Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 21:56
General
-
Target
2024-09-20_70e83a3c25aef9bf2daa6c76152c4b6d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
70e83a3c25aef9bf2daa6c76152c4b6d
-
SHA1
8ffe056daf426a9153f074067a6958331649ce7b
-
SHA256
3afd814a252b8666a87c7f0fba8e9d7dbec5d171c2402964c89cb067d18d2380
-
SHA512
e8ba6a4202a60814b352748af444c7a958450caf35300e4a8d6293442bb893fdd2de6f57fdf8092d08ff3d3060a3928937ddd4bb0243952448b3e0a0b0cc9c3f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_70e83a3c25aef9bf2daa6c76152c4b6d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_70e83a3c25aef9bf2daa6c76152c4b6d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nAIKKhy.exeC:\Windows\System\nAIKKhy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\scrYBIL.exeC:\Windows\System\scrYBIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AkTBfii.exeC:\Windows\System\AkTBfii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AAYqatM.exeC:\Windows\System\AAYqatM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjlKzDl.exeC:\Windows\System\UjlKzDl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fYxgcgF.exeC:\Windows\System\fYxgcgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzAnwaU.exeC:\Windows\System\AzAnwaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uGoIVcN.exeC:\Windows\System\uGoIVcN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LWkBDSz.exeC:\Windows\System\LWkBDSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GitMTDc.exeC:\Windows\System\GitMTDc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fLtWObT.exeC:\Windows\System\fLtWObT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iqGUrOp.exeC:\Windows\System\iqGUrOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVgJLyI.exeC:\Windows\System\FVgJLyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MvnIhlt.exeC:\Windows\System\MvnIhlt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ORfuwgA.exeC:\Windows\System\ORfuwgA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\btGPXwI.exeC:\Windows\System\btGPXwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPrwVRM.exeC:\Windows\System\EPrwVRM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LuByouK.exeC:\Windows\System\LuByouK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wPkGCeD.exeC:\Windows\System\wPkGCeD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUkitzp.exeC:\Windows\System\LUkitzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwJPIeE.exeC:\Windows\System\lwJPIeE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55ff32e345166a58fe45c50d4c82e7ef6
SHA14a102702fab784c4ac496a3b9828a3d4381bb956
SHA25660c15c5f5ee7959fe508d6d0365af6635d339d417003388ee7f3a50c68f4315c
SHA512acde624860f441f72a0fccb5956413f04a4e8acd4b8dbaaad202ac4ed453a47136a14ceabdb338934d729119b1a81e82705bcafb42b7615eab2757dee3068e03
-
Filesize
5.2MB
MD5aef7bbc15c921d81a9c7c14f5ed2be38
SHA1cd8e3032e1ea08e7edaae303b10abe69e19bc726
SHA2563c274c032ddbb21f62371aaecbba0cac059b10243778920984afcdc2f52d4644
SHA512ee9f89fda0d66b646ff3f85af68a71aa7d10d72aaf89b67dc2c2791a2bbcc8cce14d2786fd7ab4a6552a9e3bf3184bb8a795fc94b51e49ead20ed29e0e851af8
-
Filesize
5.2MB
MD5cd42f6c9913631cb5e1484500acc8de2
SHA160e1f7d01f2ef77721b2c2e1be273dd839daed34
SHA25658c5da7124522f8c0678709dbffdb00cf541e750a19ed0f0b78fe716802dcea8
SHA5122803df0fec4862afdcede54cad54c77b45892b42e68dbaff28dd0fb20b35d39ba17e3e15a70e4b29ac92d654fe3e2e401a801dd4246397e1c42ad72da464404f
-
Filesize
5.2MB
MD508e328458a0d2ba31e0b73638f1892c2
SHA1cbd3658894302ecf64a43ad4aca2791afd4f89d5
SHA256f1d95ac8b29faee4d5e2bb4ee72bc1d84243af0f9b477f520509468a56192259
SHA512de8c79080071e17bcfad76211ca6e657d390d19acf3c5be91ee618fdb62cb1603f7734bfa0be0ad84284e24cd006c4f4897888fd1c19b63c8421f82225290cc3
-
Filesize
5.2MB
MD5043ff1e9527414c231385cdcecc95f74
SHA192e38377ead3ed8d656402e5c06ee490bb2493ce
SHA256058b731e27b12c97a703e6412499fd9228840d9b36f0f6dae9c97c8e52c12964
SHA5129bc4e5b2f31294c541faa3b2167dc253eecf7c34997a51a4069125febfcf129ca78017ee765779a5782664fe0df3d5d880a6190f500aab635933b749cc4a2acf
-
Filesize
5.2MB
MD52a006b58ecd5ec14e49c5863fc9f3f11
SHA14ab56333cd42386c2ffc39b3467fcd40927e103e
SHA256f0ef219daa8d55358accff81d31308aaadc27c3ac847bcfee952208d60abf70b
SHA5129834c9eaf9993a954255bf57b0d8cd9a8299fd62a4e11bbeff67bca438cae8b20286626765f0d9d96ee831ba1ed653f004b67028d6f85f85a97decef0458ba9e
-
Filesize
5.2MB
MD5bca938fbc655f028cb5985767571f1c6
SHA1014bbbbfef8d1fdff5bae1802b1113109210cf76
SHA256fc119bdf5383147879209d8848d976a2e08837c5fa59be849e9ab9ad5b5d16c1
SHA512b2f46f5751efe75136e9792bbba4d0735539c7dbbd2a7668c6997dac8f27f898e673cb71bbd2f3280db16c1fedb4a485a25f516e919672af89e2cd3a69e9e6fa
-
Filesize
5.2MB
MD5a71bc59fc4c0a0913035dd2d7d9d1c87
SHA19a129defd6d5a0f2ab921d880380811db58ff55d
SHA2562b4cb2f182c097b6d9fdd30cfa2aa6b95666a26e6851ff8099069cdc16dc3850
SHA51256f0d2e427496219ea44bc66021e1169d533d95296326bb1a3258d0f18c594334dbd54d88c71d614bcaf51b8f5e36a8bc6e2a0494c37c534471d2631c79c1ee9
-
Filesize
5.2MB
MD576d5c77ee3324c739bac3e606448e744
SHA18f5e663531a09b17d18349f4906325f2f25b7127
SHA256fdbc746e87ac08ab1cde3af33464176fb9072897c3350e7560d8408d8ef9ff8c
SHA512ea0a1f1629ed28de5c18eba9480be7e05c2f82d34f9d89735aea4448003ef68346a939fb8a26f423e60f5ce63be1d675792945f0c6ff75bb6581bd00c74918a9
-
Filesize
5.2MB
MD53869e8a6f9e72aab3fe761241b6cd0eb
SHA1d379ec83e249a0c60e261d3c13ccd578a8b5f44a
SHA2568e7b32b61cb055274982e813a86f223a60e981310c6b0547255cd63e76b3db9d
SHA5121e897e3e93b5c79665cb58a3456a8fec38171ef0dd45c7782a32c9acfa2995b4c44fdbe4b308d78b55863d5ba1c5eecebef761cb89b0e93566ed5b3cfd8bafae
-
Filesize
5.2MB
MD5e06c06888621a2f2b859e0cf94e7c854
SHA13da543d2a492a50aac7b1b1ce67a441d788b53ef
SHA256af0c942cf45607c76573a0714aa572ae8d88d6e84ae5a24199c6806ac40f7d4e
SHA512ace208bee2fd6cea16e018906e53d7781f68a3aaffa4390606ad323274a7e70df57037c5fb6288edb075c9eea30cafa72faf603e66f0645af43c2c384c0ab560
-
Filesize
5.2MB
MD5610726cd08f739d2319e7fb07b4d4561
SHA1623d3565ed829ea9b3b4cde9bb339147a182400f
SHA256fd8e18efe38f348272e487164e115b45a42252854e8cafcd3920913642d7bd18
SHA512dd3aa741fc0f28812db2832fbca2ef14dc68cf5020463ecfc9e7b1d77179d11476cf0365368cec591d56b2688cdfcd9f79177bde5df60d6672a1713d68f73227
-
Filesize
5.2MB
MD5ea7c4de5825e8d512f8e804a56970f61
SHA1c05f1f224601c9a2455d2e09497a307493155c2d
SHA256b2d9558fd1f759ed665ba32e759d013b8f199ebe19bd94bf0775faa74c262bf1
SHA512216acef0a0ac6240219903fa597dfc12418c69b04ce7fb86d5283241834739c33453c9c293872eedb4d5e4224d4d8e5efddd36d86f346c68faefa67be33d41c5
-
Filesize
5.2MB
MD582665623fb7426b31e78fd24be5c4b90
SHA13e3ebea830b15df775de4547db7c3c20110db9b0
SHA256faddf05ff9a0b658454282a583389f7859153a6deeb35d870caced23dcd663e7
SHA51216d8ff86fdb75b61cdec408621c02cdb0cd30d592c61ed5788bb0c6bc2639d7808a1136906d350012b4b298fd6603b732ca72e83ecb43eb17cb8050eef50720d
-
Filesize
5.2MB
MD50a9f4abc48479caa0e0bb7822530fcef
SHA1f9025ae79eb4785142bebdcda89fe278d050ecb0
SHA256122cd4cee85ba26d1112a78810fee108f5bac2e5bfa0177f8c07878d9eb77c56
SHA51253391db565a786c402e83550579bacfbe0b0e390fe3e83e6e364b4a96b24580f744bb3649c0ae6e12b3fb750ce56c6f32a22cf241faab8c72e1689987d332334
-
Filesize
5.2MB
MD595c85b4cd484c8bffcadf2f3ddd10f1b
SHA11806f5a5babf69f1aa7a4790a0bb4470e75e9e7c
SHA256d1797063d114b6fdbba476a94a7262427bc7ef07fe3149d646f667b78dc52210
SHA5124ae9128601997cece9f01f2ec1f8830adfd326bc28dece9f88d0f989e0cf1d9aecaa9b84a40181cf65f073618f0f3d3a0f4a03e6055d5d620f62d17ea65e8445
-
Filesize
5.2MB
MD53195884194af8d6a4bc684a0f755918a
SHA1bcf28c4ca21cb4fb24dedf9fcd3cd832f2755402
SHA256f3c46386a71fc3279203228e5bbc8437fee8c189e4c98693005f9ed63382db85
SHA51221e4477c5384303038feceb02446784739d87a64e8715afdf1a952f546c1e81000548f8b54481b99a40cdac370b17fbade77abb81e73c131a426003855a90055
-
Filesize
5.2MB
MD50b773d2cfa1cf4d67540f3f6606bd10f
SHA1c23d3f793758aaf6c4db59a227633d8f6962cba0
SHA2560e3fe0f439442d4cf04eac36ae73e15c0227ebeeba38e25782391b2f1204c585
SHA5127b528eb8ff556d4b7bfbc759a6f87d31f3b76dfe69f0c087d9e26d025d6617c49469c8263cc2cc6c4e4359de2b5ff6fea79ac182084ed1111c8b4b70baf714ac
-
Filesize
5.2MB
MD5e955b26f33a4da5a5a0178cad31c3cb3
SHA14e220e33495c0a54e9f9710fd988bc0258506738
SHA2561e6791d8c551d87852cb102aa6896f8f07f4e2e301d4e6c4ec79b5dec6948d4f
SHA512419fe4fb105300e4f3e63540edd1fdc744b813340850756d32017e647f2b3a0a1ac8ab8ba38cd178dae276cd0056ee1b6494b87ca5451ffe8e77347c53707a10
-
Filesize
5.2MB
MD50c1b2c6b6d9b2439749c85b06d205786
SHA1973a3ab5549bb74cfee476025ddd353c267103e7
SHA2561ba360b3164e884ed227052033e44419b2834c6d65b287a720079eb2cbdd3024
SHA51259d81e6b41f649e548c6d944ebcf96a464fb14b0ab42e3d9d4ecfbb67d95849f46c7f0751d4a7fa934f0f83f9ef89713bb1ea16977942f426169e48c5a33dcfd
-
Filesize
5.2MB
MD56a8e273a7f57422841fca4360475041d
SHA1aa9f695b19ffb75f87c7818dae4a48428d1e4595
SHA256e5fdb316619774a230f2dd2ad105402b252f55234cff16c3326422d3af873e20
SHA512b9f2a075d54fa3ed1400a698b1e1f1692796291b4ae3c171a5e1aea1dc007b47d95571f88b88a0dfa679c651b79adb4bae44bb06c71936ec2b025a7d0951bc5e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB