Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
24/08/2024, 11:33
General
-
Target
2024-08-24_48c0bccf92769c5cbc967af7d445e4d5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
48c0bccf92769c5cbc967af7d445e4d5
-
SHA1
c3a6b8b437d4e08416e00cbe4c993172f80dcdb7
-
SHA256
63f3ae3c7bb08a958b76b642f97ac4dedb533ceca7afce6e0aa04693b51b8a4c
-
SHA512
d92a17b3d450d924fe66a7603ed3b418dca0709f0a1f1b6ca83138c5744c69b5938927264d2dee936e0346226808b6634f7f033746a7a9eacfd7e2c8a02d807b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_48c0bccf92769c5cbc967af7d445e4d5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_48c0bccf92769c5cbc967af7d445e4d5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UdAISzu.exeC:\Windows\System\UdAISzu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxXbNeN.exeC:\Windows\System\RxXbNeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvaVPXb.exeC:\Windows\System\JvaVPXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJbLfCo.exeC:\Windows\System\VJbLfCo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmSSIhO.exeC:\Windows\System\cmSSIhO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djhhaxD.exeC:\Windows\System\djhhaxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyKEyYH.exeC:\Windows\System\ZyKEyYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KLVYteI.exeC:\Windows\System\KLVYteI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eEJmdFe.exeC:\Windows\System\eEJmdFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcFISQP.exeC:\Windows\System\YcFISQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xoUNROI.exeC:\Windows\System\xoUNROI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRQuONa.exeC:\Windows\System\NRQuONa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sZMhVcs.exeC:\Windows\System\sZMhVcs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdpnKnT.exeC:\Windows\System\RdpnKnT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtrEgcT.exeC:\Windows\System\KtrEgcT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSfgkEf.exeC:\Windows\System\LSfgkEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygTsnxg.exeC:\Windows\System\ygTsnxg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVfIWEf.exeC:\Windows\System\mVfIWEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnhCZUv.exeC:\Windows\System\GnhCZUv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AQuZBJI.exeC:\Windows\System\AQuZBJI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naqrjin.exeC:\Windows\System\naqrjin.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD597e55b037bf4c2dcac02cd003b595448
SHA14edc7e0fdaf173741369d87018686d6adeb7dcd6
SHA256c194598aadb636d4fd0c36dca5c415a83a227dd54f56eb1faeaca5f09359a9c6
SHA51229b34daa85fa4935880188399105ec3704bf579cc6d803fee01585e79d94afa2c6040dc5b541f48fd4f21af752c418b1ddcd2504faab236f3c374dce543055ff
-
Filesize
5.2MB
MD528fca9581b8b0714c5feed9c7631de63
SHA1511bd5b07fa8ec3fefa9d5cd8a5b992fba5f89a8
SHA256d65f625b9f3d4b7ac1ca508637e6f47cce0b775fa3ca303da0c46341552187b4
SHA512178d57ce082e7844cdb12049a2f419dcbd85bbb7d839c2323738b5c20d6639b4259ba783115e5ba64f0d770b46fb13556405253e8e2170303835545e57f1c4b6
-
Filesize
5.2MB
MD5806ab11e07574318ea161c78259a8d2f
SHA1bbfdc641173dedba186ee97d77e1af6c02e9607a
SHA256441c1d24796ed8e64dff9ff43fd0cd8721dc91a3c184d3a6179a850b666ae896
SHA512c9c7c26b87e5cb1272d4aed0df75b306542eaa064e390575bafb28eb760012d1b372125e289361d3db63ac3ac5760c2e90c11b1006871a9c6f2f2a6a7d4a03a9
-
Filesize
5.2MB
MD56c2efdc9d58ddcdb694214e3918f525d
SHA129c28ec849049c139d6a4fe1a9ba50452811671f
SHA256f911e6a9772e3d69c00b0f5f8fd5c1ef9a425c3111c8eb24e5830c1d1ff645be
SHA512b9efd57ed54f7a22cc096995aa4b11c681f613ec74d5774e2130d66f615ca5708244e3695098413c0673251f67039136e487f9f649445d88489c57090c341bb7
-
Filesize
5.2MB
MD50bd2939bf38641fa573dca88fe2ffff7
SHA1fc1cd80b92f2fc7cbf57685dae14285a54743259
SHA25636c643849af8a80f9ff89f609437e7edbaedf1462e6831e3b4973cf17e156a88
SHA512d70fb114c9bae9c11bb7e1b779858bcfeefc759a0f81bda468598b629c5e4f651d2c22467aeb3940b2d0012679c20569778879a1a00fd4049aad30dae98f32be
-
Filesize
5.2MB
MD521f3b358b15b431b68a1f95df37ad517
SHA13d018a95aed1f529399500a10415506af4337371
SHA256bbf1bab8f22fd412987ee56619281b60217255757f99128a0ed75c5642cfb5a0
SHA5129d9f1a5bde487747e3279222648bebb7f046a7cfa032dfd0f20159f4ac09299a42163e27db141886a1702e695545f2225fe125e899ef24d09e2213642911e37d
-
Filesize
5.2MB
MD552db79cf37f1cf7c9afc0d230f2fe081
SHA10e224decf01ea4f56ccf2ed15f4284b02261fc17
SHA2566cb8af110ff88b239c9a3965ea8fbec741f0eb27745724dba3470227071432cf
SHA5124e5b08177fe295dec13b9d69ad5e4e1c8a2c7a922fb7236fbd9acb55c96edd22835207a1114c9606411b124dd64422562b5f2815e074c773ff20d114725447d2
-
Filesize
5.2MB
MD5f4e2d8a31fe60296984a2d630311539f
SHA1fafa8c3e8ba705129aaf9868444ea970da26d625
SHA256a7a77c7df1411176c9bd308be301696f077c2645fa84d5866f0307429a2ee2b5
SHA5121bf60fae063e46c708834c9cc28d9af34fe9929bae1afaca0665ef0060704a153eac1422d900548444b2365cbc1a2a2efd9d2e60fe4b26746df6673f2f2b3ca0
-
Filesize
5.2MB
MD5412a54f4534b104b6658adc8fb5533b2
SHA15a6e8e9b0c1e1e484f8b90bbc9dfa1b57b72191f
SHA256acedbbc8631c89f182a21f62090cc1240fbe2c8a978ffc2a3a80e06a7cb12b19
SHA51224ffd057c06573efde4ad9ece717c756de05bbde17775e2714f463e6b28790dddba64d4d96fb3df3a90a7fc0ca30b2cedc20961d673fc0ddb67c70f383415bc5
-
Filesize
5.2MB
MD51a5bedc66a1a7f5d343d106e026eab97
SHA1ec7f7768698abe5ae695667780546d47647d4132
SHA2568f2492a7f34737579fe349901b35d25ef642bd4cceaedbe5c14259643ce07851
SHA512dfab6945aad7903f61e2f1d28c6923b8c7ae35b691223356fe3765cc89899d14831344cfa2b1454b0ef1c2e5beae96971ace982703480ef9c8c86ae2e91628f7
-
Filesize
5.2MB
MD5bbc023771d047ca81f12e5cc6316fa26
SHA1439de0a910fee0459094ff706eea348a1e18508b
SHA2561adef39cdcf0b7ce1ca2f31dc9a7be142385cee68bc6a352c1885c18e3feec53
SHA51241b5528dab52f17ff647c821c0dfecdaafa4632c26933a50a207155b7fc664f1f76f9c0d94b0b2612ee72d93b701f2e77d98f714778d632867a312034d39b1c9
-
Filesize
5.2MB
MD5f998067ca03e760bb2a9d427e262dfbb
SHA15fd7e71013a2d467614894437027589fea16c7e8
SHA256acb42b5a9b05da21b69aa22073a0b3307079ac0898b4d211503559d6e049daba
SHA512f0cf748437f05c46bdc80071861084aee91b70cc0468df4132f469558e47a7ae51e22ffcfded5f56ba445b64fda06f2937ae477798bd6b6aa664f25444289ae8
-
Filesize
5.2MB
MD5f23c6a9eeaa93db1dd86f863d17c5fe9
SHA1b21c44ec3e273bbe6168b6c2114a86d6a63082f0
SHA256e57a0c0c1912a56c8e4393bc219c57fe74da76783943a34fe5678603d76a79f4
SHA512ebf71dceab19cdddd1713351419cbfa6da34c1c8bbccd55d23ade7690ea75361f44d371498c7077602fd5146cef7fbf03cb040ebe27533d1acb5acf657c99b86
-
Filesize
5.2MB
MD52e2f7831676962259c7131f81b18bcbf
SHA10bc7de17bb6fb7ed04ba8946b9e50583588e8db9
SHA256440a03e304eca21c5433b92f603f492439e10dcd3cf6902acd81205afb70d688
SHA512d2499d255e532e168ef905ca851201545390d8872412b0bee8b885116d7e90b77bdd77cf11b93afa256350339fced50d2ce1d894656d6743d58137b2323df862
-
Filesize
5.2MB
MD5dec53f40ec062be6be757929feb67808
SHA1ca562de570f8ca996a8d988505601564823ab8d4
SHA2569a64bfc18fbec866b90fcc4dc33d3179621521b09c7ec66ad5071d66d48dbc0b
SHA512a1d7d7800b017fbc5a6d14b96bb1dd2dbfac373abfbfcd50e47159ce1f2e8d812a466177109d695536fc507f205f365202a5baa1c549bdae937f9b16b2f73be0
-
Filesize
5.2MB
MD5b7ae499bfcbc44a8aa415b9d3cc8c15f
SHA11f047c85d3a0b6ef4a62f0678ced49549f0e396b
SHA256f2c13f22d0156057ff922e026a4d91325a16811f41057eb9bcf8a169a4964cea
SHA512c79acf898dda92874f00477f4ad08c341ea9de49aa0bc97c5b2a5a402e51e5d8626edeb9a565f4095a9bd3f10aaa36d9d7deb9497cb407b0a47a4f7a6eaa3141
-
Filesize
5.2MB
MD509f32d508c84e3293c73c9c24de16102
SHA1af0e754131f60738b0b7dfcd37dc534ab3e25bfd
SHA25644446015b9ee312445106fff13e2c82ce255b913a70a19d512bd46af8549ce2d
SHA512e83953aa0fe4658f0da378e850a229ba3566d1ec59f2b9d309381a70c167fc5b9b960fe791ecfe9598248f6492c313d2ae5eeb88c1cd74290ebd2a9baf1bf458
-
Filesize
5.2MB
MD5247648a391cb24ea667a91b678793bdb
SHA18b3cddddef3ecc10fd50d4fe167628402470ea18
SHA256b444626e6a5d277e8c9ec6ff9a4abc1cf93be015486a6c600c7513e5d5f7a566
SHA512765ff13af2065f76596a151e26a30d16e58b213db7af7665226b49204f0f4a583886a92f95f8a02edd87b592192b8c30781bcd9e284e1af36a598548fba92661
-
Filesize
5.2MB
MD53d573e18a4d21e8cd9f7e0c1c55b17c3
SHA13ac078fd3f0be2cc4fe16e102e139b6e67033ab9
SHA256560af8e0c91e794edb85f9046f60068e46cbc1bf44a7aed0ee9bcaa914e11cf8
SHA512e9ae2f6f958b2643bbfa064b71e8881cb022270b3094afc007a0c181710f393cc0a98f1764f4e3374d5fa9d14fb603eee9efc13dd81e4cfd34c42c1a0ae48273
-
Filesize
5.2MB
MD592dae44b0d332da9b8834505b7f370f3
SHA1c8c5229b504bc17988cff9cea4a353e53e236184
SHA256c3c5b3914c66e55825a4ad223f99480a12d4e0a0fda0da3238c93f80c9aa10a9
SHA5121bdaf2c9b35e56e6f1f027e6b26918913a6ec75774873c9f5eb76d314ff1c588ba3a03a33347344526772531cec66a74b917501d1770b00dbac02fff88f4a396
-
Filesize
5.2MB
MD5090188bed0a2cb9c3a8757c36e7dad6e
SHA1e112489461b8363a21e77c56bbfd067fb4395b52
SHA25666d5a86f1a37b8bae6d8af2c302d24d0c59d0c3714a6adac4d3b013e6321e799
SHA51289d987320f5779f9ec069f26b024ca5616d113758e793e268503259a43766821042297932049407eb50aadc0b3d1b2aa962df1d20bbf13f4cc25c3b002512443
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB