Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 12:00
General
-
Target
2024-09-20_be5f0936a74678535cdaac3cfa63442a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
be5f0936a74678535cdaac3cfa63442a
-
SHA1
8d3eca3512695c3600d257f17331df80c2e8df21
-
SHA256
ad816198b9eba55beaa1eb4cd9cd72e62dbf2ef9b46dfd4a205f172e394003f2
-
SHA512
b78dee0801f1e2fd62debb016216fee3eb068964582791edebc543ec9b6d3d27bfd1f41daa49428620817cb4411e8f9f3ee05c2fdee4115fac7e91f9808e615b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_be5f0936a74678535cdaac3cfa63442a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_be5f0936a74678535cdaac3cfa63442a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ziMEDMn.exeC:\Windows\System\ziMEDMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPYeblD.exeC:\Windows\System\lPYeblD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YrclATL.exeC:\Windows\System\YrclATL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YAZcOBq.exeC:\Windows\System\YAZcOBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mukfwMI.exeC:\Windows\System\mukfwMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LejCBaf.exeC:\Windows\System\LejCBaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VXVaiAP.exeC:\Windows\System\VXVaiAP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TcTONAt.exeC:\Windows\System\TcTONAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OejTAse.exeC:\Windows\System\OejTAse.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzTmIhy.exeC:\Windows\System\WzTmIhy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MqIMQUT.exeC:\Windows\System\MqIMQUT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTTgngL.exeC:\Windows\System\JTTgngL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DIMNKxr.exeC:\Windows\System\DIMNKxr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jgERtUW.exeC:\Windows\System\jgERtUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFaTZPi.exeC:\Windows\System\FFaTZPi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HfaTcml.exeC:\Windows\System\HfaTcml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RrHOibJ.exeC:\Windows\System\RrHOibJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zxMPpIx.exeC:\Windows\System\zxMPpIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGIpONp.exeC:\Windows\System\yGIpONp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FrjgkXc.exeC:\Windows\System\FrjgkXc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXsYXpf.exeC:\Windows\System\rXsYXpf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58072c8869ff3d863d7a87d8d8f64fee0
SHA17f9a752ce1379b25f3df2784c3c268942e53eab7
SHA2561dff2c7bbedb80d0b573d3060f2167a66972a2d102536febebd237fc6196a98d
SHA512d8d095ff100437d2e48410e7f867a525f754883ffaece8d6693e84ab32547295b6378a83bc84d4d286bd452ba3391a7f89c97202aa9d9a9fc1a22622022aadb9
-
Filesize
5.2MB
MD5b7f0d25d6f90407c9756108a8c726564
SHA18d5e6ca469cda1548e91826eb41727b4192bdb4b
SHA256b18a9665e3f3331fd1bf50a401d66dd05b1f10f36c82d7989df24141131d2ad7
SHA5127a247bcf87fc724db37db60f6c2f55ec847f7eda0307be95645c4cf7dbaa06e3602c64d746aded78ff24dfc2ac2d47db0942d0468fe645dc319027d888909216
-
Filesize
5.2MB
MD5c99e3582bdc6e8202618ebf6da587593
SHA1838bbb83e46f8fa9e28936a734ade8fe632a9c15
SHA256c01fd16d5bd65a111cd5476abea26cbe2b6557ffd6ecd65f677e45cca221a0fa
SHA512c72f66de95a3e4fa82b1925f4381396ef3e1fc3804bb626e8b86236e84ed053bfc78b089791a6ffcce78dc2d40e08891f0a3638352e7aeb93ed573f44476d00f
-
Filesize
5.2MB
MD51d384a6d00dd1b6b9374b758798cc64e
SHA1444d1b6d55e6cf46580d23a37d43d5363f0e5b2f
SHA256b79b2a8097f8af855b93aac3349100c58c74063cb7089d622bcee4234f57ae4a
SHA512333f660668f151a279c80c0e70bdb61d26c8ea4524882a90962285f6be70643d170f878ba7056df22748dc502430901d7191f4b916a89bcd9ee999952250ac94
-
Filesize
5.2MB
MD51fc1aea9536736726c03a66f31afbd95
SHA1be0be53fdba3aea0ae77625b7870ee227a70b01f
SHA25689a799423fe2536ca7d6b7dc5db8f6e2be905559b1dc0783b6c91d2f400f0fb6
SHA512aa162183c1d2558a447588f4b61da1c723a3416ff696718209ab58a1e69085f4639a53f7e3e18710d3e1af4087f35f67433526cf430594e1ebab6df04bd0e9ec
-
Filesize
5.2MB
MD5d46dbd5913f692568d890422ef6b5327
SHA1693dd10eea616769ca512aa782f0e9bf359f760a
SHA256614ad4074ea281f3683acb38927c892ec983377eddb4ad0efc888db166f7b4d8
SHA512f71660a4e04e1ab3beb1b1af9fd71db84561b39561a214a97168fba65a175547e193535c25554b8dc524c7e9eb2dcfb990645544704e539b8366c9d9c881221c
-
Filesize
5.2MB
MD5491335d81dc25f98bd80927cd7887310
SHA10aac33f12d7fa4b5618d0f5007db74680a7ce297
SHA25650ca6d3247b768fd091a2487e67d9ec502d88f08c21d73be3d21e3d73137aceb
SHA512643e719def4354db2f969cb6e93479ed8ff5da52d6c2a203087f0a94b7d1fef5d0c6af904ff5536e8172814d239b4012a4ed6c0f77f2491fa5a30f11ed91e212
-
Filesize
5.2MB
MD5a7c62b584e6df814f7f04c7b3411abb5
SHA17891cab71bda3f1dd2e9579176c964a2d69ee94c
SHA256b5df80f8edf8c14016079d2a25e5718b6cc773c8cfbf657f77b4b402e31224e4
SHA512a396dbdecaa28fcdbad9f5a46a044e8e367e8435c0e01af576abf72d55c1d88a81eb9f226011a6c6e35396b086fab9a977819a73797523534224aa1d188b498e
-
Filesize
5.2MB
MD5581995d578569e8b42052b1a2b01fbfa
SHA1e48f473293baa122d50bd1f646b80cde835841e4
SHA256aac69d293abadb80011c52f3bedbdc8e5bea907904cf12beff286df2a84b1491
SHA512cefb8bb1ff7aa11ff1bdcaf1eb2c7c7b8bbab816baa34bab416e4c29248564d1dcab7b73efae9de9f66f517f1959042ec403906dc73edd67cbb90825dd9d2eb6
-
Filesize
5.2MB
MD50825d97b6aec96fa3865811abf0ee3eb
SHA1013d428727e35114a3aa1debb05c40e666201c49
SHA256fc86c35da3c52f0c674da2874c219d5eb705b66edc516e45b0482640ef3b9dab
SHA5126f5fd99f51ee017f6abf53f440309e536cb9cdb3e9b28a2702fbe0925db89b1cdf8f11464dab25840b8766c9fd50ab0665b4e5bc9b90b6b53e7c8e4c287e6bd9
-
Filesize
5.2MB
MD5c9fcb2d71235ce89bcb0e16162bf503b
SHA18e09f01bf171d16886cfb0bfb2039934906d1467
SHA2561d5958e0d241a6e5e52fe7fe7b73ca712775f31b10dcecd736f5a01469d1717d
SHA512a0c7a9dd3fb63d9a7593232088222366c92347a4b1433f4a5e7bcdfc33f4ad89544bc6cf59962db4f11c8d931f73e944627d66c556244e913a2ae02ee24bc6ac
-
Filesize
5.2MB
MD573eff05f94ceae2de977c512f2b39281
SHA194afb3cdd2db2058b4c2f1ed09904b6de4001db3
SHA25612ab96b6d6b3257b95b1e42af24f928906215d005e64dc12521549087f5431e8
SHA51255c5b604729833391ca35a06af63895981e6484e301752e7f4cf7f4f3df4c68a1dbdfdb7f7074a7a61a1581f2920664363348f327a764ed1c8b8f8de2b48f751
-
Filesize
5.2MB
MD53fd1f3e03d44224c0e578f46c7efa426
SHA12dcccda80676a4f3e4cb4b04700512eb84b595a8
SHA256f5a78022c4e177c420b10192a3c5b7f5b64bb4a404cb1f0ecd4a075ac4e8fcd0
SHA5123b1d6633053252c06c5e9b36d46f3ae9ea6d735c66c218f78a45aa4af8426122f76eaa0a86f5ae7590a3f6a3707aecc3a46befc75a611ae575080e35d6d09ed6
-
Filesize
5.2MB
MD58fb442cbcee25155588c0fd87af4dfbe
SHA11777617b5debdd5669e272621144756a3fb5fcef
SHA25629fda1bbaa6498be33a58a28836c489c86b7f34c19fd56226143d244ca8b65ad
SHA512dcfbc3632422656c27ad2f55d187ada8e1a8a6d949728e6ce806122ae254b7052a0ef5c91e86a3f24f87b579014bc1288d86c109ff087eb188674015ad686eb8
-
Filesize
5.2MB
MD54b91b8a8898016051fa75c4ef5106f93
SHA13a1ebade02d7b1184499f821e20a0322d7924b5a
SHA256350af0217cdd9f3841197c65d23ba1a43067da94d8e3b48e4477e9ad543884b2
SHA51279fb76da55e4b05074a8b3f87282ec8937239ac1b874b505872aeb08c08723864115f5abc3816648f265fc384e0f0675c39df7764198a39dfc338379762e0e98
-
Filesize
5.2MB
MD5c1a104dd222db41990ca0f84b232e785
SHA16655fe6f7c7dc74ee3789747018495d8c23cb830
SHA25626e3c4074d35d2e4e76398a0b0efa447005f9b14e294c6949ea1a9c775fa6011
SHA512a03af725fb35666865c44573e39167650f60e58366f33217955f147b864668abf87153c969a68125cbd1142712db69000d540f8e1d203767eb729ef22d6abe3f
-
Filesize
5.2MB
MD52898f20d97679df2f3467ab9f48ed32e
SHA17dc25016c87988bb19fea6421c3ab46d5cdc0d9a
SHA256de285c153086ed205c660a82f7e81640f4c5a9614ffedcdd650eb48cfe23ae89
SHA51231a787130f74c7d3bda6c23cd3fc98743dc45fe1a2b162390d073c653c919628e840e494fa4b27af2b8d2eb815e60841817b6b9f292922f600bd06787362df29
-
Filesize
5.2MB
MD5d0f32f42235d6f86da843ce6cbdc856e
SHA13ebd5ddaf0c351bac5b6cb664f140e5020909de9
SHA256e99abd751f59f091b81eaef85518f9695b3e8697d3b000a3979d5eb0206ebba5
SHA512299929618c46bfb775b918a806a84e228c56cd7790f45815eba56c6e9b32bde3559f07e30f0287cc7cb679c7d323bf3d6f84e6b289353b54983dd3d0c1a42bf0
-
Filesize
5.2MB
MD53edecc5c9c8b59a74bcbec5253fdc33e
SHA16fd3f98678e17a5e10533c241e6b0e13322162c7
SHA256707c668d2cd8774b29435b00d0abd5f2005d670357d40ef9a15eca1775376503
SHA512ba06e2d01a715fc66090c3b824a41a7b04d6f8f2e259e4e83d27ceea0f61c45a3eea26d252586304c60552199053fc717284c931d5dee4d042bd5af189780ca1
-
Filesize
5.2MB
MD5e37de296942681b21fefa42a3212da08
SHA1de3e374d9786a92f1c329fec3b834f54da6db85b
SHA256a7bdf29a22f56d0310b77f82961d79820c5422772fffd9333c12381152a2b4ab
SHA51210898563c527ee498ca1795612bbcab4da293c3685184aae7bc22b1f84c981158dd87e91e0a168e932f6ef0168d3f38e31fa271af7a002ede6c0108498e1ba75
-
Filesize
5.2MB
MD51c62fae48e6586b0e3e0527a02818cfa
SHA1cacb4e49ee0e098ae4ec3f28a3332cbe4e974596
SHA2569216bcce0f57354d945a5e66ad8e4724ac4bdc04828f047580ba98f443571492
SHA51293e06e19e5e07e060e3da03df2328c8dc177f5bcf4a631722a407a973508cc6cc90f09f0ddab1df6cf133236adaaba7812b581e45541fe488d9916ef00a4551b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB