Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-09-2024 08:48
General
-
Target
2024-09-12_7dd40001e116b288fcf54977d0bffad4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7dd40001e116b288fcf54977d0bffad4
-
SHA1
4291d238cd72a1c43857d842b4a91d392495c191
-
SHA256
a6f22d5acf621a1f02a417cd6a5214ff252be471539cdd0e052409f15af95dba
-
SHA512
3a2c56247d2c8a500554e2a11ec15097c486d939ff10fd1c72f78848063fd1c18c04b4648bce6bcd93fac1cd4375b6694b24ebbca19a46a00c819c86f78af8f6
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUq:E+b56utgpPF8u/7q
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 63 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_7dd40001e116b288fcf54977d0bffad4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_7dd40001e116b288fcf54977d0bffad4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CFfbraz.exeC:\Windows\System\CFfbraz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oagcjFK.exeC:\Windows\System\oagcjFK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IhBeUiY.exeC:\Windows\System\IhBeUiY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BgaZDwu.exeC:\Windows\System\BgaZDwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXfXjmW.exeC:\Windows\System\OXfXjmW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lbKyJqb.exeC:\Windows\System\lbKyJqb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OOGaARx.exeC:\Windows\System\OOGaARx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BtishsV.exeC:\Windows\System\BtishsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cYgobwv.exeC:\Windows\System\cYgobwv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pJTYOlL.exeC:\Windows\System\pJTYOlL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\czhglWn.exeC:\Windows\System\czhglWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vShBVDR.exeC:\Windows\System\vShBVDR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcruQRb.exeC:\Windows\System\fcruQRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZmkPgvC.exeC:\Windows\System\ZmkPgvC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MeZXadl.exeC:\Windows\System\MeZXadl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHRpfkz.exeC:\Windows\System\xHRpfkz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGGcrde.exeC:\Windows\System\zGGcrde.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPSjqCF.exeC:\Windows\System\gPSjqCF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJdNQRr.exeC:\Windows\System\BJdNQRr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtYqQJc.exeC:\Windows\System\FtYqQJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gghRpsN.exeC:\Windows\System\gghRpsN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD529d33dff447e834f9668ffaa9c0f89bd
SHA1ced765c4d42bc9e6aa3587f9ba2d5feb322458f7
SHA256c272caab00af1588a9b62ac5cb743438677428264b6f31e300aedc211ad8ae63
SHA512536fed3a15ac8036d697545214ff665efa382a911820cd6fd0824c12a8b2405662a1bac4cebf57e3c797f395c6fb8f74c7c135dbc762e2204f30b5485107d0d8
-
Filesize
5.9MB
MD52cdd5adf06ef7a86277afe6bae182bba
SHA110322e572aca4e86d10699efe2ea5cece3d6e888
SHA25667fd7afab5fb4f318d76aae15b3a2597b33353a150980c7bb5aa5db445f0c8bb
SHA5127f6bc3428f518edf5b09184744b65584923cb2cf7c8420e8ea1eaf1e6604ca5c59f84bd41da92bac69199396c04e8cbb6197b3a9d814c5d876ad96d37a7a18bc
-
Filesize
5.9MB
MD536068a854ec5d46a1b04e6475e3f4b0a
SHA1b28d4c1a57c968dd2979bf066410f0e1e4e8c6e1
SHA256e8d2b2a55e644b2ca9f3acb8903464d710cc3c6c74af858d4f6dcf6b90d882af
SHA512ae95f5f7257e7792aa16449af9098803e8ba540126ee443a3ad509b4f67e07d06e6a19323520a7c38d3b466ec84db26e14797f844660bac75e25101c4ecc1249
-
Filesize
5.9MB
MD55015b32c28244137eba3ba5545835f30
SHA179839117b85bbe9bd95f465972aff5ed695f8a14
SHA2564c7381ee18bf706716db10c0c754206e5d218826b9822af5b653ff12fb34715b
SHA51269eae30bcdc4ead155a0c72b50a6b81fe3c262a3646b0b0ec55860a5382d90ed7531a0e5ad5e3b159b98ca4b4c779695e906a2cd718428d8808e37064b0d2cd2
-
Filesize
5.9MB
MD54efbac30ca254f953ccbf901d1791143
SHA1998e946753578c591c86044c3cff780e78739fde
SHA2567d99c469b64d4127a84a6edace6bf736cbb162af0266b874740fddc2c7e4bfa5
SHA5126925dfb216f5dc9d9d02d0c16bba0b776248b9660ac1417951fe15108faef6d976f08377fe2ed38bedc9f1b0fb4f7447fead3211456d2c6ebd554ef607b329c9
-
Filesize
5.9MB
MD5ca2a1f7c194b9a4a81dcbbeac748af68
SHA1dbdfd674fa7cd47fd66ca48e5951babfc285d8d5
SHA256757ff1f1da3c54ab32229359777bb21315045054de07a67a333878aee8ce333c
SHA512475f3f1e0af3b7e3f66c06c3724f1f6d04df17dedfc7f9de423e93bde0addd83908fad0e382935ce5c31f6363d4c4bfba7dd9144a0f58222216a3db8ae29d1ec
-
Filesize
5.9MB
MD5eaa60a404eec0d8930d2bb3f7e672861
SHA1c9894621ef42cdd0074cfa7a10645ac472458456
SHA2562a9c9b661615178a281d16e01ecd2241c5857546b9daea78b6125cbf2f97a690
SHA512a5afdead0a1381f8c8766a92b31642b65294a7f902ab0015e920a2b389850930a4f615cd9667a8bba0cc9321007bb092548c2dd5f2e4966146ad80cc2ece20e0
-
Filesize
5.9MB
MD535d79d440d8b4701ffca52238645aaaa
SHA1c687e147798e1ebd9bac559d4a9e14a50ada3932
SHA256c53b0f284d401ad92ffd885a43b29747916b58731a3c2a219d75fa420c824025
SHA512180598d152256ce643fb49bcd5ead6b31bf599e7383d60f086d3507a91af2038ede252c3bc16aef168072ff1cb705b137f7b794a0252fae3b60ea6c1949965b4
-
Filesize
5.9MB
MD55bf93e3cce444e8e0eb8b5794ca8a18c
SHA1654a0ecd704c3fb194b348613ad9dd53f3c7f78d
SHA2567cdb15ab108204f58c235f0f742503c6f2d0e4d608a4ab7cd9d69f7fc81339c3
SHA512262d67b9d5aceffae7d86d9834f0c82ee851153f84aa1e51efa7f2df0a7984bcee5f22a92923bb82c9ade7e1bc94263badca2d9f56bab0acc4f4621f50ec76a8
-
Filesize
5.9MB
MD5a96b561e5d00a0ffa79d50da7c3e63e3
SHA1ff0112d18071848bc504461ed85245cdeabdb25f
SHA25667ef9f8ef5b77e280ab41356b616b01d27bf5159f89d116136d64b41b86c63d3
SHA512eb1e02733b94f789b4715e82b0c0639800c8518bb3fce5196e4ab965107f9b7b029fee1ae0f2731b786d564c0543b34f55941aa2425db6f7bafb5c0193493815
-
Filesize
5.9MB
MD50d8205c2f3783bb16e9c9182de47792c
SHA150c705388450a94eca5bdb45f1a8c78d0d05e9d2
SHA2562cca966e19f80e6145980bffbb255bc5832b926d13b145e46c2bd29d94f619fa
SHA51265832a247311ccba6af5a4d75326bd44848206c5eaf1243f7a67eb2dcb997d5cb752b5e0b88bdaf1f7a16aefc958655f468003b5a2617a4bd99d438aaa2b9552
-
Filesize
5.9MB
MD51cdbc37e90dde6d536a0782919d42f19
SHA18552524861a79e1059993be715a09d8ae9e02d17
SHA256295a0151d765029afe3e728b3db47621aa3f16809bf8632d6a6b324b3b643a58
SHA512c087a9404f51a25b6a6c757fbccce8aeb7922ce42a0f4c9c0fd6d028080548812c73c4f4ea910f0fe49376dc2468f9b32db9fb1f290614112744832ccc80edad
-
Filesize
5.9MB
MD51815060d73be8db28c666c8950dd4bc0
SHA1a7270aad2151fe2d635f3be2c33d5a611c5ab72e
SHA2569856ad001ec58d2230ad970eda2919310a092da90560635da73e6103fbe1a6eb
SHA512430d688b8af4675bec4f8bb3e74cc46e6ff180a36d2ebca8ad76f050cf1564bba68a0c26c8936a5ef2ccd7fd3be0c3de24aabf094c43bdd4b4f770d75a572014
-
Filesize
5.9MB
MD53b0caa6a2b05d544572782c009bc3636
SHA1855c71bcf4968e85d901c9faecf2d3654458c1b6
SHA2565299c47f2d7fc8bcf65b174add6c40f24c2308bb0a2947c1fee7f1f2e9f94cd9
SHA512306cbe3f04eb1170240c5191932133368e80079c11289891b58893c135bf0b7d0210f43c864fa7b5b3d668bd3a1d3fb86ace7a3959c216468d1ada3a386c11f5
-
Filesize
5.9MB
MD55e7a8b21f1f55611ce9d56fe87318d5d
SHA1cd066f51b5f971a5f79011d6e25407a908764666
SHA25675663a2c47c302a0dc763d6d3a34eb41167ab16489ee37f4fa88c542f2364010
SHA51224623e01ade86d70e254ed49923016c6424a86c783eae4d4af0b5e74da8101e279265e671e5710f0865319391a195f2b0f3f3630599bf238bc4f7e9c6d11eeea
-
Filesize
5.9MB
MD5841a9946c293308078e770ff07572793
SHA1a17b81d999fe660a3543c120a8ebcee3fd597fcb
SHA2563321b5918d422fd342795f0a5b166ff9a919b7a2bc17564f58403eb8ecd93b02
SHA512cf8fe354f5668e7fb58e27fb17e36f0f2e4c7354acd7a88af1a648ce3fa5e0d1251b3fe27263916486f7ccb02dceb1a418f45b2e957c887888bb07185d797910
-
Filesize
5.9MB
MD588a716cb0ba83a35f69d34f9abc98a00
SHA1de01f05449d5e2bf2fb97758fd78808c191273c3
SHA2564d2858ba95394f2620572eb9ac6e54ec5332f0820d386d938f592899327c8854
SHA512d45fffd371b9209615a639345cfb5b4aad9a4e60533be44a12c11167447e2a1a4925c1b6a54058a1a9b37efd47e109128840e7a1d957ea3f4765310e26c83c2f
-
Filesize
5.9MB
MD55c1dc923444b06bc4020db4edd1dee97
SHA131559c1a5bd67ad1a30f14610078aa91b2629fe0
SHA25616f26a4adf5069246c068f5e6e5c24a929f1a9406f25e081b7e32366dec5c179
SHA512b07afea7f4081d4eadf3a23782adfdd3a182bdb3c4cb010cc7a6da6875cc4fef83cc1724f17c27ce056443827f918ab7278a8e6afbd59a40720f8194edb3f703
-
Filesize
5.9MB
MD5d9ad7e60e63431d4258b3c1aefa9db5e
SHA1e831b6cc8fe8e01280eb9b6c924fb73728576d0b
SHA2564b1b49fabf5bb0f47aeefd03756b953d1f479bfe5840d71e296de7f6c4e0d45b
SHA512827dde5ce447d1fe7c5f0c05942f5b73151849ac0ece306c70473a262e9dd5e7149136c4c74e7cccda46383488de1f1639d685de9e13b8bad02104cfe7d224bc
-
Filesize
5.9MB
MD521ff8191a09f44a164fde942617a2c1c
SHA1c75a456c4d6d3124ad513dcc7a1781908bfe6ef5
SHA256b30176f6d928b53856040b4841a1eb1ff31dd4014a10c1f5550f8eadcacf2d13
SHA512b6f45f66d3a02dbd7ae73120a804a8da6f2ae9a57a473bd30f70a1092a29b77dc54f65745591cbbd1776aefbf82bc855dd4749fa719729679c4139c0a4c2502b
-
Filesize
5.9MB
MD5eb9eabba71d496e4b64a9f07ae137e7d
SHA1e2c56ab1092d0ad89c0ccba4d30131ae9038fa36
SHA2568431ea36eba9483b509066ba79d75f31881a97cf9d6f9b44d0859177b219202f
SHA5122a22e9716817570bf42321daad610d90359870e1d9b7bc544c310b9f702a93148867176dd534070bc42524b9374aac9edad4aa8d315b3e9739ed22f83a74f63c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB