Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23/07/2024, 12:49
General
-
Target
2024-07-23_2474cdf052cc6f0ad3a8e107e8233d31_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2474cdf052cc6f0ad3a8e107e8233d31
-
SHA1
865afb1d8545d0c67c84a25bfced9d1df7888e38
-
SHA256
84fdd07395cb37b6ccb8d408c8d9e515954bf4feb53f5e2680a14b5ce1cd8109
-
SHA512
8f86ee8a4020530d1151533214635d9610ac5e79266bbaa6798c3479cc35142867f3d8a2499831398e759508d5fb4b128947c92bf5ff974c09bb32e477b32358
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lU2
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-23_2474cdf052cc6f0ad3a8e107e8233d31_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-23_2474cdf052cc6f0ad3a8e107e8233d31_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SihhNJF.exeC:\Windows\System\SihhNJF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VcHsGlg.exeC:\Windows\System\VcHsGlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLKtBEj.exeC:\Windows\System\FLKtBEj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfgWpXG.exeC:\Windows\System\EfgWpXG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGYYLgu.exeC:\Windows\System\qGYYLgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZYkIuv.exeC:\Windows\System\NZYkIuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEbdfSY.exeC:\Windows\System\EEbdfSY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\irRvwwH.exeC:\Windows\System\irRvwwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EPzTurI.exeC:\Windows\System\EPzTurI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KOszJnA.exeC:\Windows\System\KOszJnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wFaVxlG.exeC:\Windows\System\wFaVxlG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pDuuiPr.exeC:\Windows\System\pDuuiPr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZknuOgH.exeC:\Windows\System\ZknuOgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AbjynGG.exeC:\Windows\System\AbjynGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nDhOBnD.exeC:\Windows\System\nDhOBnD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XSyRupC.exeC:\Windows\System\XSyRupC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWTBueI.exeC:\Windows\System\XWTBueI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXdIWAG.exeC:\Windows\System\QXdIWAG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lDbUvte.exeC:\Windows\System\lDbUvte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxNAXNy.exeC:\Windows\System\wxNAXNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FBxDGXd.exeC:\Windows\System\FBxDGXd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5256abe437e24b6fa91655ff99fe54458
SHA156a8914ab4cf23594c728010454d4c4ec6decd90
SHA2566bca079eb516df774bbe9d4ba7b8e1e6cdc10fe436efe2d689e3cd1241ff1e91
SHA51291c192c4aba1432246efd4fa51d161ab480715887252779bc6bc141917bc94b4c6cfe2b96464bce084c40c94752c9c0acc0c3c00f67689f93b29cbabd489093d
-
Filesize
5.2MB
MD596966c736d972b52ed24f6e839cd58c1
SHA1a671298718f684abbaf9db892f3d74673aa25a8e
SHA256c12c360dd5f55bedf2caad9ed593a125e64809c7cb474399d76c9cb923c74063
SHA5122676505dc0c908c1916f43012b01364ee64aa839861c5443fef0ce431e40b3d07fafbd812a71f6aca853fa53ec01cd91ae17c3a3e2ebb00a3cb038c5497da586
-
Filesize
5.2MB
MD5c1150a4b305c607ae4ea02aa734d9390
SHA1096d06a8d1c651830d80ae5b7763bfe96e672b84
SHA256b0964fa69db283a3ccf8e8f42b294c9caf15097cff5f55c066649998d0c37fb8
SHA51214f0d543c6703e4b0c641ff8158c3af790ed467a3c147120a92cf455154d5c2de6905cfb1c2eba360632a2478c46afc1b8c78862daab3dd2fb882535450b799b
-
Filesize
5.2MB
MD5e4aeb193b96393b743044a8c1a16bc66
SHA16024b1382f743d82fcce3f5be24dda5fe12ac13a
SHA256bb60b5c7bef18412ce7faa8c76df7963077fcfcf383ee0e7eeb7962332ba2f9c
SHA5121f713d022c80f4ea7538480140d9840d3a16fb91a01bbb544c332838c679706a2cc3da067704641e7be52e0b7ddfb076433d4cef41db4ba17aa11f94ca7befcf
-
Filesize
5.2MB
MD5121771adb2e0ecb74736cb99d38c47f5
SHA1359f8508603b813d5899ee515c8d9428db74e895
SHA256dc02f3f51a7187961911effdcd197b79d5366745665843433f48a5501d2dae50
SHA512c86d8cfd1fee9f213771cbfd488c8ee6d0f83eaa9dd3c0e7598634eda6fba131f4f304cd905801a492d714fb5229caf052f042f17f74e4c6d7efbf0f93a80ab9
-
Filesize
5.2MB
MD51448ae3ee9df1fde5612bddf056bd5fa
SHA1b3a097d51285a09e7dbf5d44fd70adf450db0012
SHA2562281f4d95344015107d0d93a89f2db8c3df20d2a91d4faba3205c830f4752f80
SHA512388ef7fce2b3d1935dc5577deb18d85fac82e880b9133214aa902abb48dc71781d80db83f9a904a6f6a5e2706d49dd70bbbc5124629664ae5014da4f2e6194f7
-
Filesize
5.2MB
MD546ed5b4b965bb3fd5c3ecea4165f55d1
SHA10c06dc61c92d79d0205d517ee60e50811d3be685
SHA256b69fbabad4400afdd25a4b893a2a515dedaa95ee53f49e3e3cf717cf07cac8ae
SHA512173eb81c43115dceb8a0d1b950e14371f0d1f3eb1c4ad1cc53332d26c0ba1c98a699c8c28e08e040b640b513cb42d619b27cb230b1e274d31cf26185e8f5bc2b
-
Filesize
5.2MB
MD53ca8469b88124a5fb4e238bbd7c92b45
SHA13fc74d96757dfad92772d77c63e31d8e38010a2a
SHA256d41f2d8efea675bc3fb23574a75a0f521069ac1c6dc739eccd7c0a43eec0c9cc
SHA512758b44f7b7888971ec6aae1150d4607ed749ea945ba017a7a8c8d60ba1b591843dc88f7d1363a430ef4c792050f0af18422028121445a5953b615f20f3ba7e90
-
Filesize
5.2MB
MD5e19b645fd7a787b327da75ebf825a82e
SHA1e68f7b6488d303937452210e6191ded69ff11018
SHA256dc5b870608bbecf9e37ad037ba75860cadadf15da21ec9db9b34d783590fea5e
SHA5121003b7b68a8ef56328a4db4fb5b7faa9da6dd80c8c974328e32e0162d60eb5cecf439c34d8b0ed00c3fa902ec2339fd80b780489940dd540d5af1e52103c0c4a
-
Filesize
5.2MB
MD5e612e079dee63eb1d56d16b5d9c85209
SHA1120d628a0bfdd63aad0578f31e8c6cac24e8fd52
SHA2566d45b9c0564b197ffcf1101500e2639c771e5c8c5249b5cddfb149d1e45be6c1
SHA512a60582eb8d88dc59c6000a7a1c628fe177f69bd0cb88c5283c94d0a0f5e5081cff9c52f1498715703d005a80625dbf2f20f040760fcb5820d2eb678eb2cb1251
-
Filesize
5.2MB
MD57f2acab85e833d3f9aece55117eacafc
SHA177784e58d9b5952095cb0a9eaf0fbaf3a4d89f3f
SHA256d61f4e025e68e0350c04717dcaf5ba1156bb1ee527592198bcf11cf78edb6eba
SHA51284e93169a696fec598e93c7ea5e660b6b6d1dc78c1e9b359f2eed28d56ceb00fdc298c20c5942c8f543a9231bdbbd2f47d806229ca603359b49f376c43d3772b
-
Filesize
5.2MB
MD5d229ace444b082315c5635ec588d012d
SHA1a8f2581e74ab5f36025b139f6ab676899a960aef
SHA256717c320104f86052fbaaa30de04d7917ec3b2e8692e8b3ac3422601c9bcb561f
SHA51268c4c97e699987e779a6c943be746a811c6349298b91f740f16f4e6b70270f08b533ad49c97a08113a43fef80598b2229c9b063f3a42ec3b3fb55b01841e703b
-
Filesize
5.2MB
MD58cf06d1793c0a0a7271c0fdf3a98d7f5
SHA17772803caeea58690c1acaa41fc7ba1db0c522ed
SHA256b9155950255aae7367c75e68b85327278d97e2f0b4354ddae17d259f21e63bcd
SHA5122b31218a7b586938b6b2fec03a10d860624ef708796b43402fb763d7235a37b120c44187c6443141db44c2847929eeb222844462a23320ac363390743f819c51
-
Filesize
5.2MB
MD54beb36bd75f94cb3009fd827b7b508a6
SHA1afc8d6725b25d26cb2e8523a1d7cbc3db36ac4e2
SHA25694a5cfa68a239976634cd5d95401e252b308170ec8df9cdc9db37a644362da54
SHA5121455e642defafe98dc5b69927510e4c72f0caed4f64a2689c5d46ecc6e1548b1a4f3b64b7d2c6d7269526ed28b318c9123536daccc24a65f2349f71f0040bbf8
-
Filesize
5.2MB
MD5175598f7c95bd34b6b90eb609e739acc
SHA11e4208098321d5ee26ad4c8a313845a8dcecc9a0
SHA2561c9a9ee6b256e6508cf6e48280abfe7fba89a3558ff0ee627e638d0f08216d8d
SHA51289e94dcf821b61e3b531b470d4bcf21d36eb43b898ddd2560702f7eb7095df621eb4c46a6791f1e5a445a6db67b71d2880bd0001036ef6d54e8b0b182040eac2
-
Filesize
5.2MB
MD5a4d06ac7441e109a08ce39ec970b6189
SHA1a2e793e2a88c012f3cb42b5400b69c314b1ae3c4
SHA256dcab444cfe3e9cf027572e4f9b3e5cadc7d216fa7f7ff54a16a60e2dcef68cd6
SHA512a0582310acdc0698b3662b5bf2c35ab5dbc6d203da6e4b83ecb2f408d83220e25d0fc44c6d7621d7874b7d5ac52ea64e6ff1f11a9019833f3978a27bebc93fa7
-
Filesize
5.2MB
MD5d8bc59b33d6c8f41b9fcc662f710dcfa
SHA1238ebd312828b6ac1c7f028b61627aa6cecce28f
SHA2569aef9347f66601facbc9c4a347929c86a699760d2d9ef2eed49b869dcade1cc4
SHA51260752e684086fc2121f36ddc58e07eb602fe86483084c2fc0b1c9b572a88c983a45163a2a876b5955e331ee67e6ca24b1f76816aadf8498a96f95ac33524bef5
-
Filesize
5.2MB
MD5925d2534c59da535c6c393cab0db9fd2
SHA1d1b9162c814e006698227543fdb95e1612791d3b
SHA2569177cae0c2709452d09ccd9330a3f0c41de86b07834684440d8cc1ecbfb430b8
SHA5126a007936b14346dc4c7096ca924559b48c8fa0e593d984e8f2cc5dc32297bb065e2b6bdc40d63ca6bb05d8bcf4b942723c49037f871e9c13b68bdf2f6ae84ccb
-
Filesize
5.2MB
MD5e9b64741edb60457424e2d8c8d38c454
SHA1f0b0b32c38fec358053f99e24fa3abba94092479
SHA256effd815aa81306726376dd85291cc433c9390e05b05287fa4df3a209558791ad
SHA512861b9b54faadf5d42498964293c9e5ffda7fc4c4dcee3c6137c60f5bda64d0d31d6398491e809d18066f0154196e6b74012eeb749110d4464e025c05528cce0b
-
Filesize
5.2MB
MD5dfda45e6b466825e884c149c18c5e767
SHA187274cef46008107b2ecc231473c8f4c8a0668b5
SHA2568d2bd5431c4460ef42cd4de9d994c2bbba2b1b57673747b9a0d9d586884f20fb
SHA512482cea195aea2030d012e4674360e701143dc22f209f1a365369968dfcb7950bf88166ac4c7cd6ec5b2ad33cc6c23400d4e1fc5addc53eef70e46cb33f64fad8
-
Filesize
5.2MB
MD585cd96897c0ceffc5c72b272e63f3024
SHA15352b69d4c6b2329a00d5b16530a05e0aa8ede2c
SHA256e31cf0a443dbe8dc72203869777e2ac7c4105f583d05da9aad04fd1ab2c29f8d
SHA512739f26967368ee28efda5c804522661fff6bbc3cac9dc5ceb05244d24beb9d70e1df71194c6fd93c40597218edf2bd44d4979934ff881853904a147c3692efba
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB