Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 06:49
General
-
Target
2024-09-14_86e69bf65f6cd12fb54798aea834b5a9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
86e69bf65f6cd12fb54798aea834b5a9
-
SHA1
0f476380d085b5bd0cd812c76964ed54c88c710e
-
SHA256
8828ed367c372c4f530abed7e2185a6ad4da54e4d5a2e886a58bf0236ac046e2
-
SHA512
33047b218bae569da56480f3212cc95887afd6fdb5f5a860be6bbae7cff2265d5fc5d8d6fd3c65d0b0c51cdb433a30e57b5c92d48e901256519e52c6fba72403
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_86e69bf65f6cd12fb54798aea834b5a9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_86e69bf65f6cd12fb54798aea834b5a9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PMfmnCa.exeC:\Windows\System\PMfmnCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mGPHXyd.exeC:\Windows\System\mGPHXyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gaNKnDR.exeC:\Windows\System\gaNKnDR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYgWOPy.exeC:\Windows\System\xYgWOPy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqWhvPB.exeC:\Windows\System\eqWhvPB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmyPlEl.exeC:\Windows\System\RmyPlEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGALypC.exeC:\Windows\System\QGALypC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BeTpjRd.exeC:\Windows\System\BeTpjRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwEXanc.exeC:\Windows\System\WwEXanc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QoNjkua.exeC:\Windows\System\QoNjkua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFDbrsJ.exeC:\Windows\System\DFDbrsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGHhWHB.exeC:\Windows\System\wGHhWHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NORyIih.exeC:\Windows\System\NORyIih.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nFYzrEr.exeC:\Windows\System\nFYzrEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QlliWwj.exeC:\Windows\System\QlliWwj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KRBddnh.exeC:\Windows\System\KRBddnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nbhJesH.exeC:\Windows\System\nbhJesH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iuIZrdC.exeC:\Windows\System\iuIZrdC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PnHUtrL.exeC:\Windows\System\PnHUtrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vyLGKLE.exeC:\Windows\System\vyLGKLE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vxiyPAp.exeC:\Windows\System\vxiyPAp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50be4da3e5b4047f6e1d847fb3bdfc224
SHA18357d7c7bd1090547352f5a22e1815b2bdc87b2f
SHA256349a17547e03dbecda455b52ddc7315218d014eb45babd753daf0c35d8483b7d
SHA512a47cb4214c28d66e5996f635f4adfe1621e65958706491f1855599cffb7e70ec4f050f81dd60e48b2148009bbba14b568621215f94ba694d48887f08e03c2015
-
Filesize
5.2MB
MD59a2acab6bc4344d43909b6f6b11caeb2
SHA12d98ac85813eb15dae5883123b9aa2d68b928f1e
SHA25601ff6a4f578caf1ae7eb7dad3baf23093277ee0fb0e4c3baf38d8d1e260c1384
SHA512cd5be6070e8308181049777fac4851edc73a658cfb0a7aa1f62261b029021711cfc00fb2a6b8e96701c349dda8b5071ca9695c39c2469a79c057e1b092627c09
-
Filesize
5.2MB
MD5830b6938220cfa367757d2d717114877
SHA1d7db64dd2adb9d5d5ed2f56e2c9120cdc19c8b74
SHA2561723343e9a37f456960a85bfe9704b8cc3f7ed81e8c3da865e853f7892df57b8
SHA512828eb2276fe3a8c3749e5190bd36497eb24686fa604ee590af4762387dc63358a2262319bc12da4bbcb036851911569748545642e451dba59d7b07736a8a67c7
-
Filesize
5.2MB
MD52d024fbe670337c4cc0517ba2595380b
SHA107a1efc1c3661a221571382d04115f05d2659121
SHA25652d72faff515a1c42ef678624fb72b57d7c758dfb73783a6d5c97531a43ededb
SHA51218d5c5f6894daff71701b8ee5ee044ef14b615e0e27e86b7a5a107d4306c7453eda805889375ade22e203ca293801fd78a3c86ca95c882cce9070aba0cc6bb49
-
Filesize
5.2MB
MD5cd47485313cfdcef239ad22df4dfda57
SHA1de1bc41d8edebc9f8d406320211107384b7fa3a6
SHA256a0ad8d8d4f47e515654a88aa352e183bfd48f144a3ef18bebea7e8a695f521da
SHA5123d078b7992dc3d782b31e2bbd6dabc11600e5723cc18d06154e00bf203b1dc6058761a799ccc5416db826fb964855affc078ae0a3d8755e99669eacd3ce590ec
-
Filesize
5.2MB
MD50575e6287bdd6d1c3829d2a1fed3f244
SHA1821d21b551ff87f31a13d30b62242cc9e18dadcc
SHA2565b4e4101ec9b5a0bd5839b89bc76c2c7575de8b1f95fe7fcd7f2b53c50524612
SHA512405ea7425c9584aed5d53e598d9a4d2548017ebd19541740d2cfbf8da2500d784c024ae15870257d6e2f9016de53e699784eb213ed5602f21fc44e107267b4a9
-
Filesize
5.2MB
MD5dab3f45b3f8ef2943f5805af13c5cd03
SHA15921f66516b03df21c0e43d13654641de798858f
SHA256d2b922d8da552d4b0cbbebf8eef2207af525b6488446f251734418a3d0be262b
SHA512d72ee47f8138a8ead2f562de7af7d49c83dcd44232c07b248d7973ab696ee6d41073cd275cd3faa4ff9470ab48afde6671b0978af81b4c69a068de54355f53dc
-
Filesize
5.2MB
MD5f42253eb15cec1f93eb81a90bb5b4060
SHA154a7a3e84400088a6800b3054d55cadb5849dd54
SHA256ab5dc278b8207deed6a32462c2d55505b9b66812c5b93352d1582fb591676e88
SHA512d2fb50bd1772657efc97c52b49333c285473bb5fdc9ebce49403f76d849b374ac0abac96542a502fc939971e992e75879ee794a4b91f0a36e73bccb0e63bb6bd
-
Filesize
5.2MB
MD51445c9429f8be553f13c39082c00bcad
SHA1bd65577649e2b0361ba796adef8729dd9eda7edc
SHA2563d0e06572d12ed9402e1baa3f892f29d4462af3207f0541fea70a3825f1045c1
SHA51299781fefc97a499d672a0c5e2ae7a33748e0815b98f75893a69ce0ec356967a0f71ea1b32f25a1bd1e49f2c130a5675e1b9cab7b66760efeed440d6dc5a3037e
-
Filesize
5.2MB
MD5fa8aad65ffc9230cd62a572b4c2b89a0
SHA1065daa829fe3053cd79b42468a4f4c548df2d2c9
SHA256cf977d9971fe2eefd3d665536cd0b0f3bc03efe2244845a4361fc075efa749f2
SHA5127a537a7c56e562774c98274c3d146550bfd357842ce0b9efea25f0d32b92db8c2f67f633c6286cd7715e8c8b56614838e2888de0d6bdc7a91f81f01acae6678d
-
Filesize
5.2MB
MD53c26d6deba8dde70ed7ce1f2e8a8f317
SHA1efe2a37152c7e78f3e11fa54f5f1e285f71e0554
SHA25693ece3724f137e7757873f2a7ec89a73d88875e6f950894b2e731b37bb89a99a
SHA512ea0da61a9813827218fac367d69303e2be58bb1e66d50da248a7c9a2b5722e03f0b252746387d0520dce273e132e93aa0c8ca0834447814b0715e7a644399387
-
Filesize
5.2MB
MD59ca145c6192b447cadb25b8c2e5f3a00
SHA1ccf8429c166680ed78b5b47a0dce51ebe954bde2
SHA256fef47badbcc1bcbf6198fe9202d3163e39a941311b515843e4f7592b19a8dd38
SHA512cd038ac483cc8fec676a48cab8034299d0ee2afdc1975920597b193474f27b406278a0236184d9ef88f490e051b3000b5efa585f818472100f7d5a186a21d739
-
Filesize
5.2MB
MD5f221fc57e914df51e5bd8e24503c2997
SHA187f0e786e6289524161520cd593bda1b6da4ad91
SHA256faa5b92abf4c28766da00d1fa1eda7756ec981d601c4cc4d9bec6eecbdbb7fb5
SHA512265efe9b7a8e03c9adcb05b1378e14be4c27c6b159ce4cface9df28afef62d793a49554c3afc3314709a65184d4ab1f37b9743e4de66878edf92bcccd0d6c309
-
Filesize
5.2MB
MD5d9f6827caa7f41b8a310e4b6e7e9a6af
SHA18718a9df349963101e04fdb16c6c641c010f4145
SHA256ad78f1a81bd4e83692338fb2582ff9d82071d56d959ace568eebbca273bc3666
SHA51258046c812b61353472056011abf063a7f50059baba13d7eb52bea3ffb085fdb14b89081940ea52e72ce9d8f98e05c6e24d32c75106cd1deab66b26784bec5d22
-
Filesize
5.2MB
MD515a11c4d754cfcc6d191da7000cd6e5d
SHA10a02dba61d623ad62726a4094cec717b1095a84e
SHA256736e2c1088c639048b088094aac79b14d01debd3f47f7431a609d6a2820f9b32
SHA5125e74c969f3de6d06f2445d6b6e216740ff82482a39b8724857fb30f24195d8f8c8180680e002add65b58c01e55807c80da41f29bce22eea074d88db8049551c9
-
Filesize
5.2MB
MD52bf49aa97a836a9c44e352af8b8dc9be
SHA1f96c66cae1139a396479d10caf3e82d32b67ecd7
SHA256e477861ecb1cab1b9d1e743499491544d3085c472d97e4564bc7ef8c3566efa3
SHA51233738014e40c96ae601718705b65c618656208f1117e1dfcbcec6e892211fcd62b8b3d19d146d57fd85baef1d617c23972d41c889fcd2fe2715c7232e233e08f
-
Filesize
5.2MB
MD5e76ab1acefeb1770d5fbd4fb4b2b2c3e
SHA116b122d0a2755c8f6ec0d02594574f449c43c960
SHA2567336e9102aaba2c5ef9b88210ab9637b2a09e6bbddbdfd1bf7bcfdad99be8efa
SHA512c01e3ca070fac8496a29e45546bdf7e53ad8df4415425047455452f917737dd890e4e5a39d4faba60abffc18509169f0107dfe9e0bb41535009ea46939bc2fbc
-
Filesize
5.2MB
MD593805e5ac114883b4339300fc6f1feaa
SHA1d55a66c74d706c5fd571bbf75e5697bad45ac7b6
SHA256a795b5fecb71763d9ac7b00cf41814a2611f1df7dc69b9dd19a66926cb9c4298
SHA5123c3b2823ad519bf1f5145848b55d95637d3acd565fb08c13a9233bd1fa4b74520340023c99bcfe112be3e808f2fc41e20eaf2ec8b329184c4d3205c28ead284a
-
Filesize
5.2MB
MD53e44ed8df76b625c92edfbe1a8264c79
SHA1d5e50871738fef8c3ebf2ef1a5c3998e3bde7ab0
SHA256089f460656926a0d23321d3e8e86cdaee10d7b5ae22c63f0eabe98809c83f59a
SHA5128a64789a475141ed534797693d64be9e21f0a49ced887beeaa0694b13f678c70c60170ba3886a4bb03b59e0f7b48b624a77a7a0966556b8597b3a34795865a4f
-
Filesize
5.2MB
MD57f2ad0d792f5f2cf6193b89861eac2ae
SHA153ceebd066a059e42d2b49dfff9cd826feef91aa
SHA256712e43209a019e18f9e781660417a91704df472580096c10a2ba7990339f5a84
SHA5122c08736418e90851917ca1b0cd8d2d6f3aaa00be914bdb702d572cb866d9b5d2779612f310c5edbda2dba9bfa23e4a8af42ac9ce605d53985f206ccd1d09eb7b
-
Filesize
5.2MB
MD58ff5be2b18fbae309d70152a2caeb5ce
SHA1543c97af1f755d420361039dbafb1d1570134ebe
SHA25601ad329d629bea3684cc132893b82a54bceff0b2d4ea2175c2e78bd9c438dc8f
SHA5123ec5b5a3f0c5ebbce1f2d5f9c9c147263770b832a56f02d18a5e1805a0fd0a56a03982c5e705b792ee987aea22b7df1856449eb788eec2910b92cd656a47c3a0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB