Analysis
-
max time kernel
133s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
08/08/2024, 01:07
General
-
Target
2024-08-08_822a272b63d17f6fd6c70e8ca2075837_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
822a272b63d17f6fd6c70e8ca2075837
-
SHA1
8d14718b1a33af97386b79c18e979bda5b562f84
-
SHA256
89d17a2fe633efc367e2a780800229463658fb0c210e31199f362398c4a4e850
-
SHA512
eb8cfe815a874c55988ba19f5e3a585fb21ab26de61bb77420146167e045edef044ef55d4d2d938bc09c6f559be4a4e21a14121757e60daedc9375e6ac165164
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:T+856utgpPF8u/73
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_822a272b63d17f6fd6c70e8ca2075837_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_822a272b63d17f6fd6c70e8ca2075837_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dksfBwy.exeC:\Windows\System\dksfBwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AJshpTh.exeC:\Windows\System\AJshpTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThEhnka.exeC:\Windows\System\ThEhnka.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LFZPJoo.exeC:\Windows\System\LFZPJoo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnJemzp.exeC:\Windows\System\DnJemzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiLPQXY.exeC:\Windows\System\uiLPQXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LiSRckK.exeC:\Windows\System\LiSRckK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iKVUHLS.exeC:\Windows\System\iKVUHLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVAWBPL.exeC:\Windows\System\YVAWBPL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpaEPOX.exeC:\Windows\System\zpaEPOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzaGIQf.exeC:\Windows\System\gzaGIQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBJRkgC.exeC:\Windows\System\OBJRkgC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNLFuaK.exeC:\Windows\System\QNLFuaK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UloYrbr.exeC:\Windows\System\UloYrbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdQSLTw.exeC:\Windows\System\MdQSLTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxsAhTL.exeC:\Windows\System\ZxsAhTL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqvaipX.exeC:\Windows\System\JqvaipX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LtLHtqk.exeC:\Windows\System\LtLHtqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HeSQsWD.exeC:\Windows\System\HeSQsWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hLSHuDL.exeC:\Windows\System\hLSHuDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TvUmdhf.exeC:\Windows\System\TvUmdhf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5573d668bdbc385cec52bdae9a497ad79
SHA1ff437266e4897f8ab8ad63b13ec5fb327e58a5f4
SHA256b749c8290f1d73f97bd6e37f6c69ab1e00a42ab9da23814acbd91648f29ec720
SHA5123693ababce326c0231de486ed529d98ba63848848edd64c3a7bf112e3809c973a913a441e93d24733ff5a88ace30a6f9dfe8d1ddd3bb0e9b294b3fc5838db3ec
-
Filesize
5.9MB
MD5c2dc40f2f4e5c5f1d44d556c96af96aa
SHA10ed9d6455556be249cc94388916e3c12f2a97729
SHA2566573573a3b50db446128dd6021537909e660550c99c4c9547975fe6424568ae3
SHA5124e2da4e5cd31685ef810b788395981d5fd9d4162bf428c53d353dc8e96a7ac2469bf43808bec4510b43723981b6eb814c758eca1fe5ba554d9d31eb82958da35
-
Filesize
5.9MB
MD5a45c78303b0d7148e6da3e333f1f037d
SHA11ce9904da11be483fa0dce17babe9a39d4c324af
SHA256e45ba1395667724763acbd2c2467b4cd5a299a37d6a9f9984a0fdc970612ad18
SHA5120051c01afdb5ca36147f414357cf76aabbe407b3dd3d5c58bd93b339f0cecc962a60b474f5194314621faeb7d2da6fea49ca5c11202d78894db529b7a9f7adb7
-
Filesize
5.9MB
MD5c163dd3a51b32ac5c9aebb9f0a8994d8
SHA1bb09f3959a07cd4e0d34b8762321b74ca2cadc65
SHA256e34e11bbbafa11837ae4bb63ef8390a91f87103b4c49a5d713ab8f37e37f87af
SHA5127fb9249b3f2e1cd90b44abf85080f4e221cca2dc1c28d7a58db9a4fa906f656e817033c740c3b289fbb110ab43760b0a7dafae403f1147f3c209245bae0b1483
-
Filesize
5.9MB
MD5785ba5c0cb9b4582cfa9fe173a107124
SHA1acd48fd981b7c71eb22d5ece3f88f2dbb48c9732
SHA256245df876c7467aed542fcdbde99e8fb2f16ec377dd39e51a786573ffc63d31a6
SHA51252efa32e87e1f2dad405a35346e5f7b42331b126d47b7d38957dedbc6248974c46748d363eddcf8c913908c67ae4a4254d85490d9b0caab1aded06a83a65ce1d
-
Filesize
5.9MB
MD53efb4d84be2423fb3c658e62c99a59a4
SHA1358604a99cf9c34014d6d6eb1d912ee04404ec49
SHA256d3ca8541f8f5ffceb8957d9aefe70fb849f7a7bc505ac10ccd1d8591e4c01f75
SHA51285cdfcc462d3a340167c56e281ed6325dbb899871aaae95d062d609217cbf8db1bd841337f4223555bbef70fde1236550f29628c6d45d9a9472aeaff25e84cb3
-
Filesize
5.9MB
MD5cd5f3afe3bdd53c3db0327603f3489a6
SHA17e9de64f7d87ff37174d081c8489a644cf42e2c1
SHA256f2daa2629de81490e8df8d72271f49af490778dbcf45685450eb156829fa43e8
SHA5122a3784e45fbd97620d7ccb8c5b1869d1f4163a78bc66d4acdaa13bceb0003e74b43124de90ac2e496d4c24c68fa0b54df983e711212fe9496f7a5b7cc71add0d
-
Filesize
5.9MB
MD5bfdc2d509fa1cf581ac377c2dc3c61c5
SHA11468bb649f3f73a1362ec852c9dbffaf9faf98c2
SHA25655383b58378348936143ae9de3e6ed65ec914e4683906612b5df93bf2c47f7d1
SHA512537785c727259389ac655b0dc0833667776862b96e39980151041fb7d60d34ff4b8eecebb9e5561cfada66459a8d4c701932f7df9f100c61f16cc5644fac04e8
-
Filesize
5.9MB
MD59bb5e58178c70a3409f7abdbb6a4a398
SHA171d9d0393273a821658e610fb9f1c99aa73cbac9
SHA2566316225d7cde05b920c58a86a8eb5faa0fbd430c6d637c5038586d0ece0dad0e
SHA5125872f909ac32066f9326cb04360fa6eadd292efef7c6921564761e485e0859c33d5e511e8a145c8ca90867f9cc9c2e1f312e79b462a73c31942ebc1c4e3e519d
-
Filesize
5.9MB
MD56d8c88bfc26b41e7bddfcbd97da8684a
SHA1d95819fa4c14d5e1ff906ea4b13edbb7c81bfd5a
SHA256ec1815813544b7de5cf5ff8b8d178d03848a96129fe3dec69b8e125e8c36f13e
SHA5123cdcb9af7bc918ab92805e0f3bef0d3df7fa9d2663b67fe4670196d73f2e629ea913814133ccb9e32c1e5587fc4614268aa7430f1dfb9163d9e0c06e23b466be
-
Filesize
5.9MB
MD559c2db16fd44312f18740c989b64ee31
SHA19d9979dd8f73549744fd51a0597a0ce57af76484
SHA25679c56e2c25c76ddf8c5b3336050ffcdd15f1678d6d2c49e8b79293d5fe8c58ec
SHA5125f4df45c97a6a3106659e24cc2940f4f33f44c0c9175b5e1ea9602384eef60b2caf4843a6815944accea5464016fca56ec1f90b9d2b2dabeb8e323bd590c1f37
-
Filesize
5.9MB
MD54adb4710d4cd826e70dbbf54a6b3da7a
SHA1ed0ce228b846a190d1f0893d98eee1aa6174a2ea
SHA256eebc7684b793b62ace9a7c673807816836edf097b0c78d5365eabfe82d1ae120
SHA512b47534dea3ac250df6360f546c78837cbfd8b8f8bc3c45c4606b288bbf75a837e5b859d24d6665d2ebae207c0c682bdbd96b8fb1c68cf1cedb977e33193cf69d
-
Filesize
5.9MB
MD5e20db5e6203cad3c51e6340111704a16
SHA1bc6c606578c46666c34753c6065d18bafbbe38d9
SHA256fe522ca5c334f19ea3a15ae03f44e5f8726aaaee57417e9e6fc54d27dfcaa9a1
SHA512e464cc8bb4e0b42e823b5ce9983264e7e57de133babc983462b86252a9f453fab7698980229ac98e611b87b596a284ce79d52a89875cd763c3a251bf5c93bd87
-
Filesize
5.9MB
MD59f79094e3d7c35fd649e09a07a03ec00
SHA147b421d7f3905b790efa21eb2256ca0110ffaf6a
SHA2569c431818e953eb75dcd13522837a83c26518b43d7b6144876bdd3bdcde500cae
SHA51252313e4828304365f7ada4f7146305eefef892887bfe3392d74d7f9ce918182b2b248692748fa66837c341384249acc1a125b75517e4526670e11b8f30e322be
-
Filesize
5.9MB
MD5b9161b0d349537c5ab25aa0590b301f6
SHA125864b262357e2b7a8e15eed15ab312ad1c3d1cd
SHA2569589709b54ceafc05ec6e34152ab5f01954d101badc0123f77c2cc63808d019c
SHA512b442d6691f0d80451f0a22cd8da1fcb0274337af0b1de8bea3e001702221d637970a87f82f0682cd01a076a5e952607d4655f02b5ae49469202809dfcca64093
-
Filesize
5.9MB
MD59d6abeb511f3d51cdf7fc59315e3ccb9
SHA1497f82755b3b3eee79f02649af9e4fb9ed102658
SHA25625f96a0e105469c2ce587faf75dc64345c785e908926b3f7c3ed25aba1508b12
SHA51271721739a188fe36ed8e678277607c469745efcc663cc96d301a729188ecc9eff31628dfe89f5d451bef436fed1ca9fd9f2a6bd155a715839b0ddedbaef27859
-
Filesize
5.9MB
MD5439d305f863714afd24a3ca720195c90
SHA10c64d9379f8c25fa655c3010db82e76671bb4516
SHA2565c2d919dbe977ae818ac658094bde7480fb1fd87d470aeefd6ff9e0ebc9d7e5d
SHA51228647a9109d72f4b29ff75752800ecdb46549973f774a00437e80a7a941e2038aeebf9fd264c4176d0fcc6830c18e42fa98efdc07afa21a7889bdffa25735db0
-
Filesize
5.9MB
MD50d03f1333360ceec177539c286c05489
SHA1a0860ec5487ced0ee0363b19bbd58a7b066898c2
SHA2568f0294c7d8807b60c830c81d60cfc9e95b11d52e2d880fc57255debd9f68a769
SHA5120e2571f0e024294afdd98c72ac474956b73538b4ad48a7c94590d4a81c8811da62c49ee8cb2dc432e281b6674066e1e55a368514dd32754d5e808e1a662b3f61
-
Filesize
5.9MB
MD55e53b6dcfc4587f85da6f5518b669928
SHA18b71ee20e945514702f6fd7db552193c77266b77
SHA25654398cd454327e5a3df59ebaf88ca3f6143e3ad47fbc9e9a87928d1f1664cab2
SHA5121f7b86a4538d0f60004ee77965019d3cd38507d5630d6efdfd1fb6e3f91d17b7419027cf8c0608d47d1eddf3464725118c13a15f5e8e199efeb8a3d3b92bfdcd
-
Filesize
5.9MB
MD515de43ad7d6e6f068fb5cfc5c425f91e
SHA120b3aa3e2e4b7cda8a61463f486d119aa429a6af
SHA256cafce642759436dc6e5f7cc4ceb249a08a458e75640a6a1bae62ffca678bf3b1
SHA5122953b621a964a50ef1c36efdce0b8e238fdff2000b2795c9cb80bdf1af8593559eb208bffc13df8d707ffe080c4f7cc52df025160eb6baeb05fdb69cc7eb1eb0
-
Filesize
5.9MB
MD5bafee0735a42a91fb2ddbcaf2c934565
SHA137fa64d9113d2cca41c4f1a3ef1390e95d4405d2
SHA256d150640f38b2f1995c281f94e712d1cbee496b1df11e8ecbb1366d48dd6d9ee7
SHA512a69efbd841b3355478bab6a3797f625363dfe27fa6c7b61d182d38d6b8d0e4bf6b7546512e8e4102c6e95689b18f3ba6efb9cd79e6e0effb89c7af77fd89ac9b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB