Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-08-2024 14:34
General
-
Target
2024-08-18_92b18585bdeddc3b8222f6a18a87d816_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
92b18585bdeddc3b8222f6a18a87d816
-
SHA1
514788ae1537af3e44ed2b116d78e8298caa4f2c
-
SHA256
f77189394f39ab67cf569eb59965b054acf6084ed635eb7f3ee4445e72e27e61
-
SHA512
7549d40c422d7030903129acb7cf9b6ece7c750ac64c1d3c2ed8c398e70aab7ba32af9fc14aba83597820d76493caec6899dce223907f815a40d3f7a07b19dc7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-18_92b18585bdeddc3b8222f6a18a87d816_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-18_92b18585bdeddc3b8222f6a18a87d816_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mtVHlsI.exeC:\Windows\System\mtVHlsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAyFqVD.exeC:\Windows\System\XAyFqVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCSkodn.exeC:\Windows\System\PCSkodn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vflgsht.exeC:\Windows\System\vflgsht.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPNNlVI.exeC:\Windows\System\NPNNlVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIyIVsd.exeC:\Windows\System\IIyIVsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhvddZW.exeC:\Windows\System\ZhvddZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qPwyKZt.exeC:\Windows\System\qPwyKZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkWbwJi.exeC:\Windows\System\kkWbwJi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XVpiolT.exeC:\Windows\System\XVpiolT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGfhWtg.exeC:\Windows\System\DGfhWtg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LIwuqzt.exeC:\Windows\System\LIwuqzt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PkbuHcs.exeC:\Windows\System\PkbuHcs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgGlhuY.exeC:\Windows\System\dgGlhuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzKivDo.exeC:\Windows\System\AzKivDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVDqtyc.exeC:\Windows\System\MVDqtyc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbQhXrE.exeC:\Windows\System\wbQhXrE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gVvPJfx.exeC:\Windows\System\gVvPJfx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFNgQzS.exeC:\Windows\System\dFNgQzS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPOZotc.exeC:\Windows\System\oPOZotc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYAamhX.exeC:\Windows\System\yYAamhX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD598a493a41d97c0fa830411f15ab4e46e
SHA1d9d4a3c94d932950b2e1f6ea63240b932fb78110
SHA25674897f1040e8a7ba42dabe2d20c9b814ffb00553c2d5a169cceeb946ed288335
SHA5120992ee30e94b89402b5c7ff64909d29277860c788b662ebff4d8e800c761b593a96f249d53dcc7f13f028b914542ace9010ace1a6e90b4ab6c2c181402401a2f
-
Filesize
5.2MB
MD5fb9ebf848f1bac3f1f9f837279610947
SHA13e6578a582f4fa2cc4196e29ef8ba361929e877b
SHA25618b60e67d88f52e37b7cbb7d2472be92bf7d9d7bbb9b51768fe21268cda919ec
SHA51256503f3b59cc4649fe163b1c089dcb66385c37c6519ee43fa2fb1197e2e6ba2154b12c31dea138e89c24d10b346a4efb39dd5957f0c9d1329fca3b47a10fe663
-
Filesize
5.2MB
MD5ca15e6ff74982b1d67bb3fd48ace12a6
SHA158609c72f920fec92662608ef51f13faa4ecae94
SHA25663a5de41775ce726b15e980ef688b132d2623437a701042b090d05e9d16098c3
SHA512dfb6423c7a4e63d0f83a492375bb0ecf891dc643a7db76d9ba00362e1a0d3cf9f0f4e1380f34c68303c463872c5f6bc743b1fef5aa7e15b21bb73ba79fe4285b
-
Filesize
5.2MB
MD5c9ea6d8dfd593c51e3f87a42908816c7
SHA1a79b4b679e3eada81d491369000e059448dce3cf
SHA2565ba5960d7cefdaf8f82573b36ad169974869ad7f5d31ffddf5bef78ddb4c7b4a
SHA512326873f825d82ddca1c0ea7247305f056a4fc0f034ff4bd4f307a56fd213b9b6d9849ed6b89686d1dead4463929bf0dd8731f1e37c4c814c0b7a2b9d8d5270fb
-
Filesize
5.2MB
MD508aa3c30c49b1a804203a0885feb90f4
SHA134971721f7c1b985b91d5c8a0aca14db03c0572f
SHA256e0f7b1afd6ded13b709f36811511f7beab45281c277a95f6cae47ccd97db52dc
SHA5122ddd8406c25607ed6cd51081fa93e050b2cc6f0dc7f888226da8112608ee484df14898133e0bc330a542a6b8e284318c2ddeb66eb80e0e446edb92519a368566
-
Filesize
5.2MB
MD538b261f26f1e511b3a4f2da4f0d987ae
SHA182272acfab72d56a40cfcdd17b1ad9fcc9e75a16
SHA2563a285fdce6a38c15158fb1eb985dfd9cfbc02fabfc09aa3caf65ab9d8faae888
SHA51246b14b008c52d3fcf552948bcfd00893f6ce25f641e95d5173f797318df245783f6f88b14e6d0a71b35ce3fac54f7d0da7c23a52158a5a41001b59f05cea04bc
-
Filesize
5.2MB
MD580c737915f60534d63d0df640cab03b7
SHA12c4c8e83d7cdf6888e734a1f396f9f47ab92f5fe
SHA256523f4ab1bf74b27d21cb1396f7b2ca6b02a5590e875352ca24a9b1beb317cb50
SHA512f8d81e83cb71de6708484ddab2b4423cd597d65ae6da6a5b2a966b4f463e3f17004fd6e86e86794860d69a3763c4ceda30608b6734d56075adfeac75870941ff
-
Filesize
5.2MB
MD5c7df740174bf03725e2052f0de55968a
SHA138f576f8689d1bffbdb82a555780c108731ce769
SHA256b6d902f74072610eb70704821ffa6578fb79eb6b01a93d5c2a2181d2235ce9eb
SHA51222afc358ea35087cd74e990dd31b0a2d0d146b5c6a3b414446fddec2fad1fec88adae3645668afdc0e533618e0aeccb40e87c1850188a8c491f1303401d160d9
-
Filesize
5.2MB
MD503d028d1263050c168a21e9e05c810ee
SHA16bee92af74d42761db3170ea29fde5e10242aa42
SHA2563104c673baf06a7573f2e37bd797fed035ad325db76570af70206cfdf46c9a46
SHA51255131e96a8ab2a339757e6b85c0699d48b6c47a61516218b0f78a6dfef453d6f7cc1787fc906e47a5b01eaca2b7ec50915e0fe790d12cee4c6affd98620de5a6
-
Filesize
5.2MB
MD5e7c504d161a38875cc1adff81bbb7f8d
SHA10fee165a02bb168e4d2ce6f88f352da455951184
SHA256047e905914799add0e4bdec1b84db10f379ce5066c39713c91588fae3329424b
SHA5124e8651190ee1baf351678859fb511b69fac8023d1b3a25d187d7de9b2b9c11bee0c9c558df19f4d154237a6f19a5922a3dac1e3db882f40f5e3483e6416f4e1e
-
Filesize
5.2MB
MD50dc713b5e92c7f2588bb2b040732fa21
SHA11641f62c42673a330ce4195198ed1da81ff5a224
SHA256cb6c4e34a916a0d4d30f17992e25250607eebe167cc0bbecfe4b46a61aa3fedd
SHA512b2053121ff8272f5d4f1d01fe4f4a239caaa42eeee6de274e755136252d85823a50f3c550c0455bc7b0ea64337f3842a270061a4ad8d3cae8d2f11b80b5d536b
-
Filesize
5.2MB
MD573bc45150b7b942601760495bb5853fe
SHA17c33282ea7ce07b6c63702eb45408bfd5d0bcbfc
SHA2565286747b2c88969ed8e807ff503b013221bafef8fc872377700cc2c30f68617c
SHA51259441fff0bf783e706d24566238bea4ccb454983c6398a89f81e499e6dd2d149251dafa84e0c9c37b63be0b720f968795c452b0d5770af523b60776ab5c12ffb
-
Filesize
5.2MB
MD59f41fd527465c544fa4a0235cc700418
SHA1e3d5555c7fc60b53d36229c75586e32ae0ca02dd
SHA256099223139ef1bc3eea7b8450c12a3a3175e1cf150f385c3bf0d8d77a62d36a9e
SHA51246d04b266d662a40f69cb00b1772e2a0b711b45ce6af0ab6bf63b8267ccdbc863c51647811585bae7ae659fe7f9f89a56d5873d8c1892e3fb54bab3718cefd93
-
Filesize
5.2MB
MD5e3c0e446f4255789a7dfca234aee5309
SHA17191669c3aeed3dce3bc28aeecc781ef4ff6e865
SHA256f860dc6fc6db5e8575398e4760ac7d72427a48f289566d6bb159948e40849aa1
SHA512645790d6a719faebf236028f5d1728cbd356c523768bd2e2d81e6e2304abd664d79d4ad3065aeda864227e882f349ff44f0dc2e16909387ba91d32402fc74a57
-
Filesize
5.2MB
MD55e46a210a90d2ffb53dc6aa81bcf0f7c
SHA1b7bb858148a26f02b4f6aa75e48be30649f78127
SHA2560912cf2d0ce2a96f6cbfc2183c2979d336bd4a79f561222bf6317651835a7078
SHA512dc6d4a59935a10151106095eddb07230ff3ddda56cd6dfbbc986a71042f5442b313fc202963a5a60fbab54d2a300a29fea0f66721aacb6bc425c42a05cb246db
-
Filesize
5.2MB
MD5c829ddabaf70346a871c37c8b5491151
SHA1b32c494e2db572f2074f73bd89e5b59376cd7df9
SHA256d4a565d4dd624f4ad49f1949ce7c512214bfbce08e73b2dbaa7ed465f8ea0270
SHA5122f57e66ef5a8936f1380513d70138d0da849fb1d3918d9e7ae12c7f3ecc351718a33a8823b7a1c2d8e9148d5b3ee9d4f392c0fc8dfa17945b42c3b32adae1ee5
-
Filesize
5.2MB
MD51f7e5e7c481045c9d3d076a5ecb0634f
SHA1d0b0ea4895ec0c060ccdfe7bce247a9089c31b55
SHA25604add4de32483610202dc1356249a5befbb85da9b493ea400759bd37596ab460
SHA51296bb187b7207cf5e6fe7a688835837f0dbe0da739fafd7581b7f8348489816c02a80a137941b7bb56380aedeb70cdea56d982ffd19749a31917ce8ca99bfeed5
-
Filesize
5.2MB
MD5ae2b64faf54902f49bc06c7fbc23962f
SHA19b08f135a59401397f7d178487a908f6eed24059
SHA256af9219572e5191b9e40d2f13ef68316dd65770984074b5eaf40a2792a2c78cfa
SHA5127c4e17688c8d08417aab463015fdbead13a0a8b0928d23ddd57e3639ac29172132c406066726bfe40cff6051cba86307d6d121e48054bd322a689ba2dce165d4
-
Filesize
5.2MB
MD54396d69a3642f1c6faba49eebc5e1491
SHA1a53384095d3b799722556cec20c14a298fc4e0cc
SHA2565c6dc17ae0971f880a6a816e97ba7263b5ca9a6de4815175cab10706be528900
SHA512defd440d91c5d23a9dd163e657b9627a33ec6c5c80151c7ce24c59f0f5c8c0bb80e281c3a43c65cc7d1c9865cff9fa82648005ab4333ae1e3cbe986159fc1125
-
Filesize
5.2MB
MD502818da2249057a66315d456c45a54de
SHA1fab458eac56af31ed1bacd0d2882bb30a1908182
SHA256bfc9549623198bf4863c94d4aa9de4fc560305afe16bc3aae59d6af70b7d8549
SHA5121c1838b4d38c9164c6c870891ad5bd5dd666fd15d7fe18673178c80c0985c34bf402aa004caab5958822f286e37883844547672b1f75d0862b5691f77e8a641d
-
Filesize
5.2MB
MD550cb85cbd2677600c553e9b4cbc6c7f6
SHA17d73c0d9a98a222890c04ae2c367c2c4593ca565
SHA2567593e836f9e6d71284d78e692d86b3da9dcd7945fb1fd8790f35b346e1adb6c0
SHA5121d6cbbd52ebfa289068b02ffd7d1f04ddd2aeb79dd68fd9413c013cd714c56254545a0998118daf8b60f8a6b274b9d538ede25e67f269da1e85b396a8fa5416c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB