Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 01:49
General
-
Target
2024-09-20_d151b2ab20d0fbd2626c0df310e19145_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
d151b2ab20d0fbd2626c0df310e19145
-
SHA1
404a63f1e6c2711dcd11000e45d06e67ec467cb8
-
SHA256
4375fe9c33e6df35f7d55d7bf8daf5fd3b0ecea0217ef62ee439225c3a7cb30d
-
SHA512
3f3a5e5e0ca8d52f39ec2885ba45c7636a0a6969cdaee7693c76544a2d1bc5d7273837dae8b9c3a83b7de15b3e02e089c33ab256a22e46592f703c6f51086766
-
SSDEEP
98304:demTLkNdfE0pZ3s56utgpPFotBER/mQ32lUF:E+x56utgpPF8u/7F
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 49 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_d151b2ab20d0fbd2626c0df310e19145_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_d151b2ab20d0fbd2626c0df310e19145_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eMXXMqY.exeC:\Windows\System\eMXXMqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwjUUpJ.exeC:\Windows\System\TwjUUpJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ALeDyXT.exeC:\Windows\System\ALeDyXT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXTMxWO.exeC:\Windows\System\zXTMxWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQIOYub.exeC:\Windows\System\DQIOYub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPsrCan.exeC:\Windows\System\bPsrCan.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLwUPDv.exeC:\Windows\System\iLwUPDv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSmqtkw.exeC:\Windows\System\lSmqtkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zNMSuxQ.exeC:\Windows\System\zNMSuxQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZDCoKlM.exeC:\Windows\System\ZDCoKlM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yKrCmIH.exeC:\Windows\System\yKrCmIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cFjnHrC.exeC:\Windows\System\cFjnHrC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USfoWWO.exeC:\Windows\System\USfoWWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ahbtDJU.exeC:\Windows\System\ahbtDJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nSdvfnU.exeC:\Windows\System\nSdvfnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JfcKueL.exeC:\Windows\System\JfcKueL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEBPmoD.exeC:\Windows\System\OEBPmoD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gbLblAH.exeC:\Windows\System\gbLblAH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tNTYSDs.exeC:\Windows\System\tNTYSDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TajMxml.exeC:\Windows\System\TajMxml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PhIRZBl.exeC:\Windows\System\PhIRZBl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c963d399019c1cc1f69e2521bd3b1a00
SHA1314ae2049011e7c688d2014fe0852686fc487d1b
SHA2569474795a6e124348e34bd03119c90d5e4e1077a554159d07de6f757e4f5b3f69
SHA512c4e863d042b1690b03ac738d1367f902b949edbc92f94e69da2d0aab32914f839ceb05808c2a1a94dcd694a2715acad15fab4abc1c4d2459152a51fa26016ddd
-
Filesize
5.9MB
MD55a6cd179ba1595bb7189227e8bd5299c
SHA1833c56b3050ef0f3e7f87bc63210005a92930b4e
SHA2563fc49d38d94ace5af2dc1504a034cf6a38d7918c63d2d33f8d634a4fd0c938e9
SHA5127d2e3623a9efd4acd8ebd3d4f9e35a619c18c6232dfa01550fd2ca949c9a8257d65e82a73bd600ab3fdd33324ec4de7bd8653811008d7a13e70da401737841b9
-
Filesize
5.9MB
MD5f8770fc3adbb469b37dfa83614ad218a
SHA1ed0abcc60f2962e894956288e65774de3bc27bbe
SHA256e6a57e7ffce5691af6b705e616ed4011c4019bec11f7514492ccd77ad1629d84
SHA512d1427a2c6ebc088480c117d313684cb2742041ff1e6bbf6d2978893a4dbecfefe2e9bba057a2342a956ad4c08fc6e99ee37aa161f4dabe8b9a29ecd57ce30310
-
Filesize
5.9MB
MD59da4dce8db28191eac88ce3ccf996492
SHA1aac9caf8387022bf5db9c81e75ad20ec947e9112
SHA2561bdbbea13e5cd65a6f99cd4f50ece75f9daefcc05cd82dff52ce6d69cac913a9
SHA51225d32aeeae432a072a69a9ec49a2b6fb6c0f43c6e2207a374847bac1f1a6332d28bc225f6e0c4ad669af6f7c6d5fcf184c6aad5f3825edaf64ce4d776e5bd07d
-
Filesize
5.9MB
MD598df278a5cf865188db0ffdf9f382ef5
SHA1829fe1e8c90154cb7615eda8dcace15c3cb5d00b
SHA256fa753637f7ab385f91cc21730c16535f5afde9f89caf87c926ced5cb25495fe0
SHA5127813b456e9f593084875c4b675de80b8942d796819018b220ab25fccdbf7092e43605bd6b0dc7f48d1821a4f0bb07e6e2eef1d04068eec6f77acad256e54faaa
-
Filesize
5.9MB
MD51db6ce91c49f86601b972f41b67e5d60
SHA199aa0081110b4c783b9e4e4a9c903342c17aeb04
SHA256312def35aa12ed2cd49175465fb7b8584fdb90dc0033b4d728d3ce21127b6015
SHA512fb3d6e2b51d6efb3d2b06739ba5e438a21c829ebcdaf2cdad4b3b319690a058c815f4108b3e9891fe0ec69c4c5b30531681b459ccc75f6e94b1c1401b3bf2be7
-
Filesize
5.9MB
MD52f539afd1cca908509afdcd9220be0bb
SHA1e58d6bcca3e20f197187965c4bde1934147a0330
SHA2563d05d0b7436b44118f07c194f9f7bf1e59349a26b7ca2c5fb9f79db7a952b43d
SHA5122e8335c88d15635582388b5350e2cf76d3c83872a484e411aca98b54326e57a4086c920e8da578c39bd97b469a8ffaf8bb30ec427644cd831dea2157e1a1376a
-
Filesize
5.9MB
MD540c1ecc34286cf9eee3b98261163f8a4
SHA19869761fbc08b42a95da125d20fad9f51a264d9c
SHA2568aa7c67f199463cddb11ccdb60a3902c692f131e27814e168e68084a1bcc6376
SHA5129fa53589e94d7fb0945bbe3d1a1ec8dccdd4fac1cb5f70a13fa8eb8d7a95a7dda6b89985d1f06003825ea5c70e6c5f3915fb1c4f5893d8cad46e80af8ee633ad
-
Filesize
5.9MB
MD5a5965b8825e8de37d1920277ef3804a3
SHA17b6aacd65ab6815b74c0486fb35177a1d39c003e
SHA2566b8d56871e398c97a4f5177c91805a5cbf8b6084f88892c9ba24594b037f639d
SHA5122ac75bde06c88f84076a835982a7514031bd96bbbd66a1d5ac2fa858466a117d63afccae11e0b4eb7de54cbd4488e38610883316ef79aeb7ed70790633cb8be6
-
Filesize
5.9MB
MD5b66c1f76573fcfc475eb09f4485d0316
SHA188239627680ca662524336eed6e90ae3ef30f2c8
SHA256fce6eb210bcdd018176af0fbdb10b675d5df41fa7b1a76d84fc6d91c37aaf25f
SHA51256e814e5ebeb9858c61e8cade7548e642396e28e3d5d793904a64e12ddb63aa7401d9066fda84ba451dd16b98feff4ef2f413c07bedb1b81f818844cd9ca55e1
-
Filesize
5.9MB
MD5e7f72751b27be7ea5eebe80d823d0842
SHA144531f75a9a2451f7528d63bb4887c4249a6bdc4
SHA25669e6147732542cd85c1f5d9a9c3ab88afc6f5419ea52a755f8c0b9c9f34d6f5a
SHA5128fff2f7c6b0c8978f5ad510106502d618398e59c8e9e0a8d434c9f39e4854d3b1b403bd48cd319a19339d13f61a9dbf8fe1f1ee936516616bfac414a7775864b
-
Filesize
5.9MB
MD54d73bf8e0416b4581bed7415c8067444
SHA1bd867cdc932b0a1805e9c252b242512fc5d69884
SHA256245bf550087277fe5c93f110d831cb06e0a47d85e4c21bc4199f60944b8d75a1
SHA51277e08d096e6bb223fcb59d31e93fd2c7f8a450297e2a82ca981dba5ba5b7bcccb94afc292efeca057a50480ce798e32a6cdc79d4b3329436ca6586b019c98418
-
Filesize
5.9MB
MD5aa0b680ed93677a8743170ae12ef96c5
SHA1351b9a90cdf9eb54981f5e76e47a2f8991ee0462
SHA25608815d8e2d6da933c34cb28ff4bdf228a1923334795fadb871ffbd2b338b4d61
SHA5123da12e28938a54d99fe2eae02c05d5df13a0efe2bc45dfece7b0c6639f1fe170efc4741916dd57d38e52289e73a62f6746add9423533de01dff815db1a3bd3d4
-
Filesize
5.9MB
MD5a30143e76b37c8c1c7de9e5861842b50
SHA11af664e63d1118de4abc040ad0d9e33b6bbe9a88
SHA2560e3190c5450bb4e0ab40a40e5d3868497babaded4b0ce8fa1ce8212bbacfd8a4
SHA5123cce291ad8f59fb586a02cbfaa8f73b86067c4049c08c2f20053b2f6711115c65ec7ad6815eefc65798ad2b0851dcbff1d6c1ed69b7cbdb4fd5f135a9c5c90ce
-
Filesize
5.9MB
MD545f2950da0079c4f7a93e161cf8fbce4
SHA184e2da1f00ea293d9a56acd6819096872b7ae2ef
SHA2563a960f11fa51cb3d4066609e98e7634d6940f8148ccd9ddb81dfe0aeb25f9eeb
SHA51260ce47243c614fd2a90910c2c125a27e834b642c10191e640c79688a6d82882a96b4685240bf24963c939b01855c00662fa37d32812cb04f02e0143144d02d04
-
Filesize
5.9MB
MD568fd4d26d43b26d39b31a27f4f7d334b
SHA199cca500af4c2bed20be2cfab904d8118bad6bc6
SHA256097d2b3137da886930012bb218818f776e94a38199da84bcad7079f902631e09
SHA512b61cb5eb5d8b197d1c13044356d5dc7906c22aefa11aef3f9158e41f2abefd8d39c842303809841a7bf124303cdc3171e62eb0b7a4d411fd54e22b9e50886252
-
Filesize
5.9MB
MD542f793332fbf40820a84ad6e05d01301
SHA14898a4e00a2be834116e510e58911120a2373728
SHA256f11a46a050016d1c31d24e466414dbeb555babb44de872d16f9b2b63d46687c3
SHA5123e00f77f9210c6dbb3a54b09d72ebecb4aa058b73c90dfc9fa3e7e9c1b1839b9b319b32bf7bc4884dc6071b97cab62fe29d1a255867d153b5b7ea68132adec7c
-
Filesize
5.9MB
MD50b877a2df2dc9c2fc94aa9a38c5ccd93
SHA16b57b247e47abaabbe2f32fb1d6091f76383d7cd
SHA2560b4bf04fa88d972a50cc15a444b97b67e3cd1493fad9a56fa0f360fe23989a2b
SHA5129e62654a3c178624b8b3c616f2706595a1e78e6d18d07a6c0b4b7cc95e5a9af53da65cdb737162d568c94d2440d5b56db217018e88e3f77834d0ee9b9f53fe87
-
Filesize
5.9MB
MD5dd2ab40768ed2e7d6bb6e3df3a9255e6
SHA17bdc60d77292a9f28435e38a4a48340585bd6713
SHA25690a27c49ee3e326e06a3f882ae484ba45f537534c23500d91b7f0343f2510e8b
SHA5125497db1f2a44bd603eec26a0f6d175b8e092fb1d0bbe39d041b08d71654dedcddf945cab9eac6eaaa557b56026a5a408236768e3dc505a327407be738dde0b18
-
Filesize
5.9MB
MD5f51195a82128741a442d692183c091e1
SHA18ea4a99143128af9362edda4290ee4d78bc8b459
SHA256037856201b74bcad4a3f60091d886511090db1f6de1d4c1595758da9958ed756
SHA512813af24971cb9721f99f1eb27551dfbe042743d0fd61436a3288b370d798a475e37fd80ac57e48b6990e29423e0169345ea38632b62a6f4956c03fed6600151b
-
Filesize
5.9MB
MD5ecf272bdcc5c663f914433323de88797
SHA1e27ddb3d433bf4f1351316b757232ccc296682b6
SHA256c1b2c5ea78d435bcc38c06e0b43793a954727befd5e802939df71224f6997da2
SHA512a806c687e687d42d3cd290da21e677691e629d9270e8b0f07ffb6682c9af6a2bbbaabcc8f40f353b4b7f47bf6d78c80f0ae7e083cd20a82e876e38b1b1a983b5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB