Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 06:44
General
-
Target
2024-09-19_0e2de2117b9c55de3956f645b559e7c7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0e2de2117b9c55de3956f645b559e7c7
-
SHA1
9f59592511f356a5efdb22b3807353da13ddc469
-
SHA256
c99207230ec7e0f00e90914734a8f3e9990c9bf704e8a5a85afddfe3b323ab23
-
SHA512
735be701c628e7f0013d6ef70b8d7fc0b6bf504d88ea8a071084541c1cc687e980317da48d35d9c74cfb3b56c23f3e4f4c349a15f7dec3cbf296c7d7587561db
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_0e2de2117b9c55de3956f645b559e7c7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_0e2de2117b9c55de3956f645b559e7c7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\Qlgaazk.exeC:\Windows\System\Qlgaazk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HRBdDRk.exeC:\Windows\System\HRBdDRk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KszFxxz.exeC:\Windows\System\KszFxxz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RlZanfK.exeC:\Windows\System\RlZanfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bHvNnAF.exeC:\Windows\System\bHvNnAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fcyamBG.exeC:\Windows\System\fcyamBG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ziooqoQ.exeC:\Windows\System\ziooqoQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hLWXcDO.exeC:\Windows\System\hLWXcDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLUNRiq.exeC:\Windows\System\FLUNRiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmzKCOp.exeC:\Windows\System\mmzKCOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kePbbRi.exeC:\Windows\System\kePbbRi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkYyssy.exeC:\Windows\System\hkYyssy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UpjSTWl.exeC:\Windows\System\UpjSTWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WoWfuEH.exeC:\Windows\System\WoWfuEH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cOnjIPl.exeC:\Windows\System\cOnjIPl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gJUqAeS.exeC:\Windows\System\gJUqAeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DumuBKK.exeC:\Windows\System\DumuBKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJihRYU.exeC:\Windows\System\hJihRYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etozfCY.exeC:\Windows\System\etozfCY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NLBCWEn.exeC:\Windows\System\NLBCWEn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YIrUiXB.exeC:\Windows\System\YIrUiXB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59cd65846f7af01cee49ee0dc38d3ca3b
SHA14b9ace44d1d0d5a04a47234d5bc6051ee7b085ab
SHA256c72e1ea265a5705b31411b88e98dafb6ca676556ad3541771b5d6a79d21bc5d7
SHA51278b5f3892736c20de0099dedc06ff45fba4ed007afd318696077f168ed713ca4f566ef8b1cee055662037c870956417a86c62fe5d1a8b6eca79f90938ffd757e
-
Filesize
5.2MB
MD5267fb187abfe72099bd6381aed610a2d
SHA15a22515b9743c506cc33f9459b4443535972169d
SHA2564bb4f9a515cdc370c37f85db5f1473465385ebe4ce78d9309a9dc3b5b1badf3d
SHA512e79bd61def8d2a352e4e1a43e5801a00fc63f06d4441862007ad48b1a53b465ee3c9d085f9c8328618ff2242bac9469429eb031e1bb64ef63d0cbdea067ecb70
-
Filesize
5.2MB
MD5b2c735961862c59d3f8a1cf1ac2906e0
SHA1a7b3277a7309c641590806fcd2cf634e9e9f5bfa
SHA256d6ebbd04ea594b653871321fb2bb3eb4f23a4c9494c356ee17cdaaa02d96dda2
SHA5124972175ada69f66b51e6c562644e801dd6f974bc86a760e13f4fee8f5e3837bbfb42c627304b1fd28e426c74ac57172a28f69cf768bfc73f60f8a41f50225768
-
Filesize
5.2MB
MD53e6dc83b9e2060a7789ed69dd9eef823
SHA1d0e0d812bf640f7fb3391f4ea9775f952b0aa976
SHA256c8db9bfde6aa6ffd312b21ca07747f24bcc24f4d9149a4dcbd70ce7cdfd9bc88
SHA512ec66a2fb70d1e7c7e29e8d10a82c2974f32fdff3a3843f7f412467d90b9616ab22cfecdc8446f13bf9cd06e74664c26d9f1c506e5b7d52f5be580cfe98dc0c68
-
Filesize
5.2MB
MD5023ac1a173f984b48460524c7881235d
SHA1a74a98729874b13fb0aad40d4294aaf3ec78c6d4
SHA2569e07896c3b0b758b1d2b5844a2bf554c4ebd7b9e8d6181b13e126c5ec950ef8b
SHA512d14cca3cb3d8583224998719a00b097957c48d2afd7bcc81dac0880d6e550a27955caa2eb6743f0a09fba34e43c447d6f33041e288f9bddd4da92118d9756fb0
-
Filesize
5.2MB
MD56cced20882b03f11bc801ab789289845
SHA1f6ebb679fd59f8535c48cc27b65ab07f1c57cb49
SHA2564c9f18e146a3a087f5b05ae56c0130ba706a347a1a90de0df3f951ae1dc8e209
SHA512d61dfcb1ccb758bef48eab13e1484bdf22ea249d64555a1cb0eeed40e2cc9101604125eb861234ba0dd941c9519507c2f36f3fa4493e68dc0477aecaab24fba2
-
Filesize
5.2MB
MD59bc5c366d6b8cf287c80cbbbc7f40cc1
SHA10e3299b02691656ab0579688a7b09f83131c7e86
SHA256f5251dbeb65fe71556f86550fade255fcf130aa813e7f630954f07e20f090763
SHA512ca1c0f177cda3414c4bc0809e9a4837a86977798f233f76f2919bc8afaff05ae95035897fa5f01ef4eb73ab2cf0682f424ee8a75b0e371a8a14332889c8ded6f
-
Filesize
5.2MB
MD56d6917276fb2d8e956ebba9f1598d4c7
SHA19f688b64b043bb36a9e3437324106293f5acc9a8
SHA2564b60d7fcf0bc8bb20e98485755e45a8ba9d9f29400630a3b649d8fa94d74e614
SHA5127cf405eb0a51883db2e51ee37fa376f2283b0369f41ef09a64f3fdda3de8f5d129601d77cce8410343cfc473a8baaed1e3ef28b4d86b4e792fa2af8e574504d1
-
Filesize
5.2MB
MD5d7558e0fe1a7c2feaaf6b5507b52b734
SHA18e574c436bb3af1d208e6c59835a620b2012ddbb
SHA256091e05eb408d793df6d4a113f672b5675a158b2ad6d0dea0cb69be520af6c60a
SHA51298eab1346676a87239f734fa78ebd33c9eaf856731d810f15916cc6e43199ce31a2ab2fc429dc865855a6ab4b80bf73db9f136d7567198d4db0eb46515d40ddf
-
Filesize
5.2MB
MD5b771cebd65cafe3470244e21342ee08a
SHA1c1fcf8b539b9e7103fe6c4d3b1c4f2e26c104388
SHA2561f1c7d68bd45007d629370b989f4568818d67d26f5f9d24b22a7e77a274bf25e
SHA512058dc2f530801383a7b9be682470ff3885747fcf7618af90cf6a092ecf4997177c8e4f3fa821dbedc3e1fe491368b19de17cb986ed309b3bfeb45c57ff4b4485
-
Filesize
5.2MB
MD502aa8f22ad7462b569765636a8595426
SHA1f6b43e017ad11413ac7181fd95c0c138e9e8e7d4
SHA256f6d00ae46e9e65db7729653b43ef3f48d464f00823fb34e8df74ce5e3c1974b7
SHA51219faf030604abc79016d65c6bbd90bc9944fe2342d94f50983066ffcabd6c0196c6771c509024e057f81e085da424347a8ce4f1d59e81c1b009e5e2d0e4fe249
-
Filesize
5.2MB
MD555ba565fa00b4c3ec38481deb3cbb875
SHA14debd785a8a83639b307d44fc14577b0ae70108d
SHA25668f1607283616c803c1ade5002a703d3b871bb3c89bd501596638a4ec64f83c0
SHA51209d06d9ea22bce214d394be965fbf725e78a56874ee9297561fcc3f5b04308a06b225d7634c33e26809e5d6e592d3c68c9c1557e6a39ded72dbae72e94ecdedb
-
Filesize
5.2MB
MD5dc7bf66b46deb1c9f3b845fd613ca64a
SHA1fdc70eb15fc717c5e7cc6c6acfc822c322bbaee1
SHA256a1342f94a754636356cc69fb3e950f4d212ed85e314bad836f301a4a4731a89a
SHA5126201da75da873e10760602fc51a1da247f51ac87366a620110d413bba7f969eee3b1b3aa8388940aab2c024cc50c07b7928a1f1f589db41d15fe24b99f386f61
-
Filesize
5.2MB
MD52f35f6bd6a71ff36df98b6f6d67030af
SHA165bceb63ade5af6b6eeb2c5a7647f9601d5dee42
SHA2565bb0aa3336f014d20f4bb699f93f7c3e0de2131fa34903a6da49102b7e652a23
SHA51283b297597ba8d088161d289d1c75f07b45036e1602439197ae8bb983c44edc97d1272502431f547f7edc0e26b038ea1c64b95e607b2591b683c6d287be0d4bb7
-
Filesize
5.2MB
MD52badd26ddd5990b319cc2cb382fbf7ed
SHA1020c4dfacf3e2df73c52aa78b7670391015a7954
SHA25670371f35045ee31f16b9694bd7b76b1c0384c5a3c65a763abb264d870693baff
SHA5129dd1ea016f09baf6e885f1db67f1b088ef8d370cae178c13f3687d1e0bd314fa3eb99d3c30fbb482ac7d2f99c484ec82c434838509664492371808e346c424b7
-
Filesize
5.2MB
MD555da335154fde1334961d94b12eccc62
SHA168b4b13e24924ba3ffec6d3431812ea76e018791
SHA2568fc937d4d1ff8fa30fb32e9ff9bcf696523275d50bd9252a2142bce0659472ae
SHA512893360a879af63ce41e1256ed99fc3d238e934dcd953e19312c91dee8a90feadb1834b6d3ee63ab279acd02608f3f1d87c93c7141dcc1d72c98af73cf9f50c23
-
Filesize
5.2MB
MD5fcf5cfd2bf7e3f5d2da75a19f5f783a3
SHA1e4518b8af8633cd806a5606e54e5bc47bb4e46de
SHA256dc94b1105302050f305d018ec8a59346240b301cb14b40d5ddccc6e3b7c820e6
SHA5124e26b0be0989d214a59fdd1c28cf0ac077afabc8c9499d1c95618b91fda98b0ed315dc367b754a6816c8379f59068644213d416a9bf2c14eaa44f4c7e3dd540d
-
Filesize
5.2MB
MD58b75b7e2d21e1a6e8225de74d81801f2
SHA1ffc6ba20f64963f599314b5b07805a7926ee8101
SHA25609939a23bfda7b8c0cb3255e8ba199445b0f5ccedb4bd2af80487a26cf8708c1
SHA512d525d729dc26ded22b07b32187c51ab30fc49d28fe341cee35c828b2b4475e92b4550f884d69cf619bf175da6868e43e2010192d22e44d718f997e6c5edfaab8
-
Filesize
5.2MB
MD55f208bb482425a62fc022b0204a3c1af
SHA1512d0c37037f16e587ed73580c82c6cbd8735ab1
SHA256f0fcda0e63419aec2619d07e5f1f8e59de51aa73e9132b3e1d9fbc574744d474
SHA512ff8886bac6ec09ccc02a25d0dbd49d26bc6c1159db5f5707358464e67f6f56a5d16f54ecf91caa21c89be7603a923120d26bab57130c2a21b8717a9fa4101e7a
-
Filesize
5.2MB
MD56ea0e8d85b41f6ddcfbd526835929e9b
SHA1543bbc61c76e7acb9824ab32d3ca0c17ed459d13
SHA256c2f5b2f5268d054b6237bf9aa791f332965469bc01defd2bf30a0e3594e316ff
SHA512c48bf0876624b26014dd4b433483612c58d6dbfbec2ec58b1b5b281a4c0fff5d6214beb91a611919d40620b5dd2a80e6f515098a5999835c162985a51a245c9a
-
Filesize
5.2MB
MD5b346c9fbff9c0679efe59d26e2d702f6
SHA1375fabaaa27f381ee654fdd502acea0508a45150
SHA256adae4662e5cb4e1bbe3f64a494c83b916c126dae39040a4064819f945b4b1d42
SHA512f502764a8c9da4bd8a6e532a4afb768dfd09bd1cbef79848b2572774c5cd8687431967308eee29a1c3e9817d11324fe368a04ada46b9b671d939e0b7b4682aa2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB