Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
06-08-2024 11:48
General
-
Target
2024-08-06_2f4f0bf5cf4ef0d9391ff33afe3acb85_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2f4f0bf5cf4ef0d9391ff33afe3acb85
-
SHA1
4af2c2f180562a58fd61f7d881c868fea3771d73
-
SHA256
7f7935b5ac5f0d8ed1a649042a7c3c6625bb9ddb648b4525ef29c42b32f87099
-
SHA512
8c281f16bd192dab308a2ee0ba6944a5decbf4abc2ea2ec7dc62fad567699c534d5a8de1afe7c97a5a5d9d2107d7d05c866d288572a7ec463f9f55621a243615
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_2f4f0bf5cf4ef0d9391ff33afe3acb85_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_2f4f0bf5cf4ef0d9391ff33afe3acb85_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ABynvRH.exeC:\Windows\System\ABynvRH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FozHHCZ.exeC:\Windows\System\FozHHCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yshLIzc.exeC:\Windows\System\yshLIzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNKYxJK.exeC:\Windows\System\nNKYxJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmNNfpt.exeC:\Windows\System\gmNNfpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQqTYlO.exeC:\Windows\System\IQqTYlO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fNSYPXo.exeC:\Windows\System\fNSYPXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFkmWXG.exeC:\Windows\System\TFkmWXG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ezDzxHw.exeC:\Windows\System\ezDzxHw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwxJDmc.exeC:\Windows\System\rwxJDmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mFnJsmJ.exeC:\Windows\System\mFnJsmJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GRlVmvj.exeC:\Windows\System\GRlVmvj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWlcQme.exeC:\Windows\System\eWlcQme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSvjTSA.exeC:\Windows\System\oSvjTSA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quPbBgr.exeC:\Windows\System\quPbBgr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIzPVbM.exeC:\Windows\System\nIzPVbM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSPPNlP.exeC:\Windows\System\HSPPNlP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nHKHflI.exeC:\Windows\System\nHKHflI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aiWfciJ.exeC:\Windows\System\aiWfciJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvOsEAZ.exeC:\Windows\System\JvOsEAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\okjSmEq.exeC:\Windows\System\okjSmEq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55421355ffd74516e6f7679739ddab457
SHA1ecd52f069f2aec3e40aeb131ddeaad6bbed9ddf3
SHA256de6c76fe38523380f1b02776e17d03a3a6e4681f1d9105b29f7fec102c89eeb5
SHA512c0753b7bbff53ec414d516345dc4a6c2c2ac0470aa556163859fae211db59ba06b4956a2fe52cb914a36da7558965b846de593dd6c015496f69f67a2b9765f2b
-
Filesize
5.2MB
MD52f736b2faeac7ed758a83cb85ac7a718
SHA1df60f35daf18738bac5ddb6587bcdebd6b579ba4
SHA256c1b6e28d2d35ea95cdda96a46658b967367d853fae7eb793dbb4b65c6ff799f6
SHA5127f6555329a792c6a654b03a728ad6977531377a2a6a4fe1d319311e487f0260ecf4b3faddd602425895d4c7e497194033bbe117283cb46e62f4f1243bea7277d
-
Filesize
5.2MB
MD5d2e6be731842b0dafe759fc3bd32e83d
SHA182dc0188054f654b912c9a285020d15fba6413b8
SHA2563331fe63ab605524bf6d3b0211db6335f6f6a10dfbcb2114cc58b3c3d0d0787e
SHA5129f4f0ca0e6f11ab26a36d8ee910021ebf6d0d7ec2724e1a03a2239cc0156479531f8936d78c43e0ab79366c3221b0dea669c47558ac53bb02c5158f8a9dd5ce0
-
Filesize
5.2MB
MD53c4cc5f4339b16d7dedf69285d4d40d3
SHA16b43f10d257e7b143134e7a6d9514c73af0b2b2b
SHA2562b10651d8c2952d50ed38728b6af456b5c5d242dbcf29cbdda490d963f7a83d1
SHA5126ea1b622e18814a0b26a09d7cb3ff3ffe948ac9ee3fa69ced81620c5a0dab0aea8a1226ac3bb2040f5a0394c526011211c2b79a4afe7d1d3a501e4959df5b5f9
-
Filesize
5.2MB
MD53372792a32ac3da099a84fdb0ff19325
SHA12a8246c1b861b116c13283eeb559cc8f43b1e0d9
SHA2564b6a503218af5af89d2a97009c992465e6b0300e8ed18445eda1828ce2cecf01
SHA5123dfed10a4b36a56a6818caf022fd6a97989534466f5707edabadb0a96623ac745fdebfba19eb555fa59564558f1fae5082a41d53028175b78f42e89bf6d71615
-
Filesize
5.2MB
MD51f2c959084326096445bcc5bf90a88bc
SHA1a8306c795f82910ebce82c3f59a21ba4096198e6
SHA2562985958a7b793d10c0a1d8d972cbe1653f0338ba257960ef83ead38c9cf902ed
SHA512afe371bf459bd5fb2c890e72a7c4ace08d34e8f55aa67ccda9fb5594c1adf41f4ada5a70350925973811e26b7709116fbde3930a3f6c2b10a8151a3aae419994
-
Filesize
5.2MB
MD5fc64ffe4a7d19364eaa00385df78a045
SHA11c5328221a92ea9280f366f98dc9f80d0a013da8
SHA256541b9039ec815b408b172ebd3dff27bb9a665562a96551f38a8ea244a77a0265
SHA5129553cc52964132fb360e86e131b8409db5e23f280873f1d9119c0a3e15ff232e35395d6364755d835ae117b047eba32de4bb32fbdc37847b3a115db23706ea02
-
Filesize
5.2MB
MD599825fa01f6b19108e2ce338de15933e
SHA150ba9fce2693761eb8fed27b0321ccf6c959dbc3
SHA256788b4dfa8c09388d0b2a970eb7311c1cfdc4e3c9dff222713b68e961218b263f
SHA512beab920851cf946a8dd74fca4b3ca7aef1cc8eaaad6f25fc0248d69a00c14aa6575b13637533c236e25afec1c62f95f30e191c0eeca7b8a613b3b3146dedc53a
-
Filesize
5.2MB
MD51482675a1d22c1f2159d627e0bd8fbbd
SHA1cb30f5bf1fb0f1111938c13b72398962608a58d5
SHA256269792d8b9a4729452fd3007e5aad8a18d71090987c929657e4bc635eef43b93
SHA51288d28a896cc006693e1ced04ec35b059427d1e9ad7cce06c9682b2ff471512abd6198e02615d0aeccbcf98cfe012cf45022cc3d359f7c8bacaaa8ab0624ed1dd
-
Filesize
5.2MB
MD53ce35dbc7475df500057f8fb11ff61c0
SHA174659398660f7c80ed51086ae512564179dff54b
SHA256aef47cd235fe56a151034e59cf2438b9407b26a4b5d7f936e4237f16e67e09f1
SHA512bd4171f259177f87ca44192cf02b964c57a243b5813501913b3ae1b6c7ceae81c6bfb4edd4cafd797432b080e425a7cd552de8b6346383833bd6368be02ec3ab
-
Filesize
5.2MB
MD507950ce5852412a465733965fbf0455e
SHA132caad14a18c36ad17319fedc9253a11fd999892
SHA256399dfb6bf09110dedaabc86941356bc8d889da62755acc79ee12119e867a050f
SHA512b92c6216f00ac64cb4f82d09f285689f30c72817074829ce93cfaced6b704b02f4ec5f81b0036860366dd870239000e5732eea4693dd03b47bd08719afd5689f
-
Filesize
5.2MB
MD521b0807e061bf866ec19e2cb5363c66b
SHA16fda65899f910b4ae07d8dcf4619d3d783cf1413
SHA256df6fe15f718f8b0ec3bd02015baf48b46843c70d7624ff4e40a8c1ebf1142a3b
SHA51248bf8c7e5145f6f7d990aa9a0b45bd8bd939e488a06b9be2d18085bb7ba63e7cb4f7c2240dc0b44bd0d5e2b2c2aa0cbcc082a84cd8b0d319a3c904eb6550a62b
-
Filesize
5.2MB
MD57519ac17f8fb06a00c080ef4bcbdf601
SHA12762e51abf0360ea35e869a21d03cc16866ccdcb
SHA256e06363e0aabddff64804eb54b640f7abe8b0ed1b3d796893e4340f68df3b8edc
SHA512870070bc052916e136ff57acba35cbf496ec9eef0e5665e57fb72a5851861e481eff77522876e2295e1f70ff5acbb9b38934001efec9f223e77a61e87cd1b91d
-
Filesize
5.2MB
MD562c51d718719f0dcf831198575d28348
SHA12a750151dd7f7b6b628143cfc7f0f17d0349e142
SHA2566266f5820496371c9d75fb0ce049e8b8283a6444a569371f9e7388cfce742ffb
SHA512ae182b20b37f94770cbecdcb87b841adcebb759f2eb5d2ece090686a6fab14e4353b418c6fc971ceefb244dfce89a3e379e34071e9a5b45dc1e19086d05ed39a
-
Filesize
5.2MB
MD5d97dc46919d7a2e51da31e6166aad106
SHA1b5da62931328b8e7e2d935bc0401f96eacd2a98f
SHA256c3336f349b7bcbb21f28271fdfe155f5467570450c69b2e44a359d243056c1b4
SHA512665e3cc6862603c3680bdae0b29bbe56716b77827b05b7a3cdb2fe8914d61105674594c671aaa107c0507c2f3f23cb5081d2214cbee4eb9bd6ded1132df99518
-
Filesize
5.2MB
MD544eee69d917bcca63f31680e13620824
SHA1532a4477423758f2ea834c60ad9cd57c814acd9c
SHA256110ccdd3a033afe23c2a8034a89a35cd203e5fe6c982fb46326e1b45f0a018f6
SHA512d210c82d6f291fef583c89e6474ecf527ab251bc036e6c5ac0c89e38da38411430980e217705259a6d67604140e243dc794db88d88430f440434fd310d61a9da
-
Filesize
5.2MB
MD504a974973397f8dc5bf89cd01d5d5d8e
SHA1969747ab1699bd605dd5ed7efcd54d22f9d06d31
SHA25659eb70f3a179031a2062b56b29a4d23fff066726b93dd39c745b6a47e0fffcea
SHA512429e5b2409a4d34eed17050a80a1fe43a3cbfa0246dadf67a4995198c112a4c0b242eda637ef121c7fb4ba1a628537fa7c3bd34a1c21ef97bf612786cf421263
-
Filesize
5.2MB
MD5257612fbe2ef5e26b4c920dfe671ea19
SHA14dc56306154adc2de757ba16ac963d6011272190
SHA256b51f7a61a05775d29e542a7a5b5f80f297351fd8bfdfb7c98ca85f5dc6d47ebb
SHA512080763931ae2d91c5ed33210ac61593723733b92a5b00e030cb87180833381ead3caab9c96d509092a5578bd973edfa554b4476b1291e32c71c5a49927d7b2bc
-
Filesize
5.2MB
MD55d3072d07b505c957015a5c4dd19355d
SHA19504d50919e1f6f016be6f506dac60e014a9e67d
SHA256c0edefb55579dfb7590608428eabf0fd5d7f124f7bd3f106536417f97b900331
SHA51224290d7a39d21e86c546055cb90358da1b086073589a80a8962cdb7c5e662a6223fcdfaa8430f62d8ae2d98f8af5247c99476c5179cb21d2e1ce82dae57edade
-
Filesize
5.2MB
MD55927a95638bbec62407a1cfd0f15299b
SHA1387f1a6af0e890c563979636e6b1df79037f5d58
SHA2567c3dc2273c27d89aeff99fa78d2616e052caf08b8d454058c1b3bca8c2bd4d2d
SHA512433b94e32ac108152417e16b4afed9167fd47af567b48792a67c7263ffe769e53606b4a564fde203eb1e152a118b8506d61e7b306abd83f02e26e2ebf23bf629
-
Filesize
5.2MB
MD534f5bb61de674e4350761199aace883b
SHA11498e1c5277e6e6f90fad73763e9fe6b70881ff9
SHA25640027af1622f5c6aa40e22ccb8aa3252dec90614a930c5c0e511eaaff8ebaef2
SHA51232bc265d467f41f7dbb62587819cbe9969fdd3ad383dee4e312d230048e9979907f1c0a06dd0be8847651373a2a52daaa808f968199ab725e8b268002e06b31e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB