Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-09-2024 10:54
General
-
Target
2024-09-22_44d6e4e3b976c8917eddf3a72f86fc61_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
44d6e4e3b976c8917eddf3a72f86fc61
-
SHA1
83701bb67ef71aed967e0bc5b56c2cb1332caa83
-
SHA256
908ff2d90bb8dffadeaea6b8039903e6d7719505bdb18d7f4715499bb59879dd
-
SHA512
3b1b56b26759c5bc29bb50d925b664515a76d7577225b236fad7206a5648045fff4831fb081496b1d1d39c186ea7fc3cd7123e1b00073ce0de6756106de0707c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUP
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-22_44d6e4e3b976c8917eddf3a72f86fc61_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-22_44d6e4e3b976c8917eddf3a72f86fc61_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nYjpkEZ.exeC:\Windows\System\nYjpkEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBGSJaw.exeC:\Windows\System\qBGSJaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmzprGF.exeC:\Windows\System\cmzprGF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsUTYqU.exeC:\Windows\System\gsUTYqU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYZhNDJ.exeC:\Windows\System\uYZhNDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQnbzxn.exeC:\Windows\System\vQnbzxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzDfvgs.exeC:\Windows\System\KzDfvgs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKHSOoW.exeC:\Windows\System\ZKHSOoW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeHMCay.exeC:\Windows\System\xeHMCay.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFQAilO.exeC:\Windows\System\wFQAilO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EWKTMHG.exeC:\Windows\System\EWKTMHG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgqIpcq.exeC:\Windows\System\wgqIpcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EmwTfZc.exeC:\Windows\System\EmwTfZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YNIIumc.exeC:\Windows\System\YNIIumc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TrIpTFA.exeC:\Windows\System\TrIpTFA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUAoNey.exeC:\Windows\System\DUAoNey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlhjykN.exeC:\Windows\System\xlhjykN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NOSpoMo.exeC:\Windows\System\NOSpoMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsMPDAX.exeC:\Windows\System\CsMPDAX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IJDEshF.exeC:\Windows\System\IJDEshF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CraaGAz.exeC:\Windows\System\CraaGAz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD543cacffe34a13fd8172640c6064bf777
SHA10cf4370910e601a87f59f1d153b0575bb271fb87
SHA25609a3560cfb9ff2cd74ecb42de3f7e193f995ae680fd06968bfe11fc525d408a6
SHA51247e889cd28f35bb1d2f973c97b54bddec95e6a288396053a3f66881bef7be0dc8952a798fb475fc0fe603f3b9cf36aa74eac51446404cca5cc236b0f6f7112cf
-
Filesize
5.2MB
MD5b113d868f9393256aa93a67545ce0b71
SHA18615c677f1d41657f9436f3a2e73051195b59943
SHA256d2184ecd8b4d17ed07075e16ddcb19d72896b96e25670b929c622ec73ec70c50
SHA51231218066768dfb990d824afba91a5b84a77a572e8f9df9cd14ef09eebbb169c2b6d8399e1908b7f4bb922d4b420e1a81878fce3b44db3d17424adf3554cb73e3
-
Filesize
5.2MB
MD50563b7737cd79263bebe1b70b7c3d517
SHA1be5d0d9d59e47a0c9c6ac546736519d1d94d7b2a
SHA256cc6b3836aebad77e1f3f328ac86e6255f0e400da8af07c92e608e2188c1622b7
SHA51215af70461550eb6bd93638df34535be8c0680403aeb80995f768b2b421f4f81b1d6fcd7e6f24b070098f4eb94c6d1b3ffd726e4059de28a6811b97c964e72385
-
Filesize
5.2MB
MD5cfcb07b05a1a29e53498eecc031b5cdd
SHA17c500f2ae8d4e83467c81b27f1bde3c6d697c766
SHA256470d21b2c5020373a47b0d039410e4404f9a48ae2df1b4699d523201ab26f5ab
SHA51262d18e8219ca35fce6b95572897f8e38e2919d229d3f6fe57b300729ed033e95fad58405f72c2efbfe7612ad10e8993d924cc3608f0ce65ea5cdcba3fb54d280
-
Filesize
5.2MB
MD568f3d544c45ee9f7ced64a708b55b5a5
SHA11cb0304fe9a52dc700b37d125d39f762c87ba0ba
SHA2561ca6d49021d70794a2d703f83b7dd5dd2395448269f06d96b727705f952d188c
SHA512ec9220b816e6d8d409d0724265e87b2b9ace9087a23b5badf9d88bf467c4f4235d2baf0cb4ab7c10079eb1651cb0c9b5842991c71a29d33889d1773d6e32a3bd
-
Filesize
5.2MB
MD56df3cfe5eb2f34d679477a35fddb9023
SHA16177550ecf0e8f6d7622b0a28e08eae658b780f9
SHA2561bd4eb0a6dbbec9f075cb3fbcc541d6477dc8c4a457d4259f9b194eab1200359
SHA512aa414262de91a28121c73d20f280601d69dfc3bd5af265f6a1c2ec71e2e644be21cbc91710ccc59be8d326744ec2fe3e72a209ae0493d43f5f3c9c8ee9adfcb7
-
Filesize
5.2MB
MD5f1a28aa608b41f4651800308fee7792e
SHA137490b3f1700b709953f7edc94ebf2e3625a98a0
SHA25682c2089745fec3f8ba0058285c77f42dd0be4ee7a2a0eeb51cd0d477ecc2c078
SHA512a50bb98482ca3baeb353ed0bbfa998979498872e9175dd019ccbd32e08cdc233d1ebcbaf3a412ab96707dda4579b804aa67aa7d156d730a98a953a7ece3dc11a
-
Filesize
5.2MB
MD563d1999e211b332883fcff87e48a1cfd
SHA1593c785202c0e6d3f31c85056f380894064586e0
SHA256c21e663d7178cd137eb68e2e9112d7c34492ff0e9eb38c0b15dfd3c1986bedc7
SHA51292c9a00a180ed0909887ae871dad7a419136db6925135087f0cbe475f71c693ce32f916dbb5452cf490a341e96907edd08f04c2baab6cbb477a2a1e9f00540a1
-
Filesize
5.2MB
MD5e07db04178ebf12103e68bd12a7f4003
SHA17dc361c3db90889fdf2f7cb8b1dee49a3028aaf4
SHA256ccda53cc395ef9d8c848a1980e1d0197045ddfd4fed0e7bcd1da81ae0d740899
SHA512d83fd4cf1d9d2cdbec2b72f2d64e2ff7472a8f76cb85cff22f067905ae6194d346dc41f9af62a929eba8cb4f2ca1c8bbda7ab01fa1458d009aecf3515dcefaa1
-
Filesize
5.2MB
MD57097ff1339ca9b534ce32c38404b47f3
SHA107c464d8fd50f9000f7c52d3360a4dd352c68c65
SHA256a3294123a7114bcc9a2c223997a1668bc62a37e1fe0b2be4577b6c3bea94038d
SHA512059888369944cbaa500fdb36bd88684306f350d8c57355d0ac6190331f11ab9a87b5297b8b84b3482be7242ce5501c3b09c9cef51f9a9a463b68619d224c2b14
-
Filesize
5.2MB
MD5055e14c63adc3639c34ac47b00654f77
SHA1800d8d5afe7a875df1b6749fb3eb1c963a83da08
SHA2569ad8933281cf65e1273328e3ebd3a274d6a88f72b1f81fc87374df8a65646984
SHA512319c4cf7cff81c4021e07d662e7be5416f39179067fba39a8b0fc9ad05a6f1df79d74cf50e858f12cfd713c782e4605a4306748a0ea7d855af77fe5bac7a9d9a
-
Filesize
5.2MB
MD5460d63c8cb7e811be9e3c1a4b893c5df
SHA13f11644bd0825c96425ed1fbbf747d7fea69867d
SHA256ecb001a989f6439c43977cbe8a2815e3dcc07140d765cdb5f052a855dc6ffbb5
SHA512f9bf6ae52b2c7c552362aaeecdd23b5ce8bb90ab8a4e7fdd5aa6ad44d31016ef59186d2898fd112b9a96cad582749d9c550348c3bd372111b11c3e4dfcc966ec
-
Filesize
5.2MB
MD5c56bb4e628a62240262777ee7bc1a60f
SHA15679101fd64fff2b566b55aba2c614a96a03488e
SHA2569f030a83e86bbfb1f513b6e9f1c3a8b452a7a8b84a05bc7a000d72a3523a208f
SHA5128061b2f38fae64da2e27b965773d7472791375f52a5b4f364433aeecfca0b109c7d8a4d639e5ee747d825f4d3993c2ba4c002b6bc3db9d0247733ae7ed136d38
-
Filesize
5.2MB
MD583a92b71fb94bdcd420baa4b45c02309
SHA1b27d6407a30cca92b6c025bbdc0cafa4ee2e2f85
SHA2563607897bf65fd2f1e0437444d6c4c402c38a98c996c9f53ee91b405d838630f6
SHA5126e51e1752d61fd9e775ae0ae5f464aad3ed418e7ad493d7f52c4f98164d65ef857fc5f627ef01bb348b185ec1345d489316536796256f9b825878fd22c9219cc
-
Filesize
5.2MB
MD5b05b1a8e2d99467097ded259864148a3
SHA1b746bbe445d13b243816ae74242e28bc067acc6f
SHA256254ff19808838c59bb6d4e95cc900dbf2857f07bcde8b40c464f9ab2410abcb4
SHA512290aef2dee777e7842b9a3f2f9f3026d5a3eb7f7a652976f27e8658c0b9e870ee670582bc4b52d4d032f7c013d5e2c4d7c382c2bb519dd615710f1ddd2e80282
-
Filesize
5.2MB
MD5467e47b521c33f3f96f57bf866e206af
SHA153d466474bb761bee324a00805c4c35f9415e8e5
SHA256d2aa8dc641d6679d80ffa444abcd1bb573e115450e8bc5c04e119667c30d19eb
SHA51285057e957fe25a7d4fe1f8bbf60663c5b0e21306550e675314013c9c744c14b51f66d45bbef8abfcfd404a3a8fb8be33a1dfa6f7d1abb084dc582c8cac9c44d2
-
Filesize
5.2MB
MD5a3d182a54687e46dba278766064aeb65
SHA130b8fd299982c5bbc325dc4a8c18a4c87bfd392b
SHA256064a972622502498e258dec7d520dbbee2f6f1826049a23c45071114cf8c3817
SHA5120fe647e3239dd23149da7d2c3c7d41dd16fb451477ee10f3727fc466e75a27f65c9249b66ce752b03f0cc7e50ab02a2c727d5b68be26529b41ac0b4d8661f550
-
Filesize
5.2MB
MD5099d6f6115a29610c80e0da56592bf1d
SHA155001da591f8c5931e70be894affaeaaa5a50a84
SHA256f74fe793bb74a35073164d836d0b2c95b00b21b144def9b930e9740a94a59239
SHA51228d1e6f27cd65ee5382ed3f24da9b27feb1bd41cc42f9f30d8e933a29d3057f21fe562d05e5cc03178169f9928679bd890c98e995880c4477a2f4268b22f40cf
-
Filesize
5.2MB
MD5a1bc535ddfa7836d566968fbb68f8051
SHA12f915cc36a20e39c9bc282a0b666013a8ab3e3ce
SHA2567f00dfa599c28b72d503703500a785bbf1375e97e17370078da2a940e60be0e9
SHA51259552baf8d9fdd2fd2cb772a77da4cc8e6e2630fcb85d67a6d8215da65ab15c723bfba84e6bd27b1df8e96943e93c51bc947d1adfb50b72b2d89bc0347beeb33
-
Filesize
5.2MB
MD5bd0ac3c8e12f52dae2004c23b7381020
SHA1fe457b51321e39c67764f265f16250df86edb530
SHA256313e378cc710ed2c6c924c3de6848137aa9e44eac55911dde68f3d3cf53833e5
SHA5121bd7243926696d4b466d8d21f1088857d33f5ec67c29a0b2f0cc0e751f538867c6c8bad755d2daec363e7b0998ad1d34635dd97359897bd6547ce5b2ed2b2dd4
-
Filesize
5.2MB
MD567bc4d580506c121e4e14787d853824b
SHA1d72b337ab836ade7ecf6e610744236d3de33006e
SHA2563e998cf97411b770a41e1a194fc3b66cd70bce7c95bb657728e8a8fe2c71828c
SHA5127f3b58d602af960592cca104252787b05ce04601e5305cba8154c16709e7734008beb9def9817c82aa6f2cf5631b8deb14be9d434924d496c2f816c6653fa2a1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB