Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/08/2024, 14:35
General
-
Target
2024-08-18_a8906e6b789ed395a4bde3f0d7e06590_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a8906e6b789ed395a4bde3f0d7e06590
-
SHA1
f0825df64b10e57a0d438deb170b186061d07e62
-
SHA256
dc4378994fa084346aed82ad5f75ae2ee8e1131d67daf86bf3b83d35a0c3b063
-
SHA512
81b77f7227b84aaca6084f2467500ee6821184fcaefa4659324d58905172339ac3832a263f788a3282b267ca1801dd7d6cc59f54e85993b1a1912df58d73c539
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-18_a8906e6b789ed395a4bde3f0d7e06590_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-18_a8906e6b789ed395a4bde3f0d7e06590_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xUBNVDa.exeC:\Windows\System\xUBNVDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KuiPwdb.exeC:\Windows\System\KuiPwdb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZCxthD.exeC:\Windows\System\vZCxthD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cavOukh.exeC:\Windows\System\cavOukh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcdFXAj.exeC:\Windows\System\kcdFXAj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HbKfLhv.exeC:\Windows\System\HbKfLhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRDYVTo.exeC:\Windows\System\QRDYVTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vLwKAAh.exeC:\Windows\System\vLwKAAh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JHlcIam.exeC:\Windows\System\JHlcIam.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iifQGOG.exeC:\Windows\System\iifQGOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHaVXqq.exeC:\Windows\System\hHaVXqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XsFIkMJ.exeC:\Windows\System\XsFIkMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVFqxCV.exeC:\Windows\System\AVFqxCV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XCPGcRo.exeC:\Windows\System\XCPGcRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HCQEhDT.exeC:\Windows\System\HCQEhDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcFqLKc.exeC:\Windows\System\GcFqLKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvWxmyL.exeC:\Windows\System\hvWxmyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JsxrKzS.exeC:\Windows\System\JsxrKzS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tEXaVXT.exeC:\Windows\System\tEXaVXT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrBgatz.exeC:\Windows\System\lrBgatz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhsOWoT.exeC:\Windows\System\nhsOWoT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57bf977225e7d46c19f2c2a0b9ca79e7a
SHA13dee46166e0ac7682dfcdd0a8cf503d1116b4f74
SHA25699290915992b5f091274011e7341fac36ede5c725b0317eb823d51595ff038e2
SHA512e10b28abc497d8637c0303af2f70b27f912a5b698f3a9a7b8e027ad577dcf9936733035baeab95c20704b54fd66809b862ff7a6bb7aa393c0fa51e16d30f31b3
-
Filesize
5.2MB
MD514467592f79a77ee1217d3d9c29cc255
SHA11b922baa6a2c49a77cff9c32986b96d308f91bab
SHA25654af10b0e9ae3544500141e36daa732cc1e443baa98d25b98ba618e161baa3b1
SHA5127cc9351e64d1265199e59d0045dcc825b65e1972efa868ce38cdf85dcf7d142c3c7f72251cec4a4a6e7f2d6b1800e95ec4616723c1367509230b54e5774840cc
-
Filesize
5.2MB
MD5ac4536b607a8b9b1af41e8b71b6162e5
SHA183e4a309f0981cb5dfb21dcd90906d13173e2eb9
SHA256e01ef8b0d6bdc0632fa51d290a3fa712f9fbaf822b73879bac40b2a1a3ec69b7
SHA5124a511f685458a1a913f7aaaf67d2c6b2c3f8af4ee00bb3a709f12ab7056d40a2a22ae1c0dd11d087c06e81afc2e946415329b4895f4157e11c0d2e0b03a3c689
-
Filesize
5.2MB
MD52616ab68c5af5f87d4d575c8b85b20fc
SHA135416eccb7b473ce0ae885862de4683cd5eb032b
SHA256255e5070723903b3a4bb48ac0143496430f141cc5754632b8ab45a035a310109
SHA512f2dbabe4bfd5261262df1cf56eaf1b35438ac7fceb08b3b7eee0bba49c776347cfa94dbdaad8158978d339fbda7d62e592f3bd1237b7c6adf4ed3fe1e29cd9db
-
Filesize
5.2MB
MD5afba854f945b4f6ddb71c7e43339f884
SHA11fda945410fb53b400e2c3087a25f95314a28a97
SHA25601329d15c70b573cba610659af2b07e74b299cdeef01dcf81bdfe3f67cfb462a
SHA512e75792cbc6b6671de625b1d6973efd5be2fc0049e4fb262d3bf540ddfb67101a74c2e8f44229cf2c1eb9a2b433b2b3428d9e72cd4a67d684769b626e39dd5dcd
-
Filesize
5.2MB
MD57082e78200f4153b08cbc3f420ed3574
SHA1a40ae7900cc1f58bd16fd867dcc73f982159fb64
SHA2567f2a1f4f24c5d660ae293ecdf88f6e18e35472a8c35bcf4f953f843c959a2025
SHA512042beacf2c837a1c87df9ce5a7ceaad40a147418825da83f17b4168380e5c698dca8b7491626f0f0f4660b2848a00968d21041bcafa217fa33572ac7d9332af0
-
Filesize
5.2MB
MD52ea55b96e22e4f8d98a5a8584dac554f
SHA1aecf5cc48d3ed4d0476589a4bb2d70822ed97ea9
SHA256383c368746f897099629574f681c6d1b5c66f88997459f05e42d0d71ef7c3c45
SHA512eb9ff618ca92ce5653efd8c912d39ec85c4dc5d2cdca21f9221f1d4aa1221c2bc64235a11b0fa37c96150fd029f986e01eadbe2f24a2503ad1444e9cc5f53d07
-
Filesize
5.2MB
MD5d5b928bc98521aaf71bbf3c51aa62171
SHA1c0d1d76f80032c8bf776b24fbd6b1ed888af06dd
SHA2567624303f036be299438b69b60d561a6246812d781e4c0403146b360a2ad6ff2b
SHA51247e47d4963e3ed30d03b9732fbec9f7b046adf03036b854670622562a9cc5b831dc53e6455ebc0bd3bcf6b51d124c8204e6c22bafe5bfd419fe99302810e5da1
-
Filesize
5.2MB
MD5209f4b919fdde025999c4c99074b4eb3
SHA10707fc1d49174601a3f78ff0ce76b54c435c1956
SHA256d5555021f77a65b6aa3c8baaea811168de4863ec96e02ffa7a541a73e326c1d4
SHA512b6da0c2d391b6f76b0b2c28e38e8b6d409f40b7673f476ed32ebbaf759aec045eff8859994dcd890fdabef1cec9f03aed53f8e44855a390fa679d214d7837776
-
Filesize
5.2MB
MD5b0e76552bc0c426214ec2dae71ad0476
SHA17ef7280347032bee7448b2fb13f08c7fbbb228fd
SHA256b3ca6e6ac59a3cfce8e4d0f4e79ebba7756343d3c8feb7528a0590e4d4f805dd
SHA51279296a3bdcbc0c79b7e9789ba0607745bcf3172e63e2790839290b757d3bffcfbacd4c0c530808f83fcb09ce7a5051bb16a82ee41da480c083f59cb93fa02754
-
Filesize
5.2MB
MD5d92fb4cac1df48520c155deb601b06b6
SHA192a54e497f629851ab925b7f3e131db84bb7eece
SHA2560d44d125ceb0a837f7eb1d94f367fe9d96826f25d09ec2e70e698a039aae16f5
SHA5120c394a4b9406e32c353491d77ce67feb794ca5a9de5bd4a94d2d0b20d2092180c9f0dd6641b8f9fbd30df72b3d98da69f82c791d45486f8b6943d9cb61a685e2
-
Filesize
5.2MB
MD591a2d600c38aa09dddd0bf8a8adae359
SHA1c3f65018639327f8cbc16ab4c86894b9e852317f
SHA256b7b22ff89b48f590902af615b168b7893f26d57f56ee0bd49edb9b8ca6829cd2
SHA512a2b676a11f9eb142067af0258adbe5e843405a7b9c394cd852eaeef74f1c31060b2a136128a1ac9cdee49599dc88fa94902f0947d27f291c1f7e602bcbd6137c
-
Filesize
5.2MB
MD5169e5babfc6960bd572140c94c206e2a
SHA1e4341a8b40e5e398844447a4f676b2a26932f17a
SHA256405661f4692b55add6357b78218b9f1078083389d76c436c72753576f56f7f1c
SHA5125e08b472c0d60e2fc387a1fc92a39a9e8f39c87ef621cff49be3f6e3fdf9f117d7a5154e7d246b426351f421980804d5896df7e7a220528e5ed08762156ddd05
-
Filesize
5.2MB
MD54ce0c09a999255ea0d5a34c3ad38c946
SHA1d4bb375854602e3a0dae260c8704e927a7d65ac4
SHA256087dfee813968d015e6f77c574389266244d72af3839459b4ad3e57b1f8533f5
SHA5124df2809b115e68062faa50e3c6d970e6b4b51862691fd7ce57dcf657e6f8036f6e2820213e835e6fee5307d412d282254a9c681f6075e535c37e5f12778d246a
-
Filesize
5.2MB
MD5726b318120563925750d8c0088b6e8b1
SHA1a12c359caaedeaa744f9950a535eca31f0dc663b
SHA2564db475d7d6231423c726b08bf5b1d23cf1e260c1adb5dcd2c6ad5e4674b2d7cb
SHA51242c642bde94e6ea98ffe2d87b6edf35febf6b2ba695f3be08a3da6e7de29870a1fb7bd70bd5ecd4b729ab52c888e66630a0a3003e6325f27c145bd0129b9ddc9
-
Filesize
5.2MB
MD5846037ee55d83ed56325b27a85579186
SHA1fbf9ffeef0aa448bc287c6d14bf163f300358af2
SHA256eb2b8104dede466c8bd75f9d58e2e38ff0ae514136b37ee2b9838372ac50b5c1
SHA5127a3140d124fc0527ed3d88d424f6f3814b79c78e8b455ee7b98d4b64cc3101e340e9b1147e958d381d983549489f3907d3600da4a864675d2cea7ea0896c89c6
-
Filesize
5.2MB
MD517e748cea3598c3eee2949896a1b450e
SHA19a9e569f32476b7b1dd9d6cc1b3dac5ec516a993
SHA256abb4e699f60fbc7388905bc159f0af1619daadaa7c19310d750606f431068df9
SHA5121065ff293f1581ff861a75d50687ce2b7882a021651f0a68a6d678cdccba31bb8e3c438acd2f1583e7a0d078c98e4df69f4da0ac579a8e7a4a39c85fdab38833
-
Filesize
5.2MB
MD55bc16c3289aecc659524c055ab848e07
SHA19f660bbf1569bf266e50c08901561a1802d478f9
SHA256faed0c3bb2e9d8379c747ec49b3cc297ff771432a37f5ec37860ab0ece34aef8
SHA51291e76642d2927c1e5c9d808c2f5e8c4869fb34799697df445329add2a3b2825cbed788d8cea2a1129edeb9ffac340ec50271b269299a31c2c596adcc0bfe1a91
-
Filesize
5.2MB
MD5c0110df6d3a90336c9bdba4ec9a00f38
SHA131a2044b31bb8f0ec87fe86cb8af2658179c24b6
SHA25619a1e928795ea928446c44b99c98b2c868d1d31d1afb38c5a33fa7ae17dd1726
SHA512d16ee6d47a2bdde311365a65c9f2dc640a34ac111d9dd20550563eb0668b8d26a232ee0a980fcecbe6662c9a0f02be4d9564a64a0f83c42ce154338b46b57913
-
Filesize
5.2MB
MD59790b31235d87920b8e6fa73d4ebe704
SHA16e5f983608435aaece0b01f1f35d3d8239063db3
SHA256180859249bcab631982ee298aab9b7e80b1e7c702f26f01c9575c48df4cca755
SHA5121627973f82200d041ddb27f88d01653958b1e2437c1ccbf2f7471331abf248f5ba0cdd5e624c0ba54abed0a3a016977c31def111aadf92aa042c9363c14401b0
-
Filesize
5.2MB
MD54563ea8b72310a31b9f7063923a5fd9f
SHA1b0d0d13ca26c4133b60786488d1e5d30fe9868c2
SHA2564926eb0a464a4b11fe2d6af002eb826e9de9d21f2e1a2d1bd1e7184201ae86fe
SHA512679ba9eeb3932e5297b92c533546dd9cb65abf806dd77d0fd2af361cbf8f7139e645bd53480264dda0c33d608a41ab7d48b4ea315fc99f0f57aabfd49e0e7c65
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB