Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
29/08/2024, 16:34
General
-
Target
2024-08-29_c24a9a87ac2e9f250676a8dd565cab1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c24a9a87ac2e9f250676a8dd565cab1b
-
SHA1
e6050aac7d0ab13c9ea929bc53d2959e5b2ef4de
-
SHA256
6a5bc7eed4b1dabfb43ab13014e0a1aa50cabdba2f94b9736210b2c199e8d6f6
-
SHA512
d24b2e759cc01dcfec4485212e48ae9ae2bc40eab5c62ef8935eaf91fd776fe6eadd10caf51c8c2f99864018ef7f798d4779479ad3714e3018d7bfb076d27574
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lU6:T+q56utgpPF8u/76
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-29_c24a9a87ac2e9f250676a8dd565cab1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-29_c24a9a87ac2e9f250676a8dd565cab1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pERyhso.exeC:\Windows\System\pERyhso.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RdphXOJ.exeC:\Windows\System\RdphXOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYjWuUi.exeC:\Windows\System\CYjWuUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AIfDnKB.exeC:\Windows\System\AIfDnKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OeoybgY.exeC:\Windows\System\OeoybgY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrjejWX.exeC:\Windows\System\DrjejWX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZJlIrmT.exeC:\Windows\System\ZJlIrmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\chaJsZL.exeC:\Windows\System\chaJsZL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBbTOcH.exeC:\Windows\System\fBbTOcH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oEhNyBu.exeC:\Windows\System\oEhNyBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpWhHfj.exeC:\Windows\System\DpWhHfj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rUEpehw.exeC:\Windows\System\rUEpehw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XSHCIBp.exeC:\Windows\System\XSHCIBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IOmvhiS.exeC:\Windows\System\IOmvhiS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxbAccu.exeC:\Windows\System\lxbAccu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLngsky.exeC:\Windows\System\qLngsky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYNrPhV.exeC:\Windows\System\QYNrPhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGHCKLi.exeC:\Windows\System\LGHCKLi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vsNDCKH.exeC:\Windows\System\vsNDCKH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLpIEvU.exeC:\Windows\System\rLpIEvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShniXGa.exeC:\Windows\System\ShniXGa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD532d92fe62ddbe2da4149d9f8c0bfa013
SHA1f0090f73b2a05e6e20442b75d7e1934b6fa10587
SHA256e56c78e4916dfa45d699cd2fb929847ec63cc6188192d4eb6ce36b2428f7dd9c
SHA512b348c4a9d728e70093bda5273f1b348356351be6cb69e8b4b0cbcac7276ab45ed1470b2970a53918f0b34beea94de6ddebdc45c628a7892cdc3abe02dfe491df
-
Filesize
5.9MB
MD5c3da9ba14397c1aa185662237d5460c4
SHA1de84518025103573a4fc5bced29c646d263be671
SHA25654d0def51634666dfe4d78ac66d633cdd5b33430dd3c55d7d5f2010c58c3782d
SHA51204fd5175326e7c5c9ad4fbceb05f51f3f929494d725b628056f970d23e51f20ca99abe9a47d1ab871c248df55566530ca63f334cb859a5bf59d6e2f582da78fa
-
Filesize
5.9MB
MD53168a3d8d89acc9a06f219ba8b22bdb9
SHA1f8324f5bceca9f141f3aa39f91f540b9cd742928
SHA25662d6b64c717c4a1fb3dc685a4b50a0a8c4b47d6cc8c255dd5be416a424738be9
SHA5121a490958040eb98dafb8dfece475979b4213076af5c2482bc855fd3c4a21d8e4e6706b2dd2892fec8a3bcc59ca19febbd9372d1e1fbfe4eaf058ccd2730a3230
-
Filesize
5.9MB
MD5a6d59cd1605b4cb2f9cd7e4370dc332b
SHA1d8a4d22876c139636fdb48df6512a1c28eb1bd6d
SHA2562ad4d74c108516a3fa698807d49c8ac01af8ca8e138bfaba04d282eea30bf27a
SHA5129bd596285bfbda6028037b4d5d49caa0b869ef7352be674078089217c66c43ae0df743b556459bec127709e5aa977550a383f135cb9d35d011511525fcde3f8d
-
Filesize
5.9MB
MD5f8bfc158866c1dd06ecb716d4c928152
SHA17829acaa173fe95e3a297b7eb79232cdf6907ce8
SHA256272c30319665220eacc76aaa9f40f6ced80a2ed0913630ace7f4f73446727125
SHA5124a530ecbdd3c7f4bb0ee4e2ce0e4e910746ba9e48155f749dd1b4bc536369bcdace1c57c22c349ec50453b9c02c0f8d22b8bb08f75abdf9091b951e028d88638
-
Filesize
5.9MB
MD534810fe2e87744fb41632391916d0e8a
SHA1963aed69a6ea447b0243bc92a03aee26623866f2
SHA2564683f9c4ed6af0c1188971157074aec202da72bd780e2fea273b8d8b3ea5b9cd
SHA5122bc979a908a1f3ce3ed05ab6cc216ddf2a9b467f57d237fbfcc90ef966848a2d1f20606a5d0acc778db8c6ac77ee24c0af32e997f8ad6c7638568e9b39c7bbea
-
Filesize
5.9MB
MD5f39ab54ef89330455f707f57db99b1c6
SHA1c23beb46b856c30bc7498cf65dd9ebbc8092c321
SHA25628c112ef2d0ecb713d465af7b34a7887ea8ad7e7a15b099675f2b7557e114529
SHA5127cbe65dc2377e93100b9d9205608569db165086971fd553cf947d345a14ca40dc62363153aba35ee566064bb66170c4c6c6ec888422ef0f94797b0b285957c7b
-
Filesize
5.9MB
MD5b18b913134d7f5b40a31e0561fd37b97
SHA139ea5efd981a44325e834f9dd184b40303d7542e
SHA25681f3c9bd06e294bbeee6b9460f22adf3f8090c23657e3ad47cb9b1eeddb56398
SHA51265751ac702596af2dc24c7685b322b8c05ec794cae8d4228f9da1a9b39468f8b2dc1db5db7e335766f9ac5f89ed2f57d796d2ebc6b59a0a4a11b6b80c3d0251f
-
Filesize
5.9MB
MD58e56c21ec9f0bf737f3a576ad3b78028
SHA11c30251a56a4a490beff2f220c9db5a21768adc1
SHA256652ebc35ec3bd2f01b00db5a87d8a984fc87d0e1cb1edf3402f2a14046b858c2
SHA512f9a515372e546f72b1bf730918a000ae42b8f9324382e9bf41967bd34e33f5189b8ccabbcae86964039f014cfad43c04be0866e84d70696f29398ecae9a67c12
-
Filesize
5.9MB
MD57481a6831ecf64082240813a7d8323ff
SHA194b299184397a8510d029e4f0ec3c227728122e4
SHA2564e1f96c7419dcd675eb298fc789ec3fdc21f4beeb08547260fe5111b9257fa29
SHA512cd1bd25d61dc0f5e0a6116b63f606c4dedfedaa50f978832263a6b9210c1da196a576a14be63837442c5dfac41c8ed990eb12de498702af280e6961ef057ea37
-
Filesize
5.9MB
MD51f0b2753a7da7a811bfc7ab90075c72e
SHA1974c7aa0a8a4b5d961f6bb7b51520d8a3c7d61af
SHA25611f970fd64026badad11935c306298a8cb2a8821207f15fa220a9fc240bea964
SHA5123b8c911b77e1cd389ab2984f3cd57496d457ead53f5c73f9effc548e5005f2b7621af5aafe6dc57841e54495724dea7f34bc424afe0847b4638f2d93ee1d869d
-
Filesize
5.9MB
MD5234ee301792647827fc6e77bacccfd88
SHA114cd8ccfc4779101b8cc9eb2811f376f50f3a502
SHA25620e78e8a6286065bc58cefd5b8b78970ce30524dec4b65afb3937ef3fd898ead
SHA51205b9e426522fb5e8164899a2fb8297c15726d4ccf38087a5ee3425765ae90bb126f0dd1775bd6f16796cd310fc25d9c49cc499f09a07ef41c65bd250e00109f9
-
Filesize
5.9MB
MD527bff549183f36fe8e7c8e8efc945b50
SHA12f7623e5dd4947ba32cb24146dd0a48c0cdb020d
SHA256e4bb91550ea60ead76d0f9d2a1c75917ca7460971f80dcabaa620261e5256135
SHA51224b1f383fce02e9edd25000fdad0d5b84dcb8d93f726f47fd273b9604fcd26d2e1061314794865f9368efc3a8428d8e1776e4c4159559f629a712f9c80d15048
-
Filesize
5.9MB
MD54cb46cd1de3730b865e5924c6ffb21d2
SHA1776def42868e5d546fd5b9e3af5d6a99d75ab0a6
SHA2563ca07c7d278c1bed9954ce9345b2a9d5b38081ec6e4a3cf593bc56347a2a8f30
SHA512684b480b49669aa37487bc5bed82168cd22cbe0246ddde0cc13bfc5e5296d00bfcb4c057f1ea01df67f5086f52a8043589b68bd9f89668553bd4dc97d8833ee7
-
Filesize
5.9MB
MD5956155afb6309be320a7144e7e8478ab
SHA1199631cc75b1b4cf59b47c41e6e4f157db81b54f
SHA256fb49713cd38e760ad0a391f866ee35dfb19311463e923d06945afea4880d9dc5
SHA51243d5391e31d596b61e6792f748fb7aac3718d1a30597f26b54c55f38707d8651351055c364d7025812e515b4a63c7298e0a82073f0104a878857bb03899b1af9
-
Filesize
5.9MB
MD5832371e748993144d0ffe0ec380d7bea
SHA1e2309009d393134d152a31f5486c301cc96016cc
SHA256a17742a6b5b09beb863b3554181d5104bdfcc245417b1d8826c715138bd12657
SHA51287b47dc52274c902987b8f4050ea0e5965be081b6c4a3c99c25ac3057bb8ef484dfd5aa49e8e772b4d7f60493a40e30d050eb322a4ade673aca552ff4522c3fc
-
Filesize
5.9MB
MD57996d2f1b03821c89d8116f503cc8dbe
SHA12d01326fad87a7d6b80e51c79c65db0398832a97
SHA2569e943ef1eb1030fadd9ea1f7c0b2a780c5be99e378b68d10e663570fe50a8312
SHA512f7d8e241c7dc066775f7352db686bd67e6ddd97dc9bad6c5baa21ad5095e68b7f336e4f6def936376fb8aef53b3e85646fab0909770140e4c4600ae70bbed468
-
Filesize
5.9MB
MD552fa71aa650ca929b728683483331158
SHA181e55fbb09ee3e3839064c74120ec142cf7107ee
SHA25604ed946c3694fb6e895771061652f09848ba04fc91fa987e095b0d0995310215
SHA51202963f235b1eb084f2531dcd67b0c56da6a53d7e18931cc809ff0151af4f967246ce9f6b36dbde09c4774bed15e410a971f5982e367a26d799a8b259fbfb77e5
-
Filesize
5.9MB
MD59783febbadb3ce7375af4881498e1875
SHA1e287375be240701511333cf44190fa8afecf1b91
SHA256306cac1c50853e5bd5e60c2991e265db850bcc766e61db97dd2601c9044e54c5
SHA512b2c8743a1e3bcb3fe7a38768b06c70c01908cc590b0aa9ddfbd50ec03494c09f3014434e0f6932312897a778fdc71df21dba74cd33f38af919580be1add29ec7
-
Filesize
5.9MB
MD5d87a075fa5e3d695fe126c601b080474
SHA1020cd696775fa9151c6d524f4fc02e7a1a1e7e41
SHA256cc90da4df4cebdc51f1f2dc0852ecf1cc0bc384ca527cead9f981618a130f2da
SHA51283102b79298cd65d0472734b11831af44258ad983b63f1a636bf5b337362d68e16d81ae02c6a92a45fded6f90363c235b1940913583946446b263fcd76c52c59
-
Filesize
5.9MB
MD57d906c4a9246de6a5e0528802e7f95bf
SHA111baeed02907250b7451b772f16929b25b33204e
SHA256ab25760054f10fd1f877ba5274b9a942f831b05232d212486f41ff754291057f
SHA51280989b69f86bb60ee7edf54c5407cbfc8ea96477de9934a6c982c5a8cc93a2d8acb4b585c68349cd197a613e4d95cc3b78e8d3bd6fd5d934437362eeba29af2b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB