Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23-07-2024 04:22
General
-
Target
2024-07-23_084c28207fc55414b3ede2aaab9a0ab9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
084c28207fc55414b3ede2aaab9a0ab9
-
SHA1
8488c6e82ac7a3c1fb4ef8a3e17594958fdd1aa4
-
SHA256
21320919a28c259dc12a91fa8f2628c888756420d455b220295e94d3d60dfa6e
-
SHA512
92f129c1d464528984b94d5793f55c4b722b9d0c48cd2560d7828b8935fe11533f8451a406828046775feff29f155509337be7af3cd5246105cea086eee13f0a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUC
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_084c28207fc55414b3ede2aaab9a0ab9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_084c28207fc55414b3ede2aaab9a0ab9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YHloGtz.exeC:\Windows\System\YHloGtz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nyDJcIJ.exeC:\Windows\System\nyDJcIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lYfiyxS.exeC:\Windows\System\lYfiyxS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPTFXlZ.exeC:\Windows\System\IPTFXlZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjAtZsd.exeC:\Windows\System\fjAtZsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vCZoudX.exeC:\Windows\System\vCZoudX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kFnlCrZ.exeC:\Windows\System\kFnlCrZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFxEjKZ.exeC:\Windows\System\eFxEjKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqpZdfy.exeC:\Windows\System\nqpZdfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\siBJLor.exeC:\Windows\System\siBJLor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKimzjt.exeC:\Windows\System\YKimzjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFfXDSO.exeC:\Windows\System\gFfXDSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Utnntnm.exeC:\Windows\System\Utnntnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gKHBXZa.exeC:\Windows\System\gKHBXZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RScEMuR.exeC:\Windows\System\RScEMuR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NeXfnlc.exeC:\Windows\System\NeXfnlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MWqblWf.exeC:\Windows\System\MWqblWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsQnIdy.exeC:\Windows\System\xsQnIdy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLrAAYK.exeC:\Windows\System\sLrAAYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NnWjeYO.exeC:\Windows\System\NnWjeYO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHKefHA.exeC:\Windows\System\MHKefHA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57fccca5cd227f0a638bb2aa8b60d379a
SHA1a04c84aa2bf12a568a09ae9da456b6e46a186120
SHA256170f56253875318474395b5f1035591ff9cc0935d1c0ae06ae3958a918cdbac3
SHA51244d7d6c4371aad3e6b7f790c4538135c6339ef5ab2cc85180046c0991421cf2862673833dfa86815d0829c160150b0b7454afbfeb7ae51b4d6f9fa5ca4733e2c
-
Filesize
5.2MB
MD52a9415021ec736fdc24c683878f806db
SHA1acdd3c7ddeb3eefb24be314a0201ba4ce44394c7
SHA25667b9a7b9687e95ee5a7bf4d1b845b305055f50bf6a8b35500bb37f34e3f91a2d
SHA512ab7a6f1ded06c254e6bc06cd7153b36ee2990b1d8b88d32dce3f539abae444c2c17cbba885db778ab4374d8620fea448e9b8af6acf88d72e14c944d6d33ccd05
-
Filesize
5.2MB
MD55b490852311ac4863e7fda5f99072398
SHA192f55680db68609a3a730214c7f2c9a042eeb069
SHA2568eee18638e13c26c296f15ce4324c59262bd52e778f0248978a77408c201fabf
SHA51216c019a7e65e18c7a932dbb828a8e31bac78e59a0247fbe16193b7198624af802b6d2124a404aa0a7daeb0812dd634c253e26d796725d28c5fd353eeb84db483
-
Filesize
5.2MB
MD557d87742db0a537f6f315d05172359b4
SHA154506ea32c65cc5cb618305ec77f5439c114c784
SHA256e74a7bdc4b41696df8bafe008627fa4924657313934ed3c0fc7d8a992dc17928
SHA512ba090207d3132e9985e3ec6ca66d067ff770f21306ac452ab80c09bd41f4ae4394b5d7eaf9a4cb5047583d896f76bc0d1d0d0b4e15e8cf43140636d4c1be6ff1
-
Filesize
5.2MB
MD52ee229436959805467b8107f757535f4
SHA18597ca255d88a08ff65d41b1d883c1b613cf735f
SHA25645820dcc00bd8a108b2e44edaf58e577fdf53a174d4e4492f94c46ae9ed9b81e
SHA5128933e9eea861c69502bc7bc95efea4faa2ca71dd1358fccb681d8bce96474bb26499eddd72735897b9e1fbd9c6f2d064c11b3917a8361d70467099e074249fe1
-
Filesize
5.2MB
MD52eb0bd612431392767236b40696ce1ec
SHA171471ea3a4543b7294e813d57ea63de1c94fbf19
SHA256b62cba120e307c267358e9b490dbd969d7ce540a8ed8d760e98bac04fbb02441
SHA51201f8d10e8559ae3d374713799d2a80bfa23a4019f8cfcaa6c1d890b93a08c511cab88ed1de04c8cfbbcb731eb20aede32ac56223beaa90ac4a101291dafb8568
-
Filesize
5.2MB
MD556bac4f714005a85dae30aa06fe884c9
SHA1cd6a2335f10bb2014b42e5c154464c60bc7a59e7
SHA25685b608c26246a0324ccb4f1b3cb443ae1f3d4ed51b37f6e926babd0dabcc2ebc
SHA512a6d082a3c4d142350e1e09013e13d28a39c1b920614246be7c4465fdcd3acca2f96fc6e18ba4a832c0723405ba14df97e5df7800ca87a862134db6a3b6020d93
-
Filesize
5.2MB
MD50ee8ca049c623c51cb2705f02de24ae7
SHA125b780d6c7e14f5939fe0aa14c3bbe787b18c4b6
SHA256e89488695f29404ecf998be8fca0eaac7e2966c0b1f51f2346c7aceb08e2b5d2
SHA5123c81e8709096ae195ee5bc4761a0e3f85dcba3b4b0ab6d3bd76321b365062d6c5be6d5f8a319b5c6b897df231065549f311b1dfdd6d4ea5490c9becdb4eba051
-
Filesize
5.2MB
MD5c0b0b862d5fa5807440b4866e60e147c
SHA17fc82e237850c9e01b42883d0b4587757b7a4179
SHA2566db65b627f54a178d427ccb6dbdafb28733f49c5041af03fe1b493de1d559974
SHA51266968897066c5cd447c397c18a388d5ca328d244cb51f8a4c56b4c39f845dac587735e5099aa2ad749ce8366b966089da47af1d083b212479f47f8de3d4f7871
-
Filesize
5.2MB
MD535697cf3f6a877d8c74772ca12e58c3b
SHA13cf21bf3156ebb6671e72ed26fb2a5f79fb5d485
SHA2560e0c9d08f8548dea5c7a41402ab5d2197dde92f85dc6d7d8da72b799782d6b34
SHA512ceb9ce6bba7fefa7d822b1be1fc389bfb6dd269dd5d240bf6876bafba5b471c8cf5bcf9eae8ad958bc54f9554df4fd347ad18c1a115944d23b4520754242c353
-
Filesize
5.2MB
MD58b9d1700854d08f3d0047d5493dce44f
SHA1520621e9c15e76383ff24151d6b351f84dd1a470
SHA256e0743896c9fd02ca77c11d0a144f148209aab7f232633e90cf20f8a7b4a96d08
SHA512c146643fee1b7dfefc8be99f4d93e9698dc22203095ef25941ef102e6fff19ef49d7a31b3135028068d966c976cd2e6cbc38d88071c0a0b49154aa799cf89e57
-
Filesize
5.2MB
MD5be120179daa859a5b70fdf14b642913a
SHA16ce5e8e293e610aece8eeace8614bd234108805f
SHA25679c4e329bd7779294af2654450cbb8146dd80c8983d4c38d701fb57d509795a0
SHA5120958f1a2a1c6096b8bde07d86552bdc7fc2baa343708cfd08c34521f35f76846fb510c9111fcbc242421a1dccc43fa4cc4b1210f8ff17f025e2517cbcf5e6b68
-
Filesize
5.2MB
MD53e770e16dd63339d3aa4daf5e0aa0056
SHA12a68b9017b52ef7796fb8b4b6c86e09dbf0f03bb
SHA2566a2699655ee1128b02881405632e15f0600aa2645c3121ab2de7a5d5b387f555
SHA512b272a1500ce4cccde42b21d4c4ac29a6bd93b35952e99a55bdf6afe9be120c65a7370a2fe7b31478b9fc3a2084a0f5eec0c566b747705d45646d0daff2231400
-
Filesize
5.2MB
MD5e39ebf871304dc81cdaa09577fa59a87
SHA10f002023a8bf822794fa86b86326d28188ed0819
SHA256ee785d035673c38b8a043d8c84e927dd085c8fd451e050a8888e9a14caeb6305
SHA51228a76d59c60558872a08e8d6f2caa59baa02c5aeeca762b8a92f881fea736f66f999ad1420c74720ee1e482c6667b624d06d5c84f811b8ac6f399139319d3016
-
Filesize
5.2MB
MD5ec1dbbdf7a5113e281cd57197f1222f3
SHA17b111f0d82f31c92601e96ddcee6f5261538b43c
SHA256c40a02310f5a9232e7a8fcd7c734d2bb403954f10ca9e98e20c70b09d7aea99f
SHA512009b9a4909d282a97e3306443607f9e7516339415216e7de451157ead84c651173cd3610c8f6d724db72b7c903987e0c17708f7ec16447ab4e816c31ef70e210
-
Filesize
5.2MB
MD5f713e6f88a035623eca0e7eef16cd74a
SHA13f766018cc5f42a5fd944e4b65632e770af2abf5
SHA25617b6f9ba800d99b6e71b9e0dc831c0175628b6aac6a420def37596d104994f11
SHA512ab1111e7a947c6db4cb0f2df8df9cd9e0931c967af04e20b90f584cbf53e5f57fd09fbe4d94960681ce0656139976fe9db74f7ee3e2120744a5550f5a8d15606
-
Filesize
5.2MB
MD54de5b7cf90cec820e4e50cb1553c62e7
SHA1ee52d8f6dc5832730fdff71ed44a08613fb4232c
SHA25646e9770f34cd481a174a644817b9f46b0ada7b63256d22485321a37f523a12c9
SHA5128b2efc86a5b950e01c41b8c456476aae871ff4ff9f0843ebbef381c26819ba4a864b84c425b0e39aafef756cb2c44194d094df77cab02b48c61a378b0d1cc272
-
Filesize
5.2MB
MD5752b1baf7bde216b062a6b425c7a54b7
SHA115876eec1dc53acd1d800d17d422104916e92e58
SHA25607857f81dff4e4111a6207dc0c80d4a3a708b944959e56d2d4c45379b5e43f5b
SHA5126719b2b1edbe6bf8a33d09019244ffabbb9b58b1a3371c0246d7ac50c3e577e8867251a2ae0dfcb2dc9ea0d2200e257ee7c63e6c6e2800a41b977b7a672b0e71
-
Filesize
5.2MB
MD55d9ff919ca3c52f276cec15ad431fc15
SHA1a213a15ff584353df60cc18d71f60ede57e9353d
SHA25631fa5202187ba2bc1fa5ebbcd7a3700bc8e8b0107052185e321ec4822ffbf8c3
SHA51294d91b4b48af3de3fb07127c387bca2e6acf03e61649b6cd6770dd3bd9e7bc125186937e8dc72e6363ad9897fa9443d73bb78228272c6668eadd81134c730ffa
-
Filesize
5.2MB
MD595cf70895b622e214a061beebe857cdf
SHA1dbd42d5f465c4e44b40325892d1e696e1847d0cf
SHA25633b106a0e89442f04671f035b4c01361773e025dfaafc1bcfd19f3b9377a7f04
SHA51226b879afeb686bd59545bd78940a02f91e6592cd2d011ba4b53e398c5088ea1fe0e34bfed4ed8410e455ebedf5e8209e6f9ff63395dd687c2ecf075fde152ca2
-
Filesize
5.2MB
MD52cc008759bd2b03c2066bc59b8bd6cf2
SHA14d669aaea1f135c8c6403c1232d821bddbbb5741
SHA256d1a8f7de98735672acbac792471cc557eceb391b9a5425532b09d4ed4b9a7124
SHA5126c831797ca95bdac20a4f6fdc4d6bc9311076a0132841c8807e4f54fe7d879117ba005ca4c9ac57ed5e96ffa6b289fb1b82df565efe13176cd64f23e25271a40
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB