Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 06:48
General
-
Target
2024-09-19_1cc558ec67aa955e292376b214a9e213_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1cc558ec67aa955e292376b214a9e213
-
SHA1
12f39c3034803ee0195243b0436560c76b4fb168
-
SHA256
39a31e8fa6e9a88b8352bb9bccb56334e867a1b05df3b482b8588f6c81586a0d
-
SHA512
018abbf7390cdf80ace583f073220aa8430f207d74faf4bbd2d97f594cff4c5e7b9a2e79f7b412f1056a251c6ef98bee3adb9ccb422f7f0de474af2bc17d7f31
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_1cc558ec67aa955e292376b214a9e213_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_1cc558ec67aa955e292376b214a9e213_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ArGXqHY.exeC:\Windows\System\ArGXqHY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUzOPqk.exeC:\Windows\System\DUzOPqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\clkXUdG.exeC:\Windows\System\clkXUdG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQpyVKa.exeC:\Windows\System\DQpyVKa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BdulEds.exeC:\Windows\System\BdulEds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gbNxHRl.exeC:\Windows\System\gbNxHRl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pRQHDDE.exeC:\Windows\System\pRQHDDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GQOxDaz.exeC:\Windows\System\GQOxDaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLGeyFD.exeC:\Windows\System\dLGeyFD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZssSOHq.exeC:\Windows\System\ZssSOHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkPPaEN.exeC:\Windows\System\HkPPaEN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BFDhHvd.exeC:\Windows\System\BFDhHvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hoAiLDG.exeC:\Windows\System\hoAiLDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZNWmrj.exeC:\Windows\System\fZNWmrj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vVqwMWn.exeC:\Windows\System\vVqwMWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvxNIgH.exeC:\Windows\System\XvxNIgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZSSZGPC.exeC:\Windows\System\ZSSZGPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVDbext.exeC:\Windows\System\NVDbext.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UQTBmpP.exeC:\Windows\System\UQTBmpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLKtmJC.exeC:\Windows\System\LLKtmJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Dkbqegz.exeC:\Windows\System\Dkbqegz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ef0b1bb505d03e1fdee6f0f562f78991
SHA1748404e124b684f8ca372d808af15efb378953a9
SHA2562eb01cd1b20635a25da56f0d4664046689281a08bcc558ed1ee50283a1915b3f
SHA5123f738555317c23d265595f3ca6fab24b48f6a38ea99720197b761d3916429838429d635173e7782f042857fc96770407a0a7be166ab32d8aabd193959f188ccd
-
Filesize
5.2MB
MD5c842e9edea3dddc29b7f6903f772e7c1
SHA1c3e32ca2ad157649fc2dff0befa8cba7ee403603
SHA25606ece585e080292a38b56fd263e8ee42d36fc09c7b5653050e688ef9b6f7091a
SHA512ff1b07a7d84f9ac21a9a613fa08210ff1b72b00ecf69cff28b3df3560107c9bd9f3d8a8c084a71f5370e8f459e4abd60ab390a736579c7a42d6969da6fcb3e6f
-
Filesize
5.2MB
MD5d33eec942695f6c48750f16ab59a4b94
SHA1eca1f737ca4193ebbf210b21d5a6a244ea881b22
SHA2560114c50a83de7187f2bd8e6b3880059ee422acffed54bd9e9c657475ad844534
SHA5126a2a33db0d8244146ce016edf6ba303fd189a2a2432ff4f46e8436d9c6d29cbf48e12fdbecca234a7d46879dde2e78879b34fd259ff0fdc7a388e0130f08137c
-
Filesize
5.2MB
MD5dd4c6f88c1337bc8af63b25f2f81a664
SHA1f673e8b79bb9b21c60e20724f25aee55961b9c62
SHA25652d50974c7f250c0c2c4467d2f4a07043219012590fa285e1204fe8fd3e3708f
SHA512c1a761427a83d4ac1676c96e7c2df1d95fd170ab570666d86fbb3dac42ff3541dd493d73753b20645be4473d48beed88a3636b0c582f445353aaca5d77960116
-
Filesize
5.2MB
MD5c322dd0fe150b0048fc68c0ac004923a
SHA1870a73573b4c825d468eb209d7e53f3dfc91daf4
SHA256ad4a397b9fa21b4dff6a830f393d365ef449e4ce6a001134bb30cbf877f5b8ca
SHA512be54482c9dc076178707743604947dbdfb08af43dfc198b1b6795e24d2522d9e9222bb8580e22862744fb26e4e06eb8ea59de59320e67c83826cace0a792b8e4
-
Filesize
5.2MB
MD5b717a3537d24db21dd9e70f4b66ddd5e
SHA1b0fafc79be566a0163ab34ad5900d6249ca5c0f8
SHA256e4afcab7b1668e948cad2df603f08964562b31f40b44b5194473dde9fd53d106
SHA51209001f662281d57bf1f8221b951524d2317d6efdfc935a18dd638f259f7ff94a505b18185600371af028c6676d08843a5b528685de13c4cbbf0206ab7dede81f
-
Filesize
5.2MB
MD5c49579a0748491a3671bdfe67cb21eda
SHA1d998dbf7e30e14a8e90889dfc4024ca7c1394f08
SHA256f117dda39ed889b6f669c27a2d22ab9fd02a6dda88672923000effbdcd06c86c
SHA512a4dd1908c9f02fbc68ec8f10e4d2479f3b20040af4c833e645712d5b2a781d93ff10a84555485c78ec7c997848b7e9b69980ab1eb59495deb36e1a3b074c42d3
-
Filesize
5.2MB
MD5c4270f5fea7c01cd31d361b01e846816
SHA1365c28f4c2f8364ecd367883257d68c7887a994f
SHA256b612fa5544a8a4a462f40816bf24f5c21d25acd20002885520350ed637710dc3
SHA512a8e9352483de298ecb02929b0164f62b68e9d7bb4b1f65ae7aa421fe99df91a5783273bd6192e58ab3594dea8d735744a469c3441c60ce91504866d8b06058c9
-
Filesize
5.2MB
MD50b5f53095a4008ace67322211a6f89b2
SHA1b38840509bea64c7bfe6c2d21f8e5e0e36cf2da4
SHA25684991038cc6758eca15109d724c46113f1864e7f390804ddd4bc2fba6ce9a10d
SHA512d0bd11012af0abf892d27c6fdbf9cb9503d82e15457cebc8973880ba70d3935c8c3433e4e1b3add6a670c944aed02f91a190eb3d54b60e9e510fc6d9f6e493f1
-
Filesize
5.2MB
MD538e94f9e85557b3dbcbe2469a82976a9
SHA1e945f0c79ecc305f3923ace8ce2380b0bd639599
SHA2564926480aecb80fbb246aefc1f4f772cb4aaca7d3cf9e7e62f2ed5b33dabe2a7a
SHA5128cee0a2f573acc35387cca90977a343c074f587d2110aa61eb960189e95be83a2f4e94c6a8eaf56f71707eda2d97f646170a4aeb6fc93e08163fc4c97f981540
-
Filesize
5.2MB
MD5efe898f4f7816f8f3ce4697eca2bac9e
SHA1b04d5996c5783b504b5fdcabfe0ce0995127e726
SHA25664982615cc56b383d394072e6525142e936e42f839fe8d8054b1f5b4d139704a
SHA512a08e4f5c5274ed449fce26e3dd3d4aed6e7d56ea446f5574f83dddcc2f5cd0a495b7d30ed00686f6790866e64b80b20f10a1f1567c0c35691632780a4c55df05
-
Filesize
5.2MB
MD510d4bf75913a4582675d603db454059f
SHA147993db630fd1a83ac55c622fb4270d6f6153269
SHA25645bdee30c80aaea17fa0c85a9b1a1a58cef6bd68afdad2dac83f61fbf189040f
SHA5125c313d09f4f6455c179847a1b8843cc2844201f7d8ad683ffe128c3a082e56cb568616ef2230abee4751294c89c4472c63e3ccf2b278917ac9f5f90cdbb9db52
-
Filesize
5.2MB
MD52a85b935796e18de2958aa17de131ee0
SHA1f2247b2d2ebb8f6a2c13f6040831c0f87533d1ac
SHA256d7f6f7f8191621e56ffa0e33e61b90ce27dcb88d71cfe491295a324bdd98d56f
SHA512fa6824797b6ff7c0495f2cf0e7dc8107c51368f71db187ca566850b6985f056c9298493160ba9895ce503edafd29273552ca3afc45c26def67165237e5a627eb
-
Filesize
5.2MB
MD597f5ee532e9ee1200c8905c3826f07f9
SHA10d9f268c0df60692ceb12241ce53558945d1f071
SHA256dc24b46ca8dba404278304811c3bd892e60a38ed82b83a93431d36ba753c512a
SHA512ed3f8cfb89541b2941e9f2b53403a3862de60f17d755f83c681593f40ab0c72d05edcec73b02c30d4e17d5dc599693f4aa2d8659a004ebdfb5978e9304a7fd05
-
Filesize
5.2MB
MD5ac228ea00ce8e4d8868841871e6766f3
SHA1933f73562f3d2dd681178907bc2eff9b94347ee4
SHA256928f4dc99f290f6aa4c4e15b812be9565b6fbefa31a099c854eff174fccda275
SHA51241e105a903f0b46ef882090e60fe39c211aca7b4e1bbec893dbc450493cba95db44eed6ed71efbcfe7da085e9a1c4e6dcb981704a57ee26c8c02680480058eed
-
Filesize
5.2MB
MD572313b8bbc528e67d97dc81e93c0764d
SHA1cdd7a13b0569bbd0c8d28bb4155ca410e0bcd167
SHA25625be290a97134934f79d85df47d4002ce63de07170caa73b70085bd387d9a7f1
SHA5126ffb3d4ebbcd95ecedb727c88f1719bd95309f42de18c643beb225a250af2b501785a8d1475a49554095e76c78c07f79a8896eafc8d400e2bb9dc6830230d0cb
-
Filesize
5.2MB
MD5d45866d8488389743cd061827b4f7684
SHA1a157b19bc4724f9932fe8fb335a546e7e72da987
SHA25699cddd3d154661d380ede05f8b9a66dd6ad33989f2527fa34ad2dd8d8673d064
SHA51287819bf7ccb5e3a0b34b0ccba244ed046ee656f94485a0bb9528f94e52c924852f721fec6eabc9597fbaed99746061f184c207ff0fd5bee8b2ff29f028980e33
-
Filesize
5.2MB
MD5facbd03a505e33429b2eddf769c4b54b
SHA1525b5ff123eb44895e4b643077a2c722319b6319
SHA2566034d4a5e83ce2c683ab8a72630e799524553622c734b51135d9b6d649fea344
SHA5127d3d181f6adf650157a920d823cd61d6ace3b28eb9cc8428a31d589713ef8bf7723643881bcdd675d54e2701773331f81c0d5a8cc8b709d104e809322d9499f0
-
Filesize
5.2MB
MD5970dfcf4848f67f784420a4b557074ad
SHA1c54dae6bace6d0c32864bb61b497b67747753548
SHA2568c4b568b82f5e972bc18aa1552d2ec55a8ed15a914f076cfe2e7b05b6d2a318d
SHA512d46a3e0a4e1ff07eb46207fce6b0df2eef8cd0e191603fa771cdbce562e46703ac86c73466af70580572f33b78aa208258fb4ef56bbf24cc1881fe024fe07732
-
Filesize
5.2MB
MD51ffcc824dffcd6e95642392df6336a51
SHA1c4c9c4c8da30b311202da8e6a82b6a1625a76bc7
SHA25629dedcbffcdc23ac5e5f06e9744a92ccece137709547fd20de60e3a52a330d15
SHA512412b7873a88753cb1be7a92a93b4ba1c3c222db447c7b834abb5c228612d371b68eafcdd2683d0872115dce7557d57221f0bb5e62f8b09e401ebe714718e0b9e
-
Filesize
5.2MB
MD5f129ad3f42ee964d209bf03d97137ccc
SHA1ba7c95282a0c5f60b22157b34d2e4ea2367cb227
SHA256051353e7fd882c3705d2e56701dc0be172d435c7dbfc241cf5ba861e658836e4
SHA512b6cca1cafbd4611fc5969888de91fdcba1ee4fd60ef1d8ffa2774365c93bc21d1d76a88b5ca55deaff92b74016f050ccf2fe64d106c09964c2fb7aad4d61a3da
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB