Analysis
-
max time kernel
133s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15-09-2024 10:10
General
-
Target
2024-09-15_d2ac45caed0a99d17c38f562a17922cd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d2ac45caed0a99d17c38f562a17922cd
-
SHA1
a51d1f61089aeab5b7929561acc0c7fd8e94f4b2
-
SHA256
8dd33b3674819fcf177f65db40d0e7a50937e0dcb7b8dea877dbcbfa18d8dde7
-
SHA512
2362d4495f67641828f6aafd6ee603b0d0987f8140accd825a19e197d082cd8c8d2008211cb379709a6d0e40150e34378d9a9080adb8a9c66f60fc51ae5e3801
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUR:E+b56utgpPF8u/7R
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_d2ac45caed0a99d17c38f562a17922cd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_d2ac45caed0a99d17c38f562a17922cd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SXyyczk.exeC:\Windows\System\SXyyczk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfmbZRJ.exeC:\Windows\System\SfmbZRJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zNpfsxX.exeC:\Windows\System\zNpfsxX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUVMCmq.exeC:\Windows\System\pUVMCmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eiBQszx.exeC:\Windows\System\eiBQszx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AooastH.exeC:\Windows\System\AooastH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VwtHLrH.exeC:\Windows\System\VwtHLrH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\phdUuJT.exeC:\Windows\System\phdUuJT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbSWpeU.exeC:\Windows\System\WbSWpeU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRPcgSt.exeC:\Windows\System\bRPcgSt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yANevSm.exeC:\Windows\System\yANevSm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUqHPMh.exeC:\Windows\System\IUqHPMh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmRoimY.exeC:\Windows\System\mmRoimY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SvXLSue.exeC:\Windows\System\SvXLSue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMPfzdy.exeC:\Windows\System\tMPfzdy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMzirxW.exeC:\Windows\System\BMzirxW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylWtxUD.exeC:\Windows\System\ylWtxUD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tOKPtIE.exeC:\Windows\System\tOKPtIE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eduCPdj.exeC:\Windows\System\eduCPdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIghgEg.exeC:\Windows\System\qIghgEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tJujUQQ.exeC:\Windows\System\tJujUQQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD59d0058a2ca22e0abc2204737c7299473
SHA1b41c775934ca38293714566cf993256df80001ea
SHA25614d922128ec89e064bc6ddf682133499a415aaf20dcfd6fe52f6c06332fb0f76
SHA512a143cdea6a7dfb9333043bbb31ced650c587af3b94b6e1d37af8740c703d5808cd134eb39e599bde2e34ff212544f7198e432d876da879645f3e6cff8318caa3
-
Filesize
5.9MB
MD54f50d6e14e319deec70a0fad7e3a2f9b
SHA115ab886e50fe60252a35e54830e65011b0a943c6
SHA256c2d6ffa4b90e09b81a919c8078eec1a761a20c75910a9c076c45ad274fb7d698
SHA51215db41f27cbf8d2d0df280c6537ccf79b161338990335377d6161ebfe779b1c6fc59ee91b435e038c34dc6812cc96d1e9544f57974190fada929cddb841bfd23
-
Filesize
5.9MB
MD5c23776883daac0516f4e57dc2af3a700
SHA1b9e56315ebe2b07c4ac7144229f3a6ac3e271a72
SHA2568cb0bb110648051d52ea1394551b5cbde872a83f1841302ca94dbbd311dc0f65
SHA51204f538fb1f4bfce1a4c307249935841f49a3c70b06fea94b27051efd76709c796252034afd8822c41606069eb8659f6e768cc64230e04343f1b23b642f49c34f
-
Filesize
5.9MB
MD574dba64641075d6c5f6772e8e51d11cc
SHA118ee963f30ec580eeeeb3865cfb4a3569aa0a7ac
SHA256586dc88903702337540cba272bbe59b2d329c3cf725f174c16d47fced1e37de8
SHA512e3914e81213f111b9fd5089710f55bb91311e2c85be3320a188430ac0be98d5e3f8d4cf16f25e198433530452ef764cbdb243294c968521e4bba699968249a73
-
Filesize
5.9MB
MD5fe8fc006587fb13cb62edf382d64762d
SHA11fc7c70ed7eaf508bae92ef50221cb80ed370336
SHA25625caaf2acb5e2e19c8532bb4a606a6e9e17c5307034d0238fb49f3a390cfb11f
SHA51252e28825413209b8109b8487033c998acbc5081f81e95b553f20563ca7f0e1fc37f0dae0d1e047ba0bc489e9616fa123aca5ea882978cc602a0b5bc0090f3d96
-
Filesize
5.9MB
MD5dbf6ea9fec81b552ef5348e194d08943
SHA1204d4b1ff96fcd73ae17bf72c2c0755eac3181bd
SHA2564753c1b5c25b3c9b7540fb870a71f4d9a3cce2b7ac80f6521757b5e71a30f62c
SHA512788d5a85f624ef17ecd69249c8d49ed1d0cfcd1677dd0f76822c703b2fbfc346c89b9adf5a19c2ae27a5bdfe57ddc94fea535d744df097666f2478b48e1eb7f6
-
Filesize
5.9MB
MD5bde72dd9f62a88f355a18832c6345f03
SHA17e4d8084f162361c648baf1107c37ddc73ca6dc1
SHA256aedcd3543f45b8cbab5e87876ca969a245fb75b84e85d9f6dadb40e9ee9aba22
SHA5122add6f1b44763d1a07ff41fd246ec93d7b28765a92be069058611751aeccbdb287ffd61e300273c5489d8e99686817bdcc2edf5465b44c66f7aca0161ff0a0ce
-
Filesize
5.9MB
MD54f875709b019ddf0882909de3de399d6
SHA11f7060d0c5fddf08741737f757206d8b5fd591f2
SHA256f8cdd0776c871a133da1c96e83a5b7d20fb9e6cf3eb3514bdd21b06d281f84ab
SHA512fb1ac14ebe0888fef05da05b22c75655690193b6070c5d90e59a7c06bf0779c83eec54bf2f4d894dadc221c3369cebb7a70e9d60d826c118804228345886a94b
-
Filesize
5.9MB
MD511c0afe088e925a411cc9e02bc64c0b7
SHA1929743cd285346e049d7dd0a09cfe535410e1755
SHA256a673626af1fc1260ef95d997a54ac1fec908b6c20c1639a8e41eb1eaf7f20b0c
SHA512eb28d6cca1487afb25a484bccaba47bf997861bcbe03b6462c05bf60ae28e7710a03202a4c56e822b1d7f8fc3363fc49b047b9c6bd92910524eee975fa5d0d4b
-
Filesize
5.9MB
MD5b7197baa5667681d4a4dfd12daff8cba
SHA185ceb3cd04662b767e0867a1d06ae9aa79ed742f
SHA256632b26e70aed6775c7f9efa05ea0cc5ba4800a3bc833d04ab1a07d0aefdfe6a9
SHA512b204ef7a701d1a24604f858c8db603fabe2907883f57ac8320eb79759a66f2198329446571c2f7025388d56b78f810f9f0bd0280c00facce105e0020fa2121a8
-
Filesize
5.9MB
MD503aa9599148d9e99a2cbb7f45cfd0842
SHA1b38ad70e829c0ee19d9fe1df9b3de1acc0940f98
SHA25615a874da8f8be9f4b4ef3ae967f4c7f37d6a9076ad16f380a410d14591cc5a08
SHA51219c6e773400fdc30c9622e6983396d16d25654cabaecf957536ddba84f4a46350938d32b89f46b2679d7d6bfe64818a5a5def8ebdd0d9eb5477837e63c7115e6
-
Filesize
5.9MB
MD594982b5f54a977288104d3a6aa768421
SHA100652c0b2a235e19ac2b955d2d2c97db918af2ff
SHA256565c1c0ad02c813cec22d4f44cc4b42d01cfe4cbf8c82416574db06fed896dc7
SHA512b31847c452106df8342291a36e75fde26735e15e2324cf57d0b6fd7f0b8df0b353b8a638b47211ec3521bf5083ee0a840e7409b7ee6391f69e88dfa98fca79ee
-
Filesize
5.9MB
MD54141ef0c900ee457606d2e9f27327f10
SHA17404406703cc0780bad84c7ccd2ebcb1c3df2bcf
SHA2562e346e542c705b03a885e39958be297eea1ef433093f75961de1aa3a0ecf334a
SHA512d532708cc91f5a25f32973b453f0257108f8a38086386656f538f946a614905da6fc4e57e01fa14de6ac8c93b41f2d455d6527791ac60d7e9faae9f1876a6ce0
-
Filesize
5.9MB
MD55d3b68c7867fc97817e8e7003c720158
SHA1114bc1ae322103980214c05c267b68baafe230fd
SHA256f92381c6c152317ade7742bb15d3956722a3a1b4bb5540256478b4b1be58c88f
SHA5126811d14518eac66ee939254e78e4089c4c835fa05205e629ffa3c4613b7bbcaef07227b40d57e707de49d2b124d8f6ac9044985fbdcd799cd86e71bf9c755f6f
-
Filesize
5.9MB
MD59c9bd2af18f050fb55c17181c2c774ad
SHA104be89c20bef541224f34a05b67b8bbe8c8d4048
SHA2566d7cafae8da406b09f33dbcc02a4548ae4ff9b365f29a9b690c656d98d2f1024
SHA5127feeb4cd036261b13b53033e389934efa6cd37432e495f56561cd8fd7517d94d591fbbfdc66af62c5d4d971bbbe7e5aee0daf4edd5e65e9ba529b3d040146a0e
-
Filesize
5.9MB
MD555c5a1d7dc19bba4b7bd8eb743bd91a3
SHA13b6aba32fe7c1db767d2057004b6f4a7cbbef9c8
SHA256a5371a918c6881f5ed1bd79a51223ecb753ac9bfe6816b0ccde62914071146a5
SHA5127ceb65b835ae1454d97dc792c526cf3d329f897509747461289913cf88a2b32057ff816067bccc35e5967895395bf31101222ddc856bfb635215168b668e494c
-
Filesize
5.9MB
MD5a82543a31c2a22b25e88b33c2239bf92
SHA1c4a98c9f33c36c5ab261d57e877985429c5a49e8
SHA25630e00c9a10b0019f1cf034d8e039b7fc8f04e587559b71835cd9948e888b7275
SHA512307b41cf7582d7b661a00088fe0152827a039939e9b13106180553672cabc769a1692f01c9ec5bcd1f2d2cbecb77debbbfd0055df1a18f44964785a0e573a76d
-
Filesize
5.9MB
MD511f2661717720e657eba6056b6ec30b8
SHA131e86a45159b263251dcab0db9be695ac3a6780b
SHA256e110324a3d5ec36a68da9c32b570304543d8cc2932078f4f00002b2da2574179
SHA512d9a8c9ca09f19a1c728fb3ea5a2a5f9327656983303ec411f56ee89bd279d2724e15817c9fdcf4120b4bc2b7f7fe8ddcef815126d14a0b721414a2275cb23a33
-
Filesize
5.9MB
MD512ac1eee13156d4693e9687fbb077e1a
SHA1d5f301d6ced5f846fe2ef4e2bb3e8054b1fb5176
SHA256794209cde4e33a89a0a1aa6ec5db38e2a440752cd94621450ab6a4b3416f7e19
SHA512afed40bc6589ba157302b0c9d4aba681abf9f1311730b7c6a0104f0cfd81ee17fa008737735611d3d4b9d0aee061638c67a37ac8b3c658a90ac52fa568338557
-
Filesize
5.9MB
MD5342877d9f1cd4b2101e30d0bda67908c
SHA190cbb95896061e272a3baab280727f8629a1643f
SHA256de4228f2d5df542c26e4fe9e8f3ac60801a76beeac34ae553b042c84570d0535
SHA512c029f98ee705481b4efed13ebb6158a2b47e6c552b167e06ff56e4ff720ba2ace51846decde922c652cbff6a1d9dd7ccac901f39622c0c5778c5ad1c3b866e7a
-
Filesize
5.9MB
MD5dd3245ab594264bd8c6d01aa6916c30b
SHA1f456132fcb85d4b2e1749916c2bc444cb0db6c71
SHA256a5975bdbb0fb426b770bbbf57f4a6ecb98806f6d891ac9b2960ac1e1c3c31c51
SHA512b8fb4a684c3d3c3930f9463a9dae07ca2a207304f0c5ad8bd1c319ce9f3239489f8d4d0ab6a075d975d17e89c1b7d4fbc8cb38e1267c2b24e2969ada69d49279
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB