Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
05/08/2024, 09:42
General
-
Target
2024-08-05_131568df16bb60335a521a2966c31765_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
131568df16bb60335a521a2966c31765
-
SHA1
e5acf8fad4648435358d44b2702a18198b343716
-
SHA256
d3b9b662a77b876b5ead611b557944d56e057079cf5f0a040f27c88350e7d76b
-
SHA512
fd312ed8a1c87a5d05c841f4a371bef3a28b47f2f1b2a1410b2fccd5ecb4926e27772c1fadb0f4a6baa379c5070598a51f72949ce34c36b0a53973daa2d2db4c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_131568df16bb60335a521a2966c31765_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_131568df16bb60335a521a2966c31765_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zMZVspd.exeC:\Windows\System\zMZVspd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bKvrmzc.exeC:\Windows\System\bKvrmzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRsuBKx.exeC:\Windows\System\vRsuBKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbdVnaq.exeC:\Windows\System\BbdVnaq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GUayLVY.exeC:\Windows\System\GUayLVY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YKHpqod.exeC:\Windows\System\YKHpqod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eUmpTlK.exeC:\Windows\System\eUmpTlK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wiObJbO.exeC:\Windows\System\wiObJbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oakBBiR.exeC:\Windows\System\oakBBiR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wEBnsUr.exeC:\Windows\System\wEBnsUr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVuNnKf.exeC:\Windows\System\UVuNnKf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KAYRNuc.exeC:\Windows\System\KAYRNuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HgonCby.exeC:\Windows\System\HgonCby.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IvgeZnx.exeC:\Windows\System\IvgeZnx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tEQNEcz.exeC:\Windows\System\tEQNEcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHMeLgx.exeC:\Windows\System\VHMeLgx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTfniYY.exeC:\Windows\System\aTfniYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BPvJkge.exeC:\Windows\System\BPvJkge.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXYvfdO.exeC:\Windows\System\wXYvfdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwDuUdk.exeC:\Windows\System\KwDuUdk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFDeYrb.exeC:\Windows\System\KFDeYrb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58f4ad02fb3f1f44f225ff52e86888c2d
SHA1d562ae961787780e38ce07b16fcb7eb6c19ac73a
SHA256e408ec40452ebc3e843a50abbe07055f4ed1910c89a3f05f71dab46bed3ae7f5
SHA512cf76a77e5f4fec08dc3bf8f7bf8b66fa48da601df73e1ea87b14893833c104b7664f8f7b56cfb5a4808fb2bca9a22160b5a074d7e67d4a71c8ec1820ea390a96
-
Filesize
5.2MB
MD5a458a883deed8427892578eae09bf0e2
SHA13bf2240fab5b38e151746f975b5ca74c3b9ae6ae
SHA256354027830969ece808e26dae3678db7ac7437f8aa71a8b10155c3afd0512d461
SHA5128a11345d0582dc192915431b1023399455901edef571b730952c611c6c02cf8fac3cc004d0eeeece095c557da9f49bad2f3bd792c15ebe92ee2a879f08edf615
-
Filesize
5.2MB
MD555a24aef32a9810a29d592d5ef0b7d24
SHA14f03b1cae9ae70755db005d9e55a862f6fba307e
SHA256ed1a552bbf0c9885a12119f905afa014f3a42c139bcd77808b2238fc1d3e90e2
SHA5122fce30838f6a1a3fc851b64d77a730e0fd9178c6fbbabae21e372733abab344d86a912f1f0b5151df5e107072a03e32aae76a2acadc2cd53aab641c7bbad762a
-
Filesize
5.2MB
MD54654c14656c5ab380b7b3b1ee49414bc
SHA1ab8e17f2e06e642a31b76fe207d6231aea4eaf30
SHA256c9420e1fe1101092ea75739ff52ca1e92af5189b54f7be597486befd2d669e46
SHA51202360d021e5e78c97d7171389816e64155ba98fbf23804af27e88517847f932523b96860b0e30e6493cabb21fefec9119bb1c88790c90fb44665e991f75c6285
-
Filesize
5.2MB
MD5e297c9e8eb653595150f77f6f9253a2a
SHA1c75b32895b2ceb26eb3cb575394bde2ce4adec9c
SHA2566c081a178d58fcfba4098325b1e2ce7077370466421f9763d5ce45caacff3b42
SHA512019e6b008772ba0cd99d044d604298d6fc78446717db4c634c360702b7e1639abf34c5c1ae19cfc1b6c91729ff6a5affe42b82ee07e573c734dc5309fe49011e
-
Filesize
5.2MB
MD500cd376997c240dd72306f43f6bbd611
SHA151e1904fd6127c877abfe47f689cf5fdc69ec016
SHA256e031c4bb67785fb0b7d5ed696391bbefdc3669d6117d7e07396bdd8d4671e0ee
SHA5127a1773af0f1721c8633daca279f3e59edc08b0029a477afde00d7bb64ee06b8dac399d53425d7c43d38804bb14b67e566412b62f9b02264372a25b52a697aed5
-
Filesize
5.2MB
MD5ee3efbcc9e9b63d6c9c6c46dbe0cc619
SHA1c0ec910778bbfe3285d1ce9b8b8951c49d53e2db
SHA256f3a1692bc6d666856d549a508a4686de9c41c406c162a997c43af32e39ccf6e2
SHA512fb7099e9cd6b2e845e0dd22de0fac1a9dfa6d0c59bd24564ec91226b7c2986ab8cabc5b019d4e9ffa79fdea8b2404aa73f52f23c719d7907c00e506915d71f2d
-
Filesize
5.2MB
MD5ede4164571aa47f723c639e06a813f38
SHA14f34770464ebeee1a113ecf6d5e5d4a43c69f392
SHA2568864464d68e1f8305558be3ee94939264380d3b7901b0b6711799035470e5727
SHA512402292abcf189e228e604c1edb89d194ffaf1255d447f1d3289fb8be7e3591753c038dcf83868c1aa57fd5dfca7960d7d8f8cae2b2794a6b5dd4fca9899f9e96
-
Filesize
5.2MB
MD58f624c2762b270d0b8457922be95fc65
SHA192ad7c25f1af1d24efbd7984d776577cdff8ef5c
SHA256777e4cda01c0a377eb4b68ec44f5275390f7b5dec995ce1aed5f95dc0cea01b2
SHA512c735267bd2bafffbfb1e97147d98de92c636d4db07523c55b7629981344f1fcf783fe10c3d00ac915a235970c6a2f3fcc9fba7e9ac10c25b33ad54eebe9161a8
-
Filesize
5.2MB
MD5d72802a35a2b5525f7075e615433172b
SHA1fb93a140c60c975d39d4dc366e2f1114d5c26c0d
SHA2564984897868e7c280dda757ccb44edd398e879c2fa4dc0a961c5788a8f6173eb0
SHA5127e47c0d2471afab5babeffb53d435fbd9de257bcd3e6b7d2befd5cb86edbb432b40b1a6eedb55f3359ce02ecc2268cbd0486e566f187706447dda44ef6b16d76
-
Filesize
5.2MB
MD535b2b8cf4daf06e11da32d1b3b4b000d
SHA11a73d8683824e84f755b29c97e5081bab02f839e
SHA256194471c697b17db222a08a0a561ba552b0b33dfeca17a9808220ba839442418a
SHA512fdb0dbbda789e06fc8d207c235662774eeca79f69b481cf9c2c1322fcbde584fdeb1ea695b86c146b92d6ade6ba773d6d3c75c8357acf9ff0fc42f4aae802456
-
Filesize
5.2MB
MD519e78c4ff6e60517b2e0636780358c6b
SHA13f17b9ebbac7c5042823e0fadc821a3f286700f9
SHA256c8be33714aa1105d805c8b1bcb493fa224d9251b7ddeb6aa25511362014dec40
SHA51225e4404652d3878e45a64fbfac6d4787c97e4871ca77ada365849d0426b44b97c5363596fc3f430493b087108d739af9c3bb61bd309ccb1226763a964a221979
-
Filesize
5.2MB
MD5e0c6fc701d6b7f31f252159567498b03
SHA1fa796f5fa013d4a29e4b139de9d8cff8da067d49
SHA2562a0b3fc122400569803c728ab520ca723f7667ae264107369b6ebb93b43a12c0
SHA512abe9539068e833c53d2560db0762c66183626b7240bd760df5438c63df3f49529755670b43f6fd41f5c7ab9771e3d2c28367eb6852d94a4e5f465d500d26bdf1
-
Filesize
5.2MB
MD54a1f51c98602a88caab01ae2d21f1a70
SHA17530d07963a821e4223bcef97ef89bba0c8bbbce
SHA256e3a0aa4ceb829394ed0ce0f5ca73f0e246315db79d8d1c1d47b469b82dab7a17
SHA512034ea16769651a7235ce44ccfa3f58db74f2a081929f56e65d88107a5dbbcce754c07121ffcbd2c2c9d2303250dbced1209abc3b1693ff316e66d781c488e434
-
Filesize
5.2MB
MD59c290e7aae490041ff4470061509fc7f
SHA107fd72e695d45cbb7db11e737f53c189df22a18c
SHA256e86ba2fdbbb64ffe3a08ab2a0fb22ccac33dd2a430591e25f4ba3104d0036124
SHA5129ae8263c3119b15d3d78d24109b8952613e5601ff78605c82c8b0790a10ae73de9aa9e292af66a3b48d4ac000376a134223bd13cadf4b162624c01dc2c95a436
-
Filesize
5.2MB
MD518276d9c2e15e19ec7a96db50a4407fc
SHA1ec968bd895a2d004a7f703d14620ccdde31b2fab
SHA25698fde7d13cb3cc5338f3e7fb383b0fcbe76597282c5a2fd4d9ea4a3076358bf3
SHA5121697b3eae3efb12f2244e585a469e6c228bcb7ab7305694b245dc5b5538913ceacb5f8ffc08b7f02e2f0b70711004717075f7eaf7fe295e0cc55818ed7b739f3
-
Filesize
5.2MB
MD5e5482aa3ce2af75bb37fe8ef2bd7052d
SHA1a6e6e5ebbed0830ec841c927573ec162bce3fe8d
SHA256a18eba1832d936eb6893a1d3a4c193b7642606e534e14f65f84b9983c0a89b4e
SHA51256012a8d0012119d581f64700fd779eeda1271d63ffb1d3d458da49af594900facd0e8af9faf0631f63251b70cd3513bd0f04bf80a51a4231f0f1434655c4ad0
-
Filesize
5.2MB
MD51fb6dde8966c65cbf16762705ebe0aab
SHA1bdbe379042aed21db45cf2c7986e8e2fdf588131
SHA256deda77dc7c986caa3d9d05f632da02f85e987b6eb7fb6bf9e3ee1b05edfe4450
SHA512ead2f5ce9e40ae9f447524c8ed3ecb650d3abb129cc7a5ec74d4b16aef83627cccbbf105b3561ecf0dd0538378d406d90f4a78b29ddacbb23304059dcaf195b1
-
Filesize
5.2MB
MD50c0d7b81426b10eb5023a432be778849
SHA105769bb9fba844b8491b2bc251b96af174cfa629
SHA256a1ee1e793f4925fa6b10cee0416a2eb28bb859d7212bf6377fc16680a17d5081
SHA512dc952e6c1416874dbb48bd8cdf1c42e332997429e4cf7c196987f5cf82d868243480d2b967d9772defbd65fdeb890b1bd1418672601a53e5f68329bb38ab2d45
-
Filesize
5.2MB
MD509de7c3d65fc0b8ebeb8a1e834bde78e
SHA17d078a3abdd45189f8c16ba355d6fd28899b58fc
SHA2567afd7a367f42e41fabdd62a6971e3bc52cee59fc2ed63fcaf039db7d1a679f10
SHA5125dc10e15ba5ff3b216ccc5b5dcbb3cb147b8ff6c212e871f6818555a3ccaa983a26a682f9df5009a29b1d6c82867f174999d99a5df6f80595f3589835d16dfba
-
Filesize
5.2MB
MD584d2e37b148e8bdc19dccaeee23bfd3c
SHA19498cbb717684f42463070cca25db4f39171983d
SHA256a106b94873cb0e16aa48e00aab9c59d970d53d7eeb08a3158a7e4b9533c7de2e
SHA512e83f0ca3ae18a7a5acef59891e1dcfa726f12dc54c57809fc9cee523112e727e6a6733f7458cb5eefd8c7fab79dfdb1ff48856487514b907f9b74a1b50c4dd01
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB