Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 00:56
General
-
Target
2024-09-23_bb6e80c2ae727777873ff56cefe949ed_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
bb6e80c2ae727777873ff56cefe949ed
-
SHA1
dbbae1bb0a77d17c09d1606f1f4707b2ab5b86d0
-
SHA256
20962710e1bfe91b069ef7a1a4c6565cfe6b57709894e1539c2a6644e7d7265c
-
SHA512
3f433743c10683c510683618a196462f40aaba1eb7ac862679be2e663d54dc6d47d38780900d7e2224c044f9fa7d5efdf00e02f3013585dc49f23342eecf69cb
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_bb6e80c2ae727777873ff56cefe949ed_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_bb6e80c2ae727777873ff56cefe949ed_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WoDSBJA.exeC:\Windows\System\WoDSBJA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRBkuBq.exeC:\Windows\System\MRBkuBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxIwNJk.exeC:\Windows\System\GxIwNJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nOOSBod.exeC:\Windows\System\nOOSBod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAWLDDp.exeC:\Windows\System\MAWLDDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SFdWUNh.exeC:\Windows\System\SFdWUNh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjDUhlg.exeC:\Windows\System\yjDUhlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjBPQyT.exeC:\Windows\System\FjBPQyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcGArQT.exeC:\Windows\System\jcGArQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jSkOIYm.exeC:\Windows\System\jSkOIYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aJOleeU.exeC:\Windows\System\aJOleeU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwqEarr.exeC:\Windows\System\HwqEarr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeEzAfK.exeC:\Windows\System\xeEzAfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRfIcYR.exeC:\Windows\System\BRfIcYR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNCkQtk.exeC:\Windows\System\SNCkQtk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frGcdcu.exeC:\Windows\System\frGcdcu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NTlRiyV.exeC:\Windows\System\NTlRiyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCnlinY.exeC:\Windows\System\uCnlinY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PQVMkoV.exeC:\Windows\System\PQVMkoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPHOMOm.exeC:\Windows\System\iPHOMOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XXlEcRB.exeC:\Windows\System\XXlEcRB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5caed72fc86b61b58c099bcbe8af15d27
SHA1af30d26f6530f616c548469ae948550da24725c3
SHA2568cb6e8fb63b8dd7e10afd63b753a8706e0c3ec3f959b56998e5b0e1a2600467d
SHA5128a5bc4b56057772bef0718486bd2728c5e9643614bd731bf85d7e889b0c5b642df5b9d61295cf067c854bf9647a7b60c40140079900c511b9a5fd43b0d470a48
-
Filesize
5.2MB
MD597bb6100ef28b1940b8cd08c7bb3e10d
SHA11a4350296d9e83c8b25af1358c1b32df1bb5063e
SHA256265356e20e28c92f237f68971eb374497e15e48fec74d666688edc23610ff459
SHA512b76fa6cbcb6ce0ca02eef2bdb18a588896f055bc84848e8afd4456492e6012e0daa70cec8d35ef2abce9e5b6684dd83ecc3697197327c6ecb2e7273d735408a0
-
Filesize
5.2MB
MD5b26a5be3424e93393604d6ed28ad79e5
SHA1d6bfa36e13c76e14db2be3405cf893d076fbc279
SHA256d24c1c6183985e9fc7187d2f25bbf91b3f5cc7617ebc7ed88b08397e157af9f0
SHA5129f10d9b91173a3dcb0ff66ede8f5bcc7abb2336cd9c8a67650c657b0c2404ab52c0150589a19507bbb3c35a2490a12569f648b3b96d62abc76a5643cadc1b9e1
-
Filesize
5.2MB
MD5a0c52344f1f60dfff944c8b04bd79218
SHA159d6e9064ff994a5bb68cd1a031d17c1876ff49c
SHA256adf8647a5fe6e8c898e978ae682bb31097f9e296c55fe679c063f47af6575cbf
SHA512385471fbeca6587684c8476205458f763fc5cac67b4e5fc2be34671dd6d933d9869a921ea8e96bcaabf63029955d2088bc0ed9a158aae8d5cfdecec40c6c4637
-
Filesize
5.2MB
MD588a82b354699ba02c1dacc43a54d91b4
SHA15058f852fd8bc789a760d3a5118c75cc9b5ced5b
SHA256e48c788b895a66ee732f360ff39df14e21c04456b876ae95a36835f9c298f1a3
SHA512f3d28e82ace2813c6beff1776449ea8732ae11e750d96bf7605ac060eacbd34aa2f09f35d81bfc73953c49509d280eb51b3e8120a97b3cb687b7ff82279b3101
-
Filesize
5.2MB
MD58f90ab3363fb6ac9c909d7bc5875cc9a
SHA1428788247fa0db126f24e40411d121ed66cea845
SHA25644a2dca1d06349c8de55fa3c985ac3d38086c02492dcd18f684f17592990014b
SHA512cd477526e264af6948563daa48d4ad9bde3d0166c5f1dd501bed8a9a2ba91ee6040a25c95ba1bb5119892ff58924658dd5a7222e0decb47b1f63042f2f10cae2
-
Filesize
5.2MB
MD55132d2bb0d4e3b8d76d2cb176df6647e
SHA151c203f18f3d6b1540b5d03563916135405fbc96
SHA256099654137d52bc9ff94c3366838d4c406f91086e1de441b5660d44448b569394
SHA512d73ccc6017df93de344fe93d109aa34b9be07fa4216b018dd685a69a33f792dd282b0b622267e19a540236fb8d6e87232ddea9073fb0367989d0ee7fd6dd29b2
-
Filesize
5.2MB
MD5f2f83bd137cf5d2b4444a9d3d03ac8e2
SHA1db80bb003bd8c4ec007c100bf407a543bd7fd4b1
SHA256cef254790e4be6111d8d0f7bdffdf906e7004a439e6b1e70da23e3cde12f32f8
SHA512cb085ff4ad4c1e48f011dae43744304287d0dfc878e7fdd710407217c02b3947e6f4798008ddeebf43e71f40017560292b0d24cdb12cd2d3d00eba3efd8db4aa
-
Filesize
5.2MB
MD55f6e8ebd6c4096d012b17ec8b2c335a1
SHA1e6f77c877b1ed460a50908574f60ef375a1ba8a7
SHA25683237775e8ba2a4827852d746bd403e8aaec6a5d808eb4f817428cc2fb410500
SHA512d08bd9baa8bed1534cfb3c335f65121e90d7107af507db97fbe84e0f03a8a0c93c0d1a6fed3d521c5ea083af8ef1fca775e62243b981842ebbf95f3702e3ac71
-
Filesize
5.2MB
MD506834014a57d4f7d50b1dd9a9bb4abbd
SHA18fc75bd97472d2a4874d1befb879118eb2a63f2c
SHA256499a2761c3593884724627a44a2a97011fbc275c1133e3ee4020f25fea9b7522
SHA5128a4ace31516cc0db78fde9b0576ee0beeb5f0f9f2d742a2e2a178ea260890c61fe19b7027804a838f03118e1082dbf071823b9115dcf17f74c2e8e7555b4721f
-
Filesize
5.2MB
MD5cbed3bcbdbbef99d195dad820d8dfba3
SHA1729da1f66cf87e39ac0441234a6a59e14d6ecd64
SHA2568f85f5c3ea27f68c1f76eb3657f89ace32897d4485d9a7220f984bb02428ac4e
SHA512f985f73ff50f0fd05e3cacb5b6ded612f706ea3a1507cdf494ab0c000ff28daac5d8840c8ab324dbe78fe69458d4af2f81b602c663d3e307792056693d8caf72
-
Filesize
5.2MB
MD516acc5244c264751a1a09383fc57b2be
SHA1198ce24d7be6b5eb2d5b0d62d4e18947c5d50b11
SHA256c6aeafb9af1a8ff36dd6740b598572aa2259e421acfed30a0492f30c9f76042e
SHA5122f171b51162fb100a6f140010ed234cc7fb5c31d3dd2ea8985c5b434c5622e8585ca59d0684df2060ab2f17bdcc2ba89847f50ac9803116f53d0d2798976a699
-
Filesize
5.2MB
MD5bdf5a9bf1b22485c6f45aaab7ebd8879
SHA156aeb9943762fabe5f82b7f219f259d2566e8441
SHA256f951539dfccf12bde081336df47b1ba0b9437b657a4d6a3d24c0379317be4b89
SHA512c944b62d983e2130e71c63bc9517254fb5d5570ff127e88ad9b08c816200e0a87fa2749c0159d15d15b24ad2b0521983e60b626f24b5e03516434c23c22c22f2
-
Filesize
5.2MB
MD5d979033f2c4259a035445e0187b6a4e3
SHA1a3897295f06e498a084b08ecc56a7ae3b135c981
SHA25618ea1370070bb3b19351cee4e9b86c982103b4fbd31165cf494d9b8acdae9d8f
SHA512b5ad35e743fa8e696c8a358f749aabd7b419851ce5beab6527ffa52df0f6664486573696e56e7822a5e69d6fdf499813adc8066e0c5243c384bdc4c4d5abc123
-
Filesize
5.2MB
MD5f691a7b0281f51f48a110acc3f50bc09
SHA176d370ae85052bf9a65ae4ac8269fffc7c5967a3
SHA256c8004ed69c85005ef0fb8d92148e04d415f7e14aa8c832eb4d7d055e6c355015
SHA512c808a47280b5880a308fae2825910c8d15f6312e1b8c07dace03172761516830f7ac7c5ba24b5ea1089b1849d0ea7e44609f5ff007917ca7f56e33a6fb02c5e5
-
Filesize
5.2MB
MD58f7fb9c9b3df3e68fda063497c8c4792
SHA12c288f03b6532e5a52c6a29cf3217b3ef705abfe
SHA2565bda1082b4694366d335818e450e8901a93020a9bc7cc62b4f17056052dc5a82
SHA512187853eace525719ea59c715f3a2f02c2c320d1cc417b782a2fa3409f7753b681a04b0d435d6c9863c45894c1fa443f6ca830c50f6dbd10714525f3bd6dd051a
-
Filesize
5.2MB
MD5c7885ef68615dcdaca89e399623838f5
SHA16f658ab159b0e5b90b4bcf5717e59fc1cdfeb445
SHA256043dd58b45d6dbb27433413840ac0f3b50746812a1e228148d18dc230f737628
SHA5121000d37f0ea053085fe73bef29c733d77e9cd9295a25ce08c328f9a00130ff00f4175f5fd96e233b2c1832f7006f6e39ee62b1660b3063ca67fc8af0a485736e
-
Filesize
5.2MB
MD5345d59aabbaeaec6adea341ac8734f60
SHA13746f0da1330a908da5d6913d5b3c7e9ec136b80
SHA25615e3e15acb3a510489616604911da94f34f363e6fb860b9a7be39cce575375ad
SHA51215f99e8bc139a5449c36097831f8febda763a2a1ee0327bc525ec2d4db8f5764b72e6512ac1e69cc03187dbb4c3d096f46494cef38efe068f695e224daaeed70
-
Filesize
5.2MB
MD528c62f08de824ea46bc1449cf2d6a433
SHA1b72443c4eed23bf1ecc403dd89da8316a80ae534
SHA2560feca13e571d555da5ce9b26cdb0cad66927d85f8ae98daa2a0a1259aa243d20
SHA512f739cdb38e5e80807d79e7561764525fb3d6f0b8378189fcbded54d21b0824c54f607394b7d1bbe21d3e45cf16283fb7bf883728184948388a6520a3e1c839f2
-
Filesize
5.2MB
MD555a9c12aaf81ae57b12147780e8e9012
SHA144c7045c86d20531986efed056d61c0fe4663486
SHA25676aa02a90ff319c580093937c272b95acd0f9fa09c3616a8f3f7338a8af2be55
SHA51265f7964fe057464eddd964298a4208e2e549bc08f7402cc461bd8cc9aec3dd801dee8c11e0b2f726a48064510787f7fe1d094b6c4c5cb0a7e6353ea80914d5eb
-
Filesize
5.2MB
MD55790f62e2718b3e950934df6e05d8056
SHA16db679937aa19905a487ee30bc21343058c3c37c
SHA256fb145b48c37fa47fff219d52f58ac2c060af25d956692ecf94a0555af64e8737
SHA5120d7eeb72762d299eef8800f4ccc5d21f032f470cfb08a48d8cb39932bf9094ff4346159f4d783c760262bf8c46614b52e64ecc1f29a90e265bb2e93edffd2973
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB