Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
17-09-2024 07:32
General
-
Target
2024-09-17_4fe41d35119e9a5ff2c367eaf2e28ee7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4fe41d35119e9a5ff2c367eaf2e28ee7
-
SHA1
13a55883a332b9f5652cf8552d8a0f93271a0e2b
-
SHA256
f8fa98b4213364ac3cce2bdb936697d59bcfcae8c60d84286b317e355cf4471b
-
SHA512
2fb90c17169a3e00c8574478f155720376ad93e80809ebdbae14cb0d2b6fa5af86f5dafdb50c0b1a83d5ca7d2e67078288b965bb3f8745e2098303f487e5a29f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_4fe41d35119e9a5ff2c367eaf2e28ee7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_4fe41d35119e9a5ff2c367eaf2e28ee7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vTkJEmt.exeC:\Windows\System\vTkJEmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDefAaA.exeC:\Windows\System\NDefAaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPfUvyx.exeC:\Windows\System\ZPfUvyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jWUBipO.exeC:\Windows\System\jWUBipO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GODjSYe.exeC:\Windows\System\GODjSYe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BEFPNQk.exeC:\Windows\System\BEFPNQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaAGHcz.exeC:\Windows\System\NaAGHcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rkyTCUE.exeC:\Windows\System\rkyTCUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdVwZGP.exeC:\Windows\System\WdVwZGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aUsKjFc.exeC:\Windows\System\aUsKjFc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SKVkGNd.exeC:\Windows\System\SKVkGNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jluufeT.exeC:\Windows\System\jluufeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICUEPTP.exeC:\Windows\System\ICUEPTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLyTTNJ.exeC:\Windows\System\zLyTTNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IGyfeCH.exeC:\Windows\System\IGyfeCH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NSEZcRA.exeC:\Windows\System\NSEZcRA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xwSuKxS.exeC:\Windows\System\xwSuKxS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTHBvbi.exeC:\Windows\System\lTHBvbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cvIjPvZ.exeC:\Windows\System\cvIjPvZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJLlvit.exeC:\Windows\System\JJLlvit.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CbSeUCS.exeC:\Windows\System\CbSeUCS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50daec16318117f4390425016a45b3e96
SHA18f98b22a4e57a6a5298664fe209126b63f9ba365
SHA25669ea38e68374f96e932a9ade7f025f13040ece6f5042affa9232ce1653284364
SHA5129ac3df88271ab8120c17cccd77e0cc178ee0e56ec7ce136c14436a37e13279b91966540c0d93f30defbecf1490983c2fd8cc7ffa1483e0eab7dd44ab249b0d99
-
Filesize
5.2MB
MD5d95cd9f08b83016cef81875197ceddd5
SHA1aa78b1fc88d3f5534ded5c42c68b8264fb4d8058
SHA2562ec6d941f298f5ea77639babd7b1adeebc0f229066bb71fc1d3b18dc20c98250
SHA51251b80c44d082d7a3e0e8561f27397087ff18b929daef3b0d54294f2bd01a88d323899ae5ba65ae87ac1d8d1fd933bc82c719dbb7e60b06899c700db058dda7b4
-
Filesize
5.2MB
MD59b17d75db55b3e0986b83be23473ff1a
SHA1e3d57751f1c10b396a1192a1e762b5ab2815f1d7
SHA2569464a18c3116168ab78c9ae2ed88947edcbad76b4b5c14592fdc883c8df286fc
SHA512866d6446561ec8386e13ddf5d13f7fc92f5632bef43c7a44b9eb2cc53b9601f5918b5b3a53a6b32bcdb82c9b009cbd2c22a3979414baf5a562e953969e296cc0
-
Filesize
5.2MB
MD51d3bfdbf44ecd01dfd89c8c2d54595e1
SHA17e9a0454d6d9967b856839a598c6e4f4041881a8
SHA256a2addec16c1900d536d6cfa3366d3bebda4be3cea72963eb077fa11e8cd24a92
SHA5123201440aa4960c8266238591ed6b7d0c5546dae7c74afefa93eae7a149078bf8cb6ac54e40a7f6e51b366bd20e7e3b60b819f22589077e780228f6a1861c3391
-
Filesize
5.2MB
MD52fea78e5cce8cd92686ef90c35f22584
SHA128a1f47b92becd82d1cda13c1b3779a221ac0847
SHA2563a75bccb27a0edb8769c77e64781ef5cebb174cd63ed093d607ff09671373f74
SHA512bff5db42130cc59ea9f1628c1123fa9c8028a776f5ede283cd4806b09bb84c707ed079687af482a9a7672c331200346df380a83deb43b6e14635b6caea359334
-
Filesize
5.2MB
MD52dec9eb73b03ef6e849b7de84ae70e1f
SHA1c475c481cd874b92c666a61b810f4f2131c9f06e
SHA2565259652d7c7f32a5bf768bd59c40714af5fae1d46af9b89b59876ec764c26a57
SHA5121f9e613a64fb5e05dc7f7aa065b359c888232e3d853dc5f707960e6587118e5f5724426d2d61b29275463dfce5bce0b179738c52a0f48111c0cc79f08859b9c3
-
Filesize
5.2MB
MD523cc5d9ada853fbb43cd900fa15e4761
SHA1d3429f94b4ee562b8088a13782d2cb7a462a4bc9
SHA2564f91c642a2dc9ac058ab51b011b036a1e3637c24682d6f91b755cd3364e5013b
SHA5124b85444f041582ef10eca7982ea2058be3dec50f745839a91679a5d5564ab5f8704809a825e85ceda31faf1478d0a02f6da058bf42e3f6889947e6e79b9e994b
-
Filesize
5.2MB
MD5fe17a2b45bf50640aaee61c616696895
SHA11efda0a407f464f5494716d443918f148b593fb5
SHA2560a0087b8969f4ea5b518d4a4a403b388b1350e8b50d23f685d344d1bcbd5491d
SHA5128505a0f8d817797fefd58fe707570d5e3c05f5c22536afd22bc1e50e5c652c109d2852dfddbba7352c68d7ced482b590235cc06c8b5828fa92bf8ce57c23d9ee
-
Filesize
5.2MB
MD5d2dac08db619fd7a606400d6e25175f3
SHA1cc018f1f7273d34be41094c8d567dae1d18ec86d
SHA256f714f2b4d1abc9722bfb41cef60b72c11f316b52b53739ad78ba9684189bcad1
SHA5123430fb0cb460b8af348baa38af26399ceb273162269d0a2f5837b0cd0ccc80748e41a086081d7065c911e6b43ffba23bc5a35f475d252ece2a34c4559858f371
-
Filesize
5.2MB
MD5ee835a72291154578950df1bbfbab8ea
SHA1d13bccf3d3fa1c666246bb52ce6ddf179abbcbde
SHA25681c814d5ddfb80a5437eb76996b77a4834ed852df091ffdd5bbdd322d853d762
SHA5129124764a8538a129d5492aec1fbc936e7efad141e6dfa6cf56c7681bdfe5c54441bcc1cc20ca5c1a0cc0d2480ee555b6afb5e451d1168f277d09faab31de42d0
-
Filesize
5.2MB
MD5c5ef8b00340896e1937e839a4ad66398
SHA1b8e4a104036a914f9101ff9c9c733cf01c23702a
SHA256bf2dccbe5511e7a11f0fad16425b9e0fc3d899eaefb688c6e881bbc58944a31d
SHA51262b3419bffd218dee16c43ae1d139146588f7f9aa75ad2cb85d52baeeb7ad7b63f9d2d9ca95f424c44c88ac0c6f527bff46fd708fa1402d8ac76ad543e2867cb
-
Filesize
5.2MB
MD5c124a7602e03153a394fe82ddaf09911
SHA1780e1959c27c6f9c1afc8da0551d91dee91b8173
SHA2565c951dd22670128b6f3177f3cb82e08bf67b37a009c3a12ac919d2e71dd07e66
SHA5121a66cb7f2dd2fe8af8601d936476ed1d00a34653aabb78d88b02539908363c2213db85608424f4ad6eedef27cb455e46332605406741449c8d1c0f7724015714
-
Filesize
5.2MB
MD557f0f05f999416ee8f016bca4d8489c0
SHA1972b76a2c56e275fa87fed29b9eb01fcbafbb04d
SHA256e05ee2b0a0370625535f87be3adb942214fe49085a4f67896b494fe771b96d13
SHA512fc7a30ff69e47631bba9bf80c1ad34b6ea62b020f95ae2443fcd3c40adbeb8b2eaf8d80f243c349f379b8731ccb5f0780cb3445c4c1aabc67ae0e1e41e0bd4ab
-
Filesize
5.2MB
MD54628178a430d6b7ed6b27777eb517e3a
SHA1827e1d505fe2b3c966468ad7106216a8259668b3
SHA256609054782926764762b88ff85fa4d942f017ed059fcd582a6f7e64d99efb6fc7
SHA512d3d4b55795859bb4f522f4031e11ba625845a7c77adba5e786559d680e60264fa5b1fb8fa12e7df5033e8a5aa63e5db2ee4440d8e0eee60289e4be48ba74de01
-
Filesize
5.2MB
MD5aa16279a0b1db75edf80a658f88a7190
SHA19ca4512fdcfa722107a092a8453271934ba70320
SHA2567e7f5847c1026f2a003193af2a859d323f7121b47f5d234f61fdc706a9cf1b0e
SHA51230b6e6c256b076041d246291ff269d398ea856d1923a265147e7547a806f93eccd2f1a3e4d3a2705e99ba293fbedfbef31683c1d34b65b29eba285a1d84afbae
-
Filesize
5.2MB
MD524294238d0e20f9317f82fab7feb645e
SHA150435f47d2fa512d0419c3688bbd63559264f71a
SHA256705357ed7e21015f04b880ae694439f4c138ff7ef35a7a89897f19cbddf988d4
SHA5124103893748d1c3439376cbe2ff8773f974a3c7bd5b2366f533970c045b9520171fc3a8aaece1c22433d57bf6a89616505c49ca0299b8d27efc1ccefb690b4f40
-
Filesize
5.2MB
MD51789aa0118edf4c2c5b51e52032f2b26
SHA182222c1e156b84a7a08637bfc14474f9db67f355
SHA2561ebfa850c6efbaba4b3158a26e38b14d3a348d251347c3f17dba7d9c7cc7da56
SHA512edeab2e94d6f21542f02c773b557db7263799b47ee087328536c535388d16ac94f5b86ec636965563029c15bee70f01c346366bc3d7b66b899c285dbf18e7394
-
Filesize
5.2MB
MD5886f2714cef345567cdc83bfd3994d85
SHA1fbf0deb97d44ed190ca8b52a6c62f95eb6a570e0
SHA256a54a709613c3e4b8511b29e41d3efb2763512d6c5c1eafbde50f6e419a0cac07
SHA512ef2ce88e26283606ffa11f6020c4be0b4ea4e69928b8dc62f17371ad575881b0120efe61c08731d270cdc0c7c26bacbf4f65758875e138000b25ac40ed4c7402
-
Filesize
5.2MB
MD52b950cc76b1364b836885ada2ec306aa
SHA1369f99512e7e67ea3457e72492c72a6acb6f7ba7
SHA256c780c815d8d634779a288021299352267621ce7b7c9652f050e256f7b6ff0358
SHA512c0524eef2488f96cc08ede7f8c43b23d48ffbeae2a5423dece16a5939ad1abbf261c72cc3412d90a52f7d89b6cb01adefe1e5bc0ee25e33f7f0e6927a8541600
-
Filesize
5.2MB
MD5a3012bd898d7c8a2ef4aafaea8691416
SHA19035e968971724f7ac6e2a1f67071f4425a38291
SHA2568ae5bd5fec685c53f783e1c793f6cb0005493ca3a362723230d57571c2d509d6
SHA512c83f5b41215b45c84298fa3e988a797058bf13aaf9a6488066087dab1af9b0dab79f576909204f797d07b900facadd6fec8f4df24326c8a99b56fe5a61777c48
-
Filesize
5.2MB
MD535cd9eb66f48f71437e4c3970cc5da75
SHA1998516a9bd424f89d29de60f6d9e8e3092703f77
SHA256ce4d91ed9d05334bbb3028eb263bf3fc4aa9057053e2e4a05ed2c325dd55cc05
SHA512fb3e6d84cc96c7e74a5de4bc73d3066684ab2adc0a6c9ec54e758f9c2467d6cbfc2806f5217d5c30d53b5f33b4a628522fdaf620fb5da75cdfb1d6d69dff82f8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB