Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
26/08/2024, 04:30
General
-
Target
2024-08-26_ab5b82e49f448ce08e1c068a813d3d93_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ab5b82e49f448ce08e1c068a813d3d93
-
SHA1
36c2515c5a4a3b6249725215bcf3bda3a72644cb
-
SHA256
148160e6bab4f0e39748845e854d5b6f88721f42f3009f1f924e8801d2ecd78e
-
SHA512
d1cd1ed52fcf3a9f93d04627d0401521f162ea2d80b0a8674f34b941d7f22ea4dc931e3fdf5f02c927c980a80519478986650d00af28e00d803a7367795234b2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUa
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-26_ab5b82e49f448ce08e1c068a813d3d93_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-26_ab5b82e49f448ce08e1c068a813d3d93_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DdmtAwa.exeC:\Windows\System\DdmtAwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLkYMDx.exeC:\Windows\System\RLkYMDx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZfvSop.exeC:\Windows\System\fZfvSop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nwQElZk.exeC:\Windows\System\nwQElZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYExOVb.exeC:\Windows\System\yYExOVb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XeVoYCi.exeC:\Windows\System\XeVoYCi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQjabhD.exeC:\Windows\System\EQjabhD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zMDfbwo.exeC:\Windows\System\zMDfbwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XjDHWJJ.exeC:\Windows\System\XjDHWJJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weoqQUp.exeC:\Windows\System\weoqQUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qPWpCSO.exeC:\Windows\System\qPWpCSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQCwddK.exeC:\Windows\System\hQCwddK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coamjMX.exeC:\Windows\System\coamjMX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwSGQCb.exeC:\Windows\System\HwSGQCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbsIFYs.exeC:\Windows\System\SbsIFYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RceSdsT.exeC:\Windows\System\RceSdsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GkhTsbJ.exeC:\Windows\System\GkhTsbJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vOKpdGh.exeC:\Windows\System\vOKpdGh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KvdruIJ.exeC:\Windows\System\KvdruIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yLsBUgK.exeC:\Windows\System\yLsBUgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\McJMBwy.exeC:\Windows\System\McJMBwy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53f2610effcd6e1b5081f3d10ca606e12
SHA1bd121fabf4dcbc02f7cbdece835ff0d58523b6d5
SHA256c56030c8aa53b739230f7f70de72b24f4449313d0cc305c95e9879f40c59c76d
SHA512cf97d242c2fe372c3de753648702bab72bc60aaf620c8c1683ab236ddca94824a083c0279eaacdf0d083d7404171425c0be76af961fead5e0f22071ffdf9600b
-
Filesize
5.2MB
MD59b7b5b5e0dc6fec7c0c1211db986b83f
SHA18abdd5633acddb9a74ceaa0ba007dcab42c2d3ef
SHA256cb27377f9f2815cdd2f697f8f38a77ec37246cdb884910be8c19382d8432764e
SHA51269173d64b806f2e079febf86bfb9fc5958f8d27a22c3d64c438a0ed831147425bf72633d598b88881745a10ccc3aed594eac328f54a115580931f02b5dffaaf5
-
Filesize
5.2MB
MD504d12b45d2aa3a3f66b2dcbd629c4db1
SHA176dd0aa3de43e1783ccf7ea1df53ed1b242f2b61
SHA25688284631eabcc46a1488698f5aa994b4df91591431b1a75e9f657a32de9bcb4d
SHA5126fabf515e1ba8d5896c1b391809a36f78c3f9fb1ce000e21a293a31560df4f0478d47e051d048ca3438a17c8390c210b7edbd59ec4efac4c4484b875fb16f998
-
Filesize
5.2MB
MD5af68ab659be1f0e21080b74428958221
SHA1f50da04e825c25072a03416da8a991cec6d40842
SHA2567bccf0849d93dd40895c2af1feeff54e09de2eeb63e2e69abdbe4ad8b8c4181c
SHA5121ab2b79a307a52f280eb743ab980128a31d78b67f4fff43adf91dad0065e42f861ddb6f9ae30f36d3f2385fab958293b13bed99c2dfa5618e5fcd41525b01ac0
-
Filesize
5.2MB
MD573198335bc79bf6ce0bc5b5cabab86c5
SHA1617584ea2972e2b2d3129bedab87c497611a623e
SHA2563c5b1db9c95c8555d4f2da1059c79afbf856524484b532d492ae189a868d10a5
SHA51288397ba542a3f38e45f664500063374b7326b7410cbf4e1eeb2d5c144d1ae0d453b2a7ac9d51698b0248c2fd6975eb1a538bd6e2a9fd1e94ae8f580802a14f34
-
Filesize
5.2MB
MD50972dddf853303343096fc129ff82fbf
SHA17aa65816daec58410c3609fb38f7d40ca86e5310
SHA256fd85d629e82927e83f25797cd25f9dca3663cf0f03709744b146e212e8e6d883
SHA5122876c19cc21678fd04955c37f2a4821ce490d625acb77e40269a36b4c5fc72ae9b9ed776e0e634f1878edaf17d3b7fe80d62596edc24be1036e1e224ff574488
-
Filesize
5.2MB
MD52e6d12e62d39c176a4877e5c30c50896
SHA11e7e491a50218b097abfadcda6ad2eb8ccdbac82
SHA256d5aa511f8a329251cc887bceb33d443b0db0367602243460157c5569893c7fcc
SHA512eea780d670962e325bc774755173907fedf8f61c0d185c33c9cfcfd69f4891a60ff6d01611c4cd40e3f01ee1ac84618f2b48e1604bf50f03f261a4fed67aae4f
-
Filesize
5.2MB
MD541c3d696ae525b613cac11c5c74f96f7
SHA1c96525bec55ba65a9fb0863c5f1e639c5b395708
SHA256d663255463b0bd6bf846dd72668aebc5897dfdbd701b9133b387312796499be0
SHA5126caedb557b97adf6a91d8615254e6fe948556af52dcf6179d86b41f1c3eba8a2867a633d1ddfda4cd8c6d98c50468803861503c8ee9235dcc0cbff74962a489b
-
Filesize
5.2MB
MD5e82013547061a065b0142c851a246fd3
SHA1a0827616c1aaabdcb31059e0517df0f723dada2c
SHA2568bde52038f475aef272a773a82f40c83bc18be3eb2a059cbb2ca842da5c42fc9
SHA512ea9e9b15f592326779d42de658e4269ea0493c815ffddeee42a62eb9f04ffcc79efff76ea47a9b14f5954b8da798ae3ce20bec76a47a808f0c5e025a7eb53481
-
Filesize
5.2MB
MD5d988a89e8d5b5c47c440dfebe28b1ae6
SHA1e269d7883b70bdb8fc7da446709d1161a603a35d
SHA2562c7cddc7ba75c2ca5457cc29b7f9b48c33837387b1245c11c55182f5c22edfff
SHA512ca8a42447a2f4195f55dd61a7e38f468370fe91ffc5ab0102835911a9b7ea963015c606bf995a7a873498c6773b76bf0bd93bec8343572d9532db627741ace3d
-
Filesize
5.2MB
MD5c907a756b41dc4bd97603feb1ceda63e
SHA138fd7d763c026219da01caddcab01e4ec134b8a6
SHA256d57c1feabf8fc29720b4a9b048c7c9737004878d594cf6679255b51812ca74ca
SHA5123293e6da6427afacf44fd622160a137de7f551083854cc3839a1e0db4c086f9b16bef98c49f8b0563f521c65225553fca48f0c79c022e58cd7dd7e70d1ff498a
-
Filesize
5.2MB
MD54d103a99f609588c69f3e8ee1f6b8795
SHA1412e4fd3a35ffd1f4fddf1458c370f7a0d2da0fd
SHA25696c2a30c3178aaca273e8907f624d7adfed9c3f3376b71bf920e2586180d84a1
SHA5122da00f2321fa4c2413b68e4d98a2e79a4394d92c91335e0e71f46892248b3b187d3dff419c75a530f5b40465bc42a5685b183fc279ca51721a0d85092961109d
-
Filesize
5.2MB
MD54df98f9959950820f023ac2be6457958
SHA13d44431db55b556318bc9f043f68cc5c49dcf272
SHA256fab86fe5267e5039c2b3567e1208839ce1b0c438ed6722531a0816471908a2cb
SHA5128ca9ae7b40899456a1adbca06d06b75d63cabc7707c2d631305ac42185228f0f70d706499a3bf09263adf3b45badf716c18229b51cbfd27dbaf717eeef81fc80
-
Filesize
5.2MB
MD5cdf6624f2bee642c162d497eb1e5359a
SHA1f8e5f337329085f265ff9c48bf663c964960c5ed
SHA256ca3c4a00c21174dae9bc5c9a452f37e3b54846407c9d56143f997941342bc1a5
SHA5121b00b3c219468572360d2b02dcd92654ab748ab0cb24de4a21c39f2ee1c2c7e1195287b432c751bf3d33f07da4df8615285277ba6060ff288445562d209bcf93
-
Filesize
5.2MB
MD5ff3828ee36c009eef33db6275c76b5e5
SHA1b748a2955d8e39781d35fb997fcab53b868a757f
SHA256075ede5f2f30980921039f570191a58a493898b80e5ab2a37e35a70771704bce
SHA512de287fd31df8845f3805314efed798d685f50b109b134b73127d57fd1280fe508bd0a6b88aaca182eac971beba3ecbeba5e1dd6180608c4a5dac539a6cf99aca
-
Filesize
5.2MB
MD53bcad0742ca4bbb4e8e9843b6906f1ee
SHA18940968ecc302d3115edc1d0d69b0d2b6a375f29
SHA2560785d169890ef7ff69a82fabfc77dc64580f8bc90318f6c47105b8b03492f43e
SHA512d57d32cd734457939445e2026c3f2f078d326183419ed7a577d9b0654c3964b1b8d3c501753bdd4af8c2977b309464c362daf638e216c15d8f9d9d72a042a9cd
-
Filesize
5.2MB
MD5e2756940f080f0780f739b76a96d332f
SHA1761573b215e69f7e0e828b9bad0a85dd678f454b
SHA256d8a5de5f07ea44083989f047f7505b06dac1428605a3b950e0254ce700bd77bc
SHA51297231012c50fbc52af5165108d323e9b19d9ef9859e24e07f4bae95cb4bc7b493b0c8a957e1133a9f6bfa87c9d84a182a1df0cca55c14469543edfa340ed7f73
-
Filesize
5.2MB
MD5768a7c59ae7073c14354dce8046d1f43
SHA1bbcac4658a095a94042d927da691ae77ec492113
SHA25674ea7c4f77642327ddfc098792e1887c2f1894a87d3f113a623b82a3598ea7b3
SHA5122aaa8ffc2100ccbdbccdc5993e9dec359b95233ca8909aaebc7f531dfbf6a4b8fcd998c6e80587805c3da7a05b3437616a280145e95531bdacd4159d09221745
-
Filesize
5.2MB
MD57893cbfc8f8a99ca0ccd75d11e4121e5
SHA1852602bed8a3ef549d3235e350f70acf71a94f86
SHA256a6905ee47e72a115f368fe4cc92650ef413912575a9e7857792245384441ca3b
SHA5124add7be39dba8e6e18b2103edeec919a44a98b43df415912d284a8ef2f9b6f04f99876b68417e2ea33cf2329a9261070ef6bb4d908469aa6bc5bdcd8f5c50661
-
Filesize
5.2MB
MD58e1841e18a106c4010f8eed5fd082707
SHA15cc01d77fc04a1dbabecc2adcef78e7290c4662a
SHA256731df52cf2988f2762e57438d5ab6a5b437b6b5cc282ae766bedb75b2dd4891b
SHA512deb2d6b43674d96583e050d174ec26a2a4fa7e5ab987829d23a3865d29f6e7d867fef3eb752efd8c6c0e35d6fdb0f8bf8fe3425877b62c2501e083cf579860b4
-
Filesize
5.2MB
MD5ad3494193b7317c8e8574924b695d05d
SHA1442d94b166c4b6e663b7095ed0564d6033a98431
SHA2566aa51e39f30c07d721dbe44f49dc4aa61dc32484cffdd592eaf84300c2806d65
SHA512a1c57c178b69f76b4f5d9f284870ec559b014da215c894d78bcd15ddfd15c16b5ae9ba09126a9b59a37f89536aa79e8331f9c08d9d7b7711c88f3717b3951ab4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB