Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 04:11
General
-
Target
2024-09-16_d804234bef9b6c16a385236024ed7f4d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d804234bef9b6c16a385236024ed7f4d
-
SHA1
08ef3f565ef2bdf9febca68b6db35c156e56878c
-
SHA256
3f042cbdbeef9cb2e1adc313a93d660197b7ca4261d3164a4b0100fb6e002d3e
-
SHA512
d6d2354491425530a83e57f0a19005814b9f2ca331135a05d46610a8df44ee36597d55c56aa82da1146eff5789b322ee7f86e2ef2631f37bb019f36d08ab37d1
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUC:E+b56utgpPF8u/7C
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_d804234bef9b6c16a385236024ed7f4d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_d804234bef9b6c16a385236024ed7f4d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\meTpKch.exeC:\Windows\System\meTpKch.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryBWOFt.exeC:\Windows\System\ryBWOFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhHTmtS.exeC:\Windows\System\uhHTmtS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UBEyUjp.exeC:\Windows\System\UBEyUjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrPqMwq.exeC:\Windows\System\CrPqMwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PLrnEsR.exeC:\Windows\System\PLrnEsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzEJaBz.exeC:\Windows\System\rzEJaBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsGILSq.exeC:\Windows\System\qsGILSq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSZUyUR.exeC:\Windows\System\lSZUyUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xprmNqo.exeC:\Windows\System\xprmNqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eZkxnMI.exeC:\Windows\System\eZkxnMI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jKKPQpa.exeC:\Windows\System\jKKPQpa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Uvrlxzw.exeC:\Windows\System\Uvrlxzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KosQAEI.exeC:\Windows\System\KosQAEI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MxzRaGj.exeC:\Windows\System\MxzRaGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBzyLJL.exeC:\Windows\System\pBzyLJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kkzjCve.exeC:\Windows\System\kkzjCve.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELczSgD.exeC:\Windows\System\ELczSgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QAhmdLp.exeC:\Windows\System\QAhmdLp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evrBIXC.exeC:\Windows\System\evrBIXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcRrPEn.exeC:\Windows\System\UcRrPEn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51f6e7fedc089b5c0e3a6707366bce4af
SHA137f7e5b2efed1c91d1a0ba7a90b7e248274960bb
SHA256792a43a52b0a81dc3c76327bcb28d040c3dd09faf8a9e55af6980c1ab145261d
SHA5122f7da1c46e3448c125abb9adaaffe9f5898f38258619628ac4d306a6d3e467ee4454dc161db30f4cee328c4e9701f77ead8584d82920276a72ed1459a8bebefb
-
Filesize
5.9MB
MD5a6eabb34ee886165cfe0982ef8e6ef75
SHA157860369f523dd616bb4f05eb082a7597dbbef69
SHA25677276c8fd4c6e9128fce4bca1426be32f3052d06daaa3f088db070ee47b8bb79
SHA51298b0acbfcf6a4ff4ae1dd7778dfc947581b9711c214e5d94d2fefeaef6e59dbe1a581943ccf9cef2f877a5c208c3a2258d3db52679283fa05a194f7751aba57c
-
Filesize
5.9MB
MD5446736623c53ca9855e3a7f28d1d1db9
SHA1d7cc1c4315900c5b90f0874b076dc76fdad12a4d
SHA256b4fcf723da53322e45ab61428957f2f6a902ab69c90f71ee8a354f76d5f76c88
SHA51259fc03e153a6ae69d687fea6d3bdee49928fcc597c3b42f4338b4682a41c41bc503d215b86a14a35b6168b9d6322d298668ae25e1c0fee4c2593cc86435160ae
-
Filesize
5.9MB
MD523d3bdc2ba763d9f860f2873d21f37ce
SHA108c962a5d19fd8ee799b0267fb8dba937908c8a8
SHA256a0dced6e58ad97bc6ceadf7d50c159e7ec82970193995387f05f6ac04962acd5
SHA51217e05c81592a5635621d30191e010ce98542b7debc5ba99fe3c1d47bda4d1a846df2977b0ad0bc411b35eb7e26603051a0b0f24b52f72346da1d779ced91c306
-
Filesize
5.9MB
MD5da56959fd5c461d51abb5017140847bb
SHA12f47a9f49048b6f529742715527fbdebbb62f977
SHA256a3ea1ec31eb3639b48a09209cb519de1d719adb7d70356969726cc6e6529c47a
SHA51273a5e89cec2bee14d47a3407b12ea25e0853618551e36a29708abb5ecf411a6a2f34be61579e590800a548e3849a40dbb974a48457d58cb1bdeef5bfb42053ad
-
Filesize
5.9MB
MD5aa93050c64295b154ff4da497a1256e0
SHA1aa6180ec7b3bb4e91b1894355a5178b007846fc5
SHA256792a6e30cbe496303077dfc125878abc3944c9d980490edb72e71189d49acfb6
SHA512b38844e1f3f65258198528165dfe2d0494ec7e9b9ee2578f41576db83911151e4b27288aa64f3ece9caa98529ec7a5e851d0601ba4910b5c7ad3f83cd5899c88
-
Filesize
5.9MB
MD55416e5e0005ca10e3c2abc8877ef92d0
SHA17e3eede5302fd97f9dec2ea4a52d99b62b0f9c56
SHA2567d7f6dcf19ff02c211dd4cf53af6faf60d7c3ed28764a9778628bb324eb883b9
SHA512bfe8c11b072f04eb34d9ea438dffe8d87f34ad734d548552c3eb3a221c33938a2154d71ab95ce8d0427018df336df4a1362674bede5b1675ed13c6c9aee57302
-
Filesize
5.9MB
MD560074c18231d79e057a5adf98fe69753
SHA1985f0e522885393d5f1145f5abc2824b26f2ff75
SHA256116ffbb220b3fe111069e8f34ed60cc7c7f91d6377a67854b9ef7bcd23ceb445
SHA5129d6c131006ded946ef0ec62d71ed512aec8497e3cc4db74eaffe6eea2581fdcb0e4998e9038d71e0d4a63b64608d9f5a7452a0b6b898dd6613abd9387dc60979
-
Filesize
5.9MB
MD56d80c1d2da013eed5bc4e2d2b46240c9
SHA124949c1688a5c1a67c8ffe75a309782471379567
SHA25678a65a8db3bd0487b2f56aed4666eacbc9bcf44d3ca8ec34c13aa0b6bde647f8
SHA512c9ce7807402b50e8ce4d5293b07e81cdd5fcbde0f9f6f6c03d74d507bc7248f3a30ce4a7ee21004fced31258638797261a81e6cd11a8aa08ab1e52abb36ffe94
-
Filesize
5.9MB
MD5b8c6672f66cf4bb4c53edf9656766220
SHA1911325bba27f8793165c647fc356771187c2ad2e
SHA25695fbde3ddb42d840ee551332449e2fbbf2357d25e7e65e27b482c8fd5ad87125
SHA512d7065cc2ccc2de441fc9a09b669937dcaf41d5ff9961f80f3073008120571771caccb9c9b9a7df324f885924f67bcbb2800d4082c92a1e879b399467146379c0
-
Filesize
5.9MB
MD5f9a35be70769adc9b411d891ace501fd
SHA120d52fc1a199f6f75e16ba9c5a8841399205cef9
SHA256777445e2b0105d549c3a6ddd03808974da3ed527229669cd857b1f854204e634
SHA512add74cb2b3c6fcd3844bfaf2bbba6c47b47dd4ad6c55d8016e7cc029c94101585b475d9b88850b8aec035b45cef906f0c3d6d97d416f59092920ae4e5292501c
-
Filesize
5.9MB
MD5b838409744b90d286afb9690f183e15e
SHA137274ea077b9438ac3bef082844381110a8201fb
SHA2569c1e09ee217fa81d7aecde0d1de6dc4f7e7a81cafc1cc314b9d8024ab0beb822
SHA51223c6f5c6d1d8e0c3fbfe203ac15f5c18d6f51e2bc00ca635112f305a2ce39f5194b93acda7185c0ae4de78091f795440858340897ff5573c6ce77d4bf667d416
-
Filesize
5.9MB
MD5f1eada13251ff5f1b3fef9ca76056be8
SHA1103d45b61f79f2448f45cc17b3d8018fad184ba5
SHA2565d671d34f394dae10fcafe66a5c3ae7c57cdd6156118799e1ac21c2e5d520401
SHA512b088601b9e8928201309f7e8f97f48391e9bdf8374a029a5f4184665634c3bb7930282a3026aa3e1edce04855f9ebc1f4bdd78682d1bc30f380fe191dc40c98c
-
Filesize
5.9MB
MD5ddd22accd7ec44b63ad41f09cae76323
SHA1bf324ca9c5fe1a4e11a2ca92559d7fc0b0fb7703
SHA256a87db6ccad88a2a722436717797c9a20c3f84ec4e30167950605c176777e4099
SHA51239c94ddfd16bfa7b5e59062f10359f1839296310782b6ea0be27ba8e89a82e2e8980d96ec01c9260350c2ff71b4fd853374d300e92c5a9bef1acec9c83f2010b
-
Filesize
5.9MB
MD586e484744392129604f7b83818c4fadc
SHA1f63bfc29949ab515bb042743a6ce6f215aff1ebe
SHA2563084e940d489afde173daecab06d03c05b66e570f270d2c864bf028e4da252a7
SHA512d041d5dc433d7b87f68ad25f559083cfb5f78c54b9216108b99ede7a0e6ef0d3054454da166ff4ba753a3dc9ac12761d6e67ab473045535c67804c68fb2b8657
-
Filesize
5.9MB
MD58476aa1d2443c0410a727bbf50e47b30
SHA15a3a51f12a3678061ede165bd0485f165e1a1e67
SHA256264199e16ec09845caf5018aa72c4ed8a7a44518700d07f51be5b4dd5da70597
SHA512bef55fa34480be5a3c8625cd56ac493c3257cc4d9ca57bd474c28f4cb79f9f026b4c5785ecd52b51c0c5c210f6974df1cde3d6cc8747415681899b0fae2e98e3
-
Filesize
5.9MB
MD53db43bffba7ca6e19240190f4b0fee0a
SHA1f431e6cb6f3037b9434bd247d05e142619ef2ef3
SHA2565bd93ae3c1b8b7d969104911c10205f7d403bd6410c8eb0fd67363823e1c4723
SHA5126c56a3895bbed675c6eb9597fb8f17cc22c8c7fb5325ee38106846d191d16e951c0cc12f6b2e3a3656064b4ba837d76e19425fc509da025f035ed557408696a8
-
Filesize
5.9MB
MD58819bd00a070632d6c422c5ec6444a5d
SHA1a6d9948da73409e0a1b5b4df9f295cd03adc2ba9
SHA256ac8f0885055f684d10ed1b8d67024592e6eec614146ff5e163e43761f6f49804
SHA51283cde8cec4c3a99227ca379af1c8e45725447678cb79cf9de3854fb654cd0c06ae543d8b8c9134b6faf4bf8ffbd460b1c5d18894e21cc6e35049b227c54584e8
-
Filesize
5.9MB
MD5657b4845a42beccb142af538e5b992ac
SHA17eb1ccd9e5783d4951456eea316573e150a52941
SHA2562406c38944929bf8917611da6d2e4c95972dcecb118bb9cc8f2b763024b22b8a
SHA512e78d3105e8a7d5f74666da81ef55e7870445354b876ea0226b352b64be629d4009a3e1b3927ccf15f7baf254a516ff300d94d3ae058e0a752a0f1e71351266c6
-
Filesize
5.9MB
MD53707e36c00e9856c1ba806963c681a13
SHA1bdd6d84c56f013ae3abe116b3e228d3cafe37faf
SHA25672368890e6bd8b4da25bff37d2f4254b5960d799ed44371f065814591d535e82
SHA5129a89046f15ba4e3bde1ac84b21f0502125158b26fa81bb2a9111389dc6c5f0e4af5aa18077c093a112a8f7cf5ed522479408aa4db9e9dbd6a55017a8b1a6d1f5
-
Filesize
5.9MB
MD5252560756577dfbdc4ac75dce937d5a2
SHA17d73c53f8726285a11f0634e5f1639dbec435dda
SHA256e538cd596be5d758890f37fe6dfe06beb4472abe98dcb0ed68a9404d5c24b8ca
SHA512c874fce97c660bb62b2392514d7a519b5be66a9a81edba50faf76596c97962eb182fa4ca2cbbada5547d06f415c9f2d129915d9cabc7f9fda41196deb916546b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB