Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
27-09-2024 14:38
General
-
Target
2024-09-27_d7c1c5df3eaca6ee14eeed00db7c4e2b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d7c1c5df3eaca6ee14eeed00db7c4e2b
-
SHA1
7e469b75941d2a7e485229198985e2b409fbd66f
-
SHA256
c8bf87778e6793f4fed5d2b9999b27cbc04fae639798e0c48685917c884c76ab
-
SHA512
ddd512ad094db15e6bcf72b80cd251b59120dc062b98e824d50547dd861218dda81ae0f57c1b799964c919de314d04b98094a72e47b939c4d39b15ad7e5a89fe
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_d7c1c5df3eaca6ee14eeed00db7c4e2b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_d7c1c5df3eaca6ee14eeed00db7c4e2b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YiSzqkD.exeC:\Windows\System\YiSzqkD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnYnZZX.exeC:\Windows\System\VnYnZZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OCJlSqJ.exeC:\Windows\System\OCJlSqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PpipdRi.exeC:\Windows\System\PpipdRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yQaTDSM.exeC:\Windows\System\yQaTDSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ucUyBOY.exeC:\Windows\System\ucUyBOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xchcsXF.exeC:\Windows\System\xchcsXF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgrYham.exeC:\Windows\System\HgrYham.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OnkaIxH.exeC:\Windows\System\OnkaIxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZdESwg.exeC:\Windows\System\nZdESwg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdgyWsC.exeC:\Windows\System\HdgyWsC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JxscBTM.exeC:\Windows\System\JxscBTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkFdTpi.exeC:\Windows\System\GkFdTpi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnXVTfx.exeC:\Windows\System\AnXVTfx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mXJQEqp.exeC:\Windows\System\mXJQEqp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qlNEvRB.exeC:\Windows\System\qlNEvRB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DxsodNz.exeC:\Windows\System\DxsodNz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DELqZtm.exeC:\Windows\System\DELqZtm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGEyxfY.exeC:\Windows\System\ZGEyxfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEFycsZ.exeC:\Windows\System\IEFycsZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bgkPtgo.exeC:\Windows\System\bgkPtgo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cd5f6d964b513e1f57d160f1fd60768e
SHA1bdf27c1e71b02c60d00e6f438cfc1ac5ec3bc568
SHA2565d8e2d52012ed09cb7526e533d17af7566c98acede9140f63164fa0cdb12debc
SHA5121b798b150f2b2e1ff896f3483d62a3955d283372f122cc830954da32c7b659454bf8d46819f1614d71a6d0a9cab91233b994969169c5e03b5c4de0ad4191b767
-
Filesize
5.2MB
MD52a1bdb2a69b8f30a5d5937114010a198
SHA161c79962023ef5888fdbc1c6f802f150fee91abb
SHA2560d5dd3791f2474002e04bec434e7833b027be786d95172df473302a692babfe4
SHA5122847dc535755baf2546c409b326d29db5e5723cabe36e49f7bc36ff52c12da8d56b340c7d18fb76cf97498bbd0d5c94bb917a2412161957ff6349547b9bbb3e5
-
Filesize
5.2MB
MD5538d0343e8d6ab44ff32291cb2b8f198
SHA177d63fbfd83e277f0d66edfa523c06a8963ae7c1
SHA256f7244f715b613aa9e1872f6f24238bc99e7a3bbbdf6eec278314a01e8d8008dc
SHA51263dfb184bc0402a0cc25c60879e023cd4b1c109e67774150314df492112d4a3ea3e0d1bcb6d5b5fe2579ba1d2ed531cc042e7ca042f77e9ed2378cbc758026a8
-
Filesize
5.2MB
MD510797440e8909a67eb17b34f471911f0
SHA1e430b32377d4c5089b1ac68216704d3b7baf98ab
SHA256fabb8ed332c8ef5c125b93a97c471940ae1b3462c21adaa5ea67517f3d50fd6c
SHA5124ca3aea2e4758d5e6a2686594c4bf6f221635b713b610b477e7d3f1ae05582e44334bf885eb48f71fcbcd2e426d84fb02cf48c5d28454a18b027f248ec3cea12
-
Filesize
5.2MB
MD5617a60ce5d069501e24a7300a2e72121
SHA1c2d56d4691175cfca004fbd7353e3eccf691112c
SHA25693e41cc57ef54a67227d9c139f212497b152e824df43ceb119eb925e7f34fb2e
SHA5124d03723431c67a7c4f50a8005c60e12a6a4d20f3a686e2080c64a0292b3676d21fe112272c0017a76a617c1530f9861df8abf37c29f4718946e2dd0751d5afba
-
Filesize
5.2MB
MD57fe1f267fcbff2053d64b4ba24543b45
SHA10daf91a7e7f7c37f94dbd4f485991015b5bff66f
SHA25643ea8b0cd797ff18a0e45e618d93da3623ae7120471b1303693e47c23b82042b
SHA5122e055f059792e2c4e12a11acd8c725e9babf4535424d14bef07304f18a656ca92b8ec8c6d99fa8c526b17b286d38a6d695a5b4be67c8b8ba8795fdf0d2793643
-
Filesize
5.2MB
MD5fd64737a963fcce659dbd67315d33796
SHA1678c8bb961fd64c6137cfb2a44194c39f8b78e79
SHA25682352b6128a12fa74485fa71bd5e723f439450147ea86f85918c46fb143dc3c6
SHA5122983aa85aa1215a5f3bfda296b8d30f5486bcc2d8d627f8ac229b58f0fb46635a6074eca1a504a9ed015c74f2173e15e0a948a1b2958e29fa66d6483d4f1423c
-
Filesize
5.2MB
MD59a552f9905b004c9f7175347385eab37
SHA1f856ad4bbb0462a0f01a8faed19a042004792358
SHA256e6be9c39ccae9832363841c16fa03bf5aeb87dc18b515cfaf27e0424e01794b1
SHA512dedd5180766df22b5a6f07857e7b016adad92a9c78f503bc8cea3622de751f541b5689ff04ebe1158d45fcd5fa875b1bd0e53c804a80a29c6bf2820e9b123c0c
-
Filesize
5.2MB
MD54d860c563ad849c0b5e4df9e0ec68260
SHA1953587a4fc3c5e523625a1effb61ae0b9ba1c842
SHA2566b3de0709f4156a5f5d7d7da41294d33a5952255187be3bbdbb1fe4d99497f14
SHA512f9a1a673d3935e3669cdddb649e0efdaebca85e135a911b627950b5449928fd0ca497d24bb6359d26276e6f1c4044cb78d48f36b586de18c6c7b8bff643d2eeb
-
Filesize
5.2MB
MD5c202bbce3b4b27a3f318a7cb33525e5a
SHA18c0aa76ff02992d4e0fa4a1907c4b74f9b3c1889
SHA256d1dea454d8131cb4dc92ed96953c66df8eff7c7d003f61f5b7adaff76a5b8fdf
SHA5125fc3e3df28d6b5deac4f600fba27900cfac6d4b03a9abfb1cacc5977711f972783d2c1434c1db6830148e3b4b9a50268b172984cbfe7217e42f0e6356efc4dc0
-
Filesize
5.2MB
MD5158b2df3f2b34d6083f772e2ab52e2fe
SHA17bee378358814c6e37fe77211762d120913dd823
SHA256a598fcde455cbd869e6007225456ec5d47e2dda3e3141a320337b848df5eb820
SHA512f2b593241cf841d020ac9b4d0ad427f590caccedf72eddbf3af59ed2a54657ac326ead0e68a7a56deae8b7e636f981668de52d47f02384e6fab1bca2d3ce9a50
-
Filesize
5.2MB
MD58d257840cd78efbd728606e2c1d9cecf
SHA1d1397e1dcf6bfd6faee06208e31f2d8c88cd6472
SHA2561082485dae76946c32dc19b119a42a0d8488efe50a7325e08b7ff223352f52e4
SHA512fea31f10c0fc88b97adec86d5ab47186f2df7ee9a8b1609f32110b05316195076d300d778d57ec0612c68873b6441eebcb6c6ab3588f17af4d9de49591469294
-
Filesize
5.2MB
MD5c29fdb3b4a510de6ef24272bcfe9cdef
SHA14fa3aa78fc285bbfd65054d3240d031824a72c45
SHA25654dffa233093f1de9020ba173903087c18d35ae6899bc8c8744ac9826a8cf9a6
SHA512be5fa93859138eb20f04eeb019f3617ff2b5202f1679f49cb0e757b4b1370317cf8f9b807c67919f39b3ec4c8f70af4c9efc9a1f9e4f0b4e6b3aa005eb0a9f6a
-
Filesize
5.2MB
MD56045a27687bdadf9512accd97d6f6a25
SHA159563a006907c59ac5d5c35a247cceeee2e05c91
SHA256d19301cebf40f7ca73117733819db05f21347db135670b516539e68ca8cb5508
SHA51212428a377402cb2bbf81acb4d5d32113530885a4453b00bca7bf6cfc8742ab39250f240876724f2e3cff0f693389cc170acaa1ae8c05b65d6b4461fb2d233412
-
Filesize
5.2MB
MD58281f34d635691930c81e42bc69f72f3
SHA14684c702dac26d422fbf19f7a473b348eb12078c
SHA256193f0b52011b461d4b40e58fd435b683e4cbda7b784f0f7c1724e17ac2701820
SHA51254ac48c73e54d94058ae07d4ff747d6c56d42e386de1bc440b982a0532b4e28a6e29ce512048bd455fdad69c481ab792792d599109233f754500023c8757ecf9
-
Filesize
5.2MB
MD504590c233c0ae8e222e5bfe5ef584daf
SHA1f51bd89719c613c2acdf5f0f86428cfe6d1997a5
SHA2569af756e070d32793c820d0d7ffbc8f9171dfb2abc42f293e30c8fa85bde44983
SHA5128bf227d373be7a9fb2841a42240d520710fd1c4746ab88fb719dfa530a328ec9924c5f7b2e035e3a8802e2ff06400cda0b58c16dab7eef58aba357f5669c1125
-
Filesize
5.2MB
MD5ae1e6407cdfbc557eae659db9c0c79de
SHA189e49437a3a8e4c7612e002e33c24384fac1d52a
SHA25693eaafcaf35cb79eaa5b544cf0877cf5ff7acffe357247b9935b4b39ddd370fb
SHA5128963bbe42adb81ea7eba999d5a2f176a7bc5b236033e7551ab0ec91d33e0fabe99ef3ebeab19b436435e84383429da0d8f5f8824444a9b3697e9284efa0a1d08
-
Filesize
5.2MB
MD5b846eba0d5c7621ceeabf4637c5b0c5d
SHA1041b0965d2d6b4c77d8a77d80122761b0a0f6e83
SHA256e303525f83832757cd2d82db9668f8bb7d6c36d86c9e73dded203a1f71957f6f
SHA5125074962773f068dd356613f23636d4b6784edaf878858098b1d088818fb9c7f621d7f3e9411d69cc3edd6987b0b8c3e114b17b85dcb4b4172b267fc80e37e8cd
-
Filesize
5.2MB
MD55d021ae40d2a9d8d9b1d0125b1a76fff
SHA12b2c0bfea01eebc2a8ced055def5c13bd332dc1a
SHA256687ee2a7fff7c70d928c50b73fe2ff96f1c7951751a4efcb9c2f4a7b3a125fd1
SHA51252ac8a6af24453f72e6109f1ff42eaafda1a64570f7d673cf50f04f8b3fe55eb2c1c3785e8a803f3bc3d80b5ba8d7edbfe5555f74bda041c1b5a42fdd6f35c8c
-
Filesize
5.2MB
MD5cd180a1a1240d1136ae4c605514c704b
SHA1748b28f5b2057e4876630234b922054eaea9f925
SHA25627c3382149c9801c985d6a286371025ca94c30e28d779f7d51b2a5dffe07694e
SHA512561317c9eb17abb653e4a94e951f1ec4c72ecb3074e1ae8b7ced6d735e1ddb6eb10d97519ff54f1cb0e94dcabec928140398cd14f2e1a1b14f3a20bf59bdf56e
-
Filesize
5.2MB
MD556be6fa19f8d6fe2ad24e28ace99f5ef
SHA195f81dbbf0853d08be5dad13706c8f5d2c69fd6c
SHA256f02b65def08c6ea7250c6384f7330ce7758417f3b58c32d03681ce2cffb67725
SHA51253e0b19b2a42bfe2938b41174ebf30ca177291cc29c08802b441f1f48dfd57da36e2733c374b67419db6d822dce4f8cc1585038bb42f71abfad285fdb15dc6f7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB