Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:32
General
-
Target
2024-09-25_90b7a6a865a61f1b348b7d70c07baf15_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
90b7a6a865a61f1b348b7d70c07baf15
-
SHA1
fa7d2f2c93679c78c6ce24da13994a76834f9d9d
-
SHA256
8502fe1119384ce385e75d0bc72b477c5f4875078b071a7b75c312c7a6a38370
-
SHA512
b0e2a78bb5842eecf61b3057495c32dac6169fde30806fb6de6d25702f6185b27d432b6c60b66ae5ddbf15c07380f93b9a933eca127a5b75bf9de192829abf8b
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibj56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_90b7a6a865a61f1b348b7d70c07baf15_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_90b7a6a865a61f1b348b7d70c07baf15_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZkrQZjZ.exeC:\Windows\System\ZkrQZjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvfFDLs.exeC:\Windows\System\QvfFDLs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZByKUEV.exeC:\Windows\System\ZByKUEV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\syCmZeI.exeC:\Windows\System\syCmZeI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAqHzXg.exeC:\Windows\System\mAqHzXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzUMKlC.exeC:\Windows\System\QzUMKlC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgVaJYz.exeC:\Windows\System\CgVaJYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UaJtjNb.exeC:\Windows\System\UaJtjNb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swakOQg.exeC:\Windows\System\swakOQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQbdqQu.exeC:\Windows\System\DQbdqQu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NmDenlM.exeC:\Windows\System\NmDenlM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfchLXW.exeC:\Windows\System\cfchLXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIXWAuN.exeC:\Windows\System\wIXWAuN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGmiVCC.exeC:\Windows\System\fGmiVCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYESRqC.exeC:\Windows\System\hYESRqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IONTsTX.exeC:\Windows\System\IONTsTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmSvzdD.exeC:\Windows\System\wmSvzdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBYRDQN.exeC:\Windows\System\qBYRDQN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcGMfRY.exeC:\Windows\System\YcGMfRY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWecTpC.exeC:\Windows\System\FWecTpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcjAtaR.exeC:\Windows\System\DcjAtaR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f479a347c6eea5f225991f2541abb44e
SHA1e7b20703384486b6f3700f8d00dde60d0ac4bd5a
SHA256d0c0d50d5bd341de01b049ec635d6844cd284173d4d5892dc01dd47f5c8d7190
SHA512a2b33dcaf7fb739f8e2f8d11f62add3c4f11476444b06df52c3bf41b25effb117523125f775f8a060f877326e0b0a83c5940b91bb7374298f2b48cfd76c4d0ac
-
Filesize
5.2MB
MD5009ff79bce04953bdf3290077ac667fd
SHA125f2af3cd8c4472996e3490306d17ac3b9691b58
SHA2564ddfb3213f75bfe41c81e704b62476545953f0c118e579532ec24a42eac82a50
SHA512eaf9a1fe9a2a07e3cbadd2b07cdff45f98f4358389d1fb6d3459fa7d09ce5628777d02fee14995433958ecf8da8769ae46a6adbf3e93131d6773ba1872c8874e
-
Filesize
5.2MB
MD5a5ecd6f9af7e1e8432cfff3ab84bf2e6
SHA1738bf8735016974a169c0763ce6ccebf4dc1c352
SHA256d09761ab81af86f77e5c0b01a6320c59ff87bd467606c88a2fcc7047661fc120
SHA512e3f796d2a8a5c98658a96f0a254571f4baf50f685face6f45486b384217eecd465c2c986c5732fad318a2dc13a85e44ac6accb7858af97b01f7a0db9b5ffeafa
-
Filesize
5.2MB
MD5072aa2ee7e644ebfa518e63218500386
SHA184d272ab9860886388657164789b15daed49e403
SHA256ddbde78d52095e450d6e4f9a531e332226c15bea16697cbf4ca0d1cbfd564c49
SHA512a7166acbcf08de4a30e18fd1f01f7340ae2d03ad49f6842c6f87d1838791a054910711c5dd986833f6a35830d549cd88ec5ff5097b4545bc0f9dac8f16e1300b
-
Filesize
5.2MB
MD524568d45ec66895d11dd9d25c17add9f
SHA111f8c438c82e1fed6cf07fd85e18f169077b7ceb
SHA256914b577ede3d0ad9504938f9436c17f83cb9afe1be9c7ba689966e52436df773
SHA51225f346311f2ac32569e06ad7318989a801e712337ac52f28fe0006e27d4a73d76d6c59de8cdc46ff084524f613b5e4d3de0f7a299101dea0f27f1735a5b18c6d
-
Filesize
5.2MB
MD5c3873e7a9614d1e1f3d6a5029cf8828e
SHA13af153e7be70f3c5336b30df6e8f070967b611a3
SHA2565811d32da8c415255731a3a709877ea31f77db30dd4042a1ce7f835f51394cd0
SHA512651ff93355a9c0c9382e392aebd6e39a411eab363983f3acd5c89331d071a184d942fb21ecc66dfedaaaaa07a0807a3949e51e003d78aa388d5ba30a012d4e0f
-
Filesize
5.2MB
MD5197688fcdae14fc7c61767091720ed14
SHA14bd4279d00c0836f271127b0d29a96b67a3a665c
SHA256b31754dceea7eb96a5d505ae7607778a25d542177d30f21e1bb63d31263d7f0b
SHA512be7080cf56c7cd2fc77f86e48e3cd02d758917b1e1bf3d225a0d48ef4df929ab0f44cf3029fc1b072533c6cf6a50b454b4bdc74dfb8168a9f0f443e22ee2bb40
-
Filesize
5.2MB
MD5d8c4bd0b1d1c08e44b38ec917ec7d065
SHA15d91af8516bebae21a7af35ede49da9a62c1f07f
SHA2569afcbf8f6bdb183b1d2522dc38ef1c220c8e0e39287bf22803624c951215a01e
SHA5126b482b0fb6f4a16c5da9a7463245b44efcdcad6860681b02f65c32222e881f2e9fdf0788fbc8fa1a72928b4f7cdde5f30ab5a3fafeeabf8cb9dfab7bc4e10615
-
Filesize
5.2MB
MD5a007afbe27672f3488c3db181015cd0b
SHA1775468a472d18ae57d738ef54ef90a68eec5f59b
SHA2564884ab45f95efb843aebffb804830eb89618aa6722fd7c567827a6c4b09a5b12
SHA512210da3fcfaa386c627049c63ff21b5542fbe156b370ae3a0450d1ff475a8b13882aad42b5fec095eeac4072ef0cc714a4c468be48fdb68c7d10cf319b8d40295
-
Filesize
5.2MB
MD5b6b6ba0fff66db05e6e65c7d138e4230
SHA16dfbea0e6414eee90bae0a9267ea3328c60b2e54
SHA256e3de71acb6d8c55f3e3e567374a0b74fce58aafcfd26a72a666bf478afd212c6
SHA51243c9ff5f9d0b46528f82348776648bb8d354f313252b903bad635bf6f56c86290901368e469820ba1ca7a7e4e0ebdd4cc87e8ac1b6715d26e19b0519996917db
-
Filesize
5.2MB
MD5a017a61ec606ce0ede8d659d11000f9e
SHA1875511e2044a50e1968986e23b0896eafb69edd3
SHA256c6bc48a2c05b669f9f5d7a741dde4a565c5b1aa7a00b0eae374775293ec5ff92
SHA512b00d62da4b34a911aa5bf330300dec981e4f3f78f5dc8023c92fe910f27d8db22e6c20dc143b9eed7b596f6d7b37ec491c257cc115bb075b9baea87c253a0e73
-
Filesize
5.2MB
MD5502b0bba6643ff294bc48814af4fe525
SHA1979b7c7ea964a94bb9f9ae555b43adf6e95b5ce1
SHA2564d770adc1d825a34810fdaa9b14de87dad75c9c3c59991991f52e6b894e1ef8b
SHA512cc32f2ebdb54ba2790a0cef836c89006cf7c035ebfc120df72b6e6b50edf122896c99d5d0a5b7f8d1358531d73af682dc795f743afb91b834f1b053aad18c142
-
Filesize
5.2MB
MD52801b891b71838006de3589da801daa5
SHA1ca99402b0e7aa8c7924a6cc84f5cd9a3dafc9c8b
SHA256765cf09395ae378b20f33449035318bf1b329eb975790f48bc8c43dd0dea81f7
SHA51299d108bae945652212da2cfef751e0c966363ff2f6670c40987203ff59fd2e7a4bc956211ad48e40af4176185e3374eed6e1a3e61b7eb4564583bc3458964c6f
-
Filesize
5.2MB
MD58e98662120ea6d42017c41986249c13d
SHA1069cf4260441cef7626e8e47b6f2f7e85a17af0a
SHA25633e38c0386d6d282cb83d4fd0c12a1af83cee3fea582e308828752ce7b357de7
SHA512764696b8fa88cf2f2ecafa937b8becb35560466a1d7cfa0ce33249a2fb95b78a787893dbef2a89b91bb68143de518b2ce2e328a5ed14374b1e88288823b3e839
-
Filesize
5.2MB
MD56aeba7ed2d5cea33a13af8eb1519e1f1
SHA1eae200d6c5509419225247456ec1b79ef0ad891b
SHA256c88d3d2b2731953a11fbc015c0d2920fd074cb0cc741718de8e0b7d23cdf2e73
SHA512575ff2945cd21abc7088311a3253ccb91f07ade99b821d56c76cf8599a6190411cb10792bbf0a790560ec31a60730180a4faa92ba50606960fd99f5a94635d67
-
Filesize
5.2MB
MD5c2e98a936c44d8bfa61eef3b70e7b70e
SHA19425d84d42ad567f2943be4657e8c4bc2296a91e
SHA2561ae7a38e67889714e8078a59b8f9d8d1a64bd121b7fa6740524b70433a42e680
SHA512868c5ade639d9b20e8fcff894b66914e9731cebe8a99e16cc441cdc2e7cbe0e318253e8ce980b540ca06842d70ecb5743c813f9ac66682869b2e555dfefae846
-
Filesize
5.2MB
MD5c5d9d3049d8bb1c1715a194763c4541a
SHA15bbc0f258694d61e87e8695232eb5ca3ae946cf0
SHA25698e852304f5aaabd2c4cbce1e32a9108f1ebaa344079582457b9537ef726df71
SHA512304fb9a1e1904875e304fd8e2205e72327cb45ffdcc6d5c4608d93959c44ed6fc5753a3e2d629d429110808362dedf0c401c768edbdf388c049561a6b81e1da7
-
Filesize
5.2MB
MD567209273809128c469c1dc45f01bd079
SHA1117cf664d62e9d3586067ce5dc4a85e03e052e66
SHA25695a5ca46e879167842a3bf06ae96313424b61553b64fa433ae0faf342a0f1657
SHA512a1faff7b36b3d157d2981e0a81f281a346398db022b87eaa2c39e75337a9fb38700724c802d556eabfcbf35151a8aacfc53d61624aef3c4686b67be3f527a3fe
-
Filesize
5.2MB
MD55e22775eba301c86ff6b970fd9222bef
SHA1a7945156387158072b2280647a6eff37ba8e2b4a
SHA25634b0c7c2c0767bfc9445755f26e53073f1ac8b63e6c351db48c3dfc04c4afc85
SHA512d113e7cfc117b284c06eacb841f6a3dcd33a10f65fff168fd21921d0c505a8fd0bdf42522b2cbe41a95487ee362571a9d28d0d2c11d8cc301635f40ab1e5faf6
-
Filesize
5.2MB
MD5dbb8e5f67fbf17362d08b45a0edcc7fa
SHA16a9dfaf3aa46f26631dd74f8d88f156d8001aee9
SHA256a3a07d92358198905ecc39b3225871afe03ea85b666492aa82cbcee4abeb4f18
SHA512ac7a69a21e3dfdaa9dce6e8093e34e633b105d9c9e5d3fe48faf4fc063b62b4371f561e3ac936019bb5c2ece03ea8ea05926a42b1cf7404adee39b4c2b32a6ca
-
Filesize
5.2MB
MD5fdf51b6623e959522c4d84a967f1812d
SHA1bd7d20ee84fc63e6846839676fdbd1247edd0ee0
SHA256e99b059686cbf979633857022f5801d7eb755f9efed51bb2a4a026c355f48fff
SHA51205da8bb9d7ed7389eaf0beb1991724db0839c66832095c27ea5bd8fd17ae359eca5d47948e72cec52dd743a41e07c511d16cd791ba5f9963a9bffa2bca717a7d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB