Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 21:46
General
-
Target
2024-09-20_25155dc75fb17a02571d4013ab4ea2de_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
25155dc75fb17a02571d4013ab4ea2de
-
SHA1
6f7d53a05f2e6427fc648b711a48a7ef2e107cb8
-
SHA256
0fe3c1bd57822b505f31bf806801fa949d948f15bf2184990b99893594826772
-
SHA512
23f94469cda2e156106804e9a985769f64455c94b111fc31ee03c259d7f992107faa67a078f60d241ec7e1a8eb345fb2a9aad9d81add91ca1874fbde43418664
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_25155dc75fb17a02571d4013ab4ea2de_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_25155dc75fb17a02571d4013ab4ea2de_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hhMvnsA.exeC:\Windows\System\hhMvnsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rkmYHLN.exeC:\Windows\System\rkmYHLN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGcdFZr.exeC:\Windows\System\OGcdFZr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwMNBke.exeC:\Windows\System\YwMNBke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WcqDIRj.exeC:\Windows\System\WcqDIRj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RKLkmww.exeC:\Windows\System\RKLkmww.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNiyaxp.exeC:\Windows\System\UNiyaxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVgXLzu.exeC:\Windows\System\zVgXLzu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hCaWrrS.exeC:\Windows\System\hCaWrrS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TapRSBy.exeC:\Windows\System\TapRSBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbNoXNS.exeC:\Windows\System\PbNoXNS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cyWVRNB.exeC:\Windows\System\cyWVRNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\THPkPFw.exeC:\Windows\System\THPkPFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqtxpsG.exeC:\Windows\System\AqtxpsG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYsbPMM.exeC:\Windows\System\SYsbPMM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNiMAGZ.exeC:\Windows\System\sNiMAGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgeJjhM.exeC:\Windows\System\QgeJjhM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NAMQlFg.exeC:\Windows\System\NAMQlFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZQvLBjN.exeC:\Windows\System\ZQvLBjN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWZYvhk.exeC:\Windows\System\vWZYvhk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXofVcm.exeC:\Windows\System\sXofVcm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53a7a9d27a8851d7c982caada0b059a2e
SHA1aef635b53fea042e308db921bf84de95e802c3f5
SHA2564f00723b7745448892afdab451edba016a2ac33bf24c9043b668b150e7ee6f63
SHA512fb5ace1ad99d9495e7ad1cd6d2702f6b9814ab6c878f9bb88f98fb2dd85615df2abd244aba149f9572380cf1f078040f00a8e359d5176e6dc1fd62a7b49f62b7
-
Filesize
5.2MB
MD5605a7414eb04b1374fa82f63593f9dea
SHA189d04c97e29ddc0f86e74487e3335032cfcb7a7b
SHA2564c41f2218eedb01d955bbb35bf094536c30dbacd9d9e9579288ac10423e46176
SHA5122933eae479485fb99a32da4e712b94bf9849f77df6bf54dd2d95ac45c358ba43e703b76b9c251fb47bf9c34476fb11e2ccb13b904a2438a0cfb4c50c3a737658
-
Filesize
5.2MB
MD54828bf1a12ff1e73540f7264f6b7d613
SHA1c67d89567d1fe4b62748a267bc6c3b5e3e7a4423
SHA256eb62a266f9ff35f799346610be174eb2d198e25e236ed6aa22f5c621cf8a88cc
SHA512afcb1f60e17b9d5ad78776c2df8200c531cfc0be3e5997901bd3a054b272500d589932dcc8dc426642ce4d8acf24203a56db52f274b16bf233014b7a7cf8de3b
-
Filesize
5.2MB
MD5c079dac3333cee85b64c9a886b313147
SHA1d671c3d8629a62e9229040a27e1fa4ccf219eef5
SHA256bd15bad789930f96ad8b3b48e030f415e54d11c4259733b3b866ca2fbe4122ad
SHA51251ac73294f0fc3a80bd096e8b7666427a8fa0f49c6665528d80d078666fef8cbdc861807c5a62a6bcaff5ecd16af2e8d92c0bc363a8608f49ccca8efa95f66ba
-
Filesize
5.2MB
MD52e4a9cb9ace60e73e600cf52f1a99b18
SHA1700a64e5170a3dc456f8a5074212daf3d916663e
SHA2568872b6c228ec71b541d0a3e54dbac5dd7bf09e90036f569e420281342ec717c7
SHA512fa9eba43b07a673e4689c6fc522991230fa2cbc80e259cc53231d58a1d74a378e9f616326e8100984015c95dbd49549b8d05aef7e236020504cd4fe9d0d39cf8
-
Filesize
5.2MB
MD51e51ed2ac8516d928d225d78d547db8d
SHA10672a4b3da31de43d18e453342a45c8b92091187
SHA256cb20d9a4db1b1bab164a4051ebb734bc7d222107ac2d34d0b8218166bd1c9905
SHA512aee5afb62eebe57245733e18d82515c3f4125c522f35d7dd2c8c0c53c4ec66b25bf718c5e81f16a371867d4fb6107d3b9c346fe0d4b2f1f3dfc81f296c24cc6d
-
Filesize
5.2MB
MD560c8b94db9c2e18a2c107742099e2bd9
SHA10c73ec618757c154697c23762191bd38a507890a
SHA2562cee33a3ab9678020c96a7994d8039c31977d93c40ecd2d02d2b1bdf3658ef8a
SHA5120ff534b62fde64e5a5a3249fbaa5b976ab8fc1bbfb6d05090165a9ac70009b3dac597c60f2f7f716ac76b459adfe2b3ff2fb8cf82b6cc58bc4755bf71f944673
-
Filesize
5.2MB
MD5d753d153686e88f69190ebfe08146068
SHA12f7fc0d568cba13b3e0ea80a76dd4f77416f7b4f
SHA256ba06af33883f8b24c68fd553877121a5d38f85ce52ac87e497f3dd762fb8026e
SHA5127b1613866981135f2ecedb9ce86756193856aa4932dbf1f3ddbeef3a0f733efca4a6cac75892338aa4a1fb7ad6a592d248bb3d21728b6dbdd8b95ee3319cdf62
-
Filesize
5.2MB
MD57902cc2cb30040aa48259bbe93969c3c
SHA14338f160cce67f8ad94745ad37049e2dbf127c2f
SHA256b6cd9c5b0d1172e631c851e21769def3680a05aeb95a8fc066d855f74ac60654
SHA51244d34d146704984b99822079dfb8584396f3337e7c4db9fca567f107746c7c484de450976c1a467e2d059114bbcbef59e24de627aab056f5e25bf209e6239e29
-
Filesize
5.2MB
MD574072a6748859c4cbb565437f4605789
SHA127cea637e4e5dac5d26eddcf18e63ce75eb71832
SHA2569441ac20b44f35eb32783e541d0c24615cad7b6a8ad8adcdca4e6a0b0bb0f575
SHA51240f242319ed29face8c314efb46443de3340a7b25b248db297113898f0cfa814b4e4802fcc8df7071a7653f9e5911aea5c9b2ba311340b15062d5f505653b3cc
-
Filesize
5.2MB
MD51e5ac8a6d3b6b8f9ecff416b5dfa2ce2
SHA1ffbea3b30d5973c71c6edaade4fc6e2946277920
SHA25603921736f4715c5c770c3a0db509cd2d331d4a67d9133c57324decc5909b2a46
SHA512346ebee4af603a6f61dffe6a02f8df6d797948790387ff45d8e6a87a207842fa04d2fcbdce86260141e4b6e8b140512b0c8d286f8cc9eee0044d016c2983a310
-
Filesize
5.2MB
MD532c6d85508c6a2a140dfecac6e403c05
SHA1c3a43c0285c22eb3abeb3d6162ea3e91a4102191
SHA25631894d0bc728206d9dda94f06d0d891e5da4e0249a2a613e79a1e7c0baace3a0
SHA5127d45e621bd3e5a6093dc91869bf10c36329c2d1a4d892f1bd0f4e198ad5ffce2c59a0d68e7415e2d6c106b2aa061f86f173bf01029393f4af23be41a8e2adafb
-
Filesize
5.2MB
MD51868d57d34deff8fdf599b6423cfb324
SHA12104fda692d0f1ab20bede43c95104571e1bae29
SHA25643e5e594adfb8d0ee945043a96d74c93d7189720ee0aab88d1786258649ed060
SHA5124f821530dd0604397d1c6a9ea23f68d1f3eac66097e981141d6b64c09246f7cea587ef9e13e2b628a13af4c8a3fcf328b9e2f7862a9407d1ae788803347dc699
-
Filesize
5.2MB
MD5d0b119fde6a04ed135b1000cd3123a4a
SHA19f7cf4a12fbc83f996256d7c922ad6e08a8b0896
SHA2567640ac373d2244237f0dce735c38e9cf82a9146c2bbb07eff2bfe760e4699018
SHA5127308a19df6e21c1b80351c96988e2dedf6022c190bdd4848cba691a299ca1fdaa0403c58c040d2b68404d4a620f33cbe17ed46b9b31af3f417bf68441078ea26
-
Filesize
5.2MB
MD58783fdb9ff653296f92846a0f8f9fd82
SHA11255ab95ae1269994a29f1720c27c3c5f909ea07
SHA256812f787e7983c54381999ba64eaf9e1ae8552290971cbe7744be4b97c51ed679
SHA512dae71acc732095f7b52616bda9448ca58dedeaf5ce555267fcfffbf4d6b6ab0b9c36ae0f4c60a4f3ca7e75439aaa582da9d1a11df1f0cf7975e1b46a03098213
-
Filesize
5.2MB
MD5e486a4cbe41998e272bf76299d08f7ba
SHA19b48e8fc7d78d4120aa09c5975bf83ed31ed87ea
SHA2563fdecd64f023288552253cc19833e699dc7c317614a0ce421b83017538896cf6
SHA512f896f75d0304f7c4bb032876b428cc7186355f7be5f62d9abcd876cc8de43259de516c45080fbf0a7efbcdc5099fe97e74fa3dcde05733b63f003c769238f2b0
-
Filesize
5.2MB
MD5950db1590c0991d2f6b67349d4008d37
SHA19aa19b16fef27bdd248c981e28549abd43720a2c
SHA2568fa29885bbb09265f66f43bad17f9131f5051374486227b6652913e9657461b1
SHA512500f94732ea57db264862b0109851714a88a820c67c9313ffb908b25f3426214a078454f458bc0bd960952a46ca4a19287ba64fce6e4b35209dc474626e38357
-
Filesize
5.2MB
MD5d0a0fc0e58894e1cfa076688964b4640
SHA14b4e30e5282bf1fc2230727fab1aa2930f3d6b28
SHA25620cb0382c6cbf8e4f37cab73484908f533c66781f49a78b32628953e1ae25819
SHA512c6a7ba8664508d1f47409c40682269424f06a2b8ea81bcd063b7f7b2f2cfcf82a9e383d49292ebb81051f499a5a20cecf2703735cb5f8c4c45255ca4b379cc4e
-
Filesize
5.2MB
MD51caae15e29f083fc20c99f3c0c1f9c66
SHA18e4ccfae2cf678207827df6ccfe7c6531f613f0c
SHA25691fde4085a1acb3210737e2619a008861f2474891efd8e24dc6b1d39e33dc77e
SHA5125eef4f2060586c94710cbbdd378381ef8b80722911564ca7a0a40d58bebd4ce59108642e4d756351849ead8d6e3f20d3f8707b5722f6c967449cde9065af695c
-
Filesize
5.2MB
MD59a193092961bd325c4f05c9a95e9761b
SHA1cf1627918b74be9e7281b0c4124f8a63f065e354
SHA256481f51ccb68b19a9c15c50dab6fb521a849a2c34e592fbd7e228f5737891d5e4
SHA512e1bace959c29f2252a39a1878b4cef338dff6f109b16c179ea8ac2a27ca3adad6903a41632ceb310de1bb6a8b092430811e411d709caef0bff1ac75e5f55b493
-
Filesize
5.2MB
MD5d178066dd4ef013ea7f54e388af49c92
SHA1bcca374cc681b5f3196843bace5ced2b2c8b1aeb
SHA2566a6e84c96758744d04ea39bf89fb1d680eb0505c9e378264e8ec24bdbb8c5eee
SHA512be408bb08370a3ac0f718e475baba10057841f9950b2e51c8c39a709f8af87da90d942cac361b28d6b8a31468413ca54e3cec8a7f2dc9a228f488cf7bd0ee62a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB