Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:54
General
-
Target
2024-09-20_6f1fdf49960393610b5282359ed112b6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6f1fdf49960393610b5282359ed112b6
-
SHA1
e07528f88d859c54a7649e3f7e81dc0b8ba4ff82
-
SHA256
78a9f6a986f8128360441ab0efedce232fda5855a17e114062d65d5daa62df7b
-
SHA512
0abe4e0e3b0df2ef3ae871c396c6080df845daf5bca4ab42944561d3cd4862ae816d502a70bd8c9dedfe73678caa2a1dfa4e2af0b4e7758bdad46823d41a618e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_6f1fdf49960393610b5282359ed112b6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_6f1fdf49960393610b5282359ed112b6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aXeGbmZ.exeC:\Windows\System\aXeGbmZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EdbSyAV.exeC:\Windows\System\EdbSyAV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IJlPtEg.exeC:\Windows\System\IJlPtEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GPSGIEK.exeC:\Windows\System\GPSGIEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RTYJrEa.exeC:\Windows\System\RTYJrEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYNxDfn.exeC:\Windows\System\pYNxDfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qdwRonU.exeC:\Windows\System\qdwRonU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQvYYxB.exeC:\Windows\System\eQvYYxB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzspBVO.exeC:\Windows\System\gzspBVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dzwyJtF.exeC:\Windows\System\dzwyJtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EJrbYhj.exeC:\Windows\System\EJrbYhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imohjWk.exeC:\Windows\System\imohjWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEWWEiZ.exeC:\Windows\System\qEWWEiZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZywzRQP.exeC:\Windows\System\ZywzRQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vWFBuwv.exeC:\Windows\System\vWFBuwv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SksOmgE.exeC:\Windows\System\SksOmgE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwJeQVY.exeC:\Windows\System\WwJeQVY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzavVSb.exeC:\Windows\System\WzavVSb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xPIbuGS.exeC:\Windows\System\xPIbuGS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jWpERgx.exeC:\Windows\System\jWpERgx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZJcQtbj.exeC:\Windows\System\ZJcQtbj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD565163e0af5c57519ae484bd2f95ed25e
SHA10bb3a366a14107d691b5b378d12895572b3dc11e
SHA256f6f80263cf30f7b2e4bcd06d768cebb1a7fe60138faf3829c557d191f8ce27b5
SHA512bd862a9217a45b7b48fa4ede897cea19b44fd1be1ac1cfc44813c1f1ba455d689eb183ae823b83bf3b8e2ea1834dd136df78dbccdfeb0cd08200d15a477b5e74
-
Filesize
5.2MB
MD55e940e7c91fa7f786523c694a9373c53
SHA1f793501fb362df720cc4355540eeda1b29dda3c7
SHA256e066a7296aa1df180121bb5c704a731136cf9c442c6151c9a34f6352c14bd227
SHA512648389eaf8b23e230fda6ec0c30e554194b1be9e49197fe0f5e6b701135870a06929f344eba26b60db9219d3fc5ebea5587c0e5b44e6d6ff1de255f6505e9f05
-
Filesize
5.2MB
MD5ddfe2a9768a540f80797140c7963acfd
SHA1afa4cdee85bd9e7c31294755c5973eab5bb9a762
SHA25607ec9b5092499e4487106382a648d7a77542400afbae956181b396d625713a36
SHA512431d39174b6aec9787f0549ec1d0c9dec684c0532da0e218b4b2adac28e15bed2bab2bd34ab758f371ecd3cfeefc3db699081d90fb5b46e9d398712f1824ba4e
-
Filesize
5.2MB
MD5a7474fd6eceb05984f235d2e43ab5fe9
SHA1257794cf0e69a64bf2b5387d4fdd1fd7696fd9ef
SHA256a3a0c50c722afca60978cc15ed5a6da9d30a3fec21fc5d03a15c0917ec2fa4c2
SHA5129b37e574e575c27df0d6021c927657d5a29986c938cbb2e665d61fb931843b5b38b00de261fb862c6edf2bdb42607f3d5b405370d9f6754ce800207eca857699
-
Filesize
5.2MB
MD576d42a7dcf4a7cbc0668a76bf2ff6c00
SHA1fb0863c797ea298c0550bde884120cdbaac13330
SHA2563428bd6cd1265326e4a166e2afc12ec8c85bf0ffffe575b1bfe416450a9e136f
SHA512d043e5987f5ff2b0bc5cd840c22441b6e60b25853812575c1f09e725e6e548f45be559f177140a7fb4d5d461535439175e8ae1c2845506e69bcf2e940963af6a
-
Filesize
5.2MB
MD57dfeea255143578e9b1b7fbdec3d068d
SHA1d4a162289d7ec05083676e39e61586ed4be30e2f
SHA2560a0285f633b4fc58d9dbc3641ddede39d8aa231f67f385e46d652ae74ef7abce
SHA512ec9b50052e7020e35db01a1aa8bb42c17e4562096f72ff41f5cdf3885342f7e9c8045ca3b71b056daca33a3506a16caa0cf91fc4bba29ba2355d8ff0547d7c87
-
Filesize
5.2MB
MD541fb620b5eb3ea59ae6b9b9f58fb5ee8
SHA1d2c5c188cd3645c9aeb4c49437228b8eff13489a
SHA256035e9e3a6e37c73d68c333880c61d0dcc6c51b71dfc61c55c1643b9ea58baf37
SHA512d1c42e73137ac25d658f5c099efd3cbc5f65299952a48d99255e72dbc8d14835c309be5b68e04ed5d6b6d0642b98e9ba28c0ed4f5cb0ea8436dc1c7f6fcc26e7
-
Filesize
5.2MB
MD53a95a1b2b92ee31168439a55338ffa8a
SHA17cde6e4aa4258625e4ef43a6aa66d2fad2f004e3
SHA256d7c52db48023b77e19e5b6dddfe6cd3ea9f76f16a6da8e198334ff13430abab1
SHA512df0ac59b3699c9283e17278f9c0eaea7b3c2b4152dedd1d50313a700ee39fcdb60f3d785fb1521ad4c7b650b5f6b87a2b3d980d051f91ee33bb99f0f1bcd331d
-
Filesize
5.2MB
MD503196da3b854c394ef172c0c24a43efa
SHA133e1995a1fbfe58dc8c6fc9c7a38e9464abb8a11
SHA2564f7651968918a11e639580da2276b344e926b610e10cc78f6223cfbde366e24c
SHA5129575dbf2cb8979207ddb3ff7fbbf037773a716b7836b2ff41000421b3067cc045c2d22a1673874b6a306211ba94e8bd1ef3c5ee670259694f2e89fcf02a99a8a
-
Filesize
5.2MB
MD5869effbea02fae80277cc52eef3f6e7d
SHA15448db6399e0c1b19e70dd97e0aca6cab3858630
SHA25600c2bae81772b0a9fcbe741ae9c34c61ed11ea6347a41c21d68c610b6dcba5fc
SHA5122533e10fa190c7a4c8e14d95e0028de757a60f69f689c63ba3454af930061b902f08c3cfce11e0bf6aab21e4245e47c0f63f5948c956cd54df0b25b7f5e2bde2
-
Filesize
5.2MB
MD5113f2ae6105a0d2eb420d0020d982ec3
SHA17dfc794069b71f3670816c8082b30f1f1eee23ae
SHA25632ba0e3a59ed78aa1418f02ddf819a15910b0b36222b76181ce19f5a3f11504e
SHA51225a7bc253d4eb4dac2d07b8ae1c57e576b4e7ed43371dbd4ea5bbc2be22d3704ea1a0ca9b29cd35a6e064259b38d7b6998a6fd2a74b1c56cee13b3ad015e1c0d
-
Filesize
5.2MB
MD51fb72a5bae3752d4e3feda479956d88c
SHA1a6d842d41ef72dd0159cd9256f8fede6e5fe8ebe
SHA256b13305ace23bb687cbffc0b75837af40f0cb31fe05c34892a217ff96874c5168
SHA512348df5ba67589f784af21ecce7ea83462e7aabfc495388b8592333c81585c89e28c91f8d3c150e216b7829fdf8e85ab5d45282d7d8e65f2bd3273b3766661882
-
Filesize
5.2MB
MD55aa6fa3c7dd3bc27e5693e2f1f8341f8
SHA1697b9989862b437cb4759d7aaafd2ebe33acd41a
SHA25627b59510443985e86fd8f3a59811dce42b7805a1efc1a32ca8a557ad4cb2b554
SHA5128c27ec7bfdd393a2b60378d689c2f1e97f9695a23b86e3deb80d77fedbe0c780954d2a58bce56f449debc6bca0ec7d26ddd8dab5303bad4eb94eb17105ed567d
-
Filesize
5.2MB
MD5a0737ddb3fdae9ffa029840fd847a53c
SHA10342c19a7b1020a097e645b2f5415b336de098b4
SHA256d82deeabbd5d499b52e6f22e6e6ea4f25bb822bb51fead39c8e3aab056d7ede8
SHA5124a7b54d5c1fd3aca8f81d4de5a7e68e67e6ff845cd850b28cdff1c37ab855d5580e3f2bd0519ca9fe4988b488b445a13cb2dca19d01a388c3234a69e5a9a565b
-
Filesize
5.2MB
MD58b0a33e6bdd3d556901225402ab51919
SHA1980f3e5cb17835c171a41bedee9f10ab4bbf6d6d
SHA2569756f2f427f006fc82c571f7758e7268c84d9dd34e4962920bda9e871e614e19
SHA512786fe2a3e1837abb54e1fe5fab14bfdfa0f114aa835258ca8c51b537c02cf93f601df3c54b5e06a2464b05e5fa14cc2a3446c9e6f8c33382d7903061be89092e
-
Filesize
5.2MB
MD56990c2a27cd6062b0d04e329376fc0b3
SHA13c29cc0826c611a6b3b9e36968a64e42ddc48304
SHA2560d20372d3c3caeb9e82f57808f97b5ee423b0822bd333d794fb8a9696430a84c
SHA512d85c3d8d63921d1def886660f88d468c0ae09fa92885c83c619c40c07df572939a1eab825050c0d50848563616d5be524518443f89f532251f107f7d77f354cf
-
Filesize
5.2MB
MD54dfdc38b997f2f906fd53de4143a3c9b
SHA1e6eacf54954cf45772eecfad2302b86f23f014fe
SHA256800b216a2348fedef2e68168b713b837c7f9bec50b081112fe01cd0f515692a5
SHA5124e25748a0bea4c3826223b884ad12a795ef5aadd22a9f9ed1589b3831de78ffd1fea2289ad464d4eb366384392cee6378d03b0d66768cd20c434de125e015968
-
Filesize
5.2MB
MD56aade55020481693c63248b25105843c
SHA19d9888753d91ca64b00cf336f8b998bf970944df
SHA256ca0e290857ea2983e91f47924c06ebb2e5b12518d4cab0bde7deded8730cd43c
SHA51296922a39c01010a0c614978416d310735b7d8fbb080ea1445ad4a1e9742359f7418f5b66680be9143e7fa5cbe08a4dc00204574c0d71b6a0d3da2f4fd34d0c30
-
Filesize
5.2MB
MD5483c8d9093d79b7d61f899577cf61b69
SHA16f40f52c3e5a5bb2064c99611cb0cab980cce4b1
SHA256db92bd39832add55c488d206184d5c0ffb4e25c6e73256295cf08d30285bd46a
SHA512d4691a273425458ab9e8f85ca603936fde879bcb620115a42d52a2db39c0c36f7b7af958e9464edb1cdb6042fa2496d4228508399bcda24f3a18c6c0d402e291
-
Filesize
5.2MB
MD544e3c8461b7832dc08cc7eb7c601c5f8
SHA1ba63a068e84d8ea5ce9948766d45f7b6e5522f98
SHA2563a80018232fec9f69f40e49c0a76fe46f07b47411010f6dcd20ae0d309687a85
SHA512f10fc1b1435edbe59fe127fc0414add8f2ac2692cf9c43003dc59f805605aa5658b09ef447fba44fa69256f8b475b855d627e4bb0bb537f947f987b84334d9d4
-
Filesize
5.2MB
MD577d03f58a62e7c25d69f67b6b63f761f
SHA1dd0b672d18fe07997bc589eb5b6370329bce04eb
SHA256752971a5b978e30568386273018ae82114239ec189b8f184fbace2ade0cabfcf
SHA512fcd840c673d5a4099cc0fdbc385064a539956fb511a22f2e5322dfd68acdd51265abf62a95f9c3dd1c591e60adaed47739df167fa7f3b46f1ba2ad27809fb0a9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB