Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 07:26
General
-
Target
2024-09-17_128edf3a01ef0dc158a59b2d4b121c9f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
128edf3a01ef0dc158a59b2d4b121c9f
-
SHA1
1ebdf3d4ed4c56a41313e8f3febbb2dc3e1c7090
-
SHA256
038cb944b6ea8603b4e4795b1f08c0c2ae08d4061f5bdf55a624e7bd036a327f
-
SHA512
9aaafc28d91861e5ee608629c4afc866e547404c2743b92d3f81da0d477cf65ffea9a0a5c0926aa9c8f6fe8035e4e9b88a64091f824a469998a27af499b8386c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_128edf3a01ef0dc158a59b2d4b121c9f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_128edf3a01ef0dc158a59b2d4b121c9f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oZczeao.exeC:\Windows\System\oZczeao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhzYlGA.exeC:\Windows\System\qhzYlGA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QoeMJdm.exeC:\Windows\System\QoeMJdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMSMruk.exeC:\Windows\System\jMSMruk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThkbDwx.exeC:\Windows\System\ThkbDwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QImgTHX.exeC:\Windows\System\QImgTHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcnACAt.exeC:\Windows\System\UcnACAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZENEFFh.exeC:\Windows\System\ZENEFFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLQWAwp.exeC:\Windows\System\SLQWAwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKHcnbn.exeC:\Windows\System\EKHcnbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDumIEq.exeC:\Windows\System\hDumIEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ooMagor.exeC:\Windows\System\ooMagor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IcFKQjd.exeC:\Windows\System\IcFKQjd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaeozzj.exeC:\Windows\System\iaeozzj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBiwCub.exeC:\Windows\System\RBiwCub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XBwNFqL.exeC:\Windows\System\XBwNFqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEedrUL.exeC:\Windows\System\LEedrUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OScVCQW.exeC:\Windows\System\OScVCQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPrlhkY.exeC:\Windows\System\oPrlhkY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PIfLnLc.exeC:\Windows\System\PIfLnLc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpMKAMm.exeC:\Windows\System\mpMKAMm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59e1fea96510166d43b559ec92a711470
SHA13a113782004df323a9386af48bbf1be1ee2d29b8
SHA256c32ce3d1d7d12e0a64b6bea1132446602e3ae756024cecfbf51552cdec0f2517
SHA5120b0e055240ce467be8c334fedf93cec60e366832152aa8f4fde304570e007d4147df390c5fa4999325fc3a547f4226e6ec8ee4f06b85d511df5c1da93dc98784
-
Filesize
5.2MB
MD50a7931882eb399ef6bf80ebe40752f7e
SHA1e210c710f7793694f7ad1b8a89b6205f1c134af8
SHA25677419e9e141b43498dae39fb8832cf6e4c68514702b53017b2250cf41303a9d4
SHA5123ac42ffb5e5477cfb555baae6c870ef3e1cb7ebc76de0737bb446a71a07272ede42cd8a2be3bfd01357773b8fde474b3ccc57e5001337aea99d07790fe589610
-
Filesize
5.2MB
MD535fcbf660ef131cb42d29d06e563df41
SHA1133d200d128209feee3e981823a31893b8403554
SHA2567f20f783f79d96cdcef8ebf9f4b0058daf204f962236b34fe5b3ed16308f81fc
SHA5125425a431167bfaa719765992db6bbc9b3b5f30b04a097b3ae3e5331b8aba70fbb11469119c43acdaa7483a0c20f5f12edfda2291e3c68cf5c67ca3ac23f941e2
-
Filesize
5.2MB
MD512bd6bdd93360b103f41835b9d768822
SHA17e65d41b86d981dc4650032316ef7a44fb24c34c
SHA256585e15d88236825ea760bda9c03cf7611fbc8eba7ebfd4b6fb4b99aa1beaf427
SHA51295ad2f29a7d19ad71efaca8cf2217fc65fa0f5f026601c01e7a7cf293e38aace1572a5452fcd3e9cf11c59ec853d1743091965baeeafad33eaca695ea3cb783e
-
Filesize
5.2MB
MD5e96654ef79e63466656f5e56c7848862
SHA1297db920c314302f6e74034a1944321e7c1fb5b1
SHA2564ea8a1fdb44499e3d727331969915d369c4242bb92ca7af70fcb482c515011d2
SHA51222015b97b384f12c6ff8e0e6fcb9b5416a076c023f6f122912806aca0a5ca02ab2c721b3ff89091c1877fd0ff15793995109f6d97082a69a52f9ada1ccb6985d
-
Filesize
5.2MB
MD5dbcd852ddfede10ea725dfc3a257446f
SHA1734b0d66214440207dd8ab940f2f8fd07e5be49a
SHA256076681f29e8238618149e8ff25dc8b59a6301219d46091945e57f72f4e88d081
SHA512d69df0951cc2f7ef4f97b4e97941ce54837ba36f5490dfc124e3915fb9a2a27e1fa1856bcbb36adb829cef240ace494ba3a66ba0f581f5c1997317d183dafe35
-
Filesize
5.2MB
MD575aa604e28efb75882feed8dac71445a
SHA12453a2e07aad05583cff9723d2aa1544f79cd190
SHA25645b4437967a7dbf2a37bd8dc5b3846e66948bd1bb80358f058efbaefceaa836c
SHA5122c792cd3c866083fba6b1db23fc7606243d68ffdf62c0eaf968c4be70ec481b08448a365ef7ff648f25ec7cc17d58b055441ecaee7748813fb73e53eedd12ed5
-
Filesize
5.2MB
MD5c67fd09d8b5dbc3b02154645eed0ec27
SHA16667d422c213aa9cd26717f0a00896d7e7f00dfc
SHA256585a44ad7c1d611031786e7b3f7cc11fcac36dc7ef638f6498362e6986a000f7
SHA5128cfb10519671b785316b3c1d31d032607513565e5b2166280ac9e1da5ac8639cc6bd3c482207d8aed5f6eed0310f671babc2a8cfc72511d0e39f80f2c4e7dbe4
-
Filesize
5.2MB
MD59825ba7a8ebe8a58243dac89aab59937
SHA16703cd2a59425549ccffc52f15f6aa41a473e1a1
SHA256f8c52a1fe77fd7bffd73c2b4cc9ae02532bf5f111c2483131b82397df74f5ff0
SHA5128463402301b125b69dbb917a4d1a2f328720530343f161fe051da00180b2794ddb982f6c601ade712c4e77b8cc5f78436ffc1dc97778f8e5fcb7c4eff275b304
-
Filesize
5.2MB
MD5827038d27341f439d336bfcbc671dffe
SHA1b18ecb41b6c6fe490245df4129baded62cee3315
SHA25681a6edf68cafab2027e99da5c1a5225e6b1cbca0483b0c7921d1650e28a81f56
SHA5122ffab145bee495eb038ba02b42c86f92c25d0dccc0ff1666e0913ab6e5eef1c47404779ded81ce28c137199d21b2b46db5284223cea5abcb74a480e462275d6e
-
Filesize
5.2MB
MD5e298cd9d18b8adfa977c723a2f430319
SHA19a5bd8867adbe95ca8327f043c5bc3fe03391976
SHA256bad58bb66bba7186498df2e1f519e8f28c7afa34421d5ef212b3ac100b247cc7
SHA51241ecad31b88e5e9bdb0d3e0cacb4837bc305b9d1120d212da816bf93ecfd45914604ef4d4bf574d13d0b8e75105c3af0b853974ec232e109f2e7187f98341967
-
Filesize
5.2MB
MD5ff97ede7b4e5fe520be67f99f0acd4b2
SHA1cb3bc0dd577a3ae2818a40aaba2b250aab14e69e
SHA256a20391e606650f308d598428eb5030242ca22abc8f33a409244c335df3298372
SHA512c93a9a01da7eca0a38b209c793b3eaefcee61457837407bd8d0a364c3b779049bb9138b19a24eedfde903b510682600153458cb07d7ffd1c4f53f340d0153868
-
Filesize
5.2MB
MD55451205bddb75afefe307009def3001e
SHA174673f0ab5a9c3de94f6a6cb94705df8dcc0b80e
SHA256f5bf934c085c9bb19be9a51f67891968904b9a27429eff206f41fd6a5f3ce910
SHA512ceb56c479499854f945ef45a9f3938f7996ff6edecfdc903cce7f0dde606bc9b96534098c6d93633a473ce8689e6eee3a09914212db5454784bc36a784f1a0a6
-
Filesize
5.2MB
MD5f83ee78bfcc36b16c70434bfc6a7fcbe
SHA117cb6ecc7a390df972b33b3395ae0b74ec7abf46
SHA2561699aa691ba66080eae3d533373e7ff5e30aa44c7dfd34fd7ab1c478653a2766
SHA5125944c009d211ab2cb70628500223371db51c3771c350314cf6317fcd6900562b60b2e63a24d74a76276248493994726df893a3b2617fc7a11d5f96634628f090
-
Filesize
5.2MB
MD533a3552a33d2e445036df8983823bff5
SHA177383ddc0c91f3d97c2121b8ff34f5d6b95e2dcb
SHA2562ac37f1562ff5aee4328ab7bbf8a7dc5c92637664490de2d0475bdd6769fff93
SHA51209323a6ae8fc8ea83a44e47c424129da6323383d09e9109ddec070dfdce1d6133eb6ea1dffe226772cd8f58e89f8085d450ba52247899c9d832611572f528f7b
-
Filesize
5.2MB
MD5c0e50878ef8bd952cfcc101e6e2178ac
SHA1aed91372ad1c530def669c56e12bd8fd1f2988fa
SHA25622ecca2fbf0ece00d9ffb899d5356b29a8ee0af3a691eaceafbe294673397e55
SHA512bf6c2ba88aebacc1384ca0eff126a1eb0f693ed5aa59e245800c4dc450c18cb044b69f582b972c742096664c60005c37ef058009b1ad893705a4eda2e983704a
-
Filesize
5.2MB
MD5aa332f35a1a88ce09db0af078057736b
SHA1917bb204d526a35e9f7159ab24a6502ff5603ed1
SHA256bf1b8b99f19839083d73fc226fb032add71a0faaa6c8379766267931f8b11d84
SHA5128419c1042e1c07e6a418087bf45d0be541f5348be4c4cd3d1f3cd13f6a7e3a3b691a4aad33426aeb8152aa4ed8c920e290649dd320871e6033a73ef7a3b85cf9
-
Filesize
5.2MB
MD59fae8452227e6ea7c0381bcbed16c923
SHA195888774bc8f78a3290fb24322e3f6820bf44adc
SHA2565b02ffab6a4761c532f0179efa985b4f8ed7b36fbd4995ad13213c2f88f78195
SHA512730015345b7fd088dae45ef7263c943f691e6fc6bce167c61493ca41c66c4db7ad78a7934c2af9d00d9faa82bf7e6901632b833c2d047104ccb495becab802ea
-
Filesize
5.2MB
MD5e1e3dd05c390f1e7ee86d7c4350533f3
SHA1651bfea9935595c80195f1e37e59edd0e9a66820
SHA256ade7a546ec9324fca579afd61b1f784a69834f35d0c21cfa83cd66770ff4443c
SHA5129e6d6435b5789ccafa22f77c04586e507c5c2bc33ff1879dc3aa0a97e79b35e07cbbe410d51def4e3f994f25ba1968a61b2d6df925ee89a4eb629fe3bbd6c076
-
Filesize
5.2MB
MD5175c2961e6dc97c0099668eef7642c35
SHA1674b9978f6f6f8d057cbfdcfb8c1daff495a7e36
SHA256052bfde9ee5b2498d8d2b9a8a997dea993314f5a1b635d55ef4391f002c9904d
SHA51224c127ce90a55b3c76968b8e4e55c9ca502a0b38092952a5ffa56a313dac127ba3d77ac6d9efd22629ee8dba97a34b7449acc87c5aec2279a88064eeaac57ae8
-
Filesize
5.2MB
MD52fe13eb7c0dd29855eac448983c91d37
SHA116718b8495ac2ae08fdeba8083ce393f755372e0
SHA2565b1e1ac4f2cccbd03fc1a2014256421f0082fadb15b1779c542ca0292f1db781
SHA512428cd5b837aa5548960f382474dfe3ba866afe54026e6a0975dea4969c5721d9d3f1b9723ed2bd8be48beec1e1cdfe9fb7b7df884deab74efc8371310244a467
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB