Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-09-2024 07:28
General
-
Target
2024-09-17_27d52c7d8d09f9b5818d312820257d4d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
27d52c7d8d09f9b5818d312820257d4d
-
SHA1
0a91899ed45d81d731df4711ca141fe52a794748
-
SHA256
5257b10f59910b3b343c37204043bb42fbf2b68a9fb357d0726ef2a3456dbd73
-
SHA512
fb12bf353dc30838c46f249a4b76788ac13a128102a0043d151e786998f339ca021b7c32d29d36cb971181bd996bad794134fab2066671652f3991d4caa24be1
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUw
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-17_27d52c7d8d09f9b5818d312820257d4d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-17_27d52c7d8d09f9b5818d312820257d4d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dzNmtww.exeC:\Windows\System\dzNmtww.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GNgUTPt.exeC:\Windows\System\GNgUTPt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONEoUdn.exeC:\Windows\System\ONEoUdn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZYlKJUk.exeC:\Windows\System\ZYlKJUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRRKWWl.exeC:\Windows\System\sRRKWWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cIRCrlx.exeC:\Windows\System\cIRCrlx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PgtPOLF.exeC:\Windows\System\PgtPOLF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFotyiW.exeC:\Windows\System\oFotyiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlCMGhB.exeC:\Windows\System\TlCMGhB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZytwAyt.exeC:\Windows\System\ZytwAyt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJSOVkP.exeC:\Windows\System\SJSOVkP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UOdTpya.exeC:\Windows\System\UOdTpya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZTzxgRo.exeC:\Windows\System\ZTzxgRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OuusZBw.exeC:\Windows\System\OuusZBw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GCHkpVP.exeC:\Windows\System\GCHkpVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IraRooI.exeC:\Windows\System\IraRooI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dcMqdcA.exeC:\Windows\System\dcMqdcA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gvsJMgj.exeC:\Windows\System\gvsJMgj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWaKCtu.exeC:\Windows\System\FWaKCtu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VXmmavh.exeC:\Windows\System\VXmmavh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ObnoKUu.exeC:\Windows\System\ObnoKUu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD552fdf3f827bd7f5139ed83c5a0de0a6b
SHA1858f9305902e0627ebe741509f1727e4122ba77c
SHA256940c6e9e1328ba59b67a66315a072abd2b93afd5c3fb52325217ef1341f99eba
SHA51270413e254725ea8e48c9c95e676df8a618d1f94bb88656576b91284fd54a48528414cb1c0a4108de5fa334caa306b739d539ebcd525133239e7a8a00c96b9c58
-
Filesize
5.2MB
MD52c28829b3323fcb5aa3d1bc3b325b57e
SHA1d72b31e4b764b58df99988f2c292cfae5b8ba2b7
SHA256691597d237667250551817b7f7c2826f36e858a0bb9263d924434654e7444187
SHA512e67e20f13e14893c3224f9bf76a87e5dd958c9aaa16beb8981890cb716fe45adc466d92a5b0e03e2975cfe47ed03eeac7424dd718dbb20ce44da831d5af3f76f
-
Filesize
5.2MB
MD56d8765dc3f3d01f1bab92af24250d79a
SHA11b849e2c354bcdea1743a335efc888529ee23df7
SHA256333c5dec01f323ecab63b13a14475db74d4efb87c3407202e1da8ed63ed79ba3
SHA51241275519a991ce0cbc3b4672c75df48204f622c570b8fb23225e13d973dd0f44399b92814c14b623d9e51d6e0dc043fa01ec3f78e1b70eb7456eeeea75517c43
-
Filesize
5.2MB
MD566372cf4f6918aff5d724f9d122aa99d
SHA1c1284c5e681cb7d0b50c6289698dbf41c4097e86
SHA256599d4a36e6470b063a6de8ff6d79a9d5931675748c41ea7be8f1b1a5ceaf9b04
SHA512c2238649c6f7994b0737272cca8573c88a462d0a9bfa77e6bfa386ffb90e9fbfeae315f139799475f124ed492b2a0eed15f38907f3bd001bfcd0162b5ce5d715
-
Filesize
5.2MB
MD5c1945ff0acaeffab908c578e0e07a1dc
SHA170453f0d87be08f93776930285ce5b13cb99cbec
SHA256d22539431a38b3f30750dcbf07bc360540d6428c29c94aa80cc4eac3206ccd3d
SHA512c5d3bfceb8da4b7b1dc12dcf32afa417ddaeba0df94c5e440de5bc5799d95bcadcdf69db81db357a9a40610e697f5178edd98caf45ceae68c2d7929015a31d14
-
Filesize
5.2MB
MD5bda5ffebbe93145471c08760d81b24fc
SHA11fc172974d422924cde080673fefa42bfe5ff22e
SHA25684becb82a4db72fb7055502d00129375f7d5be4f47fdb0081edf4ed1528bd6e2
SHA512e04fe1fa4660229cc585f1b3cffa6c31996267bfefe74dd38e100aefbfb8c5440dd182bba8c0fafd1df976b02c33cc6e394a77c276358f93932544895efd4dfe
-
Filesize
5.2MB
MD588248ae21b83b9334ad4021343188a82
SHA1ba7be88435037a15c1a47eb3ce01d07679ee5657
SHA256a863a4c49189b6bbd652817cc3ab5a651834f1ee7d2bf67ea428139b964bd2c8
SHA512738bfb1d3b8bf70d22d1f9aba08b9b8d473555fa3a79f78ce7973e65cfbf61dc2efd87fcdad49afb1971b16ae90b629abad136416901c9f884eace529861eca5
-
Filesize
5.2MB
MD53ff7a367978cce244d34c8c671833ee8
SHA1e9bcbec58f132440c01e394f67ee0b80c1635ec5
SHA25612ce04313aca40327e3de56a9f50bf38cac872f6bff598569563e44d43e556cf
SHA512a72de9f83b2702c874a919cba3f59d42379ef0f0796d862ca8e2f3d98a99a7df2e35750944cf2ad35ba755d3e2515c1123055033fa585151ac1c72f38fe6ea53
-
Filesize
5.2MB
MD51411fe20866e4b261e6ad1032413a29f
SHA134ae5eedf5a9165bc4c24b0c7abcaeca85606dfb
SHA256fa828b14372335a87c53b19da8b05126793c0dfad0314cfcfcf0690219c50aca
SHA512327425f13490a3e7f099a6e3c180c169b690147542d37e8168bb7f395924a9902875c5eeca6b33fcc8dc1e23a6e5bb4677e41cf6dc66381e9f209421aee147b3
-
Filesize
5.2MB
MD5d0e876677fbf983b525d737410c01b68
SHA18dab0087b6d448198107e17df03360682ba04060
SHA25685ad22e2894ace008fa94cb088ca118cf4ad37fcd3c57e40b178deddd367fcd0
SHA5126ebe29f32124a465d6e7d21e660049616d9d188a0131fb3645fa8dd4bdd9b1b73e118d6d1fe63667ef9dddab1166c24ab777104e1444f1123ec2a24cef701338
-
Filesize
5.2MB
MD580f16a887b1e6c0444497ab3eb6fc1f3
SHA1fde651a61aea0a095edf89c998083ac4d3335f2a
SHA256b4cdb5a0d894f5b220952d075aab3ac930940ea3f56bc4406111fe0ee3b7b212
SHA5121f1f5f7d252f8f7cf4e6b3cf883df7cb0d696add0ea400f51e1038a0b5314e6ec4f2fbaf24600d54bf2eb405bfbf11a5e5d29095418d85e6d99776d29c8f402c
-
Filesize
5.2MB
MD551da0283806d8a8db41f5e549fc644f9
SHA1cc0b3d4f72b02bba3e0a5d98fa9efb2c44e6d756
SHA25610f19766e297856c1fd40116086cef0eb4766a174d8c00a6defbded75cbc5c34
SHA5120bd1c5d924680e4d7ff6e6ae51e564538291350f7d571592f63077502d848d2d10567753e952216bd392877ac70f64c39621c620a968d1f1c4a925de6f4138d8
-
Filesize
5.2MB
MD5869000eb45eb500f7ace12841fd6f32f
SHA1109627e402df19085c3da50753718fed99d3e1c6
SHA256775696b32cb5653a82da4e320f3420becfd13f7068b03beaecab83b980c8e5d1
SHA512b09735e36a6ec5538bf1fc3c5ed7cbeb384a3d09f573d64c9898d6c66c03633a5a1f02fda2e6c6affe02d005cb2ca41b4279cc4560178a9fb21ea21a48bb1c2d
-
Filesize
5.2MB
MD5c05e41ea0d7d272ce730e00d3e295221
SHA129fb73cb0709fcf62b0b1ad7e3a477e5aeac82d5
SHA256a1568b4b0b3129871b81b4f1a61d0bca87e6fb0fbea348087bd01e12c328c766
SHA512929c50b46cd3cba059dfaacf60438d9386da2214b647eeb86e5eee959816eb8b70cbd41fcb040ba0abdb4b2dc8858e46f2313ad00901acdd0ad72481422d4ba5
-
Filesize
5.2MB
MD58f82a2c4e0e5b0cf41a39d5fdfccf419
SHA163ee5a63fa2a4493d9422df8d6cf814b0a3fc44d
SHA256d2989231db95d9b65082f2142511b6149d97a54050cfd8d85e9790116355f91d
SHA5121203bdc24dcea395dae21d6944599c7a35800386571fba17feea8569c9d8179a46979c466cda7103b513449a57d332555652eb52a7867f2b1ba5c29246e72362
-
Filesize
5.2MB
MD5518715cfdb671d70a8555e98d4e5e4a3
SHA1efba5562ce48f2411f199756d5e0faaaea264885
SHA256419edac8e5aebbf01fb6711025cc9f73481718cbd53c39a2bb9c34ce8cada021
SHA51259ac0a2121003faab03f6058cbc58186232277face9ba8b774bfd4bb6acc5826b0867648c073fcf14c6d6ea5b2960366bf5e716b9a17f30849247a8c41d1459c
-
Filesize
5.2MB
MD5bc2b6d85517190c87f60d3abb3312191
SHA1317b0c7117d595927be62913432dda6b7485f470
SHA2567fc63e4c60e051a402eb3b323b04a09f62fe9c4b6aad4690070ba1dded007838
SHA512c5bcbababe74165271cccab1e865303aabdaf605929ed7b178426f2966dd21a1de809987c6cf75664b370498060f7bd57ca6a500aac44530033229fa5d2a7754
-
Filesize
5.2MB
MD52cf37e06e97ffe65c76d821b5852980a
SHA123c3c626ed6983198da1fda4bad120e81608c408
SHA256765d214d62e1ecf94c67fbee02a689f2a443b8609e396cb7bea008a8f53c511d
SHA512db4cc262b1fbfd0dbf2d53b56cb7358ac0a9e94b730f1c6a2f1107b1b559f7f97522d2ee9f16380e5465b5096e60bf0f7cd1378c590ff71553d57b3708183a1e
-
Filesize
5.2MB
MD55a94235a0fffdf1ab6e785de6ca56085
SHA1428d4346097b42dd0ebc4c1ec5833b3d10ba7842
SHA256bd599cf74ddd52b3c55ae4d93432407e993bd4d20ac82ca2ad9ecf199b7042ad
SHA51280961479eb4e9e081fcbe561083f70b43745f2105e7d28c8622a7b8c2c56d762472212c42f99f088b56899044ea1f1d1064c78a4520a87822cb54b7facca2801
-
Filesize
5.2MB
MD5603a8d58ef1923c5cba7a25a532a6efa
SHA12f8aa25b1edfb68b563e99d2c635cb6b8bc5cdbd
SHA2566b95cc28cd3e33ad9d28aef7d13bd305c57b3d139792571b4b2d9f3e9220b9ee
SHA51221c4b952a5315085a1c335a09beeb6924a67aeb48a20e81d3e9dad7ea752b3e2f5943919ce284eed51d67873e2e7ad38df8a549d8c0a55aebfe2c79416385ea4
-
Filesize
5.2MB
MD591f1a9dedaa0a264015091edf6974afd
SHA12e54d8bd1e0d8922a2e3492269746c3afe72f708
SHA256450188919ef266edfb82d3c738de5a3d344a97544478a6ec917fcb5ff3cc1d88
SHA512985f7ea53e5068ec0c1727572e1a59d70f94ca6f447af501e3256edf689016dc189dd83507800ee05ff8ed850c1441bd4f57b8e0ff1ed27869711ef839b5946f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB