Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26-07-2024 21:59
General
-
Target
2024-07-26_a9abc553057c8be8e6484b8bb9579c87_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a9abc553057c8be8e6484b8bb9579c87
-
SHA1
0bcf296c881c1a701cde674bf7fce8d27a4d9b87
-
SHA256
8b8cd079716102e6b75ad006051c66d3d3d4a8e08e3077a7aa4014f3393df598
-
SHA512
3c0741d44ce820a4667ac86f46333652afb5f5288b9af60b4f2cdda39170c40bc1cc3499b246d567d52fa426775d6682a0b2a50b95c01189f0502cc8fe5bb7e7
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibd56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-26_a9abc553057c8be8e6484b8bb9579c87_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-26_a9abc553057c8be8e6484b8bb9579c87_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TfLyvBT.exeC:\Windows\System\TfLyvBT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\fOlkuQs.exeC:\Windows\System\fOlkuQs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\TwYzHby.exeC:\Windows\System\TwYzHby.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\VJMYIfO.exeC:\Windows\System\VJMYIfO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\PohCZyp.exeC:\Windows\System\PohCZyp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ZlZhKNF.exeC:\Windows\System\ZlZhKNF.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\GFQGtGN.exeC:\Windows\System\GFQGtGN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jYyyisF.exeC:\Windows\System\jYyyisF.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uoyVYJE.exeC:\Windows\System\uoyVYJE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jSussxB.exeC:\Windows\System\jSussxB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\byaUaEA.exeC:\Windows\System\byaUaEA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yDASwFW.exeC:\Windows\System\yDASwFW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OTpdwVN.exeC:\Windows\System\OTpdwVN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qydKDwm.exeC:\Windows\System\qydKDwm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rRoqnPt.exeC:\Windows\System\rRoqnPt.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RQhzKio.exeC:\Windows\System\RQhzKio.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QfwbjHH.exeC:\Windows\System\QfwbjHH.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\WUgLhto.exeC:\Windows\System\WUgLhto.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qdjUedJ.exeC:\Windows\System\qdjUedJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wXqVyNJ.exeC:\Windows\System\wXqVyNJ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QzfjVoX.exeC:\Windows\System\QzfjVoX.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD574a3de122545e2df67db7ff90b27b2f2
SHA1baa3ad3e136b29831d83760e01d28697d93f95b3
SHA256390ae8f56648a921cae97c1c3c4da3e661ed9dd7c24992435b7dae0076584d2f
SHA51246d2c0569796f359a48a7dfda894cf33aad22bf702bf83052db1e3dcff60ea98fac0e4798c511d99ac643dddf0c5822cb8422175e8eb2e709bb19f88ecb4fb3e
-
Filesize
5.2MB
MD50f5574df88c6f7be118d16b74f35888e
SHA18be44238ecdc1ac71ff3a6054bca48e74133c525
SHA256980affc731879add2e87a4677dadca0c499e939c345f8f8d65396f206fd64445
SHA512b03ba480b9d4e3a26faacb6ec231c374c5896ec0f4be5134226c8a70e18e7a5f12b9f2d2dd4710660afc8c2c0b1a36b044b1ad1caab0e94793d9c1ca48bf5237
-
Filesize
5.2MB
MD5332a6834207ebf0438eecee0daf32b57
SHA1f68f9dcf6bc6b5f4e5c47a66ea259f18ed97ac89
SHA256f3de4d83530e71c0b8644e30fa1de4c0fff3aecbd044c51a85b1375cd0f31b62
SHA5125065752587c0b950ad55510e0143a9fdcfa16d28cc540ba349dc5d653e5e1fc5cda5420046f9fd1bceb18339ac9e1dbe43ca321e31c3a5beb37eac6c0b2a442a
-
Filesize
5.2MB
MD59e1cbdac009ae8a841143d8e8b56552d
SHA17336f2000d703f07b41277309c855c5375e0f5ae
SHA256616f10d74fee474ae6762015ad6e2dc0c98922da616adb6c8554400f7b1b9514
SHA512475a57845eb7c7d709bb85e8a61ef4aad7c93ab0f5af82ecdb631d9501695206ee2bc9944d5e6253885c1f56d3c5900b6c3d1fdf7ec41ce9a4f29d97b65ca240
-
Filesize
5.2MB
MD5167894e0b17e0a1c0b446b4d4a3fa39a
SHA17d2689306dc862fb1578cfa5228bebc5efbbc0cc
SHA2568eeb8f6c9f5f394c06500e53ad46bd52821101321aeed65afb3bcf24640e0900
SHA512be90566c7b65d3a1072866e4efefe6c8eab0622f8f85f5971539baaef4b109c512b113cf3a2afe40cfb71fb65aa833b5e52e456f8ab4ddab5509b9692a6eeb8d
-
Filesize
5.2MB
MD5c6fac632652642827a79d29dbf6d8e3d
SHA10e80cc5200a8dddbf7d1fcb6e34d04404ad6c9bb
SHA2563e501f1c4decae9ed72b4bbc47d14f3816ca222446f7dd4671c50a9d93dec119
SHA5123b0c2b3a71a517582460e925097eaf2f39af943bb3122e5d27f3110bd1339c94d8806f2ad954e6034fed4df1d91067443d398878c2d0cc70f2d35bd0b3739469
-
Filesize
5.2MB
MD5c5f360e3f6878f84c09e8c0668ad8058
SHA1020d59957781344395b8cb93decf065a91770c91
SHA25681f5e1454661519235485bae48d5e86e5056ad6c138230082b4cc2797188018c
SHA5120996f36219b90c233d2fedf28cfc658ea9989f78879c99cca19e30f3c74fd94a817059ee8737ab74fc81c1dc841991df0d7125a6853bbc433818842a24c77c2e
-
Filesize
5.2MB
MD5f0973e179bcf37bcceac76d7d54f5c91
SHA1b845f701d26beecb28c7f3ec8b5db745599ae9f8
SHA25619f3f1dfc3b01906264bf1c2b2abfb52b0d4394cde5a7c4e08b48c9784516627
SHA512e23dabf875289833312650fdf2b70def6dc16ecafa031fb5b44ccd0a7e3a02a85f4fc5c94b67842cfffb669a8af1d826c0b509df6b48b0e5a89ac864ef96f424
-
Filesize
5.2MB
MD5e06ef88f8f2e8c27ada158c8db31839d
SHA190835e1e6e5aef7b15d4225e8f8755fe91924d04
SHA2563265de2fb403a87fd55f04a3d18d1086f2d507dfd32c774aac10cbfd12216d9f
SHA512f70fa15060c6ddacea93ccb7ce8d3a3bdcb9030672e8e9f7bdf4d12e2f50d6a98771f394fec9b67da8e878f399ed9eba5c56931fc700a98cef48f5b6238f322c
-
Filesize
5.2MB
MD5574c294dd42faf181a2237103c3ee338
SHA17841cc900d9a0eab5f587e3c710005e23b86293f
SHA256b4a5a6c736a3ef08f8fe043d6d40f235e94e8fa1ef5de0734b6c759e38ae1f7c
SHA512b568c4c7a76b19f74da25394fe6da9fb06f3d9ddcead5a17fee071d8a9630e462d825e4fdb3aba727717e209cd822b8540566dd176d7778af77ff10a51badaf4
-
Filesize
5.2MB
MD5f2b8b95fe4777039aac97a752b9f3116
SHA142d5e8388998cf86761e3c7570c6f18db5c0b1dc
SHA2561273f77333fc893ad85ed54cc0eb28481dd63c1d63bfd96f65b2da6cfb36ff1b
SHA512eb08ba61c59d2dd89d5d80ab75e556f86a4c289c9396f177cce5d38b89af660722f811a2de3fcea420ee7b789dd31832efb4cbfa64235f5fbb75535fc5dca4f9
-
Filesize
5.2MB
MD562d76aaa04ed4868a11642ee984bb452
SHA10029c7d04c60776cb8f5f035062d59f713dca567
SHA256f9528d92f548b70bf62d02e70a324bf74b8755ebf6d0110a046ce452d898238c
SHA512202b4db863d148704ca3bcad9f99d91b333efcad753e0e7d326307a8e7cdef6669375366bba546f43f3cd2d41db3fcf7951cd31727b2b11790491ce8893345fe
-
Filesize
5.2MB
MD50fe54c0854cd0717d913c5f0c73fd513
SHA14eb699cb5753393119f3b4e949e1c141e94ca527
SHA256edaea82c49ba4eb37a31a5be4ff4c91c7529308aba759c5600127737576e4f0c
SHA5128870b119aa6fcaeae8c86cb5a1490a4b3df373492f7fbdc09c66dc31a9a7318c59ad91541cf6a19f1f61c06901d998216f6cb51270646d2f6cf392d5b0b46b7e
-
Filesize
5.2MB
MD5d05f6e7272089b4ddef544f44566cb47
SHA1648434f70a0d461a727489a36e97793404665671
SHA25616c08ad0c1f6c595c771a57d1e36f50dc4db58945479471c836ee6ad7ef2228e
SHA512ec0fa6a2665f62e0f333d196970147eb2d04217c15be329f8039f78ca3a1ddfc7c0f5ed0f376f24c8b7cf5b23bff8809139cea3e027f89232b8d087c46841d57
-
Filesize
5.2MB
MD5a04a1d67bd58c37e92e6f5a916a48115
SHA1f93b4aeb73bf60267d3068fddc21f1e0d6f67b89
SHA2569f6ad500604dbfdf58320385db6014cdcc5dcccee5182c855aecb9d8a6f1c3e6
SHA5120282dede9c2926e035de370d79b69a2269d60f8daf405de3f742e6c5411c2bc6eaeb5797e596d72fedcad691b3197f20c998e94b9d6b762690acdc0b772ff36b
-
Filesize
5.2MB
MD579030976004a009b1fbe04ad5b55e958
SHA1ce4e03ef9048ca36612b62608fa1e99d8b1e7542
SHA256bcff714eeb08cede36c7c86597adb1d640650b6d7789720741ed99ef69261653
SHA512cc8e1ed81d18f3c945a9a3407e44d1239e510a5bf06a8d71198cde2fabf36b18deab657080e3da76e7e29d9c67b9cdbe936e2427a4cb06d279eb69bfbb134557
-
Filesize
5.2MB
MD53a3c5f9a544aa949263439ed404073e7
SHA1fc697b9c3252122abf0d01c6c888daf4166c4c03
SHA2569330f18ae9b7f9b92f651e2a4d0dcbac4239d419b7adfedfb4a76dd747cdfcca
SHA512ccb4706df5de7c2c736fb5aaf2466c5b89b8aa21310c414b54f64077b484f428b05801669074ebf075d72f2f8df5a3e4fa7c63074c3b84edd9d6f993479949c7
-
Filesize
5.2MB
MD5d9d9baa4b6e4e82b2bfd6e65f3d52429
SHA1679c0b7a2fd35dbcea4e485ba1e358ffd25bc7d6
SHA25659b870cff21e413e863bc529c944e87c50eb8295f5191b208ede07808afacddf
SHA5128af3fc2ecd0fe51e0f44d0ee2aea87638a83eb30fc1f38db827180c72fb4a3e7ad774abcab99071e2b78c4760a98f725db8c18e55f56ce8d82f46c923f5a397b
-
Filesize
5.2MB
MD5487f3e07d5b73feebdee46b995f90b32
SHA196f19d77563de2fdc6bded875fd883865df84f9e
SHA25671a5001f2650e0c9022c8e3389695ca614a99fb4fef466f0ab74fb106279422d
SHA51276d8052c44463e9c6ea283704ebfebd705af3d3acf7263d4800262a0b0d8cb8d3ef0c87346b15bb552c2718b9f1731593f428dda8bc9a5fde13eb394e58dd213
-
Filesize
5.2MB
MD5cd59892db05a57ac5788dd2d315c2eb2
SHA17a986bbaabed16b62baa02f61876a7f738ca2149
SHA256c94c9b843baf9bdc6fffac711a7b487be40aba9ab6307b760b1601716b05c7e9
SHA512058ae44b5dd9c1b016cb894f32a91068ecc2b1a07ab2f475451e7efff4c7a32d4a41ae49c1259865da94e848dbf79605b40b5fa01016dd6d5b5e1cbfc736f080
-
Filesize
5.2MB
MD5bdc865904fb32adf4ae376b4c98509ad
SHA1057466dc15d43532f27e21abcde5df8d641fbe1e
SHA2569eaf88282c97681f8e1e205d7cdec0160bb4c0134e771c089dc6340b03240747
SHA51250f7b752b04da72232bee0c323b16cc89ac530f8f092267460ab52b9a8e16d50f398b274f1cbfa7740115040d79324ba004e9ef5a10f268ff2b600842955805a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB