Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20-09-2024 15:26
General
-
Target
2024-09-20_1dae66fefaa0b63669daaa8bdf464b7f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1dae66fefaa0b63669daaa8bdf464b7f
-
SHA1
133ec975e2632e4a826e1c60adcde2eaefa51c73
-
SHA256
387a65c70cad23d651175c2cd70523c77c99d49a24ec29607c0aa7171afe83d3
-
SHA512
0deb26b07c14f43949d9c8b096d9de6d1b10239bdf3e3702a000b3b6c949db83bec9afa17ebbdb0c46b8630abb38e8a8db2d263ad124053b6a9b1d8a20ca1c1b
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibj56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_1dae66fefaa0b63669daaa8bdf464b7f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_1dae66fefaa0b63669daaa8bdf464b7f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zDarJOY.exeC:\Windows\System\zDarJOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbkxKAK.exeC:\Windows\System\dbkxKAK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BjVEwXS.exeC:\Windows\System\BjVEwXS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHqbFsD.exeC:\Windows\System\rHqbFsD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URYhNJs.exeC:\Windows\System\URYhNJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fYCQwJM.exeC:\Windows\System\fYCQwJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npuxvhS.exeC:\Windows\System\npuxvhS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amudZoS.exeC:\Windows\System\amudZoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mQStfAy.exeC:\Windows\System\mQStfAy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vtrnsEk.exeC:\Windows\System\vtrnsEk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iGbMGRG.exeC:\Windows\System\iGbMGRG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYrHdDq.exeC:\Windows\System\sYrHdDq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EkgSBdl.exeC:\Windows\System\EkgSBdl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FuoEYAq.exeC:\Windows\System\FuoEYAq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exRKiDj.exeC:\Windows\System\exRKiDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTLXwOK.exeC:\Windows\System\pTLXwOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MwtEDWm.exeC:\Windows\System\MwtEDWm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDILKJi.exeC:\Windows\System\eDILKJi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TqkBmua.exeC:\Windows\System\TqkBmua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lpHdNTF.exeC:\Windows\System\lpHdNTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArzsXSV.exeC:\Windows\System\ArzsXSV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54c1f854d6a2354b1ad68f753a334aa4f
SHA168cdb58f99bf051a636961a6ad3007c07d0d4b15
SHA2563e6bd782bcab81f2b3a8f234227252ae06e35c6886d24844d576b4db8f1207f3
SHA512eea8ac2c1d208afc3afcb2df48fde64d0d7d82c94501e74bac922314045dd9e9668f8dabdf8d0ded726ee515d7d9d1eefb0abe069740ab200ccf9818c6abd6b3
-
Filesize
5.2MB
MD5b471d021fe4528d18cb253553b8b93b5
SHA1d976273c9a5cab51810f52a4fb614e8dde2c4222
SHA25636c0b00f161db1bb57db53a0ca9324f532a0416039becb4d3960dd4720dd3105
SHA5122eaa6fee0d0eef31d1c28d45de2cf6c026f3367c8b67e1b122937df3bb5f389d518c5084b6ece12968369af3f3c2dc364e1e51c70a053ca68f5fdb0193a4c6b9
-
Filesize
5.2MB
MD5ec709f8323bdfd2689dbf4677fa8cb42
SHA15512ed36adb880864e647756adaef272001cd548
SHA2562f9eedcf4739cc75c776cac0bf65d50d7b61a1bdb13609c6db909c3cce354a49
SHA512e88649c6d430a53a1250cb9e1f0cf9110cf77e37f47434e86bd9f4731442125f6da6f443aad4e575726e50c81de7140c4183c7c1a32f48cd3ee7450b46c4bb88
-
Filesize
5.2MB
MD57727fc1fd4fbae33f5516ec8448d155e
SHA17e5a0c98c50b1276c0bcd9dcc05a650f40369ff6
SHA2561b859af4d62db361ac870507d0a77409fcd9bd560e18f9e0fa887b6195be807b
SHA512de3bdfc239619468f5caa80a3e8a503df63b6659dbe5ea9b7b7ca1b35707162444c0d0b201a50d36290a8d32e4b1806ef439dc3b2290627e964de874ed3455ea
-
Filesize
5.2MB
MD5ea637980f7bdebfd88e55445a661c74a
SHA106b4dfbe57e310530d1d7ef80a49ec03ce7cc3fe
SHA2568526ea5f947dd992e9d98f733463cd6e0ad1c7592f0ef94a3d079cb0a71dac45
SHA51298fbade0b09b334b2c5c928dee24f25624226cb2b060b49d702f1d8b19ebcbb52924884ad53ed7eddf29861f15b613a2f8e0109afc2099d4301faf4a664c0484
-
Filesize
5.2MB
MD5525b2144e3fed9affefbd0627a62b63f
SHA1b9905181e3f5ecdb59e24301ead1cbbf5b715747
SHA256a9d05d029661f3fad6b97a2cc7776a5af01c33bbfd5af712c3919ef986c3de34
SHA5129376e5bb02644b30953e73ac3333bbcfe3167915924cdba3c957b662e64c547edc50cc21cd947c7f75a6dca0281681b0cecea25d111b4b24bda930efed718f76
-
Filesize
5.2MB
MD5a6cdb731dac8dec0c9dc92413e2c5836
SHA1b377eb83a9a8ce71dcfed555389b1ec3667b8afe
SHA256b33304bdb186e21275ea78f20fe18eacb0de8139b2690a7eb1f0bcaeb28412c9
SHA512c6092e066a59d3f42b4770a4fe6ef0e21756978b81954d8bfc1963baa45eb5a3ac11f2e2e2bfe33b9e75f8efdf21ad82e7e4c4e81d9586972f19400221ba98b5
-
Filesize
5.2MB
MD5031f54670ca0b93f812713e1cecbb74b
SHA188fc5d916fbb84359c685c7ba6b60bc983f05af4
SHA256ec1d08c1ef15fb448b114f59a85086aa52246f84c33a5a55b815d1e3a2502296
SHA512a60e92499c5300c01703abafe211c8a4db47c33f8cab77c8fb316db053e8fea007b3551b3b2448313036c5fb13b42c96e5eb7b6515d916815ca02b7a109a73b7
-
Filesize
5.2MB
MD59876af539f7973a9183acd4c0115cb02
SHA1655e4e9241661a0ecb40011174996065a633c3c0
SHA2561d9e5ca88bce014737a29e22fbc8747a1217494b6724c875b8c76c6bccfec9e2
SHA512559c82890da0c1b17386dd800b0288870f0c54e5c8729db37adfe5d11e20aeb18b67ab461ec28c78b27d798ad372a42cf32236db80e213246c5e5ec1cda6893d
-
Filesize
5.2MB
MD583cc2af48e6546a33a88a640571da0b1
SHA15f706f1639209e2ee710d4b655dcfb85b70d247b
SHA256f7a74bbf10811bbe0611762cac22c3f696278fa30ca56801633ec29aa0bfa318
SHA512ff8e389f4c0c239e6ae75c40f57f1cbacf26058724647465b353c9994280952c8993a1939270139ab7eb37440735d2df1a3177808c5dc0d5e49e4d4cb3a889bd
-
Filesize
5.2MB
MD59a3b8d9d78936b40d85c1d036a53ca35
SHA185f33c0816a7e58494758fd1c648fb6c00706d95
SHA256036eccde61afdb91f605b3ec7807c63129e6a71ffbe89e9565864685c6c8c8b1
SHA512eed8e8fe93bd26d06cd65395d80353ddfc3379f5a032382326b42f9090d8da7fe1220430bc37d7326d06282fd3261941edad859f5d143dbaca5f5069b8c43ed9
-
Filesize
5.2MB
MD5886614368eea221db1aa66fd77e6c2ac
SHA11ff20221cf216c14a0915b6b5d370b244eded5a8
SHA25662c4487e4d6dca8907f62acf9f2673e00a14fac459aece0112a199a6f618734c
SHA51212ff028d1866de481e6eea9de2aaec869c4ca0902499fb949b6c12425cc6f737940a0a6cde2f396416be8b3bdfd597f445547c2ee277602569c186c5c799fc06
-
Filesize
5.2MB
MD55b3a151f4fe760bda278d79b45400e75
SHA1c9dcab4e05e105330d175edcadb42d3ffc488543
SHA25612e49f2ae1727fcf28972bf53bee3f2ea53abee4b78411eea8023c0894f36fe0
SHA5125a3048bede4a4f6fe42153f1390233b48fb11dcee51afe2743838afec82fe240989aeb922cc5a7407787d906e98f1c8798b16cf506600bb55748eadb4170230e
-
Filesize
5.2MB
MD54e3488379ee065e178438c242174b1db
SHA10ba1b5f94af13c8be0a98dfbb7e8b5dadcbd2721
SHA2569022fa8d9a3043a5afa16da7e6e156cd2ebe5509e6012c10851a27ab648fa0ad
SHA512330ec26c60076aee47ca771ca5c7289f6aadea4df2962ce017cb3ede07f9c2e20d886d14caf6bf1d6d870aba359da6754f5f0b275fd4249a2df64b03136192af
-
Filesize
5.2MB
MD54bcd1b4e692d421af0a00327f467e8d0
SHA188d453823a80311b76175a5f00cb3828522152b9
SHA25618b91c70055d9d154a5d4935ebb4c61ad2e71b324da561c23ebeb35f1db911c0
SHA5121ee73b2b1d9cb5f4c85a8265eaa49cd1ee849af8ae720e1c687efbae50adf0c64a3a76c1d47f6c96cdd65ea07ced677b1bb1fc590276113cdc34e6cbf8a9e76a
-
Filesize
5.2MB
MD56294de2a2a07b766c0e644fc4f7ba946
SHA18e0996d94bff807ea17ec7365e8002588c3599aa
SHA256661ffefc8d8593eb3348f7ef5c94c201bc6b9a5d50dbe9e193456ccfdd4620fb
SHA512b8d047c4797a125a30facef8f694ec42189ee3af486ef4f1f9100477a01965399ebcfe90bae3f44e9db673ee1439399dc316c442fa213999f50bc6aeacfb5a03
-
Filesize
5.2MB
MD591eade41b7eeb0ecfc81fd581e3059ae
SHA1979388479808f2147d8cb2d69dc528164048ddf4
SHA2568c7989c418c70aa72f358bc06e03e5ac9a24d83cb3243aaf8fc70fd2ec1c66e7
SHA512e5be820116f672dcfe1d6222442bac96e5edf64537a9cbd98e1ddfd7863c93fef1416f94805ee7dcf1ea6da537ba199c5e53afb25671766f4fa938a1c294ce88
-
Filesize
5.2MB
MD543929c6d51332cfdb51c2b716fd2098f
SHA1f7fee63897dda733ffd7bd578644e10e37daa211
SHA2564feacec32fe3cc970a4dccb4338e4df544d7cd60c06b3d9756fb3b383b9fb575
SHA512a555836b4ee109f0f34822b51b932a116310e93f947d1b80a423d3bb74d55e2a474deb602d254ecb1d0a50733f5a83a3aea2338db1183231d109bf33609ffca0
-
Filesize
5.2MB
MD58c053d746ecbc7180d803282b3a8cf01
SHA1e69eb7cb42a3cf2ba2d8dcc54ba62cc25160bdf9
SHA256c981c17023b13c7d1157e1576d64a79cbda19e20310e28d7de517b7929516c0c
SHA512ca06de8026b25cddabb7428a91f2ca69e23e9676593d76690882491bec77e6018581ed83c93d59b751142fe3762f5f63e32b784052b4d9e3626ececd9c4781a3
-
Filesize
5.2MB
MD5b043752f7b9bef35ccb33d57aacf68db
SHA1abc78d0ad2f245bca9aa0492aeab1e35b57b3905
SHA256062f9faf835f5fe85dd4a1a4b1395039b95eb40e6e6485405dd409a97d14307c
SHA512248ba6f7c85372bb4cb1fb7d48994b628f7714b12d57afc09ff11a962b34f1e58cb7979c24b376d4a1b5970956ee7a4e462bb0262dfd3c2e11180c0c64525868
-
Filesize
5.2MB
MD5a44ab0ed863127fab5d9878c0ef6f206
SHA16a78066f9ef979dfd34dfd8aa2762ba1dffaaba3
SHA25605a6c1b5d822664ce03e8054aebefbb3d618114ed4c2adb2ad55c0b3bc7dfb74
SHA5126ff4f0281c3685529df905be90dc1e8b6f24b760494f337e832c5e8045ac67966d20c833173eee6cd8d85ab3c227d2c65b29859fcd44e2562abc70c7c02cafda
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB