Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:45
General
-
Target
2024-09-20_5bd5361b69d7767d8f62c0c42a0af988_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
5bd5361b69d7767d8f62c0c42a0af988
-
SHA1
848cc3a3ab1cac39cfb9c2efc306f65af7e689fd
-
SHA256
5a46df71756294f25a91d709d89097ee0c13f460b1efaddb27f5cc292d1d456c
-
SHA512
6933dbf8d9d158e564c954e6b533d9bf7b896a7de9d9939a39d76879fc44e5cde9a6bdf069658fe3d9442f249bb215967d9113b8c5ef03ec825a4f85ec0215ab
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lU6:E+x56utgpPF8u/76
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 62 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 59 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_5bd5361b69d7767d8f62c0c42a0af988_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_5bd5361b69d7767d8f62c0c42a0af988_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gupotxb.exeC:\Windows\System\gupotxb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXyhIQx.exeC:\Windows\System\QXyhIQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SLauFVc.exeC:\Windows\System\SLauFVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpWwlMR.exeC:\Windows\System\GpWwlMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qywLsUK.exeC:\Windows\System\qywLsUK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwnJVgW.exeC:\Windows\System\XwnJVgW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHIWSMp.exeC:\Windows\System\rHIWSMp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quIIfjC.exeC:\Windows\System\quIIfjC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sPTdVry.exeC:\Windows\System\sPTdVry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PBDhWDv.exeC:\Windows\System\PBDhWDv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsQJrVP.exeC:\Windows\System\jsQJrVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FaszRtQ.exeC:\Windows\System\FaszRtQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PiLHTRX.exeC:\Windows\System\PiLHTRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nUNuIUN.exeC:\Windows\System\nUNuIUN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XcqWmZE.exeC:\Windows\System\XcqWmZE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PORjNpU.exeC:\Windows\System\PORjNpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jFClwzh.exeC:\Windows\System\jFClwzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SiKyHpz.exeC:\Windows\System\SiKyHpz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJeXYab.exeC:\Windows\System\uJeXYab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KOxlrdv.exeC:\Windows\System\KOxlrdv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruQluaa.exeC:\Windows\System\ruQluaa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5bf458a68b2825c336e904afad10bd3c5
SHA113672d952def907528c421376144c314b57de605
SHA256b838631594c16c74d802c39c5cd2fd76240e9d81f2e5b808e21de6210d06c7d5
SHA512444d0c993e56c992dda68ae41933db7247b411fa5e1f9168b59cfe448d561f545575d0b8945a0550d6b224ab821a208940a50b1655e341731c24431a901edfba
-
Filesize
5.9MB
MD5046c364f8e601f4389e0bf6d9fbb505a
SHA10d4a982cf0f6570dc10225abc5d0348fd73f50ae
SHA256b4c91e7ea1e5e5a7174dee02af057ff1eab33ef2a9db243fc719e1bf36e64ab6
SHA512580abf2275de29b1d59df67eb16c0dc04bd185048a2dadc166894776e63e5f6f83b0dc36e957eb0970efd7f07442bca1c9b1ea5d6ade6b2fdd48be1139245adc
-
Filesize
5.9MB
MD561430020b10e85e1ec48c26c8a93500b
SHA12b86b961938f0374386dfeb88dc2e47c6d4ecc31
SHA25664b5222a7b6ef9911c83b675abfa1be8f58e791a14209d21b1682e843dd13083
SHA51276a4f4ebc1ad02055571ddaffc865790d51a98381ce7e8ca5206829d36b0d0f2894879fe4bd6deb176014ccbbbf56bcd3d6549aafbf5f9b0fb67d2fc6dfa12b8
-
Filesize
5.9MB
MD547f8f9360d9dbd206f8d6873cd842630
SHA1d3467d8fe4d64b61bdb17c8232a550e5e164be7e
SHA25676bf16ac04d57152334f864531ee57cb2cb8bcb05b15c1aea23e848787eb9a5f
SHA512b68ff3b9010e08873395ca687d497e14e370568ed238f4bd5d425d14445f06f5260f445b6a8479ba860f53147b83a6a48546e728189d7e41edd6942581a4cc80
-
Filesize
5.9MB
MD5de92522ec8a175baba83fa34892047a7
SHA109d602c609cf671c9067d4a7c3d751baa3a11f8a
SHA256ae1b8555c422719d943bfaf458416146f3c0a7a5fc3eca77a3d20e60abf9fbca
SHA5121b388e753f7f747c70b6c72114511ec0905828bcdc16e80a68121aea97ea502c147e26a4233c8f198b1be4788093dce47c726b768a0532cbb9e9c5bc59261233
-
Filesize
5.9MB
MD5a6b0cb9e97becb54697d801722a7e105
SHA1395905dbf576e8c4904df43817603376fcee66ee
SHA25606683f0d5bc733c66c32540d15ae4e1f46aab4c263fcdff1a7e299357ed9a0d2
SHA5127e628759d3566039d58405b93e0cfcb13774f10fca55c1d56bcf97df54722dfe1491dab52b0b5ceae0aa11dc05c6b857b3f87c5928e17bfd8b393b43a9dd1645
-
Filesize
5.9MB
MD5f635546b47394bf400c03ae7a25fa74f
SHA18c0a9c281fe7c5940a3aa277684054c3cc3dbeb0
SHA2566e363040f632a0f0db4c0a35de383c9e2200f6da24462ff85a42f022cd14bd36
SHA512385e4345620766c81f3f16e31c697f8a18816f3489f10170dec1625716e4ca92af436f2772741278cddd1c5e148830eeb2d81af6046fbca40883a6820f018c24
-
Filesize
5.9MB
MD53bf9a3bd740017218c37b47db35f9684
SHA16e4e00c5064afbc2c17839f5064580d03fa7871b
SHA2566712f7252863a522e9ff2d2c1766a0ce77ec329a5bbedd064ee9f3d324f78d0e
SHA5128bd758060e2a3a031366e9257ce5d6e5888733eb5c5e3c05f9e46ffa6347abff087403c31405ea3e3478bcbd468916af126c6da6b230581cef73fe99839647bf
-
Filesize
5.9MB
MD502399c098fc9afd4ac740d75eb699952
SHA1bd07cfca90f88c9802017fbf67c6b4400d612fe6
SHA256f7cf7ff2a0e92666b8d5d8d768465497f88774394b5d525a9f83f1fd2b4ef1b6
SHA5123d5c07359928e0d6f336c5976efd3e4d108e28f9b45c7cd0acf7da55d49bb9b9d04cbcb8fd2aae7d5d8a512cecb2b769a0a36cd199eea6e5d8dc68f7b84c869b
-
Filesize
5.9MB
MD5ece66b3b73454119cd30c76afc278ca7
SHA127dc9dd4d14b98b4e9034c9104d3d23727573016
SHA256767e2b962d202b7842b929158e2afcba0d00b9f3fc92b96d7c11873015a00156
SHA512ec57fcb70afefd12e1aea138c79bb4d67dd68f5bb8522c050edb66e208bcdd898446a2d1e220dee8a96c5f4f76828a15cc997c20405a6ef5c9d7e1266cbe8e8a
-
Filesize
5.9MB
MD5853d554ba6c8f6227a53fddcfbd71a5d
SHA1c8cf3b7c7868b02b05179ec44b0e881f42065d06
SHA256da241c26bdebe8a7ebdc6df59402114950ca205f5073f1e51f578f44eaef302a
SHA512015a925e0071fccec6d1e1124c634adda5593b847593d5319e4d685d4559b45899f90ee0c5dd0229d9565022e14a7556f2f64c3cffe75e9396ee9edb4388d155
-
Filesize
5.9MB
MD5a2980e7a2b74f3eaf2ad6d8ece05345a
SHA1a8fd92559a7a169d6027bd4aa0db6b9c3fbf220f
SHA25678b754fccf9ce074f3822022172d176350ccf7e4ff8f5a5aebc3af7c30234318
SHA5120aaf2250eca057ceaef5ab36081111e4ddc84f52927350fce8e22737aedf57582c415d1a40ae1cf732b9a7fa30eeea4ace109b22721271eef878bb1111604b70
-
Filesize
5.9MB
MD58b4c862232711b0e7c04538bee355498
SHA1a28cbacf661056251561b8b95411a6bd93bc382b
SHA25699a7fcb086693bfea0fd553da20ff0c13ce54cc0972753a4f170165a22c8a2b3
SHA51288cef562bef97215806c025a9e267172a2c4d4e2b2b18ae0cff2379aad2328bcdee00fc7af1500ad6be46832ec26fa11ed81c646ca67d2ff23731248553346c4
-
Filesize
5.9MB
MD59d53aba5800c1f7504a72dc5f3e3b594
SHA1ab46f75ec8412e69412a9ef45c61d66ba2b993e4
SHA256b5450b2a66eb68e8f7b3565353f6249e03371e88c29521633c11803ca01cd392
SHA512674e0cf803f6e75b2d75886c93dcd145ab31e77b7fa710c2f0e3e707c0891e76653dc1f2d91f86127344b86ca5c2435d0297e66274db4c017cc60c652997f45f
-
Filesize
5.9MB
MD5ba928241142bbf82f2416d616eb490a5
SHA1de5979a1fabeb51a0bcc11d3f608dfc8d8b0faa7
SHA256cf4eb8490d5735e1874f89cf554a651606d12afdc155d93b5ffe76297ed4d15e
SHA512e615c9b621b7bdd57ee7673862a5498e2f9a60eef7d78784351f1eb29f25b0bd5da73d9d2830c98d90f12d0325ccd99c3e554bc1681d9f04d3d508cea690cd7d
-
Filesize
5.9MB
MD56e7261b7dd53c01b00a741316061f9a7
SHA14aefa6a1439427ef4b5d6574c111a9f7d9f57ffa
SHA2568d849dab29176ae5798e530dcb532c1e40dd3f887906c8c6bd3bb21c1d5c0114
SHA5127595f3fbcd477d672370833f8b249be48d4caff973e9fc1eb87193cffa4d5f9a431a60bc9ca593bd60228ebf45e45d0b367f59e3b3a2e80ed4006e7a7ffa49fb
-
Filesize
5.9MB
MD5f321d187518dbbc46931d8eabe43387c
SHA1d56e4fb135df4047a54b3b74b695faec7668fdf4
SHA25607557ff12680dbe48c1368ab427e3fc27b5f4615892862b0edf081918137b095
SHA512b556306dceb618f32b0bea6637d9b91be4f4ae74e23cdcc8564228c89016dc0b10fcb792fdf38e9dd846f78ba8c0bcd3db202752cfaf5ae59ed22b0289722aea
-
Filesize
5.9MB
MD5f7a584b124afac14d2e23552c1782846
SHA1740b2baa099d94a852d14d7e42e54e7278415d84
SHA256613f68fe5e89888350e869bef2c4055d1664fd5b8d3ec2ee2b75cf317b1bcb09
SHA51279bef5d1eb2ce311fea052c0930d26d8aea52e71061fa4caa8d4b62f23d213bb7da4a5817814abdb3ddf872851dda9cb9a28f0700f0809e591e161c5cf5d3030
-
Filesize
5.9MB
MD51ff91778fd65183d791eddf52c4b9e0c
SHA1d3c76572a4082c41a8c1bc5a19bcd73f74d323c5
SHA256e4a0b3b3538c386e3f6a64c648ac2f73f91fcea3a315eaaef67156483e4443dd
SHA512a11ea344775d542472d03ce51ca550ffa99b4b156a54752105f3d5c59ddd8723bc825effd32e8da29f05ecd1a11fb3f71398624ea58a26a6fa267d5ab750231b
-
Filesize
5.9MB
MD58823ce6a1007f70a192727fce3674a9f
SHA1a442e4d7237e03b296c21d11cafa6efee06ed106
SHA256018c85d11ec10ada5a4670a48d0645d75743b080a33912c37a87b8cb1bfed75e
SHA512a0f78a4112bc00829675388be0124f4cd73281a01f010308ce7a196d8d0c8256578944d87e353a8b2c859212b3f4411d893d565b03eb2aec8c0041c574c56f5b
-
Filesize
5.9MB
MD52f6a7a393daaff66c17284310d98d757
SHA16b3c7859443e77f9b6885c11a886f040c8161813
SHA256a73268a8d95a57e2de4612fd932c3f534dd4cf83dc40add2ce2afadbe8fac714
SHA512c7b7c936dfcca46ebc3d88df7d1237ee270201ca8d64c0ef6b60aa5a39b2d272fdb5d878947238bf5f2ba2ea9b22a367987ddefb2650227e2b241dbb778a7627
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB