Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
13-09-2024 04:08
General
-
Target
2024-09-13_948e83230eaf0a826a040cf130417f70_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
948e83230eaf0a826a040cf130417f70
-
SHA1
8024415cc6a9dc123193654898edcab6231469b2
-
SHA256
c98e38671207ed64c795f6b83fee0b14163b804d42520e08dd240b555d70dc20
-
SHA512
bd6a5578bef13b1f5153edc7967648341290087e6905644e4b47ea1f0ca1be4a43ce88fdb127f99d0e2a4d048ced877de01dc0589f96129ee6ec3271692eb8e7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_948e83230eaf0a826a040cf130417f70_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_948e83230eaf0a826a040cf130417f70_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lkgiMOX.exeC:\Windows\System\lkgiMOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bqvBLnB.exeC:\Windows\System\bqvBLnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JMkbwiq.exeC:\Windows\System\JMkbwiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqCAHdC.exeC:\Windows\System\eqCAHdC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLXaIAL.exeC:\Windows\System\TLXaIAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvMXscH.exeC:\Windows\System\XvMXscH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\knuZZBd.exeC:\Windows\System\knuZZBd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\udEuwNR.exeC:\Windows\System\udEuwNR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UKedBhR.exeC:\Windows\System\UKedBhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDTyMky.exeC:\Windows\System\TDTyMky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JCAikuF.exeC:\Windows\System\JCAikuF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNpPufQ.exeC:\Windows\System\tNpPufQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HsGAgoD.exeC:\Windows\System\HsGAgoD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UQXySdq.exeC:\Windows\System\UQXySdq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdglMDL.exeC:\Windows\System\jdglMDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcznGfz.exeC:\Windows\System\jcznGfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQrfrzv.exeC:\Windows\System\aQrfrzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVLQGBW.exeC:\Windows\System\NVLQGBW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjQPmFT.exeC:\Windows\System\wjQPmFT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vcXYtDm.exeC:\Windows\System\vcXYtDm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oOpwAUm.exeC:\Windows\System\oOpwAUm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD569578c97da44ae1e650495f5a54c90c1
SHA195fd0683e7299c49b5dcd123460f33ab34250aa6
SHA2560c05d47aa6150a48eb0d4078d49abf390b420ff166bf1369b98cdbbc3b28f5bf
SHA5122ad06ff711d2478b236758595132d2da0bad6e9eb7f16174c40c4c36d9f924221d44ad4c6ccc37424ba6aa4d6f5ccb9aa1cef3d5eb63fb93f948c69ebee910ec
-
Filesize
5.2MB
MD5f9e18d26759d00332e66f9846c56f0c1
SHA1fb407eef089602651566c9257a24cc1b81cf1a72
SHA2562ab023a8de51a5689a36eba3b57d1884939c9df2d4702993199cd3ff97bdf79e
SHA512aa7496d72963fb85a0610571fd442dd66e870dfa6b81be91a4603ffc08f598e96c9800d949a1f3c2219539882e20c2205aa86ec7266489b5122bcf62a44f744a
-
Filesize
5.2MB
MD5c29af281a39b1a6084b7a3172d413c04
SHA1f37ba4f66c1641b31d02083c1fd97ce65d8e41f3
SHA2566bdee2ddd03e9a632aa58722d2952a926b8e0c0f185800a6efaedce96fd557e2
SHA512bd0138d3c50e15ff8d82f3d97f3791837a926e9cb12396889c55f7900f9150d0be7a5b42202ce261539b7b9c46112e4dee6ff715087d89b442b87aa9c39ffefb
-
Filesize
5.2MB
MD55d969e79492566ebaafb6f43e01f16a8
SHA176905dfbdbc1aace6e448e30ce607eb4b1f48d7f
SHA256662ec485a78316bef25644f1ac3975b6da8859ad345f76a5de929b81dd574b83
SHA51298de642488430c2854a845323c0b28f99bf4fff92d2f21078757bcba8ff5b9c30679ad4730b237f4a4cd600a15688c810c312e922a5da89bd93ccf8b223cf0dd
-
Filesize
5.2MB
MD5798df23060d2ad5093b9508d1a6b1c7e
SHA1dced4a28c3090e51c9bb5d0788bd5b3e6eda18e9
SHA2560a12db4d193c71f4fbfde64f9e53dfa66f13908dab7c7a2b61bb84ee0d0d0433
SHA5124046b57b8af703ed7ed5c38ce647e6a6ca77d36df71f3aeb9125062020912d1286e532d6e4fa4a20f5b97028fa9882b397e92b65899d06dfef94190267d930b6
-
Filesize
5.2MB
MD58371d02162fedb3017f03efa8fb0f8e2
SHA133565b08e07465cf5cb3696b60a8beea4bc994ae
SHA2563e1c92ce4a9259bbefd46bb37934b144ee225685e0ec89994a70c4d5c1f5bc18
SHA512425e27ab1c5e21e9fc734541193fb458959a73e083bc4546d49937d953d54bbe981ee6d08b2b269cef29665becb41114cbae711d61a587f18f9ea205842bff51
-
Filesize
5.2MB
MD5287e0b8b02b5e3f537b48975ddf5d4ea
SHA155801e6e4b809ac6b0a396b1ddf69ec1240d6360
SHA256a6f7a8e382604b90943b2a476c3a3adebf02f9198fb68e29d00b4d3b19140226
SHA512879cfc38befe3cd24e2e780d8da2b6ea213f7f16e0b3c6a7a88779bbe6f5cadf6b8523b597a3dcfaa16d68fd30c06156cd8f26b064a4e6c67d6ebb570be608ec
-
Filesize
5.2MB
MD59b4fa59d0f0b85dfc47f5c950d5e9fbb
SHA11f8444a64727988897384a39851218be066bc434
SHA25666380f4b0048887138abc6cb11f2b45f3b1323974330fe3865a4bc585653a7f7
SHA512fe37b3ee2eef0658b27efd6b9b95d6276d3e7cd1c54fb503d7fef39e7b769a6ff4782e6f51713a451944c17bbf17cd5f84af81210aa6c2dcaeccda2e224486fa
-
Filesize
5.2MB
MD5965f82c836693d14fb3d1f3576e0c40e
SHA120132ebaf99b30c250c54ec13f50c256df087349
SHA2564b0d633f3db081ab1dc640e4ad159e88bb86eb81050af7ba8a41df36c601fa3c
SHA51202099c106752928d30e46cdd7b6aa2f93de1aa6e6af48fcacee4149bf27648855dfc50ebe6c90f441832867c04f64aab5617e685f5ee81f1a480f80565c546cc
-
Filesize
5.2MB
MD520019a7bff71fce70d41dc80a1d1ecd8
SHA1ce8602521f0045218e24b245312122a059f70726
SHA25608f5b5bdb85b4a4bba5b8eb72faf01e170b4f99105d33c682ee2c1d1c9e14b0b
SHA512461307e6d91e17a24f10000aa12f5085894f650d9f03c644f1cc5665e7390c6c2d09ae3b55ca63ae9e17e8a6855d6c4f0c7fdf5bc5747049ef771ad861c31e24
-
Filesize
5.2MB
MD598e7dfa8b4ffc32d56ac4aea9fcefdb8
SHA11e8b20cb4748b0a8574bf00bbfa9bf29dd0a8ed2
SHA256a521c7b9fd4c83cdd628328ca590acd9eea967b4944a1c08ac66283044bab8ea
SHA512df66b0db48af4605462d26806605c8701aa2dd89ba35604d7d7deb2bfe10db0c15f42d92e12c40eaba8fa1e359e855156abc2076e65d3e794064fc5739cd714b
-
Filesize
5.2MB
MD57bcf9c063ee5e4fdfc6e40eb9414c2e7
SHA1613437421dd258188f2e2a4723cd107073d57a2b
SHA2562da6d7ba831c3f71940189467a113c56fa32dd0e24c11413a58e821112ac09ff
SHA512361dc3ba6280abbb89e4c0ac3c8287c432ea663bdd5729b9174aab68aff6baf8557d626052a65232709ea8d609d1033dbe4c38ddfa0f2d742524cf9c989e70e5
-
Filesize
5.2MB
MD5fec15eff76c203debd44f4f867307561
SHA10840a98432005cb2f71cffdbc7be565cc873216c
SHA25659b5a77ca8e371bc74cd40f99d270e0608e5d16c0d16c6566d91fa2a980e9122
SHA51204527dae64cb1fe45d597150b20f2b8a666311c4e0fca400ddbd7ddaddb64a8f8194f06412dab5ed094a592cdff5400cfb8b5aec7e28e50b835e5408896149da
-
Filesize
5.2MB
MD573e192165a44ad48bda80635ed4be7bd
SHA17e8e73a44bade1541e06332b75ff8b66ed9af7ee
SHA25685ca4f69fd9f14fa1df9bdd767cf08695a55b3a6f32338bdc31590459283922d
SHA51291e45ef9e7120b075e1848239512df2522362da27dbec67e289991b511a5911a628671e43826c57fbb1fa6e9d1dd27f671430aa1731192bed293a3f0cd34d6f0
-
Filesize
5.2MB
MD55d8310ccb2cff6a1a74bf1b50afe2f4c
SHA1418880f856ccf3adce66b146fa1f024e9e1001f9
SHA25635421b5b15663de4360b3f07cd01e4539f5cb9bfb004b879aebe17b44f79481e
SHA512cb57879fa844d7483f6403d6293dc0f7b9f69951a027f32051bf149c065c64c8c774afaa3b841af9c830cf18216e8686320a281a9c5951b855c34b0222c26018
-
Filesize
5.2MB
MD58289d07944980e98e987162c73793ba2
SHA166e84a353a05dbca84d39133065a37dce0459902
SHA256a082a26952d9fde7a1d228dde00771cbcfe7fbb4717b5d3abc8430636d110a55
SHA512409a144c2745651762ab44266053e9c53477db783e8c946a15d4469c9cec08d35ce291b7704800075a83088f940dfa79a2f6b9a397c6f12734837d30c7fa0588
-
Filesize
5.2MB
MD5604852c3c1b886533a4f4ca0437b44a9
SHA1301e977458da539673320674e14d7fb3cc74cd44
SHA256a3c92d8f3f10b44c9fe2f233f9d166b8646f4672889deaaebd0c54ff4b3d91b0
SHA51211348deab9afe48a21bf0ba09579174a7d7eb6ed0b4c54f9416e450591d64a303f60e0e0ecd234f3c025ae2ebc4b0a7d7b6ca6bf799144953a197d54d3b8a009
-
Filesize
5.2MB
MD5dbcd43b2c0e5fd7343b32454e8e28039
SHA11ca64ff62696f34238608d779498331dbe6116ab
SHA25667dd41cc859f8408df22da93fa57a6914116f43ae8f3fd00677d12547f4bbc27
SHA5126318c135fccf64659bb56dc4031a5e9620f4f10d06c433f495172883c73ec48e9ac97b7ad76d754942c5a060de278b1fffd76a8fed17726cc2f40ef9b6919876
-
Filesize
5.2MB
MD524543d57816854f70568312689d889d1
SHA1ff7a1efeebc829b2cee6671595441ff9347b403f
SHA256d3056a4bb059190de5105d6ab04a7d45febe19c664f8080bb816d8f5ba313838
SHA5124a379e49e6d1fc057424eb02b7fb6fabd4a509e668d5484aa8b120d002a037d2113def4731e4c5efe389723bccb8552b15fa0f32c2814908d9d85ced2d66e127
-
Filesize
5.2MB
MD544cc2117b489d43fc7e34f3a7e6ddc53
SHA13909af1f7f4bca5fe6873626fdfa6c41ea238673
SHA25630d9ffc436cecad05736657fa9c193e13621d2440f703bce1fe037df6fcf147e
SHA512b669acdfd5c4a0b50d43a9454aac8760b0414d179a59ddd584aab6f267b8e453984fde2a5e40d427843f3057dea0eb9a20b2d7a68a623f3b4ff19699a75525b6
-
Filesize
5.2MB
MD5f401af3b2bc03df47a0e7d4ea2a01ee1
SHA19031f1a4a5e1540febb9b8b02dc4cddf1b26f227
SHA25619740885861d9e95d084988ae2c04eb59fef8cb616e62253e4f200d24182455a
SHA51262987cf8da6864794930227e941b752b310fde5ee2d402ac1b9c7a39424d5178cbd23eeb47ae7a2de9338eae173401479b5c333f8b123a694b461010ee59a4b7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB