Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 06:39
General
-
Target
2024-09-23_e06ed1816f5aed4097ef2e054d2a234a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e06ed1816f5aed4097ef2e054d2a234a
-
SHA1
04bb501f92a709a00b4bed09555391843a4a6c0b
-
SHA256
14e0dff34fa1c258b721ab3fec53bf77eaf1183ae9439b0484a31167b2bff7c6
-
SHA512
69f74f9bd79742edcd4cf9b6a44c426ca3bfdb4584f639a521e0acdc2a67f5cf9806a797475202f4569f50ed0f878f4ddf20ca5b682bc102946f054502fcd95d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_e06ed1816f5aed4097ef2e054d2a234a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_e06ed1816f5aed4097ef2e054d2a234a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VHTRKtf.exeC:\Windows\System\VHTRKtf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nmOzuoZ.exeC:\Windows\System\nmOzuoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRVTWnc.exeC:\Windows\System\BRVTWnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPWyvhX.exeC:\Windows\System\cPWyvhX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhyrJsK.exeC:\Windows\System\fhyrJsK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tISRsGW.exeC:\Windows\System\tISRsGW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQkLFks.exeC:\Windows\System\oQkLFks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dMFJdvB.exeC:\Windows\System\dMFJdvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwYVgUH.exeC:\Windows\System\BwYVgUH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBfvoKu.exeC:\Windows\System\FBfvoKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zVhVQOJ.exeC:\Windows\System\zVhVQOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ClnCknz.exeC:\Windows\System\ClnCknz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blSuYhv.exeC:\Windows\System\blSuYhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvAbDIG.exeC:\Windows\System\YvAbDIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oTWldgC.exeC:\Windows\System\oTWldgC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndIWApB.exeC:\Windows\System\ndIWApB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUnNHIX.exeC:\Windows\System\PUnNHIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\avcepgg.exeC:\Windows\System\avcepgg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DaCQXdd.exeC:\Windows\System\DaCQXdd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCtBLNJ.exeC:\Windows\System\PCtBLNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWFdqsU.exeC:\Windows\System\xWFdqsU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58bf42dd9b5643ae06a5b1269e519f6e0
SHA1fff732fc13b501305ddd614191e3ceba5267084f
SHA2561e41a26ae6d2d69bcb2d2aad199238fd65fe4b0352cfd58dd51ff6007b74552f
SHA512bb2e210f684963390c7b1018a39408ad9da8aea3ad07be8d4e6666d5bc44e8e86c0191b231e8319dd9151ffe4390db99e05e755872991818ac1f84c4e19abf7e
-
Filesize
5.2MB
MD58d4d2d354e9ec772ea7c9335f0faec5c
SHA17336535e8dc834cb9d1f0907cadf231bdd7137ab
SHA25679012def851aa307b5402e65531de13785f6ac768a2950b0d71226151a19d6be
SHA512d85becb5f3659655daa23c01513ecc252fc1366005a28b24e770cabc94663d32f1d1e716ece88013eb0b788849dbad4279e5eb72f5343fa84f33a768fe24fd0d
-
Filesize
5.2MB
MD58602528ddb6e702d8d4b923f5846909a
SHA10d3889cdb2a62337c19e04149322a4655829866c
SHA256e696bb50f124eacd897b0b5a475f441d1dbfa826eb6e4a2606a7f31f71da5f9e
SHA512e8e79a54c603aa0c2e2c0da14317946ea701d522e4ee03f1589e9854d24fbdfe40bc7938c2d1897bd70f321af96152d631f11204fb24c75f9a410abdc6fa4de7
-
Filesize
5.2MB
MD5aea76bf321feef335edccb2b8c7865ca
SHA1f976b178cb923d8c4c8f101e0336dd28dd26f43a
SHA256c7a31d06855079e594946de4225d842b127bbf5cec9eeed66d04f06a5c39fc8a
SHA512158fcfa098d12e639ba68c6987fd3435d7790299a25839a457b3ec75cee534381c65f01ebde4999f646ed4b018f3ecbafaf19acba49f4272941c7609492ecde3
-
Filesize
5.2MB
MD564b064184928b9a4b7df46b4d828a272
SHA1caaa4e7a7eedd0d966f06be6159a32ab995f5501
SHA25638b4cc63adfa5d0dfae7fc48a81ee54d8636dc8e9fdf79768059b5128486772a
SHA512860f80602625040c8a1f7a6d9c3f4399cd53a0dd29c17740db49a1e7430005a9afe56802322aeaff2d2ec3edd6c8878ae0e5aae42758efda73a7b7555719a6b8
-
Filesize
5.2MB
MD514194ab9407be671e9f8ce369b2b9aa8
SHA1afbe45831cb0cd7cd0f10be5d648809e25aa82b9
SHA256b8dbe81ae039c85844bd53dac8548847748c9e4b94acd8cf45ab104707ca8fd2
SHA512c7db77ec1df7156e6c67f38f742c75432664abdaf5bf405090fd5acf402a71d80a1906dd850e016c6bc479050f6b77bcef4eb6e9db417608f1532dfef9be8975
-
Filesize
5.2MB
MD593e50dd8643d988b18f1761d2d4c95cb
SHA1753fccf12005ed5adc6e14024eb11b2b1e75ccaa
SHA256912ce399cf1367828d6d55b38d2c2f313ad7e15dd6b68fb8919a901efe38d431
SHA51259a128b81bbdb031049f5696150fc22577a948d94127d99476ae250abd0ccb7bcfeb218ff0e659477f84fe21e4422cf7a39d85b63807435d6c841997c707cd59
-
Filesize
5.2MB
MD582973467536a9f5999b776336a00da22
SHA1eff5fa0623ca0ff5b042c7b4151bd4b54c727f6d
SHA256f651d08a949c02ffa331a0e0fb4f3f1c1bd094125e36acc0dc9397bea6a45539
SHA512f13598cae2f29b127975357d630a6e94886f8b1605f0476e1b808dd4acc0770fd7cf91823f3e7697844b2387e10adec351ff8d42520850e9a764787d277929df
-
Filesize
5.2MB
MD56fe67be3585485663dba4b6290c8194e
SHA1da9fc3586f2ba29c5be2d3a2cfe8fd91dd3c7efe
SHA256a127dcba0b58b3b90136aca331b448f716fa8ff966e3399c526ea120b3d4a847
SHA51270d096687a50a6057d16dbb21c6c33547f30c91457ddca737d881d753c946c54c50a44cbefcc14f108cd11a187d1984557a790d9af6ffa4bfa37bc5dfcfda7f4
-
Filesize
5.2MB
MD5969bb23a14305e76374477e1e15b5edc
SHA19f80e2af74d26922db2f2cd9749570d7af0bb10c
SHA2564e0a1d5466bd6e4d88a94d5133cab33db2a982c9989942bdc2ac08bf40a89357
SHA512aa4019562c28eb56d23f155c62c6627798e1acb245e281ad692be325372e30be9ebabc13c7d0c8ed00b2581e17811da1dcf10e82eba395d016a38b5ebc32c051
-
Filesize
5.2MB
MD58141f9bda0695bc12af0fafd2ec0e53b
SHA1939530159b2f88644aeb6ddea2cac1a2c8326141
SHA256e640556cd0ca3afba3c8e8c54b6a28707d83929ead64f0e3d01eccc5c2144476
SHA512295358b87c7d07bc982de7a3258e80ae4ebbea6990dd4822334e11788118e3b10a64bf23272cc35bebdae12ab2d918098766d16f55962bd926d7c2ab54e46bbd
-
Filesize
5.2MB
MD5e294aa71df3a4c83073fed0c5b666ccd
SHA15b2c73cc2624e6f56d9872fc0b5ba78463b58b69
SHA256c55e2c249e14cab5bb374d80f21d5506cd50947c14ad24371d27b3c2af44d52f
SHA51260db27b3dc36dda2e877c5d1d3954ecae3e47da3e70031b79ddf150f7c8a891af1feeb583bc55e4f3688d447578deb165e1d5f0d1cbf86a6f80f451cc662220a
-
Filesize
5.2MB
MD5cb96fcf9c698541b3fb924abd8b9f931
SHA17ef87e0655d49362977634395497b1ae9184fa95
SHA2564c8da72fdfc8e8fd6002b82bbc5392722aec678e4dc7146810b590f3d8a1967b
SHA512336a604c893c5dc0358d6d2bcc16a77554624fa8e2f200d8010cce6be979734546f5b46f2ab3e1c5ebec8a3f17292543bc8beb2f0ef08586888a7dfeb9466f57
-
Filesize
5.2MB
MD53771f2db0287e2e87d20adbd9a21dbca
SHA19da9249e0c4582a33177948b45d195d8195826a3
SHA25660b1167b543f3096ce8deefa041d71b8e93449814595bd444933b57ca538a2d4
SHA512e7d57baf12b4c5f6114c1d1f872dd64017ec444619406ce77207033a72df425a7ef1cbe1cb45d154664a634e757a5b41fa2e988b27ae998300ef1246988d7e95
-
Filesize
5.2MB
MD56d0f07c7a69c0061fe1eb7835eee7a4b
SHA1d21733571ac56f2819824f14d2cabae6e2e2ac39
SHA256efb56f0aa3c1e4e52391ac87c9384c8ae1d500632e56c1070067df3034e1ac9c
SHA51240c39666098e373b411f8ec8991eedbd3d291e0c6888883ff4ac05de2976fa78f070edeb464194530779f46480e5cabb7e06a03d7ee61a87fa7d6d98d3758963
-
Filesize
5.2MB
MD558b3e79559c049dbe05c774673052f8f
SHA1d2095b70efe051a47bb3b143ced96741d6ee1e4d
SHA25642147c1cc6c689a9de882cc190b21aacf6dfcb84507ef5894cc8533e81a68c75
SHA512a843cd4c55b6dd6648c2143c5a1c2015af0b159b7938e1f66d0a3327d833b4838ff49affa762ea63b05e4e175ea43856ff9d36648618996b2a48d7422cf122ea
-
Filesize
5.2MB
MD5cf3d685f184283995e5824f12a388db2
SHA1f225b1bde773c19a51eca398c9e93734733d0b7a
SHA256f7cab8797918ee33a103816b9a307b7ee2ff90d4720ce7765d3c4fd41f324a39
SHA5123777546af58a6b05ed9632673ec3ec31bfe5452f6605deff09d1d3a039bddd2cfdf924ffb2e63649432d3a83dba4be32041c37d51f522a0be9062ac2f0395a5b
-
Filesize
5.2MB
MD59a92aefd1f515fc7c122f1d2663f0260
SHA1ac160b6598d555b73789334cc99405333e4eafe4
SHA256416d429de1e730578ff722e048fc6145e00936e1c8e1d778798fd75a31495a04
SHA512f4821454251bfe71fb07d099552f08085bdb677c5513d57054fc90a2db50bfeeacee4467d5d6b41dc227c2fce870adb7dc2f267a78a5ac0ec8cf821c86bfe47a
-
Filesize
5.2MB
MD53de702c8720e4106e6cd0491ba155762
SHA107a58486ea9ff9dadea9cbb76f9054fce58d8531
SHA256e73d642e48213f3da300a8e9b5b6a190b672f179b027960480ff0582bc8ca2b3
SHA512d6004e965d9296b90354122afa505e72be61c8f0cf507ef86b95cfcd0459fefbe7c42a6a8409642c1988ba025fcfffc82e37201e081050ee1a3a7a4c6a9f945a
-
Filesize
5.2MB
MD52ac502bd4fddd77b4fc7500577afaee9
SHA10daa4f930955e7d35b3e32012cac7620a46423a7
SHA256150907c74a0e3fbf35bb9b9658452eb0bbc6eb2bec8a3a50e85435722f6b4115
SHA5122f674ab52e1db7a9ac61fed2ba81bade4d02e052eaf2b7966b92ab05af63989c97d4f07a552e86a4b9a33a6e3f87dc19547871adedfcd264b2f2f320873f73f2
-
Filesize
5.2MB
MD5d49b5d4362a0a0dd49a6af373b1430e9
SHA1871bbc892e0e795c846bc51afd243bb8dea194c5
SHA256215cf968b4439f202afb9d03398c4ddf87374f20f14669a4f2b601d8e3ec755a
SHA512a91d9d83bcd2fd4569825de5b89faaf09d41c339bc3623a5776bd90bb3722733f25ee2ed064e88ce61d2cf9117a2b47223a80cdfc93d58d8895c322cb632005f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB