Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
26-08-2024 05:52
General
-
Target
2024-08-26_95013f0acdde672571df9fd93301096d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
95013f0acdde672571df9fd93301096d
-
SHA1
538c1bfdda2db60152237ba84f5600e133681529
-
SHA256
b6f21bfdb9c0109adfbe37632b5a876d81a35846d06a5eb4f7a378aba23c4d15
-
SHA512
8b11dffac0fc8585209f126e1ab47d0946026759dbce571a890d505f30a80bc9f31f09c5fbc75afa3d238e27f62609878a0d0a780995b5a34b90e26a665861be
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-26_95013f0acdde672571df9fd93301096d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-26_95013f0acdde672571df9fd93301096d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yeYTtgE.exeC:\Windows\System\yeYTtgE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkpvKvY.exeC:\Windows\System\HkpvKvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdFiOOh.exeC:\Windows\System\cdFiOOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pMnysGY.exeC:\Windows\System\pMnysGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FykvfaR.exeC:\Windows\System\FykvfaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQDaJeX.exeC:\Windows\System\tQDaJeX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tBrHHod.exeC:\Windows\System\tBrHHod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FaKfveV.exeC:\Windows\System\FaKfveV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XuvAntu.exeC:\Windows\System\XuvAntu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fowFcmE.exeC:\Windows\System\fowFcmE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rnlfOnD.exeC:\Windows\System\rnlfOnD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XZZvdNN.exeC:\Windows\System\XZZvdNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ldQIIxK.exeC:\Windows\System\ldQIIxK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rElFHar.exeC:\Windows\System\rElFHar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRiHhVG.exeC:\Windows\System\jRiHhVG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOAJlmf.exeC:\Windows\System\xOAJlmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSHbGGE.exeC:\Windows\System\BSHbGGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zuiYgZT.exeC:\Windows\System\zuiYgZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hoQqKiG.exeC:\Windows\System\hoQqKiG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWBkwPR.exeC:\Windows\System\rWBkwPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZmhGro.exeC:\Windows\System\NZmhGro.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52764d1a0e95c6473f4ae25a2170b55e2
SHA169331877710c9070b8a5155a0f02d5caf9a2b162
SHA2561752d69f57ed61c46b17de1de8ff741e9fc8d2e05566a8d1275b7feaa55a623f
SHA512a1dadfca2bc77f1ce4756f21745367528bed68da27f498b77cda3be8cafe51fa9e13cd779ddf087f3dc2b37b0cb9a225b347342309c603df1deea99fcb8e0611
-
Filesize
5.2MB
MD5facd2511daede9a98ac6a555d4e366bd
SHA1e8d944809cf01099b9a9e703c5ea9ee49c426989
SHA2561560018e1ec11f56356202491c6eb3da4894f0f3b2e53356a02810e08024e901
SHA5127ea4e1c54371ec5eb65d9bc461cf9bd1574e2657e465aca33ef47a9d4cba987b6a4dc334886b15e4c1d9fa7406e33f0dc77d0360b69fb98b30ee85928b05f114
-
Filesize
5.2MB
MD59b3cf6fe31bcaee60bfe2bb00e3a7cfd
SHA17ef6d8bd37a710f51b36f80b9049d911a09a88fd
SHA2567500eb3c299f34d5220fcb7dccbabb7cdb6458cbe7be229f5021bad3af9d7000
SHA51216a4e2391384af8dc73f74bf729045983904382a157e44d0f2cc4acb28ae96587ab5c7574524355dd6ee0327e7fb457adf4ef5b50b0c2c830c250377b9d58a5a
-
Filesize
5.2MB
MD570074bffbd6a56a2c403d5234d63f324
SHA12b290674f145724331f52242c1e271ce3e85de1a
SHA256e10ddc83a059f070a944f3bed095bace5ede9d3fe3b35ca93128b8409e039a40
SHA5122416d35b2d703c91c454f6330cd485eefd0583fe9d781c3a4b45c4905f3fdbf551b82c6537d4560de48b681ca184d2b8b0dae8bc949b181cfe3cadd03cce7cb8
-
Filesize
5.2MB
MD51d2bc6a351b436ce23e07946ca4098d8
SHA11eafa4d67af4193fc99fb8401f5c91ceb93fb16c
SHA256e9fa3ad715ff13f562e07b758957135a09def1e8161ec43edf9983c3ee99acc4
SHA512aea4952d0907e51b3f1a30c4ea99fe7dcbfff6d033511a02b81d1505b554ff999c71d160d271be98880669f01d416838a59c809736e2ada437e2b1ef22dc914f
-
Filesize
5.2MB
MD520db8f6cf090b1feefe91da77c75d327
SHA1d0cb1166abb404668e44e95c37425aecf89cca19
SHA256ce32d259a2df0c01cf17e88a0e3e3f12731521a491dc23b3ff980e6ccaa045b7
SHA51265d3fdb73b6d8995d9d1511aab28e7b672d51daca62ed057e392540dcae7f5040a6c0704797bbf04bd3a75decea8708939fc8e4d466a1d3fe3213a965cc6c7ab
-
Filesize
5.2MB
MD541b28c10bdbbac274edf009fdc54a7a3
SHA12448183ef19f5e4744ae1090545669320849b400
SHA256cfd33825aab0456ab7dab505924930a46850164d2832b2f1c0bea6581a053ada
SHA512dc87d0c3d2e700d31282109b85b21852b2f1d30d7e04d6312747ee67ca52fc2cb0d776bc93de08b0d597434a21fbd7f82da33d6e0f064ad278c44128b701fcd9
-
Filesize
5.2MB
MD51bdc0613020d568077239ffbd240ecc7
SHA159a4267527eae3c5656d1a0fa14366eeff98afe3
SHA2562f9aded5576912a41ae200481b79bc5bdb761ee4b358016b94ec35bb36a3d9bb
SHA512dda2ada0029dd5c9f7487b478ce05c4b47ea2aff9d31c980d44e2f873c79465eafef817864840d1d6f302efa545a73beec22d9354b0382c155b41d2174d8deea
-
Filesize
5.2MB
MD54589d55dbf4028ce07bf1d58c26ec2f2
SHA16ad72f8affc04c42af4a919b6f9c927d174ca7f9
SHA2561439caa6f6e736d0b87ef027e253cd8831b2c8e75e733bcb9ba9d154607cb89b
SHA512fdb7dc287a5bf0507ae5e3161b422bf86973433cd9f571772079f923936f84eca627506416ae3f721b82404b6ed1887435fda9cbb9d42113dbff47b208a01e72
-
Filesize
5.2MB
MD527f0a83b97121bf0914206af2c60b758
SHA1abb895f1c5bc0b1db8f9df5c2c6951faf94bea8d
SHA2561b7c91d58b2b71ae15d6db295f161e6dc7fa3a74f92b648cc6e0d4a794979745
SHA512c136b3256b06255aeed032d8b9b65b0390d7dd1e3f015ab40567ce1507c5a5c9290143dfb47d0dfc662689b0887eaef1d7b437d937e6c4d8cdc3b2de3378330a
-
Filesize
5.2MB
MD53d764324af83099599de6ab30cb39f45
SHA1b221fe5b7270ca0fa4613aaa1b1de4537c1e220d
SHA256ed77678b110ff68bbc299220175e2cdf9763217f46ea3850332820abf9848af6
SHA5126d9ca6e1ee2b5eb28a5c361a3b1456946d15e993ae0c8bf00b100514ff0058bf01c95b14441b44d8009a2b6046014b205e9be62584b75496a8499b557aaa6da3
-
Filesize
5.2MB
MD5a8084ff351162083e32672e8c9a2c40d
SHA1d79f55d24fc3ca542e416aab9a5c716d1d7b81b1
SHA256a45c823ed9430c1d8ae23d19ba6e5974127239e827f171d44bb981555e2de8ca
SHA512358c85dac4b68a66508d0aafc947a9414183bdebc7051069a73753166ae219ab03e25b49db53cfc73ac6103b0dffb7bbb45c976ee4591ba512f7ffc119f7bd87
-
Filesize
5.2MB
MD5faeab1e5692ef0da5ff5478864e9a3f6
SHA1e7a3029fff373b3265153903e9f8b0250a92985d
SHA256275b7f898c3022d6ad6e0b03c1496cd217461ef2ff31beb6ffbb0b79f8996d66
SHA512a6e9dacbf23d73fc561e83efa106b58304f70ac5165d13c6b32ea6c7ee49b2cc161350101da90a13a0df51bd2ccdf7aea6c26a4792d6d92e9cea804d21da44a5
-
Filesize
5.2MB
MD520060b405285cc69d1902e202afc58ca
SHA1a86b6dc9b71debde872eb2c5aa3629ae0142430a
SHA256563240c72a3cc627865633fda4e2cdaab5a4ab954c6eebe93d292cc09b876338
SHA5120b20920b1b0b69b614094a9a077283497d5dd67729cc52a0a9ce531faaba920a4465aa8805437195b0238ac47b914be84c8cb4c13d5f832be78f289247f5b273
-
Filesize
5.2MB
MD5ab238137d398b6a605795f9bed0236a8
SHA1cabbe897a96e14437d94798c16bd1a443d56a158
SHA25696065b49514e56ecd3268e84999b3e8e4bfcf24f57615bbecf2d74ffc9796fab
SHA51242067a22e9a408b3eab8c541ad84e41d9022f9ca39094a3261aa7cdda1fed99a92bec3dd0e0cdc1ebb6c551093a95e705e8e5fb936e8af8699da60c55ce25705
-
Filesize
5.2MB
MD51ddf1a212d04f8a7df61fe3e583773b7
SHA1e2e6e9ea1a8a92f011a92b2822e675aa5ba213af
SHA256037919c3cde9aad555609e696cd2bb29e72a719cbcb9b8454a3e59f8d50bd321
SHA51215dc60a75c299b8bebb715e4ed13c8e432b8e306d53175a64cf00b861674134ca819c5c70639a1e1e1ca2bf978137c834a413769bae019e90817982d8ee02ae2
-
Filesize
5.2MB
MD5771b74bc52a364c5c79c2bbe9952b93e
SHA1d6decd0b6275b54f0a49351c3db509aac358477f
SHA2561a289c4933a6ef0b47041d048be84fd62376460e152729a00f6d65eaa4f61ba1
SHA5128666de3c05a7cce0c1c1724c67e54ccb3798b5149029043bd4fa95abb9f676fa83855c99e8f34f5d4afdc8fb313004b9c5dc07eb87ece5d02f01325347c0a348
-
Filesize
5.2MB
MD54762239c675ad305ed2e770960a212bf
SHA1c1d04164504ae0c660a50aec0b78f5c205479c59
SHA256cd7c591908e3cbf123993b21109461b2433464c70bbeb1e439d9a5ca90cefed0
SHA5120a2514eee491f566500c8c426f324566f231fb43605d78bd8bb080fbe875ed3acaabb04568de2e23ee2e9a04f8fad7f75c1825b5dfa21da2a5d1d12426776118
-
Filesize
5.2MB
MD583f95de4d3d2ac1b21ef90c3aff711c7
SHA1d85318023a5110e6b18e1c28a030fcad2aaa18be
SHA256d41d2b81b5109bbf2964f237410a4beee49498a5fb87fb64efb1c513e0f9247c
SHA512dca1caa66ea721629c51f1934ee3e7889010c1b45161f193635d564e5eb2684a970a02982fff89c296c949eb9e676cc8f419481e3d0dc551883d8703d3255ff0
-
Filesize
5.2MB
MD575f1940e01b82aa32aa0cf13dd3e9121
SHA1171af4dde3f3dea227e4139c8db987c4c16e67d0
SHA256365bde57a2d395178a496497375707fd964b15b6be39e3defa4818c0f30667dd
SHA512cf21588b4211e442f29d0303de677edde568aacac80b3217e97c190bf37171de5799436766697b6783e94676298e96280c7f7e5b331b4a1ddb71a38e43dd1b61
-
Filesize
5.2MB
MD592c12f4dd55f6076ee7c9604a147eedc
SHA1063a17d2df43f536e4672c684314ea0112a1ec31
SHA256e502ea5093725453d17e7bfaaddb1bb6b59f9fefb8f7d7b944e9f5bf832fc7b3
SHA51290d346bbc8c36e8842d4b54f6ab5212178423b4b12bc47f605fff524e1998ec47ce72222af2299cdc38908e4a939c02c428f23b2d7d2c4944a8206099c0630f8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB