Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
23-09-2024 00:37
General
-
Target
2024-09-23_2aa920cb83299ec85f3631b2cadf8c76_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2aa920cb83299ec85f3631b2cadf8c76
-
SHA1
e893124e609e327a7bb49d30890ddd1fe05f70a6
-
SHA256
5801c3c30dd9513f727eff3dfbe2deb8c720d32e9beaeb0c851c123e066706cc
-
SHA512
754a76a5cbf7677cf75f1cc92836470e0dd509161a98787e860853ed149de8402b330266a1055b89e1b5284c4a6f97663e9c718d22df76657ca5dca23b4c8111
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_2aa920cb83299ec85f3631b2cadf8c76_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_2aa920cb83299ec85f3631b2cadf8c76_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oRfmszA.exeC:\Windows\System\oRfmszA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qwkEYsp.exeC:\Windows\System\qwkEYsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CjPEMaD.exeC:\Windows\System\CjPEMaD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHnaqDs.exeC:\Windows\System\vHnaqDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jecSbuM.exeC:\Windows\System\jecSbuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sEpuPkg.exeC:\Windows\System\sEpuPkg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IATGSHY.exeC:\Windows\System\IATGSHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rUFzWLS.exeC:\Windows\System\rUFzWLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WtoCTYz.exeC:\Windows\System\WtoCTYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvvZAWg.exeC:\Windows\System\kvvZAWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCgwlNu.exeC:\Windows\System\NCgwlNu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCEPODz.exeC:\Windows\System\GCEPODz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvGIuHT.exeC:\Windows\System\pvGIuHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lopRFxg.exeC:\Windows\System\lopRFxg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LAQAeCM.exeC:\Windows\System\LAQAeCM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wamAkIp.exeC:\Windows\System\wamAkIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQbMyPw.exeC:\Windows\System\XQbMyPw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WruVECP.exeC:\Windows\System\WruVECP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JpADpmN.exeC:\Windows\System\JpADpmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTGFbIP.exeC:\Windows\System\lTGFbIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMCJUwS.exeC:\Windows\System\vMCJUwS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ac6cfb06db042dad390a4f68ed9f1796
SHA1e444a8ed3a61d7fedf41d672cfd223a5973079f6
SHA25608856bf193170eb284ddcfbdcffbfe649773dc12e5f18e400940595184ae5317
SHA512ad9d9e5488086024ea477cf43482b3b2d6c7c34dffbb6f2c6b96587e1d120d37aae9aef8c1ac048b6675b4004585f2d3161b357bd570b3ca57a04f9c805dcf89
-
Filesize
5.2MB
MD5d393ce4f0066b33cef5d44c61e8ffa34
SHA174bf24c1afe6afe7fa9b14497617eb542a8746ff
SHA256838f81b293dc9a9d2bab186d00495836f075181748f092520ba89b05118c96d6
SHA512d777eed894a2d35661e483474fbe2aecde7d91e2a2a513fa6cb996a535b12824fc9fee8eca8d3b1a8546ac4b9cf059b3271f50f3e91ae13db2d0ae2adf75fa9c
-
Filesize
5.2MB
MD51704a159c69970e3dd970059772cebdc
SHA16c90a60cda3314df7867ebdab546f737821ebf1f
SHA25639553fd31798725edb9eda7f013cf44b790839b2d6bab43f397bf20f6d3173e9
SHA5123d44f2a4df26034b871c08847e7d62cf626a4551e286efa12ec0970dfa36bf00bc0cd8829c9a04d49fabaa73fe1bb1c7e09b7cff6147540f9999129d3da0defa
-
Filesize
5.2MB
MD55e4aef44e2b634a4df4faff49a96da89
SHA1f49c4954b040a17e27f1022303aeadcbb8bf6be1
SHA256fb9b699666a1d4c2e5715d2a273e735dd280b3c0a9e1b1fc7fa10ad6a21364ed
SHA51259e421071b1196eac9b58c9515e7d6154a994e2e21060d40f399e1b1d00bd071f8e0003e63597439afec2ee1145c3dd7cf81da34162928271d36a3547d85ad46
-
Filesize
5.2MB
MD5ef7f5b93ac5ee01081feaeebf8aac5ab
SHA10b64d2b4c23a902e115f606a9c95daab8e3d7116
SHA2564257362daa0f2bac2328153a5b50994d7d40d02a7e467217c944a0827a344b49
SHA512a4ff51518150f8721f470e35dcc0a38102cc760b98f8cf2b8ee38438e5f567a8c4292c9f40d7465e73326272c06a5fb77d640e56828013b13e3782c406a9ce8c
-
Filesize
5.2MB
MD5cf845d5ec0fa81fb33e443d75231d243
SHA1dec38227e2a6416c85bb06cdd2e689f814643d57
SHA256a8f142578903bba9009c958e13e07c662bb5de778819b5d46764988d180ad8f6
SHA5126a6f586789e60397d67b8358110f3e937da7fe3618a833dd37e2edcca5d2b269dc2a6ce91d7d3854de14cf31078c3b3b27edb357a425e90e2b745002be35f575
-
Filesize
5.2MB
MD5adcfc57b808d068c7b9cb2ec5bb716ba
SHA149b0e8b91bb229c39e8f9c9b9cbcb5d1dd8fd907
SHA2562e17bfe5ade1310505fc9737408b90ab769dca77a26b0f2ff1552ef569d4f4c5
SHA5126762dff0dc3ebb79412e2579e9c643cea4deeff73c9ae62ea1f522fbe57421db39083db56d9d7621d28eec6c5749fae99db2e017c89a1a5ccc91b876bf728aee
-
Filesize
5.2MB
MD58b3e70ec82d719f6dea85a1c03639307
SHA1cdfb073c293266d81fc1617affc8988aec11eb2a
SHA256b0dcf43c61798d95c5181173557165d7e73d4eac1cf2297aac3849e9c0eac95b
SHA512987c41516a0b754b05f19349fc9de85084a3f4cdf56d2d306bbe53e6209db147d8477b3cd2e33b98e17ecb61578e53f166feb126ad0e1917bcd25ff12a0e9fe8
-
Filesize
5.2MB
MD55574ac2f452c14900b69b8bdb6846114
SHA1ab92d0be03cab1a93a717c7cc81c9f4e7455243f
SHA256593ef67ce9bd32147aa054a0bf4beb74a4771ecef7f226e0479df3d2a586a3e6
SHA512f54fe6cee9cfb46625055ef00dc365c2f9ad8efdb044c7a35ff5192d163c6e0717a52840a624df33154deb7fdd60034a1a3669bc4ed140e7ff0bcff3beaa1187
-
Filesize
5.2MB
MD50b02d0b3c999cc99c2f8b082e1b51233
SHA15c6eefb6c6ed766672395380336a7206cfe626f5
SHA2562d6e677b954b7578d272d71670341a7796654f346c96b98100605b0c68a5bb9c
SHA512ec7451f637eee8bf78b1611afd1ec3fa8e754eae7e40dd45cfc606c207e3ffa4a9255d5f4daa87ed9cae522dec34d5ed93b4f3c14de4fe4055e2635a0d0830bf
-
Filesize
5.2MB
MD55822a4ac152dbe7e26e6134840b6faf2
SHA11438fdfb773969916f034c482ec40ef5a33089d5
SHA256f65dc88733bf122f10cfc3ec199b01758ed784183c3dc933f67305712dee77ac
SHA512af9ef281df7457a14be4e57e03d4ca85bceeef931c564d9a83d8c3a09f555131a7a7b3f873833b49c5ae136f14f5c4b7a72c6b881a601beaca9d6d96d59de90e
-
Filesize
5.2MB
MD52d60b1355bb82c5932d3d3dd4756b580
SHA1b3bcb865939ede099e8f4ca27f1f17c8091f2a23
SHA2569c2e0b9104d6e562f8f6f65eb25cd64a369bac791e43d77ac421590bd0c4bc87
SHA512a84a48450b931df52dde6bc857cb10b59207b4fb3f74704def08ce4b04817232fb0eaf1a39d7dd41de1118864cea003f6fe5fd459e7d69751efbdaa05f713ddd
-
Filesize
5.2MB
MD5f86760a6c4836d33b4cd958bb2e24043
SHA1091b781299db7ec3547c6c7cdec736b92ed32eef
SHA256a807663064132b1b5f35fc444a7568915c704f414ca9fa3618360fb53e9542d3
SHA512b73facd2003c2731671558f2139b0a056efc1dce211d960c0c336ef7b01bcc6f745228b7e8c403986b3941d21448b1f9d2fa424950aed7967daf213d2b71a7e7
-
Filesize
5.2MB
MD5e25f35a5044384f23bcfaf35e44f9c8b
SHA11068fcc6af2096410e52141c771e4159dc315476
SHA256b1d4bf57af0fae5267e9c2ba0bfdd0cbd1495bb183957861f5e9b3eae2af4a12
SHA5122fd9e064b9848f61ccfc85288298966439ce64d8ab613d9685fea097fbdd8871d381f25f3f92fa7620f4c4dcb8866566192697a80c5be92dec3d605a76092bce
-
Filesize
5.2MB
MD598b59c6aaf260cf375a17d21887ce605
SHA14222e006d7ac1cd4e4fdd43a3f56a94285c2c391
SHA256664092a6a1536f8d82198f5b73e435e52ad3ce8ba935b44a93fcc99562b0b928
SHA512195e0d387132cc2d06a50c85891110a62f56766c6a92d30c675d717d5a11a10aaeb0e7544b818f705c523b4cdb1d3817bae435c4f8af67a491891dc2e0200840
-
Filesize
5.2MB
MD5711f2ee36904af8882ab206475925526
SHA1a0b8931b8ba6df40cd2280497e0d2ede9206b18d
SHA256bbf6070f1c42a749795dbd697000c5e420017e27b2d10feaa4a2d0c5a9348ce3
SHA512f76b21f2498d4d9b8b8a97b69e192e0e0fa5ebe8cb211f7c251d09b410c14d96001d760b7e8c83a81e7ef9647e4db579d03cf6526950b266c49184c1c9ac7e48
-
Filesize
5.2MB
MD558cf60b0b07512a04ba9a08f61a31973
SHA1065f5562a69435175093b71910e62e1c5757dadd
SHA25683955606f4c8117f87e5f2955bf8094ab2680e153a8d5f02e40a064db1f6f479
SHA512376ff5f1ae6fd4b25eacbb9136630b0077eb89a125670e68e2250314139cf56a8fd040d363723863562b1247bc925f281bf8343e784ae120202b37b28a4a59cd
-
Filesize
5.2MB
MD532f0ef398a0c813c16abc2bea3b496ce
SHA1c1402266c3569b4ab07d0a0982824105fe7e6113
SHA256e7448f8ec63295ac32063624812b3dc505ec51df29b820a7336616682db79b0b
SHA5121e695d7d64d21210283c2ac65f6ab1f1b5f7aa8d53626505e21d7a15017cc71b19687be520c50f5adb7b918f5bc300e4e9c17ca5f3a2db154e212321f65ef219
-
Filesize
5.2MB
MD5b14be589f1b77ff5ad3d0038a5c19a51
SHA12b15350dbfee4a4bcf4e9973affee0c2a3f1aa14
SHA256829c954af9d0683e0d42ce6012d1ffebfa3e5190cc3e359c67ce0b3a09fbd384
SHA512233b96cabd78d1bb5f70f1b6bbe5a45a549412d331a5a3f0ef19c806bb4bddbef73c1f98f612c3c73b838535fdf35be73c21d85dee1fdd8d55214325da016fb8
-
Filesize
5.2MB
MD59793150d2c3dad25df6460681f8d2013
SHA1dca1e350bf999002782c4e5ff13700257fd2b9a6
SHA25626e8ae51622c534a78a14dd1c13cae0f03d154cab4d0f6f36461e25550d06a55
SHA5123f888e48eeceba3598694ab3ff8e8473097293c6854ab92f67fb57391aef6eaa0385a6c999c81a6988702943aeb42f2b945d5754d982deaa9ab9e4bb5ddcd597
-
Filesize
5.2MB
MD55c5ba8abab6270f6f89253a1be684f69
SHA178d82436239bb46784fa2748ff72b370dfa51702
SHA25693893f05c6a70b2da79e0fc53abcb522d9926bf8dfe322e9c3454a4a976f2b60
SHA5127e3ca9a93f6436eba082808ade594df453b959a75f42989d78e931f955183c4a8357907e2c6090d76bacef93622697f5b4ed1cdc9f974a181159fd08de342813
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB