Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-09-2024 13:04
General
-
Target
2024-09-21_523611914d59690ca735c32ef0ce6e70_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
523611914d59690ca735c32ef0ce6e70
-
SHA1
42df2b84529f60511e53aee6e37f7ef9621413be
-
SHA256
ac5aa878ba3bd09590e7b22da70210dcded86a38242f36f32f25cbc6974c3265
-
SHA512
8b44ddcbb8dc20df1251ca679d320a4f1c1419fae083e026d18fc4ae13ba70598b5314c167d22b46d89c363237d6793c70904aa37ec846f53c48a4975f741df8
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibj56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_523611914d59690ca735c32ef0ce6e70_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_523611914d59690ca735c32ef0ce6e70_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\odIDREq.exeC:\Windows\System\odIDREq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AOimCVv.exeC:\Windows\System\AOimCVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsoDTdJ.exeC:\Windows\System\WsoDTdJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EuOdyYF.exeC:\Windows\System\EuOdyYF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZoxJKRe.exeC:\Windows\System\ZoxJKRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TExxwsc.exeC:\Windows\System\TExxwsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ElTtfIZ.exeC:\Windows\System\ElTtfIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JVWbdIH.exeC:\Windows\System\JVWbdIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJnssdA.exeC:\Windows\System\aJnssdA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtZBOWP.exeC:\Windows\System\NtZBOWP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSOceoM.exeC:\Windows\System\oSOceoM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SeHosMp.exeC:\Windows\System\SeHosMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bUZHrEl.exeC:\Windows\System\bUZHrEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPjIlOE.exeC:\Windows\System\kPjIlOE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdzpyzZ.exeC:\Windows\System\GdzpyzZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XxdEnqv.exeC:\Windows\System\XxdEnqv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qmnKbmX.exeC:\Windows\System\qmnKbmX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwfAIis.exeC:\Windows\System\XwfAIis.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IaxKsBA.exeC:\Windows\System\IaxKsBA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfdPJfu.exeC:\Windows\System\sfdPJfu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjFBsVh.exeC:\Windows\System\ZjFBsVh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5aaecc4b907d4f28e2d778f062b61d3f0
SHA1a6d460caf655f558ca4c5d1b2f00b79d7574f6cf
SHA25611e5a39d7e3313867d1ae6b653cbf6594aeaf654187115e4031883ef8b45706f
SHA51212af9215ffc563e2472056457e98f117f12c26e29d4cadef1596175dabfcdf397b408972c8e9e62240a365f41ac33ad8acc7e9f4af2941b1f664be999bff102a
-
Filesize
5.2MB
MD53748fac1bbeb5ec51f2be4ccba3dee4c
SHA1f34e0532e5ee3d40fe474bafe3fc2de2bd600fb9
SHA25657da4372e0d7a107a361c6fc3cc5ae648bd91a0b254c8fbde50c0c9b0aab5bc1
SHA51290ed22297db58e82f965f3101713dca6fce71d0763ace245975549ed86012b8a6470328ace3aab85cf8c4cc0a32e090baa5c867ee7575f8cd8448249030cec1e
-
Filesize
5.2MB
MD55ba94016b3b2fb84f8a96933306eeccc
SHA18f5be60917a4ca305725230556fea75b6509800c
SHA256df672c1bfb93d948ada7f954dbe714ba2dddfd5af99fb074a32ae587f87eb9ca
SHA512f833492c65e8c47f7bc40287a9babee4a8a29ad406d09a5e0ab2d96a8753deca115efe04a0c71f3dbf8706062cf210fa7d4afc6a5be92869b72ed9ce728d17ec
-
Filesize
5.2MB
MD5c911a0fdd7edbae136f5c11d530926cb
SHA19d9f34d48cc0c08ea059744fdcb6f619dd89c338
SHA256de2d1a2c74122103f0f510e00ee9d0095e6734b137a18f224a6778f41f28f0a7
SHA5122bd0baebb4eddf07ebb1e24df010f1dfcdda76b365d640ffb36afa77749e716a21cfe1a68a9efed99481bfc3f791b8844072acd2ac1cb578bf621b5f5f088778
-
Filesize
5.2MB
MD524c16c756aae288d2d7362e4192e48b0
SHA13820604e551e6afa50a9117f2e3febe0bf4989b9
SHA2569d05418c81e0082e91415a29660794c57edd58722aaede99dd0786f331866bac
SHA512f1750ab8a2c7e00097f95662a403f8a234f0ecf42600df07761fa884b4de3bc350110fbad17e554db841e09278d316716f2028e52c5a5a4ff89d8722aeb4c305
-
Filesize
5.2MB
MD5e04c008e40b7694248fbb4f41028e9c4
SHA149e39a185f6ab7fc1c36c64b7902eab02dc6e8ac
SHA2569ce84926be39b384d9c031669f228da660bbf39d0282d8fca734a10d2cab1282
SHA512d3158a357a469cf736d582c04922fbac121013982ad32b5feee9938b6b36ad6cb2b9b121ab50184f8ecb5505d368214a868d64430ec062da27dd79d7c8749436
-
Filesize
5.2MB
MD5fa51ecf31222cd2fedd973f1ca595066
SHA13508c4692cbc12ac3d152b7e96e36717ed3103b6
SHA2560084a5a5184b703d92d7d5e74903c6ee70876b0c33cf7f521bac828b367f5eed
SHA512b2885dd4033dbca173faeda600ae0f1c18c0e1b5d99b89d7278b53d85399d9f3e4536fcb1720f277a7f89e32fee96b5acdf3f8c635dae3a920979d63082a39b0
-
Filesize
5.2MB
MD555295f0b899cb5a8ddca3058b5ce05da
SHA173ae10585f316adab53becff5719c061d45133bf
SHA2562c8ee00769123b5dc4d1e9b229690dc8e4933fbbbac5b0fa6796d21b6af59c26
SHA5127432d9edd8d2b1c98ede0dbe893c46efe7f886434a9eda707200d567b3ee6916af2442ca4620bba6832358d17a50a642b5d20e40f51dea88772d95466c75cd96
-
Filesize
5.2MB
MD52bd92fa999051ecb3459854e31c6a48e
SHA1ef5a36975f0c6babb4902462a59d688546b20fcb
SHA256c71e8caeefab48c365dffe561f1d1b5cef21f05a5972f15af8b98908a68a44db
SHA5122ca5cb3fe9e501935c453911547b4bc231938a8d2ee8a0f4cb486cdf2eea701b758dad336f543e63f540a39c255060ea6852ade9f45393b7f3ca9529b95d2ae3
-
Filesize
5.2MB
MD592a66f78eca30f93cfea33c934be41ce
SHA12d1c39e76a47093f91f555b7b0e57e9b96ea83bd
SHA256b20a7e051c3b17de7748e6f1a7572796bb7340eb9bd2c306286ce36121b2a5c6
SHA51243a870a103d0847db00409b9d79df3a99bf3325b311f9cd913e82c6511d4c13c657adc2bba4b85922da7fe26dc72d6de5e0db857f06c227fb17b7e32ae880aab
-
Filesize
5.2MB
MD5a8a50988c3571217661e706d26ed4752
SHA107ebbef9bf903b0a76d6a06cae64926c3178e7ab
SHA256084abaacba2b8cf018a43da71a472bcbb425915e04a5456d60f1f57d4c1470b2
SHA512bc4598bf92ea000e5802979971609436a3118c5fc55819749832f9a663567748d4ed72ede66333c29db42ba67184aa64b7c17d42880ed05d94ebc8e1172d5571
-
Filesize
5.2MB
MD5837c5270e7354c2fb6024223ab46ca73
SHA1269b756d99e91abc6218fe3e897602c0d12fccec
SHA2568b1f73f3c17dd47c87fb19ec7a9cd2fa059781ed872c40fd63f581856aead5b4
SHA512fff8d8b9c69b4364cb6d75a820dbcd86121940f3a1b254f02432696fb006a0b05a65b99297df39ae9cf6ec94118ce9d22a2c4dd663b54dd2233eb4d0dcf8dcea
-
Filesize
5.2MB
MD542a5579b74b58cc8a7618778f105f3bb
SHA1299a71d95a9fb755d093be7c635ff7d211324524
SHA256cecc7ceba17fd39882b24c8bd5417379e3d037459ad7df415f7c2c3278fea199
SHA512b4862b13d97956f377352e07b75bc6bdf8e4f20973db9eeaf9329f9cfe17be6e59df2e2ef2f3c4e092abfa510ca374bc1788d6a6e5184385af7b761fa0afdc3a
-
Filesize
5.2MB
MD51a11da679293819558ef1c36158ce59f
SHA1bdcbc03c1ca6d228f7a273172f0dc9d2feae7146
SHA2562faa479ec4ba932041fd2c20a9f84aa77f319bbf0b1dd970e7825e9a9d422f82
SHA5124456d5a1923c536f6bb87e85613c4963df168f85204a6f7cd1b50a1b40c7aff86c4ed0535e47e8a0c4f963329ab4623ae167e1574795da660353a90ca63f9bec
-
Filesize
5.2MB
MD5322b97bd7352a77da23fc3021bf2de3e
SHA1c5d8525f0c56bf2f91e5205667fff6549c0e4beb
SHA256b2de12581240731a5f052544578426cf153e468071b99cbb756c591d2e552a1d
SHA5120edf66fefdb0d9d8578d7d69971e3e62ee16f717bd6f96be6a3879a7187e238ce6a4298615f52e4bda8c1310668296994f53fa50dd004332f8a06f325a1a2aef
-
Filesize
5.2MB
MD5120a35647912fb0baabd05c74e916d7c
SHA100638e3cfa779214dd1f9fe04c31dd9065005219
SHA25637e865f723c23a7228594bc4a7cb212bc7f3382d3530333f6a87f6a8c5b3b032
SHA512b3002efb13230aa7bf3bfbe5cb2aeee00fb72ac3431ff1432f01d11be95947be17de8310da90f8ed19943358d278ec93b0ed21083152a73877b7c80025bdc33f
-
Filesize
5.2MB
MD5109757dc40e89211c2b27f20e41b39b2
SHA1b4ba0e02c13e63bf7651caf771a45a777a245d88
SHA2560d3b13bdc8a7358faf2a3d102a566fb85b3867f78bf8f04eea0a3f35a505b574
SHA512f62e3f346c765155956a1c77073fd4fbc1a3cbbc232060fa6b61c058446cfe2ab738ab1a78d1b40e4af63d03009c47928efd8db8f19d0b57d51c8d0e8c3f9d27
-
Filesize
5.2MB
MD5115da0b96b1be81bbaf1cf2a9e1e82b6
SHA13eaf5a2bf68123e758eede84782031941365d098
SHA256b1142f1f5c0c5900873ae7fe30fb0e905b23e40a9a6fc166935086e72cfd45bc
SHA512e9f6e9cb34e8522df6b657dd7044e8ec34dc180cce4647efc385b2cde0fa230103e573a73318280e55f8d38c629c05c36aa3c0bfd37668f9f9b80e89202ed38a
-
Filesize
5.2MB
MD59f1b21c69b140163baf8dd08646a153b
SHA1d354d5dbf36143695739938e2df8e32f11976a3b
SHA2567fce05c761fe3a1ce309cd05cb128d6b3fd9c8b888e3f382f83aaf2d5aac5f17
SHA512a1798d4d6217078a603e4c69e08aec9b83c07563419d58b6cf5f2200f622b34fd912625b4b97c6abd6d306cdda14d14704ac2d713862e152e481119b1b841a6a
-
Filesize
5.2MB
MD5e1e7359dd59b5fd83a708e8ed98a9dd7
SHA17f7925a739dfcc6df27e11a3f28c687c69b586e1
SHA256d63bd3bc65367e907fbdc512561a76bd83fbab5ad2ded794d02c08c80fd81970
SHA512c1e4f6634809f4146d0689ae4a39f4dedf86bb432c1089c9e3181f556d08e58a67caae7444107c858137f270cb4ee21f68ad959170feb1f5e6955d3bd140553b
-
Filesize
5.2MB
MD5231e66e0e76acdad71fa557d50a50d11
SHA18f8dd4880f23d3c0f907e2dc218e43fdeef8a5f8
SHA256e973cda21ff59e6a201b2dbf351d945afe2a675207f8c1d533d7b675802dec5b
SHA512af4b9df87140c056a48be61e850a06b408416e94d2ce1c688d72ea42dc9266b5cca81a2debbea1c01ac5c39b6fe4611d7c6141f3ef928cc9f7ab9aae67cb3ed4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB