Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-08-2024 07:28
General
-
Target
2024-08-21_1b801362a2d0f1785cb6ae18dafd7815_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1b801362a2d0f1785cb6ae18dafd7815
-
SHA1
42ce9df75df8784628409362f5c9e7469eef5ef8
-
SHA256
4060e745f1bac843f91f728039aae342198bc5763fb40b1aad1ace8e2ed59efa
-
SHA512
95f33514b9e025742710651ba4e342d3a6c54f7fc1fa655ff719cd40e990b7737f1f6abe854c7efc8063b4ae03d136efcd22f49880101e9425be07ea0a90d7d0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_1b801362a2d0f1785cb6ae18dafd7815_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_1b801362a2d0f1785cb6ae18dafd7815_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\pgUrkeF.exeC:\Windows\System\pgUrkeF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrRzorE.exeC:\Windows\System\BrRzorE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wpPxnBT.exeC:\Windows\System\wpPxnBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uthNmgl.exeC:\Windows\System\uthNmgl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RSjxHVz.exeC:\Windows\System\RSjxHVz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WumUDkG.exeC:\Windows\System\WumUDkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QmPsoqb.exeC:\Windows\System\QmPsoqb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZTjxonw.exeC:\Windows\System\ZTjxonw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGsUtmt.exeC:\Windows\System\yGsUtmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YphiHyi.exeC:\Windows\System\YphiHyi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ojhlNBZ.exeC:\Windows\System\ojhlNBZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nIJVGvd.exeC:\Windows\System\nIJVGvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QgvaLdX.exeC:\Windows\System\QgvaLdX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WPHmKEd.exeC:\Windows\System\WPHmKEd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HUayhKp.exeC:\Windows\System\HUayhKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGzRwJl.exeC:\Windows\System\RGzRwJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rWhthOy.exeC:\Windows\System\rWhthOy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leYctvt.exeC:\Windows\System\leYctvt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IEPvXcb.exeC:\Windows\System\IEPvXcb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MFOKhub.exeC:\Windows\System\MFOKhub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAunluG.exeC:\Windows\System\wAunluG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ffae52520db6d462409cbeaf4cd1485a
SHA1a6cc578c9589eabd13afabbcc65977b9232b3714
SHA256cd29765d6e72aa73fd4af8841fce9b8b021340f0243a54e582b5c76f6f2819ca
SHA512f43939356583fc18a600a2c746e731f7d3ca4eb9c37f1bcf26a49cd91d65e2e5c33a8d2a705fff588db3a44e057ae59ccdeb33a709e7b24e280cbea1c60f2e05
-
Filesize
5.2MB
MD5dca511fce740ce163bb6edf9c2af076d
SHA15154e9c1ba8dd77f8873e15fabd33195acf92f49
SHA256b7fb07bd433bc5f3d0546ff16e7b65035e75f0989188451c337472a7c5277cb6
SHA512ab18ff571b31edc6125a916084b372ceef54369f117894362357875db9040a44fc5fd431ff9b016e41cece46a892a14af44e2e18c9328b72da48d14a8c5f664e
-
Filesize
5.2MB
MD5dffc72652bd382f844133e03aae19fd5
SHA15ccae0143cbd245430d834d60d9cceaf3882a028
SHA256ec6f0f57c81bb519271731079b5f553b35b053d40d77bae196d62201913abe0c
SHA51208ce188fab0229dc4c975159bce687aa92d02584482a8caee9ec0cb2f4d91aec0d2df9947c43b3ece426798dc6ae19a76eb62b194545f1ca9575e1a590e7ebc1
-
Filesize
5.2MB
MD5882ec767a8d86334b015b48c2a5369ca
SHA1bcb45585ff3f07555af9eb1a4b57a7050b172509
SHA256f3ebef86eb675b21757379026d76daba8c7e84c56375b7e0b5fcd415d6deb5d3
SHA512ded2a3497635c5038a184880a2806f3d8faf30022597fb182009a07089b67c4ca715ecd5cbb98456dfe7de0bf6fbedbd71ee46e7807da49b21dc9d3fd23b1fec
-
Filesize
5.2MB
MD525f023d6e75dc2d405bd9c4f10e4bd75
SHA176607652535751b4c8683bd97d45ad4b82191fc5
SHA256ed45062ae46b801e84eba4b0f7a1add944bdeb0b0542dd716c5c7b6a81c82045
SHA512231b14e961ccd65f7f9218a723d50e0946112868017600f0bef39a02999b1ce25ea37b344cc1b4e65a817696b6e5a900f974b317ebfb52d73bdad8086d3d6dd2
-
Filesize
5.2MB
MD50b9047cfcaa0cfbc03d858f6e746b92f
SHA1cf1c2a154be22a5ff647a10e00a7d9049e964eb2
SHA256cd7bccc818d449cbeb8d5479321c4c121efe5617b2a484699af6e3c47dd9c0a2
SHA512cae1cc04b3cd4d01bf080e24f6e926d953cc2777b23895c820e59facd568df324848795186c8b723151c1e016d2ab5e8d9a32275d4eca403b2185f49b5843863
-
Filesize
5.2MB
MD5ba66bdb093c780d4a201436865df2732
SHA17bcea8537b82b7ff5ffdd304b5fa36312a486011
SHA256e304253f9e1bdc7830d8bf107ac51e24a38534958319abcd3a4c1c58ad90246e
SHA512386aa00652defabd6de57a37b23d749be44b7ebc709db0a89f79c23a423369508274580dbb7b5442d1c919489f7eeb9c1defc2b2a540a3024385be81208d17f8
-
Filesize
5.2MB
MD5c6e0f095d5eac7074e081cc7224b274d
SHA1110c764817db396543cf8b5ae9abcc7c22860ed1
SHA256bc46ad17ad5fbdb4a71dbdd2b7f3244a7319fc79899986d7e092acf99eee299c
SHA512c177f37b5e37c733892b72461842cf8fa5244a7c544108d234bb957fb40f416ebd99a333bcaeab9d1cf578e6a9727f650a05198885b0f3e1abab19389cdc95f2
-
Filesize
5.2MB
MD5fe346a1923f8801bee71058270afd8f9
SHA198998a1ac5cf2a862b3bd9e93f6cc2875d7e5ee4
SHA256db3958875a1b48e9552213f5e4e6d102f9f1d453eb5bcc332c21e33eede755da
SHA5127ad2d14eafa14da675837a84f9a59e3ab320085650b1a3ab9ae9319ae7482a1bfa01bb0f0c389d3094ba8026dd066108b18b7c1671de5e12087e21a6fddc66c1
-
Filesize
5.2MB
MD56a214d0d1e990732b255d0b5dd78a9e7
SHA1a0055462c065cd91c67945247fda6158312924bc
SHA256cac843b76e3872043b450b5afa25ee12cfe7674ed6652b63da781211437972d1
SHA512ba062ba20c3c3517e92b7fd12150316b408c4ca9134e2bfef3cc89cbc1f2a2487cc777a59dde81e10c54c3ead76e6dae60ab3c13cf37b69c6b26d454a3403aa0
-
Filesize
5.2MB
MD5a66d7c2e220fc346b48255619e494859
SHA151883d9ae801af5b59ec8adb816d08557b8fc606
SHA256a1a60f56548357323a8f23891c787d1ffcc72bef87ee23d354e2029a4b37a5b2
SHA512707a5ff16f4077db1ed09aaa45db8b903cc71b377a83ad052c7a8bb204f611f3e3ff80c0f0336508247535bac651c77a958f7ff28868c8e91f2a9c990803d116
-
Filesize
5.2MB
MD565cd64f40f445364d416552357fb872b
SHA115bbd69010e2713f92022f097fe8f659283eac77
SHA25690b80964ca4f8d428ac36f985adade822cecc8761a704a61c14c7a7877155818
SHA512b8323aa10f96fdc41d5c4f076854598d29d1023865dbc011dbe3f630ae34ed785c9ce890ab32364ebeea486a97861e22fb0e7f444e0f77c2e3658210a647d106
-
Filesize
5.2MB
MD5468f9c86f0becab78dcc75ea5bdb5002
SHA1dbf0c1183ccc5defca2d599117d6b27df312f4be
SHA2569cab8b7ee3ec0ba5a2b8eef64e7f5f498523435d23d852a00b67504bdb1525c4
SHA51275c8a2383bb059ac3868b1e706f6afbea86c90099a59fada70d24c74ae072b8c4bf811ceebc027c9aea12f25b8bd51b3b9aa9979e3c8a89fbb2a950631078a1e
-
Filesize
5.2MB
MD5062f301a52490ee2f661a5d6f2c18c19
SHA1a70b0b8a08bd65050e0225b1caf338f30354a5d9
SHA25684343d6a33022cbd7be88f1e17137de6ae8ab4a0797c4080171fb978dcc427a3
SHA512a99eccf8db38a6fcfa3fc7302a033862c89e06610a7b2105f2f3ce55a7c645a9af5a1750991d860239347a7c2efef32587b65c1f10d28948b23980f92b43bbda
-
Filesize
5.2MB
MD5917888356ae2eea374d4cbf14f5c1f79
SHA1a8b72282fa2936235daca0830762f1a610108a86
SHA256b153800c50d958c613da504c85a5d6a2037fcc16ccb4da50bb4cb5bffe06eaca
SHA51289f6265545df94b83d953a6c9babeee65bf4d1f0ced8e9e59f8e3e8225238f46994dde96176f883f2f3b77641500e991beeea0b3afe6b9e730b068e932f80d65
-
Filesize
5.2MB
MD51e39e03c6a48da8677c888e47d557a9c
SHA109cf0c1e47e08ade3951c32de47179f997e02239
SHA25651dd2d57a684cd98288b47ac9d67a300a10815b9fcf13059ef7c870f2d5f0b36
SHA512938cf959248108cc20aa116c116e192c9bddb5a67d982feac13369bad77f13fb4233beef0ce6ebc776ad3cec3ceeb2984e336babad7cd0ec0a5eb4ee679ac5f5
-
Filesize
5.2MB
MD58b318945e9f662c7b4e90663b61c4a43
SHA1e98b8f48d634c05782df18d580ae3c625b97dd6f
SHA256af0add402aaa5f16eba66ad2bbd4c1ab54358a3da34d00454ca698497a519337
SHA512ff9ad59e9d0bf4b756bf4224d3b1f8c9033cb348adbde0e5f7fa4f58efaa853b3cc4a3cfcf1bb785fcaaf65275a2f4ab3572393f32c6d24e9403c20e90ac25f0
-
Filesize
5.2MB
MD532d38ddd8b44d869a1e869c51252a394
SHA199f9366828be021a64c1f2e951ca11fca84434fb
SHA256ab7d2739e88cd0858dd94883fd60c4e6fc16549a8d2a2582f8d876349bca0361
SHA512b8b82cc2c9843dbbd201892a1a239ec6d4fceac497e6457d8a8440432527440fd2e93d6b4d50f66bd08f5a846e090a26529ccfd81c3d5502862bfd2746996c06
-
Filesize
5.2MB
MD5ac5fa17120896ea5a5fff656ac8bb5e8
SHA1f90d2781b36c83298c2fe2e618df5c966f1c5046
SHA256577faaf1fcee8919687a49423508bc3653dbaef1b42ab521e6ad1e4c2c6cb480
SHA5120cedfe8a4a0700d3d7accc16caa4c5fea4c28f8fe261e867c46bd7f9c88546171eac36e6cc55011176b0d2647134e641fcfae39ff199ea419d4f850aa52c2114
-
Filesize
5.2MB
MD59e3c6ff45e6cfa64bda099e3da78e827
SHA1f5c16b97233d7da5448b848fc65e43d75d2ac1ff
SHA256e4cadd87904b3cd85605ca1bbda1dbea0e646704d265f12458eba4638d8710d3
SHA512e95e0c025206a9c51e6cbaf003ddd43092d259df32f1a9d90df9b6f15e7c7edf74967b784d54bf5b5f11c679a3d02f910afdcb9107577a5e7c70338aa3971cc7
-
Filesize
5.2MB
MD59c88979a4ad0df68aa3e9f6c8205ed31
SHA1b51d66b91394f784b5c1054caba2bc052600a20f
SHA2561eb0056ee889c65540225d7eed9c36b135abb688e1a3cf737a824495361470f0
SHA51212e97bf033dd9ede4efea21960d8a3f7318eba9d3e22b0d21f25db6a1276600dbf0a7fd8b4abff642d6ad7586470bbade7e6dfab14f70403a9967edb917dc7b1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB