Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-09-2024 06:26
General
-
Target
2024-09-16_2f273e0ff73ff2f837e8f88becb5138f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2f273e0ff73ff2f837e8f88becb5138f
-
SHA1
543d30916a241f667992f377eaa18dcbff07145e
-
SHA256
66db3cd7af0658ab917154f0537914b2c24de4275a1c5b4687bc705c7504548e
-
SHA512
35a1edd1e6e4372aefba4893610a6ee394f277acb89c0b77dafb446f0125ebc37ad6968914f9bb3689fbd7e268a7fcbe612d1af89ef799a2582afa0376b7b483
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_2f273e0ff73ff2f837e8f88becb5138f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_2f273e0ff73ff2f837e8f88becb5138f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bJiiUmf.exeC:\Windows\System\bJiiUmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EtNXofW.exeC:\Windows\System\EtNXofW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UZKqhwd.exeC:\Windows\System\UZKqhwd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtWqGPq.exeC:\Windows\System\CtWqGPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UxgVTvU.exeC:\Windows\System\UxgVTvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcOjnUB.exeC:\Windows\System\GcOjnUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHeEnSs.exeC:\Windows\System\sHeEnSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbYYlJE.exeC:\Windows\System\BbYYlJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YrQywin.exeC:\Windows\System\YrQywin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEdfZdh.exeC:\Windows\System\IEdfZdh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByrrgKK.exeC:\Windows\System\ByrrgKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxNHFTr.exeC:\Windows\System\VxNHFTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FfDLYvy.exeC:\Windows\System\FfDLYvy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDTkcNw.exeC:\Windows\System\TDTkcNw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KAsCzUW.exeC:\Windows\System\KAsCzUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kEXicmx.exeC:\Windows\System\kEXicmx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CVFfSqB.exeC:\Windows\System\CVFfSqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzvMqBR.exeC:\Windows\System\bzvMqBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYzOEFu.exeC:\Windows\System\aYzOEFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bYdNhrf.exeC:\Windows\System\bYdNhrf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTIgiZT.exeC:\Windows\System\lTIgiZT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55041ec08d112df315b33e7e6f2d1b7ce
SHA1d80b34f1688209699172aed476e2545a07185f2b
SHA25607c0b13832883f3601b748b5b9cc09f47d6ce0d9e4ec0face7eba8a5d6cec9ba
SHA512adbdc59827fd463e2d740b11e21268d99d48b9ad5b5f208ed2e6203a55ba20b8f018cbbdf7f36dbd9584a42d7cc382fd39e56ac2ca02853261ca9e0a265c3e0c
-
Filesize
5.2MB
MD5fbd8890f2dd644111ecd0d21f13cbec8
SHA15e2035146968edec09a28197061f12c259951263
SHA25676c0407a8d9544b916a5e083540cbbe2a61954a40070013c8e502eb2f2727198
SHA512ed042866c0b1c60f783ea71f946ef9f927269e88df270aa4fbca3ba536af2673072ab068c4c83e3a6b67008bffc231464fb3d426ecfcdcf2100cf5e428234dd8
-
Filesize
5.2MB
MD5d9290a60503c361937fdaf8c0052532c
SHA1181bbf310b0bffbeda457b5d9e351b084955bf71
SHA2562b95699ec2b387503c3bbf0073f16d13ea449f61b5b6d1c3afd576ff8ef872db
SHA512681ff55988de3c485dd7cf9ecffb3b205ce85542a64065fdaddda966be9d9af01fd7843564bf0ed38f2424e88224a6721c56293fadb3532338d4a2b35f19ea3d
-
Filesize
5.2MB
MD5370c929edfa901c5a48e59528a4e97cf
SHA15203e354a00bac52e419ad550b16c272409808db
SHA2560dc6388b3efff824e935cb218d2bf63a87216c7e980ee87b9956b06cef5005a4
SHA512b76dab491be90abb2c8eb899ff06d1503fd59daee844616a21dc64960e4288288da0c6113a1975ece3644e8feedf70242d3747acdb3aaf8a5282869b693b1811
-
Filesize
5.2MB
MD525addf5490198ca57dfd0e2b79e35201
SHA177354ff3aa75a25e0a1752383e45fe19340d8cf5
SHA256abde091aa1745319bc08f3810538b9fd7968138212d2ef50253615e38c06fd08
SHA5126c652abf6779d9bf492edd27faf1ab6ab643eb37f6376a46e694e7fa41e2c786935b4c5edad48aab1d9e39e081516b4a78e11c32033bb49492e31440a246fc85
-
Filesize
5.2MB
MD51590ab5fbb8d8ce89e1885f4ae7ce9d1
SHA1c1990b8b240273125f7c88ec6af25c73ab8027ae
SHA256dfe718f6ae0c96c0c2d32a4c00514c1b608df372225ff4a53aef1f27ff6e1c39
SHA512af6022fd53212ae4c0d5ad71568e2510ed2ae755a66f907e7c8351561052dc6940dc5a195cb217d230ae1e041f55d6c566d77d594f38fbbf435753608f4ef665
-
Filesize
5.2MB
MD51494a896045771e67a5ae5657bb8635a
SHA1d32ecc0a8467e5244d40e0b0a43c88d2c5b53ddc
SHA256ed5afcdf20f45210171ab9253bd2f1791d4157bd1aacaef941a3bf5e6475b2b1
SHA512a3bca9fca4a9641bcf81c8f711247893cb42207cf19fc7b8fac034021f13fb4dc7732956f1a9ac2ce2a41d0620c8b9f6e086838704144789877b0431c44a3aab
-
Filesize
5.2MB
MD54504c2b19ed3fd3846c3123d5578aab1
SHA13b9695c8db2aab5e8f63e75bbfd2a5f6779b4259
SHA256a96fdc90ead1fb3f9cdcf33a2b1d6346f6529ea8626830add6b701e01dbfd7f2
SHA5122412615e8128f2a396b542320ed4c5831df67b50dfcc74e0532fc1088b95b595115a89c4f8538d032d03f7ea8bc47659a19ddb41d3e53a186940496e3d3defdf
-
Filesize
5.2MB
MD5ee2ab24c16a4adaedfd701422ef2ac03
SHA1801b86832314efbcf49179dd633fbe486e49877f
SHA256c8b4c8eff527053443a7e802f329145ec3e28fe8b4b72aa6b24542ed1dc5dbcc
SHA5122750709ae2d79c0113ea294f0efeef28fccccde2cb1f5c6d20b10447520d553ce4fc28d03c334c9ca459f865516a4cd9355f7a575ce0ee9aa763176916392b2d
-
Filesize
5.2MB
MD5df2305504bcf22e05f8097f8de7411ad
SHA14ccc0cffcb8c72d0ef07396d22b432365a8fb4ff
SHA25678dec6f61f47f534fa2400bb3a57d0c37981ace752ab375fb5fb263d534dbac3
SHA5120798914f16a60d8062efbd42294219f8e52bd18657e4173bf292a7da2dc269a0ad891cdd8ff2d4644b806c71464d2efea46ff632abfde50206b1a51157847438
-
Filesize
5.2MB
MD5284a954f14db553450316a84ce286f74
SHA1102b1bb0bd50bbe613bf35cf3cf3cbb94ab17a77
SHA256070bf597d16cd2b23cfdc5f797f5695f96568371da10589149e77bfa2a20be33
SHA512c97c2eb4f36c30a597ced2deee3c8db38b721b07e64e511e42589894f2a78530e1552dcb8f8c64aef4c5cd45fcf1fff479ed6196708e2b6d9fc5a5cf57eb462b
-
Filesize
5.2MB
MD55fad0ac90ec9b7bf412efa19db2d1cfb
SHA122a111a0b4415d04dba9a96a996e5d9aed3e05f8
SHA256f37b9e797b9a493bdf6e352225b8815b44801291ee43d5cbf41db7cc9fdd4fd3
SHA51224a74cd337f7255fdd1e759c4ce8f7364ab7c809b00a451186e37c511de1f3f39acaacf91295142821bb2c17b3a6ed3cbf91fce3aa497cb7490d6d2ce92566d1
-
Filesize
5.2MB
MD5dfa1c9be4fe525ffd55ccdaf3008b2fe
SHA18b073a073c0a02fd3a9fd2fcecd1b1293b527244
SHA2560a24b6115e5e77659fe8677e5561f0867423afc6d14c2dbfc9be75e1cc569b8b
SHA512674d2c5b142953cdeb59122c69d2315e7703750f818bf103357fceb842d66ddb3739659c377f027b9916c63cd136f2ea3af89291fd25110d76de0a7330ffe3d8
-
Filesize
5.2MB
MD5f133803f22fa41c29326f6907fe38afe
SHA1594150e380afcd5fb56e04eafa1d93eb60ffc634
SHA25621f9b9ce8443e7a6927ceff43225bed3c0f7685a9636e83584575709b136bfc8
SHA5129ce188386facad694f4623070b197a81b1feea37e08d349b9ed7ce99ad1b3b79370b708e1506c5185a9837d21f2166a04019264b8601e706b59977289369d0c2
-
Filesize
5.2MB
MD5b1dda3b56a6c2a70f35c267b25278bf4
SHA154ab7127e0f927aca3370f7140aa7ce60a2143ec
SHA25681d20d20b0472666e05965c89cbdafd7514e15c236008fb140429c6accb75f4a
SHA51237a0a0a118e6f3ee2d0a121f02ff4214ac64a3f1c881cb327ad3ac92e8520204d121319663b494e63911dc0dfafb79e6233fb728d522c1a2b620f69ea30e201c
-
Filesize
5.2MB
MD5be3df4aabcb04747d4f3632e6be6c32e
SHA12430654cd5c1d34add2ecf94e2608e379e8c31c9
SHA2563d0dbba801c055e2e3dbe1f520993ffcfa2df1d1d241448d9296f4e664043f22
SHA5125239e2e001fb7dfc9e63baff3eacff4829ef521ee2ee0af05374cb3ecb6128cef1a65080a3bb0dfb19e9724c1761d2c7c05e4f49af96d6c3356f90cba3fac013
-
Filesize
5.2MB
MD5aab4acab392fec886dee7aa20b0a3fb0
SHA1f2fdb727c76dff78761c46f04c73ce2ae89f897a
SHA2564fe7e074179cfa8d0e895b3b24489ffa191e5e4a09709cf17788d0a7b06d9ec4
SHA512b67ac3f54dc3b9c3352b22973d98c4acd7f5b388ad14174f4936df56a06bba1e99aa44da78c7349a2ef71467c69dd99a29cec1e3a21a5995fc01e4e61308419d
-
Filesize
5.2MB
MD5a77daac9f3f64d9a8965d43524248cc8
SHA1f4ba7ebcfbdcb194a13df56d85641411796b2c03
SHA2566b1bca7c8ad1e385bb0abf248674475849cd62633461508d2d8e63056ea0ea6a
SHA512fc42f4d3ee16e6c22d4f9727951364fd26890671654d010887e91ff63a96cabfe190119e6a4a864ae2afa4cf3e81244fdfc5b1d492d7bfc407f81d56df015898
-
Filesize
5.2MB
MD56929257add2304753a560f2b9c177e50
SHA10705d1132f67b5ba847b2d184566126d76a56c01
SHA25618744be816768af15ee9c12ea4f4520cfb695eaeefd8d755f6c6f802690358a6
SHA512e452a587619b561467d8907d1ebadebe806a933a89eac2b17abfe75f726a8da32369c3ef14e78c1d063d96546bfa109ae2df0e7e63d948199e4f2989111dd71a
-
Filesize
5.2MB
MD5d25bd066de6de8884dd5c8250c0ca536
SHA139ccbc515e79a96d22c378847960b2e2f848f2f7
SHA256a5c43325b87355006782e14665a86e6bcd2385e36f78d52c2cd1021b6171f229
SHA5128ed8b8639cf63aea20c478d0905cbfd176f658482eb80ce0a9a9f018cbec7a9ae3166e3e3b2e7d522eba44ff65153b981bc9fd730d0ec544bf2906ae9a2bc073
-
Filesize
5.2MB
MD518e98ad0661e9fd14ab18167c6ac18be
SHA16786e54591b6006ab25f894646785cec343e480c
SHA256e1205666a770e62ed51c15a0f4b72ce5dda7d47b48419dade66e40481562bd68
SHA512a9f5979197604e2238a1253266628e208126c5a9c4f1feadb8c6bb470e1eb7cacdf73ec02ccaa4dad04160f14a1968d4b6975b7c5654530090f5df79725d63b1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB