Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
16-08-2024 20:43
General
-
Target
2024-08-16_a449c83130a1505a337a157afc4da708_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a449c83130a1505a337a157afc4da708
-
SHA1
44af5d25afe8a2977f81264cf945f7e6dbcbd78a
-
SHA256
df17a08107b5f84c2ac99ad187bdbe1037d365f7b7d2dd376767596cd832ddf8
-
SHA512
538fd193b8bf21e802e4db266aa39fb41624d4f873b46724b07bb4ed64e19eb767597c419ff6ac8349ce41ed71671f92880e3c2286be56eaa17025c0155e4d7d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-16_a449c83130a1505a337a157afc4da708_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-16_a449c83130a1505a337a157afc4da708_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sxLrlFv.exeC:\Windows\System\sxLrlFv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCwcZJB.exeC:\Windows\System\XCwcZJB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJUJVLX.exeC:\Windows\System\SJUJVLX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RObAZnv.exeC:\Windows\System\RObAZnv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GtbJXus.exeC:\Windows\System\GtbJXus.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\drePnpO.exeC:\Windows\System\drePnpO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUNcdHs.exeC:\Windows\System\BUNcdHs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rKtUeXc.exeC:\Windows\System\rKtUeXc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wRdFCuU.exeC:\Windows\System\wRdFCuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmkrFkl.exeC:\Windows\System\bmkrFkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sPITuPN.exeC:\Windows\System\sPITuPN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VaQMHCi.exeC:\Windows\System\VaQMHCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JwKGlPC.exeC:\Windows\System\JwKGlPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NFwtOHB.exeC:\Windows\System\NFwtOHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LsPRlMN.exeC:\Windows\System\LsPRlMN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MASNMUJ.exeC:\Windows\System\MASNMUJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dKWBlkN.exeC:\Windows\System\dKWBlkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVEcLSS.exeC:\Windows\System\iVEcLSS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TQyqEkl.exeC:\Windows\System\TQyqEkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bzUoKun.exeC:\Windows\System\bzUoKun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfbWSXT.exeC:\Windows\System\QfbWSXT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f7fb203d5c9024d42b8c3139954551ab
SHA1d60623657545ce2b6bdc21548498d03b7d73d645
SHA256ab0cb1b37407ec613eda64e1a5dbb620f99f22bebae5b5b00127b964a270b46b
SHA5122ddcdd991c228829b985d31cc6534a3e785821bbb15ed5b576686207da5281846d708ff6d48065b3fe8598514c2d25280262b66242febf281dff8690a282456c
-
Filesize
5.2MB
MD590e3eb41254658637270a7d6b85de9d6
SHA1dfc7ccd2610b23840a636728d60dc22c47015c5a
SHA256b49916567c85e9802d83091f56773e7d276bd2e72d97d934f867ea1bbc872f98
SHA512212e5efc9da499d9cda46cc290c3e6a257b70fad57ec440f82dafdbedbc569d89e03a0b2087a401d6616becd20a62de8755919ee5629bce6c7b4c5861285cb8d
-
Filesize
5.2MB
MD5103d1b3a635b56cd86b1355c92d422ce
SHA1f54a81bac13981bc807968b32e626a961e5a04ec
SHA2567160ee4e26ce345f105d5087fc806a61dfcd3a33bef2ac1ff68b15c3ba95be7c
SHA512c27ee52b82833c20beaefe7bfb0885582a5e19f8a52d40e40b808b56db97575fb10a2fd19936cbc402093daad5038d35a0d763f2533bce95b069d01c0125b61a
-
Filesize
5.2MB
MD50af455725aa609ce470a119720c6abaf
SHA15cb93e8e765a0c6a4b6a5c9bf18a637ef0e4b4af
SHA2561956e68997accf91958d37ee70d06971bb410b001a2602c0dc962b38f0ac4447
SHA5129bb44edafbc2e415cc94e6f6151ea927a422edb8151468be4fcf95af2be932813d07385414839a60721b984fb00f2920ab637c47a3b6cfb183f1cd21275ff778
-
Filesize
5.2MB
MD540fb94d886b3ff77b7b45c825dcc5d3d
SHA1c6170d56317a13485a20a7e9dd502b564b7fd63c
SHA2563fa57820624443f2e1a64bd46d664e17bbc8f8484db535e62332238594348a3e
SHA51235c1526b971166d65cff43efcd1bf9838fcd4311206f20f3b24f476202edb812916635ccf4528c4a1b0c3d221ccafede4faf878c5241502243e162c4bfaf22f0
-
Filesize
5.2MB
MD5a8512826e9c0013f8dba4304c9ada66a
SHA1e7788f693e4c9d15fc027134a465524549662ffd
SHA256966cd5d75ed741033704da9447fc14e624937cc090ee8e8c81d3da4cd71cece1
SHA51221e9b19c4126899ba32dc35fbe6592999bcfff5c49157bc5d2147ed5a00a785ab518dd5df1b41f1487bddc1e6c0e6abaddeadb6b8fdf925119f6c13eabc9e75d
-
Filesize
5.2MB
MD594dde20fafd769d25c42c6ba152018b7
SHA1af10cd245fb2ba2854803d227bddc2acd4695782
SHA25653af74f778f3b07f37e470884e925d97d0063f723b18c844033f53d0aac968d4
SHA5127a46d7e232a205a551810cd7f262da21b950542056ce18bb4ed729cfcf7384b1b3326fcd46615e596b7cb9733233ae977cd877b577e580b9b39f6a0c2796332f
-
Filesize
5.2MB
MD5df236f17d2e0a4e0181c9e9319b3ad77
SHA1f7e35e59864b2918dcfa097bbba87b4af0da84cc
SHA2569803e6fdbc837f60cb076aabbfb4e85009eb2de016831be95e840849f944b910
SHA512316767d0f841a15b93329c17520f258ebc6668d4e5212aa3f949525e054f96f5ec08a79b8cf521853eb6a4fbd98b62441640067774c4c7121adf45142f608d3d
-
Filesize
5.2MB
MD5911a5cc96adca1f5f23bd0fe75078ae8
SHA1358a13b160064166ad2c79cc4fc2286c4c830b66
SHA256abce714cc6cba28f510332c5e8fc95d6d55fa1815a44f439eda0636b9ab911ca
SHA512166c2fe8b637f6e38dabbd7c2323aef0496d2d97023d9377de5a4c0bcbd51bcb47009481a46f3cb1779f74179588abc63b0f5e61bdaecfa5a6decef5ba21c5d3
-
Filesize
5.2MB
MD5e970f112479713b387d1060e2256b3b8
SHA1237d216c267f8d4ee80069623308f65ce8f567e3
SHA2567e52b356497fc8383bfd2184133dc74cabde5cd45e214911298947748af901bd
SHA512ce3326e6f216ec5ded053a712ccc8433d9e1c5a9c8a3c6723f030eff6c91d343559db24a5163a9074967b215c2e67740485164cd8987b7e0bffaf1e1c8c8f095
-
Filesize
5.2MB
MD57612611983a82592aa94ad07ee79633c
SHA134a97fc45ae3608af455a7874c44f37dfb4028d6
SHA256cee05e4c994872ee0d984d4ae060d234dd7f3a5215c061a69eec0fe7955fbc5c
SHA5129422a701a91b1c5e4b94e216f74ccc6afe0a8e772069f036e097b817db4d15f9b9a779bb767859369dab32f450ad4938f43ba9a0d246ff54055008b0b0b08245
-
Filesize
5.2MB
MD5b5d153357a290b31dbf2970f34a275dc
SHA1c47b74206be87de5f80736bdab123cf0dce0ce57
SHA2560d87defd94a8b9ad4f198742f4c9557822ffc1b0099d0e71591ea5377d8ebc17
SHA51264646fc33a3b2aed18f12e8ccab95f1adde9f4859fa881720a08fa60103a1d5a2d2eb7e0807e8289cacc4f6fcc46fca4ead8cdb1567b90b835e7e15f57570c6c
-
Filesize
5.2MB
MD5630ecfa88ab9e4ef515757d31e58de53
SHA19b72d80bf447d58478597d8391d6f4e57a7b6465
SHA25651e14aa831622577f49400cc33de8839e26ac86199415691d3588b1e77df1e05
SHA512715f3f3c6f62a655066bbd018fca0156f88654b58f6107bc14445d6646c5501010412b2b427f6a3da2378d3fd34dcd50265310e63cd995bfcd0a353164113962
-
Filesize
5.2MB
MD55e203caca8e0d1564153dd542a3c0a75
SHA1e5324e5c5783b0f7331959ba9e8c007762151266
SHA2562c564130b0574fa7a9fd7bd47660bf8ea1a9e0759e6fec75b8522bd02f88c8b8
SHA512911eddaa040fd669daf639182a12dd79199633b56f0f012c9c3a8c6a38fa72f8f544354abbf5c815d177dcbf07e8b98f87579d19232d02c31b19db320983c41c
-
Filesize
5.2MB
MD54c1561a72f32ed8ec42bf45bb9b7c94f
SHA15c66f5e1740587c54703825487612931926fb245
SHA256488343c763fc90528b0620161c1152189c3ed613a1a469b257dfae120e02dd04
SHA5129066c08037d4726e63c389349c496ceab5f1fa74175db1d17e7d4bceba61167cda4c88ae7948c00d05ae3971214a509369eef442d8da8352f449c0925c323557
-
Filesize
5.2MB
MD5ab175e091b8610f059626ff3834e79ee
SHA1d53fefd234f0595280cb5e238a5142b092612299
SHA256c965ddeaa24543bd7b9d8d524a072cf2438135011d08a1e7dcd6c00d22ab5383
SHA5123325235483b74cdc59ae679d62c52b39d12ae41880a0d51412e3d7aa4d7f13c60c9e9a2248b401a7f40d7b53b8bbc4cb973dcd393264200fdadb8ae25429a249
-
Filesize
5.2MB
MD5bbf61049d9afeb88c44bf247ce3d019c
SHA1aa5bb5d2ca22e5f771329da00d87dcee5188113f
SHA256383dbd6392f7bead0dc5900766d5506df638b4c8a9ce6d678a4496634162ad52
SHA5121b9d54769d6b2598d51970516925d08d8ffd3d94b8be42db1ebc4ba00da2d90b0747665463394ae8995bd7393c20ba6683cff95d5b1b393cae4e40ceb336ed3a
-
Filesize
5.2MB
MD534fc199742d199c8939a5a620af0bb0d
SHA16adb318d86c496c34d3e49539ac3f3e7d719e5de
SHA2560fd79a18085d9ce33ee2b00c7caff2a56b096c92a9d5df6af2587623cc9521be
SHA512043ed07ebb77bfbefb62d0fb5f08b1e6a57a3c6c43df3b340e8c1b00be032ecfa455e7f55f59370ed5cf449ede1e2b92c335cafe4fd339a48840628736b44ac6
-
Filesize
5.2MB
MD5c858e0499150551ba74a0b5facc03d71
SHA19306008a681ef8ec0c243b49221061debb39d161
SHA256a736c5ad43592dd7d935b1bd5338bdcededf76f54ebb869d07ea1f9069423315
SHA5129e925950ca00e5d92386838cb0e84f5604a00f6cd66dae18b1ee84fdcd2257ad3ade4992c36d9ccd45df63a319644544d7049a8d4ba128474be00807633f99d5
-
Filesize
5.2MB
MD5dbddb6cf56dbb26bb2afe6a9daa6e8fd
SHA128c7735efc7ee1c518e86165a85c8cdef7b455ec
SHA25666d9ec1d8a96f71ca3c6ecf02cbaef24d56d0e9182aa2f9aee7a43e77aa5b90c
SHA5120f430ef2517dc10bc3447dfd92a28de44406cff1c17a0059fcebe349d712d8303d2c076a2359fb356fc85e854d9125a2977890cfe0d369fa439560c05ae72221
-
Filesize
5.2MB
MD5b56b7425e81bc71ea1d246654cba06d0
SHA12b8b17843bffcbd1051dc5d40340368456251d79
SHA256f06570aa8af56875df42712e130b14d777f7d555295367930df5b2a1e6043d73
SHA5124defdc032f2d7a0d8b41ceeecb3135568cbea91a4dca57087bbff02bcba726d4baa0a703934d1dcc82e9c8c1bf9beaf3a9539a8ba7bf5e5792289a560eff9be2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB