Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
15-09-2024 10:11
General
-
Target
2024-09-15_dc780746eaac8e0659712946861f9ac2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
dc780746eaac8e0659712946861f9ac2
-
SHA1
2cfb55403adb54796fb9c71b9288d23bdf4a8778
-
SHA256
939193b960d9ef06429a10a984db0e0a67ec636e2a9ed7fd26edb34288b5fa1c
-
SHA512
52b3a1e6136b524e0ad75de481a19fbef331502ebe8daf8cfea1fd23ce162ae2f84f878390b15290df675ce03d9c08b1ad68f70b4722c064a99808fc651e01a9
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUx:E+b56utgpPF8u/7x
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_dc780746eaac8e0659712946861f9ac2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_dc780746eaac8e0659712946861f9ac2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BOYFRYo.exeC:\Windows\System\BOYFRYo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhnjUMk.exeC:\Windows\System\ZhnjUMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmhNDrD.exeC:\Windows\System\pmhNDrD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuAoPKl.exeC:\Windows\System\RuAoPKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwIvHGZ.exeC:\Windows\System\BwIvHGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGwykFN.exeC:\Windows\System\yGwykFN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWOiajF.exeC:\Windows\System\JWOiajF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZFlzseb.exeC:\Windows\System\ZFlzseb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLLLPjU.exeC:\Windows\System\TLLLPjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WNiIBKI.exeC:\Windows\System\WNiIBKI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RwZYtwH.exeC:\Windows\System\RwZYtwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FXoVQRW.exeC:\Windows\System\FXoVQRW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxlPNIg.exeC:\Windows\System\RxlPNIg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaciXfY.exeC:\Windows\System\iaciXfY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hahrCpk.exeC:\Windows\System\hahrCpk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YnZsvHS.exeC:\Windows\System\YnZsvHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tQJnJle.exeC:\Windows\System\tQJnJle.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dogTwZf.exeC:\Windows\System\dogTwZf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PHyGnyU.exeC:\Windows\System\PHyGnyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IxCzKti.exeC:\Windows\System\IxCzKti.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrzLtYl.exeC:\Windows\System\nrzLtYl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51be206280af958db640fa8c62d42a3e4
SHA1f5f35b3bfbf3a2519261b77a3b2eb307e4919f03
SHA2565e344bd66dea057ece014d9f028c9ff1d6da67d17289e37c0f1d5ae15d5bded2
SHA512a4b889d9235d1476d1dcdcfa84fc1fb5f0e88e0be93e54ae00d11f48b28e9990c410f9475a3d55fce8a8402da5a4dc426630af85f9443ab1cd77364c252be19a
-
Filesize
5.9MB
MD56270bdf0bdb0ec393c980d78353988c6
SHA195363df77b765eec0ccde0c7df6b945180823b27
SHA2568d709954380952561f1f4ae015254c655f60834651c3319d7c5e6fd786e95a7d
SHA512f924216ca1ebbc4a064d685ab9dc71fdbdb90e481b460c4c2eb363310497485c9600ff5d4b935ef8c31f87e17f2c32f5edbe0fa795890a75d5970cf51be61ef0
-
Filesize
5.9MB
MD5cb33b1bd349bf5138e1dc6b407121ba3
SHA19ccfa51345968ff41c6dfc4b6c10bc3da2216553
SHA256dc6a6ba52878af434a5a13dff583ed4afa3bcaf28a618d3c8a272ec7809409ff
SHA5126a71ee4ae1ceebeae24e28adc1460ce54eb0109f38ebe6ea39b9e28b4f596fa047bc632fc9cf2812ee6f1f9af99126a6c3990e02c089655293744ad10e196de5
-
Filesize
5.9MB
MD59e2f3db03df476b3fd382a63b58a305e
SHA1389d3aae58e4ea1bc760b13b094ba23f6a1a1da8
SHA256f7100509a061144208be9345810e8aaf2a8dd442eec172f88600525c111d6e5a
SHA512f1ea8a9ab12eb76b00bbe8693df06fce6c2b8c6cfbbd3cb5284d2c1bad24d8d2673ce27ee8df93cf69842ae76c762e09d6040d311c546d2311305d92769c5bd3
-
Filesize
5.9MB
MD51ef2213b3661973c517685208874056c
SHA18a8aba0cc93ea24db4cbc3579be04634b17c131f
SHA25641205c1c290648c522a99c210291208a9238642c4898a339febcbbfb00c5bacc
SHA5123b5d4bc66b132c52b73737a1a1ede543af90c779a6e84c23a0ed339c3242298b4490d478086d21b2a15bdfeb33d10387e68505f55f03686bd8b5d12795079565
-
Filesize
5.9MB
MD539f8916f285b4938c5204ec4e37a3159
SHA18cc817917fbd9bb468f9b6979f2428702283bb24
SHA256c5e81e8244f7f3d5c006e4883a595e5112da4cd6701d57b538895ab7e5c2554a
SHA512b170ea6c38b7ddfed455fd3a613c60b0f0a669cff38b3a6ef1e3dd804b3480b48f0f9545f93da6e07d5de12eddec78d8bf734cd3cebb9b5aa5dc6e47a23d0270
-
Filesize
5.9MB
MD501fe9950fe6dae8363d25ee5749f2c89
SHA13243635d3b6d4aca5b65def049d8dd423fad718c
SHA25694d914e6fc838615ef9737538cb91e613b9a43b75682b59c656f5d6ce6fea726
SHA512b23987b23ecea05297b488204be94053fba200199c63c25e6c20ae8715c4c7802ed8e373072ff959cf29763de1c61a90829113ed3a051afdd668f4fb47a7ba71
-
Filesize
5.9MB
MD559f68f6b745f87148df9901bed6caad4
SHA1b9ff38ff45fecaf49870c9f742e805af96887c9a
SHA2561665de09658614b8117e7c0b46ad9c2fd4747124ba39c7ab961a3aecb9e7ffe8
SHA51239bc489fa38a83f80d0d5cb629fa7239822186edf6959005fb6d056065481f082add7858cfc0348fe1c57c809b46a79023d4e1d6effb83b28da3f3acbe72be1d
-
Filesize
5.9MB
MD5382f5bae0b785e7ba1e20ece920fe4e4
SHA1fb7d249bcbaf94e03c46c77fb9126d57139a7ac6
SHA2563e1ea03424bf183054a5922d43bb8c11cafc36735b08e750f46c89d9d9549a83
SHA512341805e3d981407ebf4a9245f31b6ea9cca16d1ca0be6392324a104461d00d09688324e8339a6b0a12ebe8f30d022b250a660a28cbb8f1106bba953c455fd981
-
Filesize
5.9MB
MD55a065a6ef5c3d2444e6f53a34e805cdc
SHA19bc17e21e2fea6acea552cca8ee4f5fcb34e1e05
SHA256af17f7bfb7a5323b1270bc1aa88e9ca555ad3fe89963061f925ebd541107f2ec
SHA51205242c448cabf64d3d7b32e1d7187fd33c91edca64e0324fd3f2ebd6124ff15bb3b45421a2b7f27250fc687497a6bc4bcaffa943d5adfe21bb13790ec77c43b4
-
Filesize
5.9MB
MD5bc45bb1c4d3bef2ec63dcdf15bf2d7eb
SHA158dfab3548df6ff2696f428ebcc886a020c88558
SHA2560b20a1a8f7c50362de03aebb3f7b9774c729653ef0e20dae72c0f0284f8742a6
SHA51251f6e18637fe455568539a6e17269322a55488614cfe7e35c74a6cd365974c20a950dd04025b2b9f06e5fe244ea30b9d8e94e051f4a16fbe01b2c58f3d02d36f
-
Filesize
5.9MB
MD58f454b9b95585bdaf6e3362fe7a7b7f0
SHA1c26d0836a0d6493d385d0968acfae0d6a6527b78
SHA25691c50f45f068e9d69397659f2ebd37317787ddcff41762cb200a61c809aa4adb
SHA512709be20931df9b7fe7501a01cbe221acc7755a5fdd9bec3be771efb33ccdcf61b64f8b4cf4c7920ad7197b65b24e69126642683df83b87292cdb2a5348a861e0
-
Filesize
5.9MB
MD53c8a7b2884a279ea5df71bcc668ec9d4
SHA13bbb20f7230e271e3e36ad6868bf770b8abc4bb5
SHA2564378dad0d2fe32868a74f9f8e784082741700cd31556c7f8401d879daa38c5b8
SHA512687c0548fda4a9941adcf576f73e958c3e1c61d85e068dd69362b65679025627ceec666780adc95037feb4068a0ad1ef018df61d00db086abc78a74712557f4b
-
Filesize
5.9MB
MD5fabfb06e997a44dd2df9ae4fbf545d7b
SHA15194a82eb748b0bc1ee3931e66ab998ceaba79ac
SHA256d8e91854f6c18130256d2f9d1a4cb6c185ade802376bfb2e4ce26d4f3cc909e6
SHA5120687749340621fd417059365e9bd06d6b37bd3f366770d23bca97185a75f4062c2f75fef874d49114eb98f425ad28f25ef8e1fd6b77091fb0d4b1de06097fd34
-
Filesize
5.9MB
MD5a0aa052845c5ed9df055e72c645984d4
SHA1d3c200726a82d6b63ef2953bc0cd9c67fe23657a
SHA2567fb4c34efd33a39a3a01ea1b7672a298e20250de85a848c38c07aa963c9f3a38
SHA512b42d4d05e0349b18508443fb82c1dde1f36828099538f7a14dcea4904b29c9dc6fd752c1e1a185b9d16339dd2b62c23f755f8a77daa59af929929f37c73eb358
-
Filesize
5.9MB
MD5531a0933b685467bd7d288452df71581
SHA1b95e990ff65d85f7e5d2e09fb8e9aa93d9c841a3
SHA256b75a67a813943f5a6aa756825839d38be91b068e43be3359b1773509725f47a6
SHA512b6ff38d613e3c54eeb0e5d995a6bdb7040d123fb52472a71d1857bb722241aa83d645bd1f0bb5569b764b3e69fce3bdb2d2827286a50ee2cfbb52662cc91b652
-
Filesize
5.9MB
MD5be26733d7d66ffec02411d3c0c680667
SHA17dea626a968b0ef59eba112fe0a3c86fb0f70fd7
SHA256431ed8333a6b09d254c60ffc7a8235395c7cceea834d410ca2126490018ebab1
SHA5121d1f5035243ba2d64affbf6a4a93786075974726dc296fb2d5ff6aeb30f712bbd1b6e09a39c53a1d5f7807a4f279d6eaf492c2f32fa50436f2a1510c78d7aa45
-
Filesize
5.9MB
MD57139c97e9c638b4b8939fb588e388d93
SHA1ccb14760b88b4c35929cc2c43879d385e25bd14d
SHA2560dd59de430ff8db8fd769472a4e3719e3dccc6c644840d0f2ff2306473e30c4f
SHA51210b1d1022ec6572bc1cf306702c6051219cf8f34b68ebfdb7033b122cd196b2ea945cd42e7443d218f321568ee0270c1e3ccfa7c063f6af9ee70d2b1a323df7a
-
Filesize
5.9MB
MD56b1823bf376a0114e09c76c8cd3a4c8c
SHA145d2b66989176621bdae492fe698babf79c1b31d
SHA256b73c6d7082a7b827bb78fc38cac932c1738f0f03316fe9c40982d938eae5ebbf
SHA512bd7ae45d9c2985da176da70e19058a5e994b8f6730dbe6a218166952a6e83c4822aa0ed182d1d837836f103f0d42cb28616611bac304c8f9b94e91718a844d01
-
Filesize
5.9MB
MD59cca3b9412461e9fc1af62e53733ff29
SHA1e8afa50464fe7690f526f9e278c949d434f25f56
SHA2567e3d4ef2b50fc6c78aff9a39aaaf791bfd5ec42cf2aa49381e28a01f9ad41458
SHA512e8dbe610150e419bcd5643f24884a3cfe6a083e29b899ce81b89178aa27a1482e05a6b56970299e250f7740b1dce5a2bdaaead974352f63c42d7338197f5035c
-
Filesize
5.9MB
MD539edfff0924a264ffa5ef31250117e0a
SHA11ec34e872a601c7cf93bbfdfffd7408937e87eca
SHA256075161f15e733f6f23afa53de39747e867b9e2ef4c1b0aac57354200b2071158
SHA512ce7021bbf9348eaf9e66a21959f2f65a80be55c3a1f4799a3cf53c95297996d370d263849bd9d7704fb63d2fe812d95712823854f96ba5c438aef80d21b2465c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB