Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20/09/2024, 15:26
General
-
Target
2024-09-20_2ea33fb1945ca6f96c734b3ba33a681a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2ea33fb1945ca6f96c734b3ba33a681a
-
SHA1
a67a9cb45233164337c41a98cb2c09e99511d241
-
SHA256
4e9bb03a72761969758d9d6b54080ff4545143e65806e7631ead2917b029453b
-
SHA512
671a40dc790a1052a34ef4ba3a18ce9ce55bcce0e1e25cbf753202ed3c726a6e498bf416e2b0e9bfea8a8e8de642f71d273ff70d511b7b0fdee723f7258ec523
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_2ea33fb1945ca6f96c734b3ba33a681a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_2ea33fb1945ca6f96c734b3ba33a681a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dnRLrev.exeC:\Windows\System\dnRLrev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJgwEos.exeC:\Windows\System\WJgwEos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ddoqlqg.exeC:\Windows\System\ddoqlqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCSrGXq.exeC:\Windows\System\tCSrGXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUCRhsq.exeC:\Windows\System\JUCRhsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyztioR.exeC:\Windows\System\iyztioR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EsuqJLR.exeC:\Windows\System\EsuqJLR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykhnkCk.exeC:\Windows\System\ykhnkCk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpfTFhz.exeC:\Windows\System\FpfTFhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdDLGbR.exeC:\Windows\System\KdDLGbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QhEQeYz.exeC:\Windows\System\QhEQeYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrPfwVv.exeC:\Windows\System\lrPfwVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkCMdkn.exeC:\Windows\System\LkCMdkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YNvPtZE.exeC:\Windows\System\YNvPtZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JMrvpsC.exeC:\Windows\System\JMrvpsC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\krFoyfL.exeC:\Windows\System\krFoyfL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wBmRIPY.exeC:\Windows\System\wBmRIPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frmncLz.exeC:\Windows\System\frmncLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkelucB.exeC:\Windows\System\JkelucB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgyoqAt.exeC:\Windows\System\lgyoqAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cDUabok.exeC:\Windows\System\cDUabok.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD598d908432ba1ca748d6ca96a6c5e290f
SHA182b267a388f40fec81b78982dbfc08f0799a4f14
SHA25641bbadfd73c485eb31926642dbc65774261d16bf5969554a697b18fa756d4071
SHA512eab56232353520c5445510b0da7e2e5e7caf88c8b9b481614079a6f3b08d85f26fdbb0f69569276a7b64b2adb694fe46bcce10807b4ab9505659cfbf21819e66
-
Filesize
5.2MB
MD561a358b2bf5a421c6ad148ba2a2ea7c9
SHA175d10775f6aaa6531382cb36b420144bb2ab2df0
SHA2566467f8f84b61570d80f70f3fc6fdbfbed018e114106a46da0bf38ffccb18db37
SHA5123ff2bc52f1163833900b738da062e519a43540501e7ebaea8858b6f7e0a218c3fcfe06aadb00e5d0ae11887e1b1b954885b39eddc9d1046f891876d6218238f2
-
Filesize
5.2MB
MD5551b5d26de255f7096add3227aa4356c
SHA11c2e3d9e815a611016ec97dd2195567a57ec947a
SHA256614c16f78cb72a135f116ec00227ad49066fd2b3e0b3f78f4d121f9657513e82
SHA5124b389df42d8bf1e41992c5f0b4bb4eeef52d33ccdc9f63bb82927e44d64b3cbd35ccd45e0ac957ab5fbfbe4d54f4de4cf80852abf8df21f379858ebbff8ddda8
-
Filesize
5.2MB
MD5dc556e467db78305452f8648ca1fea38
SHA14c99af583e637c33d3dcedaeaebb8b444d2c1743
SHA256bea4cd63596fa8ee1e2a26d7e9db16aec646131a4d5949b74aa9ededed6b5138
SHA512ee87a278bb16f8f4db25267d5cbc7acc8f4a010bdaef2098d3f3700449e5458a53d2212524d2ad5b96d810c2e1aae8ad279a0e0991cbc6d658371df74261d736
-
Filesize
5.2MB
MD5902cbcfd3f2f6740d38810703ee402af
SHA1e5d7674dfe243b99d97e13efa32b7d7c68c8a163
SHA2569f5325720f28c353bc8e7991d4811836bb026a6d49667cfff3006af135e33a93
SHA5122ed161f2c9e62700fa62cc18748ea80dbc064b22c9bcc728ed4e4ab33ae689184c1961da6497ae8cabe2ce08fcd87bd659caa412c0550e8bb9a96f763e485384
-
Filesize
5.2MB
MD5e0852b0757056087d0460bfc5c67e0e0
SHA1508497202f2170d76994a5e46db883a98ba2f59f
SHA256af621f06ced5aa82b4662c51c2d61bd2ae608c6d1e6a0e756a928aeea4dd19fb
SHA5124280b3d3fd3bef345a875a6588a631c8da59e94da1b7d12c31ba2127abf425c335c50aa7dd29bdbd0e9571eceeec544ee5bb33b2cc0e853c436c033a15cac870
-
Filesize
5.2MB
MD554cdf307796d33bbeeff0a3606dc5905
SHA1798742d6a18588f6e6daaf3ca39f7f41cc331ab9
SHA256617abde76e2aacb42c3a63a3b041368c868c9edb9ac074c53bdf09c514bb01ec
SHA5128aa4f4cb057082fa124f3345096aa969fc7b758a27d456bbfff0e44d447585b6222a1cc93481c9140362a0bd83d2714cfbd4503f7ef26330d5e657e01a643677
-
Filesize
5.2MB
MD555bed3b1f90a194b0ac24fc59f895a57
SHA16cb886531612ea0513c427b6c8f17920d160e550
SHA256025d32e232ffcef3c5730c48f8dff9fc138098748664106ea496e773cd5c3ac3
SHA5123cae2d3beb68a8ae622156c5f470fd8bb0360779d2ec49c2da79ebd0fe0467286313ae7e06ade781cc55c36856b3364f8681ef037e51e6cbd5f878ea235e72eb
-
Filesize
5.2MB
MD5df2be9afcc9d2ccb6965d0efd7f85a94
SHA1b7e0179d4f32a2f37d9eebbd15074a84dbe6fe75
SHA2564ef944f8ec27694c0fd5339247e20a37eece001c75cc1a0727b8e74e96211dad
SHA5124a6ed20cf4dce3fa90653ff4f0a4b6b97d02f9c6dee04dcdcf6e8090478e96f9df429e9781ed1d2e6f8923f8e132d6efe42c17697da475db3b795aa5a3fb991b
-
Filesize
5.2MB
MD535ace7e8b2fde9772bb433e8988073f7
SHA106d6f607ef91944cc970fe31dc7745bfb80d21ea
SHA2567d1da2731bceac19d31a2bd98bc41d3c8407075206dc938564f41a88da1b6b39
SHA512f10a20ef35bbfa9f88672e17c7658fdf6d86771b8059318910a4328d6219e311c1ba1a1b8291a54f291eb9bd78e1af2124c235ce9b18be8f183970bd1dd127b0
-
Filesize
5.2MB
MD563ac218a1e04dd78fff6837d30780ade
SHA165a379b32a7b0f2f92dedec6c1cc6807d048cf6c
SHA2560cf03d16d1bed24a7a8933845306708bc3bfd115053068154202ea07974a993f
SHA5124ac0c61a458d57c864b9f3af78955d8328cfe21d9b5a5d608357cb6c92bedf90c1dd2f4a8c5e38928c1dc46d12081e22d59d5f6128cefa15d06ddd4fa662f8d2
-
Filesize
5.2MB
MD51c91afab365d1180d28b10ea5060ff6c
SHA150a67a1fcad8b8dae2a723b7721137ead00b9ec9
SHA2565a438fda0565b8c9796c99a2983f5c242ed91d08b023df52dd929132f92d9cfb
SHA512ed268d2c917806f8756b4f1d1ad8525b80e8a8faf14a171d8c3de854aea90afb0ac1a5a0522ebf9cae47f1e27373dc053a1a0eb4fe119e01c7a92a506565b54c
-
Filesize
5.2MB
MD54e02ac17d3a1fa5b49db3e0496525f19
SHA1b925bb9dd36c92af9c56e22ebfdeba9e6042ecb1
SHA256d6a0d57abfbc54f5241fbdcd9da87a0ead387de8b00b9cdbe9d86a8531912868
SHA51292bd1eee7327ae5e6326670d57091234e74883732ee00ef20e14f057dc5b0eccb71f896322e2f69427f88afe9d86382bce0cc4ef71a783c1e62042fe496c7b9d
-
Filesize
5.2MB
MD5ada7e48042918187994d1798eb87fb34
SHA1ca641d491e2a5aeb82c10d29743d189014e7089f
SHA2564632d21c69900288a4f6d71d88ff37a716adadc90e046db6b9edcbad95e15ce5
SHA512b3ad62ebaec4c8c998f97ffcd165f7aff9ca4f92fc4bbedbc2937af3883296ef44dc94d032a02769615754a0ed982f754792ac804373e0e88e631735e19ce5d1
-
Filesize
5.2MB
MD5457d9e4059cac7ce74f34a84faf7dc5f
SHA165da087a518a95987be969d0bfb432d023a9282c
SHA256bcb9be166c8d135988b60d7de91901bab0c1884f75e1b7c8576cf19f1e2581bb
SHA5120f15454596e0b2782cfc75e150701801ebb3cd09155c150a4bb5239d2651ef97aaa6d87a206c8836e2eb815b566c56c40dfd0c5a2fc7d487c901f72c39dc8c03
-
Filesize
5.2MB
MD5531684f896fea72ca0b84f898b1d21ee
SHA16badb2c1db8a87ad293326d7ae46e140e4e89b92
SHA2567fe190fd43ce5795160c3c53137061841e80f0d7d19bc13b6fd18a76ada2bd4d
SHA512425d214a24df85762b3f81c8675131fb7cc7367a45770536142b7f7906949f9712339f2c55dce454890dd8b0c644460d0ee50821def071ea23a2e3a6107a80bf
-
Filesize
5.2MB
MD52c01a11c3e0b49fbfa884539e5543a78
SHA1f563c3a470f267052fe5c38e3cbcb320b10ce9f3
SHA2567a478d7c3c5b795c70ffd1ac7cac5824333bc3460a65b6a46020d8104c75ba35
SHA51226142368b770adfa6ae5ca7494ad15466c3f3cbc791dcbb5b3cd7f3534fc66c00c3a51fb069a293cbdfa0f0a0d68116852e21189a38ebf2f17030e9934ca6511
-
Filesize
5.2MB
MD5b1bcd9b55596de276ed82439dfdc2fea
SHA19611f8c2383ba96c982df6347abb01959c650cd5
SHA2565b35b10e929114862b57227dd890f21b390d9334fb95905fcc914bab6c0eaccf
SHA5125b27dfdfc2105364649fdafe22f6c223cf0b843ffd296135f54b9f03a5d76a0d8ac5ad59d0bb838fbb95d1efbd1c3223570ded5294cbfe6b617a6ccf4d588cf3
-
Filesize
5.2MB
MD56a7a459e6cf5f7733c415e94a6928915
SHA1784f08706c32ba7a3d6f52ab154226620df4a8b8
SHA256697ae78fd7c16fb8a010b3d94d6a7f783537dd84b881a5f6f0317d53d0f3c6f2
SHA512d93627bf1da0981863f7d1178df1470b211a17db49202bcdc3ca55cde45d8838f42d3e22726285234643e03a640ed4c4f21d39a4a154be91bdcf87428ce204e1
-
Filesize
5.2MB
MD59f8a7bdcb5e57e57e52389d1baebc6d0
SHA18f37c359bb3f1909a0ab2a8120f3b6ce6e780864
SHA256e49b62b93419f7f732498dcc17b5e08cf9c3907546810e8cac101ef4bd2ee1b8
SHA51271b95c905a9851a7462a9fc40c597ffd7410ae95df8475f90a5c521ac65d96f50907e6357c9fc4a44b4e147caab9ffb59079be64607c1f1d093730878c3eaaf7
-
Filesize
5.2MB
MD555079bcfc69f3beb53892ed31acca221
SHA1a3492eb690a4d82517a8678c6517a13cdb5ba50d
SHA256555fec8791f2e260d6eb9f3eedffdbccf8825acab66e2b70179a8d74f72e204c
SHA5122e9e56a2dfa56c603f8929a26524653b850bb82454c8f89c1e2c41e197d2ae0da5cfe7d5af8d05e850d182ebe6eaad1d1193013e08c3e4fc1f3b808d79bb37ac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB