Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 06:50
General
-
Target
2024-09-14_9ac743513a75acbb7722e97395762eb4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9ac743513a75acbb7722e97395762eb4
-
SHA1
1a0443a607d6bd9e0356352e626ba773a64b1050
-
SHA256
b293c76cf1a8b59efb8425375644c914386146120fda119cb8586c36369dc72d
-
SHA512
1ff625c501344d7526640d42679d57c33eb5416fff5155a2bff414496b685fb813bdb2cdde5f26b8b06985d4db8a24a39f3e813309a0dade62ff58c7bba99e7f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_9ac743513a75acbb7722e97395762eb4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_9ac743513a75acbb7722e97395762eb4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ceJqooi.exeC:\Windows\System\ceJqooi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMryGiN.exeC:\Windows\System\wMryGiN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJcqCNP.exeC:\Windows\System\xJcqCNP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JwQVPMq.exeC:\Windows\System\JwQVPMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aqXqTuJ.exeC:\Windows\System\aqXqTuJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBytyfh.exeC:\Windows\System\BBytyfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kxXnBaW.exeC:\Windows\System\kxXnBaW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcMTBoc.exeC:\Windows\System\UcMTBoc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMzJmab.exeC:\Windows\System\gMzJmab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HorzLoS.exeC:\Windows\System\HorzLoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRdSLxj.exeC:\Windows\System\WRdSLxj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIAQVJS.exeC:\Windows\System\xIAQVJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPCdnNu.exeC:\Windows\System\nPCdnNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UivEilW.exeC:\Windows\System\UivEilW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLzftZC.exeC:\Windows\System\JLzftZC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKRSmzk.exeC:\Windows\System\EKRSmzk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcheOit.exeC:\Windows\System\zcheOit.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qAEuMTj.exeC:\Windows\System\qAEuMTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UlJtgco.exeC:\Windows\System\UlJtgco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XypgUCc.exeC:\Windows\System\XypgUCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SqYloTP.exeC:\Windows\System\SqYloTP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a208290f576c6b34662fde86e73c6c6f
SHA18ddbe5eeb4182a5e9df712d1c04c64fa11952723
SHA2564e052015c6840c6183852323a2fcf8bc49324a80ba794b06f5530c7abc12f197
SHA512c3e0fe0df26ddab33a1f5de210b1412d0a4c41d5878faa7f0b419a020fc60c96d7620505287af57a37a0b569dcb5e1a7b6e49febe77d2df445f7970f345fe132
-
Filesize
5.2MB
MD5f0a53795ab707c6fd840175cb6fe8357
SHA1917d5a0cc22a9fd603afe15a0f4f00a445bc97d0
SHA2567f453c25c1a97c80171cca361e50e9601b94b2e4dbad51d4d1e0d88327d44e96
SHA512091e240b1757e90b8a0f0ac809264640e95f2f90cefa25c3057bc237bb4bc7a5b0b78e97ae035175654e1ca9fb89d5747bd20411dbc06ce8db985b7b4f5550b6
-
Filesize
5.2MB
MD58e4978c820c8a8934ba4b5f18e2185b0
SHA1ca9b709b212986e1e704866c83f4d3063a028f32
SHA2567d54db2e86d399f8ad395d0c4f61272c5d83b8019a4f543d03979e0d41152033
SHA5124685461147d02450c1e8a228fe204a558e7f4f9fed556b200dd277c008310a113eb5ed8f8d50f43a46fc0d6a7f9761f32413b1fcc9091a4f10942b3b6d53f078
-
Filesize
5.2MB
MD5d67875ca6296c33c4c0187a7fbec7aca
SHA1235587b7285a53bb4948880681d6baca9c8d3f62
SHA256405e864b34d47bfbbef870e5b06e2ebf0dcf3efdd021210de421c4a28ac464c3
SHA5122a1a4f75c525dfafda500b3281c1397f7fb9989aff4375cefe8c0585edf656e6286b676f9cccb44ff7304bcc0170da14714ae644538f3d861dd89f574e7c974e
-
Filesize
5.2MB
MD596092754116b47c7de8cce4394b8dc2a
SHA12a14a63f059c9335434b4b15f3fcc991ad2c01b4
SHA25611882552cd807eb29f67aa1109737575fc01fd9ec052bb3c61dc567ed3fce0bc
SHA51269aea3521a9ca9d2c7c415df29c6f7bf64de335fce42fdd278a696efea64676725ca8a21e04f69fc13821d2f286a2fb574e524cf6e0552ee17003d988c27cccc
-
Filesize
5.2MB
MD5f62b448c901124ee7a7f07f352bf5254
SHA1bafcb1874ea0c5dea7c7757a3b055ae5cb429e17
SHA25631a35ba0a4d6d503291d76a42add365f5ed594a263291182367c8e455d690cb9
SHA51256d96f863f239fb329ea321bbb6acbf107bd81c65d3f796e8071ed73f66345f6f787aa09e6999b95e967a70357e4b05f75efd78f426cb23a4e04498bb1232744
-
Filesize
5.2MB
MD5411e1dce21fb868c035652a6f9cd4458
SHA13f864ed8cceb9eb12e60e14760cb1405c468c6c3
SHA2564e52d8223118d4866c7e4772748e7296841450ee32438290747e041029560714
SHA5126dc4fffd22b8312d445163670efe2a08f839abe1d6549dbf7c0207078e0037aad290f6422a0dc07401bef867d0da0e38ae3a3a80002866d1baf70882d63c4f5e
-
Filesize
5.2MB
MD5b0a5fa4fae0ce2f213f7a7a81216e22e
SHA1c4b6e4fe426e5c2f0ec4bd6a587141bbdeb1c4c1
SHA2562e1f89d00f66fef39fb669d7cda3cf98726da5310cdf5d5bcfe75d641aa3cebc
SHA512f1a2f86641bed4827bc7abca5f7b61e77f3b00782404d2c168448198a64469dd9563dfa38c3df08694731a57ac2a9cbf89f75eb3142fe2b6cdaf87a3367ac8a8
-
Filesize
5.2MB
MD5c358cd1ba20a8514c3120fcab7e31d66
SHA12763df528e02404ddda621a4a7a2afd445ef868d
SHA2566f9982b5f6600485190f194d41f761529086b8c43a4f3f8cee9d3dc84c867b62
SHA512c1c1df308be429029b3c9911dc0ab8b7ff6f913454ffbfd1c995368c6374f27d1a7c84262f556145c40a7bcd9e3315e4a9d84ab3ab339966a59f8eed4b66676b
-
Filesize
5.2MB
MD580b280271c5e5e860e37a18116fe8529
SHA19e090e5777b3d4a2a15b5f3dddbe3728006a2279
SHA256a7dd1efe09d8079181fc8fcee68c865a3b816b5a26d6b8235a27507f530a409e
SHA5127e159ddc1b05f7c14952dacb892493ad934678300f0005c7f5969a58cfef3ab9cd3ac8dba06d041685f2c5bae196831213c89c93edbc575d9d7877551b895f96
-
Filesize
5.2MB
MD559c7c19761bb3c1e6c201779a6daa121
SHA17b919cea8c525d4dba53f2e4f1d3990685d85588
SHA2561b9dcc3ba9aeb8694e75854b90047e7f88049e38036745ee623f245023dd6967
SHA5127582d62677349ae99ba92bd2b99fb272988e2307fe62a73605fef28ba5595c862c556b539d9a38688f3685a41cef3bda7e0dd9012592de0a7f1e187d409db371
-
Filesize
5.2MB
MD5664cd088c1669654bfd41fabad50fb9f
SHA15845471c6139cd3a07b3206b87e90b9f07c0f882
SHA256c5b0103887158c22871efe42016f3cda674344daa515be3b4beb7ebfb3715819
SHA5125ff06f5bf6242182aaa38b485565b156a859131ec5fe2eda366a4a6b594d9fea095256149c64acbdb61b39dc988f7d70fabf9acf3cb2c508a304ae1af4ec453e
-
Filesize
5.2MB
MD5162275728bcd852098351bfd149d1c69
SHA189229cb8a0f03444a7aa18ada580df6f7995b27e
SHA25621c2597869cc8bb7472da9ce3a4756f7d4623969ef7d266e491c5b74719aa0a9
SHA51275abbe9f4342232e7668a3c439072a55aeeee52faf94f4b035f1f24bd1a9413ae4bf62b600ace2a2f53a2fbd858cadf302b888c97320e1cba53099e6da0b521f
-
Filesize
5.2MB
MD55bd0784b5eabb34ca8b327273e1f318c
SHA176f5ff496bad3bc29da66785170bb7a21aa7e1af
SHA2569abe61e0f571e0dc816ccadf115df58e2096c8ff68807bd60156343497a15a9b
SHA512fc8cb7f384cb93a78c221474643df374f5dd297485148d8abf8dcd6d6c8c491763e6935ba034232a9719f6631be6703abeccc3ef704474b87af2ba963fb7499a
-
Filesize
5.2MB
MD53685d1474f4863539ebbd23e4980d2e1
SHA1be8236f0d9899900d963f575fea046318ce8497c
SHA256370863882834dbd472d2fb7fc16f126557cf65dc2dc7c8220f5784316c741ee1
SHA512e5e31efdb2906247664302e906463f0f028c8aceaf06869d2592b8481f181079fc9f216c06e6b24ad701b23e21e33e8b94b82aec632068877bafd550d0a7342e
-
Filesize
5.2MB
MD5e6aa5eeb3e0d6062ba56790a4983f8f7
SHA1010b3e115cb499d18a805c4f97864a20809bbc72
SHA256f94b51b985738e49240024527796fe0264aec726b30b9426be4dbf01ac495cee
SHA512c910f63037a93943105b82927dc2b64f0467e898fc88a3b62c2b6ecf284f2b33d66ef2789476ce0b270a517a4c3dc84eaf1fe82ef9d9fd966d77a7b1622503bf
-
Filesize
5.2MB
MD509be2929741678e0d4681f60c67a8cae
SHA18cd76be99228dca55a9575e8876eea52b8c907f2
SHA256bd07fe89bdf2f22ead968b5480e54efa477ab6d213138cca96c0a26156ea4e85
SHA512c8089d5784673cff633d7b744632ce468ba911fb79924c2723796a834008778bbaaa8a65b455cf4997225d1c61e84a06544a3c05eddc76af6f4e87217437bfe0
-
Filesize
5.2MB
MD58f17422152620f1430819a5681e17b79
SHA17cfbe8e7ccebba6906a54b47373475ee902ce038
SHA2564484c31d002df9ce910888f52c93eab8ae8702b33615281e351caaad6896d9a8
SHA5128381269b05a4d73825d8885459c5f495ee6b471fc08030b971697941502cc10b7bd4ec9aafb04d54a4c21288dcec7a2329e73b8a8c033e1ddc284bb0e64159ad
-
Filesize
5.2MB
MD5954c11f374536f4063876307d005f8da
SHA1bb9f315f1fd73d04392435d0443e3e5ad9d8bcef
SHA256bef43b7328b186933d29d07426f3dc92875a04eb3707e8e087997dfeeaf02aa1
SHA51246a38b18f8cff0a035a4e43fcb7129f735622792ece14283fa958a6daa269ccfce7135e94f5c58c255d5af98dcf766c9beddd221826cc2bb306f06b6c031d3ce
-
Filesize
5.2MB
MD52d3748f7630d65ff21be693e006dcd1e
SHA1d48a94cdc9e1f1f28e6410b86074950263b81380
SHA25642b886501c0471ebd5d8a53e78263f7000f3f004ea413dcc5ae3a07aa5361dc4
SHA512f482baaaf3115f43ff8ddb59528185129272e07fc4675df322073eea7cfc86c595201773d2b6b214a4fedb7477b193bbe1e3e127b005daca66f10571046f5ca0
-
Filesize
5.2MB
MD5a357bc21737fd13568fc2308660aeefb
SHA1d7ea46f9b64b9efd842baf0cba186a860aa0a2f7
SHA256e7f326da74fab1eb72ac232bfa92034fb865af2d27e4c3ebe7f354ffda9fceec
SHA5121922030c9d54900bbe910ce03e10c9cb49f8901eef656211b0d441f467e48f62d62b4d26a0e163c98acb37911a0c93c11b6c81c11c6fcaef4ee8d3792bea12c8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB