Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
23-09-2024 08:19
General
-
Target
2024-09-23_c1b45b8d211f568f50469a8fac074fba_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c1b45b8d211f568f50469a8fac074fba
-
SHA1
75de6c7461f87bb8320be0f4e1a962e63f5f2b78
-
SHA256
6f5a7baa9ce004c46c255dc79879536374fc1a016238262e15f60692ec810b63
-
SHA512
1e4ab3935b4106aa1acf5b73782df85fae2ec6a82085d1c21fc6f8622972f2a75682d630ae064b04a50b47462244a75ee2cc86a21990b8d237ca7c53c49dbc4b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_c1b45b8d211f568f50469a8fac074fba_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_c1b45b8d211f568f50469a8fac074fba_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tfiyqsr.exeC:\Windows\System\tfiyqsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCfmHsV.exeC:\Windows\System\DCfmHsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CHARrtF.exeC:\Windows\System\CHARrtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwoxslL.exeC:\Windows\System\vwoxslL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcwVtLD.exeC:\Windows\System\HcwVtLD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRsRQvv.exeC:\Windows\System\gRsRQvv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZoUeYmr.exeC:\Windows\System\ZoUeYmr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZRGFjUI.exeC:\Windows\System\ZRGFjUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XhXsjpC.exeC:\Windows\System\XhXsjpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TAbTJIU.exeC:\Windows\System\TAbTJIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgdKbTc.exeC:\Windows\System\YgdKbTc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRcgrqf.exeC:\Windows\System\pRcgrqf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYviVsc.exeC:\Windows\System\hYviVsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKVEbWU.exeC:\Windows\System\nKVEbWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebUjwvD.exeC:\Windows\System\ebUjwvD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbCMEhR.exeC:\Windows\System\dbCMEhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWBpguR.exeC:\Windows\System\rWBpguR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YehLfGP.exeC:\Windows\System\YehLfGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVxJyLy.exeC:\Windows\System\BVxJyLy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlbpKXd.exeC:\Windows\System\YlbpKXd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNZXAOd.exeC:\Windows\System\jNZXAOd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD540073ed4bd0f130985a00bfbc9aeaf0f
SHA10cceb58eab6bfb00cdd97c66474f79153362050e
SHA256248a10efdd6cb9058588b7d06d9a1dbf3ebc303331638f80cecbf51d1f01755e
SHA512d2134e493f4fbbdd6949ce447ec24bfd1e9403bb4370d869ce1ef8ee3d951c10a3b24df375600ce4278cb6dc9189b044c1ff093d9bdbfcb5233f5d01c3bfeb0c
-
Filesize
5.2MB
MD50094a5cd5aa37582c4008f94653a29df
SHA1fecd06a4c8e6df6cd958251bbaae99fcf316f169
SHA256f2da9805fc668a262930b4e756f09049226bd94dedbdb56ad2ac429ca8a69704
SHA51212b70863dc5c7d409313440410236212319fde49409240872c7cc7be327e314f09b1ec844400ef701d5ba4b11f51160bd3a871d110e7aa8b8844a2e8710ef4b8
-
Filesize
5.2MB
MD50503f2bf2b8134fbd880cca3a8e9c5f5
SHA184a9568194f485ffb02ed73c09d8ede426225ec4
SHA256b1230660ad063c440b82acc72421488fd2b5ee60192c751ae0df55df56a9282f
SHA512aa03fe34c10bca71b4209398a7159db79c9038d6fbab0a8ac6f7765b0d616007b45ecb97bfe8358ba6e014cbfedab5cabc0bbbaa6bf6191d743572c98740d1f1
-
Filesize
5.2MB
MD50d71800a0feec9394917cf51e1fe9175
SHA1bfb28836786aa04d8a8c05ba0cfe002021f89793
SHA256578514397d3df48d8c03e1babc39faa9d510d0b83358825e0a34ff6b328fd8b2
SHA5121afbb450036363608b04221d3ddecf6ed32086eb1f1c9940e21658b369b5f49d810ebc532fbe180284a15a794139448636ecc372c34293de94d1110cb8849a0f
-
Filesize
5.2MB
MD5e602ca6365b179b6b46bc51875be656a
SHA1344ce1d4bc3376b86d9f2fdf6efb19b2392d2222
SHA256395944679e34e574942ac57348a565fab91c5efcfb89f71fc13d6a61a5130460
SHA51241d81db454c0f636508480e65e6cfa4dd3adbc1a5133b57e5e6e3f788b9e229b6ad74180c9df170d0adccd6797bd7789c3adcc369abbcde1a10f986bdd5cad15
-
Filesize
5.2MB
MD511fa53579bc8cd72803f04cc3b8053c2
SHA1dfb2b0ada2ae8b0e5c574b9b0b7befe13d6d299b
SHA256328a2e4cb2a0d066fa4dc347ea9d28e063b3625c98e28d24653566d1c95d94fe
SHA5127d51736295f2664e5eadd6f330b0e28d1acc8a2a910a3a67e8efc22677271b808a0d18054246595b5df654512a81596d1a803954f6505a54279694ad899181c4
-
Filesize
5.2MB
MD5fa0d4de94f4454e15391703db941283b
SHA1bb034a9a3c40750607dac034798d481e75bda7de
SHA256eb9ccda932378ac657bd5e1da469a5e8008c552972ebc24e937d514a80148751
SHA51283496c060031b33e900f09cc7cb67c3d9ae75a923c8f444b4173b7d0dcdda615e0ef42519f1c95b08192e65295888620f2b9ec54e44e53ec9364e3ee158e2d5d
-
Filesize
5.2MB
MD52d797ddda9ae7e46ac201cd78b28b87d
SHA1f835043ea38c8268a732fa6eea9a1cee6d38baf3
SHA256e23719f642928b3afd6587caec2b1b22f32b26e92ef041b215a9aa5361d4b5a5
SHA512ae801a96d2a7cddec95fb9b019265cfd7ce94efb3ff5e9aebf95ae6558df57d7ca8e9692f4bd93b62e835d60aa85e1e4c219c1539e2ba9f3818ca457f4cbeee5
-
Filesize
5.2MB
MD5ebbd5b79d09716d6545d756ed2b356c7
SHA195b68b52a4f1e6dfd20eef72c27e058cf3ccb0b1
SHA256aad155085e836046c89510d59adf86cdddb7dbe4d3028a545efd8edaf27d3454
SHA51232534a0c13f22aee3530bd1e093c364e896d9a34f9c845510092e87f6a56f71c3dab484c3eecf4a46a0c72e9ed229b19a8c0cdf29546d4f4d33c3e4f3aed5e26
-
Filesize
5.2MB
MD5e8c59b130e047402d7a1b6df3d7c658e
SHA178fcd43e141823a70d9cf0a826a52a4488d2eb93
SHA2562def49f2e2e207bc683f8fb143aa2d33aeab2ac298755fbaaa7dc93e54976b3c
SHA512f3d791a636f897d75d565837590ae48c88c6e10fe83a36252d884e721e82872e44ea6859f63c567893718911c5bd31c614204a9a3fad98ffcc9c0eb9bb582bd2
-
Filesize
5.2MB
MD5300690fa196e38a2ed6a17659b88001d
SHA1bb2fdb32149700980121704f0659ad20e5004d95
SHA256d950ee800f0d2124cb2dfea47b7cbe030ec0faa42d8cd111595312461a1d9e09
SHA512d3c6240db39d8e74d62a1620721c12d85b9daccf87ecf4176ef7b65755b6459a8afb446ea452dc1ae3c789cf7bcbaae144c15cbe82c807c9e84e1bfdee41aa91
-
Filesize
5.2MB
MD54c0f73ae71b2e242e13e33d1b5618aed
SHA1f5e3663d0cc0fd34bdc7afb9eeda3ee852e252cb
SHA256f6f7be91f96db0ca86c4c7da2a057fa87c70369c811aedf368edfe28d32e90da
SHA512e4d73a3379d7ba207333a0ffec6d7eec9e01f13969d539aeab5ff630b636c2c8e536fcc7bf0fe8b7368c94d29bb2ff2aef1ea76be635ebb0dcc146b06899000c
-
Filesize
5.2MB
MD5cc75db4a4a9727780d24917b3c377747
SHA161866d1dab6f1eccf5fbb44475a9aba405860288
SHA25642da23cb50376fbf6c1e20ebfb4da49ee5bdc6764f7c0fcda1d4ac87f360d6ec
SHA5120ccc67ff0526f8edf5cc70e1f63b9adff6b900681c005f0c2e1e5c4f6ce8f7b921497b7953f2f6f4fed31fce473dd42e82652ab95150f06c2cea45d8c78bdd3b
-
Filesize
5.2MB
MD522f77fcc3c3df5c4969bb8bce4b8c805
SHA129d7e3be0e68aef8803a01f4766c35aef4667bff
SHA256ae130d9895dcd9ce96289393d42349ffb7595252c7b2c799305659c35b72a6e6
SHA512444261ac09e65d2a16c32987f498bd7b63ec20479f04f88e40da4763fc71e6cc8913edfb34cdc6c5eedf1bcfaeacc1f8f1cf4831a4c446742f075096ce657358
-
Filesize
5.2MB
MD5f629446af541b593bd723f3b3f5574fc
SHA13fd5a0ba7183f5cd9c700557509ce00c966955e2
SHA25676fa5999e02f00bab686a402e34bfa8e94f3e5b0ede1eae38c0ff12a9b139938
SHA51283d5c0ad5eeb8d1086cf111a427ce8a0fbabbe3bce0049356e7979de38b19bbed5a532505b164e8754dddeef6edad354a9695dbb3a706868222c726f57b98c81
-
Filesize
5.2MB
MD5a8d609cda4f3d6ce101e065bd8564274
SHA18143277816a3cd6a8ddda621be493d572ede3d35
SHA2565e06c20eeea7c6436e70a980959c6e069ca9cbea788e5b2875c0b0cd038e2efb
SHA512d26794883a0f30bef551bdabb50dc03b0d42535a0f167597aaac43ab6760e345c3b13c66543b4c2463136338195eb72dc4e8acd4b16de640534a3cec63cd6462
-
Filesize
5.2MB
MD52dfd543a857b7eabc6d0a6ec66aad7b1
SHA1bf3f83b0b32eae638d4b7e9692da81b0989391da
SHA2566c04d27c2b5711455406f0aadd3349b02d54a32486ffd596660ab25631af8244
SHA512bf2d840bf3bb6088e729fa57c0df802afe24f470a24d1f3daddd5f9e701387179796207ab51916e69553498e137d2a2d969cf0252275733d827bb2d119b0b369
-
Filesize
5.2MB
MD5b6cab660adead3c21903512f616372a7
SHA19185dd12de8384699f085913356370bdba3600ca
SHA256e3daa8298c09700b25c3c290624ae6e12eb9a261151e8f68ba1962808e96b760
SHA5126f49f9f9c89affd31b3c1f3b6bd16622447a3b0ff342eef924a1a713e48d5c5cb16bbf1c8333b343a21965f8a4e580ee20ed8050ff9c3cd1c547a6ca7239561c
-
Filesize
5.2MB
MD50c47d4350ff009f92ab7e04dd9229ac1
SHA15b3644baaaeced490410a016a94840d0130aeb56
SHA25655056a3267c7af372c55ce2f66de53873ae4235888b351abbe7de48ca6691756
SHA51291495a5ab43890962fb8663bc76dbeda80f5a8441bfe1e4ae98c914ff5bbae65c610464624e33eb1f2e031334485c1ea91b13cf64c2980020631c0589c7616a2
-
Filesize
5.2MB
MD583f540d6462019800d282907ea1d7023
SHA1e87a7c5e03837b080b713e361a4678f9d3c2f25e
SHA256fa477477a5de1ae00edfc7c075976108dd6dc097d5bb5957d94e027b6d462e97
SHA512dcb4cc27065f498a1cf38df55b30ddf611a8aaa19a1304d5098e5a80b360d9392426d426ad96f377b2b7ce9f0c0d7e788fa96732faa4f0f4766f87c168bde739
-
Filesize
5.2MB
MD552512d8831eecd6c0e011fc704328e42
SHA105bd4a6681c2278237f1523c7d786ec18744eebd
SHA2564bbcdd1a78b5e38bf0c47454d22f987f0359f0008cb509a9bc24a8135e701a63
SHA512acbf40f4b6247ee4493029290eda81748517b1ba08702f658f412fba23d7beb3d7665c6cce318b1a6b9025e37598f527c006c96e0e01bd18dd75881ed762364c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB