Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 07:27
General
-
Target
2024-09-17_155d32430eaba135728f1b9a1b7bc077_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
155d32430eaba135728f1b9a1b7bc077
-
SHA1
23680c10bfc2fa533927ac953455e43b4a9916ef
-
SHA256
6076562dee7842a62802cb60f690c322af1958a0102e2da8f5612c0e6c8f05a7
-
SHA512
3126290270683fcfc455e80e0ee5a6aa9258bbed7ce983c8289d0fab2630087ecb51b949cf5fcffbb5ac46af393e42286c5268faa4e55a55edecc83dad8479b3
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_155d32430eaba135728f1b9a1b7bc077_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_155d32430eaba135728f1b9a1b7bc077_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tfTndjW.exeC:\Windows\System\tfTndjW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCwimEt.exeC:\Windows\System\wCwimEt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ecDPgMw.exeC:\Windows\System\ecDPgMw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QANZLmB.exeC:\Windows\System\QANZLmB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KsNdyTj.exeC:\Windows\System\KsNdyTj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DspcZpY.exeC:\Windows\System\DspcZpY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rzIiKOt.exeC:\Windows\System\rzIiKOt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmrQAMW.exeC:\Windows\System\kmrQAMW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVwtAdx.exeC:\Windows\System\vVwtAdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kOWuvDd.exeC:\Windows\System\kOWuvDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYckjTJ.exeC:\Windows\System\SYckjTJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXlQOkq.exeC:\Windows\System\AXlQOkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gxKrKya.exeC:\Windows\System\gxKrKya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XedIiLO.exeC:\Windows\System\XedIiLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aITfpRn.exeC:\Windows\System\aITfpRn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rxUFAjN.exeC:\Windows\System\rxUFAjN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWYTFkA.exeC:\Windows\System\OWYTFkA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pvVwgnY.exeC:\Windows\System\pvVwgnY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iHBGxXq.exeC:\Windows\System\iHBGxXq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzCKoSp.exeC:\Windows\System\hzCKoSp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ETxEUpt.exeC:\Windows\System\ETxEUpt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50c5277b0a453940205f538765ce79a17
SHA18541c5cb735f5251e958f734bbf856e187f434da
SHA256f0e68cb46672c632e4ba30979ff03477eb07662e6dd88976eadebc58c40a6136
SHA5123e154b2153174323db4054d122b2989fb5999b3a78da7436fc63c9e2bbfed61432c5d3da51652d9044691ec16d439ae29a963dc11e4b64303b0d9bdf843a0ca0
-
Filesize
5.2MB
MD5a34d3da66cde92864345718c5c08c942
SHA15bca63a49ddbbae47297b1e52eb32cc9fe3b1222
SHA256fa2f91e00e92929b8d49d3d7c38ba2ce9c6ff74ccec74ca28c98f75e18992193
SHA512e090222d029eb008f76977e111c063b356eb1b647930be6ad407e90752cc0d51d7c3b617d4cd94906a720cef8247f15501d2637d629ac48060e6c738eab27ba2
-
Filesize
5.2MB
MD59e56c8d7aa8b01f8e7b3c957c57e737b
SHA1707429e3f7aab33b6571dad1800aa69dceea674c
SHA256a7e38d397b92b31b5c2b809e0993ad8b1bec75bd29c6ac7314685c5f0f2e22bd
SHA512222b0ce5a08ec056a95821a7d4fa31a3505ae29ce6663c4c6aba5b6c9bd0f217479a11e7e21fcc6fff85934123af6c06c6c53950dcf56e46e68c83ba382f0680
-
Filesize
5.2MB
MD525c323380674b81bbe7d8d0ea8ad1643
SHA1ab415e89a1879d1c1319ce2174c34e94a1ef0c79
SHA2564c70e003fa32776971c55a66b0ae73f628351baac8a1e97222474b7e9b2487f9
SHA512b5bc2dfa70a774c11f7956d2d975b0f51ab6697a5b34c6bb31f3a151703f3736475d1ddd67b6521649efd239561957f7f2ba644ff6962d95d2a914fbdd3511d8
-
Filesize
5.2MB
MD549fa8f2a6f91ea2bcc4bd5695a4e7eda
SHA11927eebfa57fce066979f48a3665816df724026e
SHA2567214d26775edaa751f84ca04d87fe89bb549b85ee88761edd2508f26efa0e6f1
SHA51286c43c2a4b1fd7684b3591ef61bd77b711f0d3a021847487859f325171562163fee46fb1e25ef274b2d01e948a0059c5e9c90299c1d05fabbda8608a7fa2de4f
-
Filesize
5.2MB
MD54665d1bd6be9669e634e8baf23b3749a
SHA155cdad379ec185c09896f2761090ff2e071ee5f2
SHA256effaabb95ff3717188ca93987a721ac79f5e749dacb61336ec8f8504926053bf
SHA512d7243df4cbef9ea6d7437ab38f53c2cec8fe81f8b2ecc876c846617297637b58c84b35c35edcc69843ba28e61789bf351d3489a3e11654584e1d1e37071aa5d4
-
Filesize
5.2MB
MD54acc6002ca77982008fc00d4cc97d679
SHA1511079a644cd104d0407f813c499013100161deb
SHA2567eb3b87f2195777c8689e90ec30c1f19b9b85283853e7d5615f7492c0ac5c128
SHA5123f45d1073412748a288e861ecbe407be7c7c9dfdbd6ab969f485a01d1dc4c995da8ecc4d4e07272de23f67afbb92a75c73463a9c8ac54d45f42df9deae01513e
-
Filesize
5.2MB
MD59cf9bda92e6709cdaa72de1310f26064
SHA1250806deed821e29a9e5402b2741644429a8cf62
SHA256d77abc0ca7af306e119e0dfd9efffb3ba3eef602ac70d676c34a593a272fbe4d
SHA512d98a869bb19cdf9c0f776975246fd17a684de21e502432799d224df723a4966df21f8cec9145283174b10e698b59009116cba316594a172ac0ee6cca2c7cd622
-
Filesize
5.2MB
MD5f1b90ae41a028805dc4906e92f930179
SHA1f14b046f1c4552084152086c692215ef7f1fb4bf
SHA25634c660d5451f52ebd533b3938575e53e32c0b535f3ae8555aca760f3ca603f00
SHA512d6c51d6eeb47cf87ac9b54f7c9d0ccdac65e68b5536bddb1f8281f7e8116c8fddff25f26fde7137f398be0013ab9a8938b52053974405502acadfb3d2922860c
-
Filesize
5.2MB
MD5c2d6fc2c90f2f74f0f6d265399587225
SHA16f23b0eb479b547bdc29acf8a38babd9bed7b4c7
SHA256b60ca863eb5e46183572464f6286a26a77fd6f68dbe701bca2f7bd49a460b748
SHA51259b25513cc324a0eb3b0ff35175761b280e47a7739e0871745aa388ae3843eaa001e7695aace6e9ca1fbe5c131c31dd6238809bd5e5b5e71fbcb1bcf1688b676
-
Filesize
5.2MB
MD51252c12861268d38e99711e7f1b0ebfd
SHA1b62612cdd3195deb5ab49fa6f5a5c9e52cbecea3
SHA25608847238d7d0b7e7ee16c5a75fcc85ecf06cda07eb1debaa64ef3075321ba0b4
SHA5122077639093001bb7bec21295240d8905b7186f5c1d3abbf06f275055ba2dab52ecf4e7ffe65356ab96b4a634beb44ed48f4ddc8edd4c81cd678e1c34afd78e8e
-
Filesize
5.2MB
MD588105b53497e993459a8e0f7a3df3d72
SHA15495d85be509edfee93027c122dec4f00e5f07c6
SHA256969ee0d0dd8101aa1177827c8cb76dd2971b78948d2803a247bedbb2335ebb13
SHA51217ea0d3e8cc8497dce209803e9efc1774e1580ce1595ac1542fbca64777b27ada22d765ab7b5b63525899b4fd61c0ec45ff6b12ccfdd3d854ae64f8f84135a31
-
Filesize
5.2MB
MD5cb50e274a8c6f4677eef144c9bdd32e0
SHA172616f27420960241dceebe74639d8a8f96bb987
SHA256875b678c619a71e4b76a20a15409d55f01a2cb31ff6e3ebbf30fdc62b8477d77
SHA512484f09ab703b208482dadc3d79fa4c942913ed03e4d39fb4e01b81c56197659affc6fa7b4540af4c0529545a306f619864aed0aacac9f1ffe80970b91884ef55
-
Filesize
5.2MB
MD5c151b632885a3a113563d0ecd34a1e12
SHA1909bcba79fa0718d9ac19023c799ef5c1335300d
SHA25600d5721ac1d6455c98c259ff5d5380e4d2891c6aa35c8ffa39c448c77e67ee26
SHA5126ccedf36009837bfc5fcb2ab10216f7eafa7225d5af7e1d21828c98b89336b782c83f9e687a66a65de28ce43bc4097fb0d0bd24b0860a18afff7f5ee2fc35085
-
Filesize
5.2MB
MD504be6f69c3f48b9913de1fb2b901527b
SHA1f2e526bcf5f974b503bff173493576ac9e4d9d2a
SHA256828e961594743d657ece46547b31798f464168c44a700d9108fd36dc057dd65e
SHA512446d08c1d00afa353b43df361c04f12bedd7920c762a3956d6c3af5a5f94187cbc571d45c9d3848ab9db63f81d52e2a4979c78b7ab89effda417998bf60cffe2
-
Filesize
5.2MB
MD5788247cb4446b39beb62f46e390728de
SHA139efba8427170ec4f479505e71c11477b43f681e
SHA256dc23eabdeebf986b954362b1cce04a33ee1b2d1186d56610d4c4e6c5007f6d6f
SHA512ab0bc50891a989e8b6b7c6d4c0492ae1c24c0662e6eb8f2ea655adf8fcad89a7940f204ecd1a7a67574a903be17781d13740c6d146746417e2b3b1282658ec95
-
Filesize
5.2MB
MD571c8fe58b68827a41b4ce546404da975
SHA1b88d44149f51538f29aba7dc00c663ac9b9506b2
SHA256baff40888dd6d1fadac463acda6da833991790d9fa67b3345a30a69af0dea444
SHA512b42c5c135d28bfad44b0a283a3905871f63b93e84ba5fd07f6736841c956d651ce3c1072ce369d0175f95ab55e713486d7da917d8bcff3ec2f2193e821cde35b
-
Filesize
5.2MB
MD5f51210807f3efcb1e21a8f4d205f1900
SHA1e4b713a838a4c39650ecd448aa66d390dbfd1caf
SHA256ed386946ca75a22fd8cd7ab4edb695ae96947adcf36e0b0efb4e3ceeca731fa4
SHA5121e4e05e451970e3abcfbb45f28d5628a56e759bf2aa1f2020b2b1c808c5cee76228224d91611bf4f3a7714d32bf786429314303212769ded95e77e2a5a2ca3c0
-
Filesize
5.2MB
MD59a3d701316a10860d909ac283ed36d60
SHA1655cd38004e489b16ae3c71bc6768d5e9a222bec
SHA2567d0d060c099bd70e9d298af87ad5c06db83c6aa12e9470ad906ee22df92c4545
SHA512806547f19e7a9e4ef7d19e2b7cc5d7985450bb9f1a5a4b65474da740b519604c2205c1c4eac8c60d4b982045234f1e42d2669a39e657efddbaaa972647ec44bb
-
Filesize
5.2MB
MD570199dffa7f3fd11c1ba64e504773391
SHA13c3f03195d6f68c0d15794e76a24247265c05159
SHA256a9dd6990ecafdeb21873a80a372e611aee061a04a31ecce3a5c09f3c9025a80b
SHA512c279a8c7038e102a22b3f7cd49c519fbdeb798d41543af3be4655c05503a0215cfda520a1b48b7f831e84d1897b606cf767f6b1491e7b996aac9bc97fc328f04
-
Filesize
5.2MB
MD5ab4ce2e9e1ca461d3d38b3ba0c8045ae
SHA15d50ad79f5456a3c00d58dd86bbb01b650f04bfe
SHA2565593a09e281355fb49fb86ba8bba5301021ab3a705a7f72ff6d6115093536111
SHA5126052e7ad296556f80e30383d2e233e6f2371421931f7ad21b62469ede070e8eace41a860ebc7d7ad527a7a325094baf65c022c4e8ee68f17ba08ef0a31dc1b5d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB