Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 22:02
General
-
Target
2024-09-20_ea4b36575c07cf71fa2bde1697216b6e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ea4b36575c07cf71fa2bde1697216b6e
-
SHA1
b1c6770dceea0412bcdddc8818880e844bc7b424
-
SHA256
dfa07a1e00b1cbf620cf5f14de35639f1c301050bd70762a1e08254d2e89aa50
-
SHA512
ea9bcfc80232947a1651e416fb8aea0f68d4c2ad600b94369d429d19ab068a411596404c9c9c251aa14a510edb8a63d78a2648d6611d38bd50fd1d0f964b5419
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUs
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_ea4b36575c07cf71fa2bde1697216b6e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_ea4b36575c07cf71fa2bde1697216b6e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PgwVzZH.exeC:\Windows\System\PgwVzZH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iUbUGsK.exeC:\Windows\System\iUbUGsK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hZgFKUt.exeC:\Windows\System\hZgFKUt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vJeYWAL.exeC:\Windows\System\vJeYWAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohHFRJj.exeC:\Windows\System\ohHFRJj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WtfHgEI.exeC:\Windows\System\WtfHgEI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WtEbQUX.exeC:\Windows\System\WtEbQUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znpZsns.exeC:\Windows\System\znpZsns.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MTfPWLY.exeC:\Windows\System\MTfPWLY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zyLrUhf.exeC:\Windows\System\zyLrUhf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOssVpl.exeC:\Windows\System\zOssVpl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxrfCig.exeC:\Windows\System\LxrfCig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRDxQcW.exeC:\Windows\System\iRDxQcW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqBziof.exeC:\Windows\System\eqBziof.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cyPawsT.exeC:\Windows\System\cyPawsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bGvwtTs.exeC:\Windows\System\bGvwtTs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtQtBBl.exeC:\Windows\System\FtQtBBl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKuXNMf.exeC:\Windows\System\MKuXNMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPlHVJo.exeC:\Windows\System\nPlHVJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YdDyhsc.exeC:\Windows\System\YdDyhsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sezJEuT.exeC:\Windows\System\sezJEuT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD570cf13bb73f8e94b3ac85ac9a9ee3af6
SHA15791fdf0878df89b3819989802e82bba16fdea7b
SHA25639e3a6eff3fc1ad4db35d489982ec4e2088a74087f11aa60c89390aa930cb968
SHA512321b97449d0a04442c187f89c71d23e07c541aaebbbe83f9caeb7195ac641c0bf827432102776a48be46b2d1b626970d71a53c23725bcd8123418fb6050ed0ae
-
Filesize
5.2MB
MD5511b998c4f1b917914894253af16013b
SHA1e75cd1685f5c5f643d1bcf0703c07581509917d8
SHA25613146c3c07827bb07bc1733404f92b7397a3a007c2bc256bcf9723fa90cf7d33
SHA5120067967183097bb3f0e738ccf8064813a7b678801d419d122228a7a828dd9ebf16d32f0e098c581b159626dae05eb022c54baef0eaa4672a99f463e65e7245d8
-
Filesize
5.2MB
MD572172b5c9d898d70d06c8cdbad259234
SHA19da55875d77d1ad19fd331453c409777eec79b1a
SHA256e3d1b1b03c184518a4f00538f24f0ba4b677fc96e4b1ae3177d9dd2a2c309354
SHA512e471447a4bb28a31a75fcc7eb33a44a9767e45560f6cb65ef1d05a71b56baae954310334ced3cd2a3812ba49f5f6e0c6c96f4f04c1ecddec819610062de7e80f
-
Filesize
5.2MB
MD5595eea084444e9e6fb92a7abb32700c9
SHA1b487063e6f3b6a12b47aad3282ea95e87a85ab7a
SHA256f94fd362988ecf93b4fe079e82d366f6195a554c43814caca83469b485009126
SHA512dce5810d42c5fb2cbfb46b5d66c79bf2396f1d7867af3e22e5f26821a4e9f3bb503afa1ab3127e32fe2e0abe67ed7380f1864950db1060f5024b58ec55a40670
-
Filesize
5.2MB
MD5ae15b2d4aeaaaeb50471a657492584c0
SHA194e1bfc08e40d4ce34f6e8a458868cf92ce14f02
SHA2566e8f6b60653998e3c25d8e88bb98e4e0bad0c73fe1a067557acd2a635f1a3bc0
SHA512b9b0269d9517020aa0d07115667016f1819c9d1f556f5d240ae0522b4636a84fd48e4125dd885327e606ffe91f3589d21eb9a57f40e8b48e8f64520190bc7b7d
-
Filesize
5.2MB
MD5b9fb8ad1dbd51ce9bf2ec96d497f749c
SHA124e5ec668555118407e736ecec2f48f01feb944b
SHA256a9335904a36c5af58b3c6f7ed2f78be9c8a1cc2648847cef416398f80c647482
SHA512746fcf66cd3f812def886564bab39c352fe4ec0fd78ad3b8a8b67514a241bd9d87f95a617b8899c1401e65e01a17c22adcfb37a2b294ccb59dadfad3cb72db14
-
Filesize
5.2MB
MD512a8a06e97b98bbfbf496e9caf1fef57
SHA12cfba29a79c08497f33c2d8271ff3c64676bdd54
SHA256f63b14a0b84e9b31d3010e0aba15aeb0ecc3df1181146b51acb29a9b0abee1d3
SHA5128ad38dc04a5603ab660d92444da62d03aa11e1d0a6456677f52e3c8081ff0ce56dd2b91927554eda3e023832308db0a9b6680bae9e82a5ced47f86b4913403eb
-
Filesize
5.2MB
MD56a570c698ad78a7fa551125cbc44da00
SHA16c7b407634fb25342ea60ccec0980fe5e1b8cda4
SHA256d59e5d620993aae5a82dbe9231f9b3837c4583bafdbed7d51e90e4c003af7908
SHA5121f7fb8f691b0c7e6414daf82d90c4232c42a9181e22c7c1de765bb14f489ebb835a307846a8923b6f78012ed10bc9fda9197897893d45743ac9b200bfb2050ee
-
Filesize
5.2MB
MD589c37e8076371657778ab86948f0b307
SHA135d5afe9248e71d648ffb8a4f17f4d3756b893c8
SHA25625c9709c21fad2b1499b7d7a852175c72bc0d7ef94b7e7897077ea7681195cfc
SHA51213b6fb096aa69a2cb80deec6b478049f1c4651ab870549061df07642c560f6368f1552e5c414ee9ce86f334851ec0c74b8e2a5980e7d3ad487140f8df8b5140a
-
Filesize
5.2MB
MD5585c3db4fabc60817ff876ae1d41a79b
SHA1e2dd2b8d1b412655db0be5493ae51855f3b62ff6
SHA2569da9a149287ab03d4c89909756e1d9cb2e8473ff8c890ba1cfc6c7254f760118
SHA51240c62d1a233ef20ed6cca01841f8f3a75b6f69dc3e803917b85d1fefec6aa20a8d5780459cf049283cec96d0478c2cb48a3d9acb520dbd10e0ec7772c7b52be6
-
Filesize
5.2MB
MD5df39ae2a7e4efc20f1a04eae85bf0bd2
SHA1b8867c1931feaeebbf648f107a97ed88100c31b0
SHA256af403f1b1070cf7374750cbfece195f6789b405e3e8dd58ef38eef03d270f8db
SHA51263941b79fe861ba012174ed16b3236ce3280be4c7487d8b20f2fb362343295ea3907bf83a9fd57ee77f96785dd994239e8fa1e05e44e2bd738f341b8da71a33a
-
Filesize
5.2MB
MD56b0a7ca2688b56a624fa274811375cd9
SHA10c2a67e089210f8711997f64c1af553416a6ef5c
SHA2561ff04765f499ef010076ea541aebdedcead86833e7c0a00dd7cbaefde7dadfbd
SHA512d396021fcb2348540db260402ed2ab5e436cb3b0f1af8c865cfc0604c2f9286eff47688dd61ca513dac478ff95cf3f8cf9df6803e01e5334737ad0e8dfd44361
-
Filesize
5.2MB
MD5d2845a3d0de3aa9c35fbf43d53214bd4
SHA1da68e417a4108179e39b532f4a4b3ab468a8a031
SHA2566ff359a57a2d1c1c86b27c8c752865f96cc41a16c0697eb0837c1e54c1c0b95e
SHA512b2b93adea8fb6207690ec27203a33ae57f8ab21ee6617a3e94e993e4d405d99c2e9b97de12275e9abe148c4256378a1a1322dc8c4b05d0ba8e3b506c7022e459
-
Filesize
5.2MB
MD5ac6033a59ffb5ccfad96343aa11e584e
SHA1a20d69576590e13ccbfa2394490a1763aa640658
SHA2562cdd9ac66ee372de14985d567fdb448271b2972455cf1759e72b06ced64e2d16
SHA512b2dc0355ca534a664655dadc76ad91a65fa0aef6d80ea42a4e27bfa2f2bd9169d115e5fab158240f6aa88fa891705aaa77991afdcab230608c58d09739697b73
-
Filesize
5.2MB
MD519e91518e8c6aa26ad24ffc9ab143e74
SHA12d9c6f4bb5eff0ba66846541ea6c70a35b5db8bf
SHA256feaa037779903306f66b67343f21f70b346737fe55a36d1dba9914eb327a4b74
SHA51290812f6d80a57f9de75c7cd0b83e9a1be125596edb282fb5e53fe88dcb741d8b043331d3875ea8a7bde59aee3d5fcfc16372e5ac3f50497641ca6ed32e89a09b
-
Filesize
5.2MB
MD522920f63dc7954d9e4d3a8240ed2c05b
SHA1a4cd5de779d3f4946e05d791608540af054d3fc7
SHA256392c8c11c1e28f5df72e47c99419c6f967e203686b51fa5644ec359e9bfefd23
SHA5125ff925e82aa3154fb2266314cc902c6bf77548e895b4d88a9ed41e67ebf33bdf9976d56c2ff9ee4b1b8ecada84b5475cbb99dd89e16c538c5a3213e15e83cc18
-
Filesize
5.2MB
MD5b6d4199f9db3ac5f149b556ba46b2326
SHA1a263e8ea65fa0455f45e5385de56a1e297aa9869
SHA256f39f7eaabfcdfd0698860e64eb8873731a15e54b6dc162aa9de704389b630962
SHA51233c66410e91899481da7790a7fa7e750fba9a3ab3474d1afced577448e94b2cd9d5c3d03359a144c6119939c76c2e62ed60e1315b9532202318dbf160fbad12f
-
Filesize
5.2MB
MD534a400cba74e49f3742793eaa0625bb5
SHA1f60319aaa077d377fdf62f9f73cff56737bc1064
SHA2565935af4c8d091b6e29bfc9c95301375f231cbecbb0dca299368423c843536e26
SHA512bcf0091725be60a63ee351d47cdf3b496d36977e6d973d4e3b8f93849613b7f0426f9aeebc0a49e1e353090147eaf424b1dd026e03a1334d7be5fec7b29425dd
-
Filesize
5.2MB
MD50094038a011e555425c875efdb14f4bb
SHA108ec8202c239a6b57e5ba137583ce963afe539dd
SHA256e1c397d10c8e1a5b7a2bd8e7c36ef33eb6abf555929913b6772217419e377fab
SHA5129d971d56bb23674b509726783bafb278ed328bce62a48923f754ff3bae668bcd8c053aeb7acabe16b822eb4ad79ad667c0e9b16ddac0d5cb85012de99cfce682
-
Filesize
5.2MB
MD57581c6522dd2690523d796597ceac2fb
SHA17a80fef43f53486af7fa4c4d97d5c806bb185ad4
SHA256af5b6631ab33037133644a05b4bf19de8a8ce46a17106bf4deb8b42717432c06
SHA512df92966e122eed996a33d6212ef4a25134bec00d713b1922f28689f6d2c04765bb87299591961687795fd6acffa65c2874b9e59a47a8bf0ec87306162ef6cf8b
-
Filesize
5.2MB
MD5d29026dfc83309297f491bf8fb92d3fc
SHA1a531413372bacabb71d45b24764ef3912b00f863
SHA2568f333eb6baf7ed6784b5caff2cc7bf3ad2dbc8d4ceb5e6fc16f52a6db4468472
SHA512422ac68074564840b7e392d15e8f49a2c56e9c0801999264c7d596fc6e7beeea411a1c423a0159089361db815014fa9f096f3716705c0f1b59395cf03f075f67
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB