Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23-09-2024 06:30
General
-
Target
2024-09-23_5f8b8ef95446d470d0469448586a4775_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5f8b8ef95446d470d0469448586a4775
-
SHA1
20c4c9375e2d4ba453b6fe78b05527ef94b966ed
-
SHA256
4eb0d2675d02f378e5f9a24f0aa69b8d4d5a93b740d78f09daf5a6f14005cb24
-
SHA512
19c94d1fed2e10cbf86924c8a8805b8e4583ae0f3fedc059a479ee1d246add6e51341ca7ef537c943d1fe9ca00a3d13b0c3b2613ff53d94cb12bace7b8610d69
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_5f8b8ef95446d470d0469448586a4775_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_5f8b8ef95446d470d0469448586a4775_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jVbxUjV.exeC:\Windows\System\jVbxUjV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipaRMBT.exeC:\Windows\System\ipaRMBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlHxrOT.exeC:\Windows\System\nlHxrOT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XGGyqHB.exeC:\Windows\System\XGGyqHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BhJNRRb.exeC:\Windows\System\BhJNRRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uFoQbPg.exeC:\Windows\System\uFoQbPg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cGINvOr.exeC:\Windows\System\cGINvOr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBFYBQq.exeC:\Windows\System\yBFYBQq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uwMsaTb.exeC:\Windows\System\uwMsaTb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhPPhxv.exeC:\Windows\System\UhPPhxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kdopuiC.exeC:\Windows\System\kdopuiC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvzhFij.exeC:\Windows\System\AvzhFij.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mhkRjfl.exeC:\Windows\System\mhkRjfl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nkoRZMj.exeC:\Windows\System\nkoRZMj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPnYkoY.exeC:\Windows\System\oPnYkoY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfwoYFT.exeC:\Windows\System\hfwoYFT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KXNzFrV.exeC:\Windows\System\KXNzFrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xNNfVSw.exeC:\Windows\System\xNNfVSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHQBOSD.exeC:\Windows\System\UHQBOSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isZkpsq.exeC:\Windows\System\isZkpsq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfzhvXx.exeC:\Windows\System\cfzhvXx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53044f40e371e9cb122e183408acf8220
SHA1046e2d068d9cc11090409e87c0f8aeadd3aa808b
SHA256e5a6b4e8dd8d5e439ba8cb98a3dce7508030affc19545cf526e818c2c9642071
SHA512222cb9764eb401410f7a0c1fec161eff5b65551517b8048e7bebf651a93653ead4149c8f972fbbbee2b207ff5ff78a545d3770d3d5acd3bfae58b5291eb77e31
-
Filesize
5.2MB
MD553e79107e6364023217872cf4d2f2a22
SHA1f29a941f6817d1302aa17eab5abb919ab128f66b
SHA25625b10685aeaa937fe9e998b4aff3c403d433cda4d443726f4eea7a52119bb3c9
SHA512804b6dddd7e6d7f7afe5388f067a2c48b5d38d67eda885be9c9b5705c3729e942d56ff4c083e49b48953c326932f1e464f1f49da6fd7916a6fa0a79f436e0fa9
-
Filesize
5.2MB
MD59da1ad4022c65010ee6badd6a8398ee6
SHA10c430748c769341c18a52badbb6a7277b326f255
SHA2563ee82072e536f108d3ac922a6f6648292c7715d20ea0eec352b75d5d39e84fbe
SHA51255b7adb2cf15d507d12473c316fb7a03e015f069bc6502c3889badf5ecf9ef49207d4e685f9491dc277a3897648faa875870649f95e940fef87c9ae5049e579d
-
Filesize
5.2MB
MD5027935bace93c1025398719d0e6d08ac
SHA17a31102124d908c472b5c6eac3625e68e49e972c
SHA2569fea07c42a6556f782c649a6b254c92581c20f0c907b65039ce9f84e18207ec8
SHA512c609e1d8f7fff1f8f45c11a464be7cb3dcaf84d5da498241f0c8cccea0b46265ca42deac503e3bcd298af8b977fab15a30ecda66a05e309245c14d17caee959a
-
Filesize
5.2MB
MD53cc38eb0d7bd38511b1ee296603f3a89
SHA19d725e1d2f5c6cd0fcfccd13c7a98edea1eae44e
SHA256356128dd2bc3a42eb469a9b3b1a89a6500710f7c72fedbcb5ff949ac48d2e411
SHA512e14e8e2088b300eeb664cc579efdc630db8550da3338ef5ba591a9f32f4222e81e33dd6478834f64f9c2dda0b63a616fc57f95653c9c91549d97d9cc86920b93
-
Filesize
5.2MB
MD51ee9204b9570a221ef1bba0cbc9cc24d
SHA1daaa44c38cbd6dbf204b236794e5eb3879af6e8f
SHA256f3b0e679913329ec924777cca00831bf170602764fc405beee36937bfb2bb225
SHA512925e3f1631eace5b9d52600ae9c40a666a9b6d6a6a44915bce22b74cfa7242523107b1bba80501f5cb01394fcc7883b41b5170721693e9ae0acbd92c4133eace
-
Filesize
5.2MB
MD5e663e388cb22910bbb7161433569b274
SHA1254713b1bdec205259095bc86ed8709f9b89326d
SHA2561d7f7da0b1d561585ed9aabd0a3407bfffd1d2c871da6e3d5c5ccdd75676720e
SHA5129ba3211c6c76e793ba29af0ada26a2ebde2c08e7d84712cb52c9156de17b93c49d15c6b89969549b9a084a1da92f3c6bfd77e34ad10ca6d033f3ad3449551d60
-
Filesize
5.2MB
MD5f837412460cae68377a8063040cf9538
SHA1a8bc93a3e9975a983ac38f3587bde1ac401dc5d7
SHA2564f8efa0525565c2af0dc883d3fb4d76a23996025fc40f2cb7efd508e2adfd250
SHA512a10b06213e61f31654dd73b6963f1b2ae4bbba19c5e7faed749da74184a5c126bee28d0a9a9c1656fc80fa7dd0f6664fef6562d56b3acf429148f221e5a6e93f
-
Filesize
5.2MB
MD55155dbd702eca0fd08ba1ed1c42eb963
SHA1a86a642a0f1a1b52f4bbe0e8bb6f3e9658ee6c92
SHA2566da629d62cc2d8cfb75cd56134fa1655bc96a6f0ae261ca3e90bf336339dfbf8
SHA512d5347f4347630f3094302b2d2713ece86c5830194887d7755f0e43c5435813dd0275dac809a071b1c2e98c0514fcfdc8fb8d1e302199ee814f7bd48ebd1ac6a7
-
Filesize
5.2MB
MD50287933a4152e713b8b331b86b94c181
SHA1b3264ab7e7e6f723292add9fad047ae7cb09b1ab
SHA2566159176d44cedbd285916360cea8587672bb111501969de39884eb8641142026
SHA5125dbc53342f9ca73d7b92ea4869941598b1e13fe780f44f103087ac7c0922d9693a470201b893601ec0637c553d896c3999e2ef20a04bcb4861d9834d1e88f966
-
Filesize
5.2MB
MD522c6f76e083e27bc2f2f74a335c90b80
SHA1d4bebd3a786bdc7c571ed39b301ed30047fabd86
SHA256cd5243a77d00e508d556cd1412418666ea6036e2bccd31c21ff30b54050f0da7
SHA51275af5edf77c9efd10fb943c6d8174646d7de931dc422d677050f88ad31451b579939ebe3306f98c5a041495eb8077331ed2d1596756c425e5713bb42fcbe5523
-
Filesize
5.2MB
MD5e04076a0d58cb7ee86db4ef70db988bd
SHA1d808decec8d91884675f1ff3c976ad74b06bb8d0
SHA25619a21a479b2328b1ea61ea7c91da8bc081df9df3d5db5d1f2c298eeeb0ee6e00
SHA512e209a938c5219deb5424df05731d7f02fbeeedc20a3cc08d7c7f8669b8b4073f95d51a1057a25e6c0fbbaeba4c890319f3b90120b70df9b70f04fbde807b4679
-
Filesize
5.2MB
MD5831cfb7e6cfaa81a9a36a83a489512c0
SHA1e606e63c0994ff768258c690f8ecf92f9a89e6b1
SHA25633955ee24df1797eba4a122be275a6cc4f575f5e77b505d8fd0b5fac01d6db27
SHA512f6d3eab82efd61aade830ac3ba449e6db359d85f3459f7ecd3692a92af37c5b45699937e5ca87c14e929bc4b29aae86fc5835f0e4d2569a99b4d2a5348108b67
-
Filesize
5.2MB
MD5c62e5b963cd53903583f974c09318471
SHA113d6e1d9f76fab5b55700b53ebfcbf89a07a4a4a
SHA256153728baacd1e9f689e1ab12154f00f1776186c1ab4aaaf0315b414c40523336
SHA512b1b3a8121aee77381e5eb03297f90828c634c48cb9ddacb2c98b20716a2fd85a8d9bfc260a93ad1aa593f2d88db9059cf0824cf13005321d39e9fa9130c02005
-
Filesize
5.2MB
MD54889a4cbdfe688c3d1b4ebdbab91fe31
SHA17eae628fc8364373ebd1c3c297a0660550525171
SHA2563ce306d2ced4d1e8443073db32bf16da5cddace47dd79a349d51888bf605582c
SHA512de20c492401069c1bb970de90dbb33b979f2cf013ae66e283a361aa102b1aec63430c6af369d3595b240db28f3ac9ab348eea08bded88f8ce406ff84e329d709
-
Filesize
5.2MB
MD5fc287b639e460a7ac4f893249f316c61
SHA1a6e38459e275b6fcb4d6f3502d895511b80c99c5
SHA2567a4c01920c2a84598e69d418c3f6f3600ed545c7b10f24c22ddaa66df2514f46
SHA5120dc511387233a42c0d609c88b43904a788c8f8acf64fe29df93b6ab6fd10aa36034ad0d68777612c8f7cd3785b6f97183ff9af2ab66d36f5db7abf1f4d2f4c7d
-
Filesize
5.2MB
MD52abff7ed1d60f85e7d4c48f7334be4cb
SHA1f4b128e0d424a7b8ada5b826a7d7cbca7470d991
SHA256e87dd20816c85debfb8f7b6425a81e7abf01674b232a868a6bce0ffcfc9a8bda
SHA512a01edebc89587eaa650a05f2048f80bbf8f705aa0fb2eb812edb8f721afabb6d5225182f26e8e00a24a7198122e989d897f5cf973069afe79652f44c3af49789
-
Filesize
5.2MB
MD58117da3bb942771e255b002b4e401f75
SHA1fe3d613b67abf63096646290c34931f4933a13d9
SHA256e7c4af18902f234415a0cb66cfa12f7cd00e1b61195b6128921ae557e41e2755
SHA512ff5b90fc8f17dc552b557eed0fb4e38469f69027bf9fad4dc174f9cd0fad9c7ca444008ffd07a2be51f6d9977677513294010ab9f5aa4159e1a005c5ad339434
-
Filesize
5.2MB
MD538abfa4a0965367ee908bb70f00b9699
SHA1b7a55ad13fcde5feaeaa323118d1f0dfce1d9dc3
SHA256b0d2a96c6d0cb700f04772d5df6e81323e8dabdd88a9288233635069b6bdb01f
SHA51266854472e68415f4a1c2bf302dec9b59e8e53228f55a2cf3d55f515c549acfe95fd220ebda92dec4f294f75f4523439aceaf102ced1448666c89a610d3420e9c
-
Filesize
5.2MB
MD533d0f364f9d22a2d5279096ed39cea45
SHA1ce04f4e289c81d9355fcc87c435dbdacade98ef6
SHA2565ce4b8e21e080cbe42862fe8db7f801e2643d3874f5dd727dba5d0e6e496c9c5
SHA51232818a99c1c2423d6ac97bdb7328ce414a3573cd9f4a970b402a13b334ab353f65462fb568fbbaf17b1449a12d9fc7e02eac97e6c7546f41bb00384e2be4fb8b
-
Filesize
5.2MB
MD564962bfd0e71020e1f2206c77b964312
SHA187d47d5a8fe4fca4fb4f82fda50c6a4ae4847196
SHA256064c082a0defc921a6bebb67544ebb43676c3bd8c598b1faa5122f1c56274327
SHA51219277ef1e4d896a174f2d7f22bc87e22774b682c47cc2834733d4544cc715241c7521d05f30aa0defef66ddb61ebfd097be7ee0899c01896b40d5ad3ca2b9849
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB