Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 10:11
General
-
Target
2024-09-15_d54aa1076ec08c8a1c3a95fcdc09a644_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d54aa1076ec08c8a1c3a95fcdc09a644
-
SHA1
ace5be758e1d452678e99242de8fb2387b30c3ee
-
SHA256
047a8fd89497465dac72fcf1b333afa86b54d36757bde04b341023c3680e0666
-
SHA512
e2027e943dde9f7574aa9ebd41a89d84a669f01023fabf13fd3628c714dde4e009e34e859d12d6550806d24c7376b526c989a020e1d7ca1aae4e5658fd552d49
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUd:E+b56utgpPF8u/7d
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 53 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_d54aa1076ec08c8a1c3a95fcdc09a644_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_d54aa1076ec08c8a1c3a95fcdc09a644_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gEjWipU.exeC:\Windows\System\gEjWipU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxPFyFi.exeC:\Windows\System\FxPFyFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PEcvgjk.exeC:\Windows\System\PEcvgjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zddMJTy.exeC:\Windows\System\zddMJTy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKhgezM.exeC:\Windows\System\EKhgezM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKKYAVy.exeC:\Windows\System\AKKYAVy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bCGKafX.exeC:\Windows\System\bCGKafX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KeaSwjB.exeC:\Windows\System\KeaSwjB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNXXWpS.exeC:\Windows\System\wNXXWpS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FPmNhkY.exeC:\Windows\System\FPmNhkY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hinHDqc.exeC:\Windows\System\hinHDqc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzTyKKT.exeC:\Windows\System\lzTyKKT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DJhQERQ.exeC:\Windows\System\DJhQERQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cBuwLij.exeC:\Windows\System\cBuwLij.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNNRByP.exeC:\Windows\System\oNNRByP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYxIHPV.exeC:\Windows\System\zYxIHPV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BWFHHEl.exeC:\Windows\System\BWFHHEl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ofyNMsM.exeC:\Windows\System\ofyNMsM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\moaNCRG.exeC:\Windows\System\moaNCRG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kOnIyGy.exeC:\Windows\System\kOnIyGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLoeZng.exeC:\Windows\System\jLoeZng.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52f7cb9d4c363f1da642c0e24e1f7d6e7
SHA16c2a51c793c3ad1a718d29aa86a0a82f2c291d0c
SHA2561334878f157cff8b6b65c897115088103695525268e688bd95a134cae7fb42e4
SHA5128ec4c37aa64bbf0fed654bfd4e8baca7c8878ff17e2a89d954cd1895de4a2311decff30045f41c30861bad33765848fc0e703610b5df4f22b5b567803b5e8310
-
Filesize
5.9MB
MD583e61c5cd4ed2b87051dbc3dc1b222a4
SHA1d7338ad637ee1521787dfdbd0b3f44f23618d296
SHA256360c69a11e495c0bfb03a88dd58260c350a755ddfbcd866dd6fa2552b86ad530
SHA512aef15a15c91c6b2af9a07b4ad3a85e0556367c815c78fe04198b7a986fe6582d7dc0184cf026ff837bd656794e2d10552810f1b8ac6067c2f570ca3bb1b1da43
-
Filesize
5.9MB
MD517572b432c896a68757f625d0ff4d506
SHA128f7aefed2e1569819138d9e995646225446572d
SHA256a6b355e8e793017e1df9f64e7c7ade6fb18190a12c3de6b448f218029dcd5eb0
SHA51235427c57be7bc264d55777bcf81b47b1c88193c48220b3a249dd5003654ae4540ffc3f8f1160c64dce8b03b83febf3f5553de393149116accfbd745f486f37eb
-
Filesize
5.9MB
MD5ed60e7c7e9e99ac6e6e7adb3e8138526
SHA154e06a7b8f8e75767451d43549d851eec1a8db4c
SHA256642b950eb1cf9d496a0e24935d7b061011a4323a27acd58aa348bc4b8ef7c152
SHA512012cdcf094ca96f60e57d0b5b59a7284e4b2f57cae327a256a22e373d2e91a5a0641601ff9112a5802df10830f8b32121cd8d329e438946f333053482b951d72
-
Filesize
5.9MB
MD514213d9f8b7042940bebcf60eff99b99
SHA1377b0b1fdab983829a92f6ba2cc7093a7ebce107
SHA2567ecb3982835517a25e2bc52f91633254e08468966a499806fceed29259ee3e3f
SHA5128d211af0d2cf7fc0e221ac74aa6cb497cb0f58436969237ce14eb69a537d09d1b6ce04965826aeb44399a5b620b8969298d22d5963fe205d87b35843b4f0dd8e
-
Filesize
5.9MB
MD5e7d87b896c83a69c632475654269dd03
SHA1521154ddcf2c6eb1425f0c57f9a4532c4cb8824f
SHA256ff40f1126cd576c9a9eb57ed92474d26044cb8faee9638bfd15feb5ced928d1a
SHA512ea3421631e6cbfc6dfcb4f7f2a2d98b09a0105b7a2ef2479e562ccc3d6e2e59607d0fb2abbf1ab54bfc6fd62be1d0ecc585a5525b4590d0db6d6f94e3e7a6dd9
-
Filesize
5.9MB
MD5856caab2237a02a88a55bb4d7c3561ff
SHA16754e628230684aacb82a399a68386ce26fd1f39
SHA2560fd47ae4bdc4d0cba35d62ac374a897c21e762e452984ea46764c89499c052f6
SHA51247d047db1c32bbcb08657c3ae77012aa8d612a747f716ad1bcdb18872f2da608a3b9fe5b16b03242f137a5259b3c11a10390d6b8a58c407fa8f4df853e6bf15a
-
Filesize
5.9MB
MD54c1edf46d15b2f25c0912cf7b24d2504
SHA118af6548d44770e5a596f39f205c0537d316ddaa
SHA25620d942ebf74f4946cf279f5704596e96452f138ef753e4662dfa3a877e65ee20
SHA512cd1f0e12c86eababe4d37939a12a93e2be71e1c8b2aed6ea5ad393c6f997c47a6b592b8ec0801455b3e0bd0b832b220ab78585f213f49e3ba31cda7cefa52e1f
-
Filesize
5.9MB
MD545a855f12cb56d792d698c56c5e8c1a5
SHA16f092fb39f5a21581db0468c1c1568792afc3b5c
SHA256c034eba6900318d4784a0f86e5134d36c659d82d864c518a600cff1e886c6e34
SHA51265e4ba51d62f13cb067c1e6fc76ed1f74a0f040c94eafc2da9806ba78659c98ef03024ce30da6730453eea97acad5915314b355a425b990d104c98d75080e320
-
Filesize
5.9MB
MD594c851689b6cf1be235ed254fe13154a
SHA1a80badfa778ab116574f5a15ff2fdb9132c4ddb0
SHA2560ee8f158a96dff97bc6b38e881af29126cfbb2e830601291b98b35eb2975b4d0
SHA51241fa966e66df120e53c0be5df88d6bc2b9328b215d1a8efb8667167ba60388cf55c3ecd583458d2077602ccc496f2fcaf888396f0e0fd1be6e802c222f94cc3b
-
Filesize
5.9MB
MD5bcb9f534298f86bfd0aae7dd23d2d25b
SHA1181e7430135d00307b1c1ca7a3d48a5f44d22f2f
SHA2565b19474474a6d6120b4e874ba29382034427e808faab87cd9a2ac9eec7325b82
SHA512f9f7774aac48f766c5a037f6c2ae0f973d9522f743b7654622f970e2c0af4ebd56442994f841d6680bbf3aacdcdb01778bba27c749b63c08af3f5bfb4245d8cd
-
Filesize
5.9MB
MD587b760f5cbb80aba113f81c459fc979e
SHA1897d9e45b30dcd365151c088cdedc47c1a5c1a3f
SHA25650e375c1d7dd6c113d66e64c25baf6aac6055e30a7a9b22cae5544f78ee560f0
SHA5124ffc46f6675ab7f4859776f1305f140ce2a1c7fd893291e4492746c2eb64cf89ff47346311ebe458386960f34df93f6f8bc1cf6e2cc097d9b69f16bf01d9cd52
-
Filesize
5.9MB
MD544ab034f0652c599e1045d3682ce97bb
SHA14bf784b9cd322578b974d4a45d54d08c6275248c
SHA256bbd401e7c082c2856baab285fe6485884d1c0d63e8074d8a72e20f5f447d66ed
SHA512920409e4992d159f435ab6dba57479c69ee2d803c3e89b3b4bfcc4f1eecd79c51ef8e9054884f84d93a2a8bcccf96bfc98c700f7940b608925715adcd9c67fc3
-
Filesize
5.9MB
MD5a15c576be98341a57586a20ffd26baf8
SHA1210a48a9d472f159bcd176bf602c13d98796421c
SHA2564e9237debe0f7610f88803bbb22049c642c5f77d97865f6e12b4716d84922a8d
SHA5123f7af0d782a9232f90ee2ede5575ac5bfaf91c3badf9ec6135e26700802b92b224e03c337f84774099da7ef8cb5c5faeed671b63d3bb3c6f6d3ea43c66aae0cf
-
Filesize
5.9MB
MD55b7a74887ee72be9fa5a11dc1e21efd1
SHA157e34ec2b567181fd56911f992d9917ec9f6fc51
SHA256a52000118f9a476c575483202856493ab4bde3e1de2d78438eddae2dcf155ab8
SHA5124a114d519e3769b13f01629504e39f9da9a0e3b3911619a5ef73f3c02647f94317ab1ef5bbc8421a91ef0a09eba5d41c8c763b5ab28309c6fcc61548530380c8
-
Filesize
5.9MB
MD59754d2b1d0a6a95e961e549939805c32
SHA1318cb96b2b075405bd99ce994c17a3103a0907f8
SHA2569c3c9016939ae383ecb79b53f863ef52dab4ade27996d72ec25a2d93fbd1b760
SHA512f04c5d6886250f08fecc37152b281135a1a40067b8919bd67142c9c3772fd001abe761d8a1841c8a1ac5f866e3a0ac2297a1fe582b170cf427dbea6f351e3658
-
Filesize
5.9MB
MD5986a85723ff1bf6e4cd935bd4acc3980
SHA1ac28c8e650af50d2180ba5099079b4dcba7946a5
SHA2565981db3d05a3b3eee0f08ff1e20863c4cdd126aa0316bb91496c6af110c43b7e
SHA5123acca676a7dabfd23b6106a5cc9fe83f905d60e77105d621fd01e95b9e76bd3e84d7042fe0b472d7c7ff4b98d3779254a10e367f79061c2f714962d8006300a4
-
Filesize
5.9MB
MD5bedd5c95a53725517a27e83cf4dbdb88
SHA1c9bca38a212a38d94f947eef3b8c904344dbd88d
SHA25644c7c9ea5e2e252826bfa7ab03d050bef8e4afe1747f3fe0bbbe50fda7183ddd
SHA51248b8876ba85ce8faa87d498d5f7158450518a9803396d1f351b58b0dce06002b25486093ef7827ddcf234d66e7c7f756a7e5a7faabbba2dddbd06417553c9917
-
Filesize
5.9MB
MD52250771128ef4a415a950601988e3baa
SHA1e0cf7da8d313839528fac7fa1ccfaa83b06917b4
SHA25650b95707069fd88073c0aa6371f3e8b5cc496e0aaa2d0b6b5c1fdf693f5a7f44
SHA5122acbfa1330a78d1344b7ee384f98f262d56cb6c6d4633060571ff1f5dfcfea59c315b885e6a32b50b28ab5c9e5711b6060e38e82056c9c33ecc276aa2c9e6000
-
Filesize
5.9MB
MD5af6feb3ba8103d98654d779709993070
SHA1ae53438f6bc430a84db2ea5aaabdfbcc6cfb9949
SHA256b99a14017b6859f3c3b2e2126112997e391d27c6fec37cddd8f290921c6a9e84
SHA5127054c847914377ed01478d6aa8d485b06f864f812246a2ca1ff6061b07b99d30db6ed6155ed8d3254a9c5a87ae6d26586ddc10fc19217b7c4f7d29c1de6c51cf
-
Filesize
5.9MB
MD5af33d0822170578bd1d2a496ef8184f7
SHA12c8d89d1d9aa6b3eda8dcf2042192618629bd423
SHA2564b95fe8c601be48e9a63a59865b216cb4954c689b99763c80b9842b6834c1b76
SHA51250cbb961914f796fa9acee6bfbab5cf033c91d8d854cf5edf78de9d823a35d330cf7e0dcd992928a7162c5e7af6d425671568a2f12f925b9ee5bdf8fa3142eed
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB