Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:55
General
-
Target
2024-09-20_7fa01ccdb1faa6a151b778d507a1f2f7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7fa01ccdb1faa6a151b778d507a1f2f7
-
SHA1
329a4e2e56a10238c60ed8d2c66721d3d827c1f1
-
SHA256
3dd62c39b333413330fc89b6a2037768627a9aa1f091980d9f0e1c5d53779e8e
-
SHA512
9fbbadfdbb7e220297ea8645c1a7e591e2b1d1943cb2484937b9dd261eab30c63b356225b32edc0e191fab8d41ca9c124ced83ddb150ad3ecc29c738d7143649
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 47 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_7fa01ccdb1faa6a151b778d507a1f2f7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_7fa01ccdb1faa6a151b778d507a1f2f7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FPVVApJ.exeC:\Windows\System\FPVVApJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WlifAIT.exeC:\Windows\System\WlifAIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjXqFDt.exeC:\Windows\System\YjXqFDt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KDnPmJE.exeC:\Windows\System\KDnPmJE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DeBmHYA.exeC:\Windows\System\DeBmHYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USWUlQe.exeC:\Windows\System\USWUlQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLdgyuN.exeC:\Windows\System\bLdgyuN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\saXnpME.exeC:\Windows\System\saXnpME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SlkIbkN.exeC:\Windows\System\SlkIbkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWVBESw.exeC:\Windows\System\RWVBESw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPOUwEl.exeC:\Windows\System\kPOUwEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtHpRFd.exeC:\Windows\System\NtHpRFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olvhRyQ.exeC:\Windows\System\olvhRyQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tuvUGQM.exeC:\Windows\System\tuvUGQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdBaOJz.exeC:\Windows\System\qdBaOJz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNniTtB.exeC:\Windows\System\bNniTtB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbxEoIP.exeC:\Windows\System\BbxEoIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WShXRQW.exeC:\Windows\System\WShXRQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxqgLxs.exeC:\Windows\System\mxqgLxs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVAkrVk.exeC:\Windows\System\UVAkrVk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poNWfUi.exeC:\Windows\System\poNWfUi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5aa5907989f9edb0948ab88b16d302d8e
SHA18e5f971bacfa2680380c8c4fe68b239aa4e61147
SHA2568ccb72cd8991baed3840a835e357ffba007199f8841535f6389de2662b89cd9f
SHA51233756f8b63d04c43bd930967e28ae96f28ee51cf8d831db6eca95f321fb9862340c220e813518ea9c2ecd9eabb9f014230515efb844dbf7bcd241ee6f41837e2
-
Filesize
5.2MB
MD5608640abbdfc00f45e44dbd3e9a368df
SHA11c88648a28df0692a4a2e8ba5fd96735ecc2a6e2
SHA25699c99e1342b51469f4cf8a406c98019700f7497f383f00d88c8afdba381effb0
SHA512c139862d4957c6919beddd340969f38aef1447e3161877322ab38d5c4353594f0a0d6dda71b3bf227ab6ca8a19f70635770e20525b5b7ed4acde72b6edda60c4
-
Filesize
5.2MB
MD567ffae168f28dde95471519e5a0aa366
SHA16974c248fa42debf30698462f8ea0cc00f593b3f
SHA256f7d4262587c9717eaffd7002fb5d0a911911343ae2636241cae3894a8b8bbc7e
SHA512b356db32e817319f8d9953b1d05e56863cb63cc9b2cbb26a7c40d783cc4399a4d9ca38db17019d18ccf432428eb3b5e4338e27522e4be6467b116f733236e41d
-
Filesize
5.2MB
MD5aeeaf367321403c4dba046207b89185a
SHA113c560240ce6e8f7a4db35f80ed6d85418cf230c
SHA256e1fcbffb7f9e3be627b271498cb9896f2b368314c01e74f3af09d08a3b013b39
SHA512ebc4ff547c4b218928772a589e87e096988e96f0c60ce0e729ae993a6a0ce182a26450eeafb374bffa28f2c7d8912aae8de59316eb706e271a8de0e16b8f5cac
-
Filesize
5.2MB
MD5a2b1f993ba708e67768e93e29b399f78
SHA1305cfa0e6a12ec3c8c9241e06d9d941d1dbf94f7
SHA2569a4313b0c35632da088661ea3a1e3ac03b712182282fc7fec9424c95cc2ba178
SHA51268a32366440d9aca4b0bde5cc01044909656f6f82ca08d12ebec5148ee155e1d70dbc5671aaf64addcf7df47c7e7f811ea1eaf37d1194b1b7255cd8f2f7b590b
-
Filesize
5.2MB
MD5e531cdb12c31c47388bad3e4ad13c67e
SHA16f4c61cfd4c43924184699f334326a86c65f02a7
SHA256614a584705c8ad2f81b23dfd997ee52acc939c68f5af73ba6742622bcfbb3a91
SHA512f55782508bb0f8259ab05dc45391e5b7f322a42153bc55a5a8810b0913b0d5c11735a7d36443e59afd6b128d19f786747262f9a105517acf3d9f329af93185db
-
Filesize
5.2MB
MD509dc10172cd6f7df309513cd8b95854b
SHA129e1789f93e59dc53697235fa3b48c0cb8723e23
SHA256b94068c922cf3d03163f2436abd11c019306b3d38b8f5f14dfbd84629e3c5e4a
SHA512f7c53aa21d8c85454084151aa2612c96de7a348742f7da3483665e48951e43680284241f3fa79e9c305dee23859c60f41f14a8177fb005250652f0ed2d9959a1
-
Filesize
5.2MB
MD512b62e16c7a3e84e248b22e6fe02b8e5
SHA13d0ee29339a6ed0923e7b2a1e3cd95013cb5d8f1
SHA2569f07ddafc019cebf90ebd31dc4b28872dedd5ab2e7341e807609d2930f561496
SHA51291576c852832b9fff04c6d956a1fdaed0d22175d78d47a0a45a65907f6d2e483aed10af82e51faed08b33ea42d3813b06ff65e4984df1fcb68edae41de6d0e64
-
Filesize
5.2MB
MD55e9f0443765add5e8e63e4033f91c314
SHA13d5cbaecb30e7a3255ba0dd063c50f2ad5e45677
SHA256bb56ea70729a3fac7d65dfd63a6529d58f07ccb20d2152c1e38acf7fc4e191a5
SHA5121b69b03c587190f3662771073f90a92ff5d17cff0a5e5710da5bf734c9966c5c5dbfd5c8be701ed7f19fe887aa28b462250b1b55ac680087ceb29b272cb8044a
-
Filesize
5.2MB
MD5823e2c1b87bdf5df65dfc561f7278684
SHA1bef47d661b90925f3f44911d5df27ea90aec2cd5
SHA256330552b0ff1157a623592ab31ccc711815b9433e6e3be7aebdded1d2f89563db
SHA512a8d18979ecb79d7b93ff8335388d5f4b42c29c7573c45239c6dd6b33ba76b94ff2004a99834c9c376a81a16a8cfbb4e48f8fc93c64b16f00529f9795a94d0e11
-
Filesize
5.2MB
MD535ca38b0ba311d2971a98ccc29a0a78b
SHA114a897c6f2cf26e9548cc2a5689789759bb9de12
SHA25694f69aca1991971f84effa019374524e5f80856c095912e7c87ff8e6c2aa0718
SHA512fc3e7c833679d9f35c89e81ff641446d3101c0a6087b5f86a1e3064202c3e7a14e7750eda3c69e1b1ba4c8210425ee4ce9f1f51842b64182fa31b700a3a6bfcc
-
Filesize
5.2MB
MD5b54e0ca672d69e32e547a5fe2ced0324
SHA194ea344227e74e50d9d52106e4ce7a96f04ae1d5
SHA2564b63daeb3a13b9fd80529610117ac1618312959c16ecfed513df0b2bb32becb3
SHA51292774bd2c98e9ce7d89ffeb75fd0c59ef4c57eb47e89e1310602786af5868d6557fc6324a22c287feebd405af9fed8adf8ecc29a53fe203fd774a69c0c5f2ff4
-
Filesize
5.2MB
MD58ccb2502b178d71eefb0089b4ae8ba4d
SHA19675159d5aaa220442af972d78a814c3f3377830
SHA256750e917b3a8e4ce804bd6ae8a140c26d72449dfda97a85986c654dc784cab900
SHA512deef1fca6e889157be98b8b5439efcd7b9376dde86c23963f203df91d3f84b3a71b7301fcabf7861054930d121365edd7fe8b2a3fd4e092095f025f4bd229e84
-
Filesize
5.2MB
MD50eb539703ab78d042f80fa0b04044eea
SHA1638d37e5716e44e3d13c3923282dd6c4336c2fad
SHA2565ac11ffad1f7ab6cdf5109d080700271b9a78a1f381000047fc816e0d01945dd
SHA5121a14271727a66935b01860028c152198e0631046222aa8d66270b8d369dcece4d66cb53ef907365a231cd3a37ca034f4852efc3bc8ec8c12c99af2bbca1aa497
-
Filesize
5.2MB
MD54d87ac55a89f3b4bfed821ed46dbf4fb
SHA11e42bec08c290383b8da1d08463c205743207a13
SHA25699f1b56b3f43ff5924c86c362ab85de884e51ee16ce78b6d07e59e897b12bc5b
SHA512822e3d17edd3325a7213f81431a283bce103558abfe0a492d8837e08c279c74bbb01d6f8dd7bf434ce1eec827e985a9cc364245524f43a82673d33368a289280
-
Filesize
5.2MB
MD53d2b0ff55cf73679dacbab6318e63a29
SHA170e30363545e1d8cef739454962d30960b46fe7b
SHA25626e20d56883c8856cc3095a23e4babffca30e60cb8f32a8fa90b26d2f78e5298
SHA5125fac92900ded367ffce9634dd153a68bf3a15cc5b462c25310e4d2f5337f6675f5a48174c2dbb5c21e47b0504f28656a67f5d813b9cc321567dfd5af0ecee6a2
-
Filesize
5.2MB
MD543bb46bcbf7461b95ebb10c08d1b1dec
SHA1e13d5f3d0bcf852daeae2d3f814ac1a320cca6d1
SHA2568c01159db66ff4cf6435ff55e666e1459ee98a3aa034003c99b983ff01d75578
SHA512ac58c320dc742abfe54e17d63e3a1202f875229b6d03580b552c1aa49ce603a266e60e44a8f41461be050a74ac871bc025d0672fbc902962423f191d30add58b
-
Filesize
5.2MB
MD5d9dd99f20fb53fbf4576977f7a7c7eb1
SHA1f3054f3b00d896f865be23d2ba90ed9e837fd273
SHA25624a4348d7cf2aa1c31a321563ef1b392f7bb202fedd045f4e6f6b03198ffe00a
SHA512a3e713d8c7eadf06d318b0fb7870daac35514c458a4ba4a78d3cc2a59097525be4decd42699311bd77dec5b12800c3b67eeb7896ed03dbdb96cd20cb84c8b970
-
Filesize
5.2MB
MD56ed7f2fb2f230dff23806fd430aa7110
SHA13c82a50f876e7fac18ca2597ad725bde17693c4d
SHA25618fcfd986fab30950eb583e6d0305d10f682e43b8668b3dd20a0a28772acc879
SHA512c12116ed62cbcab0d2c250d981201029053a1cf6360dc663fdd57e117b34970856371c64ddc4c4d7571f68375c1c487bdc61e93121b86428b61e32a6db65ccbc
-
Filesize
5.2MB
MD58a46add90bb2632f0c7263c9bd3cf416
SHA190df2b2ffe956c2554b284a5283a8ae1e1fdf448
SHA2561ea2cb82b1d08befdb59cd7d29e83ca69d59f378368af22def250fd505f7bc55
SHA512e52f4e8e0ffd68253303af154d5c84a85563b5b4fa7417a19a3af61ec51fe315282172da529597e021e1108135fef6d869b069603be574b11b06694438894ace
-
Filesize
5.2MB
MD58304eddb8196b1fe5eab90c7353c5a78
SHA19264f0e7ec46b3123f15d79178ec0edfdae8bef4
SHA256e5a9186c162b191f34aefba33e21d301d1310fa6df24b36d3624934f2987e034
SHA5127e01eded20d71c5d51d8e54c54aea5458af6e482b7e23e6dfb7a750c9bbd18d6f111be59b56dfa2cb8472deae997c42e32609fce7439c8b40f7efe59a06f96d5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB