Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
08-08-2024 01:11
General
-
Target
2024-08-08_e4286e926e46e1c351ff778eb428a7d4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
e4286e926e46e1c351ff778eb428a7d4
-
SHA1
20193b561bbd615ec1039aae2247f087a2084bca
-
SHA256
df7f6f1c972bf20f2e613933391d1bbbdd6e7a22f7b72fc5875248f52862e9d7
-
SHA512
d4020bf8d6f0225e761e2984c374739cb0e5619e4eb9c132a9143e89fda408630085c3d9a323a096b7f0b463d654172e4f54ddc8e0d978a5e5c156678878f255
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:T+856utgpPF8u/7q
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-08_e4286e926e46e1c351ff778eb428a7d4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-08_e4286e926e46e1c351ff778eb428a7d4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qbKwyTH.exeC:\Windows\System\qbKwyTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qtuJugP.exeC:\Windows\System\qtuJugP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FTBVrjE.exeC:\Windows\System\FTBVrjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfKCszj.exeC:\Windows\System\sfKCszj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNleWDa.exeC:\Windows\System\SNleWDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPfGgZI.exeC:\Windows\System\zPfGgZI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TctdwWD.exeC:\Windows\System\TctdwWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVtLswV.exeC:\Windows\System\WVtLswV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvHVAbh.exeC:\Windows\System\QvHVAbh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Jnfjxnw.exeC:\Windows\System\Jnfjxnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgEqeSM.exeC:\Windows\System\dgEqeSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apUYSAn.exeC:\Windows\System\apUYSAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kEGQWOx.exeC:\Windows\System\kEGQWOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EqlaNvh.exeC:\Windows\System\EqlaNvh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrtAnPQ.exeC:\Windows\System\LrtAnPQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGXgymA.exeC:\Windows\System\LGXgymA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XaTZtnt.exeC:\Windows\System\XaTZtnt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AARefKb.exeC:\Windows\System\AARefKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vvrCyqM.exeC:\Windows\System\vvrCyqM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBTRmhO.exeC:\Windows\System\fBTRmhO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SrhzVMr.exeC:\Windows\System\SrhzVMr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5f10179c6673ce96700d6094ae182496e
SHA1034490ebc8b5da17daf3da66d2d6b4db121f0a4d
SHA256f5da25732fa45a1c41f991057b5f00924ec99aad84d0e7897a4b13c7a6e3d8ce
SHA512b773e8c6a2b7466e857637e801a4975ecf24abbab313c7d86f43446bdeb908c077fbf295e7e326df4c8f91c9e4e820cc6c7a7f5a58d99b8e72ca0b0538c11d2b
-
Filesize
5.9MB
MD533ca23fbca06e10a8ad319b190d021da
SHA17b2d435a27b9ee833db0670239e79b067bacd56b
SHA2564f7c69ecdf061464a4f8d24bd0b8a70017d96440145e9d2d6f42417d2f70cd1b
SHA5128e8b0a45c8c55ac713e7071a2fc14a905ff4c7243381f95bba2590d795abf5136ee04474cdbd8a4e9bf923a89ac694e334e8c9bd830505f83ccaed531be7bfe5
-
Filesize
5.9MB
MD52642ad4e1a432cf245ca8e9a687fef28
SHA1473a92aafc2bcc73f89ad2dffe09e3b813fac3cc
SHA2562f8d34d51ec26f25e002a1bd773fc3f239a0863f54307dcd957a5844600c74f0
SHA51257a4b2c03e0309f2daffed2536e9d140020913fe82db754bc3cbb2c41c2afd96bb0675057eab409fca182747137c1b438d3425255f1d863ce947f7420419cfaf
-
Filesize
5.9MB
MD58362e3c2ab503066796477e2d4c59592
SHA10a8db7350dd0c0d27860c3bb3f6f877223a9f8d1
SHA2561bdc667cd7c06d636da464ffd1915ce56c932374ca0bd7633c96ba937b03aee9
SHA512d29d0c33a872b2bbcf1658fabf4bebd8983b8e3d4920040b0a144bd0d519a565f09a42b7102a0393e6d2c86c449e159e17a7a23f806bba934bbe052c8405e8bb
-
Filesize
5.9MB
MD5d81fb682a70bb72f8e34955a8060d0a9
SHA19970eaf4a8270588a4b7d6d0f83e7fcd9324caf1
SHA25672de958b4d8c9ad5b44d8b1a55f54b56796729403dc65355c87b582a983c97be
SHA512b959a47d2a1917b632e592ae1988e6fdde85769f419c76615f3c40ae963b25cfa141d5d4edc7febe474aeaf51fea5be6c577b149784ed30ff2bf8cc1d4fc4fa6
-
Filesize
5.9MB
MD55c10cd89a5c16fa89011af71f4cdf30c
SHA11e76d4a7154f46db465dd2aa0d176f56a5b8cd11
SHA256fe3875e8418c382e6bc488b9b85bf199f1dabde68fb883e14e16795a27ad0793
SHA512bbdda8dd50f1174e5dd4e4c3132915fe13e95ac6a5a734e2177944cb95a15beb2b57ecfc3deb3a1015e82b79bd0c5cadd396b3de00851b235b959fd37f3da042
-
Filesize
5.9MB
MD5de5f078e677f6ad8669d39ea9ec01157
SHA1796a623539ef44e94f7d68fafe99e470cf9aafb2
SHA256d8949a0a80fca9cda9df2168e74e8abbb156b1011a475672c184e56ace6c925c
SHA512168b2db4216237a97769b12bb2b0a18147efd74b9b5fd393b3bc204dabd56c5bcb118858eb4edf3ac53caa8736b11f5bb80fb0c3db57de118326502f4321ab1a
-
Filesize
5.9MB
MD5dd578c2566ceb91b7b833640f25e4c24
SHA19568540a080afd620c06ed5d006c138af8748957
SHA2567c8f9769c560a586d854ae28ca04df72fc6a5a8af2a6d4ba422441ef4d3c0320
SHA512813c0f186a66208ecc5b6841302c0d3d22e6bee1ba98eee9f68da9788e390907279e41bdfaa4e58f0ba5d388b877d8bb2c37e1f7a93b91727c357b78a66758e2
-
Filesize
5.9MB
MD51d8322148f196d1133bcf86ccd305c7e
SHA1493699691eddf1d4dee6fb8fc228dfe0c8d34230
SHA256384875043912d75276b5a9cebae6ed139eae8ff1599c4f7de93f53b0f3d4fdff
SHA51287318bff71def8737d91f164f9cdd05efb7f0745359a9959be98c81ee6c2cd0ecde4d8c34dacf270772bc52a5b710775dbb6c1c618834d4cfb41546b86306d60
-
Filesize
5.9MB
MD518771f76447c5401bfec36dcebb8bb8a
SHA16e6dcb99682306322f31850c4029c487d8e93d05
SHA256356dfbc0933b1a302c299b77183e944b9c4264edf86384573b63a64ca827ffc1
SHA51221df726729cbe8aa0622d3c5112cbfeffedef7f4e8b6b8582115ac654551ddbed948adaced638eaf5a9a7264fabffc5b84937296381e9ccb64a9a938945052ca
-
Filesize
5.9MB
MD5d5dbd80e19eeb5aa927c88a47c619e19
SHA11394e0767015804547e1ebdcf08b512ef6e4bd99
SHA25631eb473fae3d84c84f75bc614210ed1f6e602a89557c16c45a698cdb661da4ff
SHA5126a164632f3617c8b3a33629f0e19066c979f3605b3d79b92b99b01717279b86bb0705db972dce6381138e7f91e9abf83064e6f37e8e03bdb31bf933fbc168295
-
Filesize
5.9MB
MD554a461d8ff62bedfc91b7ecb5159c9d2
SHA1c481f0875a708711db98f6f368ad4a732d4506d5
SHA256289b42cce8c148e1acf485370f103930f89d4e465b6aae5ca8f2f245e57ebd5e
SHA51216817dc3f4c882d41e60b15ee2fb638cebfde4712ffde6e3928e19b0bb47f4e1f6b357d6f2e711c7f545090cf039e93065d759e11219d4f947b6d6035024a151
-
Filesize
5.9MB
MD5d609a06d109d9b2017be1f9799a23feb
SHA13c0f4c7d31dea86208e06c4862847662c4f85b04
SHA25621d7cf2d39958ad98083fb996c108a57f98d31903879c619d050ffe33ad3e51b
SHA51253adb84565d7d486001ea28f43f04e7d81fdc58f95eb52735edcdf341bac5188dfcb548080523aed6837acca81705943a694ac875653e044eb30352f36701b9a
-
Filesize
5.9MB
MD5a544e545336dc9cb86af784652ad9d46
SHA118501fc59520d9b5518f9a3ecc15ab130c27c6ea
SHA25671d4f44e092fc3293e73ef0091e4f318f015a904a3b8580240a86131954b0b77
SHA512598dd53b4263cff822450e83128b8fda25ee43b39c479fc851f7c59da5d3782c2eca3dbf15cbe0aa8ad20873ba250afdfa6eab43614c9cd155ec6f01d7b951c5
-
Filesize
5.9MB
MD5b7015bae57e7abf88e3127f693cab88c
SHA19c37ee3a4c94ece794804b58ae27634bebe2732f
SHA256005140aef5c4e584d52909779d1b0f0030ac82b125cd2e48ef4cc65f4b3a2bc6
SHA512405285cbf1f15935a40d989af846ef79e4489bde3a6f573f0e66271895d5fc71c62f4f530c1d88682e69f87e9c0f5047f864d5e6158423e3cb9a2cbefa4054ca
-
Filesize
5.9MB
MD59b5705175dabf23c013c495e07acd61e
SHA11a47657d825d8bad21358df7852ae318e5640290
SHA2566992a27cdea6ad7d0b4cb714bc930e438e921affa13d16705f7bdccaf5e24129
SHA512bd018552d8e24f879ab4a16c26e4ce37ef6f8561452064be89b4c548d9a84d808dea627656541fc00c3212de91174266d739381dc0b63fe06f00e8529a20d2a0
-
Filesize
5.9MB
MD57ebd827e831befe29fca1301e64c49e4
SHA17bf6ab8a033613aded35f4735139905baa86df1b
SHA256140c1f8e32e4c17c1ea28c2dd6722114523e0bd7b411256f020a5ccaec4fe98f
SHA512746cd070a91d38aa888248ee9ced4eae3c185cee4bc26d0b56d852a1730b26ea2a6f2590bf3f7be9635d03d233a9f62bb279bf001cce99950fb9cb1c93f37722
-
Filesize
5.9MB
MD53cf0228cc5671e9195863d23b9a5397a
SHA136ade25ec507e19464cc077bfd3499ebfa0fb07e
SHA256f31d119729efbe095943c897a20a51294d356379ba0252cbed3c55d21fe99596
SHA512b052195f724d358a9ba3bf3f7619184edc83c246414606eef42914086ab89ad91d1c7fc9a2967e5c463384f4373b75504fcb9db1e908dc76af078dd009837898
-
Filesize
5.9MB
MD57256c48ede210cefc8d72af6638695b3
SHA1787984b3125a7cbf8e353839e50db1d6856c9f25
SHA25643a34c3e19dc43c75647784c82c1f85625d68206429b5dec2370427ac56edebd
SHA512f87a9c306648d17ab9ffe12c5c29e55bcfd3cf97c1ca3dbc6929b2e8b623bd68991a16b39d5a60d6bad4243fb6f9527289893c62c4b778075b1ec4c695e4a855
-
Filesize
5.9MB
MD5271d795c49e68007172dddb991126ea8
SHA1adbe30ee06bfe6a82379f7744516460827ade713
SHA2561fb2c5e6ac863da99c65a98244ed3e44b4000c0f3a8c41bbcf2933f7d4669ce8
SHA5128ce3fc2055b4621ce3d213479cc8a01a03f775369afc5f548f53f61291b26062180dcf1fc95c70d225eb7b3cb1aafa6cbe90506ac4206551bafb62f5721735a1
-
Filesize
5.9MB
MD530eb2f3a3dcc015c7ea457acb7b52e00
SHA18d70a346597cb82f4110deb4614e4893095124de
SHA256acdf2f4ca1a81470463f04560cbe3e5dd6c8c335fa73940e7d0f79d55b1b23eb
SHA5128ac394ed66bcb0b977c99abe18b5d7ff0951ec78fe46b98f8cb195146c8b6fc890cb9a0cabf2a389319410667276508685f46818202cde68e2b58211f17434f2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB