Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 13:17
General
-
Target
2024-09-13_a469f23efd557fb30a3b092cc200694b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
a469f23efd557fb30a3b092cc200694b
-
SHA1
feb478fa903bdc7f0a0d03be23927ba8c276fd99
-
SHA256
c1355e54fb568c049aa5e0a94651d7a9b74eb2d4b64f252a53b014a8cc493fb2
-
SHA512
10b6228d8b4af92dbe74c324520ce1859176a329772cc07229a9689f57088df9486f8e77b43ea211b4404ddc28837e550d1a966344181055fe2e9f0c11d50a73
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUM:Q+u56utgpPF8u/7M
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_a469f23efd557fb30a3b092cc200694b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_a469f23efd557fb30a3b092cc200694b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FZJoBRK.exeC:\Windows\System\FZJoBRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oEYafda.exeC:\Windows\System\oEYafda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KZIvpcK.exeC:\Windows\System\KZIvpcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gsvntAw.exeC:\Windows\System\gsvntAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RSQkrNV.exeC:\Windows\System\RSQkrNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ViZIxjh.exeC:\Windows\System\ViZIxjh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyKaZKs.exeC:\Windows\System\SyKaZKs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGVNhMy.exeC:\Windows\System\qGVNhMy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqzzuhZ.exeC:\Windows\System\WqzzuhZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYqLqQR.exeC:\Windows\System\dYqLqQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lwXOkib.exeC:\Windows\System\lwXOkib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbhMNQI.exeC:\Windows\System\YbhMNQI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BbTvgds.exeC:\Windows\System\BbTvgds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XbqHtUN.exeC:\Windows\System\XbqHtUN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiYGoTE.exeC:\Windows\System\BiYGoTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRYLzmg.exeC:\Windows\System\bRYLzmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjYVqxT.exeC:\Windows\System\HjYVqxT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YJahAof.exeC:\Windows\System\YJahAof.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DObPMSn.exeC:\Windows\System\DObPMSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADYjzWa.exeC:\Windows\System\ADYjzWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlkXBeS.exeC:\Windows\System\rlkXBeS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5cb424516e8ff31ba7c32b456ed7118ba
SHA1da3c41b3e1e68566b8afd9427583ccb7f197b22d
SHA256666508fa921f5b8c6a294aa4ea2679bb0c3f8260b983dc00ce0bb7c7a4156e9f
SHA5120f3159bcdc4c95626ce10765cadeef0960f9614141543e9fafff48e56af18168b4cf24f5046657aabca575b66737040ba6122b3ce4a67991910a1e5e726ab1f8
-
Filesize
5.9MB
MD539e74d3969981eb352ed74fc0f199351
SHA10338c5f40d1341aa4ed81428d8357ef26ec9ec57
SHA256e619681270529de47ee1416caf3a030e00b34b5f9bd791365f065bfacd7578ea
SHA5129bb6729dafe98728462dd5e2c85df358434e5c18337bc10a13a888a3bdf2146c99d9526b7726d9cc9841801256ce254989368cb55262e6c9f99764ca4b44205b
-
Filesize
5.9MB
MD5acc4c7eb3386ece86f6b42d89b498d68
SHA18f63d55cf7ac1278d6ef46bb6ed854795c364e6b
SHA25681595620909ae288d77ffeb41b0a1d4f57c5e96a43f3878f533affe1fbb18cd7
SHA512ed08bbcb13cc2640854e2ab41469d8b820bbce900f860dba82b8874881c4e36b8bc016721259c8c1d9e16f09dbd9b02895fd167ffdb0b7228683ffe7ecdc148e
-
Filesize
5.9MB
MD5b8dbd477cab265da053b809baa9c6271
SHA115f86d8ce30da8a2a4126e64257b4bfa6545faa2
SHA2563f6d352625524561f922277eeeee91e3a19dbd28d3c6f082e3d2144640cce754
SHA5124970e4f13db1e339249f41fe7e0548863848ce11b8814e7f8229f477877e99912f02f634eb7d2d0084841e365713256e998d7c0bb058b979047ff5be3074ef35
-
Filesize
5.9MB
MD5a7e89eae71106fbc0589467c2130bb22
SHA14cc4d326a9c513860cab419da52c8a819300b0cd
SHA256a4392ce9453def1a50cd8dad185c09874ac1e0932e9fee339a15c9782df05bc5
SHA5122e46465e651485a87a969a1c03ec2c01a08929dd51fae1a4a9cfe16534505c49d03ebb903668f579fccfd80ef562f6353f6fe853f8f3d15028730b0fe9e2131c
-
Filesize
5.9MB
MD5ee1bae26a65b439406c3958f98285264
SHA1fc274e4c3770e259afcb02d586b35eb2262e6120
SHA2560e183a6e40a4db5256aabc32acd6f1e3fa7ae6bba22e5b81333d9ac4aebd0a1d
SHA51228695f96f63453fdd617f834686e3f8190a66308a58e794438c4a4eef1b03f67b41364460d40ecd71c4c096f543ba0896148fca821a309ff74ccebcc4df2b4fe
-
Filesize
5.9MB
MD5a99251a07fa691e4529b0c70f7b3dedf
SHA18e0a52b03e221c703be050a54d84cdc9eb657ab4
SHA256996145e15d2f143637464cfddd543cb0e52d663645d15baf32ae8d86beeb27c5
SHA5122eb6374b6056cfebd1dca3a6d4c9019f743e1b8aa897b4a2ee130644deeb3939d94073590938d10426d8b2c8be4554469b1bdcb019e763f4381a844f3bb561e5
-
Filesize
5.9MB
MD5aab96ce5d0e1a92665c72b8bca294a44
SHA11b01a7589699818c0a96d7055cada9881cd0e1d9
SHA2562c1923263ea5645ed848bb78aebe82414468a89df536dac20ac4cfcf22b49ec2
SHA51284b715eb8b09be7e2ee601c444744992d488da571505b01fc7b7d4a8e76f495d803858822c8acc08ac7e340cd9e11edb2e9f0ab9631f5f8e66c9274947ee8f37
-
Filesize
5.9MB
MD52c9d1bc9686385c3ba145a274250d65b
SHA11504a42eed3d4656ae453716180ff04e222a0e28
SHA256867def45c6475eb4a70841b46074d018c7eab82526191e85306095a62e9cc863
SHA5121dfc724829e3b0c3dedc64ed13b73dbf3b6db97929d967672accadbae23175ad2e7b8533ffee80a3b08ab041b53a94ed711dc424d4b50ade198ba2745df689d8
-
Filesize
5.9MB
MD5f1730c06209fa23b64228c7ce8848e82
SHA171234774107671fdb2a65543040bcf9d25cd0e16
SHA256f1497d3f37f19d119adf7c108747feef66d254dac73b3479bc01b5bc5b985210
SHA512425bb7cf22d72a5354345217a25787ba48531cb4bc01318a36cb3c9fa84efc326c311d116218c8144f5dde1166a2742d936bc4d9d3c0c92852bf20f3de048cd1
-
Filesize
5.9MB
MD5f8babc7d671a1a2de6ab287b0067a5d1
SHA11f41817e4a0edc0abd72682d702bbf90fccbf973
SHA256c2ce1915ab2949c389fdba5b5db1161403b5cb65e44c43121f75f625c02f6bfe
SHA51232ce515f7ffe0297f755ae6ae1f2818638bbdb0788d13e8045a8b128ae90038e4510f698fe297747180b7811cc0f1a20b66b62ab7597ccccdb90b39aef761095
-
Filesize
5.9MB
MD5de7132dfd22f794e7b68934b69df9e30
SHA17f9706a3a891dc81fc7d8fa5bc7712138acd070f
SHA25676287c65b982cfa734e0eded975982d864e1179f9c6cb45ec2a1a57a57504dd7
SHA5126ae5e46834be94fd8944826685f616fd9c3fafa53e322ad19a7ad501a1af9199d7a65185d508567f497e11bfb16e1d510a06e8555ab297b048bcf98f62bbebbc
-
Filesize
5.9MB
MD5bf1f65287219cf5f90380a9df53731fd
SHA147ce839f7d62c5b9381a975a13e4490c7cc74e60
SHA256c49c707e3bb81bdf14d140055b96d12178affdfd42efaf1e7ba1e1fffdf5b334
SHA512250b53a490eb8da8a5fc6e5274fd17f64bc6eb0bf640dfa0ebe111523cff7438684406f8032ccc01e76960ba0b22cffbe9a3e15be8e8b31a0a65a62243703066
-
Filesize
5.9MB
MD501584f901b31ddeb1e1b7ec58e08f98d
SHA1a14e0509eeb297e26fd4ca1d65181cea2ea7455c
SHA256e2d78af286bf31187b8b41aa1b2ca92a9c9f9f88e5d1e55ad11ac4698072df6d
SHA512754a2dc8d8b6a28349c2ba697f08d5e7be0d5989cbae12afbb9ca181aecd2a121f3adbd9cc27fc5401bbdb1725c16aadbe9dd8645a43c4ef2afd1d7b229ee365
-
Filesize
5.9MB
MD56b8a0df2ff8bd64416a2f471b0a93251
SHA100a31a274676a365c22ab30d1893f513e221fe0f
SHA2568a9a312a4084cfb8dec3d08f2208dc2ecbed8ce965763c8550ccd68ab745d9bb
SHA5122e33e8d8b6fd4b784de2b736a448c9b27a41a5e030f04ab6b09000f4894c1de9cfc5e847aca084b713d436a3ec22b72454910e80f3cc8f8c09ccea6d97ede572
-
Filesize
5.9MB
MD5b7687f63f61352c813ab462734e425c1
SHA1fd9a4f1d6901bf85907ccf4a68da8165aaa503a6
SHA256adb57837abe04d28facfff1fe2c9bb370ad9186149477dfe7dac71dd35eb430d
SHA5123eb0339e2d953f0a59b5531dc4ee03773849d1b623fda15ff9b1de769eeec89e6fe60c38f36068217f07df1135d36c5f00cd12f8d6314ddf09bdae6ea72d064a
-
Filesize
5.9MB
MD53fffa02bab8be5d42c2742773d39fda7
SHA1802e312ae7f554c523c405f411758b78caa9204b
SHA256e42d4a446ac922d16ba2dd433032649bb03b84eab8e5a77a8091f9ec2b833fd9
SHA5129704e9cdc4d169f6a00a25baec3693dca082c0153b19c11ea2943a7e4984075226097323cb412d9f11b89e2788727eec2350394cedefa3926dc08723fd112e9f
-
Filesize
5.9MB
MD55e843bc76f194308a1668fd8f16524e7
SHA1755e7e93451127191492be09d189883dc4565ca6
SHA256374d66f845d032b28a1966e3894d796b5564123a50d2b0784780f510dcd06d24
SHA512398fd04a6b75d170d7ab4b8e8e8ebc7179ad5f52565f4a800f41ab8c17a964ffee1831bd4e0bc48ad802f922ade63fe0c43fe1986002fdc74978c4ead119a357
-
Filesize
5.9MB
MD516be0cdfb97f0b8e4216ba92b4c09f80
SHA1db13d72b6b50b1b296cee9d9e3e2859abd48abd3
SHA2564c540cb41fdcae582797eb9a94e1038bc2bd5467d0de49e6fd5a2e668a95772e
SHA512911baceb7d8bff1d4ddf319808bd0851188e8148de007b085b5b659d071215e69d9a8c86afd720327dc0a8dd30b6799c2a34672c430501360b2500d05959dd1f
-
Filesize
5.9MB
MD561f445b339798ca087250f3bad997425
SHA1d59802ff113ff8226bcfe78ac322bb0ad1bf0c74
SHA256b063a346c4d55ce77b7102a3b7a7276539f460ee9b78ee8602e8106a85359dc8
SHA512dc8a2129e30e178a788ba801641c945bf65065cf998e5275adc3f550579a117e04cb367e977ae7ec42dd37df9e96fe0ec4e52db9b51ae1a17c550e01468c03c4
-
Filesize
5.9MB
MD5ac6a978b0f708b2e2b516fb6bb0ae50a
SHA18e095b9765595e752455eaa00c8f273ee1063626
SHA2566232eeda6b3b5bcb582aa4a03855ac46a2ad265dfce9774a5507aadb8527588d
SHA51202d1630566e5e7b03c942966480f991c2bec305c96d4f0804c3103d7ec42e2fbd7f75290d6fd1e49457ca7f3a2e222ccf2bdf9bf0ef60d4e955906091c4a188e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB