Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20-09-2024 12:04
General
-
Target
2024-09-20_feda05642305d195e9c9c07dba9dceda_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
feda05642305d195e9c9c07dba9dceda
-
SHA1
cf5b29a012d6be158838cb064c3db83ad9ba6c02
-
SHA256
65c54889fc6ea085b54c86631ed7d8e62bb0ccd091ce9e1122c4194e494ef11b
-
SHA512
c180f68608b59449dd93993c9f0acf106cd0cdc8c1998440ccbcf5a50a56204a9618c0898646f699973b88b7e606b3f6b62b193eee5140afaf3530bb8b8dca20
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_feda05642305d195e9c9c07dba9dceda_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_feda05642305d195e9c9c07dba9dceda_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RQyvLxL.exeC:\Windows\System\RQyvLxL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRXdzBq.exeC:\Windows\System\MRXdzBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hBbAAQj.exeC:\Windows\System\hBbAAQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obpTDNl.exeC:\Windows\System\obpTDNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OLKTObQ.exeC:\Windows\System\OLKTObQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CglcTIV.exeC:\Windows\System\CglcTIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GZSsoNM.exeC:\Windows\System\GZSsoNM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGRzKpK.exeC:\Windows\System\ZGRzKpK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsFSnxA.exeC:\Windows\System\ZsFSnxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLCOYMT.exeC:\Windows\System\RLCOYMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWLShYw.exeC:\Windows\System\mWLShYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUNNQAa.exeC:\Windows\System\zUNNQAa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFTQjsx.exeC:\Windows\System\MFTQjsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTIQpmS.exeC:\Windows\System\oTIQpmS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KrKDBqY.exeC:\Windows\System\KrKDBqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IZvFYkZ.exeC:\Windows\System\IZvFYkZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jCpDhwY.exeC:\Windows\System\jCpDhwY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfScPFP.exeC:\Windows\System\sfScPFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fCVBcJP.exeC:\Windows\System\fCVBcJP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LimgWOq.exeC:\Windows\System\LimgWOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygdWMSA.exeC:\Windows\System\ygdWMSA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5725050417811e96b35a812a9d552fd86
SHA1b1b00e214107b573882456c513f22812fd05e5d7
SHA256c47491e389c85f65a0900d53a4459c3e482e8d847da8ab298b6d2611fee33538
SHA512410fb3804bb7954e80a25082f09a66e2c8abbb6337f46978568b60330f08ecbe63c7c270085a6d1e896610d7fcc45dc1b999d103dd0aa61ebc3b2175573fe359
-
Filesize
5.2MB
MD5c1e1d69f2482972e543fc2469296a8bb
SHA1d473920ce2c8748e3fc7465b3f89b0daa336b06f
SHA256e9cc603f876fa75a49e0d94c6c63dd2a0760d0be87bac5e979df0cc889756b19
SHA5121468e469c74b6389c5af5b4218047e5705b5b4bad91d636739f1a9861a6fd7bddc8059875eef6106f732a1ba6ecae358b1b56ff1f98b32d5a58de3d7c01edf4d
-
Filesize
5.2MB
MD5f336a3ce5921ee30c6c496c54a3846d5
SHA1b67d51e704a0894b81ad4a2a8c1f853335d85f75
SHA256ae779563838a906b4441d1d7bfafc4107d623c6559e8b44f35ae31de545ee591
SHA51264f3792732966387167cddb58d7297012b0634e60bc066cdf77d64530c17e21d7e73767c7376d82195466527efd5c7722f0ff79c9b05bec9505cea14dbcd6136
-
Filesize
5.2MB
MD5ca1f0853571a9240e7a66a939bb8163f
SHA11be8618aa2ac7f1244b3fbda0a55b158ffbd7d5a
SHA2565ed4a6dfcc6e6a1859b9fa077202fb55e83af0c44f2a4ab1c462f409c3806390
SHA512cd6c418732fddcc49ef4ec3c15f9c2a93db550b313e6347fdd766f0af57b402f5b34fcfdba169213209817ce93452be1e2334f8653755ebe59ffbd1d9e8ab272
-
Filesize
5.2MB
MD54a872eb712896e4e714b117b855b2717
SHA1f25d0e89b39d694fafa0162ae596d42d3ee27551
SHA256350e8663723e107b84470deb641cb6eeb42aef769ae80eee10f359340e15eb8b
SHA5123c30fc946eeeb210b49ea791e08ce3d37b0dcde91db5ee026a6e73835cde57c3eb98b3b3ce450d7ae55b3ddbc9a898ee5c55e2edfbd7a61e88242eaf0765b62c
-
Filesize
5.2MB
MD5a597072bc72dff99ada41338d9268f49
SHA1f17f6cbe48b4b4b598979146ea0c6d8de4a900c5
SHA2566d1a6c996da86da70e6e5db9ad30fb5ea3353fe36051394c879d0081207ff302
SHA5122e27e6df36d11536ee59219a9001f560e1b5cfc770e6986a669796e355112588c8b9a2f0b69bea685bd675512b3b68578aec5722991f4f38a1e10b49cc4cb626
-
Filesize
5.2MB
MD57f3d2c689902927a9726bdd1b5a02e64
SHA1bb206b3559ec66b9dcb6594943e15cb3aac2a29e
SHA2565b8baec556cd4f609625210de38a22db015ddb0a33b2938150fed1277e281403
SHA5125c08086283cb9de967314394f3007e2b1cdd0f6e4324b2539758f247b1db5652505d3edecb2eb267a26024829e627277dd15f3046d18f5073d5fa0a505df1816
-
Filesize
5.2MB
MD59df246007bc0e5c90889cf95e3aef05d
SHA1179cb6c919f538d03727dbdd47fdb4743a042f1c
SHA2565cd2d7272065907bd5e8bcf827c141943b159c93637c86b39aa1e943f00da0f3
SHA5124c4cc756c02f14f11de75c9f312b707597ab25851cd6ebe73359c4b59881a5fa14efd752a8ac1608f17e00a916a48a3c787fac121bf012373c126de119d090d4
-
Filesize
5.2MB
MD586ab3156bd580967d90fd1af9de7a242
SHA1198f0b97670e95f16a4a97f5c0b6b8ac37215efd
SHA25662aa314354072e3b567261214b8ee666a47a53962743c5a70ec9cb7d6d8b8336
SHA512bf4b9ae3ede56e75a72006a72c3021967ef1dc93a082519c40432730dfeeae7672e4d99f86edd28f85af99ffbf372d4afc0acc06632437aefb0760376f8707da
-
Filesize
5.2MB
MD58e85266c4c242634c0645304ac84b7ff
SHA1a92e81b78ce4255236733ebabad5effcec59ad48
SHA256c8b9366cce0cbec1fbc563d23ebf45d3d3f3cdbab40adc170bb561b169836ba5
SHA512a1a0a95d08afa148f35b7c548d295c911615e0a739168b0cdad12f753e9444cb7738b03af8128ca83d89cb607ac7a3275d7bedded2fa058bba738dc7158e00c0
-
Filesize
5.2MB
MD54ca00f9ef66f4cfd24dab3439ab4f533
SHA1acecf055d4ecbcfb5366df17681436fce6a53813
SHA25626664c7759509f3da950d42477239ee94ae1fd512cee7654f81600addcb7952b
SHA512adc558df20c6159b4998b000996143328feaa52eaf5e9ed3398deb3083885906b91de2a4d7cb7257115fda7eca868f2a9e58733fb73eab99d5e885216dccafbf
-
Filesize
5.2MB
MD51294a25c4996998894822c3d6519d1d8
SHA122c6484a908177d04c1054af7e9da32eed69ce32
SHA256299d2ae8497e0074cc4cd0bb0cefadf715976776fde76eb2d1f9ea844400f486
SHA512989318d3a11c5bdab08cafedf0597cd8e4d024330fa48963261335294edd612fc69f9d075d0f5c73787f0f142765ec416b444af19ec3960d8daca77ca2d6eb97
-
Filesize
5.2MB
MD509623243822778950b39ee06dda6c2cd
SHA1f0a6cfdec48035485b1412acf272639566561dd7
SHA256470c5371833170f195e4c03f6b5e4dd2c17c13cde14a2c027c30ea7ee7d1e34f
SHA51217c9acff26de3c01cd7908d082502007f28c4ab9a9a640e3ffd0b2dd002908945b403a524d5b35da5570d2d783542fac5f3185dd099f2b0ca5b18e1a6bc84acb
-
Filesize
5.2MB
MD521be4b1a3a0c145e75a9870289bec610
SHA17f9e6abfd3994ff42c76cee4b9597c02a6d8d278
SHA25662f0fbc4b40a0cff62d65216c3c83e4a3ef5598af40142177cc49e6159f6a280
SHA512d038933662f6ae34015ee493a1eac5164b9389b9572c69481e7b8ed54b408b0d9ae6673a7969f6d1c997944d141b4f6044dda9b1ad311a0b33645da92b83356f
-
Filesize
5.2MB
MD5f30b27dcc311b2ae9b8401cb875ace44
SHA178f359aad66d260df8f66188eeead428429e2323
SHA2567aff30c7ddcdf594af6e6448db6dc94a2f912a5edef02b9e5ae7ad90e51143ab
SHA5123d3b9ee902a313c5c58d1d0a751ac38ee62a790a58d6099cae15e73e072713084c429ae98e1a88708dc682f15c9973b8c8059a43fe9c3e03923d35e0c51d04ba
-
Filesize
5.2MB
MD5742a39a346790928b904c7e2815f0c62
SHA1029fc9bcfa569c200e56dca23d6c3f14fb528ed5
SHA256db455bd2d2922fa6e87b91e4afb5265f12b702e2e7df5e48b0cbe5ce0de07512
SHA512d8d762c139b40c53c675b020fe5fedc1b1d5aa9fa67200a8466db44838e77d2fa5bd374650201d92e20b61482796444f47743efbc54a2d8b64273da06ebb1f12
-
Filesize
5.2MB
MD589d62081004cfa69dd4f7a2492590f8c
SHA1462a32f7d11f1e02e8085cc93763d7f05ebf8894
SHA256ad210b68db5877c45457bd27e0a34f9e38acc5af430452956644250c7531f7f6
SHA5123fb7f45886a5996678bd0dc87cafdeeb4449dae345ca86eec13bb1b0df912bcf8c93fe8e4ed5b39a9da758b1c2e0eaf4b585b37abb8e72d150f8cc3afd5971ff
-
Filesize
5.2MB
MD5dde98f8bcc9d3b0fa97eafe62e8866d2
SHA109f6f31c16a4ae8197cf4048d943194b2d7e90b8
SHA256a798974ba30db80abc302f8b3fdf0e51c4462202ca8ebd4ce1fd8f0b9ac1c92d
SHA512692949097a662f80842f6c99802882c59bb29428579bd1598d9cc007eb1d7799a38e8db0f0986b97858e86f7601d2e4d38880e247f2baf1bce48015b80bfb5c1
-
Filesize
5.2MB
MD5a2b099bce4aa39744bc0912d72a7ebb5
SHA1311bcf94866fc882b640fb21a7f85b4e0f8f9e01
SHA256f3f4ee50088ec4a392cd8358dde0c05d5bfd4dcb4f9adc5b6983963a94f003b2
SHA5125622a11fac080dae7e51079b14229d65a0267c513fe3eca2330d93ce0e8eba1807c0409b077f6cdee5c8e00271d790baa629d46d13d51a94c6bdd1ed03ce4b89
-
Filesize
5.2MB
MD54e51c833da96e88e646b987a3cf3ea48
SHA154263032113d703a38c9bd4fc33f2a25f96cbf6b
SHA2567db966db1f6f7fdff62b5ce7e4bbfc3d10187cb4baaf5597bc27f71d61a80c26
SHA512a58aa3c05a0f54b14e707510abf7cccda38fa5c729ca4feaca7324eeff94425b4992b1077bfd5983b399e241a0d8772b8dd30c69f0f89b3777c43a60c0669d66
-
Filesize
5.2MB
MD552e73717e4c395c4ff9647198895d1ec
SHA15b06ce73c5016b228fa75436d131525e736e7c26
SHA256935fe6a3572e76ec62fe2f344e1ec724d9772dfe0e86e16a58513f871f6e0c44
SHA512aa267a0adf82e6b67db62d2b04fa4c73e900993e0ee94d0b64d7a12a0e9131659ed512c4b9d3bd32ed5332ac2e97eef149e01b05759f217a825dafe8ae87c39d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB