Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-09-2024 07:25
General
-
Target
2024-09-17_0f110d92bcb58f576437998a564180ea_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0f110d92bcb58f576437998a564180ea
-
SHA1
0fb8f292393b8ef2558d200a7e0972a56fec34bc
-
SHA256
254931a7682f94bdac410a0a51d1ef8a8f146ad3cf785dd56a3bc4d8320d7a38
-
SHA512
a60cdbc0fc7923d68c653ec6c29860bd8bf7f135ce1329e88c6f4e97ebe788dafae066d4573d9253fa72bd7d68e5a34d52b1daf5cc90398aad35d1e38616b1e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_0f110d92bcb58f576437998a564180ea_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_0f110d92bcb58f576437998a564180ea_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hwfmJlq.exeC:\Windows\System\hwfmJlq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kpBKYcN.exeC:\Windows\System\kpBKYcN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KZtOvMo.exeC:\Windows\System\KZtOvMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aCSiRRH.exeC:\Windows\System\aCSiRRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPxsHDY.exeC:\Windows\System\iPxsHDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNSKuuM.exeC:\Windows\System\cNSKuuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akTKXrg.exeC:\Windows\System\akTKXrg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pVvGwky.exeC:\Windows\System\pVvGwky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wuKAodn.exeC:\Windows\System\wuKAodn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zWUQDRO.exeC:\Windows\System\zWUQDRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rtoHiOq.exeC:\Windows\System\rtoHiOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LBaJNHf.exeC:\Windows\System\LBaJNHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EWeOrWR.exeC:\Windows\System\EWeOrWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dfSVSWH.exeC:\Windows\System\dfSVSWH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MEyEyCe.exeC:\Windows\System\MEyEyCe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qtaCLjR.exeC:\Windows\System\qtaCLjR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qVOpYco.exeC:\Windows\System\qVOpYco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OCxWzWh.exeC:\Windows\System\OCxWzWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLDriij.exeC:\Windows\System\LLDriij.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWnjFKM.exeC:\Windows\System\rWnjFKM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bjhBDLM.exeC:\Windows\System\bjhBDLM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55e1bdbe799a5382b23838f739a96fbc0
SHA1c655ed350695100ced457a00678d2175d72766bd
SHA25636eafb51f71c6d4a21de591f6253ecbc77f6fd08ea73ff31a7e44ade67f83b46
SHA512fb0636b5609871c4c37e1555df7126c058ec4fa0684a88d56a9c65d0806644c432b5edbe786e9798b00cef8b66e94264580f76e247a0646c99c939c329c19ee7
-
Filesize
5.2MB
MD5d1b6620e493a5a7a945709bbc41a7e42
SHA15e5b8176402f000a713a22afb09eef27223b8468
SHA2567d5ecfcd15a786b6052ddb8f254a02f199eb2bfb3662b8877019c218fefd0fc9
SHA512397bfcad748436e9e1780507c5776dbc9cca22515646c47ff53afe9ed050cf5f6ff9409206714a45bafbc62400943208f220590d382943bca3f9d823b3521898
-
Filesize
5.2MB
MD584e3b389a752d09996d5b1176f0ac222
SHA1a382512c01ebe2738941c71a74cc926176f76913
SHA25601ad980d0bda4425436db979fd74c9d2bb0ed87ed59ac5da046377f543563a57
SHA512dd8966f2b692b1297f5c39b0aa8b1c6aa000df83475d64b5bfa124ea42aa9b0b08a55d161483e440e76d855ad85899c36b123e44072f0ba1e22b5f441bd085d4
-
Filesize
5.2MB
MD5f471b5146dbc64d4ffeb01862e63d4ef
SHA1450dedcda26f597c0e38d9ef7beb10b8efaa6b82
SHA256696a6e7deb1f0bfb7eba06da024397fca85b985c9713769bd650e1860b2ea9ed
SHA5127385041c5540aa71e96876f528fa23d5ab7200fd19d6c794c32d00e2d7a7c0fe9c5b6de954fae164af7ea8fcbd10cd65037ee21e4753a02fc1ce94971b952642
-
Filesize
5.2MB
MD5c914b7c6560c005e52a912196d508262
SHA1b234d4204ffb6e8163029716bc970ca0f81548d1
SHA256ec482082b456b0ceb81a10444c14f70b22a50f7f18a72954f92bfeeba2821636
SHA512f63df7dcd44f01741a1bfc999f53b4c2175094cbe47128616113e49e32b633680287dbbedfd6a7d5e4bebfcf6716aca428504620e9278dd6621b9ea4fd30c860
-
Filesize
5.2MB
MD5e762ad4dacd4ffa89cb797a12b947e86
SHA106cac0df964f02e201c1c19b7a1d1deec7e5866e
SHA25648a89770853e5090bc7a7486b5b53b2175143fab007d66295b1b44149ac22729
SHA5121028135088e4f8d15e85db3e92044ba5dd9490ec7343c4221772e22f976bfd26573cb22ccf56980cc24f91368ecbdb1ff6a2f0242518fafc74468a970671a215
-
Filesize
5.2MB
MD512abf97742abec68e88df8beb1a0ae1e
SHA1c2cf9f8566873e8a5af3267417719bbc67065462
SHA2560e03f06ec73a0407255c35bc8eb2ac999572fc1663804cc9e13152eaafc4fb93
SHA5124debee329b79c677bef77668d2006815220217ab09d4cb9ae0da6729cf37bdb38cf7ff1ef0915307ccdea8cacf9c47de8e924be9e3cc1cf3bbc7236885dad7db
-
Filesize
5.2MB
MD5f7d5d9fc6b091a34c83e77b67f7def4f
SHA14781700e87e28e8180b455eda62d7ec91e08d0db
SHA256eaed926eb1b44c96e4ebdd3e28be1773ed6637c37f602af1094d3a687926d51f
SHA51281a66b3be57e4acad492c4038f1896cc1326f4898a1f6b86218b820b963added587153289dc75d1cdf4db15a1c4f1f095ff83d64618ad17c0b8db7e5b62b2190
-
Filesize
5.2MB
MD5b64ae02c2b771f513ddbdccff5abaae1
SHA1375e2d73ef3a52d5af917e42a2a697e6b5c00ff7
SHA25606790dde9a316e46eb58a3ad15350e57e0ed3fe29b86cd8c25a5795000ecbe92
SHA51269a6f310509acc1e41209a17628c49ab2e1f3e3b459eff02c5bd28f7e44cd40c5cd95aa97c2e744eaedbcb58b3db2923093bfb23127045ac9c665889c3709155
-
Filesize
5.2MB
MD5afe872229827b5c01f3a34b1f9738f26
SHA18500ca8b58df00bba367e49092b13d8c9cfbcf8c
SHA2568dd72137ea67e0804d4ee07022fa1f93ca8b4e285cb8e4de10fb50cf84fa78f9
SHA5127da9d2e0cadd41346dbac9c3681db5d24966b50fcf1da67c896e878f9ffd671888d9a24bcc0ab9efe51f2cea8c2ae2a7da5ab95e40f6f1045f9fc5914b54f514
-
Filesize
5.2MB
MD500b390fef9eee8e162d7904158d3803f
SHA186502a7b1729edeab5b55e5b86b2d7aa2bf867df
SHA256b165b2e22c8376bfb210acd8cd3cd0c864dfafbbc3a2459d4df28209060d7055
SHA512250de4780b128fa6fc6c10fd0c7432b3609157411d8519610979f650b5ca8f648e999c00be674a37a06b082d3c95b930172719fd380fe0980f3336fc2d07e604
-
Filesize
5.2MB
MD538e12f20a8b5e6c9da03ec985b990aa0
SHA12e6f9c208a149b4e41d76d0580f04a76638aa259
SHA256b6cd079123a112255e2d09a0b7e7dd90f657ca79aab76c497af7b26b8b7fbb70
SHA512533d306ef5416bdc3b5264abdcf8f0091a5e2ea99cb7d0063b11b769f0106eb309a1ce42c0e9f5f80af05d642b92fd829ab3cdc5819c921f681c02924bad5d3c
-
Filesize
5.2MB
MD58e364d89c483beb1de672bc06f999851
SHA1ca613770df26717f2362f6f59b5bb04838903947
SHA256094c78492dc003760103d1936248ac14b66521c3352cef575eff308ecb7e7861
SHA512f71788ba86c706c114509854b94b92497aa3c598ad773f72ca8aa5d8c02e871a8c28acd9e89ace2fdbd68448affabd3626049da839887d9971e664968d809672
-
Filesize
5.2MB
MD54f8c2a23dcf19865fdec9a71163452d3
SHA1e5064864a467ad1e6a58ab33455dabef82931e47
SHA256d72b4920eb3092163637cd80f92b4cd7bb187a4d7d3fc0432c127c12f2657ef0
SHA512204cbf34057b74893fddd7d58f763e824d99bfe9f587519af9050fa0296f1aa267e7e40e0110951819608aecbc3cd347d59a53fb90ace9b43db678813551a24c
-
Filesize
5.2MB
MD5d49acce36ecf9a5ca3beed5b77ba70a2
SHA15e87b57b274ea7febbd73f85465256a7138c2214
SHA25686f8c706c05dc4d37004a4726e5134c3b8f8c7a0c4cb510543e5376294763e28
SHA512cb68736b9c936ef7e6b15634b3c171b59e057570c1fe8b5217d3b18fd9db29a4b828cc78a11082f9acb17fd5c8dc000b7d79791a22a35e56fce0cf16280098a9
-
Filesize
5.2MB
MD5128b9542345d2c112baaf0db996baf96
SHA1f3a605d7853d2055fb34881254b082a64676ae2e
SHA256faedbb8372d3908891362627e084773741982aad541dbcf7488d73b27281c14b
SHA512eaf313d72799cce6870de7922d941f755afddfb64def3275ee3632260ca8fa7a50610691f9fdfce6722e8dfdabeef91744ffe1e8cf0d683b1e4f1eeaef7bfb50
-
Filesize
5.2MB
MD5a4f2f5e81440dc320a5f353240456f20
SHA173e9b1b58c2656af083da251e377b82197dd6cbb
SHA25691aa99ca42bc0e5fbfc1266830de906f83be521f32ec6fa83b3ba3997c35896d
SHA5123230f1eea67d93c53402da89191ff5882aa185a20e56dcdf6c54791f28effdc129f2b9752295f7ed61e0e5d35118912b37d723fbcae451252d0a487f92f266e6
-
Filesize
5.2MB
MD5326986993c9f904859c0eb8e6900ee4d
SHA1c2cdc431b45cfdd7b008a7e5f8767066c23982c5
SHA256dc30c721d9100868d3437bec27e437ec693b5d27f29c1a09e46a9887b55822c0
SHA512fee585d67bc67ab40f885b850a149ba642f712464f16ee4675bf1c1d7142f51b81b02bbeded0378cb11b5ea32f2eab6229579bb81e44e26269b73efb846e72ae
-
Filesize
5.2MB
MD5318b68ec0d0a97f20d4a4f68c1ab6cd3
SHA12826bd4775f6778708d684ee041aaad7f6b30915
SHA2561db426db9a09653cdd217784e7ac8601b541594427185cd26399d4be368378fc
SHA512026bf8e3beea84196b60a97d950bf8f3385337c0f2a73d720ee10f65434c2ef6ce788d18a4242c7210cfa6cd08b0aa4572406bdd22e1dc00e0151f656141afbe
-
Filesize
5.2MB
MD5458339707b42fbc7518fb6066c6071b9
SHA17f38b5609c28bd84a995e87bf0c72d23842e7caf
SHA25699ee410ba6c250d9a618d686e89cff03d15f06190c42768e5aee14d5921ff636
SHA512983f50af4e3b9603a95936b988d1461fb0bdf1bbcef11d40194bc5e2108ebaa33e6bb851493a4a0066eb4e452e59b6366540050121cbd65e8246269496e4a43e
-
Filesize
5.2MB
MD5b82a1da8a8f0fc10247db082bf777cad
SHA11c3e9f709980576b959f18dd4e0fef2e3c6e2079
SHA256ece1b3ddfb1f4b71b21b0ae41e33acba4233d1d69f3d3b932413d0c807cdbe04
SHA51282e88997fabd68ed9503bbc70fd1c55d2cf7dee5c1362083890f142d2299c6de1ebc1a2a0a67a4deb9bb14a3b8c18cf4572dbc8e445a1a93bce24d6728fc9fbe
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB