Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
15/09/2024, 09:49
General
-
Target
2024-09-15_21543d303ff7216bdc8d351c463d3909_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
21543d303ff7216bdc8d351c463d3909
-
SHA1
d6af708e942d2ada27b666501190411c61e3fa33
-
SHA256
c91534bab633071a7554517378b8eea717cbdb27639febf0f914effac1afa0c1
-
SHA512
f334798c27f8995b268b60b30a21346b85fe3efd0d675a2be1fae749cb6724a6d8334e093d50933f9740bafd5f4b0e7b5bbe4a1ca34a0e13e5c3946e4eba5184
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUy:E+b56utgpPF8u/7y
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_21543d303ff7216bdc8d351c463d3909_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_21543d303ff7216bdc8d351c463d3909_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZnJZgal.exeC:\Windows\System\ZnJZgal.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dimYovY.exeC:\Windows\System\dimYovY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WkjKTeo.exeC:\Windows\System\WkjKTeo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCIoDoa.exeC:\Windows\System\NCIoDoa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zSXuHQA.exeC:\Windows\System\zSXuHQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jqJmANj.exeC:\Windows\System\jqJmANj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bslThVl.exeC:\Windows\System\bslThVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMlMvyN.exeC:\Windows\System\ZMlMvyN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzveYlv.exeC:\Windows\System\uzveYlv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfVZYve.exeC:\Windows\System\LfVZYve.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPtehQT.exeC:\Windows\System\PPtehQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVWTwJn.exeC:\Windows\System\eVWTwJn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfUpjoi.exeC:\Windows\System\kfUpjoi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URXOADD.exeC:\Windows\System\URXOADD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOAGPeA.exeC:\Windows\System\iOAGPeA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOUrofU.exeC:\Windows\System\lOUrofU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxpIRgj.exeC:\Windows\System\OxpIRgj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YkHIwxB.exeC:\Windows\System\YkHIwxB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TZumWGN.exeC:\Windows\System\TZumWGN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NyNaSBg.exeC:\Windows\System\NyNaSBg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uyXIPrq.exeC:\Windows\System\uyXIPrq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c325c06bb4bc265b38cb971d387899f7
SHA15b207de9341f6dccdaf5339126386c08dda76773
SHA256f662f52486d7e803b6c536de0688abb4319a6bd2dba36e3f14fbcbfc53c73939
SHA5124adac845ec9f6ce6f750c9852de296fec0ec0747ad799e77c3f492e0771df2dc01fa1764fbd061757e9af07a80035e8fe320c7ff965dca2b2fd9b7585dbb78ae
-
Filesize
5.9MB
MD5c832300b1997b33e71933938f81d2249
SHA1e3e053ab2be306e06071c42c8c37a5d269c02bad
SHA2560a9747520bb6f485b9bed1997c9308c2cd5fbb4bdf7af0d6392eb9a06ace5971
SHA512eb670b6c33ece888a95cd3c8a48d138405fced30bef3b89c25beac6c98701427e4009f265b76013c94ccc02c9f015c0d3fcc7c039901ca6f702628c613feaf9e
-
Filesize
5.9MB
MD54c213c8f1205fda0495e5f81452b8eec
SHA11ea85d8ad4a37de41492f2607ada7a5adc256d35
SHA256d7476b2666af42cb5e472029b5313ac937ad5799b67777d3dbe01db1ca98f276
SHA5129808c01b3e6850e203537fd658ae815cb0138885464710f0efe6f8277c513a854105420c6ddab305a5eb59dbaed2f5d80138760ac3b768d6b2bae56b664575e8
-
Filesize
5.9MB
MD5bcd0df32923aea178c51918edae37387
SHA1079cb18331192c41b69774602e4e770e0ed6377a
SHA256f1d75d1d06f50eda893f61f48c97d4b18a6034bc405c8bbc3be28311b77fc7fd
SHA512c11865d403778e309dd7cef78ccdf41983d6e99d680e5c0e6bebfb21e34ece246a1428dfd4cb44e3c20db211782ba4a22b487db737da559eb815fea2114fa393
-
Filesize
5.9MB
MD5cf51fa558fdaf8226d9c5dc5c373447f
SHA145a3160e439e0aa20c917fd51ec78003a8aca538
SHA2563adc3ee0f70224c43cf1e60de26ac382d13106b6a63f72bcd77a272d8aaff1a4
SHA5128fc0e1e742f9bf9bc3b001918d62dff4a034acf4c1bf1592e1290af4d9940b656946d7664db4dba71f670010dc53dbddfade2f1a37c6b3139c2b94547c770026
-
Filesize
5.9MB
MD5ec169b5b1f27c74a17457df57cea7de7
SHA1a468c1c8df38abeab47fadc7e0e360bb4d34eb3a
SHA25623676565f7743afd95c7810c51e40c7df851620b268d526755e6cf21482c7175
SHA51267cca24d84c135023df0090ddfb626b088de780d3e17b9f45d07908ef794ea990b1ae95b0d8345d8dd7a5811519f7d9448bd7a989e5f7c4728cc754e5b4e1fa9
-
Filesize
5.9MB
MD53713003b100b722ad0cfdd50c0773ade
SHA11c371096c66dd31002c97d3b86922445bcae6f85
SHA256645fb80c44ae9644dd91fb9bd2ef6cc740fd4eddc61542ee8241e15e21cd5e97
SHA51261cee8920d5efec7132c909e7ae208d0dd50c447c91c5802fd8d7ecd89dcb668beb35f13d6d8731e395c61fa1bff6075e03f7cc0c9cbc91cfdf5f070eb4bfc9d
-
Filesize
5.9MB
MD57f3ecd5b0d8f6722bbeb37df142690f4
SHA1d787815d4c1a3f8cf895e0e66a1f8c1e342a2c63
SHA2561b95512a00aa6239388ee3c13d11bbf6cf6cb11273a61fd2822b5483c77a26c0
SHA51220fb54330668464789890bb77f63bf9046e441743a9838e05df5f0728ea4773824a4d05bfefc1dd10c7a62f47e4c10a26e9a12ba430e81aad2106560c1073094
-
Filesize
5.9MB
MD5dbc38182332982d3f8be0ed4ddba92ea
SHA1c7d9821ab5dd2a2eba926a7c803d996b8cfe39da
SHA256f3c244a9c1a239eba254726622af460a58f43766b37d6d3279e6ac9185b17511
SHA5124f2b23702660cf8ca9b6ff59c67084f97f323624cfb7dad5c50b29d6d1de60334d5b8699812231efb9dbb907d8cb662bb9b1e0fe8d256a017265b6459d855887
-
Filesize
5.9MB
MD565df53d0c5b63489d9d22cbae4cbf568
SHA1db4e6848373b2d9a2ed034106baa1ad365932456
SHA256d8b95a64ede76fbae1883d6d4390af6e236b38da8325d4b0c1a823d79ebc3ae6
SHA5126507d66206d8b4e4c799130a5ebffe4c85462e186af9d4eea35a473c0111553343e7d005bf7b11eb96e678e5de9efd7db5a58ec6df4347816a7ac573d1658585
-
Filesize
5.9MB
MD5f39f81b9b73c749faf744e0d9aa25b72
SHA19c05fd610061e456bce4226be63ef3fbc783c4d5
SHA256cf46aa5fbb4a5f3ddf01bef52f7b894101cb9b2ec9104a8b4ee5867e295457ab
SHA512b4f889336d5005f7eb7eac23b1bac0d4b40a0ff14bde997e32cd555a0b78219514f04078647e9e221f20fd1257313954357fb7080336f66885f335f12aa336b9
-
Filesize
5.9MB
MD56393399748cf32ef97e86fa2d3c6c531
SHA14520f9ef899727cd9c6f52f62eabfbe2a0163698
SHA2562837e12baf0505816a724341dbc5d5a49213cc55311dc6557e9ce934144af3bd
SHA5129b40a44d73b37f153492df75eda6df8b23c0456407e4f741cca5fb55f2e1ab95bba91c18b445cd934db4f5f2a79d0e46380fd788073e30a08b1eeae0cf4eade9
-
Filesize
5.9MB
MD550fb2a9bb12e1c9d37d0d889af12d2c3
SHA178b08117eaed7a5fec393ec5429e95cce0d312cf
SHA256c46a73a14fda9d14a45aca2443f2b6a3ac199f115356c5b24e1ca53d47d2b3d8
SHA512f364cc9da3483e4fc061f98899fc496de774f5d561805631870cc2ab5221bfb900ac5d7ecc24d537d8ae8e4ef7770c48594fbd11eb707277c8404b8507532849
-
Filesize
5.9MB
MD54e363c70f5af3bbad43477184abc7343
SHA1ca050e4058a0ca1db4680018a4c08b2d8b596485
SHA2568f7ab97eee9dbc5656ea3ec1314bac5519116b4a2b39d280ddcce353a5a0a70f
SHA512887cc2bf14205379b5c9f92044e20fc0177655d1486631159483126252ca8cc6fc63976ee1f26514205d15bd562057152771513ee58f704a4a3bd9cc50ba18b9
-
Filesize
5.9MB
MD579e427ebc11ba8427b57939bec73e514
SHA19bdf58e18f8f2ce232ab4030905a24c77a29b49d
SHA25671669435348ef39ca13d1f268edb6e1d35125b7ce19bbbae9b0e91343a7982c4
SHA5125299a1e4746fd210ec6f0cb2faae6b83c45249231ab1a647a314d62f350b45d6d4b73251b9ce3fab4f32a8966be71bb6acfd7df22949bbdb13040e7340f5ba8a
-
Filesize
5.9MB
MD54409d8ec161886bc122ca8c626fbe3db
SHA11a938768ec63b7166f21e1660118ffa55c11a987
SHA25653a43665b52ba2b461d1499cb589f6b0eb2ca4a22e2a4583ee7624c38d05d8d2
SHA512982a2ea18dd4e1f2468d082d6a5f203c650457935570e29089ec4cf5853140938bcf7ce6c22d2b2dd64a926407ebf1ce38279a53fb0c74b6bb3b2b3d53f24dac
-
Filesize
5.9MB
MD53ad37d830b947ae6416a5e503985a182
SHA10564fd304a60beac52b1db517c27df90c6551be3
SHA25641b03f3b018c5d4dd5ea63c2c947543eebe86b427700ab9a2f98d56dfc5e7d9c
SHA512212a6b10d0a4dfcceed064e2f84b40731a8d7405c7e10a715fb455726552097c01db02e6e2604526df7d970258bd2f636aab01a8cede51a4617a245b362630df
-
Filesize
5.9MB
MD5eac0c8d3c07cd96832dbf6bd0e75996a
SHA18e1954b75e72710c7e21f81b6c14c6f5e64b6686
SHA256ef2fe0ee231f291a8d9f52700e53e30a427a4a6b8ad8e6a8bb5a623e2c41a6a3
SHA5126a8bdc1664220ca1d0cb3d89fa4da4c2ee6defa1948f950b512a9fba1422e25b839798605bd93b75e4f060f99604a702702aa0231c7bb1231a6c854632b12b8d
-
Filesize
5.9MB
MD5b2c623ca2ae6eb240a69b9bdcc22b01c
SHA160beb07eb7a05f03ed6a0453e7a187791495f8f2
SHA2565c93351436534f2f6d94dafc01a2ad292d04460cf78ef3373799f4423bd947cf
SHA512987a360018e617bb8c046708add2b33a87d60bab276580724b84acd437a759b2050ad7953db4759484317fb1546d9170ae70200d9eda3e203dacd4a239375876
-
Filesize
5.9MB
MD5a2c5c6a93b6e7cf37ae561b5eb696ee8
SHA1b1aea4031758618cb76b8a3bc8445c24fad77fa6
SHA25683e93b615cb96280f3dad7ecf71028cb3a18844d67485567c318a4549f317eeb
SHA51217a043009733dcedc3b1c726cf1f0c9df8fff69947b97320fceae9dc7f7735bc0ef13b226f7fdac54016c15d36a1cf9b6aedbb1e27505f4e8baab0ed245162ac
-
Filesize
5.9MB
MD59810b5dc3bf28b09510ebfcbbe421c20
SHA1fdc0f819b0921b3a41dbd74a3fd5f3fba1639bdf
SHA2565e31f6a27bf27414ea68d803efe64a1548f9ed68aee7ea38d8d1c0c3b277710f
SHA512d5c90b45cc59a0e6a4b725320fbe6ad502447308d0af21a10a28da5d816857b97995c214ed76ac0cb54798f61c36788ea6beedcb49dd813d84b1277cefdef7ff
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB