Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 05:50
General
-
Target
2024-09-16_71c8a21978a34460b8a88115cc51580f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
71c8a21978a34460b8a88115cc51580f
-
SHA1
5d17784826e7de1f1c10ae8f18be5573cc179fe4
-
SHA256
f0059a632d878ed9c678630d002269e1e8b184680b04fedcf1ead4d4184a9790
-
SHA512
551b2d44b8148cab190a1371b8fd08f81fd1ba434f69fb5d9f45f8214e5101bbad33b3cceac617b7221a324dd02e9ce397acc24119e8b6b2d338079fc4d235c2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_71c8a21978a34460b8a88115cc51580f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_71c8a21978a34460b8a88115cc51580f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aTKFdNF.exeC:\Windows\System\aTKFdNF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSbqVxK.exeC:\Windows\System\BSbqVxK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zKgFauh.exeC:\Windows\System\zKgFauh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZLFouc.exeC:\Windows\System\jZLFouc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XteYGmv.exeC:\Windows\System\XteYGmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CSXvKhI.exeC:\Windows\System\CSXvKhI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNsqPxk.exeC:\Windows\System\sNsqPxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esBOxUH.exeC:\Windows\System\esBOxUH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AeWtbnP.exeC:\Windows\System\AeWtbnP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtkjTfV.exeC:\Windows\System\vtkjTfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dzkdgoQ.exeC:\Windows\System\dzkdgoQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MBLTPGy.exeC:\Windows\System\MBLTPGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pooDKlJ.exeC:\Windows\System\pooDKlJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WmwEAxx.exeC:\Windows\System\WmwEAxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icnZTEw.exeC:\Windows\System\icnZTEw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YzEkreh.exeC:\Windows\System\YzEkreh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tIlJwHP.exeC:\Windows\System\tIlJwHP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPmgQQc.exeC:\Windows\System\mPmgQQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DHMIIdD.exeC:\Windows\System\DHMIIdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJoYBSa.exeC:\Windows\System\aJoYBSa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZlGJtdx.exeC:\Windows\System\ZlGJtdx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51c9b269b09219517f26828d187786880
SHA1c016ddcc41f2e393c416046659beb352a6c1f9f3
SHA2567fa3717a0f044e8e8ed3f9343868ae193853f5413862a407f251d7586594b575
SHA512cace6a857b81a9284629e9a387685e9ea50ac8b86aaa653e9f7d03f0d0b4e3016c44a67e70a847e4ce93fd49dcbc0068cc859ee4ee5d392bd9c053ca4c3736a0
-
Filesize
5.2MB
MD5aeccb8eba2618395358113e603240848
SHA188f6a413c83cb6f21869ab0a91943aa4f9f9762b
SHA256f7da06898966b9d9ca13621dc9c769b379b0fd5bbd41e7de9d491cd452791095
SHA51223df6d2beca7ebb7d8fc3b3cfef22d3bc502598e28b3991c895f4ce2dee6f45481ee9c95bd92d1e07e4b246c939528f6ac30363a77e8d73923de3a3684054fe1
-
Filesize
5.2MB
MD5ce6e45ec7c8f7ce3ce9c976f7e98019a
SHA1cd5ed9b09dc70299b9ea2dbb39d8973eda9381b7
SHA2566d381e88f95f710ec13c1daa1a48caa785b1d2f767e95801df3ac009e526273a
SHA5123a1bbbbbe30df72fea85502c91dd078536e8b43c61d3537f5f3de065c81202af771d79d4e431006eee2e031a15b07ad930e80792705b5d0f897d188561259bdc
-
Filesize
5.2MB
MD57eceee06782adf8906880454bc1a726e
SHA194f3d8a2f028cb371ab9f9a63df59c28e0f9da23
SHA2562496d965d90faa717e20083a327bea82ae583457a1cafa9141a0f8f98ed26f38
SHA512b8fcb681a8f49cbbadc8f91638d2bed742519bbb7abd318909e8f3298c420fcbfc9952573d9449f82a8f7bad398b22f70c97702a4a44b16614234d2aeeb17cac
-
Filesize
5.2MB
MD50915241c3879149ca2e1f17bc0940cab
SHA11c298df13a445366c90702d4a51148d11885163a
SHA256c1f9568d60057aab4edca2e264b9c4146dfc6aac95a12fd74866b4d5575f9bbd
SHA512020ad0d7ad79b9e1f7e0a13e93b857cc8bcdc41ffa0cf37d8e0111db4ef71779eaaad82386686e8080ce8f3c89d757e8adb7376b7a5d3dc47fa9f18f936ef385
-
Filesize
5.2MB
MD599ff18b3ff88392bb4d245164f085d1d
SHA1515665db5137c842f10a24181bd293ed8fcc3bbc
SHA2566a9ae0f029f00a3d58ff880f90356d4dc0b0592c9955af73f313ac403b715b60
SHA512a6c51f9da1310077cc911b10abbdc8196788ae2ac428bb755f86f18fb735d3060bb6f2de4f774b99332d484ab109b44f0796dd410f4308892144c428e105b3e7
-
Filesize
5.2MB
MD5bf2c50c27441c1e41814ef5e2ddd6ad6
SHA1a7d8488693d51b181a59ef6da569aaaf60b0e9c5
SHA2562d93c120ad36e966e6ff8714773847a6bde9384d8dcd05c127f74360e9023ce0
SHA512059c6b8031bf03329ee2337651723e81b581fc37995fb09b192cbbebe95d01a89bd471a1269eb33b17c7f9f72fbcbd83cdfa8016caf701f5aab4dc3cd2ae96e9
-
Filesize
5.2MB
MD52ffe5a82a217394705ed51677e4398a9
SHA19d8b72bdb0a643e2d7a3e0cb2fa5db808fef6e72
SHA2565004b892e4c2c7d78ed89bde476e1ee37b259999592d8f0adae958266408390a
SHA512b70eed70957ace5d10ea11ba71806fdd26de2ee5bf33760257c9d32e99af077a04d4d2755984fdc4a7e0caf30f68792aac1ad2c0767a77e712528de5a0baacab
-
Filesize
5.2MB
MD5e8cdea15299190369ee9a7399198d020
SHA13943032832412e166717aea0e26d1c9c78ccf9ab
SHA256f17a429643aef906967e12d54e187f93b0c38431ee050d56b94339908a26a81a
SHA512b29c0d24789887a4582293092d8acee7db4445be2f190256a995aca9573e90450ee4d50763530b78c0838b85ba1e10bd41ae13af199bda2c9beb52ff44a50790
-
Filesize
5.2MB
MD5acfde55cc97117649ea75861a118be3d
SHA18e9fb0d611d0bee2e24d9bad467bac780ca98625
SHA2562d56edf92c604fa97d1c3bdf5bdd321639e5bc6bce2a0fe48d58884e1496aa0f
SHA512f214964c9e4bcd401e772f31b4c9b0c16a9cc23bee4f51102ca86f9f9ec24839dff91081bcd05b5098fe91b48e1c2b7749f1935358365c49d1b3924601ed3c0d
-
Filesize
5.2MB
MD567775830fa5b94348bf41dbc8c151d13
SHA1db926ff15177da9de61a06556f1d1c90e8df9b62
SHA25611c397378524620a6e8788507564ed06fe6586fccad336d971c24124ac7128c1
SHA512aed62bd5f8988d927614868081813d680902e41d7d9ec329d514416b90c3f58262307e03d4a351e332bfde6c79d8eb0c6188ece2647f8a2e47cbf74b1ae1b9bc
-
Filesize
5.2MB
MD59ac028f84902861d4e3692dc83c881cc
SHA17a989ba4efbfafd14f67a44be9674e5f64bba66b
SHA256152b166d817164ac9b75c6cd0c852c12d3a09e1bf6c55f770e8f3b766090d299
SHA512a547be92c2b0bc7c44a9e58b33e14a061d1d4fc1d678f1f7c68708e0b0270e0988860876744062ae1976bb4965c9371a79ba2aef28021aa7f210759dddc5ac2e
-
Filesize
5.2MB
MD588c210489959c2325456980a8ebe624d
SHA18e6cb9066c40fa10740c8caca81ee1dc2482acf5
SHA25652f412a4c3857cd6ac00135775264b170d745df8860579a39c8faf25ed1bd486
SHA5121d04cc758392af4bf1a7a6a7dacaaa4507b37ed588f48c4bd97e50d8a85fab77e9a22addf76663ab4c309f334b3ec44acfb05b07687491bdd72f875917a96da7
-
Filesize
5.2MB
MD5465dcfddf98acb11ffd6952d845ee4e1
SHA1aa1a876911509067df474e574e742f97dab43f77
SHA256423e4311d3d5122f526968748a99fe72eaae01c2f6ee7450110d934095a3e67e
SHA512223030f4b44125d0200d85e304d4594230b7fdfacf206b07bbd8caac353f5d4df4a82739bfd892877a0910fa72b8bc44cd4ae122951f75fb487af83fc883dfcd
-
Filesize
5.2MB
MD58d3790b0fe88499cc5211163a76b8ec3
SHA1a5b7d5e1c272cb27963bcb5d2d2df511d50be712
SHA2566d51edbcf5c69681d5812420389fc38e409edbb5e08b8e1d019ebecd90e92999
SHA5121d28f5f548fa15ee7456566bd0105cb0d2b48ae6292fdc5f5a8df3538d58746e67bff0694fe1f1de255a867f96f9086fb2c55585f28625ccd3a94491b8f637ca
-
Filesize
5.2MB
MD5ebb6d64d0d3a696f58b1a6d6f7957f82
SHA1f1744b33f4a3d68c9946d30132ca0b20622fb8a5
SHA256b143f23ae90bed5971933e9ff1301755c4b2738981b57823ab28b347d08bbf7e
SHA51274a1d58ceb8e3de046e597496f86a4b247678756486bdf4e623c8f08ec24e2c5d6ea4925d54d63050db5d9cdc07f2284e2b0efe977ba60adad108d8d677046ae
-
Filesize
5.2MB
MD5dad8513e67f39ec5ca1d4e4e1caf332c
SHA10f7b029528e2980622a1c2a7dc4cd509f730bd1c
SHA256c2f94c657ef44a9f902c7ff19d5d747e42b96868f8f3be014926600e4e0e3d03
SHA512954f2b8ab09e689a84030a3814d91952482c4847c00db9f84cd91dc3e2352f90edbc1c81ad6f623d881258d4b1bb5894bc26e9d68605f1250d4f1da39a1d8b81
-
Filesize
5.2MB
MD5ed77fa073ce4c12da740155b8e5c9845
SHA1830d19372cab9c3c41fff60f6f0371cf20af4b8b
SHA25628e2540338688fed78b33929b15cb2f2f7405ac5fbf902046a160670aba15854
SHA5125d3de6f8c4092aa2359271cec4f0f3adb319ec13973522d90245863fed2bcff59f259c6a2979a0f0b8830a3b81344e9d0aa2b2c15081346c759dce70520468ad
-
Filesize
5.2MB
MD55715070886bcc2c7a0a1a59c5fa24267
SHA12e970ce76a0996a4495c82752944364b3448312f
SHA256f375695a2ffd30940890f5d3ef6377aeee9c88f5fd9f55b3c25e9c7d63867848
SHA5124848ff69d997996eca48dfe2e9cd7017e92441c4041715e8d59ef91d1474732e7ee614bd9bfdca9fef7e203ad873ac2eae4ee5d198c18b12ca1d48e4276e5061
-
Filesize
5.2MB
MD5f1cea421681c8ffe1e74b0fafafb254b
SHA1ac7e1fd2a0f5e3614a5d2ab64b2f70518b1fbac9
SHA256d86e0fa7264c408ebcb12f33c60a5d7a9c7d4c75ae0772bd3b541e81c5ea8ee0
SHA5122ed81a77fc134b7749be24faca2a74b8a2b509000683a847e56112bfbfc450b312d18694dcb50f399d128ba21d292de1f6c445de986d212e9d8c368a8f3bfc26
-
Filesize
5.2MB
MD544fe175a7edf5ac6095c2f2b159cfb17
SHA1fac49e8200643a859b3c0414c910ca107b46bee4
SHA2566b5a22b320c3540ace0b95068dfab81c305fc34608011a44ce6f3b0cb5e0d4c6
SHA512154f98060a611604606c603c6a8b6cbe7ef7b4d2d04248b175e17fd5270858b184754642465ff9618c8bae867c1c0e5efe505394dcf2b070ea0f8f2653015abc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB