Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 00:55
General
-
Target
2024-09-23_b5665f5a6c6642773008fa9c09b57119_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b5665f5a6c6642773008fa9c09b57119
-
SHA1
ff3d9dc5ff1dfc6ed9d39c8b327d9588d7bb941e
-
SHA256
8dbbd0825422fb0ec9597c29fac8570df720fe889845b7b231be97d2b469f73b
-
SHA512
e31d199f6f5afad717f96262b026b75b94264828430ef9f84363ad591dfdd5a199f78d6d3ba897fc9b4976bba25871e47326011d48f656311220fdc30dc2d2a2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUQ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_b5665f5a6c6642773008fa9c09b57119_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_b5665f5a6c6642773008fa9c09b57119_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bQkhygi.exeC:\Windows\System\bQkhygi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfhcreH.exeC:\Windows\System\jfhcreH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFvvuQs.exeC:\Windows\System\oFvvuQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYMrIBX.exeC:\Windows\System\vYMrIBX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UajAPiT.exeC:\Windows\System\UajAPiT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlCvQed.exeC:\Windows\System\LlCvQed.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WZsMyqF.exeC:\Windows\System\WZsMyqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSsANEO.exeC:\Windows\System\HSsANEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLmvkbL.exeC:\Windows\System\mLmvkbL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLAjKIU.exeC:\Windows\System\dLAjKIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKeLYjT.exeC:\Windows\System\OKeLYjT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KsRltME.exeC:\Windows\System\KsRltME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\stIdlnr.exeC:\Windows\System\stIdlnr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kIwarSt.exeC:\Windows\System\kIwarSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqBxZib.exeC:\Windows\System\rqBxZib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJquohw.exeC:\Windows\System\QJquohw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MlUXXAS.exeC:\Windows\System\MlUXXAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NrGSyjS.exeC:\Windows\System\NrGSyjS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQQIiwL.exeC:\Windows\System\eQQIiwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcOgvoZ.exeC:\Windows\System\PcOgvoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHBxpiJ.exeC:\Windows\System\qHBxpiJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50bc96cecb5be549045dc02a0d5824f13
SHA1f63efa5c3ab664f21b55468a7b1cc5ee8c6e8b50
SHA256fe11cf31682b53dee272826af91839d6af62504e9c24102afbdff759ad7881a0
SHA512799911622c076ac046f1b56afd7186efd1185ba4f19d45c1725a34347d52aabc1645351c3815311fa918a39f0a7a0d0878869342c081c5a00a8e18e2f5e7bb23
-
Filesize
5.2MB
MD55b558e16c70da21472bba9ae5a914c5e
SHA11ac44acbf6648f91c061186cbf54a0a8f9610c6b
SHA256c62d26adb33c4d11669d38794c23a5e74ae0421fe9a32de26893d4c858dadf96
SHA5121b41b07d3479dee553ae8d377a7f905faef58ad691d90c6ac2921ebed879682ff729f317baf971c97fe7b0dca77408f6770ebc63bbe8d881ba794d5d5c3e6af5
-
Filesize
5.2MB
MD5646f834548334f7a57db09b5e23baf6a
SHA190bf0796c91ebe5ccabdb5bdc85846880c716592
SHA256aac38a3e6160cde4707830c7d0740638f5326770708f85f1a87b18f1ac21e291
SHA512ffbd793b08c9ab8b7717073a3edac94dd86c328afe31129ec0db12fc884a7d31d0789843f6e1396240d695cb69054248806a61cfb281a871a77b4beedeabaf7d
-
Filesize
5.2MB
MD52d1f0a42c13faef4e7ffb0d4ad60e7b1
SHA147a9f5ed48c251b1b75697fbb9d2e4415c1a3479
SHA256bb8f3f12f9e4c131100c0292939c9c830ec461c226f818eeb7eab398a495fac8
SHA51208320d4035e59e5b3331c1ed99053fa7c4cb5c86c5646182cb8f1ef89f183c57c69a69bfc04179b873ee562aa175c814165a91a587cfa6154a7b89e16e002107
-
Filesize
5.2MB
MD5b53c02f7c1bc3ab6b459d9be218ac2d3
SHA12a1e69d9c24619fc432d84b9f931c3330e1a448f
SHA25613f8ec8e26b363b401093b8d6901796c7cf9f502118a3fe992f6e02d2238bfbf
SHA512a5ab14219c9a878f486db0a08ab370464327417d8982d65744f4909aa933039eebe5e5c583f0580a001630ed911f96580f803822dce547184819961efd276d42
-
Filesize
5.2MB
MD526e0ef2b17ab215abb21b1ef85259372
SHA19e22919d23f58e57fd8a1238896e816553903dd1
SHA25688bec0d92f4cf2b112f7c2fe7e9a1e34e8f9163827bfa64b544fb3bff0b96188
SHA5120aff85df3dc9c4b465180245622216507efab8d7b9f785b56f867af6d5cc7f3e3ec8f6440461331c9dd925a5e09e33d43ecb7600b2fc3571b8c066d3b9f8d722
-
Filesize
5.2MB
MD5b1c847ab8a08c72a7c761d77b7b4b4f8
SHA10949acac44ec8096e9212bab3a76f5d133194204
SHA25625e83bcc4818e83a25504af8a26342da5dbcf93fe4d1813c8e84eb482128d927
SHA51239345deb6a71aa447102ed1bb12a02661a37d6bfe7564a64fcf8e5b3694b17712e46fb6113b76840ffa59fd107a349a2b0dc9829fa143ccecf2560c4df3c348c
-
Filesize
5.2MB
MD57fbfc38b1a7d5ddecfbb6430f226d538
SHA1e55d992738513be1ee887cdf531a3c7179d0d17f
SHA256f7fc7cf8e143348dcb878ee8f7de999f835deb869d0a7cc46683418a36a7633d
SHA512fa20408af4f85468a52ba29d9091942481af116d877b2ae79710d7470fc91a115888b2595a9785073358526ca37535f1a8a21236fa766d529e413aed517b48af
-
Filesize
5.2MB
MD5a2fbd9da3ba78efd2efa512a594f8610
SHA18fb79994ed198605c4db7c9f19110aee18387cd9
SHA256e7984c37eed8d1c5fba8cc79c74e10742c85e90b9c102b8dcfc479ee2e42b21b
SHA512d5b56a8f741e311a6977fbee84e8fe63e11e83b08dfc3620bd20090e482bb4a819b3cba8f279d895be298ab8d9e04c47109fd609185780e735fb2a62732a9394
-
Filesize
5.2MB
MD5e25bbca0f88da487eb6b8b051110f3cd
SHA1bd881ad141ab47c8985e11356368e6c3e03d43d3
SHA2564a43aa4c31220e09c868ed91fcd634d0a652966cc3128702820198165985c80e
SHA512e82aaa3529dd6011f7c9f1df3ad21b7d5dab87e3100ee34586b5589a033c7966d11c230ef809445ffdaf1d1a380996e6addac6e2bae73b68916df79b55985c9c
-
Filesize
5.2MB
MD5fbe8112172deccd8f0d530bd07cfb485
SHA19f1b8b302043ee1e8ad08f5cb283801b95bcdd6a
SHA2560a59f79caa166ecd66d7696ec5e869f12ff528e1d18382750d9f6b8f35d4cb21
SHA512a46970c484778f7580a1a65fce2d8cdd4102c8e69502bea2c892c443deb66a361622626f6fc8e7ca088467439b7bc67520ef26945285dca264922eda5f675bf9
-
Filesize
5.2MB
MD5fe159d88238ed9b32a916fe4c69400f1
SHA1733aa3a203de08d647d79dead5eb47e716688a89
SHA256ecb8949c39307a3bada6fd4e38373de33f59c04d6819113f823bf6c5ea05f9dd
SHA5123dbcf3f6f92d9e37bb734bc39052ac419f03da39f0528ffba7606800dcbc2496eafa079f35b68bca482dbf199b07c1d9b86f4931424ae75e3db7f6c9ddefdc5a
-
Filesize
5.2MB
MD55a6f427221ecee4660a00efbde55a80b
SHA1c06498d21b3cafb415b1892d9bda0ea4b0eee2d6
SHA256bd87ac7374eb3c4fd8df90c99cb0208986f6237ac85389cd764a05a4877ec838
SHA512736acd9d1250735f9359aa6ce9372d038f27f9d079093153044ac50bc4293d952dc8d372ca071c58839886452c0efae405810eb1c2da7bd725bbcb9fba3ba13b
-
Filesize
5.2MB
MD5e7ca7f2962be6adc1ace86a00debd52d
SHA13b46df9b81e02efcb726848589375d42ef30b6ec
SHA256dd9918a7907cae8268a29217a463f568b4b54a544004da84140fc508973806ec
SHA5124eeceb89a0d915b85febac28522772b6a595e337d4d2e16d811cf2a75e6f8f00027c8092f8723daf49f6d2fbab28f28d04b7bb0401744ea2ff4a8be2fc1af721
-
Filesize
5.2MB
MD5de9f20142d14b27308c4290f0bf961c1
SHA1e04258b72cfdb4ec5746838ccd7ea23b8484d6a1
SHA256affcd94b4ef37d2be4faf7e0d99f1ee0c0eaa09de2493f007234864d41d06a34
SHA512567d1215afce92796c289f0909f5b4c2712298492a4ef6dc8a342996a3c0155d6f35e6ca4632447fe5dc97b34bc4542534d9e56cf54db8259a8a44fef7b81dda
-
Filesize
5.2MB
MD53754d691f27a428ad6c0a725d72eae3e
SHA19ba9793cdaec6967f9d15d902ffe356d1e361bbf
SHA2568fd1b7f2651175f3c1621d3871214b12ade071a59f82e5d59fe72cc443ab1843
SHA5120ec91beb464f651c047d1d2ec49edf1991522120e3abd3da2242812874acc5e3988c2e91338aae52c7b7a7d12c85d77dbc24f9a05bbde7351b1c4b221f02be51
-
Filesize
5.2MB
MD5ab768714698564a4a917c182b97b816e
SHA1b2593e7bf6c45a3803e9254b1d6d4b2f9e6164d8
SHA256841fbf39d965c140606d6c98ae8f909b396b61824fa050ad79668cd7f5c23c45
SHA512485e7382612722a4f3f86f6eab803672500392e1d8d9ac99801ae9483c08db6e040da250a0a8387d295de9c4fc27296259ce6c9ee48a326c87ef71876b820255
-
Filesize
5.2MB
MD5ad3959282b1bf9e8e3e21cb0ffc779e2
SHA10ec93fff87f714a865dd6a396decad238a265a16
SHA2564a8c307ab563bee3e30d5a1e2ef99a9318298b2479386aa633e5419f814f83bb
SHA5124e300444baa85fdfbc04f5bf910bd0b735e8f492291ac841440434221f82cf3ab22bee79943070a6693654253581b9b0d4c7b814da06766586bcdbd551a78643
-
Filesize
5.2MB
MD50d9b900631b456d89eae1e73ead9682d
SHA1798c5153add3773bf86eb31f2cffcc9245f48a3a
SHA256a3a2d3d3ddf561c32a3eb1f4ab3539f984948dba40f2ad58a47b8b53c55396f2
SHA51288ce8bf842b78fbd13210a5b8d19773e1a60c59948f871938c03a5901baa72a15f9530b17cb71c80833826fb8d006efc5b7a47febaa5492796a30e2b92766cdf
-
Filesize
5.2MB
MD5632e23c253c5891b1a3996f952ae96ce
SHA1390066b811a12a3caee527c5faf9e68f6df954b1
SHA256424d5491b0d8791b6bf3677ea731d7e288146fba0c734ebd15cb6f3e25b8591b
SHA51225e58c4f16f5c174123b48553d3b3a663b3dda3d034c47088b569a8e722d18ac4da481845999143d86ffd60da808d4b7b9f8d84933a68cdca6c19f58d71b642d
-
Filesize
5.2MB
MD5636b22235bd1c1f8f47d5ce57714573e
SHA145efffb829f51a57a42a6fff263f19cca5d0cdb8
SHA25617dd4a680bc1ea7716ea033a5da4e569efdbeb5cd5530e8ae7406846b8d31228
SHA5122bf2204aed5078b330046d60e2046adbce7cb7af376a648b6186595acf6199ed54a63007f2beb0c15e872349a812bf571b194ba3e842b390a5f501c8d6aeb8d5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB