Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 12:04
General
-
Target
2024-09-14_0b7fa775d690756e95f59dc09444e521_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0b7fa775d690756e95f59dc09444e521
-
SHA1
8250fd3fe1cf79bf12830e11bbb2d5f6f1b94e11
-
SHA256
2c23c98ac83c66ea7ad7c2ce191c37026c2f7c6ce0880045a964db7be2856bbe
-
SHA512
5b07bcb2a20a4ff19c84ea816717c5c882d697bff07683c104140049cd10238a60f2da46180f02b67e9f5abcf0dc00cdf1e5256c6f8bf0dc502a5d930b3168ef
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_0b7fa775d690756e95f59dc09444e521_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_0b7fa775d690756e95f59dc09444e521_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KgmQHTR.exeC:\Windows\System\KgmQHTR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYwFMSC.exeC:\Windows\System\hYwFMSC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGjZcjT.exeC:\Windows\System\HGjZcjT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqwWFvV.exeC:\Windows\System\cqwWFvV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsxoXLx.exeC:\Windows\System\PsxoXLx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omMtJkl.exeC:\Windows\System\omMtJkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIXRvAd.exeC:\Windows\System\RIXRvAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RyBHwfM.exeC:\Windows\System\RyBHwfM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GuCDtlQ.exeC:\Windows\System\GuCDtlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huLXLZB.exeC:\Windows\System\huLXLZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mNuweXE.exeC:\Windows\System\mNuweXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aZNoidw.exeC:\Windows\System\aZNoidw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYDoNww.exeC:\Windows\System\aYDoNww.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\THTLiNJ.exeC:\Windows\System\THTLiNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eXxecGv.exeC:\Windows\System\eXxecGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DRUQUgB.exeC:\Windows\System\DRUQUgB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvILqIL.exeC:\Windows\System\LvILqIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUlfBjZ.exeC:\Windows\System\QUlfBjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfXHege.exeC:\Windows\System\TfXHege.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZZIrymE.exeC:\Windows\System\ZZIrymE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHZMnkt.exeC:\Windows\System\vHZMnkt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5857e12084c4bd1d60166fa09eceb4321
SHA1bcb06086f39636da66c59c1478d4df098f81dd1c
SHA2566dc0c4b31b0ce10c10e601b3d1ed9c06a0b9db7c725c7cac9b5b29b910521b83
SHA512c13b243ac8de623a2471995c884eb01d134354819cdca1c89a9faa0aa0d3aba95da88d0bfee8025d84328ea7f848990daa4c92bd0d99799d37d827c0ddd0e2c1
-
Filesize
5.2MB
MD51438b890261a373d9767aa0f6cc0ca54
SHA1f5f39d33fb230800ae5540531f7dca99d12fdd2e
SHA25640abb6b07707f9c4d19b0b223ffcab2b6529c72eea7d87dccabfc456045aa858
SHA512d687d56aecba832a104689ea39de3a8c2d5e23dd2232398a546a67bcb988de301da6362c05e93a1481c600e4bde0585ceff7f333cccab8430b50e4213a62b1eb
-
Filesize
5.2MB
MD54ba3e4370a2d15e193ed530a6e838b13
SHA112249fd5453e3be7247dbd651b1e722191b6b9f4
SHA25630972e4e0dae67e5250556762b33b307de6ea8cc48b2160dbaffa13155b44e64
SHA512fb7f4d2d916dbd3f31cca70f906e06d7b49d5fcc295d1683302c82a20453d4a73d23bff6425558668fb66f9cf1d76cba281e7fbd8e11d5ea591b1bc4c579b70e
-
Filesize
5.2MB
MD5800afac9b3de76ee1d760a034abe25b3
SHA11142f7fdf56c88ea5bffab870f6a74f34218a4b4
SHA2561e54b3af8c9905c844b9db8b8d56d9ed81b6610cb184bea73a4bae76b8aa9506
SHA5126e1b7cc398dd14a2ea4b7332aee8b7c7ce349f805728be0ed082d8d2e5a699ecb5f9a33402aee4438871801a3026f95caeffe1abad9dfb45d574d747bae75b5e
-
Filesize
5.2MB
MD546b6bf11294c680dcbcb183f7d1fc98f
SHA10562c1b334bde4c1289fdae0058b2bfe231391be
SHA256faccf1bdc2c49f6e9ccbf17aa2e67b8f563f6e5965cdf60710353ee33b5c64dc
SHA512c0979ce1c02cc4dd1ae4397df40562cff6045146fe9890acd003585634762f0d3f34805a7c261a3447175d8982cecfaeba0287bf639097f4dbb034eea239cdd3
-
Filesize
5.2MB
MD5352203b3c2a51fd3313a097c6a2ddd18
SHA1e39d5d66e4d2b1f2683058efea1d8e4a24a3f16c
SHA2561bf4f4d520cacdc3fede627fa1afc2d9b5db6a9e65182bfed2d67673b41d2423
SHA512e9615d02a7f5fc87fd43f3269dd0b6fcf19a9727060c21bb29e4661063e945ab95d35d7f247b8c89a1aec17b2c52d629c084dceeefa9af5bd4fa949c0e54bb5d
-
Filesize
5.2MB
MD55c616968886ed7b2fe476ee471dc60da
SHA1e3f43015ba7ac80f5bfadae6064341bedbf6f437
SHA25605153e0d205d5c98e52f19738d75ae4bd5f7883c7ac6e998de41e7dd6140ffea
SHA51207ed04b5495a3b75b09bb0abd43f4478ad7b611677b8a2e443cd3c79a10d5b18e014f22b5fab358b2d6ec65a85b6685668ac0c2ba20a1ebf8b37a8e1c56ad8d4
-
Filesize
5.2MB
MD580a01509c6b9ea02a354c573b7e19560
SHA12c0e09d759c54e4a9dd07e72c3da8f29fc5f03b6
SHA2561171e708912d0f3f6147db5e03b67ae65b19bd3180dec31af3460825f7bb8219
SHA512f4a566629a8ea15b00407ce31d087aca4983d3b7dd000d8ac4e9cd2ec5881d902a3d446a015f012e4f05b797b02d55c93bb1183f4d4234fd650f00efc7b1ade6
-
Filesize
5.2MB
MD5cff58f9cae80fdfee93d7cdf4b24f0a8
SHA1f533d6524440fb0ca7aea89b9f828e57f324b3c1
SHA256bf8f7f2b674267311cd2e34e47770f522bf1268d62156c6738b56012a354fcf4
SHA51208656181195ec533c07dd80146b889ab61d82cc647562d7045a9866c955cc1dd1347fb5887d8fad0a6a1597f0f5dc8860b9106cd6fab9dca54052beb24ba34f6
-
Filesize
5.2MB
MD5b0c8eb5695bb93a6ccd21795da64d65c
SHA1cafdc64c3f502fc88e1668759e00503d645235f8
SHA256a8d943b405bf6223e66d863e1448369b4da0b5e83222fb8cf39ef270a63549e9
SHA512ff8d24f7f14e910534dcda4ed071540d54880494f6439b4744f5c2444e19d1c9166c160ac2a39e7610ba47dedfdbee5fa30969304efa57435138b2192c00db71
-
Filesize
5.2MB
MD586c3d0ef270f98b2d2f6046e423750d1
SHA1fbbeac0ff170a52e3e5bfd12ab88b4bfa014be2c
SHA256b9782f3597cd346333b4696849e54a4c558411629f59aff3443e84f11af6db70
SHA51255c89c2ff9899c55f21dee062cd2e16a5cb8c67147a708a2b390ef97017eb83db28621d17b61e3bfda0d317acd0e76c225f4409df5b04060ad1161d3754c7157
-
Filesize
5.2MB
MD588a8d8493a87f989887e02d7f55b2dce
SHA194a24069db191ea9a564382915b8aa4d4449e41c
SHA256db0d99b2621b8b6d2ef845c24ef18f9822b8a687c7bfebce72ad988d622c3fd3
SHA5121f49726af3392fbe2d7d329d895011f5800aab0daae3a64650118be609af83b4f5c573a82f770d19be4ce8b90afe5db8d0c265014d07b1ab70ec1614bc8da78f
-
Filesize
5.2MB
MD5a401b111a1e9436d6b3a11c0ab181eb8
SHA15ec0127b8b235883b5cbe05281dac18369d07a1a
SHA2568f23f654f10d5016c0785b4ea9b51781b29377c99208e5caedbd49c8c8ce4536
SHA512a0306b4fa989b7dae34468c38bbc6f32305f3b3e5721858662613589b59cfa7964b03ef181ecfebbb7c59fbde9cd0a51af465560aa1d01d93e3c707bfd1ee4d1
-
Filesize
5.2MB
MD5ecfa045575083c4d9fe37097dbe1c6ce
SHA15eaa043884d1beb3a33493445e7387e067e5b0f9
SHA2562cffe8a4610bffcb8a814c4669cca89e60ed66fe0c104582fa4654220337e550
SHA512e7755b5b5a3a44be1791fb3fb3da23f3f43808963d7598ce123dd21ec5b5f719d5a643165e786be5bad35bb12bda6cee4097ca5fa1aaa284464496a63320205d
-
Filesize
5.2MB
MD5c05f03e1e4f035021afce0258b7a0362
SHA17438681b1868b7c112cfb67a0b44b5d4283d7994
SHA256daf10a328d7cdb71e9894fd7a32bd81d905d65036567f5cc49da787c2b850a7e
SHA512149ce476618d0f1849c795ab1244b05a4a8ebd92b6cf4c7797a8d25b8808da41efabf2c1dfbc0dddccb0900b2754564002958044f9e0f258bbc58afb1c998de5
-
Filesize
5.2MB
MD5e0f6719823e2aa24c41d3bf899e8b3e4
SHA1f0710c18a99e7305da950fa32096df5b3eed6792
SHA25610273669f74b4c21648aec0cc243073dd2114332ed14a628fc64d195e47b7861
SHA5124567f655615fd54200e6f83ae0a9825e13582412942f4c9cdcb5fe01754617188eaa8b60132e5a258e41d2f3f792daa892b674ccb18d46cc5a9f39aee08c611b
-
Filesize
5.2MB
MD5785fdbeca3549acf2c6ce9ba231e195f
SHA17955b1f934048437fa669cf042130e643e4251e2
SHA2569e63bfe682c7425f90cf53e004cff84b528aa8ed8d935ec0ebfbbc698c98d180
SHA512c41a64b2cd007857e6afe52a51aa7bf358a899605bfb1e572b708ee54c929211ab8691f05d0e9d25f1dee7608870d98712dd86b49ec5d3904ca7a8c138774f29
-
Filesize
5.2MB
MD5d27118d9049732a6b5554dff3a8f774d
SHA132f71b953816e1f52f095e0c7b82ed5cb7f4ce06
SHA2565983244a2a16c8e69b924cb031cde10acdd264d29cad231bbb1ffec7afd54063
SHA512babbcd1d5dce64c7601a38d0ed696b27e748568f216ded8f3423550128f0bcd4c1e472b59ccab2496719e1aa43c97f6acf2d4a25bbb1b22f77cb90effd3cbe3d
-
Filesize
5.2MB
MD538c1f507e0c850ef3911324e0b4d9fda
SHA142f869a3ee79ffa7e117afbfe19add8daf178fc5
SHA25602c6555fe7decfa961727ba2dede8c39a45fbb6996ca53347a28bf78b8cd93cc
SHA5124eb0ee15eff2dfec26b82b6e1a955c4a635586d8271c7c021dc593d2a95878350c2540cb21d63ff335e8980b7dc37ad0d0a8f64a7bd4e6b1ce72b6258bd90975
-
Filesize
5.2MB
MD56cabfdba614505f1880eaaab2ba99115
SHA102d42c5b812fdcb3dc76e623ee64dfadae2263c2
SHA256e0dd893f65e21da971c28a69f50bc07694ffb74291a7233e32d9a8a00312515d
SHA512ea9847ec7bc5db301782b6333f760ca90b18c91a208f6643eb07814b3a9e69c2412efd56d662bacb5e5be9e8bbdfeb1f93dde65dfb97c7ce301f34cd18eb2a14
-
Filesize
5.2MB
MD564bae6119a765945e90815cab4f5274c
SHA10c9a85c8e1941366f7f4341d85ad49f8f43480b7
SHA256aad083844bbb538f4af5a3ec627e1dcb0e0fa4f51caa60e2119e5d7c615afe72
SHA512960f58f028048ccc75c68a7a2732a8e903b1b7adbbc190d7bf53ee4b4fe49cc0ec7cdbfbd664a0867b0f826655da05d57fd95cf605b481b3e7c6c96b210c6fe5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB