Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20-09-2024 21:59
General
-
Target
2024-09-20_a7628b0f3ebd0a8f8658d0645cd5b77f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a7628b0f3ebd0a8f8658d0645cd5b77f
-
SHA1
800397ca0f329277bcb529c00f25697798585ac1
-
SHA256
bf200d7974914ce2bf92f5cb0de600bd79b697512cb0d4bdc5b3dfa78bb6dad3
-
SHA512
cd5d5f424684f8476250525ee2b112220f60cade73ed269a2a58ed78aea9f6dc8b1bc1a82664b5c842bc3032604f2890be2e43a2b446833e2be3889d826a1c64
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_a7628b0f3ebd0a8f8658d0645cd5b77f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_a7628b0f3ebd0a8f8658d0645cd5b77f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jCyDuAM.exeC:\Windows\System\jCyDuAM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GIWqwCr.exeC:\Windows\System\GIWqwCr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYeaEzh.exeC:\Windows\System\xYeaEzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWzLKwp.exeC:\Windows\System\rWzLKwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\flFcOVy.exeC:\Windows\System\flFcOVy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMvYZWq.exeC:\Windows\System\XMvYZWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvatvul.exeC:\Windows\System\pvatvul.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpqoWSd.exeC:\Windows\System\tpqoWSd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMkNdON.exeC:\Windows\System\iMkNdON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YSbkRjH.exeC:\Windows\System\YSbkRjH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GUYdJps.exeC:\Windows\System\GUYdJps.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCIfTNk.exeC:\Windows\System\rCIfTNk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bSCsBAn.exeC:\Windows\System\bSCsBAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKIfvYZ.exeC:\Windows\System\pKIfvYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPwSfzt.exeC:\Windows\System\IPwSfzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tAHmABz.exeC:\Windows\System\tAHmABz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXqxRRY.exeC:\Windows\System\zXqxRRY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dnElBDL.exeC:\Windows\System\dnElBDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaGZOpO.exeC:\Windows\System\iaGZOpO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOblOkL.exeC:\Windows\System\pOblOkL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YoPCQom.exeC:\Windows\System\YoPCQom.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5adc3451222dfafa46ee8186467a6791e
SHA1b21e44397f4319c6ecb576aa3c960993dddbd7f1
SHA256991dc4a30e1ee198e0957a7f907919c5bff5da9d85cd733f41fe02c12781a01b
SHA5123d68bf4aa1feac9ceb7d19de520d56c6e6bc3a8a3e31ea0b10e85328de90e53d82bc123f8dacb9444cc03d65b725e7b7ed503217af1bdbeaf51af40b75f8fba5
-
Filesize
5.2MB
MD5f893dbfcaad5bf6c716c00be19073a41
SHA13e03f06f4cc0c4769dcad666d04e46bf38e611e9
SHA256f2497d2cbcedaf9160b912e9d007d05bd0373ce873e17009e4fd3c09ecb05516
SHA512227136421131642e15e176394a825a6cae7aa26720a956af9910230b987746a488a08ab2c83818f9b8a3ab39aaea6b9a10b7b9bb1f89a0e8453c98057922e529
-
Filesize
5.2MB
MD5b52ae0f75aee2d6e27e3ea0e4ceb198c
SHA1bb28f3890c0ed42dfe9d50401076bf0ee09af90a
SHA2563c27193ac879279142e8ab3c9866c683ea537f650a6e1ee767be807a7f037c57
SHA51280acc0ffe06273339467cde7ffab218b3a7888d18244ffedd2871d5e8701825c2a7fb39fc6f8d28a36b88d46d9809645b68cbb647a68df9c81691bcb1610da6d
-
Filesize
5.2MB
MD572e5d553a7ce87cb51e5cd297e6bc211
SHA108ecc08092832b21902f80ce68a195c2cf949556
SHA2561b7ee29f3b34c457b4fd65754073fc973464b6db4338dcaa0919f62d1832d50d
SHA51244fdeb878015b51e85cc137c7797eb05f56c471548070f0627e264be8d2c26d65c69950dc51287e61286e733b705011536e8967405826dc9707a0b70765b9688
-
Filesize
5.2MB
MD56824f44cd8afa9442ba457383979191a
SHA167e01ae629f4865faa9327d6cddf15480eeba042
SHA256a4f05db8676e79b8d4ee850c97993443df72b8a79b40701e8c3d9f1d09c4173e
SHA51297693d5339bc079298b727dbab55ce80e5a65ac68408de3f6e43c4bffc31680fc0cc5f69c30d78a11f913ddb1dc261a3875f0eee7df9da9dfd10799b2c3e729e
-
Filesize
5.2MB
MD55ec1ac96b52192012d92298ebfb67022
SHA1edf74669f4eb2399d1da27f74777721adc74c86c
SHA25659191e948d32627489a3b64ae7e87e7a2fc11abef6bc2627bc80e37a1ec15791
SHA5121b1a968bdbd76ab8fdb2cfeb530e5d6d4ff713c194dfd677d3f8c3cfd8865080f42230b137ce5c873debb5d16403d87411af9d6d2d7a0733491e8a6fa2037599
-
Filesize
5.2MB
MD536b10509a3621bf97b1af7468850a558
SHA1c8da50aaa9a8e66e9974ccf30cbf6e404b34675f
SHA2561b4ef5562ee62f3d78e986b726a7493c16b46e4e475da568d0c446e971814bb0
SHA512f8193e75c0f3a4e431eef091ca82d7315522e80cdbcaaf8209d05e708aa9a01af3e6656f7928700076830d81119eaaf16b603671447f19bfa80d7e0ecf4f4666
-
Filesize
5.2MB
MD527620300a92f06d0f345a8b4852ead68
SHA1bd94e4063da78557bd9d4ccb295f2939b966eb3f
SHA2565b9e0de2b68dd7332f4501f81a5d8d15d636bdf7ded45ba68d9a1566e1454e78
SHA51202fd81f87f7d675fd475c50b0d18b2581de8fe303e6cb55cf20912cef371533c91bfeb387c7cfa4fc2440d1c53e275a2745538dd335ba4eb2df7e3bff23f4a40
-
Filesize
5.2MB
MD53d69822504a96492a4d0b711a6698c59
SHA184c41a3a444dc581d80c11701ea5c3aad301680d
SHA256c26c4798664cc106b04797e9c93358b93c7d442612316705f842ef611d070828
SHA512a1ceb7f9c3e59a5087dcb6545bbb003c82b349fa2a75cdb95f99937ed53971becda87cc6a9854e8d7aaca4fdfb7e18bd644eb1b321231559474704f6b920ab55
-
Filesize
5.2MB
MD552009e8519b125b99735f3a3d547f886
SHA1b66de93540583daa70cbf82f127acf08be238f61
SHA2565459dc17a23b36f0dbbab1faedbb0c3102513fb3f0b282cd5e378b51c3c6c65d
SHA512131b395b521a9a2a6c946441159103a10cbc1cca35407770f3b0f16e315399fac4566b494ee7b7824dd50fcc1abeb4a749b9f8b2b212fac26fbf35a51cca6eb8
-
Filesize
5.2MB
MD5f7dc740838d5df4d1b9af8c278af8b1e
SHA13de995cd511f64a43254442433927cb9511e6913
SHA2565eb2bc79693cf814f7e799f520954b0411d12a2ee21cac048088a7b21ea75d91
SHA5126668c68676eb924b7836b679d14d284e2d7e66562bd42924b86b3fbd4f403eda2ce316257922e8375c66c18f8080968ca5ef85405db8f881eca58278f3a0ca98
-
Filesize
5.2MB
MD540c8eec684a127ed3f7d2853ec16de05
SHA13838d45368c38d5d9c8925b3688e848cb2a21b02
SHA256fc35631c3b8e7958cd0baea660b23fdf2465f6f8dabb3d772835068adadd7c44
SHA512aab7faaa594549fa0bba3104e7f8471ea6b860fbcb42767cefcb95b8ef1f9072cd16bdd49d55f72e444dd09d89cbdc3deff7aa8adb03eba8b0ca596c45f307ef
-
Filesize
5.2MB
MD541b404de437e500fc76ca0f157630e45
SHA16d43c285a6c96516ed4d21f25df9a029fc912c9d
SHA256a3d42bc04125295b2fe4b0aab2304f42a6f4b4cabe58bc7997231addae315e23
SHA512cb707984716294a4151b0acc96f81e959cd6376d28ec02ecba9b87dde649b77f6ba763272b5a9933c2ebb7c98837ede45d6c476462112b05ad3dd688b9d2ffe9
-
Filesize
5.2MB
MD593754aa4c69bcf396a791d13183f8329
SHA1490f0d84502cc890aad99e8658274b35ad762a7a
SHA25634bf97bd5cded9662e82030c014366757923eea8967ba0478fb41098a9b5776e
SHA51298b490a4d406b0608f94c0bafee32509386de9d622774a62a0055810d45c6d4825b455acda356b946c553f1b27e4253117fd3ef89d0693899339c42efd77681d
-
Filesize
5.2MB
MD5fe7adc9465e9b12e7aaf3697038ed8d9
SHA1d2231cbd434cca7d67b917f4f9861b4532042494
SHA2563398b64140b7dec1d1fc0d90068bcf75dbfe565575b10d0c5245926ad6e0f6fe
SHA512f3c0a3b755f78635909a3aba70509cb9a83f3f26b696f224bfc84f533e0db1d357acc375df8d997848a3b824d1a12f2e573a4622f035b5a464288980d941f5aa
-
Filesize
5.2MB
MD5d56c9e925c2fe2e822e5a5e28fd1afee
SHA16a2999ea43ec20d088941a2626e35c0f64e11386
SHA25650ce0eaad99e5cf0027e779715eecb52de9cd6afb6f0cd8abc427ab84007a587
SHA5120f32483e0c07ac4ba5822ac77e17108412310b3511a3165cb14b97d9126ffb8b343c4462673d6f7e78fc4d81b721d23c4231b39687c3627f9d7673f949c8687d
-
Filesize
5.2MB
MD5e6d23490251be4b533eceb308767fc1e
SHA1bac46ee1cd65fd24bd0f6ad4a113465f8345dbe5
SHA2560ac29104b988083bcbc6bf1d2aeb2d7da12f3dc46999126fc106d23455a34902
SHA512f08addcf745bb797f6597a357e3bb24f265f1c07be1e0895f6ca4544baa902b6c517562eb08c3fdfa16b9029b16d4a7bb5d4d695499d1d81abe67d8048ef5ccb
-
Filesize
5.2MB
MD51a5d3b3c8ff29edc3a3834f8dc04c73d
SHA1bccf3180542edf8531e54ca1cc635b68b54e25c1
SHA256cfb99bd4c040b2594556461bbf53f27db92eb9de66fef50e043e48fdb2f77d78
SHA51209d27a4cd92ff90ce3b74737382c4738fcb98baa08456a2499611a424f4762bd9260b2ddc5941c655d3b069178f8df18caf99c3da727a786029ad42ae235aaed
-
Filesize
5.2MB
MD52332c51524a0957e1913658d0af6abe1
SHA162e1cddbc675fa1f6c0d1557ad54beaa95a67511
SHA256de57b6a11eb21c631aa52de78f5bebc1f63f4c14a6551079b3972b1d1293f65b
SHA5125e241cd63ece33cb29dbcbe458c97a7bdd7dba76f24d2b11e935f4eb33874cd25f8e7c127d6cbac3fd761e55a138f078f95db1dbfc5ff511e8302e2c5e03074d
-
Filesize
5.2MB
MD52431b4d79787fd3e7044dfd38d6f9581
SHA1025f726523ce061a17e8215eb201b253cf8ba3f3
SHA2567263e8e0afa815dfb150d1b2786564f0a8ab0f8c7f053a2aeb37ccd9e988b486
SHA5125ec8de3164d1d0e43ca36e484ad965138c8086d1c34696a6071c5a8073029d2ef9dade37bfcf0b236a497f8d5992707843da602f4f4a20f11ab16f8fcf12ce3b
-
Filesize
5.2MB
MD52840ce2867dceb8824aea6fc5672f00e
SHA1efd547b4ec637acdf04f2b04b9a805617472302f
SHA2567e8b2265c5c10afcb9db2e9ee37d19c1f459929f0462ef6dc2a5f7f1381a98d8
SHA51267101f0cdeb350210b0454a300fd7e73133e0d62fbdca5b6e6457eee457928bab326d9fa2b06e500cbc94f8b7cb67780942ea8f4bfae1f0e2484d59aed226f8f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB