Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26-08-2024 05:44
General
-
Target
2024-08-26_6d5d69e2c1eb889ea3ba4b489e06834c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6d5d69e2c1eb889ea3ba4b489e06834c
-
SHA1
2219bab915842b73465769d4c2da56c3aab5c1b5
-
SHA256
4c1a1079de20c17fba77fbb458bbf2558f03f7259f68ef53f12168b130331a9b
-
SHA512
f8812813517d013f899a02c083d510e30816092cb632ea55e5db2835a7b6e2b8f5875459d3069a7cb8f83b99af0c62ae202dbaaa91adcf0f4ea385d6bcd33a40
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-26_6d5d69e2c1eb889ea3ba4b489e06834c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-26_6d5d69e2c1eb889ea3ba4b489e06834c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qyAGnzp.exeC:\Windows\System\qyAGnzp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBvYmtK.exeC:\Windows\System\bBvYmtK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sjfPjgY.exeC:\Windows\System\sjfPjgY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMbFSUR.exeC:\Windows\System\pMbFSUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhtnlWR.exeC:\Windows\System\uhtnlWR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhBoiQi.exeC:\Windows\System\nhBoiQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FnZiqte.exeC:\Windows\System\FnZiqte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oXutBJC.exeC:\Windows\System\oXutBJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bynjvBQ.exeC:\Windows\System\bynjvBQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XWBcQir.exeC:\Windows\System\XWBcQir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\usWSjva.exeC:\Windows\System\usWSjva.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fgarldZ.exeC:\Windows\System\fgarldZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TCZdGCh.exeC:\Windows\System\TCZdGCh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NrXjxEQ.exeC:\Windows\System\NrXjxEQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LswqQaF.exeC:\Windows\System\LswqQaF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUzGCOB.exeC:\Windows\System\ZUzGCOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiphkpj.exeC:\Windows\System\hiphkpj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txNgXMi.exeC:\Windows\System\txNgXMi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBuPACw.exeC:\Windows\System\mBuPACw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFvUmRU.exeC:\Windows\System\rFvUmRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsoTjva.exeC:\Windows\System\tsoTjva.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50e0c8cc8093a9cd69448414349fae6c3
SHA1823354a83e9800e182b3ee5475ce8f12cb6333bb
SHA2564f5ae3e492b0e0f624bdfe43ba8e097ff8a089c4fa2dc7e02971b05d8b3ba279
SHA5123ebc85b435642dee03c771bf7521cc25a33812e79ee5642b3028b524445488b650668b3ce003e1dac8c0dabd8fdb6a7cd16ae9fa7fe7734d25fbcd5e1b7ed4f8
-
Filesize
5.2MB
MD59de7f40bdf5866ef7620e60e9bd9b163
SHA105ce64e8f3e2ba0376dc137068605cd47533daf8
SHA2563a67ea23be205223fbb7bc9cfcaf631007e29d0341b27c5bc0ac0526376aa83f
SHA51297e06dc1cf1ba9aad5ce9a650ac5166fa547ce526daf203555cc861d9f8e61db026e4d5f5c051386ad41247930a78b2595b945177071b399afed8454a7b34049
-
Filesize
5.2MB
MD56c4006a2f69ec2710c28e37801083abb
SHA1edeb18b7ab56dfeeed2cd01a4dff7ce3ff078d7e
SHA256f1a25c2c033b3ecaf4a21959c49fe2740fae22eb0b87487516a32e4f28f86c0d
SHA5122531c0fd9ab9c5a700e4dbb0545af11e109c69d5582b3b698c07068a94143d4c4263971006f7fc8d7e8485f20afc8b0a1b82405dee94936982296f86bddbd634
-
Filesize
5.2MB
MD5f8abfa7443357ad969524351d520444e
SHA1a0f6ba547b4615e136ee22070e65a87aa8f45e7d
SHA256ace7cf497409bc5d6290b2d51a286f7fb5e0b4bf95f191df2a4317fcbdbaa9df
SHA5129e742be4857a4e3c2d828d62ed46f1ce2246a233e9a3bfcefcedf8b4b56a2a1dbc5caea63460cc173085d7d22a757d30c1eef5f2d3958037e1940b225f26725b
-
Filesize
5.2MB
MD535b2c54ea0536fdb1d4d1499c977667e
SHA1825c3e137c916c66e0388525eb2c7b3ebf3e176d
SHA2561b0f07781d9fe3c669ce954a11ef4c3c2e53f87d2d75df970a9c279424a87b28
SHA5120a8d4c7a13006b3dfb409dd39cd7abc1911dca80d377076b5559cecfdb3c3a793debb132083c83f6232e12796f74993a77a01d2fa66b09b64e65685830292112
-
Filesize
5.2MB
MD5932852902cd919bcb56d95abd2706f24
SHA1408d264a7175b130d0e10c7636bddc91e4253a91
SHA256ed12f176d76e09048cf5a29367fd8c3fae7e43c24dcc8ee6abea9e515e2a7e68
SHA5122daa725cc1092655fe429f9b9c6027c71b0c1fff88854e2d6594f014547ab32a56073c3250107981f6107fff5b3dcee00ac663a51ea67d6b89a2c1d3808af279
-
Filesize
5.2MB
MD58fee1c6b49fcea01f6bf6039964ba93d
SHA147592c0f5ad8e4be4c0dc5b7031d30d9fe69e0e6
SHA25681f3e2e66d82d832102d849edeaae9e0328e5034f630453ddf6556fca1644995
SHA51291b5976f341bed4e373b8739da25bf05518ea4d17f4f4bae749b01cba16232303210abcbec8847a92f3158ad67fc23bb2c7af9310c271c5930db7b7e505a08cb
-
Filesize
5.2MB
MD528a6173a8e8dd8459bf884ffce66f235
SHA1486b017266d955c2d1f0cd50e3cf023a1a611dc0
SHA25632513cfb2f1cfee5e4fd2d841670d390cfeb292b0a4cf610ce10669379ff116d
SHA512053a61295a0970d9c9fb9c50c65727e7df3d93358cb8b85bd85117fdcc4595e157ae8dd3fdd6102d2a453ef323673641b778c5b4687523ff64891b9e6514d697
-
Filesize
5.2MB
MD5bbf5d8448a37523c925161f4ff4a3596
SHA1a2e8e957d4d8188d53a5174ce82d9b1a634f17d3
SHA256a0d3812a0a9780d50ec8b4527612ea7090b400953e82bfc2c689b8cddf7dcf64
SHA512086f3ffdfb74af434a0d7c4af75fa7ba5826b562a8a46caf33764766a4ca12a71b094993d48dabd877ee8054ac0a5cbf6eab0f5efd4775c59e790fd7663b22d2
-
Filesize
5.2MB
MD52d9113696035cd8a3338e93122a1a4ca
SHA157feade6a6bb48f6a868243dfdddd0a8d4ff0cc8
SHA25607edec27fe43b7f138e92889c47e54cd1996afe1782863815b815a13d2ee4a05
SHA512906024da7c98eeb3c796d1386ead8fd93f3fc7d0d5a0e64c7add9c96d4d8d39af77a6be15f73c2c273110d7cb1e3070c4de32622b52c83c5185a647ea8976d08
-
Filesize
5.2MB
MD5b8619a63ba995ba0873734c0a965baac
SHA1102adbd34913e885cce32e040637bbe324becd05
SHA2565d683773e62dfe90b264d5caa947cde705b51728ae08efc3c634939fe2157566
SHA512c5eeb02415802b7f57b5e122812a6fc6bbb155eca5514b7beab44f0742b15e374ed4e9859b4e80b650fa71cf445ec7cde0d3c9779830da3b9243fc8012fe176e
-
Filesize
5.2MB
MD5fe15f77750c9adba2deee399e656162e
SHA1a2d1e1ef55e552cfc8675e64ac892f8160a36791
SHA256479d85a552eb5b63a1d20e86151d4b9b0788aedd58933de518807923a32a93a9
SHA5124955110eda939c703ccebc1b7e06641608c4842e57a21c285e3b5870d744666854c1f7357f68b32b9854dcaf7f40b5b358828eb332b1371d47eacb05df04c69a
-
Filesize
5.2MB
MD52413336d83d69064fe1f8082c9fa5e8b
SHA14922015c25d4597c2a968bad2c959fce3920e25e
SHA256ad05903e27cd8d38a0d823062d24e15826ba6142aed7ea6c613ab73dda4fb522
SHA51250ea3fd057aab2f93da7095376a900a214f19286e0e0e52cd4abfdfb3a1a6be6c5d0513b010c40a45541359050b3bdc442103acb0da12f67493104366be316d3
-
Filesize
5.2MB
MD51c672284ab82b3334d06ab09a293b942
SHA1a9c4a0914ade7ede1a7fa891964f28083c276433
SHA2562e424c5fc84c615ba793281ee6feb4a878649aefa5f1e72d0d946f81263259ee
SHA512a0bd81aebd28787a1139100b550608291e6cf2c3bf7e7d0ac4ce966cd54b1705f767c4a1452748eb748e9706fb84c399967d6cfe851b2aff72d8e3c8d90dc745
-
Filesize
5.2MB
MD520d243728fa2b2d33a29c139ccc41c8f
SHA1d93a030d0c7740db6db7344bc08a029e0c8194a6
SHA25674d39420a38e259bbec81f14e0eea2eab449a4b8364be77e6c5f0e0213ecc8b7
SHA512d1f4e3f3cf2f074e0b9dc37ad6b2f3dc82e4ff60ec65012067569cbbf408152e7e41da28dee69301233bbb094cd3a430d6daf7048f13e5f1ec71f70cbf96cbc5
-
Filesize
5.2MB
MD590e68a9a65568d90fb8f228d8e807689
SHA1c3ccaa000d073a0d52afaf0e4bc6e6160e40298b
SHA2565a3442416096ec8245c3d822a51dd24fb3eb92bca97b6d7434b9f87d2bc365b4
SHA5122d076c2c669636a3d819b9bfdc8e507b3ee877c78d6a2d9975ce4654b4bb84e9d77bde613206e58496591053103934e90159335bde8778c51eec3ccf2fb6709b
-
Filesize
5.2MB
MD5acb263cb183cd234fdcb5b570ec65bcf
SHA1143724d11ce4319d62e757dadfc411e6981648f8
SHA256b79cb905f096856f3c8c1a462546faa8606115da81434f298e3235fbdf0630c3
SHA51271298604fae64b229b8bc443fdedec9651fb857a3410b40ca5a891fe113419a3fda58872ce0b1e220a659a417156d3fa9addaccf2e559f8ff97d1a151fc68f98
-
Filesize
5.2MB
MD5223d2e414e8c7ed2f62d918f4651b1bf
SHA152eb6e6ec61f01ca2fb451348466060b36d01d9d
SHA256891ef74df23dc299fe3c2e2d6872ead715e9e1a5801f160dfd20380ce7ca58e1
SHA51202b77d9823f230b56cdc43aee7277c437a9ff15055138bc75fe4441bcdec65f3c1856b4b95d1c3fe754974caca0f04bb674264c89efc3e76a1e3498af5b8e9a1
-
Filesize
5.2MB
MD5ae2b1e3e9d4441d43e09aca3ec3c7c72
SHA1c377afa496f3c36fa35ed3f21662b8fe5c01379b
SHA2561c241cd398ff5e932d155578c4bd76e2bbab9d7357e7f865d0e919d5021ee67a
SHA5126689e230722bc26ad7069b79dc456c1ba3ea562995880db1f896746503d642497701c89219956c0849d0b4079e2da07b93efdf81e9ca7c79128f2edf97ade564
-
Filesize
5.2MB
MD5e2114af33280f671d1e1715e91464ef0
SHA113ecb2c5f1bb861ab917554b068fdbfd003741c4
SHA2568f0f7ae5b25283adc156f34854b453fe55f07b9ff764179ab49683fdbd8b6025
SHA512431c7911f3883742a27de7790881e93f144f213d62ef76aab4088259601134aa3a8a0974cd5ccdbd2c3cef5152c1cac223898fb7a41c6a414ed50661a423204e
-
Filesize
5.2MB
MD56bd24ea91c82c43ea99d33077ba33da8
SHA1db3d4eec7e9f0b6b79995c3484beab39633b8697
SHA2564f02da4999c67d168912e7205b80b44f7cedfbb647a21f4614dd43b91f522318
SHA51249241bbeb2a48a9c8f96aeb339835aac095ebb300052aebbe0bace5e63d3020c85445de27c62b6d89bd70eb56b660590ebe3478a0745411375c03cc362745fa2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB