Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:34
General
-
Target
2024-09-25_9b94e6e0408f4903c272f46c1658bfec_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9b94e6e0408f4903c272f46c1658bfec
-
SHA1
0d6b80ef42274b408b4d103f90744a2ba8cc19d8
-
SHA256
31ab60a4c97fb5c53ebbbdd059bb6e6777c7401897b35eeb38dc095d3002ebe4
-
SHA512
055b2d6c61154f209d4cb2cfacd51740353ec2e977052fbc0a3beb852635e6d8bfabde36df617eaff7310f278796f0a092d73f03acf499e9cffccbe4080a2457
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibj56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_9b94e6e0408f4903c272f46c1658bfec_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_9b94e6e0408f4903c272f46c1658bfec_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hrudiOM.exeC:\Windows\System\hrudiOM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZgdPDr.exeC:\Windows\System\HZgdPDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KMZgoua.exeC:\Windows\System\KMZgoua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\toTLygQ.exeC:\Windows\System\toTLygQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quJxMNo.exeC:\Windows\System\quJxMNo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUNrbyD.exeC:\Windows\System\pUNrbyD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SKMGEOC.exeC:\Windows\System\SKMGEOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xjMHige.exeC:\Windows\System\xjMHige.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omUOuxg.exeC:\Windows\System\omUOuxg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UiUrZxf.exeC:\Windows\System\UiUrZxf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxMqCwk.exeC:\Windows\System\TxMqCwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Rbryhar.exeC:\Windows\System\Rbryhar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbgozQl.exeC:\Windows\System\SbgozQl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xAsreVn.exeC:\Windows\System\xAsreVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvovNrj.exeC:\Windows\System\wvovNrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AvTaasR.exeC:\Windows\System\AvTaasR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MfPqCQc.exeC:\Windows\System\MfPqCQc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TyQjbIy.exeC:\Windows\System\TyQjbIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqMODfO.exeC:\Windows\System\KqMODfO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGLRGAb.exeC:\Windows\System\hGLRGAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VTrgLth.exeC:\Windows\System\VTrgLth.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50469adf0c9a796d2870e871540f8a365
SHA13829e555ee6cb276169e94c4e968e586297e970b
SHA256b6f46d914a13c52855e228a0143f78de1e47a82d5f98f3e3d5549d46aec2c177
SHA5126b9e96f7bdadb86140d888446b3f6ff1d1ff3c111e1dd2f05b6793b84b001720af649acdb6dd4981b4206a9adfa1d07f37faec61ea5700bd6f90d3710de75914
-
Filesize
5.2MB
MD51b51214d0a4b69068588085b8e247d55
SHA1cf9d8e5eb90aa15e57dac1b92b179f3b7ddd71e1
SHA256f3383d86b9675451650ffc52dd68efee967034aaf2c91816279637c59deadebe
SHA5123c7dcc9938f6a33fbcd2e4ee253cb8338f3f4ae152fae73da0f0667ee887a7dde5ba7106103793ac02cf39fd39095b90c05d60231b6c541939157ab12b3036c2
-
Filesize
5.2MB
MD5ed779b588546f3a76baa2e0e9d73cc69
SHA15220b7d0c450ef40625d9f652c9aacd8b1a7c0b2
SHA2563829374cf3a89ca27bbb5c43de9cbbac23077d451446ef69a8df66fe77b6a880
SHA512a6dffe5462dd7fd53dc97cd1e857736afe9b7a33ee567dd2599bac17b5c81e8ec4642cae15ceb467ab189d5cd691e4e3b9940aeb7b06dde2963b3c3c920cbfbf
-
Filesize
5.2MB
MD59e95deb9a5177a595afe240158a53c75
SHA182466abb068c8f0b472d1957deda19da94cdf884
SHA2563ce9bade6bc126fd9d06d4efc85670dab84844ad9056f1c0a3384f5e1d88c77b
SHA512b183f8f287ec1e9691d44384f7f6ffd1099f963c041c512e7d58700d76da17c93567589c286bda37adf215c34ce655f5244dd7f5d2a577f6c64cd0da2688acb0
-
Filesize
5.2MB
MD59dd162a080621fd79a180c8e697a5d9e
SHA130238769f4f78c1f374d09aa09de408624c17206
SHA256df8ccfbf21b5279780ece0c1dd8c745d3f924f92dce73ac97e031ba76c5590a6
SHA512a75691f96788ef836acb038baf223bd1e94ce3d04c44f66fa8fce7b90a92ad4bba93055ec9cdc1aaf5bfdb99085b19682ff9b4be1cc0464ec540093d07bf8fc9
-
Filesize
5.2MB
MD5d2d5e8c63c438458ed751c39c774f43a
SHA12a61c2826ce1f123832d83ff64eb0f8fb65b3ce6
SHA256b2a3259cb418cd74c431e7ba390c8ee2ce362b05cca8aa01d70e3d1b2449a048
SHA5123a73f39025d20a94f96b4fb63421aa75170175a850b233a7f7572b8380933393267f4ccf762986c6b0b5f4a7813af9ac5cff0e3c0c500c4c4f749014c2f18561
-
Filesize
5.2MB
MD50948cfb1fabb838c4052d94121a38961
SHA1d72e69e90a62733e9bb71dd658cfb21c24f673d5
SHA25688323a6be09cf7c82f953c33098b16fd8da7e24f5e26bb5a0cb26c5e5cea9e83
SHA512e8c592f5e666072ffe59a1356e0028e1f58fa2b7ee20474eb2209817bff4afbcfc75d829983dbd9ba41bf1fb52343b4be4513a41adc2416f9977d69ee28f8a06
-
Filesize
5.2MB
MD5c7b31ab4916c1d9048f24883b3c4903c
SHA14fac34d455c26d2ede81dcd7fb6e481e0925ed10
SHA256699569e6b8492e325df0996023e3291ae23579e1fe73b1bc06de3c3d59381eed
SHA5122f4740d97fd28ccdbbe77dee39fe587a65108631d576674fa570631bd645d140b5fb9f989c02fb1fc61b13c6426a6e9f148a624d4695c803dd2a4e1018e5d4ce
-
Filesize
5.2MB
MD52f50f18b683efd8cc96338e64601819d
SHA16b34b80bf4c20412f9d18a2b58e4d91b41b8f990
SHA256901ea5898b7548afc2ef3039fd4e21f66947a166b46211fa7da941edf688d96d
SHA512bc75d3d927d8a12b6f3237dfb15a33240a1c9b7aa1a7188f9bee794e4ac8ec2d90377ff340569693128e56c73b48f9e542032d86ad0799bfde4a5e731d98ee09
-
Filesize
5.2MB
MD5dcda570e15ab33b43085ccded0477402
SHA113d58ac7ca254c684b93926c2cd1d2881b6f9e2c
SHA256d49deff5182b5ec61ebf2fd763d36fe7297f01f1277092f2f347c0192e476ef9
SHA51234e3881903187d8c03c3aa1ec116bab2a609218fd13ae6f6af59de8b62e30619be2283eb3be1b643d9c30141ec3ae0343f9ff2ca37cee88c9e73f7985e8e4421
-
Filesize
5.2MB
MD5a4a67da01f421c44abf7285f971bf701
SHA1a1e93c324e2cc7e548b4eb317c2164768b4cc5d7
SHA256596cb8535774ab446bf34218190353b532825cdabd7122395824f46da9ae824c
SHA5124546d5e16348a9d4d0f09f06bb2a165c00edb32d81bea92cceb770bb7d842cc9665382fd3a29d8b0b8deac2c760b83df15757c57d962099aa29c3fe3bc307ccb
-
Filesize
5.2MB
MD5776f96af73bfb8c76baa1a137bea65a8
SHA1dd5de50bcc655542a38a25b23a0a31b6e6cd066c
SHA2569fd3f257d549feebe63bf7190d4bb3263fb815373f931a62277fb6f6daa1505b
SHA512d1a36cfbc5919a9f17513378f22cf53f44e5150878338fef61e157a3b19b307ba1d968babe162f228469e3035afff6c669b6807c5a4f6b1b7e76cf8d941d7905
-
Filesize
5.2MB
MD572778903b3504fadce280e25b1bf3fca
SHA15c7ddc45cab222d069977e4ada8fda7be0e565ba
SHA2565228779781fd564617dd8ecedde74c77849d861ffb921868c69c26f4a83e8939
SHA5129ddc6d32da15c6f10cf02150656a5f72b92c5325d9d74a0937a9a3df6df043cde8de6b0be86885341a9bca16b83af678d5f636974f1507a21ee0fa92a0ab9f32
-
Filesize
5.2MB
MD5a70f52db5976cf39dd73771b6d6dfb5e
SHA1511300503b99bffdea8c04736fec036ddc873995
SHA256471bf79bf701769f710fca622d633f938e2cd3893ce0bb1b2033986cb007ffd6
SHA512f2b462636fa008ce1cb2ec22f2f7b94e164838be89e8bf10e571d8e1ad7ee85d6465dbef42d5f1fe5978cf532415bb7590cd4bd4987c28f87cb168103fea3f67
-
Filesize
5.2MB
MD57f15ed9bb34004465018ce6937c94d1e
SHA1ec4c1456aac11f704ed669170432990c120f8e4f
SHA256e84227c9f4acc88873d58ec1bfae56ab2cac71215ff6d6317878f859c2c4f9d3
SHA512ed529e0f09ec56ed0a1223abf2efe9099a86a97772520ad7d9584522b558caef7ab5d65e9be7154e840fb0c524d4c0d6734e7fc6f03c3a8d77fa9d8abd6f28b0
-
Filesize
5.2MB
MD590bf627d0d4ffc4ac1c8981b999d5167
SHA107c1a3cb62d9f4d1d0d4020fa9c3fdb156b59249
SHA25668b7a17bad30f67418e93d3db566e045a87560e8e81d427d8d615df884fd1780
SHA512aacae02d37a76178beb383b1ca9ba8e39f424319e1261061a036ad0ac5b737bb886e683bf6f4db3fb420047e84f0d45e935a40162d11c13affb0a4523bc4ae59
-
Filesize
5.2MB
MD53099d983e92e21e9ec2abc051394b9a4
SHA1792df17272facfad6912d10cc55dcff806dbbf94
SHA2566901c4019ac3b3aaed574f3d4c074b54bb69850ac59f98bb7d77debb95dc92b7
SHA512d55906214fc9d74cf34bf331bb615a62db520d885aa624175c12745222d500305f0be6e547b8141c302757cd7a96ae9e788fb2ff350ecad2220c95f8481c3929
-
Filesize
5.2MB
MD505e46a39d1ec14855a8ef3cdcc777875
SHA1125baac764e458ee8c8f5fd570300f325fa3ca7a
SHA256ff9e4fb8aa84ff6ae3ccf7d97a4606506a2d3a1d5c080e5f1a7e650fd0abcf00
SHA512f5c03c238458613c9c9506a156a556b24727273b37bc16b65bc984b98656af39b51f929bd7020c548e7d299dafb33408e5f625ff389010c72310272bc9e2f904
-
Filesize
5.2MB
MD5666cbd664499aee9248c4277d07c9fa1
SHA1b62a1e01de79fa06497079f4dcbf5f8f624a4bc7
SHA2569509b75bb3613d786bfc5c7f557ab8c8851f1d6a912f4b3e85463f053ef9a1aa
SHA512f326fc7f1816c0cda34478ed770ab7f227ee9fe72516625a790b0c5bb9b894497607782a5e3f3e7426d8bb5e1e81b1bb1e2cbb68e35c4220a5ab1bd2911eb0e3
-
Filesize
5.2MB
MD5c546e9bfe38332e68f5c685c067ca406
SHA12fb94b6157a916544a65231f6733f349555f9d48
SHA256ee667de508da35438e76261ccdb163c879c6cdc5f3ad1bba733d197a36025a64
SHA5129ca6036e2c60c7c517fc63e59f1cd6d9d8ef9b250c4be21015cf6cb5c1e91c584e5957ced24d56acf0cc955a752b9dc340ef1f225159e4b9970e062ed092e00b
-
Filesize
5.2MB
MD52311800b3c50f1c4edf9037c501bbb55
SHA11cd6ec3c142850f3408fcfe8393c88f1a946b345
SHA25650cdd57f41c6148305069812ce9ee2feef3a6f7faeff3cefa625b4b4e4edf159
SHA5128e7eb07f5cf31b2cfd2d8edfb2734aed7a477399d1178fe1dea7e92c6737e2ad90a257d02a151a6e797e6d780a8aebca9e18427abd791c88e5636cf573b56229
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB