Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 00:51
General
-
Target
2024-09-23_92a362dc0458e8e1ba9e77588de76a4e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
92a362dc0458e8e1ba9e77588de76a4e
-
SHA1
e821c8af2e4ac35e32318085caac60007c3d16ae
-
SHA256
8dd968fdbdee8c41704696f7a4b2ae3c98d7789f9b1ea05c5d91b9a28ef416f0
-
SHA512
c45ce9a924e2cea8b1de0512590cf0bd62d04f7175c7ead01d43346031142fe5d45c13cb270b8ad958f5989d84308792bd59158397c7e1f4a39eaddc670a473b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_92a362dc0458e8e1ba9e77588de76a4e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_92a362dc0458e8e1ba9e77588de76a4e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kZNeNsx.exeC:\Windows\System\kZNeNsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pclUSkM.exeC:\Windows\System\pclUSkM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PxhfRTe.exeC:\Windows\System\PxhfRTe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IjDxBte.exeC:\Windows\System\IjDxBte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlxuvUO.exeC:\Windows\System\JlxuvUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VrTBOug.exeC:\Windows\System\VrTBOug.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lyyCGSF.exeC:\Windows\System\lyyCGSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfoVmTu.exeC:\Windows\System\zfoVmTu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sumzrlw.exeC:\Windows\System\sumzrlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kJLPGxv.exeC:\Windows\System\kJLPGxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuYkqHh.exeC:\Windows\System\BuYkqHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GttlDTE.exeC:\Windows\System\GttlDTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfPJUlK.exeC:\Windows\System\jfPJUlK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbtITCy.exeC:\Windows\System\WbtITCy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnNBJrc.exeC:\Windows\System\SnNBJrc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APjVmYG.exeC:\Windows\System\APjVmYG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MeQwHCD.exeC:\Windows\System\MeQwHCD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hIGhiPF.exeC:\Windows\System\hIGhiPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpxUeHf.exeC:\Windows\System\DpxUeHf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urVWybu.exeC:\Windows\System\urVWybu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AZlSxYd.exeC:\Windows\System\AZlSxYd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5baf1d9e49504476a67fb978df47de5b8
SHA12b9727d1573c618caaa659c35ee158b1fd84d816
SHA256a9bd69e34161a42c3661c3e80090ccc882ec1e47a4896dc4597db03ccb79f783
SHA512bea819aedf126f44924ed3d9949ff6db2e9b41e6720f9640c81093df39bc70926995e625a82fdb98f2cbddb028569affe6e5f3d907d1d482fc40dd705f2254f8
-
Filesize
5.2MB
MD58a6707067c5bd370509bf356fac204ee
SHA1d8a8e36fa9aa635b8a6795290a5da53940b7fa2e
SHA25629cd72f6ef62c5934fc66f6423457c3ac9f5c8ebece1aab636f4a3170bb21841
SHA512c4eff388a85e2d073d24e1dd5e8226bd50a3bb179f521c664ad9d314bcd88c07fe2c265780db920f6f5dfecd7934afd105c07bd9a245358388f82c5778ee7277
-
Filesize
5.2MB
MD5cea72ffadc97e3ca86e8767ac9c58729
SHA1a2126f15b3e726c4423db13f0fd7256cb5e9ddc6
SHA2567f39f1c85ec761107d6f4a0d85d5eded8f2075fd659c00041f918004b0369073
SHA512b7c27fdb0662995886d4c4c451fd5aeeca6bdb87db0474b153c3acc871c5c63dae748ff0282a52723f33e1b694fdb03409327ffd88bd3085848b200ac518251e
-
Filesize
5.2MB
MD5d72dd0a217ffd9388ad106344f16a14c
SHA15e4adf53fbf4c474307f5e4edd90b1d3ae777ed7
SHA2568ff3f9eeb0edfe33a14a808a080f3e0825a52e2f23c6ce519173886ddffef1ff
SHA51296141acfe5172af421ae1bfa6cae40befa1938e76c81ed65e6eace3bbc079915920767a413a15eb1bd2e1d7d45958f263d373cc05bb5e9b6b1e5becb529e6c1a
-
Filesize
5.2MB
MD5c02ac3cb40cadbdf780091de8d9a946f
SHA1457ad108d8284a559e10317097f1611009ec459f
SHA256c24e18ed52370e9541d466b92210280868472f004ed545be9eef76290b5cf46b
SHA5120d5988ea8100dbca97a3c10c57a19a411328bb82fb193d8cad798d22baaacce0f9a42dacc8aceb5fa9ce14acd8764005b089c5e53c3d3b303f52405abf488185
-
Filesize
5.2MB
MD5e18271f5aa05770a0bd295f5efcb5801
SHA14cb44a6f34a831699fa9bc39da282c496da32044
SHA256ae20ad3033983f95b24192e46502701218023599977a22be97d67ddb625068cf
SHA5128636d22f789a0aebcd4ff5434e69fa239f0cf13bfb9f3a3c322199c37f23a6fa263cba43159430df1d00d6103a95575b8dca9ae6441f917c09d33a5e7e360cf7
-
Filesize
5.2MB
MD52ba873d28977e075ab8e319a3e95b7da
SHA16bc893b47a0a7ac1ecab070245941443af6d0697
SHA25683f13287c43810144f897335cc9afd13b7a6ea28e54c2463c2cef53f944004d4
SHA5128fa31a28cf69efd2bd5f1c61ba3229315815734ddb41e6b708735c8dd9684eb38b1dec80a52e4faeea8d53bc864a89b500b3808d60dad57aee1b6bdb795990e7
-
Filesize
5.2MB
MD5e43b9bed3d9e8daa6e53c55748073a94
SHA157c192018c84f9d033cac7dea7b534149849db6d
SHA256345e9fde9df5e0fffeaf9dc9d9c89e4695de74c3884ad7241bc2b3e1d823032d
SHA5129671ca3078843416fef5599cfda0d926525860dd06eaf1b8cc28b921dc94ae57339f80e4163b42a02ac0fab8534e0e85295a00e2b57a49cf9b56ea9b3af1b278
-
Filesize
5.2MB
MD58c1ad9af2d32e968104efbbda7d747f6
SHA100cec5fac4608aece461c11e0e6f5ba6a9cd8bd8
SHA2567bef545b6be9f45a197892994ffd57ac2e1ed70a6b88995c2fd45f4d41a6b8a4
SHA51263aa3df3584e5947d9f99f0b3e441da1dd7e8e5eacfa7893e83f511e03ce30405b42b174725235bb74b59c4cd84eb6cfcb2a88b3d98e525c4106ba505c4c1271
-
Filesize
5.2MB
MD52a95c0f031cc40a6cb5bc26f82fd6256
SHA1a87e70590a998a5b04808d74bc00d9243e94e773
SHA256f20e2878d3ebde0469aba72d4815d5d164859a68d9f6c0d64bfe43c008bfe216
SHA51220d33e5a9136089dbf0b18236a81d3b2b7bfdf29d25e7ee002e22383b15b30a9164842bba4908810e7ba8d290eba599f478d0b49dee565002d63acd3b7129ed2
-
Filesize
5.2MB
MD5175870ab4b203b4246dda11fa95e0581
SHA1b71dea6f747cba98f5ab21f9ad0192847ada9826
SHA256355396bb4a79eb0340a3e17bb0a383615d072c9d684a688444c2e8675d618b36
SHA51231ef7a933c9038bdd08a9810a9c911905d04fdf22415a63f5f118feb33fafbc387fa78e8ea5a499fb9d621c431b00a94ee17de65def3152b91c83137b5922cf2
-
Filesize
5.2MB
MD54b559ac573c9d648180d8ad6368affb2
SHA1cb149cbe184f487a430461be1bd66c1105f7cbb8
SHA2561f3be55e8817592b309b5d814f2b0b31c45c5fdd8b0831c493d8edf577266183
SHA51274371f815d6197602b69cc3ab76607d4f32e3a901bcf69cdb49fbbba45de961b49b5681c73819e368f013e025eddbb8defd3ca14b0e5643c7b5814ad3759613c
-
Filesize
5.2MB
MD504718c8407c050cfeb36576a8712e9fd
SHA13fda7cac7cdcc66417ffd9846bb8c990aedfb968
SHA256d7d99cf935a94f0eacd9be771d8b0b9b687c67e1cb2d803490fa221061e856f0
SHA512ff3f920d0683fb4054689c2692fd34885bf4dd2aa51397d7b9f37d814fac91fec6e937620a7b80a22885eea3bd7049c140e9cdda0d40eb941efe7d347db6e752
-
Filesize
5.2MB
MD5a5a0cd3ee4ce4f8f1ff4a34b3f4279ab
SHA11b80391d15b3edad97f00434d54e99207cf35622
SHA25601f0c8c0b8fb295e6b82421ed62a481f627230dfe55393335d12b11eaf276a57
SHA5128e3fdbd9eb0bce79353eda1462a0d4ed9e13a3b84327c3196543a8c8798a045c19be017b6842bded2f61dbdc353d25904721a75181bc99206be4a4d20f993be2
-
Filesize
5.2MB
MD583716732573be84c7506539ac02c54c6
SHA182fae560a52d3e5f01cce2513e72304dc96f894d
SHA256b7f32f58235b463389001ba8918322d28d0b1b947676310a13ac0e69f525cd48
SHA51294631cb6f7241753ff77df1fce38fd072521ef49157493e809981dcf1560143b551c2eb89dfaa10f36cf271171167bd75d1922ea3fbb0c961f5062944f3c3cac
-
Filesize
5.2MB
MD544150a16032ee09a9b13f0a3a0bba53a
SHA1d6caa36a29168084c99a37423f994daaf994d20a
SHA256835f3cecafe7af849fa0d631d551dfaa59af178a30ba1145c406438c6ea2160e
SHA5120da1b3cddff0250ce4e26864a9abe007ca102258deec5b12a5f477945400c6f107ab3e200ef1f61ccfa2737913353dcdd910b34b6dfc6d3d9598357f1320f3d0
-
Filesize
5.2MB
MD518db623ff2e4c05022da21ab86fc39cd
SHA1a392b0e3b6c473af4fe1358d8580ab54ee5c7225
SHA2563e9f3e3f3b62cd175eed951a4dcc1ae5ed283fcbca9c92afd8c33b7134980d84
SHA51255d961163975bbdfbc47fc6068570ab960db5bbb12e7e740272df73f0ff0ffb1de1cb6549c3a0c008188525b700605970679a542ed4af5ef7b42f3308c9c84cb
-
Filesize
5.2MB
MD5872fff94b023a41bd2699554541fa5a1
SHA1fab183fb7e67f383c081ec37e177ca5921a89257
SHA25648ae49959527e9106c7c3501ae7f0a98f53c589ac86764a7138396f101a666bd
SHA51298c69559097a354f5df066035bcddb777329d1f9f658e29f120033715e90d9a455764e7880316c7d9c3cdb0cc2741ef17c189126d946fff6424549c35b65648b
-
Filesize
5.2MB
MD51fa07b63d3b00998f9cf57aeef26da75
SHA19be98bbfee8ad2bb93332435aba6242b3ed4dda5
SHA256566fea8653cb64267d098b9819352f30d01dc458d7ea44660488cacb2db53f63
SHA512aa914a72a22bcd482cf35bc5d148dc95a0b0a139e546adf6d0f93978fb0714862323a1582e30dd0349fac753f4c190375d5196009415fe2e9046e5a10b7d1f68
-
Filesize
5.2MB
MD5fb465aa356e991fa22a90edcac367046
SHA17152ace9434e547d0f19f5e775082acb57614507
SHA256be0268606be27ee8868603d868216cdf114a4c9d4913b2d493fdacbe6f2c4c91
SHA5121053fee1b83f542ea4f5ee58eda29458cc1fe356c5a653feaec575782e84bee6f22573c4d25df7b6ebaa1fff7cc7f408cb9ff3459d2bfec8ce8da44ae65676e9
-
Filesize
5.2MB
MD51dd6d1757d8f78e7639a0506c96bab10
SHA18c97cae1d3a8dd3ee86539934f66620eb851eae4
SHA2561b306edf8c34c3282e90e71709a6c300fbcca471fd503c59d828d037b71ca749
SHA512f7f686893b2eba8107d75da08c367758a689db4f262a651762e5a9228dad6fcd2684064394ec6e50c275108a1ef0189b9caf54b952d6075622314b6016885534
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB