Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:35
General
-
Target
2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9c5c9f78c181fbc34d077734d6c79e5f
-
SHA1
0c063299f75e9d6401293a938af95f220ab3283d
-
SHA256
94fcc9fd6147ce193da373c8c596834c76a433d3a1113886e87f30cf047baca3
-
SHA512
da57e1af529891d06b90da7da6e912be6f318346a3c9e4ba95a8e06ee126d1d029b6a01b01bfe1a372d8b66b43bedd25b0a8a6486bd711526f02da69ba576781
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibj56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VRCvLyM.exeC:\Windows\System\VRCvLyM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQJcPts.exeC:\Windows\System\KQJcPts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XZeATtF.exeC:\Windows\System\XZeATtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lipOCyU.exeC:\Windows\System\lipOCyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bqVSsde.exeC:\Windows\System\bqVSsde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znyjLas.exeC:\Windows\System\znyjLas.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FNwEnwU.exeC:\Windows\System\FNwEnwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLHNAIR.exeC:\Windows\System\YLHNAIR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJQiVon.exeC:\Windows\System\GJQiVon.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bCYwWhn.exeC:\Windows\System\bCYwWhn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XYhAugN.exeC:\Windows\System\XYhAugN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNvlIaw.exeC:\Windows\System\KNvlIaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jrORsoN.exeC:\Windows\System\jrORsoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzOiajI.exeC:\Windows\System\xzOiajI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YnUIVQp.exeC:\Windows\System\YnUIVQp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eCfENLS.exeC:\Windows\System\eCfENLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tugMddM.exeC:\Windows\System\tugMddM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UjiTZYo.exeC:\Windows\System\UjiTZYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYzkrRo.exeC:\Windows\System\QYzkrRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSAWYXV.exeC:\Windows\System\SSAWYXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XLjfWoC.exeC:\Windows\System\XLjfWoC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c9260b62a6945f5a966e432a1eb04a69
SHA1db6de6dcd71ace01bc5f46645f0119b75128b5e8
SHA25633afd6bf647c5b84241c1453c534c8d1a2fc96bd36fe2ec6d3b83a4561d9ac4c
SHA51252b3c48e667641e88082b38eac4d977fb959929c69f95f5484977da913edfdbcbcb226e7705158a41c363b3e1d2a799ee6b00cb9ea38709ac22fe1aecbb754e0
-
Filesize
5.2MB
MD52dfc5d1b5750304bcd835f20645472bd
SHA1c99ef408a0a3812874a1564deb19ca56a5ad89b5
SHA2567259b3d289f2bad5a83f690ac3725b7cccb3dceb4de0574ed0ccbaa4e3f49e98
SHA5125f9e22412d9fb4879ce2eb5951fa38be0d5d3b17034d44d0057c2b999808c380ed5f8620aa03c85c0daa836d8121e1c7202acf0d9eaffd4a5cf31b6e3b4e2e00
-
Filesize
5.2MB
MD5e19194b64ae32daec9a0026499991b38
SHA1e956fde1d4ac026f97d22520bb4f1fb5f794a75f
SHA25606a453c73267e9b8643e118518a11cd8575c5cf4536876b413e5c12c789792d0
SHA512ea1f747f6412dfee0d213febc81beb499008dd01c575b03df047403b89d7a64f6b6596f8cc8fc7ad5b823bcb9b266415250dc9967f276ede8540cda90050b471
-
Filesize
5.2MB
MD58df250ad3eeca18a93d157c49962fdc6
SHA1dab18bbb24d541b77fc5eb1060ce723275bb8c02
SHA2564b6926d3c989c427be7fdc2f4f2e43b4c47d0da4e89e135bce45f767ab8bedc4
SHA512a68c93b928775c880a2360be6ed8e530bf8d39d1ff306ea2a29f9fcbdf08cc8d3a515c7077908d3a0acbdc18b886ada047f3920564db9490f4316e5c54b74621
-
Filesize
5.2MB
MD5d9248d5e6f917388161586c8a1b84fbe
SHA168733e97bab5ca01e776c299bbffc66ac107eff5
SHA256f4097cad81d8c90ff00644e48439fc4874b481fd33a12946a301d8cc291488ee
SHA512ac23d7a59e1a4cb0408b7004e73766a0a0f241166167d696f2341d660d2a058328039bb38275e472196a4a1f06416e749a23f74a3b4e4368d0d5fc47f36b70eb
-
Filesize
5.2MB
MD56b81c1634cf4b131bbe46fd7ebc1e7c6
SHA19020b2ee377dcc9916e739e6adf698153262486c
SHA256d403c6522d8e13c4c69e87ecc5bfa4730d11fa890e378e29034f4f15894c3691
SHA51236df6223eddb966cf504b06d49fb73007f68209f8e1e92c35e1c2eeaf706ec56851a4217f2c5cd4bfbf0d39ae5801ce1311eae10b267400de75e7d860eecb89b
-
Filesize
5.2MB
MD50721419214ba4754ff32249cde70bacf
SHA1efe3ede885b3ec76e04a643558854bb137f8df52
SHA2566c4468f5f1e9ce2d4b2463f70d399cc0b50de2d6e9bd1df053e86b7d78b82f0d
SHA5122309023970ecc5e5e4039ed7360908b1d1980bcbe67211ca206631e7e682e63f8f5ce944b8d04f136efe424e7e7a578b142920d2c65a1e51060f4847eb3d2ac0
-
Filesize
5.2MB
MD5bf61c33d5f18f743a20493256dcf8caf
SHA1f7e30a3fe36800c6b5f703a00df711d813196fa1
SHA256cd99f9ba17de3e4d316b01a067fb5c5a890b0d0b78d514cd0edaef692a6c0314
SHA5129ce2a6beaff2251559807187718dd70b36d9d032426068704f5a7acc109faad81e51aa8ee2c19d313e97e6a32b823a2b7a13d780bb49054d9baa19b3366ca9e8
-
Filesize
5.2MB
MD5d1c19812b9e6823ec8df8e91bcb62644
SHA11a97d0d872eccc454cae1efafbda4ac03c8bcd01
SHA256ea005dff8396fc4b5c7ea60aefd647bf71e65c2ee49e484b4780a2d0f16c139a
SHA51272a7940a47abf5389b7475c3ba65e94551e241700859501e74926188a9fa7ebefc15f47d1fff8833c6c13f47bf6347378c88ed0db52fd7ecc7a6b0e050e0bf16
-
Filesize
5.2MB
MD573b11e6d3255c79e7653eaebc81e0e8a
SHA189ad224e7161f1a0d25ae23504440a430616f7b0
SHA256c3522a57c0343531f3d61cd951b51e5864c7a9c6f17dca4ca3dbaa5bd33108f7
SHA51238c98e62abdd4a0e80b245d50059e166e10fdfc5ad498138a0db6824ba4b0a0aaf8c96e002008830dfebb6fd1ad1db8c3f9d1e372bb815428647f8b9e2a6d11e
-
Filesize
5.2MB
MD5bd8cb1108420a101b9f1935c45aa9367
SHA1ee95e4e8312529aaa4f2f7fe8edbc93b67071ec4
SHA25667cc9252ff0f2af7aa19298d267492528320c4a488f965fe0335ecf84e322eb3
SHA5125e18cfec33a7734e31d2c2f5376fa3191c9969837b4f74313b3aacfab2c890617839c6755359c701f035ab8b56a32078cbc2915490becee63552d71f6b15ac16
-
Filesize
5.2MB
MD55d7edd58fdf65908c604bb9cde950139
SHA12442b09b8de1b10fb3663561b96102e0a780a660
SHA256d94e08c4b92e588a11600a20cc2e397f9bf365d8393aa79cffe12e392fb92763
SHA5129a302c99d5edf986859720fccf091eb0837399ff6fbbe2d409763c32f9a384fd5912d9d5923c320942a16aee83ea4fce54afb49c7ed3816794259399a0667485
-
Filesize
5.2MB
MD533d650d0e56a5480e8e46f38e4441e6f
SHA1e78a8e19ecc1bdf3e60c2d2378fb77bf54f23208
SHA256297f6df0d18826e2fa9f9b65d264c7ec38a62a06d97f47412626e086a0f14ff4
SHA512c67eb8c0eb0e95d58ad5aac395ea7f90bda3ce6697b0b3f8802f641b3148bbc015c2baed43e939dca38a046ff1025efabfe0f79a52f8440163f92a3f7a8c021d
-
Filesize
5.2MB
MD55012d5eb2eaa95b2266574da3470d9a0
SHA1516bd0195088fca349862361948ad55f6a755b49
SHA25673c86007cb4e83501894775961b921130ef8d1f538b3ef2e00a4f6cdf80a2ca1
SHA512597089a44da6a03cb8c3d467f179b0432c251aa74b08a08206b9516a3d4ccabbb2be27c6a0ad1f61828eea514fa9b79fb05c1c2f66d8fc731d7ddd7d5f704788
-
Filesize
5.2MB
MD527a08d2885a345d52c4268beab36770f
SHA1d1cb7ad37698c53cabbc7e058b46f47dbf47f4ff
SHA25625efd9877d7f31fb4c1373b3196baa9ffde0e12d35fde5f805b0c7108082f161
SHA512b96fd331cfa123728297909bf217cb72808acc33b40b8b655a52c48f2a38e4d6f8e1505f3ffee9d4e3293981a5d939a324aa46bc6338764b45a15a3ac2682ed4
-
Filesize
5.2MB
MD5c426abd169c36d1681a352e7b202baf8
SHA16f19c078b5d682b48ca1e7c1944777186b5f0d7c
SHA2568abcc2e3040b37541b1870edfb0acfcf6426287fff0e377349e1a8615eca4d80
SHA5128ae9453919c2d1a61503fb484474989644360cd3a10a28aee077951fec9bbfe3bafbe5949def8ef4480dcce402813242c04d01b74374b0a7f6ea84cd68558d2b
-
Filesize
5.2MB
MD598658115831a98602b62e648db6dae0b
SHA1657cf553ae669afa6333b0a9318831e967e63282
SHA2568feb8667fe7701a9ad5a96e6e4bc0262625e24afa5291abcea5bae247bdfdd53
SHA5120cc10470d85f8d5774056f71c10c24e3c64b0192fb0ac36bdfb8e8c56361a143ac56a2caf1e972988773e0287040a50cd0dc682fc56b06a93b0fb05e006751d0
-
Filesize
5.2MB
MD5c413a7f1fc260fd7ea69daa5da925431
SHA15d632f44c596b405f09a413c1710260f78031f8c
SHA256bfa794b62b2caa5bf69faa79e61713ffef08569d152f890d8f2909f8c47c29b9
SHA5124e339cc283ea5c9656c0784241bddd10c5c2804ab22293afbabce127a17707536719638d6e7cbf86e10691c98b34b1b2798fb4d00cb63f0717655b46448c452b
-
Filesize
5.2MB
MD5324d04ab7afd1fa580c95c08989bb461
SHA1815a6a4f25c9d488595e0bced4ef42065d11fdfb
SHA256e1ad2ef7f1fc152c0c7f0dc4d9a59e9204e464c617310182064066b9249713d8
SHA512174c79bff1232fe935df8286f5d95b9f8fd23d074b0e3356f090a6d917ace71071902b9720446bdcdc7c821bac30ab00cb11bdabd47a6672cb27a3384b1ea463
-
Filesize
5.2MB
MD573b4ea39d88a96cc3b405a4acf3f62c1
SHA1c21615231f09235c0364ac650040e00585826029
SHA2564a54046cb5df142302bfed84c3c28d5b827739ea7c363e7fb136eeccead28e31
SHA5128ba2fb92fb0abe2e29c0d166f8c3e34a7472f829928adb7531fa0be85113995db14d1a747d3c19a8a2b67dfb70f27ab45020f99d6100a1855dc85aea2cf7c410
-
Filesize
5.2MB
MD59f813d2bdccf07c595bf8e23df33e2e0
SHA1515535ad4e5707de306d053a44d01d3875d86b54
SHA2566a4b81ac41a82e04aac18859590fdaedd85e5182e89a2f33bd7599058d54e3ac
SHA512d9d6906ddc1f293e3f79ff4da4d50b00111042dbdaad742f40a4dfc902bd260fb8b970e131f59bc1d725af3e232ef3557581e90538f6767b00e52f0bd7b39591
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB