e7173f02c67ef
SHA25693841b2dcdc85187b3187fccbcf43bb81929cd95335c90adba8e071ac2824f7c
SHA512e3b54ef238e3749d3fa9b5840b473a30eb7658c164925e1a3c971d27e3934a2a3b6fd93f01fb97794142474b80fbaaee35420b1b53e22dcf060272674c0b9838
-
Filesize
5.2MB
MD52d0e673093ce67d0945cfac9dd703042
SHA19cf0068d4388defce9a201a7a4a24ced87f06db9
SHA2566dbf0bba272780b2785a96f7a28e60857337acd38d7da0865d893c0ac6963231
SHA512523b391de2e04ec472b04270becf4350bcc5db2c9070a6e13cbb6e8a3e331ba57611d09d5362aec6baa67225f3380841c188d248e952e2aea63a997fe7cdb192
-
Filesize
5.2MB
MD5e0d093998343260eea0f09df2f1fce72
SHA13a071c12b2228520473b5ccefb34e968d0cd81a5
SHA2566e78f0518e41443002ea705f0f98bbf727c037ec7d1850e3e7df49bc840be18d
SHA512cd3b83edf305f3785d1378872f5273842fa4cbe4e80b5a868b7e37b80bef429c96a1c6236390d7044036f99d4d426a4ae8f08e99360aaa4add7739069530084d
-
Filesize
5.2MB
MD5bee9bc62aa72c78701ab40804c0fda00
SHA1884f9fe05547761449cf78194e58d7b121195696
SHA256dab5eb58efaf9ec7edafc9e3f770be1f6e877033b95c1bfb1030d754a10eb8ef
SHA5127301857a439350e0bd0c70a1ef80b5c6789869ae48ec31e7421d246a4cad6bc071190f40f57b1f43ea9146f43ba7e7d85a943b8a85b109fcae8349b5a168f62a
-
Filesize
5.2MB
MD50c8a231b7fc435feb8e0ee4ca9bff048
SHA18bf0e1dd261c38332251bd6ec0c15b82fcf41117
SHA256daedb11f1caee2bbb18fe62d0a41ee19bea486282b9b476239608cd02a95edb8
SHA512963a463989593a6e1b41dfabf559fd0d520a8312a706f5086b1fc3e65b83a41167bbe21f11e66b73ed4c22c884cb77f282baf5922e3e7a022b6dcbbefdb77400
-
Filesize
5.2MB
MD57053dda92c00527c415416ad95f2c67c
SHA133da060487514d0db0796f4154c8f21124919f3c
SHA25698d7a77dccb6273f192e6e86df70fb60ba6403e2f88797c9dbaebb0be2fd4266
SHA5124cd7670ee47c822cbfc7f41b3f97e4850edbca3d2d95c622eb7d3272346b91a5b71a5296c6b27b47d33a3c86b987e6933c82215eb0bf903e0db4f2ed7b0367d6
-
Filesize
5.2MB
MD57ceafec0403c3639a2d71d9e53949dec
SHA15e90e78a5ffc53c392dabdc13ca82374d993d8dc
SHA256971a799a2d941982ff0df54ca0c830009c30965199da19a83eef29c85c63a07c
SHA51268c47159557b13fb40e9308c03114ce20d97d4e772274353cfe949a6deaccbd8b894d43a48efb2e0cd3a195cdf1bb6486d5dca0196f2013c2f148cb9e8a9e930
-
Filesize
5.2MB
MD56c0f8f08f26bb84c15a7a40c666143d0
SHA1c35f341f08219987605202ae475de5db45966b7e
SHA256a947975a9cc0f2e25db9f0afbddce40b37c3ffadb7196c40c06fee1b85ce4669
SHA512ffd228185e79fedd69f83000946c892cf5428398879c4f4c74182350aa2367143cbf4bb80c95831c19766eb95253c3cfb1368475d1581ffda72e7590174d3458
-
Filesize
5.2MB
MD5cb3c6d78389859ef13bc7d8b0f03b506
SHA13044371c1381420427a1d312c43788f50fe0d4cf
SHA25668d992801664aaaaafb32d04a9a2b12285c0baed1b419fed3e9afbeb2bf2a8a2
SHA512f1dc2b8e980f4fb572a365c19b958b393e5bf58e6be55c4adc0fa1cda7921a38d48e1d488c0eccef345bd32c6a7fac2964e5f1ae5e884a59eb91ff38ba94e5ed
-
Filesize
5.2MB
MD5619bc9a2218e44c3eee91d6222571745
SHA121471a1961c2bd77c36619fa604ece92b029f46f
SHA256d246935312573cbabb6ee62b1c1ffaebb15d31764d351d700ed19bea648e8f61
SHA512d6a7370887601366709d4a7d53e8fcbbf78eae38287bee8e7058a2284286c92ae3dbd42990a0a1daa050a7ddba3498e13c4b1ff7d6d5ae887e08073554949892
-
Filesize
5.2MB
MD53733341b875ee64bf031922d97a2ecfd
SHA1ab4b247b21ff461791d2940eba96954df65c0465
SHA25605b66de498e8d025ae1f42f57352e64673d3325b967e0e23e24b008452af9761
SHA512a9158f3be8f3b799535ab7d89365dbdbbc0dfc022466baa954f2ff59a46f8817439ccb87e67f052a3b447ceed230ea23ded14e7e00883a56e8e68b5bae22716f
-
Filesize
5.2MB
MD58c0fed74cecc707d5fafeb7f745321f4
SHA1dd34833223ad29c55433b438695f5ef98a12ed5b
SHA25698400f72d61a9c9841e05c77a42310ee0fcac7b4db078fd47e55791718b64ea5
SHA512cb40edc7c870e61231bc8812152d12a6df9772979ee3a346414c21b33db01601028be0c954d2f2955c5483b62d0819d73b62aa84d8c9762719bef24b6c8c3ac6
-
Filesize
5.2MB
MD529f4e2a700e1a92979d168cbd3bbbdf9
SHA13eb35d71ed15381eaef6029f9de4e97298ed5da5
SHA25635ce09dbcb2e978a088c51737f451741b16417d16cbe8b0d670eddda1c2c0922
SHA512f75248129dabb7d9839b5bbf5996d77a2f5ce9fd4d13d9bcc8274a14e231d20044cc338e877d40f025f8b61fa07bb181eaea2fa9b04b178fb5d4413510f89748
-
Filesize
5.2MB
MD574a5b114a0f2fade754535e9738239da
SHA1f3f26b8d114b982a6fa8097dd4db43a510c3f92f
SHA2560e2852181c25067efa8f2d75a8d9167914a27c5420e8566f735968f0a2b6ac6c
SHA51253e6a5957d39a231ef2e079cebe0eae782db9f77e1d8bc6de1347a16eb6a3b459a46b2a83fa977dd04a9d3ef6d3e334e5aafe8e7e4af7ade4145d56f61512680
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB