Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
21-08-2024 04:52
General
-
Target
2024-08-21_f5c10c6f32dfa527eb39517ca7ce949c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
f5c10c6f32dfa527eb39517ca7ce949c
-
SHA1
333ae710d8703c48a8cf373faca3accbe07773bc
-
SHA256
a44ced06d35849a3486d497905d78d65eabe1e568b5a76d5d1bac28644f1507a
-
SHA512
6c0e83ddc7d6c179baa5b9772875527d29f999b030702b14da4688b94a83c1afc1f9fbc571803c103ae8e5f3d597953d1cc57a9d83d1721aa8320f27eda4cbc1
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUs:E+b56utgpPF8u/7s
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 49 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_f5c10c6f32dfa527eb39517ca7ce949c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_f5c10c6f32dfa527eb39517ca7ce949c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oQNMhpE.exeC:\Windows\System\oQNMhpE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMmzhOo.exeC:\Windows\System\kMmzhOo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xFefrgb.exeC:\Windows\System\xFefrgb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QlkPBae.exeC:\Windows\System\QlkPBae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGTVaAJ.exeC:\Windows\System\DGTVaAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQsohDU.exeC:\Windows\System\SQsohDU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CzvJaTP.exeC:\Windows\System\CzvJaTP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mXuUDyq.exeC:\Windows\System\mXuUDyq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuZgIOB.exeC:\Windows\System\vuZgIOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIeyIIp.exeC:\Windows\System\mIeyIIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dxHjkkc.exeC:\Windows\System\dxHjkkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qlXnKJs.exeC:\Windows\System\qlXnKJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IctKjuy.exeC:\Windows\System\IctKjuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZroyKR.exeC:\Windows\System\rZroyKR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZfGiwzQ.exeC:\Windows\System\ZfGiwzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhnamAx.exeC:\Windows\System\GhnamAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLIPBsT.exeC:\Windows\System\qLIPBsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UuSPQpY.exeC:\Windows\System\UuSPQpY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DhEctBy.exeC:\Windows\System\DhEctBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvEfDGp.exeC:\Windows\System\jvEfDGp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvwNlUh.exeC:\Windows\System\tvwNlUh.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c7fd4968f6fd393620a3e1b30f10a8c5
SHA1eff0e043396c47a158926ae179d43d74c664c8e0
SHA2564f63b890f64b5e5ed832ecb7fd549186cbe3e38f90f09b05bf1992d569831d0a
SHA512305f5928bfeed7f1d09deb592faba22c08c81a56426f3bfc8b792296c0de94ff2803cb096dab488c831553400f6446d12c747d3d8a1ba5e4e189a64b8fd95b65
-
Filesize
5.9MB
MD50abc1abe9fa68b5b4ac39b1d300f7cb0
SHA1daf62332ffae9ae30295aa98e37210671d465439
SHA2566dc9b883a34ab4d29409a73e9bb17fb71e46b38b1b3e840e214c2cec2bf95dd5
SHA512f68fe2ae4e70bb2214e17c03e49ca7a0f9821c40ed2fca10147c1801342386244f50e72e6b636890ac3d39709cb14bce7e6c7ecc886aa2f28968f8a112c1d98c
-
Filesize
5.9MB
MD5e54bb0a11b2b9d2a386b93f48b5ae8e7
SHA159c3184615369261f997331bbda96889c7eab7d7
SHA2563b868b0fad2264457b24c2d1e5b3638af94182122198d9bd83d931e6534af3f7
SHA512c114067e64d250caab8f06735a9314a459a50e0421dc27b2e7201a34acc84cdb8e07897f0c5377e5a4ca67adaf9d38c41578e5af30c5f3e46ecfbe11e50a9608
-
Filesize
5.9MB
MD5b65ec51a22f4998ec6f136cb08f6cbbb
SHA1c758ce42874110fae48a10e6657583154effdde2
SHA256a0e3d3079b9c01bd1481fe07f02692a431be9be54b16532a142276e7e72902bd
SHA512b988c70cfb669ec28356ab9ae180b3d149421e21229d2cf5db1cca160c25701efc4cf9332994f0558ff15d8ef451b65eecfa2f220348c340c69b8d61d7b964af
-
Filesize
5.9MB
MD506c94a0bc0266e513d904b1696e636e6
SHA12bfbf2a2dfbc4ddb999ac90cbc54372245f061cd
SHA25600694d5bc788a9bfd75733cde1dc75759a525e7e462d0a8f722f1c0ad0754a82
SHA5125b85108d1ee7037575e6726a3f5e0c26deae6161a38fe7495b210c97a228cf69b586408099117f9936bfca52738128f9250434352df4cab593ffaac559bcf615
-
Filesize
5.9MB
MD5fdb285bd65d9419bc659a8c677d7f2bc
SHA17fadfb391846368f62e13386112c38677f95b506
SHA25616d2f9789f194c8709c0a00390dd86e6dcc0592587de01f770d7e773e8e8fc7e
SHA512df9a519cccf15d23572dc01df4efcc19b95bff0a70d9b521e1b50685cf9392e496c3cbb17a8f186d4ae208753ae40595ba5f38c5516bd36e1e3c69bfb8f4b909
-
Filesize
5.9MB
MD56d4c44628b02f6ea5579d9e40bed0056
SHA1d11d6343da904c68255c69465095a04538fff3ec
SHA2566fcb167f46f8447b36f93849232b5e00c023f9a76ace8f645c7e295df788c8c6
SHA5125efe10eee2b30772f4d80fcc80660c73723d01370aec4fafb6e5e6aaaf306b372349f57c02d6cd8476f29de13449c47ce0f95468f27e556cb5a6a8810882c917
-
Filesize
5.9MB
MD5d777ab8d55408703a201886233a180fe
SHA1bcc9a6871775cff13cc386bb3fb1bb949e5405a5
SHA256a915baf45c125619de0695207fa4816affd3d5d2f62d18365668a871a6c7c4d1
SHA5120aefa1969d15566ad2883ec4a35f5801bac5c71a0458c2ef82e1faddda9a16a3173dea5335733f494722cee8ffbe8dbd9dbbf55da878e6588c7adf1f99fe8ad6
-
Filesize
5.9MB
MD50d1d1a6d8bc3dd81fa3b45e8fe2de2a7
SHA10b0c782bc64b8df17c291367f09902a51550d188
SHA25622fc51ffdf4afb18b19a87743c057c50d67c125eb0ff36a364f9309ddecfc36e
SHA5126c4b8f7982f3fee2230f9732de49d4abbecdba011002e220d75b874f0a8c9c9559431ecde89297663aca02a42840275d3b5e1cdc8079019e1a18d4de6c557d09
-
Filesize
5.9MB
MD5755b7355d406f4dd98b3464c67634932
SHA159dbdc41a1cbc681a0e008946533a278aeeabbbf
SHA2560933c58a26405bf729c213b46fce5321a2e1f8d7e2a5b6ba32e62097cd637933
SHA51230c7e1dfb711df0ce7f7c0453cefb66b47f8c002f9635cdf2b6796edb5e0be86863abcdee3e764fd746893637a4a1a1b98786880a659e7bf9c4726f7214fe316
-
Filesize
5.9MB
MD58a8734f2ec8056671860f59362734aa3
SHA1b20d68407fe366cd91665f4a2caa6112105bbf54
SHA256d6ffdf457f6e229cafcf086801b7a4d163f5d20911db98130fa1ef6a54ab4688
SHA512f253133af04d4cf45022074da56514ea8e52f2948acf5031e8aca230950db39d80322ed6ba82e900257fb7b5e8d4b3e1e4d47a57ace41f574d4c2b7e7e540cbd
-
Filesize
5.9MB
MD5d234cc6a741f5a74adbd6e41178a3cb2
SHA1e2bb696b963af5a6ac3805738f0193ac2246f512
SHA2562b9a769fea34cd71b710723a2007ff0709930df20d4f228acc52b85f7b4de50f
SHA5120ffeb83c25ae27caf9038925547b03baeb4d4fa718f4b6378752ed1ed4bfa6eaa3f44cf2832092e65ab7b98f41a454036c477e70ac00d69278304ebd7206dae1
-
Filesize
5.9MB
MD56843cb8d96724049fff76f6ebc5dde0c
SHA121524acc253d3d339cbb6bd8b51fd80868d8ffad
SHA256c43dd43b4ab535b259656d917d75f703bc838e9ea8d7f3e8138684dde964f6cd
SHA5127de21a86904d547e4e184f644389b6b1ce45923884fcd4432e881cfa786895084f6365a62caffef4909eff79f83903a320b2bd570e92e4100dd003ec999cdc25
-
Filesize
5.9MB
MD54b4f85bcb2d06cd550ab008e857ec36b
SHA156ac45e4e3397b1840be24bb476d97976eae0e60
SHA256904cb24757465947a3740942050d763dab421fd0f1a8c434f7e588ca15fe5be5
SHA512746a2df297d7b461c08ad00d902d4af1a0884441d68f84128aa663ebfa845f79fb4b34635d002a8bd65353d376d76ec2c506b496d02a5e1f5e0300869c65532f
-
Filesize
5.9MB
MD562462869e6870d1486a929cb7e1e05b7
SHA1ec1867937afb7d872ec73cf69688e001fbdcbfe4
SHA256eec5f44b78c42e0935cc11da6413b5b62b609119cab05dd454799d62db95504a
SHA5126163641d7d8a27715057a990d8042fc8b19e30824e8817b9ac65c246bb1e22a39f1807dfa536ef8d0fcf7dbde7be988593e1f6087d5c7136c03c9ae07960e262
-
Filesize
5.9MB
MD5299fa78c0c3d820c2aa5c01408002631
SHA1c60c355700df0301735fd711158dbe01b3da5a03
SHA25656cf5ab0dda264a18b11367c17103108a35124efcf1c7d5747914cb26b520fab
SHA512d74f70cfb2fd6770872c90c77986225a5ae5a09b8fd5ab48eaff2b1e6c44e8cf9ebb5699e19f16ec55807ebd8b09901606e607407f3483783b480d973bfadb69
-
Filesize
5.9MB
MD588628955690e1e4cd0d182594872dd57
SHA125e7490d30974ddcf5e979afc4bfabc711475fc3
SHA2564311f9b4b43a44d05ead9053da1b2daead77a6b32e313df50f8b6416640ce1e3
SHA512b9f8b4bb71802716ab41b9f82d9cb258c7795eda90f5d5050d2c25b9cab45d717d607a40465ae2e318a7cadee26e0610720d05fad00204e8abae4a2f16994ca6
-
Filesize
5.9MB
MD5c902b28e1fa26e9949544eb7119a43b1
SHA1d95cb742db7742bc35faf56770e4aefbee53620f
SHA25658c4859f3b6135661fd6f0720aae690ad5b95a9460a6dedca9c5615d3efb335e
SHA512716f8d99c284fa63ff4304c35abce68e2356931a01448a8b906912a66f9dd60b00f32fe5952c1429333f048e78482e6b0312d85ef983a651eb8eea6d1687a09e
-
Filesize
5.9MB
MD5c6d5a601588f8e0f224a06019fdbca98
SHA1e24e6db23f4b5a69c74ab180a40c1fd137833aa4
SHA2563fed8fe939d76676b7e5d580dae4b5ebbe34951674458640d9232d22231180fb
SHA5127ea5e9606eec4c90f4873ee38f2a850f6f7a42a33b47d698851c829874e57c6f44ef39a2c447c893031e44823c94224d211518f3015fc98ecbad0650ba5a49bb
-
Filesize
5.9MB
MD53f1b44ab8326354b4a9365942dbd09d4
SHA1129766827c8826d83832937356256ab87389ca9b
SHA256fd842506ce9e8a598a2afb33e3fe3c8fa71f12eae885b9cd08b6ab8965eab2a5
SHA512cd3b4f23e8d2de8a9b02f0dd4229eaf1673b953f31f57f1022beab9657d993d0b38da96017367bb4b6dcb8c4e773c8d02c93d233c9f283dfb46f1e6ee12d5635
-
Filesize
5.9MB
MD5e1ec3f352b54fd18d9876b62ac528fe2
SHA188886f731a8b5ee0df0230cfc54613b193212ac6
SHA25661c2ccf656114150a910f9d5eae65c856cf37065b3a8125b6120ac73d6088bca
SHA512e94e3c29c524ad6199b4927fd9d6ab044a1051968502d03c9919d114c55e25234ad99ce7f97197b474a17996622858b48abbc2fb0e9198c4b1ba533cb9792ec9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB