Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 04:16
General
-
Target
2024-09-13_ae3bb7c136b65bbf07821a72080125c0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ae3bb7c136b65bbf07821a72080125c0
-
SHA1
35a68b70e7360e012f22bd2cc7e2fb5d2f65a577
-
SHA256
eee1b9a2ce5f4667b551cd86215a847a501ce3c34036fcdb61d40ee1cd845271
-
SHA512
7033e7086b9c7c57872fe59d8c125565aa261b7f2875176ef57ce231f580cec268c0e1be1297f2261f5e927eb72b35cf161a54bbbb2144c81ad20b2b3b8c3580
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_ae3bb7c136b65bbf07821a72080125c0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_ae3bb7c136b65bbf07821a72080125c0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AlAFwxX.exeC:\Windows\System\AlAFwxX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqTgnAt.exeC:\Windows\System\pqTgnAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DyUDBtN.exeC:\Windows\System\DyUDBtN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mydNPSg.exeC:\Windows\System\mydNPSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfIYuLA.exeC:\Windows\System\TfIYuLA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNXsDxU.exeC:\Windows\System\iNXsDxU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tPHThTn.exeC:\Windows\System\tPHThTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xMrXtCj.exeC:\Windows\System\xMrXtCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MLehNQz.exeC:\Windows\System\MLehNQz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GeptrwR.exeC:\Windows\System\GeptrwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zUkkxMZ.exeC:\Windows\System\zUkkxMZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOXsGYV.exeC:\Windows\System\dOXsGYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lkmLfvU.exeC:\Windows\System\lkmLfvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvweoKC.exeC:\Windows\System\DvweoKC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xOwpcUg.exeC:\Windows\System\xOwpcUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZWyLXi.exeC:\Windows\System\YZWyLXi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cJVrNGb.exeC:\Windows\System\cJVrNGb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NTqPgEa.exeC:\Windows\System\NTqPgEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdmGkeL.exeC:\Windows\System\VdmGkeL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RVkvoml.exeC:\Windows\System\RVkvoml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Xivwedi.exeC:\Windows\System\Xivwedi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59147770135cfe66ad27c7719d40f5dde
SHA1e4b9ef3713dc2509f7534f57263ea8816573d4c2
SHA256e73ffb18bfa644e8e6b66b4d649b6dec9bc35e8a262e2b29a04e2b26f3857d5e
SHA5123781367b260c08ddda0e5e4485231c74a9a136bbb8ed93982164e3909d22e92b893b1d599e34ef17785fede2d5699749e10ba5cc448c68449e3d07bdbce72ab0
-
Filesize
5.2MB
MD55ca56356c6f33e180a7a1234a10db077
SHA1922b81b8b371ab02607ab06088180f1a3a3cb0b8
SHA2564621e553b0203e40fe64488b61e52e848967fa8a9dc0ac85be77f9ae544df9bf
SHA512182175fd59064da26f2e2b2518267320b9b858e74a1f53efefdf52d8cb50394e179962bb6f10edc3d3d58a6764bfc30fbc4ded9721e6517a09a56be319a42154
-
Filesize
5.2MB
MD5b92f92683de80b5d6106b88b99ad189f
SHA1b8e18ccacf95e8456df1d8dd1dbb8950104ce72f
SHA2564ef0cde598fb05d5930d7af50aab82fda7a60ba02c2604041a4955df80ee116d
SHA51211b3b4d0945e130e67196fd6901f8333cb77b38a6ee1972cbc84a5f8a68676f8b5b77667649bbb59e7fe9d767e81af4fa97b7a88f8f796fb8afc67d3a1002976
-
Filesize
5.2MB
MD5945dea2d70e56b1b5c6cd01c39acb5bd
SHA1f8adec5bb7bc5b8b2e3770376c328cf9c30f54bb
SHA256f1b2b317770a18e5ffeaf2abf1486cc421796e47ce300d02a762041789229e54
SHA51234c2da7334025bff5d5dc96bef27dcedafa872d36a708f5942a456c92bb54bdab10b91aea84f53186abe453c473e0d2e59dad825f31fff550e6e30217263ce72
-
Filesize
5.2MB
MD51068c5a0bbc6045c2324cca0b65dae5d
SHA120ac6170c443622a3cd4189ed4237153670d176e
SHA256c32016688aa53f738ff67f7226000b5b3cc13893990f2159ad3b88c51cf07d2c
SHA5123e2aec14368206176d668104f57cd32a1b022c564526417bdec6065181f8f65416097b4f488a5db56d5227224f39dae3018e2e8bc19b9b03b4d71a55ca799fa7
-
Filesize
5.2MB
MD5fb9d1f755068e7cdf06f1b34cab3bf7b
SHA17abfba659c7fe40c0827dcbd6799dd257e150f42
SHA256a9016146b31f700e39e5eda855a7ca68ba6a8b0b3e623c041a0c70f95fc4735b
SHA512537b11ff288e763ffc851b19d7c4a0a23cf4045a730348184f9e2104608b072dbe52c6f03cb973bcff52c803c4e9ad7fb4a51e0b88197641f146b1b0fde13d75
-
Filesize
5.2MB
MD57a59fece1134f103b06928808f8bccb5
SHA18660f738f6c061b5cec1901cfa9d5d670e4b1885
SHA256d39a74893f12529a507291e112e4f20f8ec85138dbbd140bb79568a0dc1c505a
SHA512297cd2b792f620f19dd3b02eb9b43e0c43c33f0eae73705d39e196da44641ce9b87984f29625ff30d191f2b8cd4449d012ae1b69d2b5a35a100da4668f4b5706
-
Filesize
5.2MB
MD5ca1eb83f73918c5626058296de3f0391
SHA118b1055435ff06d179a147f2c3396378ea3498ed
SHA256a3ac58ed3d9cb92377f7720270d45f4c852be7a6a3d0d115171df9fc0ae76ef1
SHA5122b096945a3236443b053a515f0ba597fd03bf774de8ca0f1318bf7419d7022bed84263ce13619a3c1616cb2e1f259df46bb8dae34f4dc057b0dda85b23f77c7f
-
Filesize
5.2MB
MD53558ca64d84f7abd49bd2cb4cd2f61c3
SHA18afb3acbf30d7f407a8f0acec3f40f204667cf9e
SHA2566a2a69209931f3e746c7e688347e49d742a697e7e21b8ea7bf63cb5111128620
SHA51216fc5030a310c18c8554267db5810ca89eb1bc11b0c822c986c94a7131a9f96da8093307f8ff5a611bbcf9cf639d159daa7042acf9075690eefd0b5c21de8cdd
-
Filesize
5.2MB
MD59deee3c0c83acaac2ab514b42f593471
SHA12b1f2b70d074d9e8d937c15ce40db7e2aef9174a
SHA2562095fc0b05d4042211f7bc5ccbf273db8cf883950d1dbee2a4ed90fdbfc1a2a5
SHA512f3b2f082854d53e4199f53784c34386e6a19069de779d3001ae3ff5d9aca9e7db492ea8bff5bda56a3278cdc8a990c8b89fcab56ea7f0b8a4c544579b2a697ef
-
Filesize
5.2MB
MD5b2f2264c4e019368dd4a4bfb96484230
SHA19f3f0ccf854b15b7602ca3b22f0c9f3898d1912c
SHA256d49e852f0ba17c441a0a800091e43455e6e183ac23f1953a25cf737c53c7363d
SHA5127a31f42449da5f7e678a23dd0e7b46efc42ec199e40702ef1cb00c5ebcc83ca368580e53888318bf6a834dcc073dba06cec563a56199c196cbabc1246f7fb547
-
Filesize
5.2MB
MD589751ffb78ef13cc3776cccffc4bd417
SHA166057e780598192a32f96aba565843bbcea5f618
SHA2567b5586b3764a251f767dd92651f942130d468656182b658933bdb8b861099c3a
SHA5123ad0140470e25a6980c69c771a5d8678e4805b97b143dc08be5760ad50f699c232f47522deb18b9913eccaef5969a5b64d4ca140f2bb9701e5467cd65e3bcbef
-
Filesize
5.2MB
MD5a1049e56ca1adee33072e0d2d4607e52
SHA1d4c61d828275e08632958dbe594f389ad31373bf
SHA25673463dc956585dd75aa412054be03213aadb33337b8586aa40b3fc8d400234c1
SHA512a5d1e996333e5222c75fecd25c9501fcd8ddb3c637b1b930c2b2ad4757d0eef1594460d584d8b92ca94bc8cb1fecffeb9e8531ba93df71c5c6b1d44e59808dbb
-
Filesize
5.2MB
MD50497aca74ee4445b46db93e40b273a87
SHA1cc8e3da8efe0dc625a3bd618270422d61d9c2e6b
SHA25696be96f4807f74bf70e5a8f1edb8c843ac30843d01d859a1a4d6e50cbbbcb6cf
SHA5121fc4b88e205395d23f5fe16acb49e762d8ec17ede6dd07ba18de288fa05f67f318f44af1a4f221eb4620816f5d25e117814b00410d1bde63e2baf10b3a53cbc1
-
Filesize
5.2MB
MD55e1c44ae9b630e39ace818d29eefb327
SHA1bc3b09f8b35b2a15ce384f0abb695aebe59c8e8d
SHA2566be23bb38a9cdf9f5639aeb869bf51b23d0d8dd03cfb6adfbfc553ebb3647c03
SHA5121b7ea230bf0e9ba048337cdc272c273afa96329b210c6f2342571c00266c02b28a3ee9ef39ef2dbb8740a9c1978065c272ce4ad0797312f914b458137bceff4a
-
Filesize
5.2MB
MD53f99cf8601852b68bc0dc6cec5bc53a0
SHA1cec61ef9484ca0c90bad043de223b5d99af6b0aa
SHA256f4200b2f76d374181c72e36c265d5e03328c53e425c2673333bb741a9553ab1b
SHA512074cd299e806e89d44bc4b0d7b37748f99dc0590d2028b5bb9a43b491beaa7f0aaf3191a6143b90990d20cf8d17451d1f6d3654c52ff2077318df65d9f8d0ae8
-
Filesize
5.2MB
MD55565292a990a83f0bc68c2ab6d44d210
SHA10823ec78d5b7067624d4285de77d04c796908414
SHA256a5add6b8e908f133bc54865ceabfb14f110045b9b3a34e6f9832a02ef0974842
SHA51206d5bcc8584d016c273b8b4095135f2d7c468574bf111b0adb2d6aa397405f62cdc34a4a7a045651fa47a4c760d0aff5a94702f926db02cb0f008ef8afae1529
-
Filesize
5.2MB
MD50a81f135c79bdab2eb16b1d088414348
SHA176478ad3c4be29730dc3d73e34f30defa26f6fed
SHA25695b8293651337dbbd82f87135439349a7c2c107bc56e4e19da65ab56c0d9e876
SHA51271cdaa159a496fb19684d1c17256b070ebf771b507240f5d575668eda1c735f76fd82b7ab5f6a6432ed895f03e5d3014d031cdc50fb866a447cccb6dfaf7fc6a
-
Filesize
5.2MB
MD52820888b4486424b745ed89868934276
SHA1603a50dd0fcee53fac99a4c0ffbec4c719588b17
SHA256c6d4cb289b9bfd85f2165bf8b1183f30c69a4e87dc69e374d7fa1fa806c1c9b3
SHA51229637171dfa4a9b8b69e271b940a3d4822771ec9edab3e964083566908f5223265dda1b60def2e1add95df9b50ad33cd45c5268bfb1a447652e88aba129cb879
-
Filesize
5.2MB
MD5a5f7b796d5a5e3f7e091e0b772febda3
SHA1babaaf6945d60618ad5ded43764261b140e85e4d
SHA256494a0c3db0439bcd39323b736b40578bf80c87b0012a3ede2c2ef738ab6cc596
SHA512537672dc3b9165e9dd28e49a85b032274e402e5fc1921991ed1d2b8aaf9b33b69161972f5de8591716ab8796415e6e627518bf3beb87bf34ec31fbc5b5cf14a0
-
Filesize
5.2MB
MD57fc4167bdf8e14bfae5138cdbd5d2a6d
SHA11e9daf7fe608c81c0cd2c955a734127e42e4f0b4
SHA25614e80ea6faa65d88c07d9f55c048247b6101cee1b7f5eab4f3f459c10b0fc99e
SHA51253c935fa8272891b59fa7f74dba6b1344d9149b2cfda384984ffd1eb57b2cb09caf30620b4a49e8f729b1c16a9544538cf68d61a5a536dbcbffe1fdd24ef0861
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB