Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 07:24
General
-
Target
2024-09-17_05fda39761feb897ac04d98ca82a19c7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
05fda39761feb897ac04d98ca82a19c7
-
SHA1
35149c37beb5761f10ad0bd567cc2d9ab5a41bfe
-
SHA256
821aa66f2f8eecb97043b5c5ef9ab4cc754224625a6f785b3f6206686c7cd2e5
-
SHA512
7fd868e71f24be478d787d8003e6cba9b69def2e7a87e5c4e1d1bcb1323540f65bf185dabac08fcbcf38b8f21e27f9a9aab57aba6dfda9710d2d8f28e81e447b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_05fda39761feb897ac04d98ca82a19c7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_05fda39761feb897ac04d98ca82a19c7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gSQeUvB.exeC:\Windows\System\gSQeUvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zDxAZOJ.exeC:\Windows\System\zDxAZOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Xdvrqnh.exeC:\Windows\System\Xdvrqnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bOtoasc.exeC:\Windows\System\bOtoasc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PmRlhNp.exeC:\Windows\System\PmRlhNp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruutCnW.exeC:\Windows\System\ruutCnW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FywMHKq.exeC:\Windows\System\FywMHKq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pCDqGnm.exeC:\Windows\System\pCDqGnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVVBUXh.exeC:\Windows\System\eVVBUXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntOPEtJ.exeC:\Windows\System\ntOPEtJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cstauuJ.exeC:\Windows\System\cstauuJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zsEJTlO.exeC:\Windows\System\zsEJTlO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKwtQMG.exeC:\Windows\System\mKwtQMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgZopgq.exeC:\Windows\System\QgZopgq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udqbGtu.exeC:\Windows\System\udqbGtu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVhOfZR.exeC:\Windows\System\XVhOfZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vDhinhf.exeC:\Windows\System\vDhinhf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVkCeRd.exeC:\Windows\System\kVkCeRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CBmjJWi.exeC:\Windows\System\CBmjJWi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPyOsrv.exeC:\Windows\System\nPyOsrv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MzMWqkW.exeC:\Windows\System\MzMWqkW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD559b27569fc647118a9d6a4f54dea4cc9
SHA1b2ca1e03ed3f94dbb5a0c657a1fb3826135a2f1b
SHA256b66a7015de3a05beb2c7e7631a90cfe77de475c4782dc049dcc47a4dba4751fc
SHA512c1a5979372f691d255ebd8feb4a0e10e4b0d3aa06d2e9d070e7dca966961d55d95205e3e6552071bf04f21d3fa566aa6cb3dd31d254f16337ad82cde41653d1c
-
Filesize
5.2MB
MD572215facc4c0507ee1128a9708344034
SHA152c751987cd13f4e2d35a57dd504a3bf30e25dd5
SHA256bec804423556b273c298081dfb341686d57941a73e589b1a9da1a7a7c6adb1da
SHA512d8bae4618e1357e9028a95bbbf597bc05bdd74729002b64da42b1e1e5180a12129dcae0ffba1925f7d0907af05ae4c5ff2c4958eb10b5d2d3b56bce81bb5019c
-
Filesize
5.2MB
MD539c8cafcae632780494e16a832afd150
SHA1af320e652400c336fb206aae47ec10bd6659a9d6
SHA256c932948c1d9eca445837e43bd7e9db4506d4d1b4d29436d50cf2fbe073d4a9b9
SHA51233314a0f5c4aa24fe570e9dffd0d39d44fb76b3645931dc315c691726d85b4b2e3cc0ebc0b36e41d9bc51f771fb6d9693b863c04f7e511dca9a5ffe166c2fc6e
-
Filesize
5.2MB
MD50253804e5606781d2fe7fe0d678d02f9
SHA1f8f09a862ffe2d55a393c72ae3931ab26aab8d4c
SHA256e6ebe1fb8b4d4421e85489bd2af9ec63195280f0166fd72afd41208d8b450d9c
SHA512ee5e45da49eba2351d6f24ce9c313ded11bca4f4533b0d029c6a0070a59ec793c11e826ec239d0991a26510a777e86cd49a33f4e179b1bb2fd2d5da57e71a04f
-
Filesize
5.2MB
MD5f42594cf3cc0f3908083493857e03b1d
SHA13e596aa0e5553ff926a97c59f098f071bb1dee60
SHA2564b0c6ef4f696cc2d9446e5ed2d63ebb12b19a790f4a6fed0dd4d54bc89d5d7a6
SHA512be7f075524e3bfbfb06418484e0f0934252ef48e51b2f15b8851661eb16b91c932eac819886cebe3a8d93a9e48bed3152fce36d39738a1ab11f94022deb8afdb
-
Filesize
5.2MB
MD56d1969b0e5d91a2b638873d235e23298
SHA1e88f44939e4df7a06ab4e67d7bd6c0d86e02b705
SHA25604fc8423237635e48f777ab50864d78ed9c3fd0bde02f035cf532fa836f6f0ed
SHA512f0e88cc86ec5262324e4a463e4032cf60b49369ac56fb5c718ef411743b1413cf0ddbbb8957b42f6b4534860d163135a1901a3327668ed57cf384276870fc010
-
Filesize
5.2MB
MD5900910d7d7f2a47e62b37f184944feb8
SHA114889a901353dbfaea19feadf8d24fd49de285a3
SHA256f5e21d4133750ae8738d859bf1f8e69c55c6f514b9231385f528637d7709c88f
SHA5128efe7ed88b84e3c418215b42e17cc076a97056dce542e282bcc611ed5e06fbb8e70ce33db71dc83970de185c24fd33ce93f50def3aaf85771300884e1ea70aed
-
Filesize
5.2MB
MD54685328dae9a080f6dae0d53a0d0fb48
SHA1e6b934ced37a35f94234916b688d2893925992b1
SHA256a28d4f514c28cdb2e6cf1de2825d8a183e19bdaa587e98eb786011dd66e76dec
SHA512678d629b17da3f2b8536003ae336e85a39d14671b4059ea4ba2a7ee1699b2d0358c7bb1d6e6af093ca317a2162550ea12fbb89ebf45877db4f45b383b1d139b9
-
Filesize
5.2MB
MD5e549ebf52562731812c682492b03b8ca
SHA17a7eb00d65322b8f0588b0ab5832164cbdda9389
SHA256e78c09f251581f171c960f73938c21cee2c17efccbaa8be6740cbd9b070a5671
SHA51245a21ab4b9a4a67053cd2a834f2a7c92c96475395278c872834749127f1f0299327827f780a89dbaf97e90c13340ff8115032d83ef19a7f43cff67ec2264e51e
-
Filesize
5.2MB
MD579ae6d0ad39a52653b1bd48532b09ac5
SHA16a703ec07490ff5bd20b55b73bd3aa22a6891cdc
SHA256fd9977ede4783dd801a7052f5b806c1ed9f29fd3d9db26e527b88c1a82458785
SHA5120d5d90b27b0bea9ba4972d13cbe602c7adca8d0f5eacd6fab57efbf9000a25e4cd426bf5b81ced0caa719b59ef6a0537372578e326de198969cc09705a310323
-
Filesize
5.2MB
MD599d1c2dedc03ec73ca9021460b666d5d
SHA11faf0c2c9a9a5c2af1bb2765822634b4c9ee84b6
SHA2566cef3e0b66063237ca16354eb7358b5ab9b4b751af807f421fcdc9ce171889eb
SHA5126c7fe523427b28be7df2d96497e6758aa98060600b23f51c67aed574d96e81594bf80d7fad1362bee58864f51ca9c369991ef1df4d1576ef421bd19e7144eccf
-
Filesize
5.2MB
MD5a788246558bcd0a38b5a9255dc1fb1b8
SHA134f8d4a93baac3336acbc4dc8d82c1e43a6b1ce6
SHA256abec31520583270ccdc9d8de0a061fdf9c821efa65fc9aff746eae69d929dd4b
SHA512dea811f6e07a7c6295f4cd1d44c9b3f9ee966605d2b02bbfcb66831a194cb00c846a45aad9883450c8309af5075cfeb2b9f2b05a5f1efe8e8299f2b0c78d3a07
-
Filesize
5.2MB
MD5a2f226462c91b3ee9c059661721c6f2b
SHA1b748696c47428919f9381645e17d137ab114c388
SHA2561e96aac8c6714c849867ab95c68b2077b9433f2a32f4d8556c5044facfd577d1
SHA512502170edfa3f0a34b6194ecf6856c4a32819f9ff629fa11bfbce06c3a3c0c3cf51bbed2993249e33c6e0b55f01ffe5ead3d2be45bd84c687a4e952f2b0f05f8e
-
Filesize
5.2MB
MD56f2f984cdb03a0dc72fe72a92f1084fc
SHA127ba2d5443e1a9c7b1668ef06d93a5162900d044
SHA25631669fcc92fb0cdd05f2115e84cfaf4a832159a7a6e2fa2105330f44b52eef74
SHA5122382dab77fce7d0d1ecebdfe1b8e4dd7b68d53fc05a1cdad5c51946a70305142ba3a1a5ea1967fced4bd66422401ad10e01892decc6c79da95866a5ac207db5d
-
Filesize
5.2MB
MD54040512f0e2f1ecd6a8125872ae894f2
SHA1b80a656558ed302657b02a1eb1c41c302e7bf56b
SHA256907fc84b53d721ca61209aa32be040e3c3c8523d24ecba54503e5afaed58c06b
SHA51242a6b078c0a9df0f7a82861321319d200ac6df7512887b65e93000d0758a14e667356ae9b621b43ff01713c0e481a1180b3a1fccf43769dba9e8face12ca54e5
-
Filesize
5.2MB
MD51b8aada847c0f42b4bbef7fd51e4a2c4
SHA100cf258c5a2ded4b2e017230d150cf5a61916353
SHA2561e60e75d11327ce93d6729b206aaeac0214bd99d23790f595667e88fdd3dc7de
SHA512cfd57dab528972c21d248c0138765b884d146b11a40b9d029266d18bffc885e32a9202b3bc6b161513d50c882a0e10d0c6a773e152883532d3ec1fac7df56c7a
-
Filesize
5.2MB
MD5e50b833afd41bced7f0f574fbfad4543
SHA12037d794a5aaea773aa409d07d81201d9fd4c6e8
SHA25611a2eb38e072a3c8f2ea7614195ee07c8ff51368bea826dc55340a8e893e7be7
SHA51286ad2844ea26dfd6e52ff68c8b94e17e9d0e1309f463a238ed1ca5d03856f4c966c1f51bbd9c025159407cef73ce7edbf0a1a63a25b7e4d6c125d788f071ea0a
-
Filesize
5.2MB
MD54ac30f87c48bef3b0df8e3e417eb0f14
SHA1b92adf83b6329df817e262e8b190bf0599b38235
SHA25638ad928f6891c46bace15e78c31f91a08dfad147c934da201f5380b734a4cd22
SHA512c470b4a0b72c7f3066afc010c147c51148682ade63e2bdf2d0606c228970d8c857632619e2fd8d52e4d1fce78df51dfe047c525f00e90f9bf220956c69635fcc
-
Filesize
5.2MB
MD526ebb7de67b3e308538326b64e22b504
SHA1094a7aa64b8a65ed144c7e3e891e63a1581c11f1
SHA2560c6f4338ab6d199b4c0cb414e3e880ca2bc59c3fe6baab352a769de25dc31ecd
SHA512c814f3e64bf0b38cdf8855df3e687d36e63fe02cb631c4ef692b59e8d33653c10f8007749d0169e1fba73a7d6cd706e5da576c511c01079c36ed796c62f7c0eb
-
Filesize
5.2MB
MD555667c0403882692f93c3feeea2ae734
SHA1643cb171155d0af038d82a32be232178b7c2e2d1
SHA256cf6fa5c37d616f11a05498105dac6df09580d4d5e73580d02e6cb20a3c2a450e
SHA512c3b27878acc0bbfd8d9cc06fc5ea9360d2290661bb6616dbeee211b10654fcde83a102164e949eea00c37fd84307620c7d51bce4bea2a61c64f679b11ebcf150
-
Filesize
5.2MB
MD5f04122778ed54ce2ca7be77995f598a7
SHA1998e35dc8e1dad01ad393cffc648d9d87d9e0f84
SHA2565cf5eeb55529aeb1be66e30ef3b320dabd55146849d3a3acf3dc1431fb787205
SHA51256b84e163ffae663996128c69baf57dd655970e161e58a01cfec035851f6d070efdc363e58a61831af490487bfece3536608a92af88516a413f26b18d82b3633
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB