Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 00:48
General
-
Target
2024-09-23_81c3a749f6e58253b1eeec336b240a54_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
81c3a749f6e58253b1eeec336b240a54
-
SHA1
ce074767f2e9469d7d7a81c19f1f2fc5cdd81a5c
-
SHA256
4dfb6e355c06d3ba30bbc53e6a515dcc16c537450e375c767d5752a1534bf29b
-
SHA512
9788abb2d0b2daff4faf77fec34c42061ac2048d1e0fe4502358466979aef80cb076fc28d07b2f91b7bc7f3f2decb45a581acaf5e1e55a505c904209a77734a9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_81c3a749f6e58253b1eeec336b240a54_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_81c3a749f6e58253b1eeec336b240a54_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vGqJEXu.exeC:\Windows\System\vGqJEXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dhuxKMr.exeC:\Windows\System\dhuxKMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBDrzHA.exeC:\Windows\System\bBDrzHA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XzXGOkp.exeC:\Windows\System\XzXGOkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMEhleF.exeC:\Windows\System\AMEhleF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlzGFVX.exeC:\Windows\System\rlzGFVX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KfJtMQu.exeC:\Windows\System\KfJtMQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fQNBXkE.exeC:\Windows\System\fQNBXkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imnoxFt.exeC:\Windows\System\imnoxFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgxWtvH.exeC:\Windows\System\kgxWtvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rnGDSnV.exeC:\Windows\System\rnGDSnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YCROjZv.exeC:\Windows\System\YCROjZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BNEuQCq.exeC:\Windows\System\BNEuQCq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIcKafc.exeC:\Windows\System\JIcKafc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZULxDes.exeC:\Windows\System\ZULxDes.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnmsnzQ.exeC:\Windows\System\xnmsnzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wYNFUBF.exeC:\Windows\System\wYNFUBF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETxfkxp.exeC:\Windows\System\ETxfkxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pHGNIsF.exeC:\Windows\System\pHGNIsF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYPknlc.exeC:\Windows\System\MYPknlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udAZbYi.exeC:\Windows\System\udAZbYi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5647b78180b3b30f0fb923097de57df22
SHA187611366b78a4e5b01c1cb7d9c2b0c9dd734f102
SHA2568dfd020b643a4f01d52e0f48bebb86a3366d92743e4e2a252b357827d3f7f3f5
SHA512d1e717c70964749595f1713f589544339c649e6d1af638e6c4782693a3f0754dfe355c4bcee7200ae9e35e846bd90c49fd8e4ad93d47a9f292e9a99955bdbd4e
-
Filesize
5.2MB
MD548dec1b8498ccd677c5bebe7e917bfa9
SHA11d13a8d7d9d32ff7d6ca012fd225d8385aac0eef
SHA256c57ee2488f8b23d1814bd2d7f3deb6925164c85a0ece1f2a4afedca39241e23b
SHA512fe44fd46c028f3bf69718c6929b1a2288b7febbb5de4b8b294a4de459c2d49680558343355258c6028f0d8ee032e2aa3483002932ab8a5b76aef98c78a3ad352
-
Filesize
5.2MB
MD569f97ad274e6a20ff566b26eb0fa7d0c
SHA1b439e40dca979acd825b68172928e973c4ef12b8
SHA256c9cb309e60142dfe1b033dd6069840fa328cd596cf02f892835df3a88061da1c
SHA512e5776db6caec3645b2ade9a1a6985e056895872b6db909b4eecfc3b7a976cfc5f84deb02d14aa2c77a4685cef0765411dc229a242a187f3f09ef4d967652c959
-
Filesize
5.2MB
MD5f615923d00ae3368b3e378c2a5d519fb
SHA1cfc2b5ea2a3efb55bc4b9f81e1c9ed16ea102ea8
SHA256a2ccc0648726703b6f7cc88fba4c3c142caf8591c082441eda6c1630a1887fc1
SHA5128c8d5db55245ec79db7cbc857df8a2e5cfca3edd5e8f721366af035aaa903929d8a6f7db6d31a675c9548891bd1a7ef94bc510979527c1b983b1010568b83df9
-
Filesize
5.2MB
MD57bf9017e62269b199a27abba7fa068fc
SHA1b53d66c5388a5bd9503ba391886f4f6b5e2cfac0
SHA256f344ccdecb26d245fbc896b41c3b75d0da7aa9db882315387ca29da6dc32087c
SHA5123d336208bc0be0c3a637fa1339559811e6630b760d994f772c4e68e00fdbc5df108578d19a5f83a0c78fd329bc7e22c7b79237c0ec7b0060116614c08d675946
-
Filesize
5.2MB
MD5e0f0f746cd29a94c446629576a0b33e8
SHA1790e8aed5ce35765b7af8f4e61da5628148d5dc9
SHA25607941af255c7bc135b6ea01fdc8489bdd4e813dbe546e76f496d6ae0e99f1953
SHA5127cd2d9cdf3c24b35353c7853a2a13320560102e30bad7aaba739d8c1dac24fd1fa1ec6a1f7b6b3e52b3a3296f4181cac152af7e91dcea8346c7a1cba5133861a
-
Filesize
5.2MB
MD51b86f7fcf11ae48b95b8eb38649d8673
SHA13a90f0d5fa505c1254ec4d6e53fa392a96852916
SHA256d5140091ac8b1687a6771a51a4ef602f0e277670a4a0cc5d96cf26fff1acd4c9
SHA512deeef07c2f423cc9c838da69857748dea4c39aa3df3da179e670123bc2248fa5dee06abeb01f490e59c5a587d857055d2f9a0d07f633935436b7508f7f03a9a5
-
Filesize
5.2MB
MD53254feb888fc0367eedf78f855ebeea7
SHA1729870aa7c5c89d24f938639846e6f39ca5d9086
SHA2566d3849f21fd5ccbd02d060220d832d241f69fea980b39fa4f5ac635c8bd37b9b
SHA5128ddb8bdb85928708e9d9e102500024e9f2138d09265e7cca0f30cef66ea3cecde8eef8b466160801bb1e933f1cf136a7dec05f823779e823b7ab137be66e9d43
-
Filesize
5.2MB
MD5d203a9c6f38daee67d4ff6e6f1a35b98
SHA1e4b660d6d1bd5247811107f69fa26c13eae9165a
SHA256fe8c2617a4d9db8e0636de26d35842338f50dafb67597a98830a95acf772fafb
SHA512e819f0a0906d2430d5ef6406a9e5ec17a08c13230e3f74a3d283b60f9d9623e11b75113680d5d782976c848352481e45ece301d58c2ceb4a94e92f358fd3c5ca
-
Filesize
5.2MB
MD554d9a07e7f149d6ab3f8a54cf506cb58
SHA161d6f5f4fcdfbef8e2d3426ec7dc3fea7e22b503
SHA256af456883b565fac39673ac5a3651f42cf6d135a66f7686025a90f8afe25e834f
SHA5129f85ac1f8f09f7ce385b7537540f53be8d32b0790404f9b876d55918a655dfa577097985bda14a0cd4e631188a1665f0921491b0fd71337e0ec47ba52a82112e
-
Filesize
5.2MB
MD5a11722564c86d25a682590bda8eb07a1
SHA18e5b200cf981f12a73fa66d25228e3c28d487cd4
SHA256017f2bd8fa12fe348ba02c8b2311da54c78c3f9beddb2a5b5bc4cad7ab763863
SHA512108dd5fa9b5878adbca544ba90148691b2255837c80acc5f1c90c1f6c2de9291c8ea8a12aaf1ddad6d73d55a21302f001317178006cfd024ee033d0b8220d9db
-
Filesize
5.2MB
MD58b7f99c7da430039311f50eb2cdb7bf0
SHA19eb5eb2251add8b467a7349be7f3e15669492c4d
SHA256d96d24a4bce8bad10981f971f13f0ab7cf2110d6290dd3412166c0fc44b0a46b
SHA5128da7cfb445f0f0f37668c3f0ec3d393807f435179917c9726cd7d7de951f121daa4223b7692843da26e2870711eec19d4b290e6a2d79355523fd87a0e9556ebd
-
Filesize
5.2MB
MD5a3bb016a8455b7405824d1b6ab550f83
SHA1c6305748c442d5bb52be6cc44fc60cabc51cc0da
SHA256e63e8e8f662e390d687aec9f70458778063d2066a8a0df71077fc9dace9564a2
SHA512120f7680afc976f10d3568e5ab2ea107298032fa27e2f8d7c730f71aeab8fcc87f77e567889ba05f9f3b56570f7c376c2830aaa0f1636b741c05ec0efb96ce9e
-
Filesize
5.2MB
MD54037ea9ad47fcca5d6ca619765e5ea39
SHA1a096758a9857743658c5bc94c37b4d38ce094bda
SHA25690764d436db0b7b8f453eaccf0b55ccfedf376c0eac94dcae89186d19c163ab1
SHA512e93db76fd8ef474abeded709c3425f3210ed9d7eea413dd4cbc952c5755ed9d583e71bff789e03594c53d50c1d64c5eb22f972a99932a74001b80f85ddcc8d70
-
Filesize
5.2MB
MD51951d1139d60600180444f422860a8c9
SHA12db34597089435d44aeac0315b4585566a91108d
SHA25660fa80100e2e918e2ab31f0a9069aaf029681722434cf9842d432a3a2284bbbf
SHA512ba1121b23ab90fc0557f70e1117ea49cd2c496e5b076075b6a2bf0a0418878750563de303357641c62204b2fa177fce746bfe938fa938cf00bab83d6058d85e9
-
Filesize
5.2MB
MD5cb5b300d1a0d35ee2f6648e11872be70
SHA13c6e27dbf631b58b23155e81d9a29b4f3cbac10d
SHA2563cc771f2ce6b739e3219f877b3c71282f0943f0281101652fac5cefe0628877c
SHA5129a203fc8d65d302ff2a0d13727e93e53501dfaef35bcd71350aa69e9999637d109b098dbcad7da97403d96bb82643d1df491c8c09164dd20d76b639b5357612a
-
Filesize
5.2MB
MD54f316c9ded33a61de957ce7ed7eea303
SHA1cf6bffd11452e9b04754bc5629adab720127f5e9
SHA2567132653a37e1a86dc66a6ca77f68f06baa8a7bb011c86a481884eef72183cf5a
SHA51248ab3219d58ca4532426f9bdd5f4e1e12ca60f347c6bbbadeb91e5d7354a2b7213c93df7fddf41f4a59015942e8ac93ef4fc8bdd9641e525d8fac88c43a89417
-
Filesize
5.2MB
MD51b02ba4abc3399f4a099fae10b8c23c4
SHA138a6d450e9b596ef0cd5ea4eca2535b7c5b292ad
SHA256c2c0621d5ccb0b612dfd2ea46371f361867fe63f8d11784ab383899aa52a615e
SHA512f3b3462d469321634cb7d608e44347c66c36a59d1ccde75d8472d61082cf4ff259db525ac943a3ecc8391a141112ed826b4f2250b4455057abc547f492c9a933
-
Filesize
5.2MB
MD5999bbce8c46171cb2b02b5a12b9fb9ba
SHA12dfa7056442e6b280bd6d3794f4c4b63239e9dc1
SHA256fffae774d6be619fcdb19c04a8df16812b33639e462bf55f6f3e9eeae39f1e25
SHA512d80cc2414687bb272613ae698d8e8224f78541038c2f267dc782d464990cca239d66769d6cd3f1f5b9c8b4e98a9c73f02c558e45046151cca0526d2d958e9a73
-
Filesize
5.2MB
MD59d19a4a878fdcac2cdbb743ad88a94da
SHA1d6e0f35434b2649aa64969a72a74fc12c32424c5
SHA256ff489a41a80265b093d28d3b210d95d57b3a9f39da6b47dbf6739d9745dda688
SHA512572a34594f9640c4c098671660d2abc087c86bb8d7f852532d615d088f0b1dfec3637ced4084d73a10c053da067581a49b059a3481c24cf5505fa56cc2c312d9
-
Filesize
5.2MB
MD5b54ecced0f3cae679ab7f6276441dfd6
SHA15e0193505b189d493d196b52dd40bb05800a6c52
SHA256831ada38f1efe23957a31340345117ff2b8759c79744d55519007035ff6b6af1
SHA5122ea7c5fb1363724df1aa8d0c141113c1fd737846405176cc40aa9c4bd98b57d657705cfa745a08e1d21314b4256730f769e3503cfcd10e7da3435aad18f5f403
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB