Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-08-2024 12:12
General
-
Target
2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d045adebce54b55b783c2bf616f6ad20
-
SHA1
db4df8f67b7f592aac6c6ffed15e5164468f53b2
-
SHA256
e6ea8c95a3cafebbd4066c0c901401bae7f9df558ffee9ce3e793e618d59bfd0
-
SHA512
8a540628418b67d4e16d7464d966b7df739118c85d35f2d6876f6986a02383d7d3b5ef5a436ae7bf4b7eca74160f72b3e7904d84888348059252330fe6871699
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_d045adebce54b55b783c2bf616f6ad20_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HhfcbHk.exeC:\Windows\System\HhfcbHk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvODDSU.exeC:\Windows\System\pvODDSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PboYbcN.exeC:\Windows\System\PboYbcN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugIbYKr.exeC:\Windows\System\ugIbYKr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRfJJQY.exeC:\Windows\System\jRfJJQY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jfiJOxb.exeC:\Windows\System\jfiJOxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MpulSPW.exeC:\Windows\System\MpulSPW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcuMbFl.exeC:\Windows\System\fcuMbFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVtHpeM.exeC:\Windows\System\rVtHpeM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRpGJBk.exeC:\Windows\System\BRpGJBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUmAhla.exeC:\Windows\System\XUmAhla.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQuojhi.exeC:\Windows\System\aQuojhi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\htvMxGm.exeC:\Windows\System\htvMxGm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UyhIFHD.exeC:\Windows\System\UyhIFHD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\himVHmT.exeC:\Windows\System\himVHmT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBIPSgu.exeC:\Windows\System\fBIPSgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDZnFRx.exeC:\Windows\System\VDZnFRx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IulozAv.exeC:\Windows\System\IulozAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dieuchY.exeC:\Windows\System\dieuchY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XLwdzKY.exeC:\Windows\System\XLwdzKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\npGFupw.exeC:\Windows\System\npGFupw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5799d5fbb1eda67b9a80de66caa1c4a43
SHA1d6cb84328f56e45635225ebc5ece40c568fe4321
SHA256d50c0410a974863da30cce040b040dc65937c94686005592b322c58673bc9f8a
SHA512d823cddf844dbeb215b62decb67de43f4ee05ae1b02d336d5e2225706b97864ebd5c28dd394d11919c697c6209412eeeb04bbd5d4218f22511682eb9279cfd2c
-
Filesize
5.2MB
MD57e488ca7e3facb11deca005abe9a69f5
SHA1ab3bba736096ad9491aae1acea22b143796212d2
SHA2560f27cc241d3f5e1ac227ebbc5c69d491050327f673aba78e0747eae706f4be62
SHA5122666f15ab61ef7b269380259030cababd7dcf457fa07f2a1a16c4a4eb54b2fbcd4149d849f574145e31e8d6fc75d28be8be50f6fa891f8a451fc7effd4c30ef9
-
Filesize
5.2MB
MD5ee926d1e486880424ad4d58e3ebd0d74
SHA157de04b7d600d19cd5e3cf16789f975457e89eab
SHA256714354df0ebebf61c933ea31e6017b915a1047bd56aeff93a17fb5bc40d611ae
SHA51215ef6d980b72839f94efcabb84dafcb02094638f44b50a09d856a1c27710d6ab886b44d6f34bb8d730e5a869ca5c0866ca418e2e64ed74ae8b2e8694e516afc7
-
Filesize
5.2MB
MD5842a6a73adf5b2ae53f8f59e92f21a19
SHA134f6455f75ec3028bb65cf690cd946f0c7c5caec
SHA2568631df2f9c7a1b7e889d726272dbc1a9860d702becad010649506b34b10c5b44
SHA512229084a2d86185c9de99cf2fd553529b573292e5b6fc32aae7883f943c993acb474c0fd13515b73ae8ca1c42115a552ea10110ccf30626b39e099dd790445667
-
Filesize
5.2MB
MD58d88e6a2bc4061043907ba70a0a68476
SHA155367d3281953b881fcafeae13649b15ef13ea5b
SHA2568ab234dc3b0c4d6a8bcad40bbe017c55c254981010e7c4e67f3d1022d36db6f0
SHA512dba841cd29f2f429f067b3d92fbee8c6cd19e1280643b676a447b71b71ef6a9dc9dd2bc509854f7841514630b4c16977bc6a98b2613ea68ee4b9bb41c9b3e83b
-
Filesize
5.2MB
MD5d9bd904f4e2f76f7c4c2f4f5c3acab1c
SHA18694be686329c2336d414c18a7806520417346b4
SHA256a1f2f967a391a5e6ac2a7b908bca64e4a5542e928b9e4a33cf6ac3510262b17b
SHA51287e37250b821d13ecfff14bb6a3a27a7a1db5c8cd5faac9c5946fac2f4cbedad85dfcbb98a1e62e370607b666816efdf9c76111139b72eb3cb1c6b41ae1aa9d5
-
Filesize
5.2MB
MD5fc36b1ffa625a3dea925981833c271f5
SHA1d43d0f13af8af40ba5c65d24460b00971b82b8ad
SHA256a8046a54b05eed16a44a9e49ff664d46f5954cb6a4b7ee7633afcc6429dc62b1
SHA512f34846239d5c1f1c6bbba3ee6164e832a9153552740c4cefd86890d40e510256c396c644d4a0d6c6bb5b2d46d36ab0d9ff8cc310d7afdacec9774d6cb94d2e00
-
Filesize
5.2MB
MD5b96a2eb89948cbd9171a1f6be8c7f48c
SHA10e3e1cddea81dd79187078a5efd16534d5447d67
SHA25612db60488627befe7b8e58ea91003d16b1b75e59a77171a78a7add241001403f
SHA512cecb20beed670498f657f636ea615fb00fc15cf306b8c0fb9a0bc7b30dd2cc59283c778dcea26e5991f59a2b0458204cd5d1e2dd63ccc95beb38c75a9d38c257
-
Filesize
5.2MB
MD546d539626e2106fe08d46e427aca7b4e
SHA1726f01650701032679fd30292b15bd0bc4631f04
SHA256d974512d90ad91f668350b14fd665eaa3b9d35a84876df6889959918a0b4dc58
SHA512c5cb1a735e9705f49027cba62fc869348c120ee7e278ba7feb7e61695add6d501e8ea0a51c1095c8ca88ac670fd6f251538648ac861ba28113d723ccf42834a9
-
Filesize
5.2MB
MD581748d7066ae5e179b0c3df4dc33b5e1
SHA1ddd65c1cefdd60e8f1483017099435af38874bfb
SHA256cf2380b5d77d920e231bafdd5eca8d40ed18c084f349bf5e69193998f75969c6
SHA51297774a503089c5b596c2d88f0a43e2850160b8cf3da9a9e8f78b5f9e4e95cac084019b6d88524b8cc5280c8d74e7fc5856d2af7b646206b4bac0111e6f68e806
-
Filesize
5.2MB
MD5c6cd58dc9a214cd325b729267b6d64e4
SHA17d212b5ae3436d3f32157a57cf8003f00fc35708
SHA2564ef4bd8e445cfe3cde6afcda454682917b7d13e386c512d472247b090c8d8ef4
SHA512b6598d82b78a08cf6a5c623d616730651fb77cce2eedc3e93abfdaac6aaae4676238e004a63f3f8259325c9a80fe254c8a36edcae858db14d0018c382ddbc57d
-
Filesize
5.2MB
MD5ec508679333ff481eeef7796c8c9cfab
SHA1c0fea8f27d00c28c975d512634f9eff7b6591cf4
SHA25603922632671bb47f17d2daf7f4640ae8ba366941b14a500ff1cc36bc31c8d341
SHA5126c44648a4fc4a332ac4a0b39ee7af9ea1965be1c6020149803e95a6bb8f1eb5c2080accba550c04dbcfb784ea0f78a7714f76c96e39028c40eb1a7938263faaa
-
Filesize
5.2MB
MD50f7cd30dafb0489e136faffd96eef4b5
SHA1b9c4a11bcaac6f8fcf25028fc80cc8d8fbcf722a
SHA256c47d949df387d4468eba39fb4529a0df4533565e0dcdb96e595d4c1458250d5f
SHA512e81f78326a8d0ba9029daa371c7bfe7800c8018815e8a70c33934711b9ea43944618a429a908d7d9968d7513c7730cb5e42ccf4208d69a81f6c2a831aa13967c
-
Filesize
5.2MB
MD5938537bac68e7007699ce76e6e1e7355
SHA16d9fd7272f53de015df86c7c1258fafb61c74158
SHA256e0bc1ea13473b003472153d4afb2f32b2fac932b0a6d111dbe7b3d2c0d20514b
SHA512fa0928b8f49adbcbf55e9bedf8e7f4094ba08b6c2596c61aa9c7f81159d086289b924970c00a4daa612b5197364124e7d16e7c02152a75e5dd50475108f15213
-
Filesize
5.2MB
MD54e7036b2e1232c36d4a00c7ee50dc1d3
SHA1ef52bfe124a2961ee2f89c786063c75ff542224b
SHA256456b96fa2b89a1f81ad4b25051a49ef4ed91249a3c1b301c6cc12b6bee5bfd33
SHA512c8fdb513216219a62dcb4e0571f02f83d8fc819e611094b36049bec50955eace0b8d67f34417f8321d42a97dfafdd13c8efb2b53f78bd381f602809d5fb62a5e
-
Filesize
5.2MB
MD51249529865b524111353816264f563c8
SHA1e5017629aa56b2dc9a9e9793f5dc343959a13a24
SHA256a6659c3ca040ae74dfb228f221c3dbf18eaf3d7aa9e368c5e73390f723f55e57
SHA5129c4c2be08eeec27760aa9a8edd6282be111aaac1a4942191ab92e9e70f58c61a44a7695bb3617a578f7da29f22226bf0a8766f45f3c38b0fe118bb186474b4ed
-
Filesize
5.2MB
MD5645c5a97083caa2ea760dbb5c5131e64
SHA1db9d1e07a4646012cf135ee468b4daca8ce6bed8
SHA256956db48d4f08f40e6a20bbdf513c52d0c4ed2b1757dd0b3b8961e8b5f9edb1af
SHA51288e60bb8c258d22f1e06c8501163354b45b96a2b3ec985e319660edf00576bad39dd8a2a58ba192e8a486496b12345684a42180ac0a67b2bbbdbc9004ab84512
-
Filesize
5.2MB
MD5b5b74e07c3ef71a78c70b00ebebe767e
SHA1914484a710c5cd99c9166b87547e3aacb5b14ec3
SHA256404fcf0084170ed2c23343bd0d2afbb546542f89dd05b259f6127bf7e660042b
SHA51223c6251cfd81bffee6e08e36538e21879aee6f8d7eb4a296e7e3b1c4bba4c06519f36e3d66c8d912ae37a29c31678ab80361878764520631edd4e6220fe978aa
-
Filesize
5.2MB
MD5f68037925641f2ce9c3177d302df6bb4
SHA1b024be620045e55e7fc0390bf5c5ffabe4011ec3
SHA256219c488c6d547b0536b16a64cf06f94498ba23314970bde76cde3f85e8f2b3e2
SHA5120d9b098524be1e8225d432eb75b7c9d5a17456f5d4def97573f9c512bfd9567f6c406567145ec16b06333175bd67e5cf554f5aeb09523c5246ab900d963e5460
-
Filesize
5.2MB
MD58d850e5b136888b8e0c3e10c71ca40b6
SHA14846e836f35222ccb237416443cd1458ef08936c
SHA25672f24ba23073ba289ba8d03985305c80c8105b9e1d9360bb7360afb8ae776194
SHA5129265d3152cb5ec6b6df51c09fe664a96ab3b93fdbd9635b2ca759518ea1ca90e9d749d1a810da1e2c96cf1048490d7ea61666b6176d8e1f6036288f12fb11346
-
Filesize
5.2MB
MD58f7766850d28405b52744553f229c992
SHA1dbbf8ffccfea52e638f1f0c96b2582d92080d62e
SHA256ff63015f708ce2a852ca8d8db4f2e2b552b5f449d85faada38d20a72cfe6cbdf
SHA5126ad246ce678fd9d7660a3a177ae93487401c2df2a7cc95ac1ad1f41a30167aa7b9cbdb7d9d0f5ec9f9761001601fa32d2c167f52a40b7f1b8e4e31dfdf272a57
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB