Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-09-2024 14:27
General
-
Target
2024-09-27_342d17a0c10f2b287dfb3c6f742df561_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
342d17a0c10f2b287dfb3c6f742df561
-
SHA1
dd9199dd6e94bf7958b8ec3454069ab9a1a6fa84
-
SHA256
013718d3efd9ca4d5b1ec03200423f65e76ab108039240d1e6cad16edf1bde8b
-
SHA512
aabe5bd3fe320b388fbf1efaba6a68b58f5a20fb4631b9253668590a531ace7ba48eaec8dcfccbaf46d4e342f700520646911f4552c91c15cd1b5358a4ef4ed7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_342d17a0c10f2b287dfb3c6f742df561_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_342d17a0c10f2b287dfb3c6f742df561_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OuQWGdT.exeC:\Windows\System\OuQWGdT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqXMKdJ.exeC:\Windows\System\LqXMKdJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQnWcKn.exeC:\Windows\System\DQnWcKn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JMgAWqa.exeC:\Windows\System\JMgAWqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvNwIam.exeC:\Windows\System\BvNwIam.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrOoxAU.exeC:\Windows\System\LrOoxAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\arbIvOZ.exeC:\Windows\System\arbIvOZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wayExwo.exeC:\Windows\System\wayExwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RAOCdtR.exeC:\Windows\System\RAOCdtR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtnSQFB.exeC:\Windows\System\AtnSQFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZUeXDb.exeC:\Windows\System\nZUeXDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BeuRUAH.exeC:\Windows\System\BeuRUAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xmIQPpj.exeC:\Windows\System\xmIQPpj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNWdCnn.exeC:\Windows\System\gNWdCnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugHkCdU.exeC:\Windows\System\ugHkCdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmjgtRe.exeC:\Windows\System\pmjgtRe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KWMhVzL.exeC:\Windows\System\KWMhVzL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qtGvZdB.exeC:\Windows\System\qtGvZdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyGJoLM.exeC:\Windows\System\MyGJoLM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uaNzIYL.exeC:\Windows\System\uaNzIYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tnospkC.exeC:\Windows\System\tnospkC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD598bd9bee2d1cc9cb4172083c79eaa64c
SHA14cec4c7b4431f279308cded2907ed0d750ae88cf
SHA2566f70a990fd95678f0346e5f474dce088ebe68ee23f22a72bafdff0404987984b
SHA512a5f6fc32b99ae45c7e1e7b164355b01b0803ffcd43deb1807d701979038669bd85b3b8263389f0bea20c93a9af7180f0f03ac1d4d9b4d2b231bd929d20924595
-
Filesize
5.2MB
MD535b56263e0194928681c5f487245979c
SHA1e687520d7b21b36406e40ebd64d1f6c14650ea97
SHA256869264eff0166463573564cfa586a075d19e22580b472ea8fdf7ee39324f1ad6
SHA512fae9d952dddf7bfa833374d8db27caf3ac7dba1ecdc7800456bdeacb32ecac2c3306de6517e5055f4c4672d5ca073f57a3764578f2ad08de2e1776dd2012f373
-
Filesize
5.2MB
MD53261aa31d32d667211b6ff0cf57c75bd
SHA1ecdfa32b3312b790bf6aaacd78c219f4a5335182
SHA2565996c1fb0bee1869729b5be33e35831f6e3507ddea2a2642f350647196242c75
SHA512b0e25fb6d3e8bc927e0b492cc23d16643f5f78be68d466b4d29e39ef56cdcec54c0bfede5276436c97e495efa29931cf9853aa9a5eca5131f3fdee1bea5889f4
-
Filesize
5.2MB
MD56b1c0853d9eec85b3101a3ea5dfbd0c1
SHA13ba3c409b7aaa8e6e29458aab994b31f5ce7fd9e
SHA256577c114a1839d8fcf5447d9f1ab4f7905887603130b72e75fc0ec7aa78f27eb1
SHA512e3dcb33cba7bd8b4c9b6097b53a4183a5de9aca1e7e2fb1874247c88b26f157a040dd69f13b5fe3ab484cb6f3eb4130f74f0e817f100a43f4809e64425ee375a
-
Filesize
5.2MB
MD5a7da1251bcfb97d77dc1bc2a7ce4c611
SHA1f492e4692fa451aaf43b539d32320718d9da4594
SHA2560a9e4b1e4acf84cc852bfa59f85536f2ac9f77eb57f2428bde4085b76caef0be
SHA5126075eed676f2b8e08759f3d2b62f1e78a2b008ceaef52ff88030be9df661521b1da411b48c1f34239646b3a1dd61818c3e9f39bd3933b9998ac75816cd14457a
-
Filesize
5.2MB
MD52a2e88b95538d8e54caf1bbc47f6d7a7
SHA142f60ae81d557bdf2bba59341e188abd9f75f2a6
SHA25678300575d7a7c5f15303887479c1252e6bd03c4f0153c7599cb037c4b759ec4f
SHA512edbcf89f5223b17c66eeb2ea2b10976f85a3b183d5084dd021dfeb2be333da89224c06241ba6292ef0042dad2190704157da9448874610c36ca3ec0163330060
-
Filesize
5.2MB
MD53a978d468bb32993c51283cf6b805a37
SHA13155980bff0ef02f511bc38d55cb3fba92463ed5
SHA2564fc0130bf09bc389b5cd91407037ea21b766bc20df7c4c19c02141a485b8297e
SHA512a77d5a03d4d7c58e7ea9af03278da5f80cf1b10e1057408ae55f1c4c7a8468935be17371a7c939af71508dd6059f65d54ebed091468d89d0c5f06d409e1717d9
-
Filesize
5.2MB
MD55b92acf44831fdd7d0f55c7ab87a19ad
SHA116a086a74bef30cfeb5e4f07cb5800bbcf48d24a
SHA25663062c3da32a8d3aceac383efd24da01dcbf47706474471446607a696d95e7be
SHA512116619611085753187b15a698cf2e631b8daa372ffc66595bf90f4cdfbb2d29387970e07381d348d6440645f0b380b42e9808ea2f382cd35a2014fc69d351a63
-
Filesize
5.2MB
MD5b38dd986d0b3e83dc6b340bd1456bd6a
SHA1bba566625363290f30cffff1ca4d647401663cd0
SHA2562ffb5c4f527c8223b90ac5b35b89e2769561b0179e2f881cdabee679bdff645d
SHA5127fb871ddb1e93751b47051ec3e3fd73903233d329382b075ca2c38a3d872b72e8d99eabc89b65e867a8ca00cdfbb20d7fe2635231cd7ad37a8cd597e9b6c3466
-
Filesize
5.2MB
MD52c4f3fe113135b8504658671400cd36c
SHA17376a1e8a024b36524b00b40149d57807e194df7
SHA2562606a7660eff593ceac01350452213bca325c043984b4463ec7fe1c01faca2cb
SHA51249903f58e46cc405ca572ad08079cb334715ba35816f7ba0b3a7c6f5668cbd44eca12f78f228915c9c8f198692e9f798f38ecb64177d35170e28889dcaeacede
-
Filesize
5.2MB
MD52713f2f252ceb788a7b31aaf4cc8f129
SHA17090de245e6c4104cc31bd4768469f2801e01ebe
SHA256d607c92e9321a246d5fb3a0d92bd70c9a3ec1af46ee70afa2c711b418468db72
SHA5120eb55c12029ddfb34665bd348bda4a81c7c03f7f61871e955377261d3e841ef98bed7b91f001785cdd40a9032eddaffedee41aa329de6d9f38434670bb8797e1
-
Filesize
5.2MB
MD5d0f6cf48b3e6cecb693b06e284d61bae
SHA1e138862c53184616aeaea34474a4ab53c90d5a90
SHA25696329a01f4f1c852f9faad2c060883d4028eb5241103c992cb5b8f2a6a6a2660
SHA512b3664a11112e9fbbfb4690a41c399c059c5b1cc080f914b689daf7509978860003ec6c5d354e534516eaaed7a39f1ed72e05f48843fad4508a3c0f43962250a4
-
Filesize
5.2MB
MD54dabf691a609fb682b6132e36ddb3413
SHA1a823794be8bc01dfd1d7fb562a14d2f6995cc13c
SHA25642889bc7a65decda1164b7a67268ffa89e71b7aaa4dd743b691da09a1160196b
SHA512db9c028040316078b84ad0b1949a2a923da6af7f5915d26f0b0f56e1e65b43a16f2c98afd42d8b57dc78613c92f8e817d5401f9967c802614315adaba3a7ab70
-
Filesize
5.2MB
MD5b5d910a03c37e64fe4d9ff640a9b7689
SHA1103edfe45803d33f8a98a42386c558e6050c6750
SHA2567887b6300f1fad71e784a32caa47c5634746a07cd8cdc03c9b40897fe2f767e5
SHA512ce0af488dcb3bddcfa02e8d8eb69ffab3954d9217e8549e4d2949812095334cc557c9f3d37979dd028ce8b5f6523ef351c63d9acc3559bff098d4e9d98d1933f
-
Filesize
5.2MB
MD54437964d3267edca5888835981fb87cd
SHA10c0ffa75f844768007bb176e80ff6b78ab76d452
SHA2561d7ec6ff2df08d80b6b6276d1e5cf48751d52d24f3bf07f2494afd0456d14c8a
SHA5123e101d2094421417993b1c54e57d9901fd4c357c4082f4980f840a2b3ccefee1c37754b44fc705d29ed490a8fabbeca633421c39759ed808785dbe0cd636a259
-
Filesize
5.2MB
MD571156d9d92c6e0c0ead4c4014b3329e8
SHA17cdcf551d1bebd08bb96b9211e48ae2d402a01a7
SHA256ae3bee7b95f6a80abaae642795ea1f00c5f64a53a088811615ca592da351c9cd
SHA512afa32ea4503ced393a9a224014aadb8f0dc3f88424029a25bb943e4811f14edefb958edd880db95fcc0e9bdcd1f305e5e7bf3ea14f765af794ec67ee96536db5
-
Filesize
5.2MB
MD5a29b1d46945c9d9f3a3c00bc4294f491
SHA17740a78049222d4a462e3d92f3fc917d95ac7260
SHA25601af2db266662677cc1622e59f02b6ae14be145c5216b17ce5d1529ec3212bf4
SHA512d60362d7321ace9fae91f28bafeba7f16586ab27d51afe86ff730331d0476bcabd680deb38efc79a8df29eb10c2140685cf17c703468ae334ed1308afc0eb823
-
Filesize
5.2MB
MD53ceda663c7fb6fc52b0e0a96081e0cb2
SHA1d4c5f3a8588f42657550f8c69183cc6237093d05
SHA2563c703bc878b403f884b05e1712c451abb3a16b08b96eaf4295366982be5333f5
SHA512bd1f50c67e490fe297ba3bfb4a625b4458655d1ec0839a4c1cd3be1659fc34c3feb6bc69a14593da58714c707a173e870343e5bd1fd1f08d4dcf65a2dcf70be4
-
Filesize
5.2MB
MD54adbbe60bb38b3aa4a8a24dcef3f86be
SHA16f938043f72f25e7ecd76e83814ebe6c7f500cec
SHA256955c0842bd3b8e85bf999d211565dca51f5427fb2085ab499b36abfbcca2e1e8
SHA5126b6d61afcc7714de2eca710f05585368814e6d7454fa1df59b40df38ce5cc09dfdd20c96965d7739942eda5227be2214171a4050a3382729cba2af956f1a100f
-
Filesize
5.2MB
MD5937a71567c8e1e3ad2b34aab60a36477
SHA124835283f01e3f6588eb5758fe92d5432457bdbf
SHA256dace67d9a7ea892b7b54b652f33fdcdfa3db00ef9ddddcddfbca5ddcd49a9313
SHA5124f355cd773d8bc28fb5a82ee67d54c2a304d2ac5be1100eb48c28030466ce790da064b57d6d67879e985c7fdc83dc65db20f4d6be5f8fd39894d2b3361a4421d
-
Filesize
5.2MB
MD585300612e76519660d2697aa04eef9d8
SHA11b4161660de7a8591b08ce3e38bc46ac9be2384d
SHA256619f70fc91a0a50519129e178b48a50ca0f69efa60f20445286df8c672420b07
SHA512abf42ecfea95c21a49d938d1f16f2435152a43affdcfe3da6225b7ad48218ffd603836025891771cf9f198cb687608eb1f1782f5bdf557fdde7b8a78b253cf2e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB