Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 04:18
General
-
Target
2024-09-13_aedf99c03f75bed657e10527d3721c70_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
aedf99c03f75bed657e10527d3721c70
-
SHA1
fee7181294a7b62361a503cfce0fa14295af3862
-
SHA256
238861a3ac9009e142e23ee3f460ac8a01a118ff7930c513c268889eededa7ea
-
SHA512
efcf36b4ee3d818858b8b94fe0736844ac7a015cb6111dc323aa529db0c0c7d779d2990386a9ecfbe378f9f4ec4449741ab1f85ba42c10b2fcc4e2a5d66291e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUs
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_aedf99c03f75bed657e10527d3721c70_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_aedf99c03f75bed657e10527d3721c70_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NuhrWcF.exeC:\Windows\System\NuhrWcF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZAuZRSM.exeC:\Windows\System\ZAuZRSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMsRExY.exeC:\Windows\System\aMsRExY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FRlkFja.exeC:\Windows\System\FRlkFja.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WZjfbDo.exeC:\Windows\System\WZjfbDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PWFNcnW.exeC:\Windows\System\PWFNcnW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uOoNcRQ.exeC:\Windows\System\uOoNcRQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzHKEqA.exeC:\Windows\System\KzHKEqA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVpNGtI.exeC:\Windows\System\AVpNGtI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pPHjcXU.exeC:\Windows\System\pPHjcXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNQznbN.exeC:\Windows\System\hNQznbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qYmAUMb.exeC:\Windows\System\qYmAUMb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOljZvQ.exeC:\Windows\System\qOljZvQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KpfiVii.exeC:\Windows\System\KpfiVii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUeThin.exeC:\Windows\System\xUeThin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LuqsWDb.exeC:\Windows\System\LuqsWDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVVtqig.exeC:\Windows\System\IVVtqig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JzBMupP.exeC:\Windows\System\JzBMupP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtyUmUg.exeC:\Windows\System\FtyUmUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bFbqwpb.exeC:\Windows\System\bFbqwpb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpVIgsf.exeC:\Windows\System\YpVIgsf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53248b0b8e359ffc6c26ab2f2088ada78
SHA1de25dbb99535369527d910c7758d0c3e79e43a8d
SHA2560182344a395f4e34b8bc1e88b3bf94b20f0bfd36c838f989d35850985c1369d8
SHA512a4106d0b116091b1f1e0c7d57c49d38426a4339d09856128dce0fb7bfed26a3c543cc20fa7bdaa5b74129133a65a1b0b11ef76aba66cb2c142019f04bc871a7d
-
Filesize
5.2MB
MD5c344b6b638e01b1da7f1242935b57bce
SHA17a7cc5c313428c6e914c520851ca37743c586f27
SHA25688690567c00a7643be74450fd30be035c28c30a9d3c64f2803d9b37b0c7c7b53
SHA512bc4ad50bb715b8e1dd40595469be4b56046f07714c36658a9d82b260401cc93170dcd78654aa8e3b1bfe5e90386f391bc19e2cbcfae62a8b91dcac1850d6d062
-
Filesize
5.2MB
MD597cbf447ae53579cfe722221f09c0002
SHA14084c35b41ab14b91c20013c5c35b3fad118f6d5
SHA256ec97e32e9c64434c1d32e9fe12ab8c45c9672b6ecc7d4da3f054a1360239b738
SHA51236da5fc63d3b6309618c782e854091c34b88d169fbe05d8e9b1c4e6a6312f308da4e73a2dcd356a52f8d3e0a24539747e417477bb5206644ce1a06f697f2a9ba
-
Filesize
5.2MB
MD50a4e76eedf2d968b9be78399d97cd25b
SHA178733e02254fe559a50d35edfa7800b5dd5148d4
SHA256288ab75f1c70d2bb19213ee6002b62bfa666edd4700a0074048ec39effea937f
SHA51276c7efef997327f5d77c3d2af4a2d05c4e935821af09b19e5ff6b2edf7b8aa98a0ef98f2d0eae070f0cc3cfd15a06bd9327a2e09ca9ffde7f249430fa569c1f4
-
Filesize
5.2MB
MD50292ecd2456ca8064f0a956fa59097f6
SHA1a3ff1ffbfa5d61e6deeec6d584227f6e148fb9e0
SHA256e446ea1a59fb8a72fca6d13777441e5ba4853ca64c95f9048658731bdc51ba74
SHA512fefb8ab2588b3cc146c61f08eb443bbfa4cd606a2e96ae71d39724d1b46353e9cc49447d10067be7ca4fb93fca9bb810eb7c590cfdba17da746a6baa7dec0ffa
-
Filesize
5.2MB
MD597ea149c34ade9e48b4b1d691c373075
SHA10580a5d78c50088249fb321060b41669485caac3
SHA256a7392a2f3f3c485ccbbeca2321f4b69ca3c0c4a07a5eccb6a92cf58c51b5b7f3
SHA5122b50680b3a2ae94d092a1c12152030c53f5041fe624ea06c90f360e8db0f3ea285d2ab9cafbea056ca3d2ca4871c3867c215a09bdc16166339d0ae40a9b1199b
-
Filesize
5.2MB
MD528bccdfa60875054b91c1867e6b64979
SHA12d49ab4da6fa58c59a57750a964ee14eae47540d
SHA25618bb71fc1145d43ad8f0019c4daafd9d3591692f440d4940ed8ac901ad2cf243
SHA512e23e2609e6f305691a3dfce3240a5f829a66dc39ba4d95e8e1de20072d42e6d4e58c483476875bd95ed16222360eee0f6e0589720d309dec475e256319e4fe17
-
Filesize
5.2MB
MD5146f1ce3f959b854c192d58d1dd64358
SHA1b81d50822b5fa63c1a407f750387e1959b465339
SHA256f6560ff2480c112305d86b1ec9dab1ed788150a647ad2e3f676816d1c75a92ba
SHA5128fd3eebdf59988aa52f317d956f6fafc21f24e2915adf16f59657589dd39f3b7fbb7af60b10f41d78c09681b1ef474818a75b75fb4f0c6729a74924e70003265
-
Filesize
5.2MB
MD59e6ec15be7a8854a9ec74256d5fcca8f
SHA1e45467ded171f882b9b691a54e97ff5779f7ed9a
SHA2561e4331901b3504c8fc86eef6c4639b72a00feab7fe1edc7c5d2f79067450c66d
SHA51219e7711353a9f7bc46fc42dccc6740451ad1864178f3842978fd357dfa0ef741a0b49cdca711c7e1b57ff9a241b9c12ce91beebea051ab4ecc3adccb92455250
-
Filesize
5.2MB
MD5f4d08039a2f6456bcfb6cb05652847eb
SHA14c3d3716349f92cfe09450978eb86a0448e11e1d
SHA256df103619a0c773b09b73b6757693f4dbf41cbf4a0b60614f2cf4fddba97db61b
SHA512a6752a586f6507cbfd8a2838a3e7dfd79cce52064d0538e0663b9ecab7c54f3613c1edf70dd3ab23288186489969f387e6089938d8a361f380a2571cc99f632d
-
Filesize
5.2MB
MD53dd1ff136160f94b3dea63fb89b413ec
SHA18fbd6fdc3abb65e8767e09853a59fb625eca69e4
SHA25621ddf3227a03d2317e6c2f9828ae8df8d342f34413d6520f09ef5d7594906951
SHA512900c8f9ddb728fe19f003227e30e6b082696a8048c582246f1645d1a6817dbb876f6b8716ebb6cb39092f491b4f55a220ec529507969a7721f3b93bae4986658
-
Filesize
5.2MB
MD56a10f01c90b764845a0ee4db42e0e340
SHA1ccc5141d9fc1b9e84dbc6c068a7e147ce5b441a2
SHA256688c945176ba310ec6138c840a0363fdea778d2f69fd75ab120d505016d4d115
SHA51243d33c2ad032fc4ed559230cc6a11b6bd70730a80e99e3babfe39c3d8331bf9d8dc2b0074f82bdc27e219e031c63d0b4d3774d30f3f8397ab25be0c83371f1cf
-
Filesize
5.2MB
MD552a0fc1443492a294187b89a6d1fb7ad
SHA1b36ab69084a811260cdfd427a7ce2fa7acbc54d3
SHA256cdeb5605645d589eac6910202f51b1cbec415633cc56a3789179a0a3faef768c
SHA5125d5379c80bbac190dfe87a38a1c2253fab4e4097bdae57a244b82ce318ad292f8bd6ca4b74eb32273cf3c81cd228c0109a14ac6247fc23c3d4a38756b1b7c9dd
-
Filesize
5.2MB
MD5494e90f2b6af7fc9e4ed9ef9ed0fb90a
SHA14449b0f4288829e7666d127bf274bf2c69d28801
SHA25686933a54757a621c9013de1587b42273ce354c7c9b38e3df96a1f8660fc5a84a
SHA51262a4e6106e807889594de771ab8d3819ef798c4ee6afe9ad9a16ec7ceb819ad37418e54a4c9cef5bb066726c2ae2acdbfd6603744212e98fe1326064b592990c
-
Filesize
5.2MB
MD5064e92e8e25b4f8f44c1f1395c8ff1e2
SHA172ec5f55855a7972cb66c7fdf4c26cc44241695b
SHA256d51b98033e7068f211f7408eeab14e8056499a9f4b3aef3064d094de90040d65
SHA512d01de241a071740329baf7ed50002f61ec90f186555978ad0d2a55f088ba3cb01e3cc946475dadb5a4bfab33472563c01f6ad033af247bcbcaf3f7e966b285af
-
Filesize
5.2MB
MD5e4a060251d82302ed3f44c3826b56d56
SHA18deae3b4b596b5304945758cc8c6569d4ddd6fa8
SHA2565b28efbe16a56205885a8eff4c8783e9f3133b16af9a3658cc200d6d05ab9b20
SHA512a64fc92ed872685f48e3b8b7682b1815b6c27efd56630be85e3fd53a99d4dd6e9942096d3e3d469db26693b5b6935687de4676ac62e837e496fab16bf76c467f
-
Filesize
5.2MB
MD52192a6f211df448c3496c9fcaac11d64
SHA1c3f57c709ffaed1c7b6f03bdd8b0515013425ead
SHA2562b7baedd5a087e5bd37d7d66315398f3bf76f34a5bd31f40839dc2614f36b9bf
SHA512e49091bf88a22f75875e6e2dfe836941afffbb1e57a4d3c850d0af2774c1fb064a7cc13b64504879d47a95c3ed9af1533756913886c745af75d9613f3561e434
-
Filesize
5.2MB
MD56a620062a2f087acdaa69151b183548d
SHA1fc6bc1594ceaeeaa4ba2aa80c408d0c270914cfb
SHA256512eacc7a924e0a575d863abed19d08c40570c660da05579b661a400e370befe
SHA512579968e299422964835b3164312b268484cfd69797fc248b1c20905ec62e408069e0840afacc48e6cc69278682d3eb40fe05a3cb4bfa3d8c6c49fa012abc3f69
-
Filesize
5.2MB
MD50f7d59b319cff32c3e8c529df079566d
SHA1176e6c26ac9830ea4c67b866159bf3955b7991cd
SHA2561b90e5907c4ec9bc82ffa50b7908c307c6f03ef483f0627494265659560260db
SHA512abdc12f8fda4634ceb188a13903d19efa78e1be0910099581129ed950bc49f166883e631f4e6132d9907496683118610c3e847dab3cce27b132568c07610bc21
-
Filesize
5.2MB
MD53b2f52783d02b79df90c81da73861620
SHA10036a8da294a4df0589c53f041ed7e3c1335a45b
SHA2562b8537230a768719bcf5ae38ce6ebc425412e6be59dedbd86b6450c0f07cbc27
SHA512dbc78d8510c326577f8ee0b71d29ea13be041b0b967f8bea9c0d7abfca9fb0937fa33e96fb2725f6542ea360eb24b78f1b484b3b4d3e3dd42da337fdc3c87bf1
-
Filesize
5.2MB
MD5621e1396664de6ea4d7e6e9b644149f0
SHA12dc2bd015e119c04f00e62e83c88442b04896748
SHA256f3dd913ebc37b9ea5110e49e8bc44a19f469043506a1985a5b102340b01373e4
SHA512f2283b35e1ae5e08c5772f089572d7f301ed0947dd21e4c564d81d7a1f8724a14182aafae68a5174e21ad1199a8643aa755ed4a07517df78b0d82b361ed8ed6a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB