Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 16:46
General
-
Target
2024-09-16_63604fdbe990b36cbc4405b6b04c626c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
63604fdbe990b36cbc4405b6b04c626c
-
SHA1
79f338dde435a015458b1382c797cd282b4e4cf8
-
SHA256
dcea5059a7f6c904d6a2e67a69cf15e8ac685f32b104908ce558db441052faaf
-
SHA512
6135da31b072c432a00dc83a33083b6e78b5ae29d46734528718c09f3e7ad6baf0d58547f9b593f6ad94ce53b3658d4469a18cfbcaa603ebf62988a6f4be351b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_63604fdbe990b36cbc4405b6b04c626c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_63604fdbe990b36cbc4405b6b04c626c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PtxHHRg.exeC:\Windows\System\PtxHHRg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKenznQ.exeC:\Windows\System\AKenznQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TqXzNRR.exeC:\Windows\System\TqXzNRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UBmflBW.exeC:\Windows\System\UBmflBW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRDJgWO.exeC:\Windows\System\vRDJgWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYVdDcR.exeC:\Windows\System\dYVdDcR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evujhWe.exeC:\Windows\System\evujhWe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvWAVWG.exeC:\Windows\System\AvWAVWG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Hrrokik.exeC:\Windows\System\Hrrokik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqJHCbw.exeC:\Windows\System\sqJHCbw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JKRodfP.exeC:\Windows\System\JKRodfP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omupEMW.exeC:\Windows\System\omupEMW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\awwjRkn.exeC:\Windows\System\awwjRkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\beTEFvp.exeC:\Windows\System\beTEFvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uNDrmHd.exeC:\Windows\System\uNDrmHd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qUzWeDJ.exeC:\Windows\System\qUzWeDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UkXDyHb.exeC:\Windows\System\UkXDyHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TaiNQoT.exeC:\Windows\System\TaiNQoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ucMKyLF.exeC:\Windows\System\ucMKyLF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZWWksVd.exeC:\Windows\System\ZWWksVd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lpYgdhN.exeC:\Windows\System\lpYgdhN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e565b51aba3246c9250d1f3618bc1d14
SHA1f5762dd0c67a8cb645bcab3df1357e6c1fa6bf79
SHA2569cad8ecf7264a54b9dae74086db85f3f6e4a4425172efdd5666b7d234c7b0404
SHA5124c8b385c059359b966357f22018917066126ac3ea37bcdb498cecefdfb7632ea01fb471f63da96af16bb9a6cfe9609cbe08817d25eaf698ea44a452873425715
-
Filesize
5.2MB
MD565a0c515ed45291c48d1fa9eb7f8a9de
SHA1faac97f545a7c4aa58a238a16d98e2b781cfc31a
SHA256ac3628a38ab19a7c08f24ed21ef9059de463b77c7ff60b72f1ea3ccb6c827da9
SHA512ec23b7e566152c58e89eaacff9055f8f558de93ed74e34e302002ff9ab092ab8e6bbab100a78dbc317f453b0eb24767597dfd9827674336dddd4e336bcad1532
-
Filesize
5.2MB
MD502fe5e6c8d4ed6045de36e6638f28b6e
SHA1114c6ad13e157062eb9c0a1859c149cd93ddab00
SHA256f2e1d956a6d23defe0581ce7e5482fc1c6d3617140f902bdc754e28bac28d62e
SHA512cf969df16a43bd174a749ea09e80cfd27d1f570d5da65923d615852b639d6ccaeb6efa377e336b016a958b32829b272693ee57927dfd35bb67e2114f81c986e6
-
Filesize
5.2MB
MD5c611dbe2d883a58e5e25081e977a1895
SHA18ded45da63f4359d2de8e55b2ee348e403f07e3c
SHA256d0dbba39c6e50198ffbf3860c1dcd916c6a83b1159f6e280433fc3e7381e9866
SHA512ff082d93928ebdb137def815504ac4275e14925a6b4378333bfd8f244098ff2734a4656d50ca448cf967d18475bc774125c1f465f435278b0ada0537bcd40879
-
Filesize
5.2MB
MD53e4d77caf7a40eb347094f068d13c4c6
SHA12e8f3f525760a9150f82bdefa2a5e37a3f82de9d
SHA256504551ea62982407fc89eff9e44332f5d67d5b973e7f4bd6dafef2dea6f86038
SHA5126bc1c468ef763f33778386b6914a58eac41294dfd5d13b3b25fa7af0b53f75319a2ba66d700755a5461f8af64846ef11a57fec159c1d89501a3523d1d3bbacd8
-
Filesize
5.2MB
MD59fc96c5f98d35b332a44cb7e50334a5b
SHA1914e8cf58f50c60d324d015b929831d77fec297b
SHA25680f381d4559967dac788966c052ba2e9e1c5e2605dfab7e437a50621780abe08
SHA5120de68f25a9e6b8a75ae4a460df30d6dfaea9d08a9c181c8842c7db1194f8a23cc95ddf1636d125a80bb1a7e216f94f2c16db84b88214ed733ca4241996de1fa3
-
Filesize
5.2MB
MD51c81556252065690e8e66274863ecb60
SHA1114af361fb4b56322becff6eb0ac7665d175d5f7
SHA25695abd1789eb254eacba1cda769378e8949c43034d3bb7574416af9355533e954
SHA512bb35b18fe7f8d2746a8762a8a2d88a054a49ad4b7ffc3840131c5410f37ec997e16a545e96c17eeb91596554cb08f6797d28a3708a9878ceeb7f84b0ab666612
-
Filesize
5.2MB
MD594d7fe03dd0d99167b3eb6a0a8b9e18c
SHA1975037027d16d38b085ef96736a5c8cf7835febf
SHA256dbc95d27f62d1d11cf097e6cbdb023db9cd6addd8d091687b09b0b39f6ed8b58
SHA512531ab8cd6a81cfbe5a6db432946d0a02e2d2c96f36be3b8155c6b991560d9821c380ac0cd02a0771a08c1e958d6858e7c642391ae545541f7723b8c7b453de35
-
Filesize
5.2MB
MD52fb13781afdf1776ee8556adb26da6e3
SHA102420feed464b1977fdd3ffd76b14fcdec9486f8
SHA256651f59637b27e02ab0f3f2053f1b4cb67e686b709bbe6c3c1210d521b012f4d7
SHA5129d79189b16650b74b9f3d0a0e7d397705c459bf91ae1a126807882acea5f63aa62af28ce26218c64219ecb6e52f2a05a1a0b55c71a79500d474c47053c4cb59d
-
Filesize
5.2MB
MD50aa70683db20942c32bb669d81a47324
SHA1bc7457a42a8d99e2545c47e3a1bb2e09a059e62a
SHA2562ee8cd4268adcf48f2bb321e7442d1c8c78aa98c5c72be36451fb7309baead9b
SHA512e824997db3634a5675adc40d5c323ea73ba57bca9c8b2e173a16111655dbd6a46772d1b48363ad5f5c1758d709578763b28c7ba6681fced75d8f4c112a721237
-
Filesize
5.2MB
MD512c47198d8ac388f43ef2de629a09261
SHA167b5f74749deace67d3a53ee22c30164cd53617f
SHA256a0aea39beb71f5ea6f969edbb3ca9a8cd2323c21b5228b23f28769175360579b
SHA512441a509a1892d591f4f8009d91291c8d95f7b17e2fbfb8930e6b88a85d98d41fff41e37a41652a1cd2faea7553b7721c4d95090e58c2faa91253b6931483f625
-
Filesize
5.2MB
MD5022de5a598184556d7af62c9486a646a
SHA181c1ab38b3487bfb44623aca2e4d41f14473df9a
SHA2560123b03077f134f4e3fd76de99e6085037586accb58e2b358182d930a1ad02b7
SHA512b95735eac30e6ecbcf134ec6b0eeab90c5495e3349bec156d22c731968628cf3f86dac3775744e10a63cb3c68804b405cb26b7a9e01c9f601198c8bd0e867650
-
Filesize
5.2MB
MD56d4a7364dfcb1ebe022ed87c282ff7a5
SHA126b47c11fa8deb41e22ae77f900ad7e7cf2c1246
SHA25600f3f62c63fd12c123dd0d28fe65808d5397132a297453f7abaf57f9336ae713
SHA512e4ef8ca4c0ace3fb3ae365e2ddf53f9d3fc925eaafd7d83d0ff3156454eafaa2e8c252063a8758e7cc61ab9a75e116a5e7395a02b1c5dc97c47bc5cfd3799bae
-
Filesize
5.2MB
MD52dff9d003dcd037ed44539414bfebf04
SHA1a49f6e21df3ec8cf56c3ad58c376b27e1e5e58c2
SHA2569a017be0994a84d8aea6128d2fd1fd0ab419370cb8c7a4480e699766156eec38
SHA512d2254394ac259d844ab93900d73144ceb03cec82b8fdd5a2a80d2c9e47863474c62cea0c226cfb0f10528a29d91e6befb56438f20f63f187a5f78ba31104c3da
-
Filesize
5.2MB
MD505daac55112fd3bcc8909f40d4a17f1a
SHA1dcb0ebe705468a3b7ac2cd4c573e1aa59e7a6d69
SHA25645bf80db3beda0e75ff3baa71c9fa9031a90a7ce8ee810b03628be00ecd0d408
SHA51294779f82ad812728bac717d70a08a69dd7fe440220d0f3e73dc7cda8d3b393dba2195babd68a434421f76bfe4ff36e00af87e08e5d0da0dd6f66db63fc00ee70
-
Filesize
5.2MB
MD551e3df6ee49a520e224c0080a5a8f9c7
SHA1d84b2f80edb40c9b915539c4ce2b9bbbfadcc253
SHA256aee613fdae264afe884754358c740ff8c5bf931befaa986d68bfaae805427ebf
SHA5125cd25a74c23329430ed7ff00c947fdb4939d99cea4b350fd15048c3b1198ffbff5cdcd15bd02d4769f139006c45292a2476be0aecb5c863df0adb845c346a9ee
-
Filesize
5.2MB
MD5fd495cb12d951cfd66701597bf9c7389
SHA1e4c2d8b12bf85b89b96c3bbea3592008248f449a
SHA2561f261738c9934529eb628f8648835f5f3e7ea4ed9d29740f89abc2d2abfb765b
SHA512c3daf04d091410a3c20db9e61d76b7e5f0b18f42050fc9caacc1f68a261514f0006683ed1c8b1584fc2375a629caf97235bd5ca136e294c8edd9c07fe70e15bc
-
Filesize
5.2MB
MD5070908a40f5859b70fb2d0f1544792b2
SHA17f0c007f24aa636e45b9c66428c61f415c70ae63
SHA25600946bf1fcab24495eb93b89a248cc37db827496a32b98660cd19e1731ec6341
SHA512d3e86c17b146877f9b9722ace7ea34fc4898805f468a23236b40c1660f1da0eb559850aecba607408e6138b1a827ebe7d5d0adfd9daa023406b87a01cde1f065
-
Filesize
5.2MB
MD5de370539d980063ef9cc62f8c4562426
SHA1a22485990acb6854474faeb5c9b1cee09cbe5009
SHA256287401e6bfc304a6c685dffea43d1400ff018cf979dbe5396268ceb64f47f7c8
SHA512a258fa4024a85bcef4fa7944fdf611f6f73fffb118713c171e8c3f6bfb620a0c8e0d82cd9238aeebe73c1123a6e84d84cb203c8333ac2796991203dbe4f125f9
-
Filesize
5.2MB
MD580d7b56ebfb718a01d3555517fbab548
SHA1d397c1827ffdea8f38069b8630745eaee00980d0
SHA256a28bc70f1c46f7c0d1599aa595f7427a0aec27ef713aeb6f1c34c53693defdc2
SHA512bb1ecb6bb32d46c93ea516a7906bca62d34616434bb95b826f0f3cd66f8b6137d826f08e8d1425c4434ecb6bae94cfa9c814c7721b7192924cdf5d1129460874
-
Filesize
5.2MB
MD503ba43af3c5bb419bf050a6c33df54e8
SHA19f96b1b815f1d8cfcee4110f22533e5a1c884cbb
SHA2563419a80ef16f704f4d08755bec74932392562d9c9eff9b1ed48fbc2c5109ae1a
SHA51230717f7c66c0afd621060cdcc2ba3a195f80063b5d0b1812310f83555faffee006421b4022e51d7066680e2015f20a290a01b404539a24b325fbc6494a8825e2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB