Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:36
General
-
Target
2024-09-25_b4f84e8b8750170a1e4feb37f11d3602_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b4f84e8b8750170a1e4feb37f11d3602
-
SHA1
de8e52c6e30dc4632853b1a40703e25df8ed983b
-
SHA256
f9007d7bef2130ed83dd2d11fc7df0e7d21ad46ca8952ba444bab5206198ce58
-
SHA512
518628f9013f7e98c4d6f591daa9f90d877fc26fb1af7a7e560bd973366168b18e140d07f4ad8b13b50ed3674e3c7180384f25d6711a4f4b6524074f984246fd
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibj56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_b4f84e8b8750170a1e4feb37f11d3602_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_b4f84e8b8750170a1e4feb37f11d3602_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SwiDsTp.exeC:\Windows\System\SwiDsTp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzSqedT.exeC:\Windows\System\GzSqedT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVVJiXu.exeC:\Windows\System\kVVJiXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FkExRwo.exeC:\Windows\System\FkExRwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QPZQbhM.exeC:\Windows\System\QPZQbhM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqeqmyS.exeC:\Windows\System\YqeqmyS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WOgqqAO.exeC:\Windows\System\WOgqqAO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQKOBAg.exeC:\Windows\System\wQKOBAg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WkvLoxr.exeC:\Windows\System\WkvLoxr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOUbeed.exeC:\Windows\System\pOUbeed.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zjDZHBc.exeC:\Windows\System\zjDZHBc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vaunbRJ.exeC:\Windows\System\vaunbRJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhteIsI.exeC:\Windows\System\UhteIsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VPCVofd.exeC:\Windows\System\VPCVofd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oHGPXYz.exeC:\Windows\System\oHGPXYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbrCdXL.exeC:\Windows\System\bbrCdXL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QTXraCl.exeC:\Windows\System\QTXraCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VKhKwED.exeC:\Windows\System\VKhKwED.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eomsJQW.exeC:\Windows\System\eomsJQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wimEQjf.exeC:\Windows\System\wimEQjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ItzfEQW.exeC:\Windows\System\ItzfEQW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD513d613183cf746ec3bed8c06c9e6b6ef
SHA1e7d5ee61b33ae9eb16c9ac8d08fb7c8476d7e362
SHA256a358e8ce2cf3075f5738125086ee0e49d1212d8f98c1a383ca7cbb5886c6cec2
SHA512195c2d1ff3999176aae406792bb3ed02058da6a0590efa322bf7fd0136d656b9bc8687950a7f7c6b3ba11774d0124afdc9fd38ad98046d10225b24f1959751b2
-
Filesize
5.2MB
MD5b8c877c73938bd30354b251af51b6ff8
SHA16d3582259c7326daf9a98258bac04cb31ce1cd76
SHA25659fe8edc74972d229016257d9ece34546f9df48b3d5cc6cd3714b1bb40589e22
SHA512d5208829c8ef8eeb47af89a021e0416474fa356b2c6df3d4acc327fa7034e84653ff2c66fb8c709c120e03e3e04c23d4725d4825077b65f854fcfd3cc89ba24c
-
Filesize
5.2MB
MD5949562e4a4f0cf7b883218064f60cb6e
SHA151104d6498bc0708ed94067040b20fd3b2b735ba
SHA256eace41aef3cb4ef30dbbd9297fa59c590d876019c007f17ca538865151eaffb0
SHA512ffffa95d115aea4a4d126bba73e5f3d080a3c9e5e64f91d838e5b74c15ceb5c979207793cd08750cc7e9bb3cff3978f62b1cb0fc33cf528803638c35c5f76e00
-
Filesize
5.2MB
MD538d1fbc3cf720796ebb82ca1958d5d4b
SHA1168d806f7908eb88573c7cc0cf8a63d36daf33b2
SHA25674e07f4fbec4a0166a44b6b605b7c7736470c9a85982de84d6a1eed3add435d3
SHA512c23d53530fd30e4a390eadbd0607323bb85ae3af6643cb88a0a5bc21d2fcc1a8259714fcbe6227c71727508687c1cf808f4c039dbbc9ef747152f114e0942fa2
-
Filesize
5.2MB
MD5b57a9e3fc8a4618af60c2c5967a44026
SHA1bd67e513e2a4b1e6a3177239d3a7708e24939adf
SHA256a189496dbbbe4680cebb23dd8f1e2e7619bf893b8d8fab0842445d7443fd8d50
SHA5121860abff36a9cb2065b4dfb4d6431747069d58e79cd00add5291ad8c75501fea2d6d436487919536ab338a7562b19c55f73952d8d041b49449102ba79802a669
-
Filesize
5.2MB
MD59150e93c1135c6f6ce7d2577efc5b7f1
SHA130e724f1c767a39f88f9c1134932b4895de1a40a
SHA2564e75d6bbba99fa1ea8cd44e0efde7e001520755a1b9a25cea53f16ae90bf0ad6
SHA51206dbc8826171de7dd2d0045e8b4b7abf81ec019453203f7c742cb20daadc1cc24ec553d24ff295213ff341b62471c25d7e18a76729c3560a6797f9876001aefa
-
Filesize
5.2MB
MD58a06f1ec2e505a55c7c5bd76c5c734f5
SHA1a142c1edd68b7c3b47e20344454148a33cccc40e
SHA2566a229ea2c4040c5295ed0f669ed77edf46e4798c7110dcaaa0d809902e23847d
SHA5126d54c7af75dfe1d00c64dcf1c5a00c335b7f20de4df460ae753e7b90050ffc8e2a49664e7594aff98bd164ff357266e9cb77f709c513df9f0d15d36fc04b9dae
-
Filesize
5.2MB
MD558d9cae6b7df60b8568b4cb670c719ed
SHA18b94da99b5309fc3fcb4909c1a5ff90ecaa11b0d
SHA25668cfaff8e48820b83ea682c7fa69244bb76b3b807a87388c26b2775f45ac1044
SHA512ae655eb6a4bd9b97a6af0c79edf82b8cb8f5504281ced1d3092874fb3e21f5b8e8416853f8464419919c08016bf46744bd1418f431328eab6485177bcad948e0
-
Filesize
5.2MB
MD5ab2ea0eac5183aecaa7e774fc6988cf4
SHA17d1852e7c672cedd24f02a542c2937bb6f38de7d
SHA25629ccc7842f256533ac247949a52b493040e033d4a303e5c7c2adfc69b097f6c3
SHA512f779b4991c291d893d07b8b442e176ef6c6cbef1407d98b61c05ffbebae0c4f53e81dbb477c0d656f53cbd2d8e0c4696676a10e37e234d7e0b9ff0be630c75de
-
Filesize
5.2MB
MD50ff1f698845fb27199554afbd23bdab4
SHA1c404dbdd37867e9b8e7f8801f0bcefe2e3ddc814
SHA256c6d121ca73b5341a77284ae49a8e2a4e0b9dfa774efb035cb29cf2591da0a5dd
SHA512daec400f769c9a495acb58e11cbe9579243d1f6a7de9be5e275a42ac4ee7e429df1cc258c6bba4e1cc9ccdb09d302218545af21a79e748aca5850bf234ba7534
-
Filesize
5.2MB
MD5a938b20d410d2883968bab85e6a950b1
SHA12ede7090b8613e7e6e246539f4c41df867cb03e7
SHA256fc45c331a9c99966ec7669a5629f56d5532636eab97534794b6ad324f84ef459
SHA51287903918e7b58221da5dd8f08ff6aa327f7d1dfa95b3ef714cf3800cf651c324db290b472108b9941af8d7f1d71c19eb7a612cc649ae8183a4f23ce7bfdc2088
-
Filesize
5.2MB
MD5707e7484a56f16850523585791ba5748
SHA183b153d0be104085fc83ad6fb87ae66568bcaa05
SHA25654cab259db02db232f4ef6a569dd1dec4824c85075e9be223cba511de63b1664
SHA512d15fd1fad6c5bafa78974f2d460e08bca710beda24c16dd32a530a3e01762347e4f3b3d97a60603ad4a3f5acef9c793d9d21db6f1e26ea4fc42b4ec971088f47
-
Filesize
5.2MB
MD53218d37233e671fad388162a35b672de
SHA11e21e1c6d8f96b19a7be78941643af1938534163
SHA256c6c5f07390923ac318524994b731e24e247122c2c9f20198600fa8a3ae1a0c20
SHA51257c0de61bbd098af2fcd1aa7801f6782a2cee972656d523e86b2e29d0f983268f551efbd7ffecd9660cc4feba05b91200b0955c4e9a8c66b28c5f68305eee144
-
Filesize
5.2MB
MD5f48851cc2ad8d2454e3a42eb9bfc72c4
SHA155ac18a43874cca6e5d62fdedf8e595f6097f6ae
SHA2568cd5f856a6ce9949612133bdcbee451a7413e194448f1f7b174e9d7cc2b19d1d
SHA51219234fe4517f936b3e05c1e6228224e726f657024f7801edb05cb054cd32fe795709fdd2da64c7634ac9dde88369375acf70355808e9186f5e4b9eba57dcf2d9
-
Filesize
5.2MB
MD56bbd7ee699d423f0c1e269c479fa57bd
SHA1737012563f3f0d1f0a5cdf7c4f5b4388be077309
SHA2562df5190ab8e96850b574627dec943afa5f61da75fe19874fb28f13c60e404b25
SHA512b1f8707fb708c6be042c6be702c3eabd850ca01b3490520134270f2a64e962086d71a36f755153f5d21ce89d87c7e75fbc37a54c6e73fc0aab2ba59f3cf6c72b
-
Filesize
5.2MB
MD57eb5444e80421fef980f44a0e89df9e8
SHA10ec3aacfb28d96b226cbd7bfc75566137877d3a8
SHA2561b3f47b2afe6befb71594f6678959130030322ec537c5da1eaf76bbbc50aff8a
SHA5122893bee91d2e1ccf8fea652ed8642e7150e15b3fd2c31ca69f8deef22468cce7d09a886dab9e5f6cac0b0842bb9349956e6b82570dc6eceb3d662ad61bc74302
-
Filesize
5.2MB
MD515c91ef8cf5ee071a320d95d48e11de8
SHA1e1a33957b3df711a66bb656b24f883f860d7752d
SHA25629cfedc5fa123fe071971dafb407516243313f9a35d0d12de7f1e680085e5588
SHA5126da6c36966eea7dcbdad8a6399bc732faddc90fbf2d3dc49af24d9271ad2fd8de199ecbd6f7109dadefd388e599d1d6cb7a5e86c63f5e3bba181f113674f07f6
-
Filesize
5.2MB
MD5188d273334860a232dd0844598a892e8
SHA17052b2c0a68a43b896f44da5d89ec2bebd34ac17
SHA256ea0ae3ca2649923c4804ebac837e913577d406d819a78d99cdee52fd0a2392b8
SHA512f5f41c7c7d059d991b739df985ee42ac252ffce33accdb57639ad48600b84ac7e9f0dd1b2c49da11aaa4bea5518babc893dc18bb6825ecab9cfa203a09ecf43e
-
Filesize
5.2MB
MD523e19cd1f42b1fd98e7d495aee07d0da
SHA11028e6c1b2f3b9f36b41cdee516d708aa47e396a
SHA256e7c8079e67736fb3e701d497d5b05825f4d13831f4fc596103a425e7370bc042
SHA512d7fe275a386e2c639ca5a6013530593cffeaac6f2b64378606eda4ee48b2106b3184c37abf7a88f076e550adad22a7344ffeda65fb4b8312671a0965c48dce25
-
Filesize
5.2MB
MD58099f535545417803807b7980740aa70
SHA1e6c329e93db2d68c59bcabe4b557645e07acf4cb
SHA2560c71c065386976a95fb35b7d217b08e996f0ecaef1f96208743516660187f866
SHA5125dffaf9175bade8a87766337269296553b86c871509dfd66430416ea843290edd6dae61019ba8c65242069eb476c2d3789db6c1a9bc775d08a61f06b6ebc1236
-
Filesize
5.2MB
MD505abc4486412844ff1822e9dedd298ec
SHA18530a0e18f84419cdd4bfdef530545de0beba91d
SHA256033bec4bd9e98409cadf846d30934e5a422bbdb9a25f36bc1d6be83f73353f4e
SHA512ae854b9558cfa17f13d6ac9fa440429a3278ddea345d867ddced0900875014c2f736d011fb1d8837887520a3fc6be6c57a7123f057a9bd6041c75976234d4390
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB