Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 06:29
General
-
Target
2024-09-23_53aeb58d8b6b7b0091d8cdbb1830292e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
53aeb58d8b6b7b0091d8cdbb1830292e
-
SHA1
6f46433efdf38c6719935cb2a7e874782cccd040
-
SHA256
53fca9194064ee663272e601c961549355ebbcf1ebe20b1ffbd85914b3455d45
-
SHA512
8f4d95c1ae3cb9271527506074dcf5f13b2659aedf2d98823435f843181eaf472a53edee7860d9a3e391e4cfdaa326152a3053ee7db83234da942572dadca7f4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_53aeb58d8b6b7b0091d8cdbb1830292e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_53aeb58d8b6b7b0091d8cdbb1830292e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YmwrjYL.exeC:\Windows\System\YmwrjYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nvpHOlv.exeC:\Windows\System\nvpHOlv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWQknKD.exeC:\Windows\System\IWQknKD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKvIpDO.exeC:\Windows\System\iKvIpDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dUmVfnA.exeC:\Windows\System\dUmVfnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uucltbF.exeC:\Windows\System\uucltbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVBLDVh.exeC:\Windows\System\mVBLDVh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tEFULxC.exeC:\Windows\System\tEFULxC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaxkODY.exeC:\Windows\System\VaxkODY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUShOVz.exeC:\Windows\System\RUShOVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zctBtls.exeC:\Windows\System\zctBtls.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTiTKeS.exeC:\Windows\System\oTiTKeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwGNsFJ.exeC:\Windows\System\BwGNsFJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uGWvexT.exeC:\Windows\System\uGWvexT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDhKywB.exeC:\Windows\System\hDhKywB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nXCnHBa.exeC:\Windows\System\nXCnHBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\avzjrkO.exeC:\Windows\System\avzjrkO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UrTETGb.exeC:\Windows\System\UrTETGb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQyHJuv.exeC:\Windows\System\wQyHJuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYndukT.exeC:\Windows\System\lYndukT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nWHBLXA.exeC:\Windows\System\nWHBLXA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ee7ca8c7be69f86578404bcb4810c9c3
SHA1f5b23f29b52c46bb9e9feff8cbfc43df76d3931f
SHA256bf5fafcd8b511cf14c3d2c73a1d0da7074ba49658da60c40e6315e51a41576f7
SHA512f7a031a1fec51dae03be6ed6a6195a525b8ce4e0904904655ae36aeccb53c664908f006d18fb3861ab9803072e940f5584ebae4fb24a7919614a1faaa7f9bea9
-
Filesize
5.2MB
MD5524c5e67e7f2296c77499d9232497cb8
SHA1fa94f4ea3bc3900d5a6c0b544a10b1a4d3e16796
SHA2565606b9d767ffd7da3e6322eb724684529de72c67dca905471fd5855ee05af190
SHA5122447ee5df174f81b0f5ba301e8949a19621489f0f0702028ee63c671e3d3a9c314c06d50ab28da8a26b6b98bdb53b32bf356afca655652c5cb19ba92d325c60a
-
Filesize
5.2MB
MD5fccf455d2e8d1cbc5d273facbedc9dd1
SHA1d8e78075fd382023368d6fa262eebd5451b6c755
SHA256a9584a45b285e12d73eb19af83599e16bebe364ae4ddcb11076bb20ed4966c8e
SHA5121394d4311a4c9511fe56d1726933a4208edefef5614913e489a216a970b179d3862babed998cffd08c8598cde466d36d331b4894f86af5a549e6e8c4548202bc
-
Filesize
5.2MB
MD5e7fd6c4d8d353baa71c450b0b8044d1c
SHA173988f162aea369979acd1951e35024f443710b9
SHA256568c4ff22372cdf8ab49cff11f09eae7d52521e7355f2bc8daaa94b52fe07669
SHA512dfc1170c991d0010a68dfd0e150998a22ba0c8ad8f5e9db6675aadde2dec479cd08cced6a8af823808f1645f123b7bad74b255caf4798e199fe7f109a0c864c0
-
Filesize
5.2MB
MD5bf0607c4c413abc8d3008de472ed1fda
SHA1313af2abb1a4b5bd00b5af04612815d3c8c0db59
SHA256d987c6b84da8280979b41a9cdbd0a4194c88e0486cf506afcfceab765def12aa
SHA512bb8c47f98298eaf435eb6b9aa7cb759d1635e468ce0d2ffb570b7a88840ddb981d7a18a7617cec90c299abfe92fff95a724b63efc1622d4bf781ee66b13aca64
-
Filesize
5.2MB
MD5337bd2a281180a0e4b2bd16d6760ab2f
SHA19b478aa39f9336074a88a47814f77dfd93758374
SHA256f85c048457d38e6bde109cfeaa814aeb46c67a713ff9839696e52f47593e6a7c
SHA5124dd35b6afb6c575491d79ed7ab8d697ed92de72217a1661eba66172dacea31748ea51ae74db66c9e05bada049e79d41240c71a87b669a15b36fd7c61d5caeef6
-
Filesize
5.2MB
MD5316c0405e9125e2d926aea37e7b34d68
SHA1476238e05f17e5d8a20a58e8304af6f8a74b0420
SHA256d6f6357b16edf7b5b271b1b42c1615faa289c713305d2a44745d3c1b001b2c7b
SHA51208525d7beca2a28429dfb2e066eaebc4112e1ce2faed4b58f0fe4b163e26967112675607c410f64ff101b406c53d51ad62424963332c257f09d50657799598f6
-
Filesize
5.2MB
MD5bf9e0b8fb652a5aa086d22e3235e6b87
SHA1269295c65628c42fb19f2126ceba02cecbebf153
SHA256c53e5289eddfc321c728c1eb3a1cc687fd4bfbc8539516676a4b96fb2bd81c8d
SHA512e55ad105d42fdff5152f2477ead032e7bc8b6ce081089fdb5a701ed00e235c89f6b71e6c07d919267dd38905a939351ae3fe4fbd83072edf17004c00475da17b
-
Filesize
5.2MB
MD5dfc09951ea1154a37692cc87734c368d
SHA188a257e742af8d41f0b350418f35697ccde822fb
SHA256e5eadba577c22c42ac22739447c3d187dfc09c00f8b7a6f2cbb36a66d3be4e9a
SHA51251ec4609af3c3c5fe8a6f4472daa9ddc88fd2d448d6bb7cd4aff8b5878a2513a9845eedfc8fae39050e79e11a850460d5e92f9d8bfbcc3da124d9a2d7a0a6261
-
Filesize
5.2MB
MD5e448fe95c349d8e2c066c1792523865a
SHA1097453bd857331bcf1ddf94cf8026b6fffc82f0a
SHA25617aaf69fce6ae4b77283ab9495f3c48252994d367d727248a8bdb71180ad2063
SHA512b33368f9efdff72a0523370fe0223ff0e335c20834c70b8fb3b38b2fe20ce71cec5ce5265fd50268ccc780f6395298819185c07162069c9a70492d897f692258
-
Filesize
5.2MB
MD5886c9b6708f22f30a72f090e3a47d06b
SHA1c6d8d0e5cb1f1b07362c1d6a86a5ec4cc30d0c89
SHA2568d1c6b1660d4167bc7910eedb519474ca3b783c0fd2070c6361f6049b112387c
SHA512b4a236cf7ed501c4149d1518c76f43f073db44fc16450195f89d4b281b27cfb7a56fb6430aeb737c2bbf872b74ff30704683194df2061f0c283ed55a7d1d3b27
-
Filesize
5.2MB
MD554e13e2cfb2e5d20d52ef33c5291d463
SHA1ccc9624469dd9373159781b71526ccd2706bd599
SHA256123b4722058d55f4aa0a0ed9260795f28ac4181b28c5cda4116cf2133af63837
SHA5125ad7d47ad4111f42d1e8dd16ad0a0869d4aecd7c26141d9dba99d794fd9c92f7af216eb9424802e6e554f7c2865644760cebfcf8c896a3ef95ca900070e6ccd7
-
Filesize
5.2MB
MD58eb5b870f7ae2451648df84f73fd49e1
SHA1609daa922e9b311b5b0a237453d31b109028b7ec
SHA2562a13a7a111e424c144deb77da7848ae7b12fd78dd38bb2efd26e006d4a63d90f
SHA51208d99a54c25aa308f0c916863ea68566fb65b73e621ec79794beb4823fea18dd26535f8186c534777e57b7625acd93f0f81dad7ab00f9cd31510adc20549575b
-
Filesize
5.2MB
MD546d698cf11d93f2306eb4210a1fd5dbd
SHA14faaf0a0008e9f93bd5bd7119fbd58f59dc5cddd
SHA2561b99b304b6455061dfa16d0858f780d5ab109fa617ee1ebc018f9c6fbee76b01
SHA5122750d1e7cc3ef8109f3d2fa85945e0bb11db7be764a2b147a8168067febd965c6be4141137d407baaf722076c67c2f6335de812d39df0516d71b82ad0e3cb72c
-
Filesize
5.2MB
MD5c24a346628bc53153d5d47c9544fe0f2
SHA1ba5917b75832be0a7d453b348675371aecaf241f
SHA25644116eca6c4b67e78f13dc59057937d7fda4e5d0422d87b59bf1ef918f8a16a1
SHA512d05b0d8f0205a74adca339a36a85ed191376ea5f64c080843c3ffd1c30aba6f73ec7b144018cc1d6bd9a4da557cf22fe04770cfaabd79cc2ea7cc8387f4920a1
-
Filesize
5.2MB
MD5de8fb389558b7349dc3487853aa56c86
SHA1555c6e9e6ea58e59f4ecb30df0c1aa382db8f871
SHA25687f35c69261fb3178d7d10af41206d16e2c899bf45a4f50c813bc9878fec99f9
SHA512d9ad15ce77542f47462384725fe5c309fde96e56946de48c88bd53db53732067b852478eb3ef8d094e9cf794f62ee4935b30b258df9802915a7629f358222132
-
Filesize
5.2MB
MD54ebd30c4e395f5040d09e3c2d95cbd71
SHA1e6a06fc7e741503e2047ff073d10490af77fa4ee
SHA25611bd02ce84cc5ee08ad06f481ebbde763b266851a90c02fe84bdac9db081c87b
SHA51208a77e1b6fc7e537db169145a2b44afc0d2ce427de890e4653b5651f94eacb0f2df877932005b246f21e26ab4b851c267c2b9967f23afe64ab25405001dcda61
-
Filesize
5.2MB
MD54f1b2edab1a3b59276e3d746228b0d98
SHA1ac3fc47da9f27b64c670866388de5ff97727410f
SHA2562c6b9d76e3113d19302eebbdf3efae8804128898732a7db39a124d294a898984
SHA5129c06e9bf1d79890446ca9927f310bcf8d35732fe732115ef4edb00b1af1a40e941beec93fcd5db0b004a8cd409b6f76ea5c5d57dbc4b2a5277610cdc9d385f8b
-
Filesize
5.2MB
MD56191201afa5efa1f159969a45f6f8454
SHA15860e11c8520348d64f7ae0a2f5b650fa91df2d9
SHA256b20afa8d1593c9bd24486073e0d97035b51c7d1497c3c435750cfcb6622f2072
SHA512a1fd248767e54f3cae25922aee88ef59d766616ec29533a6993dd834f409b8587467d292f1acfc99c07a452f1c482eb1b66b370172457479e261fc9c9fda0812
-
Filesize
5.2MB
MD5b5aece27d969d88848c19e7ccd2a1f7a
SHA1cb84593fd5ccead7c3eeb26eeddfbfa055d4523f
SHA2565fc2086676e2e4cceb64e1545b67284db6913a31edc5a8becbbb44febd3e92cf
SHA512ae513772f9839b252465f44f44f8b0de7f5b94ad62834c6dd7d78b616a4e6990aa3b16b20d853071ab0c7ae092bf39e323af309a4649d649dcfa5c59f1370341
-
Filesize
5.2MB
MD5dff2986856367a6e756a68f0bc729cc0
SHA10b5fc6b48fedb64e35c23b373148676584faa78e
SHA256eaad538fe114ae857b7b1f2ad3debdeee485bb846970d499233398a6e36ed382
SHA512536bd5cafd2b5794487d8456fe8f342df2368c9a9b6b49cba14179e27e4777ec191eec73b9f3160339153ad72f6a8a92166e4ec1281b2958f53f0e23437eb805
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB