Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17-09-2024 07:29
General
-
Target
2024-09-17_373905ad212d5a9ce2d3a817c1b6a834_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
373905ad212d5a9ce2d3a817c1b6a834
-
SHA1
2d6585906c87b3d4d3bb7c91021df9208a01f1cd
-
SHA256
4a2b629dcfd47096b18325042a265ff31695ba30290eaa3206a408dc852a6733
-
SHA512
756e0bf230856d7653dfa9fa4599dc20d13a21e3b86c020a25bde11adafc6f09e34e4a99ee846e0a8dd802c6fd026819bbc5c5e841c10686a2a55fc42ef9901e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_373905ad212d5a9ce2d3a817c1b6a834_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_373905ad212d5a9ce2d3a817c1b6a834_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RvrRUkP.exeC:\Windows\System\RvrRUkP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHKOKIq.exeC:\Windows\System\dHKOKIq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aqhkZDZ.exeC:\Windows\System\aqhkZDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFnGceE.exeC:\Windows\System\HFnGceE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zhJuPxh.exeC:\Windows\System\zhJuPxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZXHQGi.exeC:\Windows\System\vZXHQGi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqcgSpb.exeC:\Windows\System\wqcgSpb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KngStOs.exeC:\Windows\System\KngStOs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udIvtEz.exeC:\Windows\System\udIvtEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZRpGPxv.exeC:\Windows\System\ZRpGPxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGpBBoQ.exeC:\Windows\System\nGpBBoQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmYVwvs.exeC:\Windows\System\gmYVwvs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axEPWwv.exeC:\Windows\System\axEPWwv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPRGeVs.exeC:\Windows\System\aPRGeVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kUfgdnT.exeC:\Windows\System\kUfgdnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRVpiUF.exeC:\Windows\System\jRVpiUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjOxeih.exeC:\Windows\System\JjOxeih.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MiDeAyB.exeC:\Windows\System\MiDeAyB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSrTqjW.exeC:\Windows\System\GSrTqjW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YhwsBUe.exeC:\Windows\System\YhwsBUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bdkmJLE.exeC:\Windows\System\bdkmJLE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f4fe20ca221bdb197f9dc2d4479fe3b0
SHA14af9617c059da10442579509e4855d63ebbd6d18
SHA256b3fc0d6ab1fb384c8d30888a041759d4fa738abbada47e14cbea201121e7a547
SHA512ebb1301e91441a2da10f98d586bf869996e7f46cc338a612019d3d625382efaeca813f18c901b2c99cda684ae91790c7a18a1056a104dc9a6387e4dbf4495bf6
-
Filesize
5.2MB
MD50984463b02eefcdf5b8fbd9246a8f94c
SHA16a90046ec2c9ac67341984b0a1a1eb613b0565e0
SHA25628fd3184eaaf2e632b882714633671072fa112421846048a415f6b9530c06041
SHA512904df4b7cadb3e3d808b4da3e0eb65186cbe474b7524ca998e6da09242c3e23e27c5530529508520969afcdcac1466cff8c7d3c5186547b84fc629cb218b8f06
-
Filesize
5.2MB
MD512325181921ce1d76661d3d2561ad415
SHA1173dc24d04da44a5010faba25a24d2f58ba9218a
SHA2563d75890e415febd9fb42ae905897fa567dc5539260733e1dda64114c3309315f
SHA5121b7ea5fa34710f16f54175d31e58841ffde72ed5b00371cf8ca14f795eb2e61fd98bb3ca57189fda51797e873024f6f8fc5e5e2889a7678c7ba5aaf59a00f92c
-
Filesize
5.2MB
MD5dc3ef1735c1216052c4a2698f7d11105
SHA1262913450dc1960e07280333b1750e77cf72a690
SHA256aeb61255ae28ddc5b327c46bea3a9ea03262b92d33cccafbdf7cc73b17304d22
SHA512e221db7b4f4451eae093a01a83bffb69c3e300f005c20364675ea8f4ca356f82741773c9b9bb90f416a404bb0d0f1f8360470ed6c5c33e162daf07677c11ba12
-
Filesize
5.2MB
MD53050ccc38261f6fae2076a576cc4d9fa
SHA1242cc3a86b5dc43ce323759be72fcd97595516ce
SHA256ae6fd4cf8d45557c9878e0a18cf2f724d0d67c36d17428c85d12f5c7a5db9aea
SHA5120198c68ba135e9d74988be7302acd9963acf15fcb9a1e78ab1ab79cdba9a030c9d49fd35bab4f72f5d84ccf6bff23be090ab0d86edc57967e1dfa0c60828d16d
-
Filesize
5.2MB
MD5b41f99bd75cb6f3f1d8f049caba9d108
SHA11709fd9aa23b3538aff709c1e94c595d495b0ccc
SHA25639bfe9d1a774de9d2defa77b532a5043521e0dddb1be236d2aa2c49c276d2123
SHA512230b83e9bd9dac35643d7ae5dabfea7225a00634778f4478e3bfbf936e38c62e3357d402d167191e4ab3f8b88a4a375e030b3405a1e39daec4456c42f0aee87f
-
Filesize
5.2MB
MD5f6eeba222adc9f4d7bd298ec859563f2
SHA1e28de7cded074c33442a376c795213437e0f63b2
SHA2565f772bee4504b61d1725828658fd4605b4380233ef3f8b67a071c0182163f9fd
SHA512280747a31310309eb0f9d1da4cede13b68a3630b499356c44d2b2b472cd7159afb15fea8511eb9ed947411e1bbd0d15547f7b68f346356d90a8417800947bbe8
-
Filesize
5.2MB
MD5d2c280d9fc82f8820bf4f857f0263fbb
SHA1adb0f8d1b602114b7b83d9f21bc22801f94799b1
SHA25697838927b8261c2b011b453c70a633f01643fbd6058aebf21de6d3d399ebc329
SHA5121b4ac84d09b801d9854261353e26b2351c00db1d95e5a07c4098c65bc83e213aa69c15e6143f93e3ca6441b6da355e89d1e49a7911a04d748a14dcb5c5bb30f9
-
Filesize
5.2MB
MD597d97b6a5c48b6f8c5c82621035a17cb
SHA1672ed6b10dd75673ffd4596e34d17aada1a15b7c
SHA256ef19c680d75bdcf0c1a75acef64e9e6727abfff143f31a47a8d3d9ef41f1a07c
SHA5129db54b0ff443294c7e63aae454ae1e2bb92170999373981b3a7bdfad388fad5dd626233eb780a9c329097b32b090d5b50b872a2aa26757eb681fb736c0b2e484
-
Filesize
5.2MB
MD5afc639be3b3d37e92c3537b8696b8db3
SHA13c68bbdcf72d8b9447317933402478d239c7cf50
SHA256658cc2793924a52dc2951dd5b70afcf2352581edf1ab8794a3adcaf8ed90969b
SHA51291db4c0f9512d8e7f3df992bd6159f35655a2b300c360a6e8ddcfc6b5d8f635e71200ecb116c75e3d51c4560080df7ecd0aa96ad1b296c3f0fd35b3946997dbc
-
Filesize
5.2MB
MD5bd33ecb7bf1ac06ea5fd0ce4f9f27c22
SHA13ec9520f4bcc0dc831b0da8eefae208de4d04360
SHA256f3ef346ee54c513d9304df98583f8a94590cd254a97e80f14ff831793904622d
SHA51296c99fcc2681ff33a9345bffa3b92e6da8653dddfbfcd8a8025f31cabedc402d61f8e8f4ef633a1305fc5256d67e87d6115ee043b8eafb92721af6e0ba0933a4
-
Filesize
5.2MB
MD5c3a073d87284c3c670f2c324fb05dd1b
SHA11eeb863b4fa5d5b2c2c91e93debcc6f12745c3ee
SHA256dc3516f98eece0ae74213c42ab33828b6cb9591d82ae7aa6be03ac468e6ac913
SHA5125a30d9a9235fa57e0fa9583fc42f70e0cfa1370b44194c0c391e753e83e9440dcff96171f7874ea12680112383a1900a356163fabdc7451e28289bc79379500d
-
Filesize
5.2MB
MD5ba4f1ce9c3428190743c8c3ab23f0029
SHA196e2e22210acef8d59d1fe4d2ddb34212e0a0063
SHA256d0390e79cbb39b10aa076452180b2ad212166ec86d8d27de44ddd8c7206ee218
SHA512c46efa1f7a60269c52436f4d533e25738204359c60f6151ec49bb4ed4c0bd78af0f46c5bb83a03344bc2fb6164f1bd6b5b11fb0b83dab70b1d508012fe59dfdc
-
Filesize
5.2MB
MD5758d84afd4609ddb09040255d89f36bb
SHA120bcef66509bc3b491a938a1ae3f0a45eeaaf11d
SHA256e9d5b21f06b904acd215032dee3f9d8783272d504db1d300ba9e18729b24c9be
SHA512773cdd455b1c30d8f8302e33db6ce7bf0d9a3afbb77279f90244e077da28ec234bb6a3c36af6540a15ea297c13e9f1348b5315a66ceb360a9bfdf425c701c4a8
-
Filesize
5.2MB
MD56235c6a84e1949904c991125f06072b4
SHA14dc02a4fee1db1c8e69d80df7e90a11dd3f4acdd
SHA256474e9c67d3b49f3849abc936907e738759b4740bdd9278d92948c9677d83b832
SHA512509b00d728e60a8354910400fe421e8320700be9f555ada93711503bb5d48e95abfc649abf1c921399542eea2a9104a15fc6484e558393209ca45b8b29362c71
-
Filesize
5.2MB
MD512a256821a38b22676e447170a587de2
SHA1973287144201a64acd5b995dc352c10aac640f8a
SHA256c3f5500d4237ec4ca855030989b46ed7619e14aa3fd6c7e5c1d2b78d5aaf389b
SHA51210260dad4f9ad7495af5a128c8cbbc053e92ebc34aae261d13c0441524edaa1af656f6783cd77e8bbef45631b0ddfbedce1b5a27ba2608a639ec624faf7f3aca
-
Filesize
5.2MB
MD59c2836dcbb860388bea1f6a6583ea088
SHA1569b69c49c322c5d46183cf20a7ead94c092defb
SHA256273751584314017b7497d47938a6ee9556b15e6f7183dcf1f782f7aae5608da7
SHA5126552589c3d1310bd16ec0a2a877655cfe4b56ecf23dbbc716fee07228f1d548ddc90a510d5bc3e450d602b7b9cec483949efdb5dd05843e168175534939c07be
-
Filesize
5.2MB
MD506fd265fcb26f3f74d8fbe6cd8d67cc8
SHA18b44f1b7432c8dda5204f14eda3999fa53bdbdb5
SHA2569634313e51b4d118488f04e2d4cda198e478205e10ad8cb94cecaa02f360e109
SHA512080fecb3422f4f03e89832e6b0e71d879c609023d8df0e050d18844e8f874ac23b20e2d0324314573afdcb190dc1c51692012ae99489cee51cf223cb44502021
-
Filesize
5.2MB
MD52d1bc69e20ba0ec65223172e34e24c62
SHA17315fb1226e8c3563f7b1e6579920f1dece3cc85
SHA25669614f2a37d64540ebb6768c972bff83d1cc76f2d4cb10e23ad57ba7b6eb359e
SHA512d2cd0a80d2be24718094153f169d5a3be1babd02f0f029991a868d309d0881bbd0cffd1eb27de0621037384b6be9d537d57e8890b989688a2a9bf05ffeced7bc
-
Filesize
5.2MB
MD5e47a5ceffa1f384db35e33d92b3c54c2
SHA1efbe38bf30ed14d541df591f1f13da7bfab00082
SHA2561e50643fc6f4566618a805ca49ff8eb2a0a5fd0895755469c47daa64e61f3a04
SHA5123a1096e2f2b04e7f5b24282959bacc72c2545b86c7a98c50550e17195a110b6656a4f6b2a8881b6e0cb2c150c7ccfd145fc941c4b5a386113f302e62832d49b3
-
Filesize
5.2MB
MD5296874c3dce151467aefd766356ac45b
SHA1d890de07176e8fc353dbee2a6df676d7b264b92b
SHA256dbcb90e3c31324e18ee5df9a80f43c3213b9e91ec3ee28d0f6d4ba2901646ea9
SHA5125722c9c55a085e8a60b3e95bdc19325363b98c2fc7d569a34070c9e2e7c9d867d2c60e8e1d31e2d870ad9ec4ea8fd211f371dedcb91401105eb10b59f1eef8a5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB