Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
24/08/2024, 11:49
General
-
Target
2024-08-24_d132cef95bdb4f09504ede1bac6d904e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d132cef95bdb4f09504ede1bac6d904e
-
SHA1
02e0d7b18ece94cea6b1a22d796127870b4f0b30
-
SHA256
f36782acbb9331aa33a196b635fcd44e087576ea17a5015d21bc3fd855406e27
-
SHA512
46f6837a46184d62c0fca3dccc1bc250433bdb363792ef49c3990994c192b71e3a614c54ac06d5cfade428920d6af0aed2cbb95f36c8c8ec261d8797d56f8258
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_d132cef95bdb4f09504ede1bac6d904e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_d132cef95bdb4f09504ede1bac6d904e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QnOzvno.exeC:\Windows\System\QnOzvno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVmrmcd.exeC:\Windows\System\KVmrmcd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJcpDga.exeC:\Windows\System\NJcpDga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsjTSpO.exeC:\Windows\System\DsjTSpO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjsdcju.exeC:\Windows\System\tjsdcju.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNHmsbJ.exeC:\Windows\System\jNHmsbJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGevnCP.exeC:\Windows\System\UGevnCP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mHjzeoV.exeC:\Windows\System\mHjzeoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AheiUlk.exeC:\Windows\System\AheiUlk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WUrMfyN.exeC:\Windows\System\WUrMfyN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHeMjmk.exeC:\Windows\System\IHeMjmk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UntvrSj.exeC:\Windows\System\UntvrSj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnqAZVy.exeC:\Windows\System\xnqAZVy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmblZhn.exeC:\Windows\System\bmblZhn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FsEEWNI.exeC:\Windows\System\FsEEWNI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzGvFZp.exeC:\Windows\System\hzGvFZp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMIjeFe.exeC:\Windows\System\DMIjeFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOotoxh.exeC:\Windows\System\uOotoxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SosKXFB.exeC:\Windows\System\SosKXFB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TXjMJDJ.exeC:\Windows\System\TXjMJDJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyUuJou.exeC:\Windows\System\OyUuJou.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD508e26bfd5f1796058a72dca95ba93b44
SHA193e7f25a1372830ea726b4338738779a5779b698
SHA256aab9c3aea86fc4c134a50845f701836cca07ec63edcc8fe3b8c2abc78cd189d4
SHA512c55da754f7e1c8ccd2af10b02ce02bd41d1e25be77637852795dc276d3deb48e8a9d8987e32668ab7453807054073e213e9ac7c997f5e4979dfa84cad220021c
-
Filesize
5.2MB
MD5b2a515c90d92752843213481aa2c93d7
SHA1c11583d463257f54b9b91482c622785febdda856
SHA256a08ea59575b01046ce2fabdc33ce84925440913248576d8cb9ad4502915b30c9
SHA51271a73f0d852f439f489aebc7075857e2962956dd5b375ca8c12baff23f87caac194714aa3fdcbb2c65d7b4a4131928e30762fffb2538485ade34a1e91a738142
-
Filesize
5.2MB
MD55a450036636b2eb9bc1a639724f8062c
SHA1202199148b388e4b8f92d81bfc6b37c215ea8a4a
SHA256d3b115ace0fee5e991c9895ba944275394a9fa9399d9fd398b021ad0cfd58019
SHA5126dc181737fc19305833f7a000d0f004a66e4de0c0982e4dbc061cbc3e737f19b8727dfaa0e7cd779c0e44046163ad492ff51d59d419710533be85ab885fa40af
-
Filesize
5.2MB
MD537d8e8d24b0f2f41fc39977ff9b6252f
SHA1d964f19a4d453edb2582d44c008e6b8caa271fad
SHA25684857c927af410371ce942ac313419c1cbdc98d9aa50862a7d118282a2d1297e
SHA5125322c6ae1695b107f9e450cd0c0b0fd715ef857f712abef860c842a5a75a4fd1a8d11b854bebf3a8304787d37e4f6750ae9c83b83b0f52343ccab023dbd39d9c
-
Filesize
5.2MB
MD5be8cfc64a87f3bffde5a700d589bb66f
SHA18a4b727aa5c28f561fcca676f4065e2992385402
SHA256d8db9b565ffbc758e1f5ed2004e787bd7f3269220be86ff685d769e2e3538c1f
SHA5125994dfdf1ecd1cb72d802f12642b85816bf512d6822bcc219c405bd074e73eb851d0743e08926f17ed5111d6ecabe252ab473f18f57e2d14d319f235a1bed6f0
-
Filesize
5.2MB
MD57b5dfeb4ffc1b7f158e54f419625f6c1
SHA10d74ac6ea5ba546ef3cf154a198ca20b21987b3d
SHA2560552701c39923737066a9a2bf59421b9b995808e51694f7d2fe709b7a91ba4e4
SHA51237a08764b86438bac32df8868e97ba1e8da4b2be0e8e83462745ddc918ef55ef4c00efe046d232a949e18a9db9d084ca4447734220d15135597df0261e7585e7
-
Filesize
5.2MB
MD57ac1e3994dadd40735b88a064f85f71f
SHA130dccdba74f3155ecded5c7a5498286acbf3cc1a
SHA2568c09831ac19626f348f96b1c63bbebe61466a5169acc2c23f33934374dc8d5da
SHA512f037479aa8de06c2d4ce2179098a44a2de06225101e35d9c4f8942df0924098cc1cad0bdd5c05b4241fdca1425794199d919574ca7276d53e3febdf1d308c236
-
Filesize
5.2MB
MD55048c336fe0cc6d5f03aa1f3aa633f2c
SHA1c82deb7260fb62c033c3308e39cc4652b33e7a3b
SHA256e1b3d150d57f8ee0153fa5f41ff656cba39905dcf0ba1dc4fbf87f1b42c5ea7d
SHA5126e5ebac7cf48ef3898467e15dcdf61a1b92cbbd8b0229e7a255b6e89ee8ed007bc03a6ecbb13435bfb12d909bbf42de09807bf17b03aeb847fefcb6707e33599
-
Filesize
5.2MB
MD519f5b55f87c7d1eaf70772d3271cab52
SHA190b7faa64e7d3879d259d12c1547a20c40a0bd2e
SHA2562d5ff9dd56401487f90d4f4ecef1da8f44f61e944a1d3f44abb6fa1b6a1d8984
SHA51285ed6f14e2144fafc278f57496b6e96981e069f7960a8c04722ea29e78e98cb9ab91737cc951e25d82499de6356631ab3a3ab03a454e5bed5f720cc11d90a86b
-
Filesize
5.2MB
MD57ac35dc460b81b8db71056045306ebe9
SHA13e09f081e90a867e942f095ac7e91bfdccbd8ce6
SHA2569b878ccd7cf41e636743ad9f8bcc8100a408ffa86f18ec69ae44a744abf2865f
SHA5124a1f65e72d7f905c08f37b090a562cfe9ca3377b525e5fb93e3f0deddd636bcc6afc6ce584c8ade4cff29429e4d25081d34fa1ce64e0b6d5869d5ce22cffe875
-
Filesize
5.2MB
MD59abcdb8baf6e7470941443136379d58e
SHA1a3263c42e9d084d0bf8622a9b486a444fa50c795
SHA2569ca474143e3e8b964d2811486c76e2756913e441fd8c73f5b87f6547c75a17fa
SHA512f7d1ecad05fd67da3bba481f5f60aeea0a31f78d31bd22782dac5f1eb8fc6bbd06011ccce140f2b5051d8447268130a50ec67fa1560d5a03358716c5d207e703
-
Filesize
5.2MB
MD5bec2229823e6a1d8f692262706f3646d
SHA10c7406eec86c30a1598d7eabc27dbb7f7e429b48
SHA256aed1171ea384cc5555c24b29431641b3e3acf8f9cb711b089556aea4c8430296
SHA512d88fe137222d312ff50d009cc4a12823dd2eb68f29303f52ad3eb9719203d34bb52087b2a578ecdf53f1192d153257cfa4c1df1109b08bc8bdd0f6c1da91811f
-
Filesize
5.2MB
MD560eb0c4435fc1b32e4f41ad17f6b6545
SHA120cb5824cd476a302b63a34db96d1896a528a86b
SHA256465cbfd646f00aaca63c1e792b3a9ea80832a53058cae7387879c52640d68845
SHA5128836bfbc6c04d207b2c8974e0c65980309ff5ee5f2650f5eca692ef2d8ff7a4afe91eb45ebf8dcd0d28859e07297cfd9d2ae7737241e1ab3f30503622ee1cdf9
-
Filesize
5.2MB
MD53ce6f2d0d1d72033cc7cfd075a3391a5
SHA10b14764633b126a018bdea340794b6a36eac5f23
SHA256c4fc41a181dd855858319ba0cc75c93daaf5d7c7b2146720f8cf54ea046e9f2d
SHA512fb186f82ba6a56514f131fd6876aff582c8cf407ce9acc5b8d6c2b73c4046e089bb875ededa2d921fcffb16afbe093965688cc0fd40fb98a914070810b8a66bb
-
Filesize
5.2MB
MD5fbf932591b48e9927839dbb624a2b774
SHA1f0176b395e9de378ec15adad231fb13fa3bd642b
SHA256a912c87194e515e5d40ddfb779226e2ddebb146e85d765ba3f75028991b68c1d
SHA512ec3872e7d4b1512304b88505049840724ab71b1ac578622ee6be9c26fd3579b650abfc5f5bed361802b6483d4375623e0aa79fc90af656ce3ccceaacf9cabd2d
-
Filesize
5.2MB
MD57e5439ebdc1ae36958b6e0cba7c6fd42
SHA178dd92699730491bfa141dd57332ae6a59b75d9a
SHA2562f0ac8353dea4063d03b6673918606fabcd07614e06d81228100a7d433ec0750
SHA5129eacba4a025382b9be9cf059ae74667c8871ef2a3bf7b947633aa431f6c78d53699286f357e1180df83011f3a09a9f3a68d423a24f1df6601b170f70fa80139d
-
Filesize
5.2MB
MD5411c99640cf2e6fd6cd2512f8e1c823b
SHA10f96e9712818bb6dfc651e0aebe2737c1d180f85
SHA25606fbc35d1a1c3a82e7e7750425b07b4e75265192c39ad23c40c0978ed3d8eec4
SHA5121f13e4a235abd03889f896c8282f15d4d025011a12cf0fa0cd52ee51ad477a385be46ce6796cc9682b150b33533e952bead2d367d683787dd0fabf96ee12a05b
-
Filesize
5.2MB
MD5c7daf59a04f52a1ab87b3c4303f83b84
SHA1e6b09fd32adfd7a84d34e5df94d49963c0497abf
SHA2568cdd84be5e05d57a7156e7a845cb0420fa6411f157b25df1ef9a94c650549560
SHA512f8344adee3e1f568d40589cf4900e6b4c6cd0cee16cbae5916b98c14793f798558172829b0bca5438af3cef9d66fb785b0e3938875db7e8df8a541f3e320374d
-
Filesize
5.2MB
MD5a9771353d1b5cdeb00458fbfaaa2fe00
SHA1a116d08869616c2fb3bb93716f72dbe0cfb3ece2
SHA256a99cef133bf04d2135bedd91661e33cb171eefc20a8d40ea050666f350981439
SHA512cc09c1b17b3255e7b1957f176089890e20a739162e34fef2538c1f795534a7f8ab97034813108b23826f83727b4033cde0a30fca35f0e37bba8464919b99f831
-
Filesize
5.2MB
MD5ff351c08d7e1d970e66e4119491110a3
SHA1fd448fd7bbdaab413a9ffffc3493b3adced431da
SHA256bb75300c87d8b7dd4b8807d15aedc8970330d30b1d662a2b048467295ffd4db0
SHA5124dab23fe16b4d6877194a2b39373eeef5dabe618d907737ebce463593f7b59943e0452eb44368a505170dab498533da987b6ee217afda4e9370d579d6f5382f0
-
Filesize
5.2MB
MD58d8693f844889f32087316ac81bc64b3
SHA1afe17747891f1a2e1780baffab7170fe9e0041dc
SHA256572d4bd6e4ed3eb7346b4e4567e9b9bf57343251a776fb6ad36d9b24bbe7369c
SHA512d958d672100f5f274f8d96c88a007d27b0a8b8c89612b5136f4c465a1142a7d21bce05bb4356ac7645d7a8774a83ff83def07a6272461743d409c041c26662a1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB