Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
08-08-2024 00:57
General
-
Target
2024-08-08_a96d53e1f31d215e47dfe3ea383d262b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a96d53e1f31d215e47dfe3ea383d262b
-
SHA1
d44dba516021f390ad7795dd79d111bf59c2d000
-
SHA256
473f479e9b484fbe7ba755a4c608ef2bebd2d96b24dff71de2a692930da7a99e
-
SHA512
2306e4fb6faa78abf7b7e169a62c17ec40899aa05d7a3aac737c417e481cbc83a3800a27a3f42399b8ca5c83c3285dd7ba4f83c45944dfabce0b48d12462bc84
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_a96d53e1f31d215e47dfe3ea383d262b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_a96d53e1f31d215e47dfe3ea383d262b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AJCBRfc.exeC:\Windows\System\AJCBRfc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcgFXvp.exeC:\Windows\System\DcgFXvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYecnaV.exeC:\Windows\System\LYecnaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qYeBQdE.exeC:\Windows\System\qYeBQdE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DwWeYPP.exeC:\Windows\System\DwWeYPP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RooNNVl.exeC:\Windows\System\RooNNVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QlKSfvd.exeC:\Windows\System\QlKSfvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GStWmxI.exeC:\Windows\System\GStWmxI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\otivcag.exeC:\Windows\System\otivcag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DkFFjyt.exeC:\Windows\System\DkFFjyt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqXPTdk.exeC:\Windows\System\RqXPTdk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUnMKMd.exeC:\Windows\System\zUnMKMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UOHrunH.exeC:\Windows\System\UOHrunH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vAzVCvK.exeC:\Windows\System\vAzVCvK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raYNUKW.exeC:\Windows\System\raYNUKW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctFxDTl.exeC:\Windows\System\ctFxDTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IeGWJyB.exeC:\Windows\System\IeGWJyB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FSWwTtW.exeC:\Windows\System\FSWwTtW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\epPXpDj.exeC:\Windows\System\epPXpDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iIzGsNi.exeC:\Windows\System\iIzGsNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQBckKY.exeC:\Windows\System\RQBckKY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e2c6470838c3638ea5830c307a2c4f72
SHA15e2bb5035e1fedaeb5e1248bcb238cfa7bb7587c
SHA2562132b740172c39a98f78054163e12849bf65638744e0d849cb9e2225aedbe45e
SHA512741da7245be20b5ebc510a87d4f6975ae0c705d848422f7085544776c740f0209a313dd528ecd3735c23290bec9cefcbb25558816f784308cefad6ec7e866015
-
Filesize
5.2MB
MD5a5bb6c25149b72401d113b140295a765
SHA16c9c1eba5d21a0ac65081e962e653087f50e8ccb
SHA256dc7a7c8f4980cb4ea69ba7b6536ce727190db635bff0ea7f593103b4c1ff3c0a
SHA512d5987b9d74300a3cc404166dfe3e0b99ebb4730d024f39ecf660f9bb055c111ee6c85a9cee7d85f9fedc5736b1de557a54701c686f2f4147bc870627ac8a0be7
-
Filesize
5.2MB
MD5727f3a844872283eb959a5ba0a036391
SHA1535099ea1646a9319ab33c08d889561f50d1e9c8
SHA2560ca2b2a1fe30f63f0b364042798173abebe9768c2c23214555760aacdf7f7045
SHA5127ae8e0a180257d03e8e529bc59af4a669980a6609e0bebba36fa101cfb493e7b5a64d883dfc87f7aceae1d140d077bde3c66133b373d19b24ce6c2274dc1cf9c
-
Filesize
5.2MB
MD58fcec54b60eede744797d461c176c2bb
SHA186a51937e856ede66b64de65caa269fb0bf55e0d
SHA256463c9983ed6a78c6ad3da2fb30882e72ac492a2330b3df742c560d6b21a7758d
SHA512fe327b8611b5057a979eddcc6c43f4b63bc2af9dafa267f64c0a91daddb4f0eadc61fa22541b7dfe10c0eb357f6d6715aff3c52fbd2ff2672a494913f2701c62
-
Filesize
5.2MB
MD5a15cd0af51ecf3c5171e22ec4a3876ca
SHA1e9b0bf8069214a4a9e3e51e1ad3c2147ee68e260
SHA2568e4bf453f44b7dfc35d73814b46c9fc57916f716c4ddb7367fee2d7524c37d7a
SHA512f59d3abe3f02b59295b39b942cca42b96dbbef3531d01a71e02fd96152aeacd927c75603f29db01ea75dbd6c8bb8efaba39f906fd42e8085ba9cf6b0c4eee275
-
Filesize
5.2MB
MD5b98a1ac58ff46425ead9d6fcde67be04
SHA1cf140e6f6bc85b21641ee357f575972fcacbddc0
SHA2562d842340553eef0724b4e7aa0c79335679a2b55409c1ba7af0f0ee4c9798f57c
SHA5127944f8693a5a18a39dc36680bef614d6ae07f935682da7968fd99585550005f6647711b90aa88a1f2b10210ecc7e6735608b0700f90619e159f4a8efc54c52d8
-
Filesize
5.2MB
MD57bed441282a80705b1be68555a252923
SHA1b623a7690cbb65bd82e5ca532deacf2b0942d4ea
SHA256a766a960c2a66a2d8a473c3225f6c861e7c8f7502556e25d21af43a4d98eef0d
SHA5127678e21fdd4df3c366327402d831cdcdd4de7dadad654850592fb9a9c24629dcde11f923f07f6d42d89b0dfccee5de8797593fb2811223c5b1a86b689c661591
-
Filesize
5.2MB
MD5f4178cab7086bf1fd75a036e529fb054
SHA1afe3c1288270046eddf3028f5c4aa9522280352a
SHA2567b2daf7a002dfc28201414e077a4afbe7cf0b02ef424c4d4eacc5febf9dd62fb
SHA512489828784002adafcc65e9f85f76bb6c92cf8bd76717470bc47db8e8e223ab40fd52de6820e9c5e52635fc5d8ed041f07da00725e9d7a29bf679d41890527ea7
-
Filesize
5.2MB
MD5ecf83e19d018b3538e20c5363333a462
SHA1846b5016f3d62269e8c3481c96cb7a2d531e48ac
SHA256512967cae5374ab9c649501b54180a47ffad76699125db46e7b5c42cf78d997a
SHA51202b2f665cc11ea80762df5a83059b8187fcb0f9afad6661bf7d69292e4e8cba8373e0e7eafa0a69a8c6d93eff15b4ca769056666bb601b8a33511c6285afefd4
-
Filesize
5.2MB
MD5f225fbee60a910fd7e2ca4dfc70ce590
SHA1e17ff3b69362934367fc8ec3b02f4390d8b9f062
SHA256391956a61e63f390e5200080911388b33a585be1fdc754053d9137440dcd77c0
SHA512d898d1e3596ef19c395ca64b300bf2b22e571abb7af468252fd1f7a717778f9bdbaae1b213fe3569f07850e3211d50f1e88ecba6dcb4eb92d36d8d660b8f16a7
-
Filesize
5.2MB
MD51e6489ee7a667ebd42be01af3a1ac09e
SHA1a42843e858148c804b0efa6bafaea701c3225544
SHA256245ea2a8c798162d3901c8a6d0c76cded9c0cfd720064969165c56485ac91894
SHA512ee5891c0085940ff589f18a4cef79943da1cd2e8f936de5e81934d93fca7c3539956bd21008b01715a879fbeb950ed69d9bf9e9c48dffe6e037010fb725e95a9
-
Filesize
5.2MB
MD5db02dc4fd50b11fc3115ddcffbcd1ecf
SHA1dde48b95b2e4a112e74e19f88438a1c40110e7db
SHA256f7927f7fa5b8a004dddac60cb9f445b8ee19ab332d6d3bc8ff05e48d1d2bc896
SHA512b217704bdd1dab63ac39a33c056d2406600af625527837b1f992a8964ecb9f1362dd6fd315af07257437abdb42f8056febbfe7b9e350853dea85a6d8a4c9bbc6
-
Filesize
5.2MB
MD52c57b09f3efbe9b217af21bfd949abbd
SHA1f19179e842a9c5056ebe3e5d7374978e77b53ef1
SHA2565220ed0f345eecdf72ff1852058da6bc7d4f3268df234661ec17f7dd594616aa
SHA5123992dffdc6c766a86cfb9b793bcdfe91067a9bf4c8b410425abfc282dcce615dd87e2cc109802767544ad0a479362f8482ffabb7737c79c8960e7b8573cc4dbf
-
Filesize
5.2MB
MD55b52b960160500c4ad5ca1b489b4d6c5
SHA1e5cb3caaf32554e7794d463dcc6390513fa6a6dd
SHA256d16184a360176a0a3eedbb4453f59a75d563d8ff2305390f6b85709642a99943
SHA51299356e5530dc9855650be81e2338d718a731058beb4bc195d5f4afdf9427ca7cee5ddd6d31f4ac4b2894571eae4426bf91c0624c588c976b4acbca69f4c249f7
-
Filesize
5.2MB
MD5e384d91d1de55f32ddecd3099b3bca8a
SHA12e7fd7716dc3bf22bcb8e489ef00ed4c2012e335
SHA2563f78045a7d28f18f09ca84de0b4adeefe87c5d964ce26d23a78196ba8239343a
SHA512e837bea691fec9a746e39f168527d5c4da6e95fc39036c99ea19e1d11e2ef6157ad0c290d72ac07a37d42653c6272ef064ae45734c6721cd3785bb7edebdc39d
-
Filesize
5.2MB
MD52ee950470289c0a8c0a66002e6509f31
SHA11e42b17d5030aec873c07df4a7c0902142d58194
SHA256792168c374de1014186ab7a4761b15a7b6a60798a339765e3ed60a5fbbc97c11
SHA512f03835249a5084997a278908d778a927a256d1eb714b01829313e59c9253bed02193e64b5cd72570778dfdd8267edfb9950ba352a0ae8711134688af3b473ab7
-
Filesize
5.2MB
MD5b485115527f367a1eb49240c9b86871f
SHA15b4c3a0c4d4ee6f099b94ce728af148670991758
SHA256f03ae7a6600247570e4d8c2db60609ae81dd8b5b1cbed5b2d1896514bbebee54
SHA512f51072da998e3e838bbcaa55f3526d389ca52e49df2b4de02d9c4ac00bd638b89d58c2b7c1391f7a0a9927a7dedd9875aa959760aa8dcfaa153c0ca92f0cf368
-
Filesize
5.2MB
MD54161ae4d5f212c6145d445a9e186c8f5
SHA1d1c3721d20a06041c5ed8fd975be9d5fde46ca80
SHA256341cbc6714f10eafd2fcc1373385241c9977c59152061076a1d1c308c6f44ec6
SHA5127c084f69b7fc199568a6b8ab9210f3a59b503e1661bbf5fa272090855fa4517b18fbf3912d74c935e73a03c06b83e8b85409a404a6855d39c156384e8dd93e36
-
Filesize
5.2MB
MD56d28de5478e0334d99638baee47fc4c5
SHA1c09a9fe8379058ab2ae9ad419045dfa4f2d6b1eb
SHA256308081b899a28764004c4650457b3278e45267df3d12663c0afd64a493c1a7f9
SHA5126851948510827ec89f6cfd9aa0688822fd05710e7a314d671764b026fd18c9a44caf55d498785d182298465c066c306b8d3da0a18e71b6f149905f2ce25f8a95
-
Filesize
5.2MB
MD5f2462c180a610bae909fc025ac40b576
SHA150795d5226ddb77b6a2c021da9ff5204286bf438
SHA2564000d3c1d858133a850cca7605645176da6642ad7ec8e771b0a70b391e5a5aab
SHA512df5cc91cbcfbf7385ac2c6fbac1c23ddd2db6411e2bf4d72e3f6ac5fd7ff7ae688977150b35b7be1a01d4de98c40f3c366a7ac427247324fb3ccf3faa69a7830
-
Filesize
5.2MB
MD5219325bf553836e016bebbf6eae0191e
SHA176ba2a088cb469d8562aa4ab45e4134ff22a20ce
SHA256bd7b02e5e6f76133d98a439e989121316adb00b1e4500615814aedc28457be65
SHA5121f1de46566ad29aacb4a8e219c5b90a7261223c4f8c4f95bc625f23b60f58562d4f428cb1ac8cc45b11403f8821b1ea9f92cc22af7d188b6c331c3683f63a740
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB