Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 06:51
General
-
Target
2024-09-14_b6d27ddb21898867a31de5c16b3e06c2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b6d27ddb21898867a31de5c16b3e06c2
-
SHA1
8043b357c3266df3c9ea92b57fa9c7805d910ba0
-
SHA256
4a93d241a9de67b0468a34f6cc4e971dc59d36c738fdf0880cf0541980b8814b
-
SHA512
5497b4bcffc705026ee6b3d7599293b2208bfc517bf527be0123638a2952392b0910da38d8aec3da891376f5de6f485be5e82b18b945c0b8b51160b35b97e5e9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUs
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_b6d27ddb21898867a31de5c16b3e06c2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_b6d27ddb21898867a31de5c16b3e06c2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\auTfHAF.exeC:\Windows\System\auTfHAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xTCfmhR.exeC:\Windows\System\xTCfmhR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AdWKXEh.exeC:\Windows\System\AdWKXEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oWjFztA.exeC:\Windows\System\oWjFztA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yLmSmXF.exeC:\Windows\System\yLmSmXF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BSViQHx.exeC:\Windows\System\BSViQHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNpcmNH.exeC:\Windows\System\hNpcmNH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmHHfmB.exeC:\Windows\System\wmHHfmB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NWqIume.exeC:\Windows\System\NWqIume.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ugPFbXo.exeC:\Windows\System\ugPFbXo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\flsMsyk.exeC:\Windows\System\flsMsyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lVKoXlN.exeC:\Windows\System\lVKoXlN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpybjKq.exeC:\Windows\System\hpybjKq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hFjeHCz.exeC:\Windows\System\hFjeHCz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fxPBNMA.exeC:\Windows\System\fxPBNMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LevoSnd.exeC:\Windows\System\LevoSnd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcsmDAT.exeC:\Windows\System\UcsmDAT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvfzYCB.exeC:\Windows\System\JvfzYCB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbFjQYS.exeC:\Windows\System\mbFjQYS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\daahtTi.exeC:\Windows\System\daahtTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhyAged.exeC:\Windows\System\hhyAged.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53b4a71e9d44d8385ca4e2ee2bc2dc5f9
SHA15017f60ac3779223573654eb1d65a6c2d2def448
SHA256cd233a409181f9ad22f48b039e68792430d63163e32045c8b4aa41c1e2a39b03
SHA512e673435457a4826a0654a2a8e4daaf3342252b51f4f428d07b9836b6dbf6a946d0d464bf3ecd1ca4679cbf4d61cd632abd0f4a35634a9a372aaa52db8399a7ef
-
Filesize
5.2MB
MD58dc51d6d2b01c4f0bb20e52592cfc015
SHA1f5692c342451d966a1e20927c9777826e4a7f6b8
SHA256e6d1949f7fc0907d4c9ef32d42dda4ea5dd3af94d86c7782bf6baef4237e825b
SHA512738dd4f0c6c9a4e934a47412ce150e5618f739e51b89fffc79184ab8e0155b885732b5f017838a70968f94929fa9e1e1c2c83369fd813a6f0960a40e0a00a597
-
Filesize
5.2MB
MD53872d77c8f3f9a418ee5c5c11e1975eb
SHA1fdcb545771b54d412af0e43a0346e30bbf4b3db3
SHA256f54adda70fcfd51deb33260fc06e841f14e0c5b82805b3205fd5e134f0a05e35
SHA512b6932f456caf10b1ec5b279ce3b92a3229ff9586024dd130bf61f3912b58b161b57f2b0f9394ecdced124439743bc8c5ca8923909d7485ece472c8dae402a82e
-
Filesize
5.2MB
MD5b691c3d65634ef4ca68a4cacda3633ba
SHA1238aad3c0d19f1f2e1b03c4c6905349d9ebe7766
SHA256a12ffa2d2b1db168f8bca2ec17f3c081f33fb25968194f95fbe724134d2eaada
SHA512d7041c4b6d00e222d496abe78f3861ee5415808567ed0be9e36d150cb86076bfc48db2a698c79d7799564c697bfe432fb6babbacd8ac1c0db032c7b8eb388efa
-
Filesize
5.2MB
MD56a98f95b037116de7437e3a7022521b5
SHA1fd2fa639b96f334c884ee9b8777dba6d916b8bde
SHA2560038209dd105689a589ac5bcf47c11eadff4911051bc2b91bcc342e5052d5597
SHA5121be8aadb91a333f1dc3d383ddc22ae80c7edad02641e77de9c705db58134bb27f5e80e874c92ff9739804474ec3fc9b4356cd853f2846eee1fa3d9b84a83174c
-
Filesize
5.2MB
MD519336ebef37bf6e7fb16c95929bcb9af
SHA136ef4f65773c2f0e0ee611c2cd553b09503167a2
SHA256b1c1ccc7633a26dbd7186cfa5e5a5112bac18d1ab339cef0f28565fa7c92ed4b
SHA512e1bdaf1f55eae4fba3069fc23b4fc9998eb7f631fb7c0f5cb6f7c2e7ec57d739f0731c19185422d7f06ce4a829b6acfe648d93c70be354e28c64ef7a3928fba6
-
Filesize
5.2MB
MD56e8235be66e25edb2cb8d9429f4d5e8f
SHA1588ab8a7eedefc79e6fde0cc8d9472d39d6cca86
SHA2562e16b7d0b63f1c04efc58379fdb4cf169cf47ab59e0c25813ee2b13eca62a924
SHA512fa6f105bc021a4e9796516a3253ba9537d620b2c34f1df0a4c827a3e284b88584e80f18b167ec657e1427b69919f62204e2b104dccf8cfa81f6fe98229fae6be
-
Filesize
5.2MB
MD521b9e0faa9b685e4cc890e5753b6b736
SHA1a848823a20e668852dd33230e898040cd7592e39
SHA256c80888aa398272ea902f4b6131e7bc6961008aa54ab9d7edc3d24500cc454a6e
SHA5123fb962911fb8dd560469ca2f7f5811d27fb99b94e922d4f33a2ab9b3e5d1862e73a82f4c91fcb266f744b1547d9a4ae9afa9a8bcf3834f4c5fba80a3ef464a28
-
Filesize
5.2MB
MD5762da37c71111a335b5ac6e4a1072a6a
SHA1a9bd589d5da8b7a91da485d485f7bd895b4b6239
SHA2563e46ca0f793cfd535ec7507514dfcea0350d4e4fa9b9870438a7eda0e7e63952
SHA512c406a2a3da007f64da69a64f97ce08c0205c1169a82ba0e6259ea6764243119eccd7d74525c3aa20ffcfe25a8667bc830605ddf10abc2c81e3b042a2dc8f86d8
-
Filesize
5.2MB
MD59c03bf488229ed4dc21a3509c2f31bc2
SHA1ce3e30e5e1159459c45dfac3cca3e823f39cfdac
SHA256f9c5c388fa5ec67e92a0b741be7233de9699879a5bcf1d80b159b93d2690ce5c
SHA51254d11e0cf162ec45109837bd805caade8fed3e25e086a637ee3a013edd2327ef6a751b8c6891b2cc306186fb7da8bdcc0e5a902c56aa5e01d1811d8771823274
-
Filesize
5.2MB
MD5ebdad0283253eb07f04b7184d8fe4cb6
SHA1ed5eca479a2a78b0607dcd3d212b8dc567c73213
SHA256ac21bcb41dd39aae8a255e706a53a765617bdccfbf7e74c7dbdc07f1a95b7cfa
SHA512b31ba55147895d447c87baaa4cd95e7958461e758cbbb879b80e5b5a1aa144781db2d73790d8b69228b86560ee5af907e7d601873fdabb24d9b3687779529386
-
Filesize
5.2MB
MD5f07dd9cd65a2c2bc8d89cc006792bb00
SHA15a9a21c59209a4047d970db924e27674b44b8f87
SHA256bf68ed4ed20025097474dca3cf480306ddd49808cee175573ad26a93dec1872d
SHA51225569388662f699c7e38a9dbb307869341b09cc8b0da550a62209ca242efca6a36189963af2bb9c84c17bda42473d1cef493be575084eb38e4f5e342b3a0bdb1
-
Filesize
5.2MB
MD54a85d35b33a20a039de32b6a4144d1e1
SHA176714a6a3ccc944f3e0c70672b9740be7d45871d
SHA256f3ab1b32beea99c7c00483b4a739ced82505cf5fe7fe444954bb9b42c902faf6
SHA512a1d1941b8ee17d85743958db51c158d37249842ed8eda88cbf320f70caf465e428db10eb38e8f783d8e91b2486ce35d256eb73e24fedb6362db544a4ae0fee29
-
Filesize
5.2MB
MD58b842a9b2b78b25328e6be31959ba44d
SHA1c8cf19913f6040c36edb0627f4e30f84d1905406
SHA2566975f1008e123646f2448a0005f05f45144980eeeb626676fe917ccfc52909c7
SHA512134220dd52d13c5ec15aba3fed4f3eab5b704036f1c562163b65c322c18adfe173f8964c607097a9f7368071f8c4d099d06f4c3941034e2619d1947c995f6fdd
-
Filesize
5.2MB
MD5a23bb444330f4c9ccf2b6e7061b6a4c3
SHA130ed2dabf7aabd2b3d36531fbb96558850f7cb64
SHA25695ad1b7470b82ff0a8db53fabb26cdefc789697f47d7fba24fe50305f3fba0a2
SHA512d14faeeb0031589d91481cbe987e38c88ca553c0aa231816e01a3b5e19575d022b48ba707db1625593363a721f729bd5f2594f3a721b4b27539a437708393ef2
-
Filesize
5.2MB
MD5d572f3466fd4611e101f1707e6b9dad1
SHA1cfca339c4f921e3a844889f77371cd204e9a916c
SHA256956f92f3099c6b56c35f0714e7276a0cc18bb4fe48e710098d59c0c04f452620
SHA512db399be30385ddc1d2417db758921ae0f57345111f6aadbeaaf9938e76f406c5e69ea47f18310ee9a88bfcd403f01ccce73d6e416920004a0f379ad9a11484d6
-
Filesize
5.2MB
MD55dc289c1cffa59f138749c395e000508
SHA10dbdd38167b51f53308c4ddb8edf5a601f627007
SHA256d7983acbb31124ad4f737ac14ff4775498f32fd852ed98eb3fd4c82b2aa74ce9
SHA512fb00213272e0faeffbf01866f7276cfbe727d5e09ad0445029e579fedf2bdf559c6550465a1faf3819884357eeb0f31d7d90054ecc6527585564e8d561907803
-
Filesize
5.2MB
MD5fb34c62763b3ca76ba7a137295c0f917
SHA12e3ab4a61d98b5769238013fc69aa75ca2a62b0c
SHA25671b62a6627140137c54d5c83c4f92aaaf85d4081be75a820f76595772eccb32a
SHA512ea16b666e90c0c7410925f1908d7cc84746812bb85baf1fcad82d6f7439f7f4d4d39e014478360586754277b96067261ae35d6ca3e20e5b40be89e2fa05617fd
-
Filesize
5.2MB
MD54597a16f1b82bce07cf8a488e4d96805
SHA1748070d8efaa7e69a2345cb7d72a77c13e656706
SHA25687e15d9ce01716d0021b97b2d8da6a42e3ffa7c35c69978e9b9ef6dd5c508017
SHA51241817f451209888856d178eb7e963afa92955933ffcecc5025b1a8914219f97101f396cba473002cae66680a6ed8287e1e42dc5549a2ad7aa9e12b5f65655cb7
-
Filesize
5.2MB
MD5b5a761680181a2fc603daf6c02449ee4
SHA16eab7a3989615a35eabbdb9034867fac95d2743a
SHA256a1a792429b0f3a14c69af10ac95bcc2e216f74ada3fb51f790d88ffaac148050
SHA51217d9a10080cb3348d4045c8379957a67c9c58741b0a368f50d796f3ecb060eae9d655ce90f8b5dacad8599d83ffceec17a040a14d34c012e1d695aa0c8a4c782
-
Filesize
5.2MB
MD578ddb43eba7a7d1baf70f39bc792bbf6
SHA1fbc9905c25fbae310fc540862c3dc8ea447728c1
SHA256ea268523d0be7ec925889ffd8a03796ee53393e6483e1607d7e2c5ac31637efd
SHA512dfa0a158cadf942ac72dd4f04c5e1e1e317fb0b95f724201b08e9179781234b4f33ba31aea91bb4964f676483f3d8001042baf5df082d29606a028bdbf3538b9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB