Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-09-2024 08:44
General
-
Target
2024-09-24_41408c47913631d5c2cc09d5e1f404c8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
41408c47913631d5c2cc09d5e1f404c8
-
SHA1
e638d2d2bc475d08877517ae483cfeac346ac7fb
-
SHA256
c05c2828bf15eeaee89e7c4f6a8c2268094f8c368d9a29c4a502f9fce62fd287
-
SHA512
a1589e35ef01b2b2fb06cf286297a1b73a0864cc4644c1723cdac21678d90d5b0359bf47a63930983aa8454d75c5f831ba93a022bd97702b450a8e0fb655b994
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibd56utgpPFotBER/mQ32lUV
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-24_41408c47913631d5c2cc09d5e1f404c8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-24_41408c47913631d5c2cc09d5e1f404c8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qKrFMCE.exeC:\Windows\System\qKrFMCE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lyJlrKe.exeC:\Windows\System\lyJlrKe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZmfyCl.exeC:\Windows\System\vZmfyCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OcBNfFR.exeC:\Windows\System\OcBNfFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeOwffY.exeC:\Windows\System\qeOwffY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WHkicvn.exeC:\Windows\System\WHkicvn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GLLvBkn.exeC:\Windows\System\GLLvBkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aAWjhui.exeC:\Windows\System\aAWjhui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnDJDYq.exeC:\Windows\System\SnDJDYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XTNFeqS.exeC:\Windows\System\XTNFeqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXQjAxN.exeC:\Windows\System\UXQjAxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDjsPyM.exeC:\Windows\System\VDjsPyM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XevYBwZ.exeC:\Windows\System\XevYBwZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efTOeDx.exeC:\Windows\System\efTOeDx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uQRcfex.exeC:\Windows\System\uQRcfex.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YrncHRK.exeC:\Windows\System\YrncHRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYOKGSr.exeC:\Windows\System\vYOKGSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqWXtgd.exeC:\Windows\System\RqWXtgd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\StUEtrt.exeC:\Windows\System\StUEtrt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aiHmnBR.exeC:\Windows\System\aiHmnBR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUaOdKN.exeC:\Windows\System\LUaOdKN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD539d605a21a3d851eed1bc12e9b07025b
SHA104b4a58ec6541575a0b2a39525be33c65ce6d2ac
SHA256e8c44339a34dd18164da8638af7c82a883f33d3abad0ee3fd0f1ca8acbb9d9aa
SHA512baba52f23f48eea944495dd5fabc213e869324b4656790d225f4641f535cd51d163879d44cb3fd6844061cbb5b49bc6e536063e84d161316f9dddf74dfb4ef9f
-
Filesize
5.2MB
MD571856947b738b0e84ecc905e0de914c1
SHA1bb313fb02b1a3b3f4fc9e472cdb013ff1d809b06
SHA2569f7c4686104361b4d42cd0014bb4e9044823fb3aff86d550f784eaf57da620cc
SHA512febb4008bd14a25dba0cd4bc19a2ae6edb5fca025d0fd8aff36184e4e75829ad883a8100ccb727203205fb3ef8d40bafc8902484837ef00829d27d352efcaad1
-
Filesize
5.2MB
MD55647a2d5b8df34a3eaca7979f58c2bab
SHA19802597466a17ccd0e852e9ffa4a6a9eaeee6f1d
SHA256771f0869627f39b410fe2da3858fed1829bef14076fc1eaf1fb9e926c543b50d
SHA512645262fb2abfbadae291eb45f81c40f80f58d3c7b2bd23210491c235ca2339c637e67197d7532a6b05db4c8e88295737cc7e5744612f9f70f2866ac4c4a0f3ee
-
Filesize
5.2MB
MD58305d8c071c6c3e4762b87e84c684a64
SHA1ad5e8dec55c34713d75eff1334bf2f0863716141
SHA256ad5adee203e33d91da542437da15eccb3a05591281d0020cd3d57c86482f74cf
SHA5120e7a083af797842f873009a3e69570b6f50cb138f92fb7f3311063a40edcc8889ccc4f2a943ff3326ace2c65fcc77db990ef9b70fdef259c14110323e78af6d7
-
Filesize
5.2MB
MD56ba46c7afac52a129c9258cfb5851b48
SHA1dff618c62db87038a64c4ae9e8c1ebd65a32067f
SHA256e12e8fa05641d7af2c0cd3177f0201a318a358a3f1e1d1367c5377c08309b379
SHA5128e6466abe5db4e1fe7a78dc6bb59e5100809fe0d866dd2a91f5d09fc372f5f29f83dc89a188692fc613922557b3e2380775bbf835f2c8d69691af344e6947575
-
Filesize
5.2MB
MD572db7a92e846e8ec70311b59e59fdf5a
SHA197bf10a9e8797dae82b80ebceff53eb6a9a3ab84
SHA256c969d2444661d05da8563ba49f858ffadf3b47c230fd42d40e84d5ddb08276e3
SHA512570c08216cf03cca31474bd2852f739795ab33935f212165982cc63ca42bd46195788a478734a8da8dc4e86d35a6fecdb178f7c99e0ae4f7b30e7784c3d7ecfd
-
Filesize
5.2MB
MD5400fd99eab40e0dc1cb058c80b2bbae2
SHA1b490119cba654ee38ea59fa46c6bede8faca14fb
SHA25651f90097d7255288fb3363e25ce314b726e61b5bfca9b1333713ff379a26f79a
SHA51252dad368f51ebbb66ae26666ddd4085e9c0be04eec6b6e9a5b6b73c24b8809aeb986baa40a7ed382c30dc32e6ece68844baabd0a94822a6c866072dde43c2522
-
Filesize
5.2MB
MD57c667ad035527f83b439f89420edbe1c
SHA1c201549d1c969bcd05d655d4aa4e43c13ac3d48e
SHA2565e829f919b844d9b20830d11eca91fa4ecb29c0d4e317f8bfa3b069169ba4e41
SHA512e64abb59ca8114d8fba5a4c5db8907209180344f03dc79dc3a836e2c4174929e4171a6604f99828167175e148e1cc9d47df38927a6f4f3c6e621f02b9ce1861a
-
Filesize
5.2MB
MD5f19499c3b9de8c39f61c36d4294bce0f
SHA1e7f3b11cc4c93cb75b37de0605a0fe116bff7c21
SHA256aa57ef58e814e248181a87e981f792bff81621c5b78221403c019afff0532d21
SHA512290fccdd04d8df98eaf34396a78f3c742079708cec09b99fe27eb1185938e39aa15954b8ad0fddd8664ce5b7f41cbca301ac44558478d2d7c28d69c9a20929cd
-
Filesize
5.2MB
MD51aca39c54437025c2054e92b528c000b
SHA1de6a8ba692f9003ec8915511c3921d5e6ce2bcb1
SHA256460556a511d75e7e94b79b2cceb8985a8c94d4da367f7f2b5b7aaf7141b4016d
SHA51248bf874f2b40f7040c3737eeb015be16a9f484913aab29f6064cac172115bfa06da3eab5e52ea76235200a023eff70520642c36834c2386aaa8d610594dd866f
-
Filesize
5.2MB
MD54feb225137ee88c61cb85ff0265299d5
SHA1ce9d8e06b66541aa58a411e536758fa6414c3db1
SHA2562393a160be83d7ca1582e2b07fc6d153858f9afc850e9f7c4365f264c9091fee
SHA512d7dc61ba18b5811bb1e5c252287b992389d379c01c7ed1d39b1bf2a409b83e45a65f14d5066a6171ddc1adf0f9bccd856f20eff74491e2a092b50937e1a85f14
-
Filesize
5.2MB
MD5faf0864d5e3a183b80fdf7fdfda26cc4
SHA1c56dd67176818cb3699a855bbe4fe0724cd48422
SHA256b35e36daa2f108f31331e92c04c0a1c8bc01dcb9750e4407a5d7e474d3b5c82a
SHA5128b8baced430a01521d88d2038d9b0f52c6a6d5a8236f343127adb0c4ffdb888840202e4b5d5b50293071f66c2b0ebb9da4b1c977f83458271d126dfa34ddd5b9
-
Filesize
5.2MB
MD533ac014968f24d8c51a354218456eca7
SHA14dfc7d622906f9da217e88d515beb8992bf31dd0
SHA25672c581e72e6b5dc37f877a1606e92d57797cd72c1d564a2dde120cb4c0b90582
SHA5123a9cdf95c7e03b9b19fd80c4e99ef60f81f373b9f6e512220e8e40fbaccd6783abe89082297a16e57e66bda89b2e72da050f98ed0ccd343040726fe111a91e09
-
Filesize
5.2MB
MD505c58a3405e99b81390e42003c3d63ef
SHA1d97d937e9ce23704b9c70fd55f3a1da2655275e1
SHA256cc0fc3f2a6f68f2d9f8b1e8003d4ebf5d3a55ceb7acd5647d21faf587e04347c
SHA512c8100f3fc8db06397947246f4d830027379ea2d9a764d4a556a9fede3a2ca356cbf3cda5f32e04f908e9530929f2dae9c4a8f3dfcf0a323398bbda7fc385d9d3
-
Filesize
5.2MB
MD523229ee5233d38702062da2ae4af47dd
SHA1b052378744896c6b6f9641355f5ae07b12e07aa0
SHA256aa442535686b884fa96d615aecb54d405a6de719e34f902cd818aeb84e637f91
SHA512ee4941a21080ac832140a45d36016c158180b229dcf80435c24bab838f9ef86abaffb5a6ba93456e703985776550ec7d4250aa5b4b8ce1b4909dec041d39d2b0
-
Filesize
5.2MB
MD59dc358e67ad97143de3f5159ec08d29d
SHA138d480522932474333d97db481e90f7ddc2c72a4
SHA256b3385d5f715edd597a4ea7d1271a5f54017f49a212260f930f62dd555b6c5c85
SHA51287504574cf7ac6b65e9b11dd082bc58ef626873e9d062580ab067f6389e156082382dd30453ba15bb9f6f5cd0b7a3d75bdc54d72c426160b0b4cfca99a599fc3
-
Filesize
5.2MB
MD5f5aa6f2785e7df7413bc01546fa60582
SHA10e697894bdec1345ff097d06ce866cf62a49a289
SHA2566a76de017c5f0b3e85914c651d85696d9cd1eda216d53b535f6ab671aed8be5a
SHA5126e059e439a80d79005408bcb0a92a9e60a97388a7c786f1991d0d674cd6df0e46d75af26f9fa4100af7dde8544c31f86a5de4425ca58c42bda78c643aab2e3fc
-
Filesize
5.2MB
MD529139194d2b2a26df17bdef051ed6db9
SHA14a9435b1139bad522674cc494a0d313fcf914195
SHA256c3b54e62c8e67005d2ec3db88e087d981c45bd93f4bd6e7dbc792be1276235cb
SHA512e0e587c54055737092654559f607ec0b7341bcf56115ca0fba0fbde61967dc170662100cbe2d4d76b8160eb7d6b29439c977ffb0ceb72822bdb407ef4b4e0bda
-
Filesize
5.2MB
MD523ee53f450913aa389d7cad71e09a31a
SHA19fe279c6e125437ecf220fd750fb7e8c6c1e2e61
SHA2566f54d66cfbc931cd815ac69769a0496325b1cc1ac9f5b1a9b03f991d341df229
SHA512fa9dee5cf27b9c6a98769e6104e6cdaec45def4d77aaf83b2d0655064db0577b03ab93e42ea0e308dd21f9a506b061a7b58108de98285a9231c12eaebf750b71
-
Filesize
5.2MB
MD57c62705feb904b487d522ab24aadf62c
SHA1a7b3efbb383ef7565c1399a122156c0f610bb38a
SHA256aedb9f76b3e8176d80d0ef02b3edc3fe28d343c59a94d5600ab7c2012d74cfa3
SHA5122861a9e45cf42aa310ed261dcc84161005bb3238509872707fb7b0d9ffc2b9f62aab77e681c798e318e63877e0dac7cc553fef11ce68db903ef1adcda3f4dbd7
-
Filesize
5.2MB
MD588db846f1972f8ff33acff82504e41df
SHA1b89b6abfcbdba7a3b3b874099afc4cc7b373b0d7
SHA256908f299addb6c9e5a7f61e5cb377cd3cc82f2a78805f2c7d5f077f943518c7b1
SHA512361a53148f08b2f46bf0a158b1213f64e51a0e60db0848b400a0bee6a325ac268ed900dda4af41ff69b497960ac8d002062cd4a66f5bbafb3146efd71112c4dc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB