Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23-09-2024 07:45
General
-
Target
2024-09-23_04e8e2d0597907bcecac9bce53d09093_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
04e8e2d0597907bcecac9bce53d09093
-
SHA1
e7533eab92aab5f006f23799f59f4ce362e27f72
-
SHA256
3f9e61c8fd15719873f16476e5f8eb1c1c8731e5fa3b10a88691697973c7f919
-
SHA512
281803182a714570fbad6f034dc25815e6c661997efa509326bf67e2a87f2757525049f84d37cc6eb140d82f82f31a01c0a2f128a9c7687ef6987a0dc533a08e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_04e8e2d0597907bcecac9bce53d09093_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_04e8e2d0597907bcecac9bce53d09093_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NkknUBg.exeC:\Windows\System\NkknUBg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RbLTjXv.exeC:\Windows\System\RbLTjXv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EzWJEMF.exeC:\Windows\System\EzWJEMF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xCEiBrT.exeC:\Windows\System\xCEiBrT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrhQsjF.exeC:\Windows\System\zrhQsjF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRWlPvI.exeC:\Windows\System\sRWlPvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odYiiSH.exeC:\Windows\System\odYiiSH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NXvPUXu.exeC:\Windows\System\NXvPUXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WAdFmAm.exeC:\Windows\System\WAdFmAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vcIBWXZ.exeC:\Windows\System\vcIBWXZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvCbdrz.exeC:\Windows\System\QvCbdrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtylcVf.exeC:\Windows\System\KtylcVf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyBKEZF.exeC:\Windows\System\wyBKEZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dRgEWZb.exeC:\Windows\System\dRgEWZb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IaOCkAl.exeC:\Windows\System\IaOCkAl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPVNWBy.exeC:\Windows\System\rPVNWBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HmwlUeY.exeC:\Windows\System\HmwlUeY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jZzzkMo.exeC:\Windows\System\jZzzkMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGrVwOa.exeC:\Windows\System\LGrVwOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XIADPrE.exeC:\Windows\System\XIADPrE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ferxply.exeC:\Windows\System\Ferxply.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57078766031ddf6e46b52cf7d1830d51d
SHA18c35541d130947ec2de9027d5b736eaee404e9f9
SHA256b95ac061249b4895dba9bccfe47332ef2da4ccd98a2f8d164ecad7ac268373b6
SHA512834ebdfa6d3533841d94e47b438187a8f9a20af2260b7a4054c40206d32eab9e6d7ac57f6435e6d21300f7a355f7018fb035a95d53a63f3f40a71bac091bfd8e
-
Filesize
5.2MB
MD5076d76e750e5189c5c248df80d596edc
SHA1c08b4dd53a673ecc5e0de419ab90bf136f84604e
SHA256a4fc5bec92e22405afd04fa7ca50ea13807d7c3becb036dd38b1619ac54355a4
SHA512d3f585e64ded5494db0a36c79bec18aa71f196103a00c37448eedbf30ecb6a218c749df41ec5079cbd00330ed20848fab4a82b367aa915ecadf5180cef373ccb
-
Filesize
5.2MB
MD535718da2772694c155ba59e4ad2cf6d0
SHA108483a2d9348e87f57d4a90aeddbf28c7a2ff337
SHA256279c955b60dd650b1b92d39d1e6cae44b4cde02c7ea3884bc9907bf8b5dd30ce
SHA512b9d670ac5e706b29406c883e023abca34d9ac03862366f8977d3ad0402254a53797fb57c92cc2e9a877cd376bbe15045a3aee72c00d4976f1f587d7a1ab1650c
-
Filesize
5.2MB
MD5311fa01c3ca00ca64600df4fb13dc8e5
SHA1bbe8319e623e8aad1f79a1d1fee2c4d1c30f7be1
SHA256dd5dbcd6703207868f246c5565af6897a1f5a3b5a348c4ff3f6008313a8eae4d
SHA5126a5385e3f1ac9bd0f07e289dc7448e879d4e2093d145a88c946894fd14586bc6823fdef29f2a24863eda520417da658090f1f840dca767cb121820823ae1f9e5
-
Filesize
5.2MB
MD5fe7b402761610193ce675453e6283d3f
SHA130166ea4dcd60609fc5ee4f08c548f6449472d4d
SHA256d0273ad0f679699dc494c91ff601c628d33469b010ce9dfc43318719182d7bca
SHA5125ef9ada9b87d2cfd967cd31b7eecbd90a169a5f8443e7dcadf46b02c573c2401edb174a9baae7c0bb4c9735b4cdfaa52b42f22e6fdfc1abf020076471de3caae
-
Filesize
5.2MB
MD5c4d6eccd6ac70520f843f78c3d00d862
SHA1fda3e2b880fb02ed1275e4dac053018035220d60
SHA2567e6d4fecc3c00295976dcc3dfa752dd6c25032761cf6c3f29062da19dfaa5797
SHA51200464c1a3a1a4ce00f1fd1a35672414f41df7dc45e718c6574209a2d061330434425ba80be8dbcab35b53a7eb22ac758e7f755c392654c867c62d7ef0e9b6e36
-
Filesize
5.2MB
MD5c7a959dbfdc35f059bf806c1cb680db4
SHA16ddab7e49cd6285ac8998ce7a65424fdc14ce995
SHA256f0c6d25c87dd6d5dd1b057dc2af610beb90c27088ddbf29d58782bfb2a6d05a3
SHA5128f5160e12186c5ea57fb30e9e33a055b09f2f868a59d42c0d93f75316d97dd9ac6ee2880188985e347a1c89a9f2ff5eaed9b931ab1e93d315ff363065e54f443
-
Filesize
5.2MB
MD54c36db1c63d597d0b56dab7f0e291052
SHA1b03da4cd1ea4dc9a1d42ffa8007e95d22b671e1a
SHA256757620241302034fe5c29a4151a39d0d614c86585a984e3c3cc83d74a0d983c4
SHA51253a9a102fa242e44960da04899c22d75d971796446abb2d34af31efa641322d07584a3e97af01ae74e3ad402f4af38423cf985d64026e4696cf455e7e72e1f7b
-
Filesize
5.2MB
MD5d2a973a62e33afcfd9e3c0434166ea51
SHA10d38a98d1d3b06602eb8c409b8460d08451ab509
SHA256383135ca7c114c7e3156b055566de057a125386c2f34d1f48ba16cc6e6d379c7
SHA512ce36741065e810c88691dd848ae68e7bd63279c990af9f76a2fb25a4b535a7bc54df887538e3531bb648cfbc0245216942da6cca3701e4ba9d69dcb40b37b0c6
-
Filesize
5.2MB
MD58de2a9cfe5549376ed81d0627119a90a
SHA1b170210b53298d1f8e5b22c91d54952e684f9d16
SHA256d4512a03b30a2bbf4f6a58d195ef78f02b62b80d038299e63580f828e03fcc27
SHA5129b44d3cfcb33454e3f18aa9a3354c1b4a100abb5b18476451002a7c75aab13229c8dfa96a19b98af790145efe06786292da84894c01e0b36285dbb3d642e336c
-
Filesize
5.2MB
MD5836d761b09360f73d2ae2ecd6428816f
SHA113c43f62487696932bc9fe799d8a94489518330e
SHA256b2d367493c369e804a98cf5c9858c60156476246a63c0bc8b2a0209caec3a300
SHA51230e619a51fde1f9458894e0bf9aafe5a6952f12e5e2169be4d5f44d16d73118a42b52ef187a9c9d50ac981c3bb5d1f826b46ca7bdd43cd07686b7b43f1b7ae9b
-
Filesize
5.2MB
MD539374f3b5346809d197216f5655bd585
SHA10dbef67fe7ffbd4ed513480dedd3dd1d27a6df01
SHA256d88bf5c1d0783bb58b68a8eb1f336d5a82d26b32595ba88407b2a12f3dd3a8f5
SHA5120c6ad7826e74a714d6fe0a0854525ebb546ffc8d6214dae1a33562160d2603440ed61809491fe6184d823a1ad8fe76263670235037813caecb9556e933a62f72
-
Filesize
5.2MB
MD5553c97ad7d055c7304bb1f974f0fd96b
SHA16f0c25f0805885f1a9547b875493a637de589aab
SHA256fa7a1eb815a4d5cc0fb85f7ce1a5172a60300d23ae61115a8349724149a50dfc
SHA5127655f5f8c5bafa98226561a28a8431e1d06020a626483ebb5477a9994d06827ead11a0dd8b43d9da48cc0e5a8e5cb6adb8acb47d25f04ed362682e3e2dec503f
-
Filesize
5.2MB
MD59f6849b011f1451d51fff92f098ee716
SHA1e4b399cd9c99ec2ae66651110a98709b01ee4efb
SHA25681daeb8630d1416bc7b9f76dce8e5a496d9b4cbe60e3d8b29217b2b8cf3d6d07
SHA512a1c332fe46ff73f183b4e0f4b474f49e595438b9472f86cb080d480f639579f929ba1e7cbc49b199877ae863523d7786cb2ae044affdd2c619d87df16fe0810c
-
Filesize
5.2MB
MD585df7e15c8101abf7780519d46b06bef
SHA17a5625a988f9622cfd7889f6dbf972665362faca
SHA25696b976e5ba3e53395e82895e0c4ca3d77d828816a7eb01aa2d2f51e81dba7bc2
SHA5124b88cc356b4699106b657e4c79c49f07628152d354f4f5dbbf24dcb9fa419d057fe09a644551a0f0690bb058aab7c6a8f52df32a4f39cb78dfd3e653396efdee
-
Filesize
5.2MB
MD5af498f8cf856e8c82fb9c23f5703d509
SHA1aba2bf413ba584f510e9f6fe269ed62f8315db1a
SHA256349d0a730da572099fa0890fe69d7581c192481317674a6f9e32e326e8d412d7
SHA512044f07d6e01bd6ab7d211df78728e176860726f100f76bf4982a5f2e131e4a8b735db0addeb3a5342ed041c1a14c715816349667e3764316d126d79dc055c131
-
Filesize
5.2MB
MD525477f67c775ff6cb1004235d7e9da12
SHA1ed0b15c83a61be650c76fd26fe5fcb4a74a8841a
SHA256e96cde9d1870911487054f884ea09003a62cdd164e0d0dc5e9f5dc6deac9befc
SHA512c8422bd588f782e1a8639c06c4b25980ff8cedfcf5d3348d75ea9277f48900ddc4abc15576e677fa3e2060e2e3009df05c5f6da113f855d90600b5908e374a58
-
Filesize
5.2MB
MD5a8909d35680ea1358b1aec49fc53dbdc
SHA1838ef412d41773ef6794f6f4b4bce1a6b066293f
SHA25612f3d0489c135b619b6d0b853fc9f7ccde70421cb9e50cf5357c7f60a1932d3d
SHA512857cfad1e743429f41bfbe383a584ca5e0134afab083cfa20a47c4992058b164f6182527cf7a139bc331741702ecf49b817859a3301c45c7aadd4832bd055b09
-
Filesize
5.2MB
MD5e1dd52a2968d056c3adb9ff298075efe
SHA13d0ed9611d7487b357ecc758fa1207a8877dbac4
SHA25607c74718b0dd80baeab4951e293ee017b0f701bffc710541feb0e1fab11fc3cc
SHA51245601c11a9cce3e610007f5e3c700af3a5ac649c4d54b99a79c166e7dc94bdf60b0f36971826f4a8b711f60dadd3debdaafc975cc3f33f9220e2ee54e2e5af99
-
Filesize
5.2MB
MD568c344d59091bf1d9ab644eba12fd241
SHA169f6116d3fd1da6ac155ac2264518ec352f41122
SHA25612bd52a88310e517491c2bb08b9196a4db71016395855c7a6d2db83f8816c56b
SHA5120207957ec27bf287a7a48f82ac1f1a90ec75a12bf93dd55497c056f7d79cd0147db05a9253a06ea837117ee2ea720c0e95c3dc495d92df2e3379e6c39295f2d9
-
Filesize
5.2MB
MD579f533453dccabcafc4b02616c3f1368
SHA18838f7933dd1447de0749b7b20ebd9452325676e
SHA256f2ff927939da28c9570bb47d13036107d83c4e92de20defa3aa8d0da36ec9fca
SHA5124f7007531506eb3aba3956043452eacadb2d02d6c5b98899c826f4933d57c9ac934cbeeda0dc03479c46fa0537adb5b357ab36f7e372dfb9ea5281ff0904ef86
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB