Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-09-2024 09:26
General
-
Target
2024-09-21_37e20ebb8ae1e4ac216ffef9051d47c4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
37e20ebb8ae1e4ac216ffef9051d47c4
-
SHA1
48743e8d78fc3d896a7e98097c9dedd03fed3d83
-
SHA256
f3a45bdb0fe93a4775e8f62538b1084401fb41b166bb8518dde97285a425c034
-
SHA512
0a338392d8586cb750c631b05f5f3b8ed2f915a2116599ba61d666b453393392a565c9073e569b7ce39ac0c05538451763e59717088d6f4082a4c79710df12f2
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUR:T+o56utgpPF8u/7R
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_37e20ebb8ae1e4ac216ffef9051d47c4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_37e20ebb8ae1e4ac216ffef9051d47c4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\phMXCbz.exeC:\Windows\System\phMXCbz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMDmyrN.exeC:\Windows\System\tMDmyrN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URbNKHr.exeC:\Windows\System\URbNKHr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UJpydIP.exeC:\Windows\System\UJpydIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EXJeOXv.exeC:\Windows\System\EXJeOXv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rOzJXeR.exeC:\Windows\System\rOzJXeR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zgEGDWE.exeC:\Windows\System\zgEGDWE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LIszgrW.exeC:\Windows\System\LIszgrW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hZEYPIu.exeC:\Windows\System\hZEYPIu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uXOiMDz.exeC:\Windows\System\uXOiMDz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvMjbwb.exeC:\Windows\System\YvMjbwb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\itnzCXt.exeC:\Windows\System\itnzCXt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gDcUfcy.exeC:\Windows\System\gDcUfcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WMLyctG.exeC:\Windows\System\WMLyctG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZicUuqC.exeC:\Windows\System\ZicUuqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilJWIJz.exeC:\Windows\System\ilJWIJz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqfiKEa.exeC:\Windows\System\OqfiKEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEoSRnH.exeC:\Windows\System\fEoSRnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OTcBtCN.exeC:\Windows\System\OTcBtCN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ambeNEu.exeC:\Windows\System\ambeNEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GFuSOkm.exeC:\Windows\System\GFuSOkm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52649a80de4a818dae6e8137e0eb58915
SHA18aeae28355dcb8d6e4626d39c8411ccfb34ae56d
SHA2563d03417e364e48eafd6e8cb4eac25e586ef1356fcee8b142eb3da6ef7efa4d7d
SHA51287eff3d31564f47515f4692ace5c7dfa7d1a88076024487bfe8ee78dc3ff23fab735452659b9e4d7b4fde34098b6638fd47292d6475a2a226d92a25eb221af26
-
Filesize
5.9MB
MD591e025f533618bd2401dd12e118a2fe0
SHA1673caeb1134d718da4312e7a10c5680708311f64
SHA256f60b0a616b5ba228c5dfd9437dd8329fbc269ef12e93796476c0c815b4f3c3eb
SHA512bafdfc28724e8003285049b6c270c339467ededd4d31bc1dbc6031b2fa46f42d67d24d4894c4b49682836756189c4f62aa0ee5eb3de1009051ca6125e4f12cf5
-
Filesize
5.9MB
MD543186ea176956a7c79c811846839c89b
SHA1df520232459a8312631b346d899f4a5948fcc78f
SHA256a17dd04117680768399ddd65865e5671c5ec773006cafcedfe40d76d2b4df91d
SHA512d6b781844d17618068b6d13e94b4ac7ea0f2911c2e43c093e469aec62c301116238f5fb90d50f530b17895733c6320fdd7f912e21425cc3b647d2885dddc55d0
-
Filesize
5.9MB
MD523e8981ce2e7c5b5518af48846c237a6
SHA18e52e7296d9a0a6eb1c1a171fef30696f08816b4
SHA2560d1b7233337fc344c76d18332a98a0cf88ddaa790427793c602948a989624c71
SHA512b17f43587ec01be00aa9122fa39b71167b0aceb159f53d8e21ba97f4b5ce84f293de6a6382cd21139932890269c4fa401f5037ad13b9de081af8a2f1a927147c
-
Filesize
5.9MB
MD5cdd10aa74f9a00ce526284b702ea9f1e
SHA10e8b341344d3c33ecdcfdef2d3a707550a240eb9
SHA2564114fce5c957eeeb21eb3a64a3d0c3d09aca2c939a709c4bb87ebc834124a58d
SHA5126e4813f4143f13d1b3d28296af7913fa21238c9331489d9f92b2b13a165641783bf58ae78f402e499a4056f214b24c23855139090b79040cdfa254b3ecdd4981
-
Filesize
5.9MB
MD540a580d5724f9f334efb0255bd9488c9
SHA163cf845af6d4a3627a613f277f0b3093ca54d61f
SHA2561ebcc37084f28681ca837cf532a61ff98b988dbdbc0d94113d0c4590277320c7
SHA5121c1a69d1c4f58704c1d4afa179b1553dba6f025bf1ee54bfb58a1fc7210b995c67ab735bcf8af3b30e51299dde8f9b0b73864f78e082e03db2bfab9e3882d896
-
Filesize
5.9MB
MD553a65f66e27c622c22756ec4d99eb340
SHA14ee783a86f5c5d5ed1002153eacc617c53c9d26d
SHA2562c655112650f0f9a75e43289ee9227dc2e085c1b95ce5978acb83b9b4a2f5e27
SHA5123aed9489ff3831eb199c11f3df23a885d181b731728c512336f23be60d34bdde017f14c672279270155313fcdfc08b3a8621770b9c5df3b747b6796479219c44
-
Filesize
5.9MB
MD510c62cd1cf78c548f19b95cb555f8da0
SHA19054f544208dd5e06329bb0beb2db4c5c3780310
SHA256b76b43681d1967a95ddc44ed3314dc71f329a8fff03946101049e5e29c07d284
SHA51202711e872ab456a222c14f2ef6e27d586432362d47478a5126ea8a6395e5cbc13f69d1ad1ef1e8499fc3981f16095f1d07ce089e67dc82bbffc631615552ef50
-
Filesize
5.9MB
MD5954e34f94c980e0ee26560aa2c5704d7
SHA1bc832beda3cd48ceedb2f671cd411ff4b90e88ab
SHA256b26a1715eca577f9b19ba27d9c226cc0faca5499010b35dd5d48d11cd7a9595a
SHA512199c330f37644b06db08d282758cae83377c64c6b7ef74e56c91a2aff3e1347e4e2396865616162bbfcc23f67ec005f0b9e645d366bee49b6647e1508e26f005
-
Filesize
5.9MB
MD5990c2b55edb465a9c8bfbd61b3dc930f
SHA12ee542e3a499b50805a9174ab521a868e5048977
SHA256ddafce1489099ea8188fc66ad7c2668d91b413bcefee2b1df650034cd0ef5246
SHA512545d9ca12420532de7af0dc71aa2d6b3a48bb24b77bad795c30559089ff3b21f7462b71e3ed29dfb70847f3a504f1e363d839d4a2836c8fd9653f88f9e59e47b
-
Filesize
5.9MB
MD5068863bff0835ca08c194670a863838d
SHA1f269a44287a33cd17c48d9022981dec20f049080
SHA256428651598087f8217401fafdb963123563a8eccd213b6bb53630c5683f8f5e89
SHA5129fda3415c06ddb5be12217558a72d7728a9f9c5f445c5e05ffabbcefb37328ab7e0d02d9af2b847ab2475f9ca27e30beca20235c4cdbc732d458827eac9898c8
-
Filesize
5.9MB
MD5e596f1c8f2a9f213a42c2f16a53a7ae5
SHA19003375b5a2b65c05ed5eb91227c6cdef40e6f78
SHA25613a68962597fa10a89cd27d248f5f662d1839f9bb2617af7e1391dfffd4f6c57
SHA512a4668d088bfb92625f38dc5c4920cb117850c6036bf57a2d5f52918fa73bd2b6ca6b01fff9e48f8274eb65bc2881c798663a5bea8a132dc2d9510420a9a03494
-
Filesize
5.9MB
MD564e71cf551fd89a3fa9d02d3fb9d5214
SHA17df6439ad6a721b93447a408e6dd2506e803bbd8
SHA25677c990fe00b16d3d95363a0864bb45d50797addf6ae43888c64a36b0f86f4083
SHA51293876ed59201d6efb01c2ce5ea32ea2c253a9ea3fcc4645600b2b4dd8299c11b34f3b434d00facfca3157508f29a444b25b77ccce62ab7349decc39c7acd4d8e
-
Filesize
5.9MB
MD5cb5392a5041d2ca2df60c4bc2927a318
SHA10a68afeb98f1d03deb0313364b0f716ae15919ba
SHA2560ce42032de3bc901b48636e065b22b3359764b2d51c64a39cf11d5852f6dfad4
SHA5128d8a12a4b2cc976331bc595b0bf41d2e05170e477a5f01b5c2eb3ad306d0294717c8b3e4350fff0b77bb4b354c8ee54949afa6a23b43a70d22423bdd534759b5
-
Filesize
5.9MB
MD5c3685442dcad00563049f720a3dcd7ac
SHA12727d2f45363be866ca0a401125b4994c2bd0ab7
SHA2569ab9ad7e74adf9d1907d71fdbac9e6f886f1ab8b9b283abc5cd3b156ebad0817
SHA51263091ee9158d07822b92ff120546f8bc66c5374090f1c9fa482e4b78acd433788cc6965676d13be952cecabb10e722b19f502508f4819aba07aa574e51f1f344
-
Filesize
5.9MB
MD5094f6eea4d1abb8b5e5fc6eb2a5c2a56
SHA123fd6fcb1a699df560e86b7ef1e72805cf01bdc7
SHA2561ada9907b47a85bf5f5b542b719928d22f3b11e1d554c38527e86e1e8ef7aa4a
SHA51206515e044281cfdc3d9ab9ff09c6dd7644f71072d8589f2c2556198d27ff4cd18561ec8c64b7de1a7f78189c4981897ad4da4b6877e31b674ef3c9a1beaa7b60
-
Filesize
5.9MB
MD51792ca0e576f942028f47dd3f357e79b
SHA1fc8657cb79ba4917eea0ac148822fd43508667ad
SHA256c77286673fc722da481ccfbdc5a46e0edf981dc260dc633336a9291a17467206
SHA512fd7f07bd04c702d8ddb6dbf7cf31e9604395e124301ba770a422d2da964183d162ce6cf8de67e0ba892e3c82f60bcfa83dab1348afb1401518f0bc50b24d9175
-
Filesize
5.9MB
MD5fe484b3a338786dd93551264aca05287
SHA19ad1519c2950abd910e20f9a4a045262a23c80ad
SHA25607ac36855bdd4348eadaa42931cbdd56dfba2e64fc1e0660a929d50905c656f2
SHA51294c639426e06d9c99f5835868c04d52b110d917c50a81dfd23823462eb1d23a25e42c8f1a5e6476c94ea7547c8457c4435a692b99a2a2b1f9601a9db04385dc0
-
Filesize
5.9MB
MD51f3492c9f562e4389a4daf8fe675a984
SHA1b8e8e8f6f39c6545fe72d0a574677f08e6232bf1
SHA256f33e5a67bcec407b62dc68897268d3614dc23bf2b83810eb229c524aca88f213
SHA512a79f092d2b9fd3f0088de4bec9fd5bb02d445f221fe42772d73b6964e77eaca237434003bd3bc0b879739975a609928f8c787e3bddb08eb05ab289db266c5901
-
Filesize
5.9MB
MD5455f2c47e8204fd5d7e3fc49c6571c7c
SHA1ab54b7cd5f2ffaf90d680c7c5e5454af580e7721
SHA2564d8dd2576947ee0333c6dea9208421b181fc045e55631869083b06fd4118a6e5
SHA5124fe8751b117d43c4a7dbe5853ae0c53813a62d0eacf98e28f46a5e652e91dca939127715c8e09b44d81d65d59d829767dbd1103dd9ee7aa8f35c7421b7d587c2
-
Filesize
5.9MB
MD581f6ab5c203adb147ffa4ad148f506fe
SHA1b0b21025ae4470988e78f0393fff8725aa6df8fe
SHA256a8e4c0184f6691e64ce5781056ed9afd7081054770e4c12fc52b4c6cd74428ed
SHA5129fab54ee92d679b8cbb803035e957cf8da697e4e8bbfbb7a52ecc38aff5f3726a3fc4c64f3d986323b6aeb4ab7beff619b1eacadf1bb3a7dfc4aaddb458bc96d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB