Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-09-2024 14:32
General
-
Target
2024-09-27_6652f4a32be26fb3935c4a44c14ca3ad_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6652f4a32be26fb3935c4a44c14ca3ad
-
SHA1
2fdc17811fd330f74718b41a1c41fe50d69b0724
-
SHA256
ce21df8138490d0163b3477b35e71011fdfba6f6e286178ebae0a4eb5c7b040f
-
SHA512
2689fe1ca4adc36bd5cace3bc37967367afd49110bab44541063c54e5cb96904679ac9e32b1654185e29dc8ab63e2f2f096b452251075be3c49d5e78618155c0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_6652f4a32be26fb3935c4a44c14ca3ad_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_6652f4a32be26fb3935c4a44c14ca3ad_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wuPOvjx.exeC:\Windows\System\wuPOvjx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UKqSlxt.exeC:\Windows\System\UKqSlxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XlqluQb.exeC:\Windows\System\XlqluQb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PDoICtQ.exeC:\Windows\System\PDoICtQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGRCVcj.exeC:\Windows\System\NGRCVcj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NNUFwuT.exeC:\Windows\System\NNUFwuT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IxLrOLB.exeC:\Windows\System\IxLrOLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEilnUQ.exeC:\Windows\System\zEilnUQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eYCpVzp.exeC:\Windows\System\eYCpVzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brpAREK.exeC:\Windows\System\brpAREK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcjgjLe.exeC:\Windows\System\UcjgjLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jySvRbC.exeC:\Windows\System\jySvRbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYzStUe.exeC:\Windows\System\mYzStUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrKZdxT.exeC:\Windows\System\OrKZdxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lHEsWIS.exeC:\Windows\System\lHEsWIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADivqcQ.exeC:\Windows\System\ADivqcQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zBnNqei.exeC:\Windows\System\zBnNqei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJvXoeT.exeC:\Windows\System\VJvXoeT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhLgfFk.exeC:\Windows\System\fhLgfFk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XzdAUFq.exeC:\Windows\System\XzdAUFq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yQMlAzT.exeC:\Windows\System\yQMlAzT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5026d2996ce3408b8e405349bf6b07812
SHA1fcc383707da2e53e327f7965c5d88d9bbfa99fa2
SHA25666528e60d02314429e19d5cf5fd5a9cbb61656ee275d0f2fa3903c5ec55363de
SHA5124ebb3c9ae3cca745631da1897ad972aecb7462cc10c92f8be0184aff2ae0eba0d45f81d5974d91db7200d48259886e1a0e2900db66acb2c4219b86814ca4e750
-
Filesize
5.2MB
MD5ea432dc854508ada4be1ce6a88227f30
SHA163fa54551117e749df1dfdd0da91f45493b49fef
SHA256ae347a0289c74444f307cb32c245547c51c9795c8696c8e2fc1dcb3a1a57328f
SHA5122c2fca5e03b1ea3222bd3913e0d3a07d9ce231e6886765169a86c9885da438d4c56770f6b1945a05f0ee0efcaebb7c4c82f0833e6d730c68e52874753f879906
-
Filesize
5.2MB
MD5fa548ad3d77dec3132c9ff04806c9661
SHA11569978ec8feb21bf9bdbbdb08b47b51e92c0057
SHA256645616937d8bd628ca156a9a860899d5f8dfc539fd987aa00325fa7f8309e325
SHA51280963b1de10efdbb941745214f0b479d034fece9df05ce4c80b027fd80dd35e4e24e093f0eb9d1d8329de0803f50fd9bb7950d6a205b8455261a98bc7e9caea7
-
Filesize
5.2MB
MD5c6faca793827224ab57bcb965e688698
SHA1c88f8300a11006c71d0b2f74e32bcd234fbcdb6e
SHA2562b9580343a8785c016fd224c953f25d89e2abc14a8910a026efb251b14f91559
SHA51267d75ca14100f20ce4f3d95e945d3b864f21780fa9c7210dedb441e40fd01663ed27c224f5cefd65c381a5945d492b84aef55f5da79b6d2da92c3c47ffd25c72
-
Filesize
5.2MB
MD52b50832b34afa1974f6c1535ac795dea
SHA197c1f7d25b539973726b04b08ca08b81f30e4b62
SHA256e35687a05de31d1bd458276fdc6b7858b6f1f0c723e2e4794f47f7ab26c9a5e0
SHA512ace7f11ba51854266c107ee136d70686763f9a9c831912a13124c5ca99e81735d64dc15fa45d69f3ff4f09e44cff62dbf33ccc05086ccb0144ee6f1626f6ad87
-
Filesize
5.2MB
MD56edc7d352217884238eb2b667e1a7951
SHA1c4e50b3736b2031520572c4007b7f2d3b5d6017d
SHA25678801e1a97f9afc29cc938f5599bc2d0110e23aa3ea642e43ff842d62d8b801c
SHA512ea09df468b969ed7408cdb6ea585f6867a03f21aaf3aa919bba7b878f7f3650af2ca133c9aedbedf5042cbdba703784424e72b14252a3745d8dc31f0315e6cd3
-
Filesize
5.2MB
MD527156b648d32139098dfd8d9b0ebe33f
SHA1f3cb4e431f5ab26ace366db2bea3597278fdfd81
SHA256e9c97e7fc70712f6daf10ef9fa49965ea57c04d1a0ab5b7a124d77c12cc40453
SHA5121170a991bb5f705ca72e6e301162c979381a6ff01e2c8905ccb5d664e7448c197a1e9371087c9b15a99b0108e2bcd41a22a4bdead1c4102f5a5a5f4ba15aefec
-
Filesize
5.2MB
MD52a837d144effabc4425986cfb4f4a264
SHA1b2f0bec259465d9ee4bfa6672dea2656c776878d
SHA25665ba38c2419b4e05b67c0980885132556c115828c743fa4640ea0f07473b0168
SHA512a89f35cf9eaabe15fc36050ebc4d054fd02304fa2bda48ded04fda0fa45215a2fbf44f09e8279eb1ad82b3891c3218513bfa5acf030df9473fafbcb59d6ad40b
-
Filesize
5.2MB
MD5f075cd069c0399460556b35e19a94bc3
SHA1eb668cf6e18b1015c74d9fef473a88ef0c6c9e9b
SHA256ba41e80e6e53d5cbfb1896db72d77f6e66dc6044476fd8452ad13952cdc43f43
SHA512d8bed67cbbc874aab8bb9b2d36c92c9aac474b036218bb4410bbb02e6fd8defd01abf25eb37e7804f723866985b2df0305c5db82244f2e1ba965992f619e8666
-
Filesize
5.2MB
MD5e92111c83aa7805d1c92646e0b5890df
SHA163cae2389cd2a287938cb702651d767f17791dea
SHA2564e8786456395b441f65d8bc173a67ed7450ea9d1da1617c2f8778b85b3ec6b73
SHA512984dba4d80c806f34345b7899362a0ba19d552a07b6498759180fdb432016eb934df64382b5d0c8ec242cb9c87022f63732cc45fdfd8837d0836d759eef31d6c
-
Filesize
5.2MB
MD5fb622be7a668db03b1281c725dc4261b
SHA1441991e78c99d480b9e14906c237ce9b0cf3fe76
SHA256d07da7f5f219807db70f0004c9fe07297100ccf95e6df48372e2002f4b7f8b9c
SHA51290960c116adf3805a8ae2e4ff9c3388eadc633a97dccfaac13056fc1d66d19e0a984ac64f06f146e79afec9d5d0c1fce84034fc42c151354f2fa5bedff66e8b8
-
Filesize
5.2MB
MD510d78b3ea1bc0390ec19f2cc584877a8
SHA1305e1b1af575c7fd0fc4af70b926a55e45e62139
SHA25614b3c3cfd9d8e8ff2c7dc7857f01bd904c40cb4e7117c356d988b3ac0e4e5408
SHA512957e2bd52726e072732e4e50bb4b7feae346d64dc6b908d676530ca7a827ddb7feef92ada8f9446028920ba1d92f865b580a31eb64de9335450017b72e50147d
-
Filesize
5.2MB
MD533f15719c51e063600759f93ea7c84b2
SHA14b7ce1a88ffca5d504d10680f600d1bee73ccd4d
SHA256f409c2609706717de1e0abe265e85f02b3b8dcf598871b3f6c881cc4c677305b
SHA512cc0be12229965074bbda9d3149a00d3358b6e8edd358142ed0bc50cb50a16e409e2f39725d45e4f874e0560a7b81a294032e1c3a444efbf29374b8670622c234
-
Filesize
5.2MB
MD5bc9f695fe972378fbe15efac8a310988
SHA1fba426c96fbfbe8e4013fc07e24bc1446ac055b2
SHA256d40f7642d97ef481c5874b17750dee86947fbbc809dd99ae5e02e94714814483
SHA5129d7b41956e2ce106bc7241edfa17f2f5e091c6a5fffcaa9b01ff42fe3826554a5becea38dde58b8d08992cee11caef1a90ee84689697e8366cfff4d12620c8be
-
Filesize
5.2MB
MD5c0533a98aae2e5734bf8111f66ec0bd3
SHA11eee96390ae099ba1b7d1dfd34351afbc788f6f6
SHA256648c32a401a5948be56d6069b42948e168c9bfffa26d3b1eb07533898fa2b5ed
SHA5125ce80bd28c5ba4c984ff96ccac861aa4e0ccb414cdbebc3c829c0d382704bb13aa32f48c6a599383ad5e5ceb99c8614054cda4bf8b3cb18e23315425df166f99
-
Filesize
5.2MB
MD52741c711f69df5f2dc2b9a79d9819b2f
SHA1f835d8edcaa41ee541f42cd1aacafc9e0e785de8
SHA2560e5de7799fd6299499c86bce633dc3fb381c990a96c395d07381c8c7bd392b18
SHA51235e237e75f5d5a6aea92675d931117667d6c1c372bf4d9d5307f811cb0618438f24d10e36684022cbed2a74422cb76f7da4e0b4087fd1613717fac2789e3bab1
-
Filesize
5.2MB
MD53eefbb9653ddaaaf962e470ec4bdcb11
SHA1c68535e1d5e112fe321b2acc885eacbccbe47a43
SHA2560a257728b5f2f311ff024ce2186a99a970e5ece397e4716c29c70372587d7ad5
SHA512eb879acf79d65247ae5bc32a788c8c90118106b651aa33c5ad32f3e63741e888629607ebdf2cd034be8eef2a3ba8251826da00f93ecc76b26f06d464d2761e23
-
Filesize
5.2MB
MD59dc7974dc7b25e99ca48917eab0d8108
SHA130e0f00318570e4847c88ea330e2586cbba4e3dd
SHA256254fa8ebe99bff9cf588cad5c7198e524d6b1c04a0914cd3fa3a4ba883381670
SHA512734d7a6ccfb4028fa2ae8e4d96be2dd488c145aea82258f50a647e3c22d5a36b3d8c3cc95aaaf681d59ce27144c921e6ec38712b3985824c0181d0558cd12d97
-
Filesize
5.2MB
MD57766fa54e5fbe0d8c5bc7c19e37d9942
SHA17706db1f24b33bd865f91900643361e69d12156d
SHA256aa94ef592f322410ac53a6998146c4e79e7ff7dffc751bac56c15e746ff41139
SHA512c1cbb4bd11f6c88a9919a5780117d4cce47ca6f5bf9cde5b9155975a34f024feb2f8e18d46c1861238579599312a3d5ecbc42ceac8b4bcc24a05142948dcc452
-
Filesize
5.2MB
MD539c00ca11dac7176bc7084e18384a74e
SHA1d2cccc14bc53fc5f3a43ef0241d3f649208060e9
SHA2562ed9c14a0f8c59962e24554b95cd7fb52b52613d705b29d42688d5f5c5adb44d
SHA5127af0649ecf843fd435d30fb63e16321c11ad7041a43951c1d92170d0403ce71434ca6c66b9fa0fdc68d39f551e35f765d934d6d18970b3214150f8e6feedd66a
-
Filesize
5.2MB
MD5342b0055e9e4fce7a31f31a19d4ed582
SHA18c2cee83f8970b2c333abb8c3ddd92093fd99515
SHA256117afe0f6ad67b420c49cb1e04ac45e447b154e4016476472b9aa35c7c3f1ff1
SHA51227846a6935137c79b7b85ee70807f5eab546b3ea6b3c912fd21f89e2c00ca80cde2c76ade99542b7dd782f9222deb5eb942c1332a43a45fbcb95db220b8ade5d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB