Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-09-2024 16:27
General
-
Target
2024-09-21_7d1c6c7f51525b57ab6dbf2ec2f9607d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7d1c6c7f51525b57ab6dbf2ec2f9607d
-
SHA1
908db1a86d5cfc8deceeb56189f615bd54ced83b
-
SHA256
9b68da3e301dbefcd1766d96a446bd30b752737f477c07dfeee524dfb0219812
-
SHA512
144ef0734c33013fc8ed104299776c31d09df8ad472e0d48f391c0a607e7d2e25c17cf0210105d6662635a1be0fa592454ad84934bacb483fd93e3d88372db7e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_7d1c6c7f51525b57ab6dbf2ec2f9607d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_7d1c6c7f51525b57ab6dbf2ec2f9607d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vgQdyOF.exeC:\Windows\System\vgQdyOF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlQnlYE.exeC:\Windows\System\rlQnlYE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eoEjIjN.exeC:\Windows\System\eoEjIjN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ympSSma.exeC:\Windows\System\ympSSma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MjPoidM.exeC:\Windows\System\MjPoidM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xdwHQKc.exeC:\Windows\System\xdwHQKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ysPotCN.exeC:\Windows\System\ysPotCN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuwHkId.exeC:\Windows\System\kuwHkId.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dpUdcHI.exeC:\Windows\System\dpUdcHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlhmBRz.exeC:\Windows\System\YlhmBRz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdquNCV.exeC:\Windows\System\FdquNCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\roXDlaH.exeC:\Windows\System\roXDlaH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UIohNnu.exeC:\Windows\System\UIohNnu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wSFDImF.exeC:\Windows\System\wSFDImF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDLFSiI.exeC:\Windows\System\kDLFSiI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wDtymxY.exeC:\Windows\System\wDtymxY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GthpWJa.exeC:\Windows\System\GthpWJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gHDIYyh.exeC:\Windows\System\gHDIYyh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bhKXvxs.exeC:\Windows\System\bhKXvxs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUtmFey.exeC:\Windows\System\BUtmFey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GEGFkrP.exeC:\Windows\System\GEGFkrP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56ed0eef07e173632492f40a6a6a270a4
SHA1ddcadb36e2f1d8d4939b84d56976daf09d315327
SHA256dd5e6f0f27e313efed2db027829e48842c4d54bf3f0d33b1f29efd4c6177ac2c
SHA512859b7fdbb74f332c974a3781c95bcdcd757d3a3e951370d1815065c0ee79b31b50399eb701b1bf4b7aa6337e96979f4625a46819f4d222d82285b81ff5bd96cf
-
Filesize
5.2MB
MD5b6d875aca4fe07d4b4f2863ff5ea3af4
SHA185010f9043fcd81393501ef60602f4046176c8db
SHA25684f9f62c9da42cc11f2d629bd6ef7f124e30fa9b980b5c4514c567c1bcb0fef0
SHA512ff9b8b3eba6da31d3805ba50a874bd057a033f8e867509080b431a43b2eaa8d09ebc581ae7f3d75ca4ede07718e0b3b573f7b856a75d28597c37fc010fb551a3
-
Filesize
5.2MB
MD561fb580bba7b5a96343e0107985898ff
SHA152831a9cca566c0159bc35cd9d38902a426464b5
SHA256a83bbe8b9ddde92d47dcd059f49bc7cf3a52b61039f57b95a04e8ea6863db904
SHA512f06e48b9c6467e2ef3127fad2c6fbf0681403daca3c8326f07c831137cdc4622625d1c54c97badee98c28fd6ab90a4314ff5dc7c7637ce3ff6dcb31f0722b056
-
Filesize
5.2MB
MD5d93985c040f4116f0545219032f893d8
SHA17dea618e88bc718559ead73a9a3ea46869577862
SHA256f12d8f86add577208aeaf191887f8bc012c306d92c31ce60ff0cc71717b56a09
SHA51281d53f48e648f9e35b57312528ef2d3d923fd7c3ef59b768a249b521387832568aa47cee61722a5a44a47f584e1cfd70a4fa50caec104dde0c2d9b51897619d5
-
Filesize
5.2MB
MD569066e1f021fcbf5dd8d51c30f59ec8b
SHA14f8c34cf0b28d7f20228a719a15702af220b594b
SHA256a0d53fd10c5c9f2d62c6f4916e7cb5450694d212578073223a73437e8765e981
SHA512e7aee6c124e5776ea38a12dbc868a0e92da9b2df29680b7f004a8b2ab5969fc6f1ab56f57e10b4ce4d3b7857d015ddd138c630fff9656feb08d58cc3543f83cf
-
Filesize
5.2MB
MD5280cb9f28073d1f4e672e61ea8bed3ed
SHA12d64076534b8f2e046112edcd4e653a1ac8d2065
SHA2565cb6c0d759f192d97c1bf3afe20e573276b0037a6c9a1e2cb04e3dc50844d382
SHA5122a5c7fffa435458075bca19fe4d5fae352a619bec77e05516cade189ca299756bc580ea45c6b78d9feb3b559e9a3539c589d705e3b1f05fe18e866633842575b
-
Filesize
5.2MB
MD55f906cb8b60fc306a81828231cb1c101
SHA11fe5744b92734a1d79584c4cc6924b998d693160
SHA2566cc1465dd61dcc8d6749db330dbb2e9b0fe6e05f887dd1b4c7b7f2a697299d9f
SHA512a350d3fd16a06b22ed6711f574ae0a468efe413f3d9f5a29370978a0f97d640c289bad8173e4226d2a286c2c7d4dde8e92aecaf742b00300b4a45c965b16d669
-
Filesize
5.2MB
MD5bdac80145f71408001fa3768707c52d0
SHA16ebeaa17e7e97f4808da0d230d9411735179dde2
SHA256bd6b82f1a50bfd7154bd13c28a51effd05176f09fb02b7080626199895f5ce92
SHA51242808be175622664e1dbc6bde644acbc2a45e39a172670ed400c238be76951aa6fa5d91d5f64148da6cd6444489d9f8c05ae15aee5d5d144e2ce4ab7488b205d
-
Filesize
5.2MB
MD586fe5c846b317ba7d33aad4acbcb4b1f
SHA1049dc8b0cd960d24250cb7025fac8d5ffbbc26d9
SHA2566b2bfe397841f287f1f07877b2486a59fa37916bab80ca30faa0676ad42a4f89
SHA51235c02ad4a3a3adc0445c2ed1b3f28f7b5a7961106b2a870ab97735a3ab531ea9adec33f28815fec8e6475ede6f6832bf7e62d11f3a2665d060d3506a74341ddd
-
Filesize
5.2MB
MD5ed2ec6f5a347db1a469c9f492985ccdc
SHA1e4cc11c7b5d0c7679b917104ed831360e3148622
SHA256868bdbadf609e00acded1260f9b1fafd0afa7bb65fb8240379a7c433818e19f9
SHA5124ee9375791f05ba5912169bbcc3a7492f53ff74ae9a8e59384e107fe541051d64fd67bc36ca34c6327220a3389fb1eadf281851f6b51a2ad6f18ffc8ae0b961f
-
Filesize
5.2MB
MD5029e99c70a73927aa01c4deba030e445
SHA1b9af570a4163f840ee978d066862b1e5464566cf
SHA256840f266aa05068771c9704ba21c912f7a280cd95c9f1c7548780a9162a5e5a75
SHA512553b15b254c52c0bb0a0c616adcba31078cb5780f3a39a695c5cc8b02890ba3f6341d6ab53792a072519230ec436368c2d6a5c7f264f57a90d359460588e5ae8
-
Filesize
5.2MB
MD502959ac19b7dca054357cff9dbf472c9
SHA116cfdf0c0dff1419579bb65fc48660705bd5f431
SHA2563c004b17c87fbece02f9581cdbfe0b82206a6194650ed836ea65edea1d45463a
SHA5124290e8f2f03cf00a914cae7131f07dc9b5e5442c12d6e57f7ee38bd79bf715bd5a9f81f8983454d13d75b704fc9916579cff80638aac9a225c96985e6ab4d23c
-
Filesize
5.2MB
MD58fa703a8a084516d35faa85a596816eb
SHA1b83db642307791c3cc8a0c997f6fffa7888dd107
SHA256872686a097ea6743da992e9439649ce1b6a436cf4c8e373680aa3abab8968ffc
SHA51224cd34b99c7e3f0e24dd805f5b74be4dc99dd01bf8577f650e9cfb32b2a8e1ff3e7c9d2a60ae00551f3ef89a8bcaeee65ba9544a9764fdf2b5dc65eb33f2819c
-
Filesize
5.2MB
MD5c829769505cb3d879f6afa5fd12db88b
SHA145c1cc0d6d64a1947dcb91b819880ac69fd8b3f8
SHA256f08d1590214cbaccc9b918bf0ffe02ebe68e80b8334b33ae467e62e00f594265
SHA51273f10ce12488ce57c7e76769fad7002375c0eb0f486822f04d100e051b388a22a0fff6b75bf41b92ff2af845eebb89494a3296010c2c09e3b4a7b85331fca054
-
Filesize
5.2MB
MD5e9fb3994176332df4962f2c73d108a42
SHA1f9c0aeb205c004509ad46394b3fa9cf233e72214
SHA2562e0e9f3584019a4c5d9556d1286dba251dfb0961bb52977d19f3ad335367622c
SHA512161c64e7ab5dd6ac10e7572c13b1d14b8afc9e786db027303b921a393d2803c41b87fc38eb429051182f5c34c623c49d418aa2e889fb1ee070e4d97a72947c8a
-
Filesize
5.2MB
MD5675795c4ff618db3878d81d69ed43acd
SHA1128a52432c63c7025551eb49ff37c95e7dc4abd0
SHA2562a7f859a1757264297af053b872e5f133c80dd22b07be5a9a98ba9bfc7ccf81e
SHA5125ee5f57e90be46b4a36d32947e99001fe6f796385535b2a9a9a613f8fa15141f6cc1864726fccfaf115938f81d58fc407837bec4817f895d2735e77e465d70a9
-
Filesize
5.2MB
MD5407501193521f2fa16f7a759c69c8fce
SHA12cc111924ae96486e8739531ad133c4f2cf49d14
SHA256d56cd689a72b9f67a4b05e9b31268d25b36b5219702212ec5eb2fa6f43164597
SHA512697cb9a4e5001c67c69705bd5ed37ee7abbe02f93a766f826f0483ba7dd9ba18ef05dd2b8f323367f2260b3fdcee491197d184d7bd523999031da2a8acd51f7a
-
Filesize
5.2MB
MD5319ff521d6f3e7019919ba0f2020058e
SHA19d5193d217deee66d75a79391f75dbcb0ed100c2
SHA2561185244fdeea53df5dc0b2c83a1af458ba1b3ebea1ea834151001b1c635eb401
SHA5121c2399620ffae81b3fc8aa5617bf7daba017becc1703198cb5e9d5cd983c8c3bae017e471213e021d47f13d83bfc14738f6b80425fe5e16abb3e23e27150350e
-
Filesize
5.2MB
MD5af466ac5131808c92d28f904ef9066ed
SHA12718860ccb06fe01432c0364d641fcfdf5e71137
SHA256d4fb7db99623b00f8f04032abda72c0b5fc099a1d09f5c898f41c6fc04f23b89
SHA512f8f63a9c403725c0b03fcfe386f450e80295fb202b8f9a6fef602e43c18da2a6c30a5516dca0025eab154483f3b2e7cf321d37eb00858dba85e3c26dc12d9770
-
Filesize
5.2MB
MD58198e2f296a00e9e7dd04f2a74e825e2
SHA17ab59b2026e5428fe57ee79d1abd09def8ce7760
SHA256e61355bfeedf5f580887de3b6011470978006c0c86cf18581b71ad52145c7425
SHA5128da9e452dcf7ec686fd6fd4126f8f3f93cfb5c0ed53e81d91adbb9a52d00c32fdf4827f5c2c99d81ca5bbcae0c147f4eb897d30d7f3748c94bfed67da35cec08
-
Filesize
5.2MB
MD531365d7dd6604267ac5da13f610e0535
SHA1321fcb48b4b61f6b41a0cd5d50f99da98cde8855
SHA2560fa734966750090975f4985379b1fc8cf9843a412e113ca63223f50141a8c70d
SHA512ed202a063e3d017f8b7e73d93c018536c6af7d8a94158787a7bbf1fd6ef741c725f8bebd3a8f2fb60feb7fef37aeb01f044063a43a34496920f8775d3e5e9489
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB