Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 06:47
General
-
Target
2024-09-19_1b150ab288b289beb6e1f41367116282_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1b150ab288b289beb6e1f41367116282
-
SHA1
1a3dbc4f8b46af4712c49b608fcf7b23b30f61b8
-
SHA256
21a4998cf5589ac985617c9a3809dbfdd0e81808e0d510f3f597464e006c5969
-
SHA512
903df31964b4db1711042f7f5995c001dedae2b69d6945653e673d5c13b128aab6151feaba03f93c0bb2097bb43f43e5373e5ba97c04e2cb24e5c5386ec656ae
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_1b150ab288b289beb6e1f41367116282_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_1b150ab288b289beb6e1f41367116282_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MSzFMPY.exeC:\Windows\System\MSzFMPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmXHPIb.exeC:\Windows\System\BmXHPIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYfDxej.exeC:\Windows\System\IYfDxej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVUDIrW.exeC:\Windows\System\KVUDIrW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QpiYgGD.exeC:\Windows\System\QpiYgGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIcFfxv.exeC:\Windows\System\OIcFfxv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\COYRUNm.exeC:\Windows\System\COYRUNm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\moTrlyE.exeC:\Windows\System\moTrlyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgKLYGx.exeC:\Windows\System\MgKLYGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KYoVZXa.exeC:\Windows\System\KYoVZXa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJtFhUk.exeC:\Windows\System\uJtFhUk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSzugvY.exeC:\Windows\System\PSzugvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYSNLYd.exeC:\Windows\System\PYSNLYd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaqfzkN.exeC:\Windows\System\oaqfzkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlLaExZ.exeC:\Windows\System\TlLaExZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BxmbVNN.exeC:\Windows\System\BxmbVNN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sCBDfCb.exeC:\Windows\System\sCBDfCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Mrtsgov.exeC:\Windows\System\Mrtsgov.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqgfqDp.exeC:\Windows\System\OqgfqDp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aHWwbmH.exeC:\Windows\System\aHWwbmH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BrjzLlm.exeC:\Windows\System\BrjzLlm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5410c043e12ede51b9429b49f5f18cc8a
SHA1e87ccbda66570a57d3b75b8fb9d1f3968a15b3cb
SHA2569837c10e61edb9296401d6d30dc2bf22c46c521ca6032fc9c3800bc9dd7293cf
SHA51271727c21bb7e9272ef4efb606a8ec8ae25c4b952cbf80e785efb007fa0997e8c16cad80632d1d1933f9175b9d96625a95fe6b9020ef3cae0af809cc4cdb3e1dc
-
Filesize
5.2MB
MD5210650d7d5de3268492cef5c38c339c8
SHA163b36e666725fdcd29f2fb2f0920051ae8d69c3d
SHA25602419571ea58835d6cd6b5990a2a1369f1579a927432f481d75fddf1dc0c8685
SHA5126472346bfc05a6fb70ea7c4bc104024b21531d0635a81b45063e0ebf06d3492babc9b2d106ccb4dca6258cadca7181d14ccb85022594e72a43356209c6ed689b
-
Filesize
5.2MB
MD58f3b39c44c8478daf847d4bed4c2cc0d
SHA143a52024e9df4368a73ec1989236d000b725da1e
SHA2563a5bf40bf770ebe91e61bd771c36c89af95603f121b40f9ce32b67f2fe0d1b97
SHA512f3ae8716115a644007cb4622fcf20a7257a71c2fa624bf773a3694652eb42d349f1b4c3136466b61303f595ab70cb39bc4aa59ce1fea0aa12fabefabf5fb4543
-
Filesize
5.2MB
MD505ef7ecfbd0f775b4b713720b98501b4
SHA1cbdf6ee0a377a0870eacf2d049c9303da9b2af6f
SHA25649cd6ccdc7c48a5fb95829e9d2f0f6a000d7e95374767da0f7f10717b8046330
SHA51288098790b95997aa2b69fd132311ee0ba3ee61dae4cffb1f0d2f63d0d1f7bc443a0dcb7df34f7d66545cc673488390c4cb21d604cd6be309dcf2ac6e8a21c9ad
-
Filesize
5.2MB
MD5313a29d9de4000590fd97e082873bc1c
SHA10085b7bfc647ed5320fcfb646682433dcc6e6d96
SHA2561e8cc4ca9995082ebdc6a1371787504e8e447a43a0a4ac158100933ad903164b
SHA5123c85a77f59b995fda4f8e8483e17f814d0e1fd8a98e70e934c687cd3a76afbd041623e8397b0944447962e05596904f87931db6907dde07e65dac97076ce2619
-
Filesize
5.2MB
MD51e9633ad1a99d33c5090ab7f1ae86a3b
SHA1487c3344a0b2f2c27c0f06ed8264502d1f687303
SHA2561c60418346524852a8ca85043c26b733a8dd1a7227b4d1c84a8c3d5f15434c9f
SHA512223b2542b1d3ed420ebb41db6bf79e60282911662d449145c027b0967022979b3e163fbb9a1980373effea980852905b509f532ef320737bcd0d795c70a419df
-
Filesize
5.2MB
MD574078613c923510324ad591a9e0df98b
SHA1bffb04394e8adc76184ac83f26da91606cbf27d1
SHA25611b904568505417458defcb04ad356fee1aa1946b2d979705a863cd6e452cbbb
SHA5128d29512a5116a5d882e4e2807017c4057aa5255ea9e6f4bb674c52c7e1c9cbeeb630263a374b3d67e234a8a55d7270a75b21f12f47c0e87032a975df028dc65c
-
Filesize
5.2MB
MD5e871f4f569d0382fe5e35eac800056af
SHA1fd8d47c64c9840da5e75dc87efb748490413444e
SHA256288517ffe58affd778fefd4244b2fe8dd9aec436e43cac5a24b65a7d27915885
SHA512cc63efa62e587e5a8993703727f18a0fbf3df626820b94f8d8e7561c421a0367e5e6827d34ea5d439541412fa68426aaebabaeaa5e721ccbb20097fb27691d61
-
Filesize
5.2MB
MD525078a4f8c8bcf39ec0479b455a25263
SHA19e6bc2865864b563a1d53e5426ac3ca29c3f893b
SHA2565facca2a98ad168290e5813e6b98fd569d1e85746192b752a6ea7d65361804b0
SHA512001d609c9834e510d33960437514cb1eb5a5cb1b5ffbef3733b66dbfb730cc25bed3bf87fbc1a647589ee5c570c50fe3a452343fe9afc8ca00e8bad6d7c4f77b
-
Filesize
5.2MB
MD5be2517b570c2267e327067890243febc
SHA1523850894e2047df99d802dd33d62c2bd45af0a7
SHA256dfcd8ac6564ba6ac3a3c3da0889fd0f40b1c76d89be31b1d491a862671da0c31
SHA5129aa9f8033b99f9964dbf56d09e5e7b1be9dddd726563353e5f89254cc29954a03b6db677b70d3b2a181b8741b93e997f9f08070b47b798aa2f7781c61c346cd4
-
Filesize
5.2MB
MD5cd7c76a77835f61bdeb18f6f9113f125
SHA1ceb492a6d339329150fd5a06c6edae9ce1881e13
SHA25644bb618ba0805108b067a76485fce7b4d0d1ac9df2806960587d4315ca76235d
SHA512aeba75282ec5f93805be011a3eac16081e29997447248ec8da878a3d2497a0be83261ee69ee7b8e5d13812c12c0a90dd64912b0b0d32c505b0d41b90d8bd0173
-
Filesize
5.2MB
MD52badb5d0b03b2aefa193a4b53ecaf57f
SHA1c76597830b24d794a1a87610e66846c6d7df5b84
SHA2568aa4d782ac490ffe0df0112754484e84300e5876f777f178d44ddab7c563c377
SHA5121f1c648d93d06a9ff54607d8ba2fccba6a4ab3948ac849137da7b4b1a763ea431a4e53a8392d7b4e708a37642fb600b3a7a23d89905c1cd9551705e99f989030
-
Filesize
5.2MB
MD54764916488b4fcc349842eb590a4ca88
SHA15d00490f916365f5ec88679a257984befa1b5e6b
SHA256d7e29d2dfaa35b07043c5be3dd243cc746a7e00b751121e44794a30e7f6408d8
SHA5122abb687a79051224be07a376f3c68ac9556e3a6858f2420eb19411f2c749ff1f451549b751c3f3ad347987e62ca6041d0bb5463ebc8a3948774f4eb9bce2ba40
-
Filesize
5.2MB
MD5e74ceefbf9397e530364c8a703443b5c
SHA1a51975d04147e6cb15167f2b0f0a1baf6f32308c
SHA25645d05ed60dd6d40a3686dea070c0a8b81da3375507878aa8cf4bb282d13e50b0
SHA5125a9146d1e3dfde2e25e206908823b2ec1d9c682878d781a253497b1bd9bbebd13c0b0c6739088477d6d45fd3e1e16f41e80de6826290adba65a126decd5d50dd
-
Filesize
5.2MB
MD5bb2effc0a279a6db8a5a13187fa10591
SHA131bbc840f8cc31190c414e7faaa56623d6142d2b
SHA25659b9f77a4e0b850c15701155b231ca90223331d090c33df047c30f08a2c0ed6f
SHA512e3633f979b437ac0153794209999174ff9fe606c1ba859c4ae8ace1bc636f5c0015ae0e48eacf95e1cc3efda7c4aa6c2dc7a0df2e62df76c5247cd62792fe424
-
Filesize
5.2MB
MD570a4707a12c4340c83967a1b4bba962e
SHA18caea81b98d683dba84d106fbf30660dcf421890
SHA2564dbb91655dd754cf1295ecca455af5c6c51c8903584d44a276d688eb16298fe8
SHA512a8362b953d58483ea0fe6734622bd306894e37fedf5eb6a872b5c979921a02cffee8a71210cc564760c271ba38a0dd7867ee70ec46078f8796f1a080606e69bf
-
Filesize
5.2MB
MD5334181fe2fe169651c03dbd6f6a60b0d
SHA124c9bbf07ed35249246a30673042ce534c8801f5
SHA2565019b296b7965ead86c4b5a77a7f560cd8cbe146f61f36541bf7c458638a6add
SHA5125c53cbf9f71a6e4a1fb488277ef1293cd319a7ecf2708c983cf7cd9909238a441b6fc8f4a105ba7f24a096cd762d8b996dff130354855d232203da03f19f54df
-
Filesize
5.2MB
MD58f1ea42e1c24fa73510f480670e7bff3
SHA1ff20af613a6c72af466b5cdf3f9b696424f3a594
SHA2566a0e0286d4118a10dadb98a5d58e946b2689eceea0857dfa5204fba60ed38208
SHA512d9fbf3f8271f093b1dd7d509712188fa790b8b1b2445655e21b9803343530a1b961f5040b8ac59dc0f4126f3695320f1646dc4f3101d278b725f1ed57c7b02e5
-
Filesize
5.2MB
MD59ffdb90ee2cd400474134077a1e427d7
SHA13c750c79381928d25f40074ae2a9273ecabf8dc9
SHA256050519e47e4ecf0080167e24e5d653f411fc19c4eef62c171a2435310bd05a6e
SHA512e1492e12e1fd37031d53c6dbb70693e9893e7e9363b3a2aada0fd16c970695b76c3c7b80da3bd9a3a756a349ef706782629130caddf65fca0e7f71e6f18d4da5
-
Filesize
5.2MB
MD5c129003b97d8ed95f2feaf62b09d0091
SHA1722e14755f497c9abce7f3e2109c67dfc7c47e2f
SHA2565bf0b5ee903de96881448b53966d7388155ab2e2f11f9fdbd89b03091cc08744
SHA512073ccbe706a64b185359fb6f842367826a7e943c946f51ca21a0b37e994265f3ef48738f8b40a69124613571cafa4ad9c494039a076d03a3b0fb947194951d33
-
Filesize
5.2MB
MD57e2656adeaeae6a4ea9f90b81a37f163
SHA1aa34db0a5e0510391742ec0511726a9ec16dc285
SHA2561402dda54169a5d0456c9d3d41fb36601d37227337761ca5d23afea8d37eabe5
SHA5128930b17c0ec94c9f2ab39245e5a284f70310731226acfee9bf5a69a66afaecaa999ac7a6b00d72f73c20bf821f45ca0e62fedd38fd50f8e6ac47e6120d0f5eee
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB