Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:44
General
-
Target
2024-09-20_4fcb779ddeefb35c9ab278d6a25892aa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4fcb779ddeefb35c9ab278d6a25892aa
-
SHA1
09c01e81ea8b302e458a798e23f12f4e740098ba
-
SHA256
4bdff4439a0dfcd105c0401c7647c2222fac29f18eb71ddc2f920c3661b5bf28
-
SHA512
87d3d56dd2d235d01504cf022d16cdbd366c06195057de7505d1d0a8832652636cc88b505679d4f837d68ad3cb2a11d5a74fc29a0018aa43e672240951abe7e9
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUC:E+x56utgpPF8u/7C
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_4fcb779ddeefb35c9ab278d6a25892aa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_4fcb779ddeefb35c9ab278d6a25892aa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WEnRDdD.exeC:\Windows\System\WEnRDdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzQybPB.exeC:\Windows\System\SzQybPB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMmtHdp.exeC:\Windows\System\kMmtHdp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URYIFyL.exeC:\Windows\System\URYIFyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CYswxHE.exeC:\Windows\System\CYswxHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qqJMenu.exeC:\Windows\System\qqJMenu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\htjfPJW.exeC:\Windows\System\htjfPJW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pLAiKOY.exeC:\Windows\System\pLAiKOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbQFoet.exeC:\Windows\System\dbQFoet.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jdiZvEf.exeC:\Windows\System\jdiZvEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fAXiKMs.exeC:\Windows\System\fAXiKMs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DzuOyZa.exeC:\Windows\System\DzuOyZa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vZqoQrv.exeC:\Windows\System\vZqoQrv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axvUYSF.exeC:\Windows\System\axvUYSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhGXSLU.exeC:\Windows\System\VhGXSLU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WBpyUMT.exeC:\Windows\System\WBpyUMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMIrimi.exeC:\Windows\System\vMIrimi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IgBluYg.exeC:\Windows\System\IgBluYg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atdDjIX.exeC:\Windows\System\atdDjIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pyBodic.exeC:\Windows\System\pyBodic.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEiVcKY.exeC:\Windows\System\fEiVcKY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b0a7863180c9ab2285ba399fc309ef5a
SHA19c5c43f6b6b89d370e355e6e17921ba21ab1eda0
SHA2564b7056da95e16ea24e29eb31c6a12bf7c088e486369e179807ffc1d42daae1a0
SHA5127e560ba0040f7cd4cef246c352566af0047e01df8895cf8db1437a6e755f5258a045aae6bcab70c110545fdbff85470265b5af44b6264a4c8d5b97b9b62838ed
-
Filesize
5.9MB
MD5962fd45c88685d19f44e5d35c19c8b8d
SHA17d4a700d02683372f87bd08abb1bc1b1fe919a8d
SHA2561adb9cc8335dd141f1dc6b7fcf745700472ab2c899fce501611d137367eaa9af
SHA5129583383bfe08dac6356f24d301e2bf59515fbd3535f3af653277fd6c5f3b9647afc5599f1d0bd6ec241558bd4a0fbd72e91f7a0d6e69f3ff1807aead8668831e
-
Filesize
5.9MB
MD57ae6bc7abebc9dcef06510c7bc6216e9
SHA1cf430038809d1d2b29ba97d1df9bf5980c6cc2ee
SHA256d137d45c207ce49aea5a8918ecab3546f313480de50ef8b760549fb05b2a52ce
SHA512ad4bd5ba8e5a247772903ad8ee8a69891b9b6439fc4739183b88367a3ec8854867ae310f53ce4ccd619cbca279ab786cabee686fe095e58dfc528f8cfdd5ba27
-
Filesize
5.9MB
MD5f50f0af235de9b2e117979f2032b5725
SHA1945b7afe67b1f39b8cb6ae6b430299e95a0c933f
SHA256504f57f8dbeff7d283d4bb4a41bf2463ae95e9349d0de14c1fd4ea1ccd8b2a4d
SHA51202f818e8fe6428bf75f09d6c5f0e89f3178432579118b9307481a58f597174b0a4ccf462e85d97bea745f225057b0d7e3b7af550a25b859560e0ecff100714d8
-
Filesize
5.9MB
MD5a45dba2b18fb3f316764eefd6946000d
SHA107111d91f3ab58a6a1e37628185d5ae662d96ebb
SHA256ba76769e15b402ec6e45bcf88049ede54c643d6ace74edbca29b2b0d7a792469
SHA512382ca2b1a3436824003ff3a7806c4e1b90332a976882bca30577bc3decc0136c4be905ca88cf464b75dded4f8acd737f8c8c1137421b3ef527795d2b03a3e3f5
-
Filesize
5.9MB
MD566828a2d7c0bed83db5b6f4ad59a78fa
SHA19dc099f19e913b57f89eaebfbe820ed115305c84
SHA25616b034cbc2de74a935d762cecc1bc09c3952a6fe00afb897c721be184c85b50f
SHA51293b6bbe511632f8a2dc277b616ceeeb94ffe601a75ae84705e83b9acef18a2318ac3c6329abd2f0013001e87819e9ca29f31117efc1f762dd3d10a74060730fc
-
Filesize
5.9MB
MD5e59bf98b077a203b3227d0fd462fc982
SHA19a10bb598b06f808461d254a5a6fc405ae4d8dcc
SHA256556fb2f48960349fdee668a46e95e0bba2bfacc58e4683e8bee9a1db7eb2cf5e
SHA512180eca9a210158cc77f30c59841ab6187ea21f20224249400193e4f3e8240203474f0ccbd27830e54afcd1cec48391c490011b4023d2bf9a767644dc38c6a07c
-
Filesize
5.9MB
MD5598c35a4c18c7ba5bf51a2a3ea64e5e9
SHA138d7e61bdfe7c72116b6b9e47f9f0dfff12ac95e
SHA256d2c9e4e4a63c24015a0af03425ed196ecaa050b298d4f1126860a626f6dc1a19
SHA512ae3e37d6ef8f04b32c1310230a9e98306500c081724dc7358b974c30b307b4c9e9416bc92059c2493a94a90c21b389a17a501ffebc85ac673a4eb0531a7b26ee
-
Filesize
5.9MB
MD5bd63a8b71647e0f83330c35dc1b220e1
SHA10bb81bde56c689d2d1de4fc96d6241adab255059
SHA256354eb3c0a0d84b2aa43f2765dec3bbc0133ec293995e2a1f80fdc3c1f64484e8
SHA512cc08d3f045efaf917f0035df1910ca21545d9d21c0dd361340b6e96d3c768692bccbf0bfe47ae8446187c085b0b31bc989b5db6d089384a6105d36c44beb872a
-
Filesize
5.9MB
MD56b14ba9aa7a02e9469891a324463bbe8
SHA165df6fe2d99625dc6bcb047e620f74179a13730f
SHA256bc64978704e1b6b41b1f8c13e8c4246c7a2f9e3136c7cc453ce0f95b386aa63a
SHA51271f1a8a40381c9a036ea29bf518abe763623a972cf885c9dd6f753c9a0f0435631a50f998d0f45087f7df955323cb3ed827f52da898308419761516a3a97b2d4
-
Filesize
5.9MB
MD532372ca6f7c35242e4f493bd7ee2f110
SHA16ae4a1561fdb6cc5cc8231bc48332cbd23b21eb8
SHA2560de281f5d0d9bcabfc6d414e45803fa6f0f583be1a24d617abe81920f0939e0a
SHA5122724727cdeffc3cd7f9027b62a2261cdaa0e50378324b198c5ba26cbb6687adf6f2a4926e1cd4907e3c38bee3e51c0b50a5d441c5511da774937b5cbde9fbd9b
-
Filesize
5.9MB
MD5a8fe3cc18d41af52d63a775471fe6eaa
SHA1d3440fd53037ec2959f71e781895a71f095fb052
SHA256995e141d063a458cd925f7bed0837e32ef10e836335d296b9e3ef1287e79e1ff
SHA512d01fd83366aa821762ca0f1da4676808fe3b24b2ebde1d030701bacda5a851f35517d287a603fa487f70c92e4ec7ca12e90550a1275a563ec3c8493869a4cd84
-
Filesize
5.9MB
MD56bdad049c7118e27c574e0b6cd489576
SHA14e1c1f18f75b1afcc4372acaafa92f55cb9db6c6
SHA2564284f260699530f17f4618f6a4370ccf74496b65b920357ac34ed1b75bcc14eb
SHA512fd4a245ed5201d2fb5748647030197f0a9c95ae55a847fbbcff2ef9b7a3e01d4d66a3962d5c734699bca2ff5f16ad2e5864dadedca0e3c1bd5c6a463346f90bb
-
Filesize
5.9MB
MD5fdef142894b6d79897ee96b6da403ccf
SHA13c18a3e7465dec5c742d4ab1c4f1a0cb8618039b
SHA2565da9f94e1343010b95cac7cd5108e53c6235278b25f0972afda726e49a436d49
SHA512fba86bbca4f44bc37d32e7933ce47d114778cb5a671baa705cd74b1a00db242af8c0ba694ef30c2cc66f057664c0bc3269704bb6a61b159a556d0ffa35fb25b3
-
Filesize
5.9MB
MD537dfff7e34effaed90e5f1ddb7aae9b2
SHA1ca06836374b9e6346acb6c702227727494a15c05
SHA2567183284dbf200b37ac70b7496727ee4bc5d549943c1444e59175e8132d5e1f58
SHA512b9f569e379122610f394337d68a183061f62034361cee521c23c557e85944b58a4b0660e4cfada5d13ef2f0296de776d7ebc9e1321190d2655c1dbc36e7dedf6
-
Filesize
5.9MB
MD53e7b727e2dadb3d273bee15dd823ab3e
SHA1f5e57ca2b6aa4d89f5311f5dd7b10dd33d25eab0
SHA25660393ce7e27d4a7f084552e8bd4196e4a1c2239a0e5746aedc456c972565b1bc
SHA5120aa9799fb185fea25fe6c1fd6ac94113a2afff4285289fb19e67c7ef41f091fa1f8a60ce3b21c2247f72adef79988f0160508dfedae79a7a07f40fcdf27a0850
-
Filesize
5.9MB
MD5828c5f1fbb3d863764d6dc7ab2093441
SHA1c9e276ee807b19e838c3173f25ac5204e4fbcba4
SHA2563c3d3330dbdcf4e94eb5fef575bb712a5d65ebe896b20a325cddb723be849cfa
SHA512103724159032538a7d78cf963dbe7f58139e3de8e2fb086a970bfaa010cc9be21ff2e598fab85c84bdb7429c83b1e68501d4af49c4a2bf1e0279cfe0d3c951e6
-
Filesize
5.9MB
MD5b68e71e93304b5dcd08263a65b62a393
SHA1c35c1df1ee184a9b5a41e4173a43deece4e55a7c
SHA256f1375117abf4116c9457e06e387bea9d1f6a547743d7273062c0d6f492bf45ff
SHA51280cea74d92f6a4dca18063523917efb8af332b1f73db83bef98284600b52e6a038413a6e4800c45af100bea60508ed2c2457e07d1e70717707ab928f53db5699
-
Filesize
5.9MB
MD5b7ea0e233e1ae36e32cfef6039fcf0d2
SHA179d0932885aa9cd35e8546773fed7b5975274df1
SHA25625adc1339131a54a4017edacb7ecb5abbe88208a4a260e23bae4da71c503e23d
SHA512fb5fcb0eb3223808b78ea4498dfccef63d1413527097341dd5e9c0d0b1795c7d7b0969eca431f947b306a46efc5c5b365bbc5e1fb7af035db49df8bb37551711
-
Filesize
5.9MB
MD52ede63cf28e6a6f5937a2c4f3ba3b88b
SHA14b221e0ac8a216d105de275aa755465a5b13b37e
SHA2565c24195a9f93f2d10394a008af2d493030bcf4a6dd9875653eef1f6865f5efd3
SHA512266044a465d0bc120c433c555be2604c6fabf66c1b3b3cbac296f700923e74658d6ec9c99044a7fc425cd86f880a8dcf2d4db0bb7265bb5c7c5d9156bd050e67
-
Filesize
5.9MB
MD50fc1e1b6a0e165f3574018edf3f20ec7
SHA1aa9a4fba56c79ac3464c48c72d9cf1253827c6c8
SHA256d1e1a8c4fa71408ea916aaa70e483cf609ac5ed27b7fe033ffa7cbda0bf4d674
SHA51228f26ba54969137e8e58d88e2fc9acb7b722c1af0d533e864c71f2a2d5d5759d08c65bf26002e51df02d72a1d19a9fad6fd61b5d6670621c2bf3eba858b366d5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB