Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
08/09/2024, 23:02
General
-
Target
2024-09-08_22a78eabde98f942f0513bda3391a1d0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
22a78eabde98f942f0513bda3391a1d0
-
SHA1
1f38e94429c0aa20dba296540cd4e7921fb76cd6
-
SHA256
9896b3a2d7393ea7c53def66661b5045f1067ebf63c2e15843717e0ea2dbfcb2
-
SHA512
34edf4039016d79ba00b00a8e2bf896db02965a1e4e51b143f21ca104c7a33e0e94e797023cb790529ffbf77421daacd04708336214f806a892800a20cf2618e
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_22a78eabde98f942f0513bda3391a1d0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_22a78eabde98f942f0513bda3391a1d0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vWUkGSN.exeC:\Windows\System\vWUkGSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kSpQjTi.exeC:\Windows\System\kSpQjTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HPQsPje.exeC:\Windows\System\HPQsPje.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DYovPGy.exeC:\Windows\System\DYovPGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxAuGsB.exeC:\Windows\System\BxAuGsB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wEnpWLZ.exeC:\Windows\System\wEnpWLZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTzahIU.exeC:\Windows\System\eTzahIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MlhUheC.exeC:\Windows\System\MlhUheC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ErCSadT.exeC:\Windows\System\ErCSadT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdYoXzJ.exeC:\Windows\System\GdYoXzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WZuEMxw.exeC:\Windows\System\WZuEMxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzGVqfy.exeC:\Windows\System\DzGVqfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIbLvEF.exeC:\Windows\System\ZIbLvEF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzpZFXc.exeC:\Windows\System\RzpZFXc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qAlCRtz.exeC:\Windows\System\qAlCRtz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uViHlBy.exeC:\Windows\System\uViHlBy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shCwWTc.exeC:\Windows\System\shCwWTc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CvDPSsV.exeC:\Windows\System\CvDPSsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NiKUPYm.exeC:\Windows\System\NiKUPYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCFHPxz.exeC:\Windows\System\lCFHPxz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EIEjqzc.exeC:\Windows\System\EIEjqzc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5843dac3aa7f4a7355ca59f906f7f307f
SHA1d5c3c19d1320ee388fc6e8a0270ef7c22df72354
SHA256bd9b7fda70d67baf21bf24447318718235c4066d45e23956e4fde266ad1fe74f
SHA5125edf3659a2b8f203b899704b7d8c6bed3ea5ccdb9b6af6874b26092391af11d8c0ce24f917bfeb39c4b181afd70f9d5604da849bd3fdef1c577d0f40a1331d52
-
Filesize
5.9MB
MD58cecc775546b94496e49ddcc4706243d
SHA1cfffc38c0af26bbf5d99be4bdd2440544077651d
SHA2569fac94a44a27e6e38dc0386ef131bb49917095f79b96eed757a2f6a8d329b237
SHA512fb95a8c8e772e957cc979482682e562b39be9744e17de430f689abaf420f1ad5dd5a988a27222c578bcf75e6deb6800af431346f108d5ced03d9a139a5156535
-
Filesize
5.9MB
MD59ced827856daa1ceb6a92e6ca51bcfb2
SHA14394dee92572e7a0c7d294595618dd5e0128d339
SHA2561389f7accc43bee91a31ccc67fca07c7800c63fd671dcedb2e0b0e9362fbfe9d
SHA51266ae86799fd89aa65726ae3cb7a9664ced00585ba31d3f42f38de3fcfe4183e12d6fe8b481f0142246e9b8d295a5bc9101f9b0b731273178b51a50cd431c6549
-
Filesize
5.9MB
MD5d5ec5946a1949aafb77b98648d4bf2ef
SHA17c1fbd4f5bc15ba4b5530bcb097e3187a42a3dbc
SHA2569778dc184334287b25512bdcfa2037eedf46618e7f2a541b3ecf5ff5118bd74e
SHA512fbc4a3424c9b191a3c0b2a2ea910240d667987371defbaf97cd5b17ba6767d40b0be1784eaf9fa221611140eaa4e3cf2b9f1690c1678528e01ba61780febec5b
-
Filesize
5.9MB
MD515907a172c93dae0a10c4eebd11f70a7
SHA189a8a6708f5219f21ef1bb6ed08f8635674dc6d9
SHA256f91dd400ee80c5ebe7cfa8ebc539fa411934d15677082e5ef40e1a4b094d446f
SHA512dbec4bd6eaceb6a1d1f089589704a4113d59605ebaf4fdf580fa236dfca169a8882393b5c58323911d54c886fb561a0664fbd2cfdf4d11438ce0ada50736c4d7
-
Filesize
5.9MB
MD5570e7343dabe3baca10ce5621f8decbf
SHA1782412efd04be3fe1d27be69e608609c979a3343
SHA2569487074670dab9f416136ea7ebbf75990c45d2b49d974848999111ac743bbb73
SHA5128e5757f18c328087df44fc6edd650d5fabd532a9ead03fddd4267324c436088be132c9e1465cb7bbb236647530158c3a86f3e3fc8dfde73dcced17ebb380b1b9
-
Filesize
5.9MB
MD5784d672b00a5522c7336a13d5e540c4b
SHA147371f6a1278c5adcfb19998910ce057772e0450
SHA2564bbf2a13649ae3b9d6a6b39a5fc2476491dc24c5102bf19e7cdef543202da251
SHA5124f7adce20874e06e4c233301c6440dd59729b51d8495b80f1cd9d508397a388b939d1d4b4a83c356cb84dab3f9e01298d5c2e0cc462adc3fd0483b28049fbe44
-
Filesize
5.9MB
MD58d0f5f34bda565eff773472281a21979
SHA128d38a1739bfa0651dc59eac20868779db61c0f3
SHA2568ce0c6c1f81ea58be74dc824648cd21d3e926d19e4cd2565c102c8eeafd90562
SHA5129272420522ab73dbd37185decd664ced940584249bcf11dadacecb323d198d825ad8a6ce5aebc02b9a8992946ccaa8c045ef33902c58a49c2da90708fbce6bfc
-
Filesize
5.9MB
MD51951c5841feefc4f1d8318e085052db0
SHA1264d38800a0117269accdc7155ecf3e70e5962d3
SHA256ba52dae3ab91be2546022cbd591e19e0cddb6bd60aefcc24c074c81accba072a
SHA5127855171cf6ec138a60345bb48197146881ecdbf0eb69ca0bb683e4ac6919f46629eb7da6da266b39942d32b06774b66984fb306b32106b485eb998129fee6802
-
Filesize
5.9MB
MD50ec6e98859e8b91076b83994b6674aed
SHA177f67a372d15107f038b7273ccc150323447a9d1
SHA2568fdc3e1bc5b8abae29c284dfb6a5e976dbc952dd10d258bb5d4ec5844e149fc4
SHA5127f7241a6fc61ce1ea3004b60675e38790013696e7c16f64322555f099b12c4fe327c90ffb9d18e6b67bd1a981bfeb34f024b4922baeeaf0f6f5066d798588f39
-
Filesize
5.9MB
MD5e097a2aabdc81c3ca9eeffeab5f2a951
SHA1cf2cacf91476134118a5267323c8ac7d761c8f93
SHA256b53a6744ebd4ac1c1517a09748299bce44281bc16f6189d98c77e8fdfe6af70c
SHA512b0ec146f0190b601521db3ac64754bc13b63f1626219e6c8cbf6231aeb2e003dc15ea8aca73d098abcba18063668b9968b4742449aa9bf29f3fe33d0442a262d
-
Filesize
5.9MB
MD59e1b5c6e93882936927ca94206603e74
SHA1d1f21a43afee35416ef02659075f32c584490d86
SHA2564d3770786e156a6bf6213094502cdfc800ebe13194dc328ede4c11c2f5feea6f
SHA512af71ab01ccc51d3524581ef5a3199965a340a2d7c5c44d2db4acec5e0a52337d86d04d3865dd5deef5cdb365edd6db1f94b8bfb9b46b1099b1e9bdad7400769e
-
Filesize
5.9MB
MD52cb32d06251fa244398e6e99dd617837
SHA17b235069778975fb3004c9f98bfae246d38efd16
SHA256aebad584230a44fa1433542640e9796a230b5c0edbb2ab601763bbe133fffe9b
SHA512b2352da616c7b144c493df3316c80f66d60ff918466c503e46ccf2a17cb3ff6219c4cf119e215f1b7b7175ecbd2c1bdf02e02ff7dff4ddafa3d6d336eeece417
-
Filesize
5.9MB
MD586a8435aa698d25b7c94623f2f0eb893
SHA10a570e00679714bc1d7aaa973f22018dcba18d54
SHA2563adea62da3c38c29fc0a81f08e875c50a42b7cebc3da1d0222d7d13a197a686d
SHA512257d54dc01ceb10fcc3e0d12884f586eb43fa2caa88ff01813e0728feb5c1acd99026a87088a699f9b7a1c4c35176b04d912b361e168856d1bfde2c35a81e6a4
-
Filesize
5.9MB
MD5f700d959321bdd12263d93e93f0aa626
SHA1c17bcf7e6552d8b44bba234d5060df0dd0e4fd2d
SHA25683531aa3b9773a015095992106c479be12c4bf04ce5244f531f5be591010224e
SHA5125f2b300b5a28f99e091c965906e56c1a82d9481fb422e84f4c77bd775717e1205c9e891c95ceaf207e0df000aa4014d7651b4ad1f4248c0d151bcaec1711c41d
-
Filesize
5.9MB
MD5d7b81620d7ed70fb5f8a87fd0f0f4124
SHA1c449b0f9df14973692b76a6fb84c34def7d17d6c
SHA2566ff03163944f4cd3d05030b0f9a4af7112125e0a9448f8af51dbbf8961752c97
SHA512c18a72a391c9641a7c31b9eb12060e2e6b6d34604ce73e0436ec119afc4da199d619d3c85b6cc804a28b6871ce56fb4dc415fb4c9bc6a9fc04ca9c853c9312bd
-
Filesize
5.9MB
MD54c67cb3bf897047152945cba30d5365b
SHA1a7e7766622d4b5d016669a5d9fffadc89e452e8f
SHA2568cdabf6818d459ada608159c8794e17e7aaaa287c6d773f3ce2ddb7a739ecc65
SHA5128118999b97f3854d1e6cb789f1ce77e02bc1b9f484a05d57418fc2f39947d7b4d5264cfedc16650889b520166936c0bec0d6b1c30abaa4901e5d944c9b388495
-
Filesize
5.9MB
MD59b25a64130787510817e14bf72487f07
SHA1a700b4a66fe43456eac4c26bee4ba35632c90278
SHA2565d71c3d6d51c705f6ea11891574a628795a095ee40c0c85e572138eb1889260b
SHA512c262657f5e4cf99156968d41069471a1000ebd6a1a180c2841e99e5aa770136eec93e391dfff1fc17a2d8642133b85a4b64a981fd85853bc3d0badfae1a1e617
-
Filesize
5.9MB
MD5e833ac8a97914cce8e0d1a7aad7c87c9
SHA149fb90362c03ce2289a12bd2b59e9c7233dcb7e6
SHA2563b8ba5140d3f22e7d81b1e24c3330f15ab464b8bf48c5c9cd9c135e27f01b74f
SHA5122f846e2c8e021c5d47c13805a56d03b974e9a0536bf6fbb4bf8e5bb23a9d9a1e4df9df2b230ebfcca824994645a6cef758cb9d900333cff6228f430de8c4a2fa
-
Filesize
5.9MB
MD5dabc4f738846cf6c3becd6cf1a59da09
SHA18da88a7e648a3518fac57159e10959f2d65ce2fb
SHA256250fe6d1c6f82c435b99021df8047ddc91075582923baeb0931598828731333f
SHA5121639a0568ebc5db5f895905171473fa59a680d7103ae556ec021297fa7408f012fbbf4378cd96acee61e8eb27a37df0acfb7131234864dcc05ca08b0781d364c
-
Filesize
5.9MB
MD5d2b483f816f04b8b459ad54cff523393
SHA198f9b5d796341fcc3cc9a3e4d6d6287a48872c94
SHA256edbbaae7eec2f8434c4abb45180ca5acfd452f2354e03b7149704a8eed16b2bb
SHA512053adbcb86159b76afbb54b79e1da56a0ee1e62525b106b3d15b179aa17ca273697f9023be5a93826e42ec2da53436c7fa63cfeaee5c6007ccc99e982845f519
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB