Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:45
General
-
Target
2024-09-20_113f0afa7543fedaf6d3caded1ec5e25_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
113f0afa7543fedaf6d3caded1ec5e25
-
SHA1
a505509ca766c49e73433f60b5f57460270a0680
-
SHA256
bd958eb8a8b4b1b8ae30c6867ad0aed5968a03f9b2fe87d5a6db805803531e8d
-
SHA512
bc31c9e2b289945adbf4bd495071619445ac5c4c8432ca5640a4a73316d61a62ea4230091a19f85a5f932259ee3235dded684ef7f93993ee5f60d5b073fc58f5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUO
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_113f0afa7543fedaf6d3caded1ec5e25_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_113f0afa7543fedaf6d3caded1ec5e25_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kRQfTVU.exeC:\Windows\System\kRQfTVU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FsVPqgv.exeC:\Windows\System\FsVPqgv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbaKfRZ.exeC:\Windows\System\SbaKfRZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rkLIeGD.exeC:\Windows\System\rkLIeGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTjWmcM.exeC:\Windows\System\oTjWmcM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\paeGdMn.exeC:\Windows\System\paeGdMn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzeNfJl.exeC:\Windows\System\lzeNfJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbyXkoT.exeC:\Windows\System\WbyXkoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\inQLqQj.exeC:\Windows\System\inQLqQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTHqyfg.exeC:\Windows\System\bTHqyfg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjSsbFb.exeC:\Windows\System\FjSsbFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PiCVEpr.exeC:\Windows\System\PiCVEpr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgFeUKj.exeC:\Windows\System\JgFeUKj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IfGCQWF.exeC:\Windows\System\IfGCQWF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SrYvrHk.exeC:\Windows\System\SrYvrHk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyQtZgW.exeC:\Windows\System\ZyQtZgW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXgIqPo.exeC:\Windows\System\BXgIqPo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khtaCSo.exeC:\Windows\System\khtaCSo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvIAIcV.exeC:\Windows\System\HvIAIcV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVMZhcN.exeC:\Windows\System\LVMZhcN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dAxEGJe.exeC:\Windows\System\dAxEGJe.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57df58993e3491d06c42e886d9961f0fe
SHA167d3e6a62240ed21af8dd1d0de9b2b87d4fbe49f
SHA25615347330c865b5c56f6e3664a88810fe1e3bcabc165c97063636311b62373edc
SHA512248a6bed6f600a00368ade55eec06c8895ccb0ce9017fc26bbfd7a4e34a53c8cfaf8f7b1c229e7058b6d8c5c0b00094a3c207b2948100c66f4e7ae711ec4de90
-
Filesize
5.2MB
MD5f21f57ca8b76191dd7b8721c8ae244e3
SHA16d282b141d3de092c495ed4f2eeb0fb699b83d52
SHA256c02f772e9ed652dd4740a73d97872c3877d8e1d90751b45d5975ba2517ce65c5
SHA51279812b1599a52cd20d755ca9c762c6f8172964c1baf6b7684fd639d820178c64dcd4c1dd265809c638daa67e3a3a0d36a3afb63b9f9c9792c2e6a48a3baedcaf
-
Filesize
5.2MB
MD598be1d8f363aa901ca555e54cb22c434
SHA1f62052b908fd9edb181f6b88b308e54191c73435
SHA256984d76782803d1548b5a34068a56ff971872baa064e6b3b3693ef959cf7a1d50
SHA512849fa4a450020f05d3d9c788446703b74f24f133aa657b3a243939b547bdd6d500796fafa2a2a98fc0fc5d2f16dd570582d5b66f098a2f59ddc5e599f3b074a2
-
Filesize
5.2MB
MD5608a7890e2051a85a5e16a61bba28d43
SHA13578e8a05907fc0bc433fb28a355768b5e892bab
SHA256f6a5161c1f5bbc84a859496e15afdba15ad54e86c47cd35f71f6e5cd44f53f1a
SHA512135c99055d4384dea26de497e57ba91514852fb60f0c1ba276bde71485cd34344d05210a683cbd3da011eca7a765cfb742940fa561a184e44ca4abdf7a406ef0
-
Filesize
5.2MB
MD5a97c5722dcb538d66255ec532fb3d099
SHA16f32fa72adbc39f8c62546d82d7b7ac7cb07dbd0
SHA256c9becd86f1e1bea7d41cc44df4d26628020b21955679bd6e2ee241d9e3902ae8
SHA51224248bf59b987c80fd386361d3709b02a3fc943f483710df7a7c441a6c9668475ba39ddda90c3e475ed152eb4df8f376da251d64e6b0074d58999dc32aa8e3d9
-
Filesize
5.2MB
MD5974c61acdc983102b816a28bb87e91c3
SHA1765dd94407e80bd04caddd3b146a4a0ed2ce6315
SHA256312f6908405a818d241c0f491d648119b816b4aa15d2a86765a564f9726d4a05
SHA51234f2596b28c47e25e98351da6f639b158cf2b61add19f8888fd24f7fc9b5fb6451b068dc20b5e3cbb36646a5c1bc600e643cfe6ef55efb38e21c65420178d1c1
-
Filesize
5.2MB
MD55293c2cc412f23ddda1a8e8826bfa966
SHA19a07cd3c60e5e769293642d3c0a9961226bb5909
SHA256ac1a15b3a6db633f322d267166c50de28674c7992025ab21ed459817556e2ebf
SHA5127a241d9eb3e440cff70337c5aacebecfdd53a2a52a1ed8d5b732a8e5caf12c7c681fbbd40f419f5465d355598c42e37a391634ea49e11779c145e5dac8d28e8a
-
Filesize
5.2MB
MD5f214b50be5f4afde719da87542fb5206
SHA1cf382ddb9b6819c230746621b3319e4c6bbf663b
SHA256db77a7b58ac0405101e35686b562760640e0826aa2a59a44ad9744322c83f99f
SHA51280bbe04cdf6df4bb7e8155062e6bcd032310f3d9a9df6d5b7ef00b0a38142889831bcfee30804b97ae89c8588342b8a8e889f98dd875ddb4b1c73a3050ee5070
-
Filesize
5.2MB
MD5663f17ef71315a4e8d6ec5783def4d2b
SHA1c18bd380f569ad49c78be2606d87f503d97a0545
SHA256f115fd0408fddde6b213235afa1981442c267150958b6a94d274bc214ba84120
SHA512fb7d7b01ba94950b10c32f2340ed902a9bcdf5f46112d140a21a874b9baeb4ba0f2988ef1b10107a8432a217b34d64c106898764ec25ab948aec3f1b1dc30a1a
-
Filesize
5.2MB
MD5adc4f389fb419fe104f51a9123664d32
SHA19e89841be2ed8030935fb2b939ca4f3db1c13d3e
SHA2560abcf9f7407f049600811868ff16eff74c8a81253de83ffa820d0cb661ba115d
SHA5120e343f10b0739c299d5f3678aed22eedeed8c455843748cf76e39d518d21a06f8694deac4eac6742e1871a5efa7791794814c28344350ae908be459ac286c0e3
-
Filesize
5.2MB
MD5664374b6d6d0135761925ff4c9336db4
SHA16b4ddc4dff084e52b5599673ff3e4084b372185f
SHA2567da1e0deaba600e0b7ac9184324a993d2bf203844e56428aa5d15374f8df78c4
SHA5124003bb897d8073bb6d6091baeaa921d587440b95b395f1c8e961cae0991b7b7401f6c3f9f6eacac97dbd3b164accc853151549ca674eac423f69f2bbec7def73
-
Filesize
5.2MB
MD538dd4b2f88bb5907c6606248e27ec631
SHA18df4450f66348036b63c7fe1618f9f0a5c25c2a6
SHA256ecfdd81a7b2c536f60cb5eb407deed340e88da24bdff9996e5db3c008770d446
SHA512a81e80f75a111cd85b6ce0af9121f1ddde24aa23b279371c21d08e81ed62433d160f8b0a3151bfb9fc224aadaa99e03cb379f88453b7fd4aec2027b2f2d15ba1
-
Filesize
5.2MB
MD5af303f4f02760d8f58b9b095f14cbf32
SHA1e4ec36c055c9c94df01a2f06527ce5a13865e25e
SHA256526047aacaa8fb6dbb1bf6a93bebff03217fe2ef632d3554f1af53b34e10fced
SHA5129ff6c50336b0d812754a6f805a4334f23267ec7377008a4d320d13fc10327765091fc15fad0528879f904dbacf1991e459df72a18b8fabc23778cf608deb1a18
-
Filesize
5.2MB
MD5bfd984e380903262d3739fd0908c16e0
SHA17c93829ebf9fbea7f41a3e8d2f8f5792d186827e
SHA2560585e5059198497d27a5bd92e18ae6fca65b7f734a1faa089fa170c702749e2e
SHA5127675ae952c1481b6e82b4c7985eee2d5212fa6745b9209f4e89b73c5fd8cb9031e43801d7f33995d0ccc13c1c9b58db76ab1e5c1df4bc6c861d25a03db9bb771
-
Filesize
5.2MB
MD5b1f0fd03bb8d1d3a2fd89c6086c7b250
SHA1fe1207a07430611121af244ea0503e9cf7499ff4
SHA25623bcc761279e184d8e7e30392ff09e94d67a1c70a5deb07160ef1e86f2a996b7
SHA512293fe2b9cfa818b056d96cb3d7765edf757230d88053032a7dbaaa0036d0a7e428bb0d74c03e5a7b950643234963242282902b91b886a1dddfc96a42e113a29d
-
Filesize
5.2MB
MD5fc46dd82d62f8b977a3a46a29d940130
SHA110453c2536d58ec7a1d1084afc3fba17d5695eb1
SHA2569dbc55746fcbfc2327f50206d0777e57f67bd3e24f969462cf7ec9a371855d29
SHA51252fa266b976ca91c0f36e90992b359ddf87555f99dd64d4d26238bd8bdb921c4da155bc7d15928616d19ceffd98019babb809ef3bfca061131a15a3d4ddc6b6d
-
Filesize
5.2MB
MD5f940bd0910004406c534966e1d96a7d4
SHA1df292e6f964184bddef3ee8b4a864f72778a0f5d
SHA25617ab878d7b9853132f90ba60da38a479b563699a8e058d0cc7053c923f8b19fa
SHA5120213115488dbb010af006904c18039334f8c09e54f1d5db5c33b83d65e9f15b14b00938885d888eed2ef9a3858f2c55e81e7aa25600692d912f41107492af6c9
-
Filesize
5.2MB
MD594f883d895a1a363666379574c9215ed
SHA126d1456b3049adcbb19acfc9141e5d0a192fae39
SHA25606573ae4422064823e2521f3d4a06797aa996b898909db260c13c725485cb149
SHA512a17ae5c03f56db2c60bd50fec2307596125205321b5bbbb96c8f1fe4192d149227bacfff317bddec7ac50e5341c6d8dab2d82fbe2c05cf844566edbb17b51c39
-
Filesize
5.2MB
MD5a50684360ec764dd815df47490e8ceef
SHA1eb49d9a2ba0114c643b9aedf3566d65c0f8f4dcf
SHA2569b3266ad37d20bed99dae4c62dacd247cd4caebf0735be9a8130cadc4b514abb
SHA512f9c1422ce24ef3814251c5e994fcdb233260658a218527b7c2d370f83428ddfc267992e45dd766138c9b736a273123f457b04ff66c5cdd6d163200db8ba4705c
-
Filesize
5.2MB
MD5b13ea8c063bd8ab0700120aec58cf87f
SHA13d80def4747a41937c5fa7834da6a9adf3beb39b
SHA256b78a83c5648af9ee5cacf62c7f6c308d8bee169569b4b1df9fddb650e8c5276a
SHA512e1b04e8b5a2e9fe5879c3b731f7417cb5ddf160161995eb82bedbc6b0ef271cd4846579006198d742a049a611dc2b13a875f5c9e8a767d21e0c73faa5fefc1fd
-
Filesize
5.2MB
MD53073a176ced045056ffe0668b321bff9
SHA1d3df2a5cc9b5f2b69ae95fd44b23656d057121af
SHA25623d7ec73209a66c1c6e1cb284e1d16e064f33c55d422ddac1e453a34f9740f14
SHA512211d44187d757bdf238bfdf60cd33fd6844c5fdc3c94844c726832f76f6e25353e3bab722d78fdbe8967f29682c10046b537d8599f757c59d06888e4d18376d3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB