Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:56
General
-
Target
2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
86680d41caab6b4c7ab7f5280fa04cf7
-
SHA1
3a9aea3c7e620166520f4ca52ebebbb9ca8c372f
-
SHA256
85a7268ab71ed72ef7e78700420b4064e53ca5e3de22d42f59c270a5fe0f8bc0
-
SHA512
22b386b5f4a332be7d0cbda3da8505b933cf45eae018afad7cfe44bbc151ed4b4653edab399af09013f942dca8504834d9b85ea1d44efe9313ea17b3772fd168
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DIIyWxF.exeC:\Windows\System\DIIyWxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgshxvb.exeC:\Windows\System\vgshxvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cnubCRx.exeC:\Windows\System\cnubCRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsaHQyp.exeC:\Windows\System\jsaHQyp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FYlyMpp.exeC:\Windows\System\FYlyMpp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkPxIiz.exeC:\Windows\System\KkPxIiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUwBWlC.exeC:\Windows\System\mUwBWlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SmVIjGu.exeC:\Windows\System\SmVIjGu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qaZsORR.exeC:\Windows\System\qaZsORR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZBtleg.exeC:\Windows\System\JZBtleg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VEccplX.exeC:\Windows\System\VEccplX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZcpyYsD.exeC:\Windows\System\ZcpyYsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpEqXup.exeC:\Windows\System\zpEqXup.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lnjfdaP.exeC:\Windows\System\lnjfdaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JYYODDz.exeC:\Windows\System\JYYODDz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNrKrcy.exeC:\Windows\System\cNrKrcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fsYULhs.exeC:\Windows\System\fsYULhs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KCYrmxM.exeC:\Windows\System\KCYrmxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KiHjmyU.exeC:\Windows\System\KiHjmyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsPbHkw.exeC:\Windows\System\RsPbHkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leidskH.exeC:\Windows\System\leidskH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e7f71c3fe0a3a4f5656ea75d01822f42
SHA1d9babd1430d0b3b4f052e7750cea80cd45eaaca4
SHA2565bea58d75e9942f636e83b842c7e7a69220017b89d744e2aba187c6e38c9d63e
SHA512ac5a005b2d4d4a87f100c07a6768f62077868e35496f49c9fb76936d84304f2f56f3c40dfe3bfa3ff71f207ab7724e2a87938daa0f0ed7787960ce1f325600ed
-
Filesize
5.2MB
MD5bed98529512f3406654a58a3a334a63b
SHA1aed960701d3f8b0eed4d2bc229a1fe4f13efb719
SHA2569a9be9b602cfa9766fb66b1d6b4bf156654a6284ec454c8fd8249a24cdef2821
SHA51264af93c49776fc4800c5ba2e9c2ef32cee53dfe4720943d459ffc6138025a65de89c6eecd7471efb4aa08784c7e9c51fcb60c41fe4caccc0eb7a757c2596038b
-
Filesize
5.2MB
MD5eb638fdace932972740d1d18c014d162
SHA1b42bc5031243ee54f10cbe7e9ecf17fb25d4c136
SHA2567daba3beada354640a5c06e64c3bd05a27de19780cb9569917c689346aaa7fcb
SHA512812da061ea41abd6fa0bdd52eb02649785363e292bd5d76e4f749711e0e7d8a3745adff87af61cbf45d1bdbff5e57c66b16f0b5819dc3428c0cb91af75d9a119
-
Filesize
5.2MB
MD5e45e41a3a403f85b58b66059ea9feff4
SHA1c1c1bb431bcb807df98621717d9530634308c99a
SHA256007514f79b93585faa800db292f7f69401e22dc0db57e860c78282dbd3ce6644
SHA512aead9295975a5becb5f0124313a449b180a5777496b3766c6f9e5971d85f87d582b3d25a20e7949fc540e72371946fc510c16c1926fe1d909a4824dcd8e72007
-
Filesize
5.2MB
MD58442226dada85e403a5dd3afe9cdc8e4
SHA15becb98a4f66dff0b167b01e42380419748ec84e
SHA25646bfe1471de18b906ba642ce14c66c0459bca87adf6e2cce90b13837a62764f9
SHA5120d90652c5e0d1a5fd7cc0558fb7800e4e36f474af5978e65c5f8846940925e12d31f9d2f1a6d3d56f6475ea10b763cbdfc80374d23b34149e2486b0f5591b8a1
-
Filesize
5.2MB
MD561d53a636600bec2d04c987379da5240
SHA133e755dd51eaa2357c00408ed2f2232fd0f28382
SHA25637c3e19a140ac5cd136143557e8f27757ed368a2a4a58500760728063fb47377
SHA512d39c4529b8b6cbcb175f1ad81ba59f183668becf59ab3098b8418a6296d56f8368b477494e12a4bbdbe25e5675252eb6f1959790e70f86ea17b15e6fa83f7676
-
Filesize
5.2MB
MD56c67712ecb1321db478266ed70018bc2
SHA11d18389e191b1cc5d2b12d588256345042802af0
SHA2566875002b8bef767a0915417d5c87dae7a6ce543b7290b179cd16abb0640bc0c8
SHA5121b8ce828bc04baf60e1cc8405ddf811d602d434f532b32fb60ff373ce7f335968441b4dde93dd816e39d543a47fda440aef4c09c4d7c55de2c6f7ce6b230e878
-
Filesize
5.2MB
MD5602f1811b1512304eab44b4c4854404d
SHA1558d09f60b268b855650b0d216392b8b9aa4a006
SHA25635a89148283f6eb8bbf7f3a12afd02b9d172c550ff91eb6639a0cc1ce17b337c
SHA5127ffe36175822ecc14cbecab87b4d86aeb6e5843a1b6e05957b49fbadf2eef17b38cc54647fb1b6218d626b1d3886fbb34475007cbeedc944cea68f3166d98da3
-
Filesize
5.2MB
MD5bc3165c01ae8bcc04597ba3d299e70e6
SHA1a05f6e65602655fb38735e764d655e3f22253ed5
SHA2568e1b1f2f7ac3eb73fc36b8f3e767b548f047377adf5d536b1be506a0b1bc6751
SHA5124fef3ee0ba5b7209bd17f4b5f5ea268464026543c7341470009702070a6d276069265ea9bb3bd65dcf626f7cf8ad725f9f3876f414d0ce3d8c89dd38f7d184af
-
Filesize
5.2MB
MD5c1ac1867dca9f22db449c333cc96bba1
SHA1990a22c4ba9e28758df13025e5efe776ce5b5107
SHA25667e56c295bdb9f037dbc5a4f6cbad41c6bf0b10a57afe59046fa1bcdded399f3
SHA51215fcbd1f70be6158ed25e32b174a684d6fed4ac60ae6996ffe6330fb302352db4f7a46391e36d1fd654bb12ecbf91060f5decf5605f471615c223f9aa21902a4
-
Filesize
5.2MB
MD5abacb32aca963d4edc68190ef64150d6
SHA109068f1af97f4aef961bd76f760db85f9b4d95a7
SHA25611795550db94790bbc2c6ca1f6f50d319c905ce1cceaf25291a6f6da593ae1a7
SHA5125c838c83d0e1ac9da3f52ec0b7aca42bab496430a09380fdb4c4a61b23e18d14a44b7cfcb4a7c3eb55cba504664332e799ec2806dd98426ea9badd1a1177a9fb
-
Filesize
5.2MB
MD5c98e656e25da875534cd16ed8c8b3f74
SHA152a4cdb1bb0ea80f3debac33a0f62552ec0bbc49
SHA25607a33e9f73d98399599abf5ecc6f762172b288b6d42d97c547adb995ae8b79ba
SHA51202087df95bdc1253db396019383cf6b9effd014ae0a4c69d3c62d6d9cb47fe233f115b54f7c8ebdf4ad85ef5fae535c8e8c7e849b32a6b05e9be85971b9ddff8
-
Filesize
5.2MB
MD5aa9ec92541e2f112a2ebf997d3e0379d
SHA190d9ab6bea70d059170f93909deff4372c86ae72
SHA2567e901a309c41537a791c03998f2eade5da32a8c0bd2e63e45573bd652e1c7849
SHA51224a4991f624a86a629209cfb80d88442141044b1b50f00253d5861c3bd618d52b4074532a4ccd07418af490e33df814eb780ddf937652103735b63889202b0d2
-
Filesize
5.2MB
MD5ce13f15337bbeafe4ac19f40e08c2c62
SHA1ab2b00be6a484a54d60c8693a9c625d5de390527
SHA256de01b321865c8644026383f3606655b4e6298a6cf320556cf25986bd90e7cd15
SHA51237a18dfa5f178d4c1ff430ef0d747b702e7ea25e5a5803149e91a317a98b2be9e1d8f0ce6e2cfc45b6c609ba8e81b54cd7c475fc260cc7cafe7a6ccf9323c896
-
Filesize
5.2MB
MD5fdfb2c7cc8b524c52fc3bba076704b9a
SHA197a1925a57947f374855e688b403d5348e733d29
SHA25662d772d54edd471e27904d3d97b9e51aaa3a5693adc9e90f8e81a275e328622e
SHA512e7325a045336640a24bb745f1e2601393b3266205235f91402b45c083c528ec89372313be25c78ee679aba0342eb00ff731388ba5357b11179538169f852d40e
-
Filesize
5.2MB
MD55e883936d1e2e0cd915e3e4b858b9547
SHA17ee58f638baac91b408c9c8b071d4822b2442060
SHA2560d2be84683f604192b4a69edbf393b5ed5fff875f0dfdb987ca103b5673a968b
SHA512769b9f512440f5c5b55b9c2e50a122221c6237aec9626cbcb56897185f404d12e1c8f70751a90e5a16691d46bda2d941f9f38de117d80fb996dd1e4f10b54b6b
-
Filesize
5.2MB
MD5860e16a9b303d5207ed37e2a1d969e1d
SHA1c5162e2ffc66e2adcb6cf1db8a687b6219bee060
SHA25683c63c601086c6db0fa6b6678350f82c697e1fe1d0efcd0f574a97026c004631
SHA512d8751b478ac9c81bb211523db00840241d392c4ac474897059b63a2ebb1d23a34b8ccd11fd54c84a31ba27b8b351d88beb6cb33502431b87cdebf425a6bdfb58
-
Filesize
5.2MB
MD5555daf5a88019da846959cf58c6598a2
SHA1da213228abc99e50f9f580aa34c18027c8fddbbd
SHA256339878fa2c8b0f727490b9479c5cb771b6a3f4ac935928f74dd0c8e74165c694
SHA5124b741e79c5ca6b0150f2aadc209631443b1149121e136025e28c7355c24e662c1b7f5f23748bbb6f2e99e8d5c508f6d4f8145d9cdbb3bd90cce4d8d676cb7935
-
Filesize
5.2MB
MD5dc93ee3bd0cf85c7dac2058db78845f9
SHA14fb44bb99918bb80b9359ffa26635948f48f4733
SHA256923bdb4154660f9ce475581a06aed51a2a226b9b7d91fa99ade245701676c61d
SHA512561de9a3926f1273e6e7202ed5364e7ad4a02d7b9564320c287c437609a01a0822778244e1c220df2a4fc1d19b1baf79156f4db8b5fb66cc9c5561768128a3de
-
Filesize
5.2MB
MD51c234d103e0fd9cad45d789dbab17f23
SHA1aab9ad19499ad925a14ad4f9e57f669b8095fe2b
SHA25647ec4bc6034738b51c6fb43963b0fcbb503ce4fdc58bdde8b2d519a0bf6784f9
SHA512f28199c180770a05274463ece1b4b687bfd7ff8cef525d9e3b1fa8989b9799fb34956314f11869f5d97f360fbf990aafa71c0d951a34a64be13e859bc55d5eba
-
Filesize
5.2MB
MD5c5143c45bd0f058689235c9f6e7b120c
SHA16424e730cea78459ea43059efa5dfe14c5fa071b
SHA2567574d26d6d9fd324e104a7e36e4da7c12ed4daa96447d34d4fab0a7ebffceecf
SHA512c77d118d903ea7510b69076051da574f7934128ea6728c064322daaf07e38f43a5e3b04b1873a1471a316a7f20bb1164d60c71e95ea1a968b4493bd95680d905
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB