Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 22:01
General
-
Target
2024-09-20_db15583d1d14a37c4b3adb1413673bdd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
db15583d1d14a37c4b3adb1413673bdd
-
SHA1
f5104a8ac7c60d4f718cb554dc3f5a64b82fcc8e
-
SHA256
c75f244fc806c5b64083ce10e1f33e9f1e54435f9548677b9b07ade9bb8c5c21
-
SHA512
b99a32d3e929cc8a19e882632080bd16687b167b3adab031e4afacdfb4476fe846601e93c9bb2eb510d8a2f34da32208c21d458c5455819fa87d85b2594e963d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_db15583d1d14a37c4b3adb1413673bdd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_db15583d1d14a37c4b3adb1413673bdd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\veHeQqn.exeC:\Windows\System\veHeQqn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OkLqklz.exeC:\Windows\System\OkLqklz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HrjnvMa.exeC:\Windows\System\HrjnvMa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsGvZIY.exeC:\Windows\System\dsGvZIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qvhroCX.exeC:\Windows\System\qvhroCX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZwBZwVt.exeC:\Windows\System\ZwBZwVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZEMRIp.exeC:\Windows\System\nZEMRIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMekosL.exeC:\Windows\System\kMekosL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pVrcdQW.exeC:\Windows\System\pVrcdQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izGoIHu.exeC:\Windows\System\izGoIHu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PAFbfjF.exeC:\Windows\System\PAFbfjF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZfQnbe.exeC:\Windows\System\qZfQnbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdzFHdy.exeC:\Windows\System\MdzFHdy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRTFVqq.exeC:\Windows\System\YRTFVqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jlvAwBq.exeC:\Windows\System\jlvAwBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KqbNFbo.exeC:\Windows\System\KqbNFbo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHNErTl.exeC:\Windows\System\VHNErTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WAMSefE.exeC:\Windows\System\WAMSefE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KxNWtca.exeC:\Windows\System\KxNWtca.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuoPdyB.exeC:\Windows\System\AuoPdyB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqpUsJN.exeC:\Windows\System\nqpUsJN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD549f4bc992572f1d0b20ed62ef4e157d2
SHA1e4dcf571e7fe66b4273b5271085af3a15e0bb634
SHA25654a56a9608c23b6faad052988c22055e2891697f5ce3e1229be7128f6b9f0c8d
SHA5127e983037eecff53f22599e0e7ec0e33b145d8a2bc0cc7c78dcec231672abb232726c176fb2bdaec7635f007f7c36c1065b3c7fb983ded40fb11845f8be617e50
-
Filesize
5.2MB
MD5532959d828f308862104f1076f9aae95
SHA12c7c27f3399eb37d29382c58b1b58b3ebcfdd9c8
SHA25678d7bf7fe4e0ca3f7847079dbe04f69f3ab8cec1f55aca5967d920768d32aa8b
SHA5120f7fdd6860c48c9dbd8a656b641ec914928018d2c8d69c634019d1e459b96d011337cf4b884c1b796925157fefd9ce6af0bb1ee26891d74dd7d66d763a7bb830
-
Filesize
5.2MB
MD58a7b82d410b7a1104f389f98282b012f
SHA10562b9fd47b6138d8b95cc6407842a27cdb0461c
SHA256a2c80fe1b1d4fa9d74f6e4caaf79e498f968ce4979171c1c4131a0813b42e6e7
SHA5125c10f7607ba49f5ace8e52e6105603650e20de9dbf30b6be83672bfcbeac0bfc3ba8d030d91512c2a747751ac96f4736fd20507c6c41ebfb35bce0c982755425
-
Filesize
5.2MB
MD568eefb083fa50cbefe9a511ee3b37047
SHA1418abf9c1f1fc1bde1068463e2c2976748a9acea
SHA2565d2876ca511adca15420d2fc6a140f0e19c8df4bbe08b282394879d80bb83be6
SHA5123dfafd18bbc7071187559acad7f8a433e73011d2105c60774f8468333c6297be26b11cd233b810726ccb6bfbfec2b3e609982d53aae988d5c5dce359a821e712
-
Filesize
5.2MB
MD5fc43a67eeebedf805982b1b6a6877d0d
SHA13c06b90dc290c71e5d690f200e9b3cca6b8a77de
SHA2568a8823d3362c67b49bd1be6e287c57e0a9c2945a1d63f56ba3b94f03b050545c
SHA512fefcdd0b76f44d64340e1adf0b0f0094c8437a0c40b792e16a818c980896eb16cb62f566e27f80e35aa4c15f544e217014d92dc7d458d2c28702ad0aef2310e8
-
Filesize
5.2MB
MD512f92c7e2f902dee2fb6bb6268a1a67e
SHA18578a684e4a4d27b6c5a0701ff1d79edda6fd7d6
SHA256e130f20f7b597d05a26133d79c0e066b9b900dd0c08545bffcd55e507ccf0e54
SHA5120603518569d7c8680f81d6bf0381fd4e7e0ca07c14693bd509ab106b31b108b44b3c633e6271b95d96d45b5ab8d6277f346b0f75609b961c54f4d08b345f75fe
-
Filesize
5.2MB
MD5a559c6679657527f4b58311274e0f7c2
SHA105e2b554f39dffa57c90f1ea80e2df862bb04909
SHA2562ba93f959771d31e86bb0f4b926efb989f8485ef0c4dd4f620806b2f751f2213
SHA51219f35593d54405ff73f2eacabb3732ff0fb159356f4e16f7ff53d890035b643581847fe6cb1313a0ee47bfcd72cd0df510ec6d5d7d78ecc1ee93cdf186a9a14a
-
Filesize
5.2MB
MD55289fa3436c76a19f698e08d3f15bb42
SHA1ae83db94939fcc62dbc1fcd6f91afaa8ef2ee5f4
SHA256d5cbaddd4a5a1634263bd06c0171e2c8fb11d5d04d9a87a1e2c463b1c3f69021
SHA51280d6caad51217772684ca15333909d2254aac66a56053c374171a99005b0cf9196add40cff94c2da83e87c35cb78177bd6554951333e1478825a2c5a1f730451
-
Filesize
5.2MB
MD59b235de42b1d7d23f35f5a068fc88d31
SHA18572c9ad4cca0df332d6797edf8dc8c68756e67b
SHA2569c2af3e98e9267cf1a9de690f30c143815a27f6e7c5b170d3b0e1dbbc1f37c9c
SHA51257b342e696f1ee712f381e1132c299c714a41e6631a015a393ef492df178e1cbe6695c62c390362dbfd87b3287d500c6a211e976559ebe3a48cfa87dc01f2518
-
Filesize
5.2MB
MD501d8cfb8a107e6b7333c9254fa7a0e20
SHA1584180acd26f438ad9748091437d405b0a8941ba
SHA2567bb9a8ce6c553e33e1d4ffdcb08c5c32f4acba9422330c8dd185012f6bd6e299
SHA512df24d7ac2c9afd5b7f5bc8355f3480a27a84e2b9a4368e0c0c492582c66faf959f3690e21eeb808d23f2a330abd87d05eae635b1041d339c70ff1ad70bb59fe1
-
Filesize
5.2MB
MD5afb9c16c72cbd99ebd24d749aa576f22
SHA1ef1a2bdd1d4f32325d3a35a2b9525bbf3306ca04
SHA2563185a94cb2106eebc656cbe48e3e49e9f709524a67f6e71930a3fe13118170d2
SHA5127c138e2ac388f591f0692db2cd9fa7494b5b12a9e7dc72176b1fda7c75d05b198e4b74dd98c11f8bcab0bf6738f1fd7651dc1d559f20871f9d5a30d1e2b112d0
-
Filesize
5.2MB
MD5b7ac295e78e2a530a5a454e16d80d48a
SHA1d88991c473265b8764ae3123d766d0d5dd855132
SHA2560c700ba3bf160de91123618b1cfabbd91154ba25c48a23f44f86619e54a1a344
SHA5123a0ba382a9a55ce8ef8cd98c33df8b6c4e31f495f9d9de86e0878914e0e893ce4b1a12d594405e836efde9e7b384f23f6eeacadbcf74166156a0750c434def5b
-
Filesize
5.2MB
MD5ad198ee193327a95da9106749898cbcd
SHA1cb9e7a4feeaf4223406669105ab645bdacdd6f34
SHA2561f87b0f52f5a7a2d4d7f6cbf474c04eab1be4d3b6eebcd9dd346a7cc160b7529
SHA51285b6641091dbf9da1e98d215e5936f6ba3aea7065034e6fe39516a7742ae45c143f069212c33bb917d7504cc31d73bfef2eaad0e489902ca2aaa53c5b483908f
-
Filesize
5.2MB
MD59ae97f00c4f281acb93ae3fdadd001d2
SHA1d9e687c04f133f5729a1dac56f5c4df386ff05b8
SHA25689c07bcbd2952c509744d22532a2829178b2cd2797f2da5070eab526382f7ede
SHA5121c600374368458151521cd13c758a1c4deaec6915cc321fe0501f4666d4c21bd6ec41621e9bb7ee521de1b4103cbae494922290947d8fffe3c22b5422bafce2d
-
Filesize
5.2MB
MD5d74d3f249a7557bc27282a93667f4d7a
SHA162f64f201110ec6ae584be17c64fc81e4af46c98
SHA2568d87843b02df9c0dba7f7f8195bb7312dbb9782111f175d3a420cfac5dcea129
SHA512e56f308110fdcaeb2cbf5b2be54f0bd61ffe3a01240026906f9cbf9c2121e6b98ac55c8f1882f98f2224accbebbb6304b678fd0cd27d11dea6f5da27a4f53516
-
Filesize
5.2MB
MD53ec4c7228b6e44527287891f024ae0e3
SHA15fca37501339cd517bef16ff4efe446b923abebf
SHA2565ae60423e76565c7afbaeb4e7e07eaa6d1815cac1d2e433faa66b230143758f7
SHA512d3d682462b01691d2ae98edf820cec14cfc4100f0ca8b507f6ceff3c532cfd303d4288ff7ef8aa5143a71d33396545712a985ac2452735ccc80502a5d21a8f69
-
Filesize
5.2MB
MD521cd96957f1d6cc36903ba46f56c60c6
SHA194bb043f5d26f13b7ee6a0fc9453229f0bc4139c
SHA256408cc400be4475ba5e4923bb4a9f13075a45efb84f7a3b458fce86d99a5694cc
SHA512e75a580ec36369205a196b855642f641ab00b362600cbe12a7a2d6b93b50251b61d6fb466e2fe151f3f9d974257825e9342ba434b009bd6ce05269bf17105f24
-
Filesize
5.2MB
MD5b466b94413232c9c81729c53fafedf6e
SHA17ae067fdcb8b94e14a77ab881c73df1c67937e9e
SHA2562802daffea2a4e85af3d4e4c36e2aa9cbe505ba94e4b128df193f32d99d2f5a6
SHA512c4cf01fd1c7ae4baff8e72f93db11ddeb8e5aa130cc2ea71fb654d2476a7ade9cea036a7992b471b3e262ab50f147a9e5898d82aad62ba34e5bfd5ace6b07fd4
-
Filesize
5.2MB
MD5c3049a2ba3370f904688afd2c90bd8e7
SHA143f7685cfb2532834ada3fb49b4f7ba1322b763a
SHA25679e3f0b3983cdddc7322e9f45b350c37023b617c31ceee60c46b69e3d602de71
SHA5124939d934f90810aaba983048d7b9949ceb95260c198bae5da17c00cb24062fa4a6403f5a27a90d3cba97eab3b51e0c37bfa5b9885040bd4ffb8ded76ea44ab52
-
Filesize
5.2MB
MD5a6659afe7f5748c66035275cf90eb684
SHA15232076b6aaf6b543b43d5b5ab069a4fe816d63d
SHA2569e3a2fc3cee3202ced4f949afe059e23acc9cdf22f7367c9bde5031a3c8e8cc7
SHA512b9fd0f09eed557e43e4de2b0e3df59d50482a45df01e7bc6e26cdb74b2a9f3400bd903e767b6851ac165ac1ad80c917e8771e7f2aaf5ed754500014d841e85c7
-
Filesize
5.2MB
MD5a69b1a64f4a68f028ed332f29c05e758
SHA16ecd4de4fdcbeba99ed9f2c720aaba282d0565a5
SHA25661cf4b032ab819a187e605de42b9a8a73ce43f5a689b797cd0a3cd3ff738567f
SHA51263a416c5a12f710816b1c1769a047f529e2d6aafd5690b0f027020bc0848b1da175a124a76c1df4e2dbdba529e50208362d2c4da427e818429bfb397b6f21616
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB