Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 09:45
General
-
Target
2024-09-15_09c1e6a33032606bbdfdc4d68d52b832_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
09c1e6a33032606bbdfdc4d68d52b832
-
SHA1
cf09dbf22593f673753484a58a6e2064f8183374
-
SHA256
cbd8869735cb5098b8aee5d669fffa627fc6194c1fa79d8748d3b997f45a9d75
-
SHA512
7e607fb53885c1ecc6972b0aad7b3f890e9465cbd72ce39e5a29374c80f8ea8769388cc9fd67ef7e0b6d44189f8c8f0c56f660b2a7c8b8e7ae39b4327af62768
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU0:E+b56utgpPF8u/70
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_09c1e6a33032606bbdfdc4d68d52b832_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_09c1e6a33032606bbdfdc4d68d52b832_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\IMXkQcr.exeC:\Windows\System\IMXkQcr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TPqohzC.exeC:\Windows\System\TPqohzC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BFDizVI.exeC:\Windows\System\BFDizVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zdmqzCl.exeC:\Windows\System\zdmqzCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VSyzunc.exeC:\Windows\System\VSyzunc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cALzWmo.exeC:\Windows\System\cALzWmo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUMXVui.exeC:\Windows\System\RUMXVui.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCcYMKp.exeC:\Windows\System\SCcYMKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AqwQlPg.exeC:\Windows\System\AqwQlPg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyzlpZc.exeC:\Windows\System\qyzlpZc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOkVQUz.exeC:\Windows\System\wOkVQUz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGXWaOU.exeC:\Windows\System\RGXWaOU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYQLnuJ.exeC:\Windows\System\KYQLnuJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QzMiYMz.exeC:\Windows\System\QzMiYMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lcmbtjw.exeC:\Windows\System\lcmbtjw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qhJzQcc.exeC:\Windows\System\qhJzQcc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sMDikFa.exeC:\Windows\System\sMDikFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgeeBFx.exeC:\Windows\System\lgeeBFx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\taUvSKm.exeC:\Windows\System\taUvSKm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\APemdTg.exeC:\Windows\System\APemdTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jJKZIBN.exeC:\Windows\System\jJKZIBN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55588108134992c85b4180d66905fec18
SHA106c8dda6f6f102587c6b62b7a4465dd619000673
SHA25637fe6dfc7cd3a66256e75eb137ca6db587bf507a54e9bb97eb31678483052b1e
SHA512026a8f7c1d8eb24fa53256bd1d8a95ede79c425606087f7cfc5c84af6d7467b1003f4e02e965c2545c7f43090a2915427416f73ed63f1adba21d8d6178776169
-
Filesize
5.9MB
MD52778183fe56af26b52602af93f33a581
SHA1a87ae9d5c300756ae3797647b393330a571653db
SHA2567e43aba22f78e8ef9e377cd3f6b8915e35eaa1650dff07c5b814e20eb9f7097f
SHA5123e084766451a2914a8cc24eaec9edd04837cde945edcbc91408e0c7cd6c448761b670f3ff2958d299ba3d0567205492417641cba462eed4417cc26d1e2419efc
-
Filesize
5.9MB
MD501d3e8123d0e74663f5fa94c1bc7c3ff
SHA10fd325fdbd2961cc08c3621b85495dd51ad7bb4e
SHA2565adefd3905450265fc74992bfada8e5ebd9b1d72b5994b903f5e9ed8bd216f60
SHA5125b18c32af03c712178342356ce38209cde71ff6f0bee05550c0eae2c83ea144faa27a93695e8249d7f59aba50a2cfc9b16d8d014b1a779ad246f4aee0aa46ea7
-
Filesize
5.9MB
MD50075b85be4367d23d7734aa763d787f5
SHA1850400ec8f4bb58a96626e21bddccef53dfb1780
SHA2563877e69853908917ab34c6d05325287bf5f9c22cbb278af9c90959eed76d495d
SHA512aeed840925258181fbc516d656994d9903d5cf06034daf3a00dbc4f939f469619164c98ea40a2470e06f8718670fcba1bb21df86f9e9ff156cf8208827f67346
-
Filesize
5.9MB
MD5a51716259452dd66aabc5a39f9366380
SHA11fe97c609b71b88dcec3fdd5a8d27f2374f1fd18
SHA25615b0baf307b8b069c9769962c6825bbc72037ffcd2395de9cd123847ed1edd4b
SHA5121ddf4502af64554da9b7e09f3523d6654863d0e2ebe24dcfbd20995c4b5034c5f453e0585b64e22bb6c670692db8210df66e2eb026d4726311289b9308c50f64
-
Filesize
5.9MB
MD58801d7a2b93defe3b78eb06d7ac68d35
SHA109e2579f561f9a4bdd518d02189fad8e349f9d63
SHA25621e9800a826393852e24e843c482d90b0f11dc9c567521ff08621a43d5c567fa
SHA5122f83910be97cb38bc0b7e2b76ba292ffeb7b129df357bf9f1ea73d96f77c834cfc00ae15741f44138e9341b4b3b7a71cd81a10e050278f4cb964e3f20aff75f9
-
Filesize
5.9MB
MD5638f9bea4f3843218c55915435c2673f
SHA16005274d91443694c0437fa9d720157be107d691
SHA25681abe9ac51d2938892312f8758e13cea2d3fa7ef8957ca0525e8629713e20f9c
SHA512b0b7202a01171bde8904a6885f89eaaaed1371a54d820bfcfbb07327a1d8c408930863af879550a70a9a5ab9543b346561dc3ac5a15926c278eefc38a4f307f8
-
Filesize
5.9MB
MD58b923efd9dae7c890866a5a398118b78
SHA1408307b1573256a379b24ecfd9da57e033dcecbc
SHA25685624c5e0cb2bf654feef087c081ba830ab87a83a5fabbdd3be905c7e015ce59
SHA5127f578ae01d538dff3995e40e4b97ca5ec3d76735df3411829598c65d07afd3b03fb184a36faf3d3686f3bcaa31e4bbb3d1c404bea3ef8a8bf1b6a1583d433b35
-
Filesize
5.9MB
MD5781b52c190dea4a51a43367981026195
SHA1a66e17f2000103475df7098a6e2adfb2360eeb2b
SHA2566b737c979365f067dbe50ac1a732600db1ed4d95fbec7ef828d4302b29f24550
SHA512e5a7b8268e5aa2f040982405f88b39176cdb181c7a561b663d8c97c616d8ecd722b590fc2a0fbfbad80450a833f8e550488bba15e37c4cde8482374b04042311
-
Filesize
5.9MB
MD54c3090dc456e2a364b322015c7839d05
SHA10bb66a535ffafd2765061078431247f7e44c68ad
SHA2566aedff86e8a4682860bba2e94570c79f62202adfbf4596b66645e8497ccde1c9
SHA51294bcd91f56961bd5e5978b26658a366b3f4147584b8e873a3363d807305673e20f49ad07ed2653f1b18b5c46024a0bc38744763976a3439b119ab4083ec69c7a
-
Filesize
5.9MB
MD5d6c045da2585d0b3a6f79bce761ad790
SHA1ee8b3f0d944a8e225c95f3e18aeb6b312e28f022
SHA256f6d60e48e3c389a43f3feb6c0efa66782520a910998e50243e4a163a8ca93b01
SHA5127d65f08bf54030ff98d793e2fd0d44e80cda01471aae61fbb9050a86f881a3fd5b1dcaf56c44662484b548a6fd6d9afa85e21873500bc25b9fe3d483219dc38a
-
Filesize
5.9MB
MD5beece529d0678f403ba9d742d6f5f636
SHA10541af224c97e35822cd7be046f3f8e06786f73c
SHA256acad218fa47a057f4ad75577a71b2002d5142a4b7e49c00f1460141877c9ed8b
SHA512618db96bda59e24089cc2286a0f0056f932aade69053f9d5f96034d45eed695e99a1ca94b16fe1389394f707bc7755b452857346a114eb95a92e36c99462df8e
-
Filesize
5.9MB
MD5514d12435911d2f9e11653e580f350b1
SHA12185356705b600f65af7483b63c75165db0fd706
SHA25693ff25a3f77935c99775df3ee560176018bfb0ddc64303bbd84297ec3672e019
SHA51200d1804504690c871dc4222ad1f3a7035ff7ea7cf88887c53c718a93625592194dd8980198335528a3b0314476920b4c7e295df2f0685b800db7668ae64dfa3b
-
Filesize
5.9MB
MD5fe42ab857353ea19b9bc00bd73edff6b
SHA15b24ea5c33e970e09106f0f5e9c5fa88ba57f69f
SHA256b9f350f8ca208d7eb666bc34e20a7bb159dfa459106a7cdf4f5a35b2c55a34de
SHA512523190277d55e691608193ac391b896ad5b29389166692bcf132474257458f5caed42f7afc982d8f393c3b17a6832dbeacd3adf507d11db0b4b88560bb2f9219
-
Filesize
5.9MB
MD534afa021235c740ac55bf34552cdb479
SHA1708f378702f5d56e8cf0c68f1c5de9506a96cf31
SHA256d098a64c0e086ed03008fb45a88cdbae91cde34cdef29d27959e6799983f06c7
SHA5123bdbe18a0ea88578a93c1e84f65554ca3311592a0e4ad5e3f18640f2a76ef287375b67d9b5e6af640188d0f16f042886e8595700e99f3d848fb8cd55a3755c77
-
Filesize
5.9MB
MD572f11009c4e2ea9858dfbbe2de446509
SHA1ea2385df7b0c03e2bfa9bbda7f9ec449fcfb4c05
SHA2564858e75fbcffe07619a4e5b3f24391b11a89cb6d68eaa534bdd5a1019a1c6947
SHA512904b8f9a2d03a736b25c7cdeb5e37526ed44f567f805ab348d849e79af7daf9aa0c02510b43b62ad0f0357044f6a1a432e50ac5ff1ee8417ea94b47a70f6b4fb
-
Filesize
5.9MB
MD565ae47f7cece7cf998475f62e13bee00
SHA1e689307febe1ca07d5d3777d8fa6f2a7bf72ba9a
SHA2564061b39a1aa1733310a6383bd536c2ad5469a69f6db2412f42cff8f158e845d6
SHA512421058c1b852c7355af17fdcb7ae694685b9c80488f3a5589529d49c3b4641068965c18548bf77bcb16434fa221125423be82c6e2d74fd181061b6771efc41a9
-
Filesize
5.9MB
MD551dc6e78ab72450b669a9ccca714eb19
SHA18c07cfd848c68d8a71bb6c74ce9d7db6c5d73197
SHA2564becebb4e4f6a769aede1fa85b239fd75a8cf8737993bce3a43eb00f0baf036a
SHA512929fddedb7247e8529794080a322393e9e4b86ee4673a325eec05494cb1c5fa364f6c09ed63ec058b6e80e1530d81a80e4a0e13e0aa4b9a3de0ee7e70137c36e
-
Filesize
5.9MB
MD5a20dc66d31b446c91a8d8c864e87056e
SHA1e083d7dd62c6e085bf8f90f558ad35ec65da74af
SHA256308dd75affd41e7d4c307b4456b1133e0acef6b0760825eec2b8e2da5d739984
SHA512b51eca860652411187e648982991e93bb7a830b8647b7ea68aa95aa9fa32cd6526cf06d0b86ff6fb946df128625ebd23f7b4e913fd3ccf69d210228b08a688b9
-
Filesize
5.9MB
MD595bf88bc3f89d524e8373f190424d0d6
SHA1b15054500e55fca57c20ae9f5b0c971728405fcc
SHA256afbd2673f6ab510fa198997bf7bde565df0019c5c1568de2cf5ad5947e681987
SHA512d3e5539b2d4e07a3c971990121f1f7e5ef5c312d60222764ab0ecdb6ebfa47a6ec93ee49f612c3ce4cd55b88abc71c4e69ff031e910c5095b031c602d1917735
-
Filesize
5.9MB
MD58069410f50b7c9748603623175ae6450
SHA17f985b392c62f42f5d22484f16424776c04a0e9a
SHA256b56429b0767bc896b1e1fc0fd681c1859e762360dd3c01fd9768d9463b897538
SHA512decb2b22415ef4d09b58e14f73b0b495f5074828772d10677623c001a9f2747448865710464a6f85705573a0eeaef8b55ec3e4bb26390da74f6126da0be5988b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB