Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20/08/2024, 00:24
General
-
Target
2024-08-20_0009b5981a68b00cdcd9dbd72dce0bc6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0009b5981a68b00cdcd9dbd72dce0bc6
-
SHA1
fa9690c6bf6cfbc78564cb454fc8e72ccfd25e6d
-
SHA256
b52d5b1ef6276b03562d464191418a85fbb715a7094f239e069193a10d2d454a
-
SHA512
373c5ea7bfac5daa314d444e009b5be0a071b9c632a8efed6a2b6d2f9243db8f1e9f2a0b4dc8d3ab73f1f36daa07c06690422849ad3de6506e2bcfc727b1401d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_0009b5981a68b00cdcd9dbd72dce0bc6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_0009b5981a68b00cdcd9dbd72dce0bc6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xvSzfVF.exeC:\Windows\System\xvSzfVF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVopddu.exeC:\Windows\System\ZVopddu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNVVMhH.exeC:\Windows\System\VNVVMhH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JKZLmpe.exeC:\Windows\System\JKZLmpe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lPSJtLU.exeC:\Windows\System\lPSJtLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uZcfLlW.exeC:\Windows\System\uZcfLlW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DHgNGDZ.exeC:\Windows\System\DHgNGDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KfoOtrR.exeC:\Windows\System\KfoOtrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EhIAobX.exeC:\Windows\System\EhIAobX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETJhGwG.exeC:\Windows\System\ETJhGwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zpyDLmy.exeC:\Windows\System\zpyDLmy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vYKalTF.exeC:\Windows\System\vYKalTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHURlox.exeC:\Windows\System\LHURlox.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTkqzXD.exeC:\Windows\System\pTkqzXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\midVQRX.exeC:\Windows\System\midVQRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qNEvhDP.exeC:\Windows\System\qNEvhDP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjoyztG.exeC:\Windows\System\yjoyztG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGiuFVf.exeC:\Windows\System\NGiuFVf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oPkSwWV.exeC:\Windows\System\oPkSwWV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbIRhsx.exeC:\Windows\System\UbIRhsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MtGlEhz.exeC:\Windows\System\MtGlEhz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c01ffdfad97289bd8eb26d6838999951
SHA10292603891ccc12c3c0bacd34774b7a9b398d622
SHA256159424599ba8527c946f86b6f5886e67b25dcca903bde9a4183919c511f6b7aa
SHA512854545253169810841bea0d9a0b40c6dc20456b85a73741d2eb6585fa2bf55fe8618834c5fbec6ec9f2b02d02278ad694c80ab49f5ecca6a0fd45c9f4a2f423f
-
Filesize
5.2MB
MD538c9524f8d8fbc1e3b3931cb1ccb75da
SHA1ac5064be27b128450a920215e16c434ebb0eaa06
SHA2567a76a21be4b9bb147ae57d8595b96e3c2e0b3e9176b74ec4d4aee7aee621a52a
SHA51254366c543dccc062be2489097a282ffdc946d7feaaa770a8fd4735a64da8b679a3e80154ad1ba7833479b3d0e9c389915b0f025363cab3b42ca827154fc2cf08
-
Filesize
5.2MB
MD5de64e173fbc61e3b0a74c0782f391fbb
SHA1a64217de9b595102270302cbcb819970734da76e
SHA256c15c8b83959f94eeab932c85465aa8fbfc4421cc14ff2f585c01757059b1dbb5
SHA512a52276e5ceb37c03bd2017515dd7236be708e5811f72336414548584f745e6dc82aa29392758b4d8835ec776aa09f66ccd9ef0c90dfb650479260ab9fa06bc4a
-
Filesize
5.2MB
MD5a051fc9275071e58b2068871dc75945e
SHA1a2c77b1a33f014ce7930aee51391409a45f77adb
SHA256ef60217629f32c36c0eeaf1e41b591f23fa1fc21442c0bb782f462299d2fdc03
SHA512959a7e233274f6646cd2dd34b6de7c7de0282e0fe87fc5eab4bd15702f71f942cd9a6d00dc6fb897fb3af6d73f6421d6b0d68d956f9c5b0ba1caf8696fc98df7
-
Filesize
5.2MB
MD5062d4f4695973f0a598895b35ef56527
SHA15521d140a4da216483a93fd404ee1e4203949956
SHA256d8025bf1b8694cac0412f41e81b6d0c6f0fa33172d379f8eaf4450747e7c9fad
SHA51258fe463cf02bb90851322a826076b31a406bda119540fb387047fb12f7723a7ec621ce4169ff8b37f07dbe3c35d6f1a78bf36a18de50e97d3dcb106764ed42cb
-
Filesize
5.2MB
MD5559333911dc78cd168e2bec8d6d8c4a9
SHA1083763fbfb782ea3d651af452f6a08660fa3c747
SHA256cc705759779118e7392df2fc5fa1c5fc133cf1963a093f09a6d55cf071523f9c
SHA5126d2e543aa9ad6cd68a52b76c83b236c9d9985a5a8f3ec3769de4eea3de2fe4cf1228c8b9f6bd97fb4f20a5c3e3b24135b68fd87741d9776dada1f7803c0b0f47
-
Filesize
5.2MB
MD5b2df2954d134219b3b94c0cfd7616f92
SHA11a1a8b4f011c1c5d077297c09616af32d73b12f4
SHA2562e9906eba34cd93c56ac28a83bf76c7d329052cd6645d24522c3401a6afa494c
SHA512d77ce4bc1a3406d353f77d188b48916211d541e066af28b8e5f883f9cc099347f9ab13ada7a8a9789227fdb82b85c11b7dfcbf9eaf5e13d3c181b9e75b763786
-
Filesize
5.2MB
MD5912b7c7da65314bf4a698da774914e0c
SHA1dd002bd922b88e51712660b6ff488b6528b800da
SHA2568375532c5eb16a3aa08cfc5fa614d45b45aa5957e4198c17bcd36f5327ee4e9d
SHA51276378db581b50ba80cc5a8423f8caaf52eeb66ee7e0bb64f3e9319786bf829895cd470473b64672d05712ebcab83555f4cf90309ca8950c4feca5f63eb10aed4
-
Filesize
5.2MB
MD5acf13dd245fe43631fe3d95a560aa483
SHA1476183e3ab4dbdda0afb4b31e2734c091abc7e8a
SHA256f8df4e0727c64765377ab429726c81d78c84d9336f1e44d2a8fba8b3536181fe
SHA512500f1fe433c4eac215234e27f17e5dab8503afc2148dd144e76dbd7461961123aeee26bb737bb0506eb8cb2606cd4c80ca7c6c7ce8c8701194acb072d61b2f38
-
Filesize
5.2MB
MD5cc83f74110373ead45665a35fba2dfc2
SHA1dc3524ac0eb036dca855ce79b850d1d5931bf9a2
SHA2565db1a720fad6cb2c53cf4c608cfb1fab925e0479fa7912b750cf5f1349170745
SHA5121529556176eb6d552cd3c1c6dea6b9e3d22e239ed409ffe9a3579ddeaf6183efb14849fb7d063246a3294aa281f20e331cd5ea7b51d6b6544128fca44c56c676
-
Filesize
5.2MB
MD5a0c69a8b51fd808741d19bdeb3f4fe98
SHA14ecc53ebd3ca9114f92aa9821d155c03fcc3a3c9
SHA256ab900fe8b8988881b6ad9e41b65e691170a48e22746911b97542760dc9e04ea9
SHA512b4abaf2f8667772676bd4709c7f878544e59c1e8b4c95e890cab69b16586cb8a149ccbcca62a8ee37c3f8334a52e8ee3dcebbcc75c7b34127fe4d125439486d1
-
Filesize
5.2MB
MD56d4cf6e90cfa1de07109d67e11ed7b41
SHA1b1e2b187271204f11e24aca8940d041b4fe39381
SHA256f252692179b14ce166ac43ae83442c5caadda676047edf4cd872f02f74f20649
SHA5121990ffeff9cd007957611a9fe24d3bba44960bb16c97053bbd9eb38766575fc46d13d092766df8afd302352ea168ef20d7e6643cae4dea3a46cb2f25ed6e06da
-
Filesize
5.2MB
MD54ac8315cee8ddbaf593b4440fa0eff75
SHA176d010fc863729a9f8543f9a5b015275f5b9b514
SHA2566a317d011bbea9140ff508c49d77ce7b9dd26a106dacb82367271edd70c3fa2e
SHA512cc39de4ccba637c38543d773aa393e819f59d605679e5920010d14baa9766f894586f4751ade8c9368e34a4a1c244d3c54741ee069362f4a50995691e5567023
-
Filesize
5.2MB
MD52be2f5dadc7a0a723b445f0a64758fe4
SHA1f7e7504fbf0a492e8d54dc66e59b5ad113a30096
SHA2560988f90b7b20893de7043fbd68baf576822a0b0dc0e704c25fe8c7b84cde5894
SHA512f270ab30eff8e3ff66e58323cb98ef781eabd7edf4a58260ad1aaa8cfc4125f5dbceb67996edba5863d84ad191b6be700346e1b78bcfd926a04747f517231d35
-
Filesize
5.2MB
MD5f36e5efdaf0801c9cda6e97ec9edd40c
SHA1778d0d90e1a7ca879d359926d2818c056ffa4617
SHA2563851c2d1db2a4471dc3f83c02570a76c54684d3e077488d2b75a43fc184ce104
SHA51246e00a80d62ebf42f55f5f4487cca22cd551ed302781cdd666aedd10b13a605cffc78735747f3e97e9eb249f71467b1eace2878068461dff387c67a3644f8a93
-
Filesize
5.2MB
MD51f39cd5e32ce079b059d73b5cf60feb5
SHA12679a5d70dc631f2631d38214fb3a4f024e5cba8
SHA256a65f44b8e74de8eaa86d070327b39531cf244ffc017cdb950ed3a6c9cb8bf9d0
SHA5122ddb1a3656a2943ee82226f61ee648d66803a88fac76f91166cf411d9a5c865f99f28efd0192793d707730b6c7dc69ffc1ad5ecf2e63e561ec5e172a8223b295
-
Filesize
5.2MB
MD59c2b86aa486118380cc17cc5ec6cf4b9
SHA1b9fb9c98e484ae02174598b804e63fb89e2754e1
SHA256cfb6683ce4f64f26e4dc52fe9c2575272f4fa296edbbc1e31bbcb37015c8280c
SHA5121397acf5ebd18240cf3b1c73106083b3eb2790a6d859579c072e761edd055fbf2489242100515ee95781738e41af709d62bc979f356831f879b8ef7248a5c945
-
Filesize
5.2MB
MD574c7f7838a27501f5b7b265fd03f11e8
SHA1668e7140f6ee72f4c18d0c690d7792a10eeefe04
SHA256bdbb31f406a187ee99c8a6404ca5c4794fc9e06f92d9adf91062f8f4d6ed676d
SHA5123f4ecc375bc9dfe16bf8e3aadd0128f2f9ebfa99bdcb49dbf954e54caaeb9b49e6d11fd9a71ef889c6a7d70210ddbf29fac3e8918cde14cf5c45ac1325752b46
-
Filesize
5.2MB
MD54c12d8caf4cb699fed322376214c7e57
SHA1d9e0eb08bdd086190e7e048ec9bb01bdc9df679a
SHA256e2385a8577e49465cdb716bcea081d42ba3f0c895809c143c5fc7d15a3efac67
SHA512646d0d96c5fd31fb3ea62c88374bea1f4bbd81e127c8540470c0ec12e0928d3990dace95b15284e08a19c3b8c32b0967f14a667bafc57f3a4d150f6f128ae5dc
-
Filesize
5.2MB
MD5b8fbafbaeeed86c5917229b904db7d75
SHA1a60325ff3dea3de11c093fae545b5bb93300decc
SHA25651fba8ff83abc267894ae4eea736ab289c59cf5015a841da5a50a14eb0eb87f7
SHA512f2804fa2cb1991b64dde012f4106af63562cc817b8ad171695d1edcf7c301f9417fb6cf2c600bee2ac7b98b180e093ec5190cd3e8664c006682a1045c2b0c1b9
-
Filesize
5.2MB
MD5c741ca0dc55a0108acec01d2c67cbbf9
SHA1bef78edaff095e50fdcce39d0cc220a1e8ae5b17
SHA2561d15f921961bf1a4e267f3dcc2c4e593ccee030afadd409c0e7ef6f1c3bc0cb9
SHA5128d4e80962877d1685575bf6726a3a710e8aa55a8c702fc56d972f82c7c5b40280cf6be861a3e505bb5acc85bf6bbdc8dece61e1fcacae0d25e7c04ac8d2a9257
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB