Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
24-08-2024 15:23
General
-
Target
2024-08-24_1359f0c496c387b7162f5c39bb07f72a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1359f0c496c387b7162f5c39bb07f72a
-
SHA1
0b67f1777cd3cbd63b70fcab5d525bcb5336cce1
-
SHA256
b609f999a15b80ee840afd5dbcf54c32791f0d7ba768d58dcf2e1a74434db3d4
-
SHA512
520469698d460038bff949843241c7a217b4e459276650adf729fd24090e851b03a8992163c94676274c14e1afc150c63dc013aa14e6e47eb51e0c5e2ee66f2b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUj
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_1359f0c496c387b7162f5c39bb07f72a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_1359f0c496c387b7162f5c39bb07f72a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\duwWumD.exeC:\Windows\System\duwWumD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzdShtD.exeC:\Windows\System\rzdShtD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FHmFZHF.exeC:\Windows\System\FHmFZHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dFafgDy.exeC:\Windows\System\dFafgDy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WRRsaGz.exeC:\Windows\System\WRRsaGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGZbChJ.exeC:\Windows\System\tGZbChJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVjqOQh.exeC:\Windows\System\TVjqOQh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yfRmYQa.exeC:\Windows\System\yfRmYQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPibEtg.exeC:\Windows\System\GPibEtg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IBYTUfz.exeC:\Windows\System\IBYTUfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WDfZeuh.exeC:\Windows\System\WDfZeuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CyMXeRX.exeC:\Windows\System\CyMXeRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSmjfyV.exeC:\Windows\System\lSmjfyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKstHSb.exeC:\Windows\System\fKstHSb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cVpvpuk.exeC:\Windows\System\cVpvpuk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ygERzxt.exeC:\Windows\System\ygERzxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsbfCNp.exeC:\Windows\System\MsbfCNp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TnmxvDC.exeC:\Windows\System\TnmxvDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVDAlLn.exeC:\Windows\System\FVDAlLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cGIEsae.exeC:\Windows\System\cGIEsae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RSJqFvo.exeC:\Windows\System\RSJqFvo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f7d2a5d63d2c0a287e2251ba1bb853dd
SHA164b92c151ebf778e3789579b66b988c69ac46aa3
SHA256d498f2e3f57e1ea64cc7cf9a01c0f9e7bcf4d1ccb0f19bdcf2a67bbccaee3f4b
SHA512ae8a59502bcced4b8a42ab45514e384d61d5e69276634400eb0e4e62277d87d97e2bf2d2399f4305fd002ed8ef3ec67ff067dd3d6302577886752eee000d2011
-
Filesize
5.2MB
MD5937f61feb205e21ffbc6aa2821733a1b
SHA18ef701288dfd8babfaabcfde6f17e5c0ac34812e
SHA25640a9b4a83733c365810278af9ffaff8ea28aa55b6b52e0dd516f57b0e6d3fff9
SHA512799591fb036b44bcc18a92e2ae002f3cc90b42f868f19bc215423a129ecdfa68c7d7e2c36218ba199b2e00d1efdf412bc845bf9895acb20bcbfd45f641862ef2
-
Filesize
5.2MB
MD5af4602b44a4f0adb71eb62ce0c77674f
SHA1b68b4c82ef94c8d7ebe617f70e7a9b0fcc3a230c
SHA256f3723377da529c76d78a795384e13787eacf9595856030ace08d209d74b2ee5c
SHA512d93d89ee44c1ee6a3eb1ec24b25289b3b4b357c7f90ad96bb0045b3443c55657d93c65221adf26ad9a39236eb712ee8676e9bf35d8fabfde6e4ed8ae3bb129ae
-
Filesize
5.2MB
MD58fddbc22505453fc03ff80abc818ddda
SHA19ae0fbcd8d3248cad8c0adca6a38bc5aed0a0de8
SHA256ad01c27c80e1f2f4285f38198e4e1684ab5166b4153788d703e97371d150dc3e
SHA512b8e0cdceeb7acf677a9839da546c0fc2db421dfb8921e270db67b4a1718223b413b3758b19a3b0960cc0c87a6aeccf5b60e98ed0672ac5022c8e23d49513f801
-
Filesize
5.2MB
MD54c8936d939c935d8c6841198eb087848
SHA1fd330266fa518a1c2dd73a318c61369480a3d984
SHA256206e11e52b634999109f6a553679f480090906736fe216832521e390943cb32c
SHA51201e70b6c761edaa53be26dea9a07f0c5666043ba4d1a5997d82c4d70d5cff2c235cf9dde08a3f561c87bfb1180cc40f09a2c30e45f4dd56619210514c7debdf5
-
Filesize
5.2MB
MD5e7b365b3c32b0a0912f1655c9cf4b54d
SHA12cef207f905aca8c0256446112d6d03b168cd58e
SHA25602ff90d751c39a020a9c402f1a0cefe6d327f094e534a9ec128289adfa44993d
SHA512bbbb07c7db99dabd1776163367a4bdc29405b70f4ec9792be41cccc3c60fea88afa1716c5e2d7318a1f8d39733d81da0714dec67a2b38e9d0422e173cb7ed5ad
-
Filesize
5.2MB
MD5e6bc52d4f12a7c9c0b6cb3796208d89c
SHA195d64cdc8f0760ed936c9c2e9e45f6b20d10ec03
SHA2562659dee3dad8a12dd43e55d2f58d7dc66592751dd6366d9604885ff004fd6a75
SHA512496d02aa1be7be89839a67821c908e5d01368509d7f583a26949e1689c5873dcda03654b6f7fc71b2dd4bd1ff62d27aff0af4a286235647b9b391a2334b150cf
-
Filesize
5.2MB
MD50a37a1eb03639bc40a3e00036ea229cf
SHA1b5d97bba6948b3fd787a2042d0649208d2c3a7d0
SHA256b1879a718913990e4296fd0dd067684ef1be83fc8916eb0954b5bb72efeb33a1
SHA5129d697887fe8625c1ef415dd58f15ed6679005b862eb48eb5313e3cd34f5be2c14b861e7d2a7159276528ce966526a1f818f1c86ad87b890ad50b481ac099f0b0
-
Filesize
5.2MB
MD5d44738f9ad994b133e33b039902261fb
SHA17275ebe769a75a5694b21baed03298cd9207cdfc
SHA2563ecaf80fe708e59e7ee82cdda63453a70b1b533a9fcc1cd199e61ca1f7486bb9
SHA512a3e731455c945215f99c20ad43e599b9bf24ee9f924a1234e405b0e5edb4800807394499f8dbbb0672227ed9ef34f34b6724cc1bf58a5b1614feb3c52e25bf21
-
Filesize
5.2MB
MD5b8cdf16c19aaf2c8a4d7203c298e5482
SHA15683c29b3503017190b509774223096c0c1ef1f6
SHA256bf6a886e12afc320cd33fa3ddc12462b1e2c961fcb286f45d927a7b8c6526632
SHA5124710d454ae750e4988bc5ffdb44ecb22d687e521e9582848440cb380ab21c941eb66ac71a6ed7ce8098fb8425bba6e8d6610210fe06798080f5f49e73653e0db
-
Filesize
5.2MB
MD5b6984c35e53d3fee2af49120e01eb696
SHA16d4e72111a65fc60e70d5767ac06c74b3be0699d
SHA256e51ead213c4a61b41e4127b2aed03658561dcdfb051dd83fea38d12220c556cb
SHA5129c584d3b60ff7ff521278447034170151c3720780cefa20eed18c97f9c700f4f28e6ef5909b9b364a1d5da213947eb366e96752b2456cfc07058d76fa1aea67e
-
Filesize
5.2MB
MD51894449e548cb4ca01f4215a9471cd03
SHA14c427285af8e6af0b40da520d240c2b1e54f91e4
SHA256dee90f1e8b57a5e2aa53713e3abe2667a770245c7e99f44db0d68f7e397bfceb
SHA5128f1f0d5c7f18f028dffe2422e500f88f1b7b10750a81f6106242434333b77d26a59859e5cf3a5285b50d6c4e8edb27994a2be7b500195ad183603c5e9996142b
-
Filesize
5.2MB
MD531e1c7810884c09d59a9fde2d2c2944e
SHA1537de89589738c3f4907781f30f7e2b1a426d7c7
SHA256b605d27e191e2e029820804406c254399b8f8a02e9889089bcd4e30ce9bd4d1e
SHA51278f093ce36759dd189eea2a4fd227a694d99f917b303e941f52548267976ba5df7a99adbfb61ff5734338a84291a3922b084d237947621c339bbb7cc266eab6e
-
Filesize
5.2MB
MD51e9736d915c1b98b51cae769401be016
SHA186480fc9f2897e1a962682991c5d58b413634741
SHA256259239d3bc77a0ae9966c790f97df37d6b5225b50306139ead3694d917d3fee3
SHA51279da1c1376b9ad23f42ccc1cc71f8094eba50ffa54ca5d70a8b269afe5fbca47ec311b3fa3a1ff7bb4a9297cc299081ce5713b52dba10e1f6b4397f6841161af
-
Filesize
5.2MB
MD5abfd9f306b820d1a3278a16b13b86801
SHA148ac6586ef5bba1c43bd59bc381a2b20458c075b
SHA256b222144d348dd77c7dc76617cd4e13da98d2b84ef2909a544346a578512eec2a
SHA5122c5101e827ea7b14ed56043aca8d3a795b44338505a7a7ae8ad33ddb05c0a54ccc5a8e8f514d93e485e7856a239b6e973a70479adaea6ae29fc5e21cf1bde10a
-
Filesize
5.2MB
MD540b7d55b8108a723dbcc630d87b49e92
SHA1dac7be59e0c0741eb3f1dcd7bfdb45d0100beacd
SHA2567a48b30b84943081a43bcd80d456248fa576f97bda1e8dfaa20c23f4a493fca6
SHA512257166cf3571987cdf598d31ab4269da8561a615016d439d5c20fc34a39cfcf1342e7b7126751d9bdd1840053e4063c1e90af1a8eac65c69ecb4766be7d6c3a5
-
Filesize
5.2MB
MD5ea3a0a9ce3c5159acdcf20c3d93fdc67
SHA13e6b427329b5edad60eaaa9d2bea4dc04b167eca
SHA2567b5b2ee932ef627f10d8f67b30bf7d938c9d79029dad883e18d2be3aefde081b
SHA5126d30edc3e18470a2c3fd9b7972673b6c84136e07576e5f7fc4ef073bd846dc93857a83c2eb648a0d241307cb2421970ad31b69478f57e32618021beb71457317
-
Filesize
5.2MB
MD50fbcca2d5955362785c453d71c67c3d6
SHA1bf3308b5e46f22573aedd50e968d2b7933390865
SHA25601cf41e5f4ed4acef30daf36811dbe608c8255e19881b610301c28a47895b8ec
SHA51260a590ec37606bee49159e97b4e69f20459ea20a9240724a137cf2ebc774e3142371d474f293d1e0ba4b36142a28e87b893ae79aa4e73f7a1224704b440b0ab5
-
Filesize
5.2MB
MD5f5d2d639d9320bf386f285bc64d1f5f1
SHA1afadbc1b0ad0c3d811496ee634a732b24a7d859b
SHA256dde5c2c1453d587a7d1d7f8d630b4b03bce39df8cc154326029a150591dd230d
SHA51277d6bfb587830ddd6a061377e8da10c272dd07a766251a7a0fc5e47e832e203a07191b60cc1758ee12f03e511197c8dcbc1f4bca44948dc22ae9c9eba1515079
-
Filesize
5.2MB
MD5ca37ec76a4eb48bb4e14db9d29907b25
SHA1307573a8dc30d4ad81551e5fdd8a63f291eb3746
SHA2565930fb4bfe224bd18b2cc64459df2ca6fb7af508c5a4e9224b3fb8c1230adf27
SHA5120667988a3996a01127ea8e0728113533074d655d2d550a5393dd36baeb9e54ddc445ff88e1fb6ec74d01d1abb21fa785280e86d31f1a3d773a7b22c017026bb5
-
Filesize
5.2MB
MD5b86050017607564857918230dbde5995
SHA1f2b334615e00cc962f539a48a00499622586b30f
SHA2560a2b71c3598a7e5ae8f11aa2c4e98152b9122f4eb1e298e93277030bcc205f57
SHA512f8d800166c08b397ebe717699649f0c1b9823e4d7715353b20a2ea56a4025920d1910daad7da68ecf536703ab23412a27babd30b7372190861505767706bcc01
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB