Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 01:02
General
-
Target
2024-09-23_d3d285bbf6240839224ad1cc9ca7e943_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d3d285bbf6240839224ad1cc9ca7e943
-
SHA1
75f4daab13483859b9987fce849981913d8b71f2
-
SHA256
7ddb5d0ec919a82937cdeebea68c00643701aa0b6a18e7b8273f7dcd1fd8b6a4
-
SHA512
104e8e304b399a854ce37c4fefa54866b25f3609e26988d22a401f99676330d86983b15e20215c229e07500f500686e06389f4c54742ab7e90dd92703725b305
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lU0
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_d3d285bbf6240839224ad1cc9ca7e943_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_d3d285bbf6240839224ad1cc9ca7e943_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YyGbXPE.exeC:\Windows\System\YyGbXPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHitZUI.exeC:\Windows\System\BHitZUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CcOZvSP.exeC:\Windows\System\CcOZvSP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QypBKAS.exeC:\Windows\System\QypBKAS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKfCCvd.exeC:\Windows\System\uKfCCvd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HCXwEuw.exeC:\Windows\System\HCXwEuw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\avEYJwq.exeC:\Windows\System\avEYJwq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RaNyhKS.exeC:\Windows\System\RaNyhKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JHVxwWm.exeC:\Windows\System\JHVxwWm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nZOReMz.exeC:\Windows\System\nZOReMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaOAVLI.exeC:\Windows\System\KaOAVLI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PfQTLoG.exeC:\Windows\System\PfQTLoG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVjYHzU.exeC:\Windows\System\rVjYHzU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUAwFLd.exeC:\Windows\System\JUAwFLd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xcwCRlO.exeC:\Windows\System\xcwCRlO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\olHKxxd.exeC:\Windows\System\olHKxxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xCnIMKc.exeC:\Windows\System\xCnIMKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPpFzaP.exeC:\Windows\System\DPpFzaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrpumJK.exeC:\Windows\System\GrpumJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUwfDcw.exeC:\Windows\System\BUwfDcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CWBXxiV.exeC:\Windows\System\CWBXxiV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD561c8a9dd5092607fb4c47aa57a0f1076
SHA11f9ca3b339d4d42b8dfcd418914bd402727f994d
SHA2561e860e7a142b913d6ef756529ff7ce970e1ee860e2bb79755155346bfd449e2b
SHA5124648a59da91a704e1fb59b5e5767a9693e258ea602e7c46547292e3610cb58f2377cb5d29485804999bb84459d4d74896c3305224df4373b152038a68c97a398
-
Filesize
5.2MB
MD5c2a15af3f15e8c807f7aeae294c92ce3
SHA104be17055c9995f279a6a4f8bfb08beb9536cbe9
SHA2564349d0b88f25e4687e77a28073afa6dc5ad070b01dc0154d1191dadbd0ff5de6
SHA5127a06c47e8d0ace3fcb7ccd04478c44ffc2c99820feb8b859f5074d79676167573778d86774978bb9bd3919787abb58ca31c0ba122c1dbebb2bad8cc525549005
-
Filesize
5.2MB
MD58c24b0769d239790723311a8389e2310
SHA14ce5a8be92d59d360759af1f7aded21ce49d5db1
SHA256e95649ab86b021a12bd511ac0dfef1850ed98d26f5873a5a0c96efc953f0c3c5
SHA51290ef654c1384bbb5e8dac057f2a78bfdd53192fc5b8498cedc79e5ea212ced3967593c7a869dafd594da986a96b3c273df42dfa58c860440a3cd7673a1d00e7f
-
Filesize
5.2MB
MD5d45769e11d183b168db1f434b8dd2969
SHA1b1547d8786f978d1ebefbff0bd81c34ba87d9b99
SHA2567681550f17ff17ef2dbf76c4a01a05404517b93c8d778bc829b66a679f11247c
SHA51230d8761aca553d29c81fc3f9480b357290e2d01c709b86d2982041292eb03ec4dd38262f7cb9533da437aa103a8e566ba651ccab8b797335396f6c3182de1a7b
-
Filesize
5.2MB
MD515045a9c47fb1461e467b0c5961dd154
SHA18a2167c3032847d30047ffe31f86715c7f67bed6
SHA2560cb2a59878379eaeaebfe7f8cb63111b446a0da0601ab3244269f1e28c28ab9a
SHA512a6b0efd97d03587b4616a9534e7da5039f4cde19c2dcf3975e80c9c1755801b064c68cb60e66ef89738de588815e341f7ced2444d9d77d3917e7a4a845b4886f
-
Filesize
5.2MB
MD5876a939b09affd1a56037da22f91668a
SHA123be5051a551015902b3380839a31251acfede08
SHA2566f796f3ec484b6dc9c2fd4621aa5041cff5faedbe41dbada3bc38f997a867105
SHA512715a99d60874754770204c992819b25d813c63c2ccc78025a12f44a54560552cbfa65f78e0b9389170fe33001672c3763fcfffea1a7d58b5ade290e87ee23a7f
-
Filesize
5.2MB
MD5c81f669e37d6a59c155537b053352e84
SHA1a0d5f870df9ea3af1e6a017f8db400f6f681089b
SHA256ae2a129a5477c8711376820311e86fa1d200e13d5aab38f24649a387f7f92cf7
SHA5120a306f75217566fe7ae7b112adfdb06cb4df026839e42d90c423502a058ea6706b8490a3f9924baf5de024df83a90d1ef57ddc1a90acbad88aae1cf99c2f0997
-
Filesize
5.2MB
MD5e9aedfbb794decb15020ef9fb40f7143
SHA106207b231bd7e2b8660e40edfce1a375cb8f1659
SHA256b29fb2c91d3b0b2efe2281e50adb1b057ec9e470a1dc752b90fe2ca215e7ae83
SHA512061bd42129daf1f7da87082435b4bb0a8e0b09577c00a348291f09b0b19580d8380d94166a54d767f7ba1d6ac7b4844388b377b5a52a5e9023b83f128873f642
-
Filesize
5.2MB
MD57a0356e9a509caf2af647fe1ac65a54f
SHA19805c24216abd6583d7c546bf031328d23451c95
SHA256f28f72cf4059c236bda7c8115810765fbd75c710fde36a61bd6d695745f48319
SHA512ac3106695f07c0ce56091fef7eaa9f34a059470b70ad763a2cbf88913e23e8041058cf3b0883452e38fc51198dd13ea00bd8e44d046a8a09faac9d73c7b7a639
-
Filesize
5.2MB
MD53af4a0670597df7af9a556aeb290db9d
SHA1accf9eaefcd65f292493edb67d9bfef311249b39
SHA2562fd01577ed63553dcf551baf44a8cd20f9c86e49527a07a2bd64231b9ccdfdde
SHA512ba77effc34fe57544fcf2eb245eafe53653b948cfe47fc73dfab11718b45332e5fdffdc87fc1cd067a02d16973db83dd2224ace0cc0c1bf3d7bad1979d135064
-
Filesize
5.2MB
MD5ed9c2bd4eee5cfbb33a77d8d3adb1bd6
SHA1e1525967403ca4d271c9bdc907933e5ea6522325
SHA2566077ff705a02469c4aabf652434ac54b154a8b2988214354358058ff80830195
SHA51253036eac920acead9d3747f72f4e8d6a74bf2a2d5e8039c2f086dede843eb91f3e89350b67cd2b45091aab8820c76bf123bd263034044124e34c8a8cfcdf9bd0
-
Filesize
5.2MB
MD5edbc4f6ce65587f92af90db4fa37d5fa
SHA15d0085d190f333bbdaff4dec5cc7db19352fb1ae
SHA2560d21daa4d632c5be7fe1d91fd456830ae0d7dd22cd682d61e928ecacb394a31e
SHA51220da530acf4c447f9ed7de8c02dc04f168b28aa1b0958fc2729e58bdfb440c55b53d8008999e5ee3df4a56408fa9ccce8b58ff469bcf4468995cbf9e00fbf297
-
Filesize
5.2MB
MD59130accf2e98fca65d77cd79f29c03a3
SHA172a1f74859e1d4e19fbd786fe01d39fb16bf377e
SHA256fdbd83e87115ceb8118c9825ccd5eeac2b2e877bad9c0a77cdab7c7ca3cdb61c
SHA5128b81c9fc75f65c9f8d478b7da1d7d945386daef02e4b92568ffe0c98dcf3ad1b46efe1f96b2d0fe66c2d9c8dd3025effb61021a9e7ed52065b91ddf016250d63
-
Filesize
5.2MB
MD58cea4e0d55310e2fb8d3b5cf3e178ddf
SHA170646041377bbc92956c26fa7f54433078ecd7d9
SHA256a02e964040ad627f20911b04e8c6279f250bb41a7b0da2331f74c03a63afd09b
SHA512ac37d8a67ba067be0c564fb173885a0d088b82df98a980e9d0aa5fc0fa1a811d594d906599b35f05d7b4a8ff53b00ab648da2194c22a5a594c35eae6e245f47c
-
Filesize
5.2MB
MD5ad6cfa54d51b1ef2ed7d75723b701ef0
SHA1cc6a78a4f6e46e8a8e1361ec9af320b3266173c5
SHA2563d990706d90b7841cde6ca9731ffb152a28b731dcdd65c8888178b5bbaad0128
SHA512093d9138eb8125f6c749fd76ef2b64819743e03128fa0c86606b09349ee93c198961d4cb0e76cd8412c454e698616074129b7a718c01f22065decf9cd3da684b
-
Filesize
5.2MB
MD5a1a8094c5d7c042df855960d99179030
SHA158d35a306e19c35ee35af093b7ae5d88918a1a3f
SHA256ff2e22f8acb5afa055ff7c99b4e9c26194cce5cd1aa06d7d428dc900db04ebb9
SHA5125feed2ce1d243183301aead6999e2532a90c079e6db679658ff3b356df2e749e9c7a55345c0d2bce108d01792012be91fc31953c3353bd6e4c9a77d3fddc32f3
-
Filesize
5.2MB
MD52b7c6a8d14576a9530842661e7d34044
SHA1522117ccdcab52de9c76e9fb2b8f15f0e0fc55b0
SHA256139d1d59d9d4cf6395d4ef6bc86606d7d6da8846c4ee951acee229b9d76dd903
SHA512090608f02a66bf970e565a4affb824733e7c2e05b2781d895b5c06f7eda0c122a25b1020656095b4d5270d984b8b0ce589184d3a7e33b8e2898880d1d08204cb
-
Filesize
5.2MB
MD5313eba11bfacca497ca9e6087370d32a
SHA1749e77fba1e8152cc62961e22650d8751819ee80
SHA2563adc391e0ca221b47fbaa270f29efa209a068ebd8645c9737bd93af7def0a06c
SHA512ef78311ece49c6a306d9e30cc38f3e3b2c7df0589f085413bf888cc1ca52205e576c5b5fed2b060ea1fadb4b6b7375ce94b982f79e1df3fdceb9d0f19e9d5068
-
Filesize
5.2MB
MD5dcb03de2abc7470a9bc3b139bb9df4e1
SHA13717d6701f9a03d9171dfc44a79caabf20954335
SHA256506c172ab4d12fa438a96577a5a782987d1b436826528620085495f103877486
SHA512c74726e33c0123e6592bc246fb70eeadcd38641ad78fc1043c463a32c197208e7a9d30be9f5aa413013ef000a4023464f12ed9efeb161d27e219e439cf4f49ec
-
Filesize
5.2MB
MD52225de87d762cabbdec282c167e9828f
SHA1f40cc1b9f155dedc84ed70318c7386deb4165e72
SHA25653d0a2be925a2399046a4eff1773452068d3e3582f59e77ab30bd1ee819b9381
SHA5123621294e61b95a6358c9b79cf277e8041b342bd890a01437497781e3a3ced1ff67daaccd4cc550a986037970b9542295eed09a26908e3aec970514092e148db5
-
Filesize
5.2MB
MD5a5c6e0d3c2562f3d2fd671eb3afcb734
SHA1c4c9c59f01713712a206618d0c79408f5f892921
SHA2560753f4a0063c8926fb0957b8d4530b41866aebe55a4b06549317d02622a120f8
SHA51245cbbeb0404fca563479723c6301a38fc576220b6dca0bfd169bf023c48cdeebaca773757d95b398cad302aa31f92816d3b8ac95b90e6df6a31c2a4d931dd291
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB