Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 07:30
General
-
Target
2024-09-17_38a6bcbd35708a03a4bd104b84264b8b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
38a6bcbd35708a03a4bd104b84264b8b
-
SHA1
30777981ea899ab92e5c2a06e378ae3be19ebde7
-
SHA256
783161abb0cd5a55fc64cd158073fe5c654804aee5509552bed6e859525bb6a5
-
SHA512
fc1585cd1aa1412ad4525aaf9d6fda9c95e18c7bdc1cdf1e01b4d446fc8677dedb65a982f5d8ffb87b618b229b41850462b4fec8ebe8cde697e6b463a496c536
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_38a6bcbd35708a03a4bd104b84264b8b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_38a6bcbd35708a03a4bd104b84264b8b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iVEVktr.exeC:\Windows\System\iVEVktr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dIgtdgD.exeC:\Windows\System\dIgtdgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RgEfeBp.exeC:\Windows\System\RgEfeBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zWYQNmG.exeC:\Windows\System\zWYQNmG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkmFWXr.exeC:\Windows\System\hkmFWXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEftmQl.exeC:\Windows\System\zEftmQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhnTZLA.exeC:\Windows\System\VhnTZLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yzGMsyv.exeC:\Windows\System\yzGMsyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrFTGgH.exeC:\Windows\System\OrFTGgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XpVAabC.exeC:\Windows\System\XpVAabC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BBnCwIs.exeC:\Windows\System\BBnCwIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkxCWTM.exeC:\Windows\System\JkxCWTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pdsCLhZ.exeC:\Windows\System\pdsCLhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EjuWcwT.exeC:\Windows\System\EjuWcwT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eCOIiPM.exeC:\Windows\System\eCOIiPM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAAUHVz.exeC:\Windows\System\yAAUHVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUDuKmu.exeC:\Windows\System\cUDuKmu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EvOkcHO.exeC:\Windows\System\EvOkcHO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKXzbpT.exeC:\Windows\System\yKXzbpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXdyQKJ.exeC:\Windows\System\hXdyQKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQnENlt.exeC:\Windows\System\dQnENlt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5130565f503239c99c4e1b58e30bef10b
SHA1bcc8402cc0bd98bd17e7c3ec4ae7c809c0cc2fe7
SHA2564dc90e1dd3c52a95049b39923693da2684185e10303adc319482028c95640b14
SHA51224041f5cae8839cc23b10f9d35e6226b980943295c69b8abedfaae496267fcf7aeacbbc1c600b74a0bbce01d72f1ee9e816e1ff04f3f22f5cb583e355698d71f
-
Filesize
5.2MB
MD5fff3224c36f644bdcf36f4db96fbcaa0
SHA1fe4dc8ddbfd0883153441e34154736ebb2d93fbc
SHA256e9f3b3a658ec242f1f061ca76b51cbbc490b1df1074928c2c8a5798acdd2f217
SHA5121de02d822fc28c5bb93667895732511ca3260e4e247020c89068f85c4f342e8b53ce55a14e3c9afb15c07038b218bebb45ef20459e5d38db29b7f1151f2a67c1
-
Filesize
5.2MB
MD5927fb3396bcd2ba78d31a0d4a8b6a903
SHA1cbfde2b8cca0878b5f7da35b0bf6d3d2b56dd84b
SHA25671d15928c8fc3eec3094d45693863900f953a8884fe071e930410897079cc2ec
SHA51280653b8b641a807bde6146947b9faf5151e80f007386157a01c171eaa494e83230d204848633ea77d98894045a2d6c1c3fe6c586f647dd8f608f05b50800ca74
-
Filesize
5.2MB
MD56cd39cbc8ff9929338c45a99a5db88b8
SHA1a04a373aefcd37b32173da952fe687a574e13e11
SHA256100c32c8c934066719281c37eca06a10d5bf4160d83bae78f15f0f840bf9be58
SHA51252fd3d4594b21451542237a54e602282a51f977980b2a26b2c4d18bbf911663cd4495cfbd9351d6794da5bacc7afc9bccf5eb79c7e92a35ef2f85e44d553c932
-
Filesize
5.2MB
MD58a0e2fb956aa8d5dfa6fb4be6b2ddfe8
SHA14902555b12c9938925cd8253125837740d97e4cf
SHA256fd46ec5d1ef7597e0689479313152a523fa98c4d696e39aedfa2eddf949604ce
SHA512d4d4909d85aafa2925905d24d702d86f16fac141134bfc30713dec2437f0471b0ce6181cc5212fc0c0d6b32359a795264d327e4736a42352ea122f48ffa9c46f
-
Filesize
5.2MB
MD53632740399c7dbf0da2043c81ed1763d
SHA1c0bde2727880274bca7d4f96ff70f16fbd4ab8b0
SHA2560c5b7b35cf1d05004bac03764511d2806d6df433b0ef60046847ed71679a685f
SHA5126c76bbc094a69bb75ae2ca1fc270425109a465a477db7b8779bab5039854265eff88fe50178f54594e7dea15fe4e5c3bc1460ee22a6fe9fbd50977c644bff5e9
-
Filesize
5.2MB
MD52df9a935d9c51b072804beed2609493e
SHA150874cb199fed4fa00121661028724b3fea22bfe
SHA25653261266a455ca73d2db526104377d9ac528510cef0b357c21b05ecbc967ac5d
SHA512195d4b9fa7288a16f767d7aa653c70aaba56e17dd179f8e7c3d4811d10e6b7ce09e117e055c749c01ea7f9ccb819077fdf5ad287d777cbf15c225b804097def9
-
Filesize
5.2MB
MD5e8f5a55caf73d829f7dbb986712fddd8
SHA1f25c2e2e65a980944c8b36e40fe6ee30c9048b05
SHA256f79398bde4388e6a6fde81c6ef054bf4b4cb5d675ed20e1118c31f7e78b54c55
SHA512d0bab40dce5f06cb2f51cbdd0936c0dd4fadd55fecf0b6251f12915eac064ef461dabd4e00b153d71041a1c48cbbe55c3bd2e92e3f3d4787bd4398bc4f263b34
-
Filesize
5.2MB
MD57596a66780ef090146f65aeb4099f3b7
SHA1fe2747cef2fd84781d7955a059087a41ed347a8d
SHA256cee15ba41a16ea1b838a8d80ad4e9d97d4e08b278c68e900d85359a7079735d7
SHA5122f721c8683d4a5d0a77ee8adf086621581a4be987cb572d4abe134f8500cd6dbe2a03bc0b64c45791ef121cb5f9e858586440d0140c1da18656ff09294b55efc
-
Filesize
5.2MB
MD564c29ceeb1c86f35c1385771ca5bc149
SHA160367d21e673c6fbd211901d0fa0b176ebacc120
SHA256318840da332e931aa66a409896f3318d86a860e8c9899bd560fc249804cc6cea
SHA51241e5f018b01cd822913a5dac15704a4bded2a9d415f72387f459fbc5dca013f0ed56d363cff5867e7711e8db885aeff7750927027cb885768fe31512dc3d913b
-
Filesize
5.2MB
MD50f3b983c67e5d83c92f9b9a6122ec300
SHA1048aad8abdfebca96dd3faa65b78be1b7e8cb0d1
SHA2565a6deb9e43d9d19f47224a384875cf91b54526827b93a1aa42bbef2579261858
SHA512447e14d379b26c8a03171393791e9f028b8d67f6347b21f03d2f395fa2a994fbfb96198a5bd1e5bceef3c17228fab4dbb62f9f0abbb1d630c43ef9bbb03a4243
-
Filesize
5.2MB
MD5ef46cc704e09432859da15170a8f693a
SHA1cff17763e67a9b77b1241c09d23324efefbf1a21
SHA256604eef90083f76a96ccdd7d49cd1a5ce716f3ab73c0c5f5caaf37fbb0a1043ce
SHA512ad922a9e3c131c2ef832b0630dc00e4ac054fb8d119d3131a241c58443d9da0680f63463e0b0a0b26f55f30772ce4600b1e2a3932c18f4f5f5b6568d26d391d3
-
Filesize
5.2MB
MD53fdee6abad174b3427a8f3a57a1f659b
SHA1d9c64f0649573d9a59297ed4c21b7aad3d46d6ef
SHA2565b5e2a125f001c969a39fd749bb554ff645814b10bc5a5eae2eaf81e155c072b
SHA512cf353aa82c3fcea057feda50d7b7a6239c7b62a92034a58448e6ad4b0115859306d4b8dcc8dab1fa60b651bd0001c9168acdbb45793b10dbce64febb91fc08ff
-
Filesize
5.2MB
MD538b00d2463d57ad8ab58645ad32c6808
SHA17e74627a4104c2d3a52984358dccbdaa3bfb3b1c
SHA256df07ba973f785cfabd850f2bc1c3ba97b8afdc5cbd8b21ecd344c31270910328
SHA5129dc4eafb7b34922be016fa8a9718991d2fe316f2bb126a15df39e7771c1b2412a0378f5cd41ce19b53514c0757c2da7ece3b5d52afb57ff827ebdcf76e9b1347
-
Filesize
5.2MB
MD5a4b34e78b6ea78d00780caa697604e44
SHA140c937c290c913ff9fb31f8abcf002ba772d84ae
SHA256ae39efebf759102de84ac10544a794a1628c65449832ec64993b28c2459c3b97
SHA51245fa42e8ef195d31790d59c1e64023d619bfd5082beda35a3ef093e456c3e677046777f0f5285f01101b085239eb94df8a07c0e1896bd066163c32bba7fe40bb
-
Filesize
5.2MB
MD5ff76655b95ef2a76ea293b08fc887c6b
SHA1b0f6ddd39fae5083247adb8698c0de10a5137047
SHA256b2f1b6b508203391df8c4d5265a19b29b7b3b67980a308ab76962890be253dd6
SHA51247bcb5a9dea7ed4b0caf942c74924151316f1665bdcbd6770f03a45e6c894790b8bf6aced6f08c2d49e3ea515d695147d8cc79f3ff76de92152502392c6fda7b
-
Filesize
5.2MB
MD548a3adb768e6b8329e90e3fb0ebb9d1c
SHA1c3b3ed0f6d85aec670185b8e8fa650b111dfadb0
SHA256c86fb414a1e27c78495a8e5a20715a0f834aaab3e372ec9f674e4a207f49dc33
SHA5129811c86afb104f387e5cd978a68f7f23083ee3376a0e2500905cb322f0173df1f045982c3181807dbe5a4d5a06d764589cf4749784f1a6b933966d1a427f2b3d
-
Filesize
5.2MB
MD5e6d1658407fdb6771083edbcf8cf2301
SHA1e854c62cb708c03beb94f147fd0817af2031c215
SHA256008eaf43de1d4442d9686f4fecc855b1965b932b95511dfb088f8b1428303f35
SHA512dc5b4226bd33e40e61d71ea207d243252de9be2d94685eba1474354c8480b4d657580d8b3341c4f4b41ae34e258383190474b4f688799a0d25984e81dcd685f1
-
Filesize
5.2MB
MD5fec4fa09e44e2afb9c260e47c23de754
SHA1acdc14d56c38b9b173732ebaef2bdf47009a24e9
SHA256de4fff6a31518a5018f3ebbbbb76be088173aa1527b7904f6063dbc1bc5ac40d
SHA51237f063c9c3246afe2a93671519ecdf7f0e8522bbd82f7f8f4b8bd5833e87da22ab664e951da1009239c0109ec76d0556d4565cc4b3e5edf82f78a191997a96b6
-
Filesize
5.2MB
MD5a4645b8147969e2e7a5f86701199a4a7
SHA1be8d7ddf83cdf73e2c8ac87591c397443dbfdf53
SHA2567b064568a3b46c91545249b75a2f10df7da18b61810d3a041ee2cc128c89d568
SHA512de54d0f9068813befd201781a617063c7b44eeed0ec4ced01146252a9f7b4a439bf0e959a3f98a1ae76bac50a7231af7ff7cd849a0309df639d20c8179f086e1
-
Filesize
5.2MB
MD5dc4e98bc986f046b2ab16d4ca9fb6875
SHA1b9f72d590f58d6eddab32dc685e89c108cb7b403
SHA256ce07d6a0cb14f0496db97e3b4564808c71b5ca932718b85bcfbf20370c1f085a
SHA51247172d9ecc770eb8a7d1711233328e1b0a55676d36dbed707202e15d4a866227fabd9b15ed8d632c83a35e45d2e5100a9299d7f60e37f094825f19e8325b94e5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB