Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:39
General
-
Target
2024-09-25_db4726897a27c26ec5c8ecc5abaa32c7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
db4726897a27c26ec5c8ecc5abaa32c7
-
SHA1
c7e727564caa48b60d3264f2cde1e5cdfb2b469d
-
SHA256
1f426f57b326ba7039b166d357e418ddb91fef2851c5257305ca22b6084f72dc
-
SHA512
ac90f580d92b26d9f73d3583da1a39257c0740eb1b8be65398e82f17dbc9642508732b07f941250c3f19b0317fbd8d095e873bb72f2358ce90371a912bc9f469
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibj56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_db4726897a27c26ec5c8ecc5abaa32c7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_db4726897a27c26ec5c8ecc5abaa32c7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\itFrUaC.exeC:\Windows\System\itFrUaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XpLYmCt.exeC:\Windows\System\XpLYmCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SDMMqHU.exeC:\Windows\System\SDMMqHU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UWBtWSy.exeC:\Windows\System\UWBtWSy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cwSDOUA.exeC:\Windows\System\cwSDOUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFENXag.exeC:\Windows\System\vFENXag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TspolvS.exeC:\Windows\System\TspolvS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHjltjt.exeC:\Windows\System\LHjltjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pVNSAUB.exeC:\Windows\System\pVNSAUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKlGekZ.exeC:\Windows\System\yKlGekZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MiSIkVX.exeC:\Windows\System\MiSIkVX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ogXcCyU.exeC:\Windows\System\ogXcCyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcQoWbW.exeC:\Windows\System\VcQoWbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbLMmpQ.exeC:\Windows\System\FbLMmpQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSTJKTU.exeC:\Windows\System\LSTJKTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsTFOQL.exeC:\Windows\System\DsTFOQL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AncSOal.exeC:\Windows\System\AncSOal.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fgwMOrL.exeC:\Windows\System\fgwMOrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vUtkwjE.exeC:\Windows\System\vUtkwjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FKfeAGW.exeC:\Windows\System\FKfeAGW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyrbqgR.exeC:\Windows\System\MyrbqgR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55de422818f62c68b275c0fb3675c84e7
SHA1295ea1ed02b17152ccdf1f01ee6738240c684988
SHA25609656bb0a01c02912c84d4b0dfd053c9ff0abd2e035a8e60347faa0080648b0a
SHA512e3b762ada4e3a5d69d8577ab3fbcf2aea951c1aac1a5093c8834e5806dd60eed8cfa6e916c7b1bc57029c6b6f86fca36ee552035d530d0737773a3886266e949
-
Filesize
5.2MB
MD565803653625f7a445dc3b5e8d1d49ba4
SHA177b07d39f6bc71248b67af3393e8ef037968c158
SHA25677e89144cfbdc5d49e1f9b4868c57b2e3034f06f22dd4ee1a3972f421ca28008
SHA512f4e7d2f7ad805ec313efc16424d3f1318ad456360f5772c9bca2ce21ea74283f76be17e62e26e54f4c7719a43ed4d0e66d436ee24877f1d9a782445318458482
-
Filesize
5.2MB
MD5482679ecf02af0dc50d0120e82482024
SHA19983b18fee7a0a6c54679a98273e0a84b08e4fc8
SHA25662574bf899d654787d2e4ef0c16fabe028e1f5cff100e1ddf3f07a2a0c1a8ac1
SHA5125d57f69f2cae96276f67d6ca52617a453afafcc7652faec146c11d48a67311f8a1da4a33e3643630f817319113620df650df9628af47fd92f45dd10a495a08e7
-
Filesize
5.2MB
MD5d89498ceaf9ae39636ab8ba7d5e7d297
SHA175247cf14eb795008aa24fb70e101d999a4e8ee5
SHA256d6e340ced269f82a452a01d839985a4d5efc59bf61d31c60e9fc807b67570b4c
SHA51247548a7a9aaa2b516a4f270bdbb80bd9495c23159939b2c33533d1ad0c9ca6ac77a522960f6275d6d99f6cb2327954059664bf55c95d9b57b31d38b571ada4c4
-
Filesize
5.2MB
MD56446cb33560dc738780f1528b1b41b10
SHA11eeca544a599b323bf34711efcef9619e624e40c
SHA256595da52e87f82f3e9be9980b0190de5482ef6739067a9352feb9ca9d0c8eb96a
SHA5126b2853aaaa61dd000636fa8c4df9676eaebd7996dbe046422b921a57415b4b31f3cec341039e0f279f6dbeb2419f46370cb1418d0d56d0ac8647b12787ea7302
-
Filesize
5.2MB
MD58f48f1aa210d66063d42d054a5be4d26
SHA195a9397bc6834c7f936c65cbf5a39aab4edfe0f9
SHA256da5970a20666b57508c9c2467dccbcffa448639e4a90452750d380929c4869ea
SHA512540eaa550f95d583f0813b25d2cb4cf8176c65311a4b0e221e7021b713385283ee8e92d6e13c88d5a8f47221d773f0bf224b0fa862fc5303d1a7d07e8ff2b833
-
Filesize
5.2MB
MD5910ab9932f69af60b15409bf4c631e68
SHA1781450d35c61a970ec7d933644f6d05a2db08235
SHA2560c02f3acf0664d7e111b233de35400ed0f15b8f02a4f412f8a676b95aa75ecf8
SHA5128c8a26cb7c8c0ab7edc832545a6fe999bf257560cf68ab0b1c86b3dabb37f6896258b7d34deea7bbad698bdf7df9546ce338b5ba6589ca6fa521c41d3c94e0c5
-
Filesize
5.2MB
MD5c3a4fc0d0d09217c29fb1bf4e9469879
SHA1fc8a903340d0d115bf80c6ada08ce9db9778a178
SHA2564121954d4daffcc9c1eae4f30eb529358966a28930f3948d7ba78bb180171b46
SHA512a342b04b00e3ca80ba06373d7f82082fe036157f49ed5492dedce3aafd286db256675cc4985786f33b21375b8377217aec9724f77bb57878d925407018dc95db
-
Filesize
5.2MB
MD5cc3bc8c9e50c814ea1cd62502116819d
SHA14ec7a6bb161cdc2a03a060085af0ecbc9f241490
SHA25681c336f9098d8c8915051a051643e462c5b44d85b319eb559ff60445ae5bf7d2
SHA5126fffaf71bf795fb69a974ec7e87b43dbb69f393c4e6c9468ac97e2ed0724f41a4688c49914611291b90e6bac8de9df9740b0a962d7a71b7552f73ae995ab60ce
-
Filesize
5.2MB
MD5a6eafe5ab81b86de965c0ff3fad011b6
SHA10caf82f977c615dccd46d3c22c2faeb43049d927
SHA256d748dadec7a608c35ed75a44ab4640a6eac4aa03e400da79a2022c86c60a50d7
SHA51206fb1c5e8fd80cad72822bf8ee950b5b8aa48810615b56d95e9551f0ab6c93efc6ef890c63efefca4a9e1ad15f8fe43117b0b9aa167594fbefe5bd769c585b3d
-
Filesize
5.2MB
MD5ed289ba130190badb24fb4596a262d3b
SHA1e13364fd2ebab6e4942dcfaf0cab59691faf78fc
SHA25686e94420f07d82cbdc9c50eea4a5de8e2e557635a967a81fb3883239f4f34512
SHA512b0b38958a4b33c9cf0408de373e4baff9820b346c32c8c7d1f4bac9ef6ee73292a9e6d770657a3ae0707fbb0e397b484db25e0efa3a43b83900822945790e79b
-
Filesize
5.2MB
MD503b1e9dfa94d1f38ff6529eba4944e39
SHA1a8cc9725a52925a9e8cdf4733bd8405bb8027102
SHA256e153432ca36188b828888c5ceb47611d177ce7f441a035e2e0bb53751ad282b5
SHA5123d1be693f71c1b5db887fa2b3b57eb090371a44a9b235f3ac5725ceea7befd6b5910ba172509b09ade7102b6455502d9c9823e668c024632019090180f764aa7
-
Filesize
5.2MB
MD558e6ae505ee16b71fbfb49ee1115b3d6
SHA16825ed692e79de39a19442490697281d77df2614
SHA2565461dc56dcdd36fed27cf50d89b5af90a85826b39d6c38282a078f6f9207fc5b
SHA5120119ae26b8fd301c57287aa2d8ee0c13930eeeb916d6a7bfb0d68471b91dc65b25793441bff6363dd90e5ce8895dc4c0f07681a1f52fae45297fa3da434012fa
-
Filesize
5.2MB
MD510a90e98c9520784079d2c4d3fa01cb0
SHA12a9291494a868e5d8aecf8ae8db57c1d1e5b6d11
SHA2568eab8dc963e292940fba541203081fbfdee32d0b8d67ce01d9c4b454104a7eba
SHA5127156f054050e3e03325a8b65c1640eefd7fb686fdedb5c1a1f4a1681afaa3780b857397a78f2fe2855cc0f563289c36f7af290a34fd3c2d6a37a2b715c9409ef
-
Filesize
5.2MB
MD5f15c2f249c6b648e5e8e8d5a63c12588
SHA1df29ac02029d77fd86bdaad5d8866703d2f383d6
SHA2561622d371cb7a0d2a9bce8072c524bd36879e2ce0d2b376cfcf682c31ddb07398
SHA512d9cce7b96d6113c3a257ff0e3265488d16ed044b86827be429088835f74eb356dcd37b500bae68f746a2776ac4adb5d6645a60caf20464f7e4a1f6ea1c20c35f
-
Filesize
5.2MB
MD5590f7da5f86f726c30c4de90c0e5a9ce
SHA168226c186e27cb7efc1f1c1a11726fb2f7b10cdb
SHA256094a442f8930b2f8a6778190ba36ffbbb13b2a349f42eab886436d34d2a4e7dc
SHA5123263bee053802a11c0926d2463453d490ab88e6ab2a1cd801cdc5ca79993bdb00b01ca65c271228d1005952b1a2d895c951fdd775335ee9946ec637fd1468cf6
-
Filesize
5.2MB
MD5f4f63a70714cee07b47c75d9f2ba1240
SHA15808da18b51d38a881b5cbe7632d77a01a7fbb55
SHA256ccc9265e60736e437e5e7e704faaf4718d9eea60a591868e8376c8fcbe3b14a5
SHA512d9811dc3b18711f312c51252bafd21accaef678fb37285108c8f911b5e0379758519b69537cf32088e8565ea3fa58c42b6419d60fc66fa18e84ed8a1654cab77
-
Filesize
5.2MB
MD5fd2e2df81f9acb950c21ee14063f6ba1
SHA1a351416b7a348bf55ea4c15ce6b025384908f2e9
SHA2563923812c4ffd8f1ae51328b5f7973f04186c130499928498f71961af2aaf940d
SHA5128c8845179d50334b92df87f6ba7ed7398afb13433ec32fcf5c1b82d00cb21004f398150c8c1d62ca504667e4263e37671d09922ee93250aebad72d6c2f175e39
-
Filesize
5.2MB
MD588b8224557a3f829bf82e521e2b643cb
SHA18789250d8c258a38d4c0a0559fa7fcea9b92e4c9
SHA256a1cbdd695046880cbc05ad18fcfdf6f3f1d40178b74ef891541317374999059e
SHA5123713c68c36a1041edd3692b88e63a49417f407dd32c166125ce2be9594c59cf1628875af8e0b7c4cfedfd5e46ea76892b9eb084286ea3a19133a8ebc3a1c5e57
-
Filesize
5.2MB
MD580ea10419fcad208489d3afb43d38073
SHA19442364c35b7db5faa57244cc573fecd3ccb302e
SHA256c4228b908ddefbd0c8730947b7c4326e606a28e588c9e98a6256ddf0f8568c61
SHA512d94502b97ff77d33735b7d5f07a37ae2287ca029cea5de18b577ac815b487e1db9ab47a2f95c5458341c4e93721ba1d9e13439c1e23854f150aba6b046848437
-
Filesize
5.2MB
MD584de0da56b8035f82d3d6126abd2b6d1
SHA184a864b05ddea6775cf58e321a80e7109f73b11c
SHA25622402909ca2b9fb2398c7dfae26aace590fdd3360cdbe80ca259b1788b82ab28
SHA512c5eea9ac218ec57565a5f11b7626e4691deb2caa76c33ba377a6084bab703bcb2ea7683f8556f8ad0d39ce2680ba77fe4d1c48a4c3dc7a921754d0a167fd31aa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB