Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 13:03
General
-
Target
2024-09-14_2591861871754df5b90ab3160c479b5c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2591861871754df5b90ab3160c479b5c
-
SHA1
1e1db059283f4173612b8b38c24978807ba3f88d
-
SHA256
d407236d347bf9f3081d0c497f6f8c4315ab52f26fff1ca84bc897d3cc6fe649
-
SHA512
e2e1c73da5cfeb4f49f4580cfe49a96718d765738e1522cb5c59b3fdcfbc4588730fbbef61928e952b73e99158ad90f5a79583e4b5804c38d57ffe3be1c5cfef
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_2591861871754df5b90ab3160c479b5c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_2591861871754df5b90ab3160c479b5c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nERTTtz.exeC:\Windows\System\nERTTtz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYmKcVb.exeC:\Windows\System\EYmKcVb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iDeJzmO.exeC:\Windows\System\iDeJzmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ILjBTSH.exeC:\Windows\System\ILjBTSH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Lhsewme.exeC:\Windows\System\Lhsewme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\igAnTMu.exeC:\Windows\System\igAnTMu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTLRHVJ.exeC:\Windows\System\aTLRHVJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dmUKECP.exeC:\Windows\System\dmUKECP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VejZNGU.exeC:\Windows\System\VejZNGU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ealxEmC.exeC:\Windows\System\ealxEmC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQcByhg.exeC:\Windows\System\DQcByhg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vLTOHXU.exeC:\Windows\System\vLTOHXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfmvpcX.exeC:\Windows\System\WfmvpcX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCwdBYU.exeC:\Windows\System\VCwdBYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UsphHNk.exeC:\Windows\System\UsphHNk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJtRbDL.exeC:\Windows\System\QJtRbDL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mCAiPHw.exeC:\Windows\System\mCAiPHw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOoMytd.exeC:\Windows\System\QOoMytd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubDDAJb.exeC:\Windows\System\ubDDAJb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwFRTLJ.exeC:\Windows\System\XwFRTLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pJbJvAD.exeC:\Windows\System\pJbJvAD.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD519b41d9b2178179f2373ea97b266a389
SHA1f94d35c453de8bd7c33f21a8c103f6d9d9d0057c
SHA25648c1e3e47edfcbd3e2c7eace5121eeaec1d0387528dd5b4442ba449ab5652b26
SHA512344be0a766d48c45471b38c7d33f6d9d5b4562324fbb6e300ede1713902a7ae2fbb94acc97bfbd386ec8d2a56e2fd5750227ebfaec315169812ebcc66dbe1fb1
-
Filesize
5.2MB
MD556d242bd6427ef8db57c8ca1e143ce98
SHA1a57e239d95d923b0054be0f6febd78848ae66b00
SHA25626547f4db03580ccf4222820b3cdad4528ef845bf59a3052fa1ebee7b8b1e7c0
SHA512baf4eeac221d731d9ec48edc12bcde336484aec6c3f13b14ca84b141ab9027c43073125cf295f093000b132a158c2441c5c267e8c97a3d7a0c16dfe05ea9d466
-
Filesize
5.2MB
MD56a71f29e984966ab3434f9386ee0f89b
SHA1b7c6ace161db9dc19e9c80454e0628e9f32d909e
SHA256fd12e92a8121b52b9aa4067138f30bbb6de9ec1a0e3388cc234068c916db46a9
SHA512566efdbd2f3616fbb86d38cddcc912c9baad309adf4b8e92924be840a6bae68739a074c1452a6e85f77933c23220c47b9006b03aef47bb30cf1b709b7e41855e
-
Filesize
5.2MB
MD57de39881787d2f5f44769b872a520de5
SHA13fbe31f887ea9c4546b4bc4e218cb84eb792a303
SHA256541259087262fae77e48d95b4fd982e5f8d95f0765e90e244f54ead6f0708385
SHA51209a45c49c293ecdcf73884e7466084ea970c81b1a42830b1afb4fe52b1526a83a402ef869ade5912ee6930cac2fbff593de95d33436af116ed8cb623e98bd803
-
Filesize
5.2MB
MD5ac4086daf48e5a54a284dbace7b9b971
SHA11cd091e511836612be511d6f8f3416916eb52c7b
SHA2563393a64dda551766590d6198a8bc92e8d980015d0d16ac73026919a7177d9a1e
SHA512c6da4519c972bbf73ecfdfd107292708e3ab152d570f6631ed2fd4f6b5a08ce0612c0a3c1c24f99e943153dc52397209a89a8d710b34f9f223a14178e8e3e303
-
Filesize
5.2MB
MD53479cfbc7d444e96bf372e426127ce53
SHA1ee750887e3186b87233e8f1483ea1acf29a25b0f
SHA2563388619e2c65543ddd84c1f3d04cc34a3c246b2cfca895ee392da47c9b0c2d12
SHA512758d5bb969e41486d856c66725bf12a6b287f63d095834cc1059916ced08188fdb3eb36dcdfa2730bcd204b09c77916b181bd83f313665c8cf511583847969e3
-
Filesize
5.2MB
MD5735226b3f1d7ff67dc49af2a3a393edb
SHA1ac4f10ae9263640c8b4ae54794aafb542e48b350
SHA256c8191b415f925621cd486c5a8bf3c775907d18f0f24a08343d1549a5e4b6241f
SHA512c3509b774d185058de6f252a7a284fdc5a84866cddb3edfa54c903aa8813aae6ee73dfc846ad3f4e9ab4d46ffb0281a03c3fc093f03e284ef1a5b7db4027c875
-
Filesize
5.2MB
MD5ebeda9f8af29d54af55c9d3e9bf5cfcb
SHA151363267eafdc9f8c70e23d2f059f08ae6e7c0d1
SHA25670525b86c0dac79a798c4f178808fb556157e65518d44e7ff0ff01c462afdd10
SHA512c0d725d26dfec12fb23ef4f3cf89c2d44e7f2cff6c24d463c898301d75e23798d5e50f0ca063d974d21e520e6f1f2e65700da892be8395849f8bdf091e03776d
-
Filesize
5.2MB
MD5f0503731515b88386e07e197f99aa163
SHA12080362df99b66672e48001f090214b40f156315
SHA2568310c1cbb627cf34b8601a46da9a718cbf27c01fd6da8f81f65218770db9d58a
SHA512dadb1024e158d7bef18548762c4b99826a1b602231785b4e9f5b9992f1194a5f78813c042c26010febd11f08c702706fd59b3474691b843371659988d2789301
-
Filesize
5.2MB
MD5416b6de49b188c44c45ab07f941d4522
SHA1085af6d45df9d701a18a7f8170f807cf6dbceff4
SHA25653173e962fa40402c8b9c0642ad74e0b50b4ecefe996407aa291f0b6de0454c3
SHA512aab113d5b853e2eb8820fca328fc8bc703f1695efef211c101311bad6cd58b6a535e15727714cb0b6b33d1218232b564473439aa55b9b9ded92be0b089df2931
-
Filesize
5.2MB
MD5f2453662ee0a7ed379834fded9160ba5
SHA1a76ac9829c8057a426d4090426b1d69772ef5eaa
SHA256b7d72a161ed47049b4c9f228245d729325f5d49ffbfac3507bd500882ae19bce
SHA512d8c84d192403c58a523733ed68a75f05c7a618e70812e3319e5c0dde2557f2ce746661b1f4d5d1048d8977a558133fb948c514f9ef77517abd57112ceab4c6b8
-
Filesize
5.2MB
MD56b2f7d7ea6d8b3f5c3043416a6f9f2a4
SHA1bcf9b5827d78be50c3d1814396bee1878372e112
SHA2561d79dcc17604b82a9c4486c4b9029852c2ec291bb141d26ac884aca4ab2555fc
SHA512bff1808bd3deab9d0ea45769dde2501286914a952971b6a6df152ab9fb38c0b94437360ac4fa935cf27b1c777afe91cd2fc94aed176dba5e3fdf71fe9e921273
-
Filesize
5.2MB
MD5a1c863c4b775b4abb8ad94d2f4552698
SHA15a647c961f74760516673e1648d283c87501584e
SHA256e2e64a32799479c8782f5025a79cc4ae07a09b4ae60684a03096f3477bbfbdfb
SHA5121fbf38b3bffde7c06687a5f530c6b125437f6008ac890d8d38ff272fac42f32b8b4c8555d3bcab882676e33f98af3c20438dc18ded079d8818813e84b0029f07
-
Filesize
5.2MB
MD5387074b49236e6f12bd1e5c599c4d8b9
SHA1ac5f09a43a00f820c2b0a51f4916e9f73348cf49
SHA256c1bb57956c2b9bd11eb59c045080f8c2fa56bd09aef91e38735213e586993f1d
SHA5127a3888c3b5df735f1528eba70d71e9b0fd78696ca84794dba9a10e871e2a7041ce46faada10d10cf105fee97fcb31d61cc5731f51f392c780fd737cf0739e090
-
Filesize
5.2MB
MD5b0d66e6b4570d75dbbae1d73298716ee
SHA131f2e6b1201a54eb7dccad024eb24ee9a108470f
SHA256268eb34e9b71b6267950f70f0cb4bd846eb1d74729ff69ad1b9444d4e17b43dc
SHA512e5511e03ccbd70426129efc757d4ddcbf5cc4e558853b57103129072cdaefb33fa3b020e85563ee67e7903afedc0fcf2abcf0cf12aefb1f3b574847dcc8f6d31
-
Filesize
5.2MB
MD534c5ae8f6a83753283032f4691db0068
SHA1038a31c3bb43a973a59160d589a9e98c4cc03f27
SHA256f5aa83b34b7fcb4bc8b18d935bf3caa47c4e99331ba6789c74001dd840551eff
SHA51258790a33e26ed51da09eee53d6ce85b57d7989c824f81e6110aad60fe402bc595a7be8d4e93b9c006fcc9538351a0785ae885a847694c2e173be60b9fc8b9514
-
Filesize
5.2MB
MD59e9d9418ee8c87dffaa610cbcb068427
SHA1b481199f1078e97c69d1802d4eb535e0c78cf6e6
SHA256e0d9ae1a14449724dbaa34e39cb765f83e404cb11c729031e3bf96b5e66d0591
SHA51219fc551fd1bfb8bb03fa6da2731ed4a33054ae0d3aebc7385b69d3eb2759b595e819b7e51a31f9732686224a9de1c295b347f9d21e211242274f9057961c2f9d
-
Filesize
5.2MB
MD5019596224d35cc8f50b1f2fd4aceee84
SHA1211fdc6063896ad08f24a63f651f1785fd27712f
SHA256b353cc731350062208dd5c52cb8548284ec0dfe134245196e8701c4efe54499c
SHA51278c0e30d0b484f00de72f2c0c5a8aaea26d7607827795fc042948204cb91b5830d23afa74593678af2a2165775df1a82b1b442aa3e61e2e0e65d7083be30244f
-
Filesize
5.2MB
MD59fff167afc48a9c1944c4c2e987f9f5f
SHA12d456ddadb79b81819b5f3ea5b87245af67ea144
SHA25669e9e1df7d1ec9e703e2c56f6c92beacf495f50a0407d3bf4b136b97ac71ae4d
SHA512b55a502c21a94fcbb2bf98b1dc8d43a789b290c02037f5ee99ee22f9d41a853253048bb5fc6eb08206f00ceb99a8a522347d02f517c127ad670cfbb70c768dce
-
Filesize
5.2MB
MD577facf761c9e2d174a72a9a79a076712
SHA1cbd7427632f72fcfb59972840c0ab00050741d60
SHA2564bdbb7d820f654b5aad4e96fbdba6f271a003bcaf65f61b1f1d3adb03a4d070d
SHA512cfcc7c28a1b49bc65f4c968527fe5e2b7773f9f868eb1fcf5837a7249b856897f016913cffd0f11de63f130275a90286495ce9f0a01964a5541c237c72236086
-
Filesize
5.2MB
MD532850603d307c9fc9bf58abc5a27de58
SHA1cc06edaecae9cd235ad6510a8774f76fb08f6bf1
SHA2565cdcc6c2b032f863e1ba2a51f5c4ecf7088268ca223b441238f8f24112cdb3d9
SHA512a746dc83d1701a0ef8370cdc120fa8dc2f842d550b7fb0ba8e7090613d5911e7c2458cc81141de71f7be0705bb8d6bb41c4a68bc0ac032b707250d25ab1c55fc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB