Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20-09-2024 15:28
General
-
Target
2024-09-20_3b93c55d63772cdaf7f89ed43fa54b55_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3b93c55d63772cdaf7f89ed43fa54b55
-
SHA1
6838c06d9638dc0d0b611b2e33599773415be383
-
SHA256
9e2327d0b6d11951f1dd6832cb48d8c554e57f1df9845fc24709ee774df3b5c6
-
SHA512
5e108ba3402dc2091e6b1a05d77c84ba0eea07b31f76f8bfd51683da3e92e423def9170d6ee0476af05b9c7a644c3985b16d4951094483000fa49a15382da98a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 35 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_3b93c55d63772cdaf7f89ed43fa54b55_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_3b93c55d63772cdaf7f89ed43fa54b55_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yikcUEK.exeC:\Windows\System\yikcUEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQGBzCX.exeC:\Windows\System\nQGBzCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjpUGKc.exeC:\Windows\System\tjpUGKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjuNhxT.exeC:\Windows\System\PjuNhxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quoBtQX.exeC:\Windows\System\quoBtQX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJUBLbX.exeC:\Windows\System\GJUBLbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjkJjNy.exeC:\Windows\System\TjkJjNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRkPKnb.exeC:\Windows\System\BRkPKnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lenkmnA.exeC:\Windows\System\lenkmnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HQdoZna.exeC:\Windows\System\HQdoZna.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwkugSR.exeC:\Windows\System\hwkugSR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYvYeMg.exeC:\Windows\System\QYvYeMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xAXoakN.exeC:\Windows\System\xAXoakN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KmdwQrK.exeC:\Windows\System\KmdwQrK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjokPNT.exeC:\Windows\System\PjokPNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KszwByI.exeC:\Windows\System\KszwByI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\deBbKqZ.exeC:\Windows\System\deBbKqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nVEHAnU.exeC:\Windows\System\nVEHAnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlUDnPL.exeC:\Windows\System\rlUDnPL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSMiisZ.exeC:\Windows\System\lSMiisZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJpexIk.exeC:\Windows\System\KJpexIk.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD559f454d2f4bbfcbd3ab14f43462bdb34
SHA1bfc55441747185b77bb3d01f97603583e313a195
SHA256a04f811fe381f27c305f7f36ab3125ab78919d20338b53565a1773bf27b253ed
SHA512607f30eab8e871452a94e6c5fd295484f5b7db1cae56adb797016f327b059ba8f11dbabb605b854e5a841f5d90bba269349c98de22f8cee8791354144e9b96b0
-
Filesize
5.2MB
MD57dec932cb0aaaa9cbd242ba7b17f2829
SHA19b56d85686f81ec9f1b20ca251d824e0794c09a6
SHA2560c447e6c2ea3e290ccb772b4e1c5fad1e241d89f6ae2e78b955f2d42844ab632
SHA5127458d7b2d453d92fe88aa8dcf17e56c78f7359dd61d50be51802991b87749b46eaaf5bf98979d9a616d491b419c223d0c52505780bad914b35181cceee4c9177
-
Filesize
5.2MB
MD597fb6c4f6efcbd4e771795cae63e057d
SHA1452e94e398f06d7da67db0ea3f3e2ce9d896eafa
SHA2565ba22ea594ae1d497423c88785efbe46241260d150f593c2b2ab4ad6834974c5
SHA51219b4cb3afa100afed0fcb9f00752a363b730a53e34f7e97489f581386851ec3b676978d7fc47b4a50b258fcce6b42be36736cafa53f99577100c9da9d15852d8
-
Filesize
5.2MB
MD5a39453afa5bafa7c7e0c222f2e2de35c
SHA11411b4936c553988b024396d2b9ecb2b9dfa191a
SHA2560b638b77b375d813ae80373c487bf62bd4f37ab6db86b46920213c30a96ec4f6
SHA5129a68b9d945c3cc20a5b4ab679b9ace9e12bbba8132c056a4334b7560019ca42303fbd3b67c37946100a81f1fcddc286083f295db9a076ef20549ba468603bad5
-
Filesize
5.2MB
MD5b0bca433cdbb8cdbde1b2b487c79c88b
SHA1a7e148ffc4347f00138fa8cab65b97693a5eacac
SHA2565baca960037091ae1886666b7f224d1b839603e8aa7aeb457783bf679f805df4
SHA5123aed6f19a4192b116d8d2b5f520ed507de268f935ddbb0599d59bd76d2ecce4afbc83f13af9d249edb32c4cb8e7c8022b2ed4c6b055926a81e509e927c85feac
-
Filesize
5.2MB
MD5531a82bff6fcf0b544256b998ee7b337
SHA1bd8036d845534ff724ca18429ff1c22aa1e2b474
SHA2568bdfcfbeafdae4b6717fe111f3989c413a5a8218a6edc93fe96ceebf78d59997
SHA512ae19eebed996f96db4a1d51902dd2e4aaf0e425fe39267ac91de8f0c2442231383374935b4d47a53d4a5d0147e2ce2677be5f7ecf583d4209f0d2d56588fc51a
-
Filesize
5.2MB
MD5db86d490e3fb581b68fd2f055f8f47b4
SHA19df15a2ef123ee14a5176a81da475ef7227c2b7f
SHA25659df85558a3af02943eb4a98de041a430ebfe7a2db1be3781672fe680c940d33
SHA5124224116aebec21363f47675dac9c9025c2059f1f44e57b443070263c5c37b328850acbd1de7c94da36707fc890f4448d6467ab65dcb7ae8eac4448c265f21464
-
Filesize
5.2MB
MD54ac5ce8224da6bd411b98d7b3c4e560e
SHA118ca13ee28e57acf0aae0c93487639abe11e6674
SHA256d61ff240e382c89675e2df7b1c9a638af9d7b253f5ec64849bb1a4db1d2e7dfe
SHA512ad0465e114f27bcd79299ae73a518b155b6ba921c1fea7bd13891040d33200e1c89e980a4c5ee4f3415397b8b5747a3c0795a35ce053322aaedd78b676beddf6
-
Filesize
5.2MB
MD517ef5255d9de56517de9443a20ecc206
SHA1e979639f92d5c4ae0f70ac4c960f02d182b4593b
SHA2564ceea6d797b9b39a4eadb271f1f39782e68605c041bf5df8f405ce168df66f34
SHA512c736e4f76dbfa67300a61f32df3e432bb3f47d294c622b482ada41c391ebc7c3b87b6aa27fe0bc2c7cd56923e81efa06f94399f6348a13b2a8ba6831629af063
-
Filesize
5.2MB
MD5cb526f9804b2314324f21dbea1ee4c9a
SHA14c48d26d2af0cbf6dee8cac56169be1ad2ebd4cb
SHA25612e1a75fc8308a8af991a5b2ade3990a5934b5ed1ae15fabf2b876d6c6f529c5
SHA512eebb313bf2b7b5d2cb275a824fd0b3fac000647bd34bd2b6b918fcb9e4e8108eb1697cf5050a97ee4b8bdbb97277e33987e60b1f62b0d32f5c57251210628589
-
Filesize
5.2MB
MD5444eaf3ec8643423078c6d9e10ab4f1a
SHA1a91274c73943a93fb79b0e20d00195fb08923e5a
SHA256d65cc35ed409049553f1278a21800a2e6600c707a4d870963c995543d77f1b9a
SHA512c82c11aeec05cdc5407080ef1441d98c99e607413428267c2c713a0fa9ce6e868f34401f97b268bd988f33fdb0c428fe2d651248c9c27ba42b24a7d3a7657e91
-
Filesize
5.2MB
MD5cd70b6674f8fbceb45ee9d7592e95e6f
SHA1b7f186382be8800468e8cc1df7954413f4260fcb
SHA256a571d0e4156ed811c2e01889c695958009a7ced004a7a4a5f4fb3fbca3fdcfb5
SHA512148e910751f89d27adf1eb0ddd3e6bd117015ba6b69876b253760f7d5e45c8d2a1237a1f4a7a0b74ace1cff7a23a0c9c76e178a56d0e2adc3d7bd83bfb462721
-
Filesize
5.2MB
MD50a7285d1f734ef5e1d5e9040b970707e
SHA154fb01666ec60bebd69168f3110d75e16365de68
SHA256c5cdd5b378989a87447f9be2c5f5e4f3bbf5bd5fa03fd11ba0c2baee1567dcd8
SHA51225cc7f10cecd9a3d3136c46fc85b84ea1bc925f34ad92c2a1476afa2a6802c10b91781f3b052a7cbd338b2f5de6c008215f851c40b68d1a7a6a23a5ec700b408
-
Filesize
5.2MB
MD5cc4d2cfb79396e2ebb76793fe5f7697c
SHA15a209d63a3551089ef4b276588666a445e369655
SHA2565f2b75aa731f3c2b226766160a392faa5052189b55c8360cbe4b7cb51c909518
SHA5126b1092de7ea851732f8e7d388e69e5fb617be20896ec40a6a0c0e1f18220e4a585cadf30136d20e61f791ccca1cd0189c3d4a3dc404a820f87c438e5120b9b5b
-
Filesize
5.2MB
MD5d2c295eeda2050d6e8ce48709bcd4196
SHA17cc25ea1361b2126f93799dc82ad49b543167e1c
SHA256ab45d06beebf3c30d75d52e002eea7b8c0b92d7eb3764c53295b2c86e0ff0f35
SHA51287605c76d3cb9c5e5d914fd8e1d3c6e48b55e3d453b58f7d61193466e544f4607e8aa1e1dcb386fdf9c0bb6a4e391cdf70478bfd95e7588ce39bac44831e0499
-
Filesize
5.2MB
MD5e3c807de70b3df2ce8b8e186e5de8a6e
SHA16b32c4ea0c2dd03f73499c6abe8713e3d20260ae
SHA256e1c9703179a4aebf515243eb5e95c8507bdb3c60ac87af256494b878f038b39a
SHA512dd8e3c4d1fecb276f3e913af7150f9ab8d985ea71a7177ae4c58488ec3f88383455c6e6feb73f91c00916e5903c53beddc28a42ed619dc20126b2d0a030e2485
-
Filesize
5.2MB
MD5c8ee23657696a707d219990ede3d341c
SHA1d7d019d6b9ae720d64b5522756407999ff72398d
SHA2565f872f9be15a079b87cf51b4721f316247a418642421b9a0342f5f6c6e6d0acc
SHA5125d09d7eccd4c727e45108349eed300302ed37f4f62c7483df15a6157a2fd74a2a366e6027993d734396db95eb951b739f238d4d6edc6dcd396f84e5494aed3f9
-
Filesize
5.2MB
MD58e6c6e1ac14fd3d3461492dfbd75d76b
SHA11e06edd696e26424f891e6a6d3e60c05c7507571
SHA25647ec283e996e46ae03d38e4e9159e81c58f9562f28e1e5e8f95c8d46e3282bf8
SHA5124f72c3fbd2da260430a8ec3c8246d0e4ca5c125d51fe80975e30b1d1e0caa4d0b1394b10ff676384cd479f2d71e6c2fdee786a1e1e8088b65ea96bea8c8fa39d
-
Filesize
5.2MB
MD54e40c5792273395a7114a6a32330da5b
SHA1ae731812ebff0957b802edbf127804f28a8b5a69
SHA256379841d89990efc2d472e3b17a5c09f84d3c6f26670d2e9a45ca057d9fa10e0d
SHA512af5f70f9428f980bbbd15744ca3f6aaae49cc332b05ef8845120b3850c4b19e7baaef2e986ca5e82555d0f7015ab822e677d9875f18e0ccc12f86eb7e4854060
-
Filesize
5.2MB
MD5e734ffc55f158b72d306eb194a07023b
SHA1439db3f1342cbbf371f2fb8e37119799e5cb862f
SHA256f2f189a0c0c5e7caee1c98241defe341219e73d71c006facfa554bbc6aea478c
SHA51278fbe3316fa5d1064af9c4c2514faca31b3641b548449a0d77f1294c9894dfbdee1d0dabec03bc91d66bf49e219241ba93609b637f9bbfee3f3a402fec33dff0
-
Filesize
5.2MB
MD53238dbc67ea5b3c893d3502dde80991e
SHA11682e77ac114a29492aaf9ab0f14bb6de905519f
SHA256a232ee8e586bdb97b8c0c56af45eba55376cb81ec6c5c3d37a48cf002bc7aaec
SHA512da466797a56e8d5af6949dc830f84ba5b7d0cc57b527eaf85c3499053c51d24420ec2ae848f8d2ce8529a6982342f6a1e93f04a76727436303fe66a5f8b84102
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB