Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 11:47
General
-
Target
2024-09-20_343782730c7876569d2e942dbf286dfb_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
343782730c7876569d2e942dbf286dfb
-
SHA1
25bd21c49ad574a5239dedb94cff65141e52dd32
-
SHA256
936caf2da6a9066a7cfcfde51cdde1f7e8ac263aa2c0e6f08388ce4f959325ff
-
SHA512
e6ad87dc3832f4f794cbbf61ffeda18e330455d4de7251045718c8e8a300ffb05a367dae015b8d04e68ecfe9ce8bc3d9552ef5cd7a0d726f49ff3070bcec3d17
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_343782730c7876569d2e942dbf286dfb_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_343782730c7876569d2e942dbf286dfb_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WevzNUD.exeC:\Windows\System\WevzNUD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dsKzNRf.exeC:\Windows\System\dsKzNRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPwiGqd.exeC:\Windows\System\gPwiGqd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjgoqxi.exeC:\Windows\System\wjgoqxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LwzayhL.exeC:\Windows\System\LwzayhL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AIzAkJx.exeC:\Windows\System\AIzAkJx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZfSUar.exeC:\Windows\System\QZfSUar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UbkjJRO.exeC:\Windows\System\UbkjJRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqNscyk.exeC:\Windows\System\hqNscyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfUFUVE.exeC:\Windows\System\NfUFUVE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAEYgKd.exeC:\Windows\System\jAEYgKd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUGvMNE.exeC:\Windows\System\XUGvMNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LcFtFnm.exeC:\Windows\System\LcFtFnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YPKrtHe.exeC:\Windows\System\YPKrtHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SvFMHFu.exeC:\Windows\System\SvFMHFu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GjqXAIV.exeC:\Windows\System\GjqXAIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmsXgDC.exeC:\Windows\System\BmsXgDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPeACSX.exeC:\Windows\System\kPeACSX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ipVzfVc.exeC:\Windows\System\ipVzfVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UyOYoTQ.exeC:\Windows\System\UyOYoTQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EtUSpLL.exeC:\Windows\System\EtUSpLL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5391380a08625c0c1f29488d1dc1cf583
SHA10221b8b7635834e45c4134fd7b9914151413d88d
SHA256199786826638b2c34fd7017f500137b6493a7d9eb53cfd99fe5f3d3849785d43
SHA512c547bf41663cda4e73900e0be76b7c06da8ea7951290e4bdcfaf62b53474a44711a84c1b43fae992bfd25556d315e937e6a8f50c4b4008c319c82526b653c29e
-
Filesize
5.2MB
MD5e2432d0b5c7e8919b70d596e50dc228f
SHA1f37c8ab56504b4c9aeaeaedda992f5f39f2f3450
SHA2567ea5247cca1ea04d51340593b48ade992687a518312b9f64c55fa727b185681d
SHA5126b7587c8e57dbc50d0ce4f8e12f6ec3687dc1a24f4e053dd079caa2b62c4dead100a50431d5e523b3788f81de612bc7fdcfeb05a2029dbd0013a008752db103d
-
Filesize
5.2MB
MD5d99c7626fe634c713092ca0b5d59d54d
SHA1195e156035b87684442da5b8f21745758b725469
SHA256a52ec55877ee859dcbae94694a841bac8031a54b99f128a3b247852293891346
SHA512167a8f84dd169cd2a507cab0b045c5e732ab9a6f00d477cac59b083b61801d4be2bb1f59a2a18213b5fff631a68880fed9a475908641d7b59db9db1176d87874
-
Filesize
5.2MB
MD5a553b7991e067ad0bcb98682009ba545
SHA1df73a87c824b634a7fdc2a8bd22f931a3899a10e
SHA256c8b331d59eebc8f025352e1137c4f3a5cfadbc60b273cb2c1ce37672be0a3bd7
SHA512985d159806ae4344a6cde435e916221a07682e737bc4353c82967dfa1440b1657ed389706a8a60254ba16e5303657f05d4cb8fb661e2f52f62fba6d75f1cb37f
-
Filesize
5.2MB
MD5477f85606e5b73844810e0a4bc212ba9
SHA1de809cbad475a7b3548603f84c84bc1cb2991f71
SHA25628548ae87c2d55c6977018077725adeb9ad0218cbffbe3ecc60935e796f3b107
SHA512e2cc7dfac8041516bc412195fbdbc6d0f1058229c523cc6a246f62d4004ff6131557c2ed2ea768996a6071812cb60d375c77e4117afc19a63913bfd36c66fc80
-
Filesize
5.2MB
MD54f49358174eeb5d595dafbde997ff916
SHA151d3694daee60b1b19b5697d23e8caaddb7de7e8
SHA25606fca5cafb4f07547d77ebe63e460b1e4598b64239134a17d7d9d2a6627435d9
SHA5129aca384f40cca4eb0077eec1e08e8b20d82d131a2dc9b55c89a5912ecf289c1c8717acbd4e4442fe40ced20bff86ea9c615d30c40c12df6b7e8f17186e536f5d
-
Filesize
5.2MB
MD5c86fdc2d7eecc4f83b30e6b3f26703bd
SHA1e3ec91ce7a69f4ec215f4254042e4722781e5292
SHA256e9be03dbb1bfb4aa2cf9526e2ff00cad212bf2f0e760261697063d4781228a17
SHA5127e9a12f0644d7ea612d80ca3bce7a70f480e5eeb3c3b8a19e24781bb3e02932f8584eabb8a5be4f97fae6735fd131383414f29a9d590be5ddd201ccacc4c805a
-
Filesize
5.2MB
MD58e7cced90e3569000972809c2bb55b93
SHA1702539a33c5a305ddaf4d5538e57d37178a9dc1e
SHA256ec5c77e3f7c006ba4e095fea0d7b402e074c99f7fa01af68ecd246d455831885
SHA51236366f7a2e97317ca2c3cd1074cf655731290968fa777fd4399451218a3e7479a3697e636e257dee62edddae062d585bd0a910ed47274cc8cb8165373577e7af
-
Filesize
5.2MB
MD5702a5c427fc02b4b4adf5b9802290f9b
SHA198e2bf35bd9b8e82f15ba5adb4c933d2a4c2d017
SHA256261da86a6522e10940c5d0a6ca98077378e5aa9f80c19b857f3af773f9c8537f
SHA51234343fa16e03b88ce0ed5a8effad40fce4dcfab24a83cf374f5198c127047e3bcba0c772b78f427a3c080805df23db7256293f25efe8869b2a403acf4d834695
-
Filesize
5.2MB
MD5964a6dfc7b1354bfbe99b3c8f2bb8736
SHA124c495189c162efd13a85043344d150fd9ea0ab2
SHA256ca37ff4353c94ffa8e6ab7a271177516407494fa33aeb76a9a5a991c6999a359
SHA512fdfcf926e6635d11809594ea2b4ca930843b679489aca26be159d801a4a05a125e434ed09d38ae637044470723646e7aec254fbd6d8e10c662d1a80b095ed69c
-
Filesize
5.2MB
MD5dc966104a4273ef1c166d5b32119c2f5
SHA1eda1db97c45f074a6b4ee1aac5f3f9d49c42f215
SHA2565115bc1d9aec2ed2d4d02ceebe9c52e34a7c7f382a462fee7abcfbced3a7b1ef
SHA512d1187c1b31409737ce1bc80e90c0fec2e1406038408887e6eb3db85906e0f29085e532009fb5f24de74fdc2a2aa5ad4bfd241441bc74882136081cd58783b399
-
Filesize
5.2MB
MD56ce6cfa49a16f3d2305da3edc09a23cd
SHA19d85c34490088ac073865c6372b77c18123c8941
SHA2563ed233aac8bdba1b111479b1df4ddedd792b4c9e8aadc7ee65f202f97a0b9539
SHA51252a8693a67007ab80d451b3ac912a7e148251d37f260882c312441b7d7fc7720f017f1c8bddf0b7e1d0132a5b5f5b3124bb74eb708f1c4780c9f00626ba190ad
-
Filesize
5.2MB
MD5fb74ca62c1eede8551dab61a1b25fcab
SHA1006dfbc8601029aefabbdd9d06068c534a5f83f5
SHA2565982fd9f98b205a14b34c709329a7bead4c8f7ce54911d7956af5fe968a50965
SHA5123650cef8aad4e77642917de67651945899261f8140198ce7cbc846274f6a6a12fabffe63667a4913c5b244a1ed4c9a981f9e2da9fc079f2d2f4dbec244ff294c
-
Filesize
5.2MB
MD54157bbaae3dd990e5ba4fc7c24e14112
SHA1d1d72f34baa8b6c2b949ef96b3816abcd5f9f8a8
SHA256460ecb7cf69a70a35c536da555e21d1ce047e9c09e9b967561c5c2928a112d88
SHA5120c8b1f33986398833af6c773b04945b5cbe8e8dbfbb1dac4e7ede5cef3ec5b2c21b30f201ada7623bd85ed74d35995fef2b13ce010dcf95ed30ecf009408152f
-
Filesize
5.2MB
MD505c2adc445f0ffe5993dfe846c082ebe
SHA1b422a3c678ae01d2997d1d61b3647be157f37c69
SHA2561770dd3f91562a6d740b412de7065a93014a532393a38a41f4c478e37eebd14c
SHA512788f29e2f03995bdf0422424a704090beac4e9dc42255d5b100e96a1db21bf11d334e2a7605a0e5ec175699dbd65b7e40c1611d7d565d196ef5a5ee925bddd13
-
Filesize
5.2MB
MD590379991e86d50136f717bc8d71818e8
SHA145b5a081b3770058acfc1759274376e6ee60e0f6
SHA25604a18deb4d1be64bddb12209f4a998f056e003e115be71c499ea4e2b11324d84
SHA512b821a7a1216bc010cf8430f49de317b84ccc5b15f30321991c2291a991c28842fa51a32301a9dd3928fc1ca7aad29495ff95fd885a7d2339c24d8e703ff932bf
-
Filesize
5.2MB
MD501b8aac8a33bf0196ada1af4e76ea4b6
SHA1737198fd6a5b950f2720cae5d595afc4390559f2
SHA2565bb34cedbb2657c16a145be75793e2477916fc1b49f0e7e5b7a2fc0b447f9390
SHA51202fd9ec65230c9482c5a79b3063ca0395f6278c06a035369c52529f6c41d47c96adda1b34f550500e87d0ce11773f78b45182ac184d4161963af57c1ae50c673
-
Filesize
5.2MB
MD51b4b67d09853397ed5241273a4bfc9fd
SHA1c3c1e05ca6ca015c72d445ab69f87ab0940daecb
SHA256f1a0f6eba764dddc8d8e38b8a5700e52c8f1500eb0831e94ab6a13f75b5c90f2
SHA512c304af40e7d2bd6e99b2b3535a508dfe52e388f33f60acd290f7b7cdf4e3a33ff81b521b008106c392e2ec2e79c8a15b20dbbf813b46c9895b5ad31dc80316f4
-
Filesize
5.2MB
MD5f4a357a1edbd445b3b96bc03e22f67b5
SHA198d86395aeea09b2d89f6a46869fd20bea96367b
SHA25608ec63f263835d3df5960f9dcd279357b11571435b847423cac3ff9fd8598ad2
SHA51265fd6ece68e173eff7f3248300beb7e2d787b48e0de6d7e49465ca8a8f32ebe5dc10d676a39b84528f088c321dfcd1689c8f13dc8db8b519d9e2f2cebbef3f0d
-
Filesize
5.2MB
MD5da94493684f6a8ffa1c064063e8236fe
SHA1c2a0b38cb19bc8668f44161a3739591001a9fb59
SHA25623a27658aa726771c6660334d902c8595523b975fe9d13687b012573604a95c4
SHA512bbb1ba06dcf6ca4a835181dee4d6a91e8226efa982226ac0c182f4f0cfbebabcc9672dd390799e9bf7234d098d809f20431f43eaeb15484fd0cfba497cacc577
-
Filesize
5.2MB
MD5cf21c28c85be1a80cabd56434a275388
SHA132e81b0c33005906a21dfd0f6644b78c7843f5a7
SHA256fb3f8fbac10592e82eccd47c8fb30188156498363e539ebfa201561c98711bf3
SHA512d4207dc9c2a89c18437ed3668be80d491ca3e0e09ad346ed1ab8a5f79f78692bb3cb47270cb09331a09f872cdeecbec7fde8bf705485efc6876cd481feac8338
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB