Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 15:41
General
-
Target
2024-09-20_d087ce6c690b4644495acd71e4c7e1cf_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d087ce6c690b4644495acd71e4c7e1cf
-
SHA1
15c6971f232a209d7c55cdce06af74109e41ed7f
-
SHA256
46bc9ca3a7b4cea3ac58ef372e7da7f2062e42dae22f8d4e850362b0c78da548
-
SHA512
534c0d71e274e39a5f5e810b614d0f526ad9869ba4f729bcac67daf3c78b885be4f7cdf857f03472f6267c32aac8fac433f581188dbd5ea97fd2fad282832459
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUL
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-20_d087ce6c690b4644495acd71e4c7e1cf_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-20_d087ce6c690b4644495acd71e4c7e1cf_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dCqwUuD.exeC:\Windows\System\dCqwUuD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjbIiTl.exeC:\Windows\System\LjbIiTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QrFZgWY.exeC:\Windows\System\QrFZgWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQsZthm.exeC:\Windows\System\eQsZthm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MWAujMt.exeC:\Windows\System\MWAujMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fJdBshY.exeC:\Windows\System\fJdBshY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljWyvHC.exeC:\Windows\System\ljWyvHC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LJpghPR.exeC:\Windows\System\LJpghPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eoeueAx.exeC:\Windows\System\eoeueAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYVWudv.exeC:\Windows\System\PYVWudv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPdFKqD.exeC:\Windows\System\zPdFKqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MfjFMAE.exeC:\Windows\System\MfjFMAE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrGVVcv.exeC:\Windows\System\mrGVVcv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FjFIOPa.exeC:\Windows\System\FjFIOPa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SGSTBhj.exeC:\Windows\System\SGSTBhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uehzWAb.exeC:\Windows\System\uehzWAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AIYVNYW.exeC:\Windows\System\AIYVNYW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPNcMqV.exeC:\Windows\System\bPNcMqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWHuqbm.exeC:\Windows\System\qWHuqbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UuQsaRf.exeC:\Windows\System\UuQsaRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EKQNiHJ.exeC:\Windows\System\EKQNiHJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD524d10e4efcfebfd91168d458bacf38ef
SHA13369d108c4e646ef58730af41dd260eda4b17f01
SHA256a6783d3447352e9d1e7b6bb770fa04b40112442f78ac9436b619661e4f233c14
SHA5129add681fd6815c6e38fb1c9b9d391f9c45ba0e08ec1f671183c4d890b5dceb9df0426abd755159bdfe373cdd51ce0aa6c285dc526258975eb0108b5366cac997
-
Filesize
5.2MB
MD5d8ef4f02e61574296ab79c66a647b6d9
SHA1d4676c13f44c83aae5eb621ae4874d8b4738b335
SHA256e883e767a523c2142a8854fc4185e322a30e93a3da68e491809834e1d060f647
SHA512c4f0a97a1d9ea082e258d839e807fe01812ac25e6e692cb23da52279ea3ee04aff9a72c3c6bd58937c7b2f283fe75f0d82ec71d680b037d55c40915bdddfa8f9
-
Filesize
5.2MB
MD5df761c3d964e3bcbf65204dd829fad05
SHA16078fd846c5bc76edeee1b1c5d1ca045fe4ae46f
SHA256570723c62abf15f9bb0023e2fd66326c506bca9b9ae229c0f9cb36230e56e439
SHA512e5c54a131d8b208d60bdaa0b41a3a1b5edafe59f01f614f140fefd930c8e376ebab85fe823164e04af80626512ef5279a6e092987b8beda608924edc81d3c951
-
Filesize
5.2MB
MD518d4ec65bd84e5332c6e7f9e7bdf03f7
SHA193696688f825ad838879c4ec77e38c54edc36f8a
SHA2569cd1d404c7c9662ed9a392bd3d45f125b71843047aaf9cda3a9deb77bcbf65f4
SHA512e1bc14c8e00116367f9c5db453d40de751740485e4d35544bb0407698ecd904cc518699cf11ac5b8fbd4728a6362d866eece4da8072e3bcd9f025d7df396b864
-
Filesize
5.2MB
MD5c66d4ce3d6ac339c86b40ff3f4a4175a
SHA11646db5c3dcc8a876d82c4a3695f01b54e34f909
SHA256dd1f5727e8613880ecdba0f71e0ebe361bfe01d0ce9340ab4d3d8b1e7f8f5861
SHA51280a7d24853fd89e82504f170120fad5608ae2f845517b4233ee9f4829ae101888245916aaba2959d3bfec6eae99812d62105b97e0c83bf024397f180d5242c7b
-
Filesize
5.2MB
MD5950a959ddb15d8144fcd88a82581bd12
SHA149585226f6963ca807abb4569a1b682da503f11e
SHA256b1ee4222624143a3b18d5bb24b46c8f0d24fa6ccfd97aa777afd699472ff598b
SHA512c1456fcadf780d1f91f28b196af8cb4e96a9346b95a3a005b712a6d68d99e1c0be2cf3d3b8d2e72ff127ab8ba3eafe8a62ef1a6470767d6e13625a5f708fe934
-
Filesize
5.2MB
MD5738463a5291dd7b5664fbe8e660c7c4c
SHA19c3f1b6099f4d1004ce041e1075f34d766fe272d
SHA256f755c936756578ac55332aa3a5e20ffca8efcf8313d64ec43b221b2094cd2975
SHA5123f0528f8b88e9da93e5c409d6eb3b7359cda24868e73cbb81ac7d90d16744b15c700942f928733417b4bf4e06ef56fdfff033dba91ab08c32069a534820c1bda
-
Filesize
5.2MB
MD58c74ed06c0d1d21a5897f2012bf3e968
SHA1d3e8f7a047c64b5fe4b7301829fc71c9ec0cda56
SHA256596a97cc35847d723d5812b4147e1a82a9054e27aa3c215720daf7976711998f
SHA5128689cc5dcb3009e5aea7997bebbd8186f9a3ee2aab39ee72e62b669e0807da1779b60023618b2c8487d26cf79723b3d69b1a0739c95a37ef2eac7e8287c832e4
-
Filesize
5.2MB
MD5a60722d64722a0334b41cf7fc72317db
SHA17c2943b60aebaf3e2644917bf185d48c80a640a3
SHA25667a4fd44494d88421e65ae7a250e854113c488069c972f6880b200a245c51689
SHA5123c0ba0cf4c2d76758a377f1d207ecae2a87c7826efdf9b6cac6c18182612470a8f5b557bc1790ccdc6355ab62bc873a82b8884a348660700491f313cfd1397d3
-
Filesize
5.2MB
MD5de4cca43ec9e626cfebe779aa1f7e3d3
SHA119427eee1ca2d6f631857969ed07a9d3236aa047
SHA25681288c587cdb7ee9b870e9a4090c02592ecb42b2d22245804f6ba9e68a99356f
SHA51299f06fe4e0b7df144b4d39b226d1bfcb29d5e00bbda98896c518ff09d41c4a2fc598f2c8f013db80d835560d1bc8c7115cc7117cc66d3bb65ebef1883d08c337
-
Filesize
5.2MB
MD5b2422c630355b7528b03533cc308cc68
SHA159ee69a5c9ccecfd6825003a27fe4d1928616107
SHA256355affe7485624c01404ba4d2b15cea9a8557ba8369a1410e63b558873ca2d27
SHA512ae38f0e966a698a1e8a2d13a35f9546a393d9c8208ad800ff4836f5c02640204ee5847e641c66c1811481c5b53004ac468fe37e206388e1dbf9dd19b728c8b71
-
Filesize
5.2MB
MD5a639b59d05b001db1de6c666530f96f0
SHA139554a388f6c1bacee5918ba3b98eb66304ad0cf
SHA2566f12afbdc5b419f4cc96a26f35902d07fbfadb8a3b1aae4a4ea563719c657931
SHA5125d0cf3110b7858dd0fdc28ef986fa731325ec03bf01bd777aa5faf15b965e7feeb378d2f402bb5ddfc68eb5da1993044a11771b7f4e1358c5ae9cbb4660e83b1
-
Filesize
5.2MB
MD508b7d93888b94acfc6a6c0a81716ccf5
SHA1a3e6556934595dd196222d99f9b45c0c7863cb43
SHA2569d121e94ad2e0537c783b3b905370563be0789f854ca44f3fe6f60833af268f9
SHA512460071291c178c86c3abe3724a0058ae0266bb179645a2d8515f51378c2b8023820981f2f2f49ce3f0db7fa3cfff528108151adb415052e3c6f7f5aa9e780982
-
Filesize
5.2MB
MD5bcc937ff605e0db0a5589e4bcafbb4ff
SHA187c354fe452bba2be7a7df19e820f4813c8d1513
SHA256cbcca5d41134e89427e4ed02d9ac1ce0ef558469316c90535b7b8098862aca44
SHA51246552b77a7bbb3173147876eeb76757de19478db3e52a8af362e88268899dca8507ebca76ea945e56eddea1968e6982d5971826e3dea03fc8645636034175291
-
Filesize
5.2MB
MD5f9241b90aaf1b24672745c885778933f
SHA1b17d3a71982f56998ceea0456d3a7fbc730d7656
SHA256b516d60b723af3c67b761064925321b76d22646d09848f23b845bad23b2c97d6
SHA5128a322857a52c9ba2aad193045cf9432e3bb6314f27c96cfd317de1feb7777a9361f83d75b7c968526fb732f21b718105ee936534afbd8612512f95fad5626b7a
-
Filesize
5.2MB
MD5542f65c3a1fa2fdcd9dd3c96f9aac3d6
SHA1c8bbd91b1f5880c3a97e0b4fa8eba9902675463b
SHA2566bbc36dc7f99aeb7753a2451bc026ea2397dfcc8995e901bb9aca4262fcf22aa
SHA51236f42c93d4905f2ec6eff897d35523f770b0256d4681b31332f0a7446f368af3c2ff6173522672ca92f95735a4fdb79f01a6266aca1c05a28eccfbc37e56df5a
-
Filesize
5.2MB
MD5de908559d89e5aa5fa01773115f728d8
SHA1d67f53429d13bbd4a0256ae4f2bbd0310a8ecc7c
SHA256236f7eb36c54a20855e6a03a52bd2817afb3da9adcce49c3261b2f936788cabb
SHA51273f13edf8338674dcb672a8df0d8c61ad8c9100cccd14657d2e7d8bb4cb555232e698968fd6390b1e1ffd2d3b7686aad2addb3018f8ff948a17049e3808536e3
-
Filesize
5.2MB
MD5b7e0cc358e5c699ca9b6ec09ca36990f
SHA10e81f0dabf789d479ffbb592b9b366660a0ee8fc
SHA2569ac151158ebbc106bd789ceea795a9006bd24791073440ab7d6a9106b0968a3d
SHA51262283abf6553bb820ddfd6b1133546311e336008a71871af6fb4d3ac4197e05ad4fe5ac9892cfb51058369274b14c0b709f52b151817130ee0f8fa6bbb342f9a
-
Filesize
5.2MB
MD526401b109d73b3683ada6faad40cdf2b
SHA1b70c18fa99a8f3bd6cf6dd4e0273a0e183990199
SHA2560bdc89e09a79868396329a25e22fc30a351ba56116c25a423c947b544384c443
SHA5128c77476a78c81945bab5cf6c17c3dd4f6d8b321a2a96629c3efa44152b75871dd8cc9ca04bdf1d8a20971badfe4da68add77211f614e7bdb1c5b2d9aeacc083f
-
Filesize
5.2MB
MD5c8b72027223573d6877a8ad57a01ce11
SHA1832c252e9ae0487fed1981fef443304be1ff0862
SHA2566dde1978eeba1f9022eed1f0fa304d18c47e6bd310cd888887164b9de06b9b4e
SHA5126d8a3bf5c0e0d77aaf431d647574c0688ce1ed494e673a1c9eb428972784c7be089c1a404b8dbf8d06d8952442adacd0f1b517e1bc153f6d3f478e563ccc8498
-
Filesize
5.2MB
MD5436e05d99458006073e78712b6baa673
SHA19c8384467dcbef1ba3e7164bb3cad3f1db8dfcef
SHA256159e1381a26fad0b73a00452c0d8d25879ddc2587d7965a747d73d4fd2e5b63f
SHA512cd5c2277cbfa3ca3558442f909557f3b35dc66b10f4f45ff1892da7aa49edad80ee83b480868d1a5d74403c0ef8da6861e0bf6b21dbac541245e760640aa40fa
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB