Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 04:02
General
-
Target
2024-09-16_98c4e7c6576d26ab41b1233c699a5fd3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
98c4e7c6576d26ab41b1233c699a5fd3
-
SHA1
9f69de019bd7782958e8d05b2b967221718b1e22
-
SHA256
56e870aa0c27b2b63c55476a74caa5e5748825e4dd1aab39902be8f313ec8cb5
-
SHA512
8c9cd437f7650ab9e0c10d76ac424de2bec90a50815b986a1c6721f18d575f626e8fce1f154df0fa52783dbb142705820fcf15bc13236759aec87ba4bd743edc
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU3:E+b56utgpPF8u/73
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_98c4e7c6576d26ab41b1233c699a5fd3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_98c4e7c6576d26ab41b1233c699a5fd3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UIuFObD.exeC:\Windows\System\UIuFObD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MsZQKtl.exeC:\Windows\System\MsZQKtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TotARLO.exeC:\Windows\System\TotARLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVnZObc.exeC:\Windows\System\iVnZObc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CAMTOnc.exeC:\Windows\System\CAMTOnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kWLwntA.exeC:\Windows\System\kWLwntA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXUczKp.exeC:\Windows\System\sXUczKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YxiEwVt.exeC:\Windows\System\YxiEwVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZrNXSPi.exeC:\Windows\System\ZrNXSPi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzbJinM.exeC:\Windows\System\KzbJinM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cmbKbKI.exeC:\Windows\System\cmbKbKI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yiNSEdN.exeC:\Windows\System\yiNSEdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTfmqms.exeC:\Windows\System\jTfmqms.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KwVTFgS.exeC:\Windows\System\KwVTFgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWkBpwy.exeC:\Windows\System\uWkBpwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilWKjzh.exeC:\Windows\System\ilWKjzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAoDSRK.exeC:\Windows\System\cAoDSRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wEhlECq.exeC:\Windows\System\wEhlECq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwJAXOb.exeC:\Windows\System\BwJAXOb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNxykmu.exeC:\Windows\System\RNxykmu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFlFStf.exeC:\Windows\System\oFlFStf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58f375e878388ea082ff0ceb5f7ed73e5
SHA113ac440cb153c20d1ccbe68220a73ee8432a3eb6
SHA256537cb1a18c71bc21ca267eb0813e9e6884ea1a531a7b8d5738f621ec470107a2
SHA51249b9ebed5beb9cebd3d928c0b4cc9103f56adab950cc35ab931d7e79f9d016bb47f36390b70950b7e11d3769f3d26f0e767f1ba93272174fd54bef1f0b5582f0
-
Filesize
5.9MB
MD52ba378bd4126a93f51c1769968249bcb
SHA19162050cd40994c3a03000b6d068749eff7c7f8c
SHA256aa25b582d0c405d366962fc31e5e28c87fe85fa122fb1584fe7f99d41d8a54ce
SHA51251a3b473907593e0f742e23bb9b5c7d55e92d9891dacc406ba8ee68695f9c470566781fc95712777e571acc780387d1e3c1d41ece1a65ccd333f20dd483925df
-
Filesize
5.9MB
MD539d67dbc38207a4d58e463f6d38b91bc
SHA1c92335b8f1ba8718255d2eda6d765c0d8ce2f33a
SHA256de6d643c3e99b379a360e2594f5d488b277bd1a154d14ed69ceaa0c004b802f2
SHA51221f0aeade1af7f548f2a1c5d61ad063e024f91a3619a20228559ee3ea6e108cdb890f41382c8a466022a9f7c61eeb09074066cbde6ec0f5133f1e822f0f875f3
-
Filesize
5.9MB
MD5cab99a31bc4ec4d5916f4427ec2d5ae1
SHA1c9ab60c9cc30bb0fd61d630e691f64c3ca0d254d
SHA2564181f0c64770164ca1cc18512546113b2ca3bd521de15c0f557f36c9fee649cd
SHA512095cac1d600c727ab7f35cd565c0578f05768f617c1a7ccb3dbb26c115cc365058442e695c9645cfc0b243b43654de2576f899fdaa60aecef5a37fa702006054
-
Filesize
5.9MB
MD5055b30ad7c4fd56deba3431f8cc78cfb
SHA1e7e17eeeaa41bf64d74879d526b48d260b25f6b4
SHA2568435d90d903f53a43aaa50a5d7c03ca2864b881eea1fdfd916d76fbdd6123b4b
SHA51221b7d22ccab4c70e1dc17261600899a2b9268a067bcdb37983f041ea863b58fec8b87f825232f2716a262052d7ecbb6ff8a6b9fbd65aebf8385984b20eb14826
-
Filesize
5.9MB
MD5f02a94c6194140e1dca190f28f4a60b3
SHA11cb4bfc4742183fa09869b15c8054c32cfda3c51
SHA2563466fffd508ca8972007d15fdc756da8d24e2a51944add75a31fca7fc91a517f
SHA5129b78bd9ffbeb17ed632edd85fa69375b8f7308728ed490a56e8a2f01125114692fedc9673b7b267555f24667d81e9f7cfa05a9c7cf37c287b4f28154d8e23519
-
Filesize
5.9MB
MD55b8f4f067540af8d86c8639202def422
SHA106585c038dd1f968697401a985aa4e313d05ac5a
SHA2565ce47dcedb7fc77b6c0a1bbc650b8b2c0a3aeeb30c5f973c4d390f5eca6a56a0
SHA512888fc3977a9a87f4a2037eb30cc4c214296bbbe8da59141d83c22abc92419dc2e17fb5f8ee5b1c8f5cc0bcd11325979ac824bdd64470041f9212afa544e35b93
-
Filesize
5.9MB
MD5248a0203054cc7a33d767a9dab5615da
SHA139c13a0a5edf0d620e71bf8694204f283ab19271
SHA256fb48389b348f79a01a4c93f0af4aac364459701335e923bda9ee7e7fe4f197b2
SHA512661b1565247ead22a813d1b3ef086b3a1ac1325ee0cc8159c7e9e9546cdca9edc054e4bbf1494b0008209dbba8f9bc592ba8ab4722e25c16ed42b26a7f4e062a
-
Filesize
5.9MB
MD51a485047ff0e102f8ba55ffd016f5a0d
SHA1eabc824458d85356b2bbca1b3f6e60aaa19689c4
SHA2569994385159ed50c0f87729f7f41a206277bf963c35d6a5d4ae0be82326abd2cb
SHA512d3458ff33a41f0d11d6db278e9179380c0ad30ac4149eb9b8f7a466209c94f6a881e0c84e025cafe4dcd92d11fd4f2753f4b90abe57ff07ca0c706c35427804a
-
Filesize
5.9MB
MD5928187164d7435c6014c4325ba07c7b9
SHA1b8a40432c5c0db22611bc638b86340c6b05ce37d
SHA256963c7651225c1a6a35e983a85750aa660d9b459b15f434a41918878dc0d44b11
SHA512b22b5ec7e8c8a281fc4ddf9f9acf798562bd8e7f588a1a2a62cdb99344438c21d6dfdcaee290a8157cef86d7fcc85052d6fe35c676c050116991e92eac7a8152
-
Filesize
5.9MB
MD50bbb3d36184401f16a287e347b467a8a
SHA17721930101a0594ef387fc7ea938a58f2b95bf2a
SHA256445f37a6374262c905ab66dfa9c8fadcec173c56b18806a2bf63951e52271945
SHA512a521e9023421647bb00b6d46481d1ec3fae8797e0d63134859789c1a02c54fdc14ad5db71dd2e63981d1ecccbe9aa2aef3edbfa0a4890eced5f755f3b21c509c
-
Filesize
5.9MB
MD59283112bacd8b8b7b5d01d147b0909c7
SHA1d67b4292e899abdafcf081dae442694072ffdecb
SHA2565f084f476eb4ae459a7b56784585c02958eba104e53d33e17e57e6b4bd1ad798
SHA512d1dafd6f2cfc8d8ff87499f747228b0e925adb57e41a3dcd758015a6354ccf5d0467ef7ba5d7fd4a3e5c449aa17ced7948a1ad6bcd9cf0ae196467c5541e8b95
-
Filesize
5.9MB
MD5978d3204fc2271ea464ce1bad7edaa25
SHA19aa80559d700871ccf8d728723333ec35eeeff88
SHA256d490a00e96611af6aa103a0bb5e3a2d7479fa102e01553262fbb095e9c9cb3ad
SHA51283d236028cf7f8fc126c547be96792d6e182fae71e52da8f9610b84ad0c5d5d1ff68b6307f820426faaac750234b779ad9751795b73927a6527cc8d38b6ae7b3
-
Filesize
5.9MB
MD51127e20b1330d192fae8127e1fb8a44f
SHA18e4cbd55e1328a49d1d7b1db60b1c437f0db1d57
SHA2569843fc1e355902132dbdf91751f02a7691bab504ef1fe8d64e8b303a03a6e59e
SHA5124b413ad69fd499d6af151687ba5a9b7eeda35aadd6f111a450b7bf43f960d5e91814d033423cf83a120c8ec8eb9ec9ad1f6964230e4c44d9763df7379bfe04e6
-
Filesize
5.9MB
MD56845443e42c66b65d0d31c70c51fd266
SHA17ef0af342ff3145920f2ccca0884948fc760a57d
SHA2569a1a88b3c5a87312ac3c697d359499b534f3c9d8572d963909080434b10cc3f0
SHA512d5aa5eb53b3a540799a7e006058483dbfdb4889177d038953903f1c4686c2d3f52dd42698206d378dc6a695f8060810e6b1b49b3ab6b7a1742cd935af1525565
-
Filesize
5.9MB
MD5bedcc9fe09925f7a4b3be625c7dd1672
SHA198167e4438c2b69d38c7ccfadd4ceda5ac9f3910
SHA256d54221c4091b9c852bcedaa3bc4f08952f53d7e228ff96883a2c001343bf7f69
SHA512d669f4962fe51ea2c8196c5f0696c55eed216316886af5b73ff78ecd5674832a02a266ecb60a4436f5e2bb706b590d8cd3673207e27a5b9b81d1df18783f2a57
-
Filesize
5.9MB
MD59da142c7a1fed0eea27edf3196d3dec7
SHA1e21e36aa8c2c33e5ecccc1afac91e5941acce773
SHA2567a0dd897fe3bfb373ec495c68594d28f017323f7a5313b65202c5f0b14f27f19
SHA5128459a9ebff6d88630f0f9192d4712d234bca3b820c9b4d4ca7a9da1b20541f8d975cfa147d709032f8582fa05aa061e7d43cdc49aff7c8736a01ea24e70462d9
-
Filesize
5.9MB
MD5965111f60761a6ac095cce04196d280b
SHA19aeb7be548dbca926c3396c6e6e1dcba050f9583
SHA2561fd0b68903658bb688c1accafe220d7f54a6ebc5ee12dc5440210cf91297543a
SHA512d68bdcc81a127214fdc655458ca6c1d51e4fe179005cb9d6ff9e048aadb9a9be52ad37f4ec13e845aaa00c30d8d626363965ea340dfa223cd983fae12a821ee9
-
Filesize
5.9MB
MD5ad91d5e114dd728137279ca54d87ba73
SHA14e21670b6326dd08ff3f2314c80831458bbc590d
SHA256be01ce937fcf3fe4ea229d1dc69f1349b145d4323f5d32944059bb4616b28e3e
SHA5126367844201b847811d8a3893dda9235cf5de3ec253bc7688e89e787fb9ce926f721e8b8fa8bec7779d06da260f632e812c856215b6248845151cee58b96dc66e
-
Filesize
5.9MB
MD55fca2402391ffac56ad566491295fd24
SHA1cae86ec9cbc8179c12cde76cfa44fe9851cd6804
SHA2561c4e05af3c6eaa79863aacc1e5b890295bca71438f55da1d44c754c229247b16
SHA51255730707593b30333e470fcbd7b4dde48c32a9fa155545adc0b1576aaabdf42f73932fceb1634c9f684f14e39e11bfa471361923d5a661a7593a051564116ec1
-
Filesize
5.9MB
MD5e051339957cf4ae5a72c7aa59d25ae96
SHA1ddc8e0a51fd43fd1807b5025fdc2d8222111cf07
SHA25671bb3f01edc19842d27c3bf64c72a82417ebc3152f71d2a534d7186e7ef24a3c
SHA51235f97e08e19e3faf9d96d7de1a5ae694535af7bb7143373651dfae3dee3138036b61997da41189e92e75d871f249fb870b5005446dc5fd230dd7d2824275db17
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB