Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20/09/2024, 15:35
General
-
Target
2024-09-20_72114d82a4adc27f95f59fb1bea22c95_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
72114d82a4adc27f95f59fb1bea22c95
-
SHA1
447095e5ab980dd689d87c93c847b21354f1f738
-
SHA256
34501ff7a5bff0dae96761cc03cc7931710759b9adec08898a8b3a28ca0727fb
-
SHA512
605236e3af21ac6fb984a2b488350fff1837f01a871edff7d8a5cd24c109cabc244f116eca355cc656863e7e2b7f1c60749726c30708061f0fb746ef90375716
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_72114d82a4adc27f95f59fb1bea22c95_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_72114d82a4adc27f95f59fb1bea22c95_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IyyzzqB.exeC:\Windows\System\IyyzzqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bkhjqNg.exeC:\Windows\System\bkhjqNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iRVSHBT.exeC:\Windows\System\iRVSHBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRmOPDQ.exeC:\Windows\System\sRmOPDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dqQqNrU.exeC:\Windows\System\dqQqNrU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcHFMVn.exeC:\Windows\System\UcHFMVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ChlBOOE.exeC:\Windows\System\ChlBOOE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qKGFaSd.exeC:\Windows\System\qKGFaSd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHxDXSa.exeC:\Windows\System\AHxDXSa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxAEdIQ.exeC:\Windows\System\cxAEdIQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eXsWlKl.exeC:\Windows\System\eXsWlKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDkEbNZ.exeC:\Windows\System\NDkEbNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJSepaC.exeC:\Windows\System\NJSepaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\skvkCxI.exeC:\Windows\System\skvkCxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JeTXEOW.exeC:\Windows\System\JeTXEOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTOcDrk.exeC:\Windows\System\aTOcDrk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cNIMspU.exeC:\Windows\System\cNIMspU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXyBqao.exeC:\Windows\System\aXyBqao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UatoNyj.exeC:\Windows\System\UatoNyj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XPhwMRI.exeC:\Windows\System\XPhwMRI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QyNcbsU.exeC:\Windows\System\QyNcbsU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d349050ff71c863c1285523dc8b5496e
SHA1a7f8f392591387ffb0a635856952dd9fc860ca2c
SHA256d77dfabeaf3438c8d24bb40c94925627894ba284cba2d6d01c21010b4f8c0bf1
SHA512cba0c0906122873b2d652fc65ce1049421a030b1a4efa7a2fa7d29280bba3240fd1e3b1f27667d54689eded3ea5c16951142dd93fd230e7087c546a700f93729
-
Filesize
5.2MB
MD5642b101394e3ccc73dabccb4662782a3
SHA1cd8047a528ff39c54602967c716fb32c98b08370
SHA2567699e34e130770130457b8539f95128642301e441e5193c778c56c19acada37c
SHA51208d21a9f62464c0388fd1fa83f894a7ab43a7524074ad228b5fef1a4d42f41e52d4907996c75841651000578c56f3421a720c0b957f6068f152a67334ac2ad7a
-
Filesize
5.2MB
MD5d76ee4951647e9f60b8ade4d3b7dadc5
SHA106941320796a79aa1e9f04f2c7957585cd055eef
SHA256400d31e1794e334212134035bcaafca749a682cb632fc47a6e2a659de195a2e3
SHA5127b8e7ed92554aad0bd00cda2cc6c65d89261a4ea41b163b6411c95b71700f4fa0b29b1ab35e61ca524d3470594c3f899374cc939c39fdf177230ff88ea5142bc
-
Filesize
5.2MB
MD53881caf3af1db2ac5156c6237587fe98
SHA13f24a86711a0ec5c53d7b3cd805cdae31c2a8e18
SHA256d0dc2849e141a7e15b95e00ceb3977e2c787b317e4fc697728d2909579d9025f
SHA51248ba5db9af5b6a723f322b6cd474d579ba9e570097ee1f137ea1b0150c9d4e2f8c9d15ae79969a4b88953e8aee07347e8bda8d711ace3271e5abc82d4322ec09
-
Filesize
5.2MB
MD54c78361c2cbb51169f2b42ff498c6e55
SHA1320aabd8e0fa2c8aae026b705da38cbdcb85608a
SHA256915f8825969dabf1384d7831f9d8c35c63e864ea8a73471a1cb67412b4439872
SHA512032211926a5c7969efeaea24f53fe70ee9fde6a1b5ba8ffc44f5842c27a4df9a59eb91e2fca19e4910865664f4e410c579dc8cba66b80387ccc5d8ffe2f025fe
-
Filesize
5.2MB
MD5839f056862bec632d1139d5f1f646034
SHA1ec57df735571db39d87b843054211080e85cd8c5
SHA256f02af735d2da4b5eac9c75ae53d34543474a568d4ab37aa6200c735cef07373e
SHA5122f1d7295b0cc3a3e9a78511623edc8fb5dfb99c05214f66ed87c17fd843bfbe16ba0f06d2fd61dc100a36ad540348d7c2aac36a1485633464d694887ed8c82ce
-
Filesize
5.2MB
MD597e339f08a6855e8f8c5990ba9aa746b
SHA12c1e01c6b0000420cc893bc8e0a0c04ab62eb635
SHA25619f3a87179192dcd3d99ab276a1e943053a3c4366a5b9c684f3599f8097ed6a3
SHA512c9c7b544d4246d83507f4a26169e2324c6a395ac3926240fd44584e16dee9ba2e99a71e2607908cb14b04fab8668e664e92a336116639e601d233beb40666fb9
-
Filesize
5.2MB
MD514393ddb4dcca2770c9a6db18487ae90
SHA1c80b58267314a4f186ad2b72030a70aa43a05961
SHA2565610c5e12f8a490e1086cdf67da9afc420da09faa4f9ef535481e5a7761b77c2
SHA5123ec7116ccfe719032546d0ff03f450fbfb654d21144624f6ddde4805b00bd40239beaceab2b0c1bd8019181a1e7fca8bd919eb90f96cdc63305a405c9ac5e8fb
-
Filesize
5.2MB
MD51679060d4fba0982594f3deee5390575
SHA18d5b4adae026f469e67fbaa61015e111319cbc8f
SHA2565cd10489bc949f23684700cd821416facd284eb3e82a5bc48afe653d6f5ab34b
SHA512fd410a433d34ff239dd1454c9a3bd899bd1950b053247694785fd3443a5ec29366c31040745a2840862841fcc1bd4d2caa558a943e83c53257e9f63ee228e977
-
Filesize
5.2MB
MD5f7d48ad132754bafd5b2542ff48510e7
SHA1d9e7b443bd0249ab14eab8226622e7a3b044f3f6
SHA256f54f8e01ea7b0bc9628491a49ac1f7fe96b47bf38f39ff44f612faf275c39f43
SHA512afc892059f9f27f702db1bf81cf15b9e73db747a8adb31c8807a3dcfee9569eff11f5a00849711af548cedafbd44f614fcc870264d02ee5860a61b92e2bc5993
-
Filesize
5.2MB
MD563009a3ee761afc6248d6be4312c0911
SHA1af595d9ce73504bd2c72e54ced8bf0a48b38e99d
SHA2564d09c027aca28a901095622e24d09685bbbec147d6fdce55e800802eba12ca01
SHA51277d88d8ba9cac4933b565c1b181e2b80c2675be943d2723f4f8b6733c5e7173a09cdab8e103e50c01c219825955d37f4acd0e20d209f00314962a5627cad11d8
-
Filesize
5.2MB
MD5fc274850dc2fbc4a6e6da7ba2593bdcb
SHA1f4ac0e457186c221c39ef41b5c06ac1f921eb65e
SHA2566a9fd1a887ce377c49eae0be53e5c028948ba2d44f9c3bfe3ff0018ad08b1382
SHA5124533a71c674b95b9c5077f998d0b94daaeac1e0ec5c8eb3fc7093f359a53d6480aa6f71e2bd447d92ebc636ed0a9ed329c72aeea5fbb61fc57c8013eb0ac911f
-
Filesize
5.2MB
MD51ab75d7eacb056f2f0e2c41a77e8ebbc
SHA1617381faee8becaae4707a849157ab14717db68a
SHA256e088d12e1616f40ee9ce18f741f18fdd46874519c285ee6ebdb84cb94708647c
SHA51263ce989e6a4f46cb88196d495221e586b461b95df2e58cbb02efe9cd171e5fa6ea8996c2fd9bdd65e240ff8f2de9bc28413ebfab9609894595829156b4e221dd
-
Filesize
5.2MB
MD5f1f16e4dce41bf3b8820e834e551ae9c
SHA148ca185003c690158f40390a5350195ecaf6e68d
SHA2564f1aeb07ff398596237d9a0154c14cd45487ce1c1d1472607b360ebb75ca45dd
SHA51250b602a5ad559a9c06908998045c5e97308b85c12325a6abc04ece4daf402d874eb30c4c9a1a30554c338a39ca155235178f1b5d04e88329657d135dfe79d329
-
Filesize
5.2MB
MD569817b63f6a5af68896ba2ecf2cf57c4
SHA138c3c763a09ee7dee005a3bc7f45414d542e921c
SHA2560aa3fcb94650befaa7688248939a77008ab64cd1f24c99ddb13ffc262c4bedf2
SHA512f2c286a73bc3ea739e33ab1bb66bffaecb223121a21133b6265ec8adae92a3221988026abbd405e4d8c6314775ae42b865f2fe09603ad11cd5d13d31e5b37d84
-
Filesize
5.2MB
MD5e9baa453316eccc4eb718a22d80c7640
SHA1fdf4db8f2048ae9a9606e8cc51a78ff6807085a8
SHA256f498e1adf5104a2b2e5f7e0243239d57245c0368b279abc8dd028eb10672232f
SHA5122ab2ecb80720f21a07cf77e2ba658b8019559e42ff38f89edf75ca2483d57745bf1fb9b1c6525e7ba7cb32c79da7cf91fbe85d3dbdd72bdcf1a048be0a327d47
-
Filesize
5.2MB
MD5c7ee545263052ca20c6bfdd14f0b0a82
SHA1d89b7975837effa75f449d3a28253f6253a6aae8
SHA2560662dd4766d6e7822385cea1230f9a29b0dedfd7d73c65a988003aef0bf39877
SHA512f344a3f531822a087ad748f49ecd5b74f919396c216cc7e070c3dc9b207a9fb3767b79829dc9669a80a11fb01f26fc149f7a9332fd1822ca847c04e85e5dc457
-
Filesize
5.2MB
MD5ec17ae9414da4fd292e82346d7f1f71d
SHA16cdde5504c482827ccd6d9635d91952ac7bd57ea
SHA2565ab5ec753ffd578f181fa2ed00c5884b0d2f62873cdae3d6f479026c21a74593
SHA512572e2dd440f7acab66139d6e3a499201f4a02ad2a12d286ded1b9b771575a60e6b8eca2711c7e3315296a2e91b4ff874fcfde82f1fd9866c9dec171f75225f3c
-
Filesize
5.2MB
MD5f542c8d76299cfb9994825386fd0e86b
SHA19d3bf35d2e05f55220a6a874719a53cfe5b93895
SHA25694c6052754ed25406194fc615dbe8f226d0bec1d5ff226b716dd67d44faf084e
SHA51231d648beef71041da3abaefc1c9e1c8f1c04a99eff29b0331a7d8ea00d1d22c29dc150e296df5454d04da6c4f608f83bc4081f3f24047bf3262d4ab8f64d9206
-
Filesize
5.2MB
MD57a62e351ad87f0a6dd86ad983858c0c2
SHA1b87d8249bf7de6b9e6599cd05c4b95ac009e6490
SHA256d8e16918caef243b72b714ee3b1c72b89739c411e9388b77a5ffae8b9e2da5e6
SHA512bc63b57b9e8b57c269f3c947633800b53a25b057e4bef7aa27aabf987c22e2a4f69f20691ba1f596932ef16d1230fd6b068fe51d88385af4577e986de12d9adb
-
Filesize
5.2MB
MD58ef51791dc7d21b620dbc5212be57c32
SHA14706f06d5f9d905ddeca07540ba0c44da6f97c64
SHA256cfc807b93b236dcb194403a05a68ba1b76bc9f0d7752ade3aec4c06474f9ca78
SHA512b4899dd4f8eb11220c08371cf0b6305df1d24bc07ba3a9d57b939e79cabd5d80f2c548b8e540f3778c6796469b530d4cdf128bd1490558b8fc145ba94edc61df
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB