Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
06/08/2024, 12:00
General
-
Target
2024-08-06_a2a70371a61ff2799dc0813b899073d0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a2a70371a61ff2799dc0813b899073d0
-
SHA1
526911d1dad488a847ce47c0f8cbe282a4f2ff24
-
SHA256
1687f481bc6bc1e38bb20624a3f29846ddb452a1bdf290ac4205156554a3d145
-
SHA512
9b1e4753fee2e240ffc75698bd00d54322d4d3d79ceae5f0728a6f94ef536c833446ba3f601d3fc4eed9c4d5d384c12775fc768eb6ba55e475c35482efe320e9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUT
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-06_a2a70371a61ff2799dc0813b899073d0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-06_a2a70371a61ff2799dc0813b899073d0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ibJeYqF.exeC:\Windows\System\ibJeYqF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FFKMBgX.exeC:\Windows\System\FFKMBgX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\REjWmFV.exeC:\Windows\System\REjWmFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lGMAfEr.exeC:\Windows\System\lGMAfEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zNqtRVa.exeC:\Windows\System\zNqtRVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIFzjYC.exeC:\Windows\System\rIFzjYC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mDdADZL.exeC:\Windows\System\mDdADZL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CtirIxG.exeC:\Windows\System\CtirIxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUFZCYq.exeC:\Windows\System\zUFZCYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zBKzqIV.exeC:\Windows\System\zBKzqIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbKMUcK.exeC:\Windows\System\TbKMUcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qpsmFDZ.exeC:\Windows\System\qpsmFDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HRLAFqv.exeC:\Windows\System\HRLAFqv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOjsCfV.exeC:\Windows\System\rOjsCfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOWWzyI.exeC:\Windows\System\iOWWzyI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OudiRvi.exeC:\Windows\System\OudiRvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfDmBvb.exeC:\Windows\System\JfDmBvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYcJWIT.exeC:\Windows\System\uYcJWIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BqzbECA.exeC:\Windows\System\BqzbECA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBDDgMU.exeC:\Windows\System\DBDDgMU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLptLwy.exeC:\Windows\System\mLptLwy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ab959076112238f01207510de628fb95
SHA103925df3b7d7310c9ba286c19aa2f29f41921478
SHA256bb0ac2b3ecf803d2c3f35771fd220e8e993c102c6c6eaef8b597a4bad7b99157
SHA5127466a6f171994b21d17eda2b191e5e0a1f119463e73e787b00bb5e4c94b85cc6a74d54224b11bf7a10d1032d825d89165cb6c37af0753f7f696d0700ccbf7ba8
-
Filesize
5.2MB
MD58914bb8cdee7e14b8efb1387c351df9f
SHA125b3f62ce1126f86a4d174a64281b91fddf4adc5
SHA256f2d0c8bc0c215f56c67cf2ddb8c46bc948ab8428e0185437bcf5d6a143d2f61e
SHA512c76988e0bddacaa637f824065af7231333f50282e118bde7fde47ce11e6618e0205bc721e69c4d563700a5fed0bb058943ee468fb41c6589cbec60fe27ffbd06
-
Filesize
5.2MB
MD564f42424b4c4e84698545b223367d9d5
SHA1fcd38bd8aad5cb40980181494d6e5d3f0977d814
SHA256c571b101c352e7a1fa0757a5441d772d314c5083934eedb887a4dd2c91996b42
SHA512dd1a4cb217554fd868065c84a15275cb35b9abccb94fceb32bdaf891008d7a334cd93bace3df2627ab3914d883cb7eda61f3e0b38359dd87f62aec2b8167144f
-
Filesize
5.2MB
MD532a898a1491ff30daa50286fd44de3f3
SHA1fbd75357c255e8232f86895313ed77efde0f878a
SHA256d89324fd7c5adedb71da98789b38f91cb10b96f6d0c5f56f845052bb0ff05e28
SHA5122866df3b05c7741ed39586575a1577a7c47988c056bce8f5c8b14eaae7a91986cf37485985f7dd3148fe71ee3ee85d4838a9744945e31d8e68815b2234500a50
-
Filesize
5.2MB
MD57253bf50e025480926e531d7d5e8b2d8
SHA14f1688ebf0c5a9afebf110a0a67bd72e6716a170
SHA256595203a28029ea35c77d7ea5b38122768a5b25a9f9048db40828670b143dc8c5
SHA512b6f5979e482eded6b1cb1fe2f6e71fbb6d77db4728ee48ad2de9a263b84b006a0937ea26949e03b017697a81cc0b72a2aa51404208ba4f59d6a64d0200edbfff
-
Filesize
5.2MB
MD589b1f7618abce711d7fb023735150725
SHA12858b32778186df920c1e98d09ab6aee4b7f0ce5
SHA256b77f04830ed79bb941784fb78145fe5b16c8be329508676c7c0b795b803fc4b1
SHA512227bb8e20b6b14c4cb415e3907cd8dcc2ed0db0f291e671262c00f44cef38275d759be1a5a19d6f429bd3880b3a3ec433559e52e828b23702718e4f116f266e2
-
Filesize
5.2MB
MD5d85cf9b056ec8ce5b331ea0a2e42705b
SHA1aa3bc198272108977401ca7bece698e2b2fe9af7
SHA256dd5e9049b7c0a4735e85139c44e33c37d7ea4b8e2aef9e1b0923bf088cde00fb
SHA512eead0e633ba5c6a2a717127e7f0a2ff52d186d39363d9f27fe9ee3f4561cc6a74a2221f657a8b6cc78bfa4abe1e557ee0082802fdfb6d11eaf19a0b22dfa42c9
-
Filesize
5.2MB
MD5387995a934c78b068c66b50f7a8f819f
SHA1cf23b8fa11ca67f0f0f9e31908be013e8bb6aa10
SHA2567b5ccb3125b68834632f4347df05753e363da350e4fd0f4804643925aab822e5
SHA5125f8b419527645d793b7f9fa76b83b23c7f503befdde87e0e3726da37a84b5e5d6b723877434a3992f52ab55329e437c6fc3d44dc3ecab70c184b2f2897ffd273
-
Filesize
5.2MB
MD53dacec48a6a54cd90aa44a6f01680f5c
SHA158485155955ade6770a7cc1e2e3d2ea892e2de8b
SHA256371665b7d95533bcef7d04091a3d54a2ed7342964fc3bb2c26a19492269c3970
SHA512eb9d1f1145a13ebb5645c22dc9425c0b0ec59137eee7fa9eda8298e1d78bae03fc315dc4a69b3fafcbfde6816c53d7fa1775940fc29fa571652f4259ea6f3ad1
-
Filesize
5.2MB
MD5347ee0ac7193382923e76d5da3985d86
SHA1f4ec52730d34e16c76a3b6c933e47d23adb9310d
SHA25616134bd437b1c74354c21d27fd3f16534c9af92f100dabcced14cbd251787121
SHA51207d9bc3776cf2fe25843a3efa258a39f8b24b0d0b57f12fc5b482f4e21b7567fd732a804002f3a8a8d2d48305ec921aebe58664ea67c56f856de03ea1bbca0c3
-
Filesize
5.2MB
MD548e8ce1131fa2dbb4d85105e9d9bdaa0
SHA14d2ea17beff5c9572a3cfcd8eddb52a15eb3e42d
SHA256e1c7090ec449d90af79a6ce9ef2f0430b1805469d404ab2476a0727c4e230bae
SHA512c4b215e11fd8ad5820a448e06c41f9dbc535bd5bff9ca8934ffb3a151c5d66f53ea675924ac69a181a1619d80b8c49949882c0257d8f81bfcf2e722a68d6a9ac
-
Filesize
5.2MB
MD52e6f5320eee8d8735841813a1ce3cfc1
SHA1fa2ca61e2346a3faf9c0060e32f7fc245b3dae53
SHA256cbd6e0a50f793d262321b470d90bcf6426197224f3e50ddb828f1c09ce688388
SHA512b2e5f3bc4141200ba75b9fbf4f63f5df5a6e409869c5440f897e3e8e6cbee808c491e453fe0ed35eb5fbc69977955673e0ba315c187663cfa43e9f971fbcab9e
-
Filesize
5.2MB
MD507de194ae8da32318c7e30b2ff3a34b3
SHA1d731277c8d87faeb3cede633c0bd50188bc134e5
SHA25633c46154a246aa9db75e98c1fcd1150e55853504e0f946eda92d60579e2a111a
SHA512a28a1083fb6563e4e24c6e5c9f068a4af01b0ceff8bb1e91e3ecd43e69edae0aac93ea300628d0145b1080c435e832f0f15c83a32cddba509407d3769ea0ba57
-
Filesize
5.2MB
MD57937b267a6a1f461f037c0baa9dfe3ce
SHA10b013f935cf06785f7d14d1d4be7af90b5698acf
SHA2562b7605d025d9670e63595ec69e78804d8e1f4b4078239cd7b7d32a913e26e530
SHA512297167c53b48cb606b278bce97c193723eb398b8c225ebcc9602352581b8b2d0c35837dd91b7d6b1db10a3ae2dc9669af79170cfd31412240e004578f1bad775
-
Filesize
5.2MB
MD5f4912b12e14bab6f0ba0cce587183221
SHA1e3bf36dcbe3fa9e472b081e8107fe27dd251cab0
SHA2569a6c8d378b510f6ca013e934cf40c6c02863d8f2248cc4ae498a83b2a5e4e529
SHA5123f5f778d9a0f0037a7c92301a51d9fab702fc7481d8627a7952247bbb0088dd7392e177111eb113630d42b09d5b15c2bb0bc4895e592a8bc2f48348976a9a2bc
-
Filesize
5.2MB
MD5d3a0099cb4f890083fb3de35e3dd7eb1
SHA11e5fcbcc3214e032e72812d60de41e3a54e79309
SHA2562cb9d88f9b18c5b34e8aae7d1c36f1920011a03fdb853c3e3cc4905e7931616d
SHA512c3c37297801041d7cd61fb3e3f01de29aeaebe1c051d863c62ba752c06ca022aa312e5631a6ace95e56c61c33b0de0921884e0744578af7a34a2743344eea8b9
-
Filesize
5.2MB
MD50c73e0ee0b7e01846c9b29a7e107794f
SHA1d645e45a21180823d83c978f5f539461e6e05c4a
SHA25608f08fde3c21cc9d1506e6cacdddc2c567a69ee65aef3cd9d2c5604dcfad1859
SHA512a1bb0c9419483c7d390aa03193caab7bcdbb58bc3c326981a370a12c62a2e0fa69ca4c076a9675d41d39df8bf4932dd0e16ac58f6e269241970cb9558f1cbddd
-
Filesize
5.2MB
MD54d118c536ef1cf30b7742b63e3365c8a
SHA1db7efe76138b93115c833832d29dd32c6a6775cc
SHA256f4ffeeaea238021981faa3bcca163f67cb37f10638d193c22b4af144b8b567a5
SHA5125292e21b96ef06cd0f880ac8e1d6bab0014702baf3434530dca888af02b0818b3f7e0c10f080b2b3de11b78cc3d4102889ba5ad74342c759f6da5cd2dba890a1
-
Filesize
5.2MB
MD5ab48cd7bec2c7e660e7e8c80300ddf62
SHA12f89f7397046cee4824b1283b01785e60ee5198d
SHA25652bede377855abd85477eb6ab5509abf63f5eb026b461e159592eab5fadae0fd
SHA512d088daeb795da50cb241f330807bde557469ae471c087482c9aa19f475dd0d6aaba880c3f1de63eff14498f1801eb390d2f408cac12eec4116cd7fb3a646ffd2
-
Filesize
5.2MB
MD5149d10538a602877c2d83d7969b824a4
SHA1e34d35e68fe4d64c709f958242edac1001e860e3
SHA256f312ee7585f9c0a2b4d732a4a19430d74cde2b430fd35283737be96ebf3f8db6
SHA512925bd1e6c93c496b2f324ec05a97b3652d55f5f46b7e3623030c13db13f30d0373d1d197a88679e9922d1975a83fe1e2544c95c0efdf88185cea2b03083206a6
-
Filesize
5.2MB
MD5047c6422775135bf805aee678306e6e1
SHA1941fa0660e2da8fcc9b34bb157193ac129fe35f3
SHA25625cc937575b28279e41f4313bd88bbbce445ac1a97ea29c446a02e8ccb593652
SHA5127821b4f14604de0da22eb7a7c98c70204c39fa5ab7c8fb6fd02667ea4ed81cc4c54bfd75b7aa31474d2fea09dc3a51177cde94d29fd2673701dfedb16781c4bd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB