Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:53
General
-
Target
2024-09-20_66ff7b24106ab708197531cbfb9098a1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
66ff7b24106ab708197531cbfb9098a1
-
SHA1
97d82d014a76ecca925e8486a9f8090c7ba27227
-
SHA256
2598501a9a87ecd72466d468c066e6d62572d206ea0669994bd0b92521ba0af6
-
SHA512
793cf0eda7b0a2db3e7bbe7d3bead48b4a868ad062f5c3a3107c4fcc676d073fb2dcf63f6d3b8a70d0b08930ba5bf12c29c1ab22f326cba0a07d9d3f69f35e74
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:T+856utgpPF8u/7l
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_66ff7b24106ab708197531cbfb9098a1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_66ff7b24106ab708197531cbfb9098a1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HdlsJxA.exeC:\Windows\System\HdlsJxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bHXshYB.exeC:\Windows\System\bHXshYB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akGEPjs.exeC:\Windows\System\akGEPjs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMHHGSb.exeC:\Windows\System\jMHHGSb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RDfyBmK.exeC:\Windows\System\RDfyBmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCEaufD.exeC:\Windows\System\VCEaufD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgCFrIY.exeC:\Windows\System\CgCFrIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTJfhvu.exeC:\Windows\System\kTJfhvu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GTLJcCJ.exeC:\Windows\System\GTLJcCJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uBgJFoc.exeC:\Windows\System\uBgJFoc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DtsjUZz.exeC:\Windows\System\DtsjUZz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkBWdLn.exeC:\Windows\System\fkBWdLn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hlzDJfy.exeC:\Windows\System\hlzDJfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcvhjCH.exeC:\Windows\System\DcvhjCH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CdfyRrR.exeC:\Windows\System\CdfyRrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyMdUQF.exeC:\Windows\System\eyMdUQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OJKfpwI.exeC:\Windows\System\OJKfpwI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmqFWtW.exeC:\Windows\System\zmqFWtW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nUFWUlT.exeC:\Windows\System\nUFWUlT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XNhEFqK.exeC:\Windows\System\XNhEFqK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nYxinZr.exeC:\Windows\System\nYxinZr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5eb1602a25232cdb512f3eef202e09d73
SHA1205d7371cc592fb10beffe88fb210dca163b75d5
SHA2564023474010a82ae921faf266efaff169371befd2377b0c5466db9b9ed3958053
SHA51207665306f177795bad8fa176472265f1da5107aac661074f68ff7114a8ac077c0d89a07e8c508e617a97a25f6254124ed56f600714f7d4e6921519e115dc913d
-
Filesize
5.9MB
MD503949bcc8e275ea0b17cc7c3be1599bb
SHA1503cc6d0591a2c168ee83dae1d197911627a538a
SHA2569d88ca508cf0a0250bdd08b986887fb5d559757d34f4828412668bc5dcf561e3
SHA512ec853f8f77a7b5dd198c213ee71a6c34e7d2a803f2651d8e6bd31dfe4877f053be6bd3937a55fddbd0f3050369821606fe548d8cba3bc1c1f0c72ba64339de7c
-
Filesize
5.9MB
MD58fd6b33e548cd93925b1518c9a132349
SHA11c1f738260e65cbcf1c59c07943219a13450f419
SHA2568894a935f9914d188d021c75321713a948d3a2eeb272396cbbf43449b80db83b
SHA512a3db2215e9f64ff289d07a216071448539ce9aa169104c7707563608e90318408331d995be6a0ebcd1a096b6e3d696a23089a5bd944b565230841a494bfb647a
-
Filesize
5.9MB
MD54b687d52ab30554ecdc284056cb4c7fd
SHA1c2c3245d0dfe9ebea0bfbf0fd48c320f27d084fe
SHA2561244f1058b8ccca180601136249e4e272fa519e0c914df8320c4190db9254868
SHA5122ea22f50d6c947444b8852ef6719a9b19541d91244d0c0ce16bd968d3c009f4b5b8d5a9f652bf443879e01656b857e91db885e348b00b0f952eeca20708e1a13
-
Filesize
5.9MB
MD5fff5c3991a808d4865e12d9bc3d297f1
SHA129959a5cba26f2dc02c7bb20bdf789d708c77a1b
SHA25620c8d2ce112c8d890fd558596dcfd5d830780ecd71535e7e0ed65703ac948d3e
SHA5125951e4e98b5d129a1da6a07d3c847ddb39267ab5411b54fd5fc7ae6f90a188d03e493383ce5434b130b726827b6e0d73a50a08d40c4c74cb8e1bc089de74eb9d
-
Filesize
5.9MB
MD59a9fcb97e7f72aab73cc558718b0d73f
SHA15cee60920e923e817e6d1ca2e062dbe64a656ff4
SHA256b34c121b6781681b0faf79128a3f73a5b463ab6ec9e20c80739dadd4b80c19ce
SHA5122d836af703e7de225fae014cc0c71f95acf239d4fbc98bc19fe86d7a5c40e39e731d4026531630329ca7b2ec86b045b30a72af65a6b1f09f8ba8a084196fe52e
-
Filesize
5.9MB
MD5e1620b92c3b916ab6709fa3cc0a0593c
SHA199378876c1fb145cd97b1bfabea447f081c7ea8e
SHA2561393bab1497fb366b78db34c060617e4b60d725cb266301562e31e6e1e15242a
SHA512540e87194c20a106dc9dbcd715b65948c2413598c124897859f4fdef2be9d4c4fae2d67ace786e1ec8eda575905387e2c3b5087f26371d723a2288553565f7ed
-
Filesize
5.9MB
MD555866e6f91482ffeb06c9636858c7d9d
SHA100cbab3206b142027185fea939e142bc07adb7db
SHA25680906ae9c7df80872035cdb39c847cb8cf920a8cb0a1afbf9306a1f675af18ea
SHA5121a214243092cf47095e9d2364f2be99f6e630ade5cd208f228559350d86408549e2811ecbf3f9b1e7c20909588fcf63674a8d621a70d47483dec26fc1133252a
-
Filesize
5.9MB
MD585ac1e85c75e29229dd1df26582bef8f
SHA1af59e266166a57435e9b320fad5e9d9e2d34e28b
SHA25688f99676b848de9926cc510efa664fadede6e40d0b9713d787af25075767aeeb
SHA51210a4fe62908c303391a957c5fc34c47c1e83c798c30ad9b2afdef044296ae1cadf87aa0378f75a604d6488a83c0612ed704d9b112ed3430378e30e9544a06bbb
-
Filesize
5.9MB
MD529056c53a23517ef86c27d65049b137a
SHA1c41da3dfc76bb807167d9e3fa54bae31eca4b230
SHA256304526747cd8e685811f77a835efa21495ed9be9d1ad8aa006f643166ca974e7
SHA512eea04de2293e9b3e674e2de5199ab03f679f1214087020ca7422353ebd864e1d244deb1587acaa45cdba4856f087a45f30927f21c98d0420a96722ba8cee9933
-
Filesize
5.9MB
MD590eba561582d1c95ae9fcab0edf330f8
SHA17c489d8fad3baffc23895bc566a1846d112ed418
SHA256879f3e2d90fd838695bf65a223652855a83f289274f6d70202f6456a28b5ef3d
SHA51296f2568203d90b6c1cee069dc08b98dfb03d12ea268bdf20c7948e8330d3737c5b1dd97e832fd04a22f27840c49a55167b31779d8be1637b4aafd5632f482f57
-
Filesize
5.9MB
MD5c35f4f413beb990817749ea677db70dd
SHA12f27633963268dac4ab708bd98b668d04390751b
SHA256bcda1c75a5e32f6537273c99dba93b40392edd639449c4f845c4f128816ae951
SHA512de9a956b42a274985f8509010702ba8a1fcb74e1ef8a10ce6732b7b4b68544b2c2ad87d8f97c1a5f206dc2d4cd9499626b16002d31061936e90c7ad5c74fa4a9
-
Filesize
5.9MB
MD5f7933b6fcd9ef7d8e8a581a1934903f9
SHA1d08c0df136646281bdf74b30c985bf96d811ca07
SHA256a8931a2bc1a654c4353514731a7be23a603208bcf27209995823f6d65eaca056
SHA512af41a4294986a5d295c8c570e2e71471795a592fe9d718c6d15564e00a84bf3cfb0d7a8b9ced23b3d886f26de95e39e81338678f84c416e7f04e6ebd2e021b56
-
Filesize
5.9MB
MD52c3bc570dd8650966ebeab2f8d9f1fcd
SHA169d6acd9c562a2b1e3f79e51578eb357c7096c0d
SHA2561f5f9a98589ebd456d93f30037bab094153c3929a4fcfa38458a3d426e8c46c8
SHA5120578ae46bc676af7db964e5354ffe2bb4f365c829e7848397cbe3cb839a98937bcdf842bb8d39a45cdb9f65cc1d5f23321ead861b5ff49511e5e05c9b63a2316
-
Filesize
5.9MB
MD522f9ffeaea614cee781601d297f79dbc
SHA1a6398a2d4a43d76040d9fd35feb0398cc0ec63dc
SHA25644ce7e85b3bcb44a563453f48f77a247ee6fd2981b256d117f5b89e2f7d78d28
SHA512f0b8848001df740a9c8ecb98a04ea612beef5e36f975faffa59d26597b1701a6381f9e2b3a55d47d50f089f39b3ac428fd972d27fbd9593e4ee64c0928a7330c
-
Filesize
5.9MB
MD570813e08104ee19f0c0076ab2b135a71
SHA157a48b1146f57d3a2f7c520ffcfc318548cb7cb6
SHA256366bc408962ce76c50b3f7c54ee3ef24c44178154e1d132de7d55d7f4809221a
SHA512693d252cb35dce36e30a0de40eb721632755607ce9058d83883ddba1490540084f5fabcaba9f14018ea1c8c055c1e997226df5a783a02c8d30b85fb69a5d9dab
-
Filesize
5.9MB
MD560e0c60bac50b85308a347f8a3b792c3
SHA1b7b67644d327cf04da756a06d7fe3af42bc2375a
SHA256dc7281521b041d026cfaa475c5457a415d54e53b76cadeed4fec2648ffc0e285
SHA512ab531d8178ffef7bf8963e70c6d2c1bbeec85df558069eeb1e51dd4ad043ca887b714c1afbd06600da897d69ee96018a165a3fa9bc047ba4458c45d2d9ca363e
-
Filesize
5.9MB
MD55d4dfb7a455b888f411f82897c99276c
SHA12ba016ebd059739ccb507f32ab28475d97dfe131
SHA25667264cf4e52e76daf902495549226d919cc3ad63cc7adecfe1fbfa193821f5ab
SHA5120047e3c8225e15cb6702359f6720b398d54031bfab7417486f0e7bf7c4d67c6ecd8836c6f6cfda1471e8d6d5f247e23739afb361a1e86d95c888ef71fb4fd855
-
Filesize
5.9MB
MD5367de6be0a48562207056cfe6f639b8d
SHA137970cc558eebf58f6a4a0f69227b2c143cacbfc
SHA256c340a2b7235b9a9c50c19d17838d5aab53fa5081bd469069b905a26e91f0f341
SHA5127ef6b21b67bf72f3da06226f1f035a6e07b9b51790f0cc835b3e3b76c4594f696ebd820055b55a5a18ca135702eec580b241fd18f30510f492f1b7ad6c112928
-
Filesize
5.9MB
MD599be34ce39ee77be3215d0dc731bf6e0
SHA1561c7f0538baf66dee739211e21ed5f1373d3d69
SHA2560ea94ac019df5d6433dd40326a663a663b63c351a73f37aeb5104dc7f044e607
SHA512bd71809d702bc638089c147afb0b62f6176202d884c28dbb0df6be8c1ff882d3617b89b5ac49004191e579f8552555974aeae0265aeb5f3bf81961da330da9bf
-
Filesize
5.9MB
MD53c2fbf3865024f637e9329c7ec2327d7
SHA15e3f5fc1f70b448fc2e1ddd0df81dba998893099
SHA25662fb5d8f560556455cece5b9fdb5e2ae47d8dca066d605d4c1e3adc902587b35
SHA512beca185871836aecd74e1deeac84554376fcd2e5ccbdc89af776c611466476db4b2e1065da6846161bd44273767d862eb38536854e60b426b5ebd4b3c27649ac
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB