Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
17-08-2024 01:26
General
-
Target
2024-08-17_75e7bedae148d8297ba3f8081c053d7a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
75e7bedae148d8297ba3f8081c053d7a
-
SHA1
ac33c851934d0455410d5b30b41d54507b0ae45a
-
SHA256
9961bfcb4fcfb8968b9e8b3b81b9e5a9e3ae038e377f5d47baeb5edb6db6059b
-
SHA512
e4ddc3dab0982b46071aa90e36a9a01993f5ca0bd22d2fef4a99c1aed25974e745819a3e78f4646c4900a5769213c3c650ed48b1687babed29ec0bed841eeb1e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-17_75e7bedae148d8297ba3f8081c053d7a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-17_75e7bedae148d8297ba3f8081c053d7a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kfEOktj.exeC:\Windows\System\kfEOktj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yPjJXIv.exeC:\Windows\System\yPjJXIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GasEGIy.exeC:\Windows\System\GasEGIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RIEnwKl.exeC:\Windows\System\RIEnwKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByoIpTb.exeC:\Windows\System\ByoIpTb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iutiLaj.exeC:\Windows\System\iutiLaj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARexlAW.exeC:\Windows\System\ARexlAW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOnrnBh.exeC:\Windows\System\dOnrnBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygXPxXC.exeC:\Windows\System\ygXPxXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrOdxlf.exeC:\Windows\System\LrOdxlf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QLKkojj.exeC:\Windows\System\QLKkojj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\moVDgVQ.exeC:\Windows\System\moVDgVQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvWgjgx.exeC:\Windows\System\lvWgjgx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqpJVcJ.exeC:\Windows\System\PqpJVcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TOYkSiJ.exeC:\Windows\System\TOYkSiJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\actsrpB.exeC:\Windows\System\actsrpB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhsqyFx.exeC:\Windows\System\RhsqyFx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CvZviER.exeC:\Windows\System\CvZviER.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pilsffc.exeC:\Windows\System\pilsffc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MhkCJDX.exeC:\Windows\System\MhkCJDX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RjvfBrO.exeC:\Windows\System\RjvfBrO.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD577f11123388f226e677e91251c97e851
SHA12dcfb6f4460a4216354aa354d302255ff495897e
SHA2565c5520f32e9f5f4c4df51e8fda6782ee3e842d1331d3b3dfe139db5461d63516
SHA5120156fe15689e899c204d4f7c959c45fea4eadfe6f2495e4766da85c41d09cd4b5aa9ca5d1305c7217a2cfb439a9ca760940484912a84dc222c49be6b24437bce
-
Filesize
5.2MB
MD56991ea69ba443d84a3bfec351ebc42b9
SHA1a62e1f3771bb45e8dc52c5e297fcdc8a7ee29bbe
SHA256fb4174332eff05b8126c85f645676b0689f3c0abaa921cf88ae27e2f4ed476ed
SHA512f1ad9870d13f4f4bd3f892873a2f45e78c889acce15d823eed7147f835412f23cbfd4a19786ecb75f66e0e129b806661cbde060db30e78f24cdf169e953a593a
-
Filesize
5.2MB
MD5d9e0d716567e4562b30573a17769a961
SHA1a8a3a581a740fe9158b09992e5ea14f7bb7430e8
SHA256825b20ad8cabad1ec79650a166ffeda84c927f5f7fbca53e2ae20e3451fda7e8
SHA512718d2eb521581669db006e7cf03c32b04804ee88bf07ecc330b00f1cc6d7bc1dd8a64a830fee71d463bda05bbd0a360ff889ca8250ea7e50752239c969d5ca81
-
Filesize
5.2MB
MD59f035e46e6c8e92356d6d680f61690f5
SHA1c61eaa7144415af22c41c7ad7f6a11fddecd5173
SHA25635b6f3b5cd3aa1e680ea89dbd79aa3fd8d329c76afa87e130709208ef2a425b7
SHA5123a453bb4ed017be67d3186d06422c52c4aeb50887fd1cb3778f694971cd1d0f5a3a85e17482b1b74c635f0ffc823ea4032701aa7e3a385f7ed3b8406d751d57d
-
Filesize
5.2MB
MD57ff5d108e5e5bad30d733d7d0d730208
SHA169712aa8a162b33c76a651688808bbfc088f7266
SHA256c5c113f5cc1d1a228240455be668868e43eacf49dd1e8f59fd89f5f2b1816495
SHA512670674478efc5335278d7c96049e0776475fb9ded25548d24311eb2c956e01ede77e057d691f43302817c6532bfb27aa06334c0cfc6e3aece588fb064ec752c2
-
Filesize
5.2MB
MD57bfca34e12d983cd9e74021ccc29dc03
SHA1676f63d5703c368aa9b5dc0910b077d8c506c97c
SHA256bf42ea08fa0049e74d96579e7433588624723363fb1f22e4c26fc3e9fefa504f
SHA51289e900ab96de0856e28dd4c88ef1278aef6bc369e6076a214a6c9098f37ad11264a1e64507a05d6019ea3aff8963ebabe5e7b013af7d2ca980cde6fe4616965e
-
Filesize
5.2MB
MD51c4639cf984d7c77facfe650f7d8f6e5
SHA15687c4fe78d0370a15d3983ea74fb5e29eb7ecb7
SHA25647a34d7ae2a02d33f7889ab930c50a35f44e4bca31d53c35f8afb7a648c59e74
SHA512ae231b49b7585283b2751a9cbf48e24355d43aa0377ace7f844fe50d545371e8bc08bde0cdde6e9bb66b6bf7d2fe377819292ab29e42f158440d1b0df3189632
-
Filesize
5.2MB
MD59ac5aa0d7dfe9df335b1c9bcf98557c2
SHA18c47f99f5f6fe7f4cede844ef190599cb360e16f
SHA2567a14b35967a15c01f4ee45e5cf5dfbf729a58348e819653ba7f8f81933d8e1a9
SHA512ff6c67abba37428126c24a54e7e413e58443daa68aa25fc180f6eef3ae58995549596203b2e80b252eeb984c7296697bd3f265d123adb7c79b0d512d2d08919d
-
Filesize
5.2MB
MD5c46ef41ead07f47f644fbf985fb01ac5
SHA140f3dcdb8c7e866a9ab66f82b513249782b9bd8d
SHA256a47fe62559e5b4bc004ceb31474ca47c664bb29c08f9923200682d4a88840588
SHA512fbafbedce622bbf6a4c6f93b76417f0c0718d2ea0bec110fd70c137fce458912dc8589e4f2721bd88f1cf5ebd7cdf8d834993bec61f0e31a5cd88fc4b1805c2c
-
Filesize
5.2MB
MD50f9ef2b79c2d68d4def915a5a8f996a7
SHA110c5347dc1e256ee523fc3db531fe436907ce72b
SHA256e2d571ae52ce9564bcb9976824ffad7f01747a0793c27a02dd4fc920e38b7aee
SHA512fd9a0c11d42469ee40cf93ac3245f421f7464b80e54497ff707ff5d5915609d5263237ad5951b6b8db6a35fd0d3aeae409cfa0add38c19fa4ece71d530c83008
-
Filesize
5.2MB
MD5ae35b77a3a7df79ec33416becb035adf
SHA1b0e8d4c52681d07e40d6fb2142f53919019b3472
SHA2566950eeddf8719a740b0a2c399ed2034a4141674c66b36348c5bbe533277f5554
SHA5120249fabf13303494234d75f45feed79e45971b93f42b4506b0acd75321950cabc3c4832bfb552cb97975da65e0622682042cf1ba99a44e1f53ba53057afe2b97
-
Filesize
5.2MB
MD5950808fcdceafd7f77c5921019123636
SHA1cfe83c6305304c15debabd09d69ec41093b4aa91
SHA256859c0efb7d7f361af112eec5a1f86b65ce0d1a6042069b4e9c4d6164993b71d9
SHA5120b691c36d841ae4dd6f439202dfd107bcbead9c22bcb8722c00493b34a456436f8ddaac5e8794f2c0b3f78ee78425473faab3e67ca9e5b0ed8156590a8021771
-
Filesize
5.2MB
MD5190a0be016c87d4e13a51fd6be4c7f11
SHA1e5f041548f2ca5906afca8a3c83fbc90180b794c
SHA25659a021d58ed47fa8e8b89cfbf2fa8f8ff1ffeddeec8424ac215731344c2eda3f
SHA512fbdb4d7c34e8f0c45e39d90b42c406dbd97010a10c835e6181e19da31d995d6356ba62778e78f8e5816b35ea67b46c34d5d83c695c5b1fb1d4f9a8ed7b2a77cb
-
Filesize
5.2MB
MD5456bf1a20741239dab7f5a35f9847fb1
SHA1bc8deaa3321d67837502b90c012ad80960397ffe
SHA2565d335b1bac381a0ab449e5af01397b6dc081103becbd6b51acf9151562c62830
SHA5123dc0a49a7546089b5fb6881bb9eb660fac3ff9d110d9454566d49031e7d9e1a4ade808dc9fb1ce7a378f2d1af7098ebe04948c95acc41f28b2ce1485f79e1129
-
Filesize
5.2MB
MD53b67b4bbc237ab683074d74119a5ea31
SHA1d76b3bde1b34ba7e3a2ab896ef2f830aa3055ec8
SHA256818f32e0eb4ac739e040e724db1ce32373ff7de2257263586a30f55e4b7cf488
SHA5122f707a205a9936a2975bb7830b6ecc69b729377233fac43b27a327cfe9d9304e9fddb1428851530fab84f5205a4227fd6c352e4b04d8a09ef354b41e749ece8a
-
Filesize
5.2MB
MD5ae7f29e2acea02b52142bf6c3183cb8c
SHA188ac7fd572af9bfe1fce35165f7227e748f2e342
SHA2560b2b9c5af0c4015c3402f53f40a139f74791f99029247d96f170314dca72f770
SHA5127cf2bb0e49eb2e38a3505a00471028e1daf8352159f5746eaa72850aca5c7123f7023f19006c99906eecd3c173faca89fc6c358ef233eea7ff5c8b03e741e87e
-
Filesize
5.2MB
MD560b2669b7c852f3ec461e6a384472f8e
SHA1c434d3e5e8894c44db9eadddd8bc71463fb1d1d2
SHA2568d4441fcc687dd81d7da7f9f7314087662f290685840af34885eebb9c96b6bb4
SHA512b266eb95e051de398c90b57b422faf891f846516703e09b0a901e035c5ad40a6aed656a5f212fb0fbb1efb9d6be2ccf46a4b92b57bca78f0768e9239e587026c
-
Filesize
5.2MB
MD57c30055674670466eb196a1ba66ff987
SHA10fc611a586fcc193535c6d01a1e9c28ac3064728
SHA256d3845a8615b0e9340481ade988e873f3994e4b684385c95af7d070773d8200ab
SHA5128cba18c1ce8f7a15adb6eaf3bbc7403eea29799eb018e2dc9de4d98cdc17ad05c9200c9401d795adc47abbe36f554f49e751ecd0e34f92de113bb43428aa49a1
-
Filesize
5.2MB
MD527f8a8a01e7366bb63178d2e3ca16885
SHA1c94c0fe9647a8fac1f417597e6a514fa946d73ef
SHA256d40214eead0b37a4f8e860b8c51afbe795a64b79e48713f05fa0fad813f35588
SHA512722cf716444f9bfc486d6351e8b446d9092d26b35b5ec7e601a2d0f5033767231f6faf7a36d4da066f938a046a7284246c94046770f4ca4a7909fdd8f7949fb2
-
Filesize
5.2MB
MD559e736e3ed826949f413711030175c23
SHA1ed6e3127dbaa9e653179d77354097adc9731cf33
SHA2564a31e5dd0d2c2fbba9bc03a464168bfc6483e731a610f672a24f5614ab1e517f
SHA5126c55360b6d2c0fad983483920b2a7f743e278329bc49600ee7e2292806624c12db1e4d7d56ba4a94f0c9165caa06bffd2fc80c07188ca653ed7cf76bd24b09e0
-
Filesize
5.2MB
MD5cdd18adbb747d27e570853217e908a87
SHA1967b72daa6b680d06c539d4fe8d6582c15062062
SHA256c290d054ae9dec0897f23826d77ebdb73189c5217f9e6a4cb3d3e569ccbcc569
SHA51246d80e4bf1f97473655d7bb0f1e8e1b0a17a66a9234a251811f3937ea986c222abb01ae7d29703979fcc9221398be3daf16a8f204a76231d602c5e39887a20aa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB