Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-09-2024 16:17
General
-
Target
2024-09-23_8f74488ba9e4346308dee338c2d06ce7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8f74488ba9e4346308dee338c2d06ce7
-
SHA1
35fd02d80e29eb6aeaf2478d4754885fe2e01561
-
SHA256
4c94cd1121165626a20b3a99798ad89927f30fdfc944d6186538d437c9ca00c9
-
SHA512
7df885e166bd4a5f51f645c973f963771d60b693394f0503c9a8cfa72c364ad01709d18d5b1ba4da888605c638dcc0cdd2606fb26d2a55271c2d89d054528cbd
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_8f74488ba9e4346308dee338c2d06ce7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_8f74488ba9e4346308dee338c2d06ce7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\mxSAloE.exeC:\Windows\System\mxSAloE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hkrKlPL.exeC:\Windows\System\hkrKlPL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCScdoW.exeC:\Windows\System\yCScdoW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZoVzWVc.exeC:\Windows\System\ZoVzWVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hSkWoxH.exeC:\Windows\System\hSkWoxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CUVbzYB.exeC:\Windows\System\CUVbzYB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sAWWuZP.exeC:\Windows\System\sAWWuZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\trxAJVK.exeC:\Windows\System\trxAJVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YuYOrHQ.exeC:\Windows\System\YuYOrHQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gByRMpT.exeC:\Windows\System\gByRMpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VpXVgqB.exeC:\Windows\System\VpXVgqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NuSDKhV.exeC:\Windows\System\NuSDKhV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IXJbRBu.exeC:\Windows\System\IXJbRBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XObzrSi.exeC:\Windows\System\XObzrSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghnJhaU.exeC:\Windows\System\ghnJhaU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FcyGGqH.exeC:\Windows\System\FcyGGqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tScGMqJ.exeC:\Windows\System\tScGMqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NErRaRE.exeC:\Windows\System\NErRaRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eKyHJfu.exeC:\Windows\System\eKyHJfu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YOOwcbe.exeC:\Windows\System\YOOwcbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqPWpgK.exeC:\Windows\System\xqPWpgK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59bc495a89585d12549d1b939e3748cc9
SHA1770bc75be1e2424b093bcbf82914214e6d9a3244
SHA256be44b10c21d265b81e7105315c83ef56d170ca5794d990e3292eea42eccb7452
SHA512a19492e6e0671a2e70008aae52592926dab5c72f7246b41c3240b5efdcc1a9658a7f118457be30145f0c7ba234d64e76e9bcbe96f64e4ca57dcb0abea32a4d64
-
Filesize
5.2MB
MD554e0bceeb3833c1f0a4443f20fef0eef
SHA113571e4f7534308d2a6a094134e4aaacac27314b
SHA256987a67db17c67ca157079e377cbf3ea9c6922ec42768b9286619a3c7cc10625c
SHA51260cb11b85ebd63dd6572d09246227b739ffeb91afdd4497cdffe6784ac03ee318f3b2e6b45f5b96c3d0bcf394bbf88201c835cbf8257f42eea5505b90c03864c
-
Filesize
5.2MB
MD5c9a7cfc1f741ae78fd5774d623ac3e97
SHA1af7331c8c90f0af823774587b84d8fd7d9264f6a
SHA256b3103c7c830ebdaecd10ba9f340fc18406b7ea2fa8f485c38f91c28bd732b587
SHA512f4fec56eef7494258bb1411de30f2ae8867bf730ee43bc02fc04b1484ce0fdbfc60e78b3c6040866ebcb3d32fa565909db3d25b080bb6d3d424ea7d1f35cbf03
-
Filesize
5.2MB
MD5db099278ae6327c8ba0c8de3cbeda004
SHA1e9c4ca10f77066122d0182f12a92a3dbc4209f00
SHA2560a41d1932ecab2740276b4b6111acae14892f6f0f66f4d34dbd9f382b3b6024b
SHA512e43c02daf985a1ce63adc942f93c2780c076f35021975bcd218559e335ac8b867a7605a8fb8dd64cc93c98b3ae87bb392d0db147ab6819c13e15b21603bd4365
-
Filesize
5.2MB
MD5e2e2437a2cf75e0ab739ed80a8cd8b35
SHA1bf48f5435889c6a5d8779d754f1c39652ec155a3
SHA25660292a587ce20106e0a75ecc2e48aa3a001a84a57df27e01e119bb80658d4a98
SHA512db75510db0f1d952eae0a9b72bcc9b180aac5395b6c8119df34b05b1001985fe8565b35f15e1d86f310bc736a11f4d310286512cbf54cb445ea3df25169fed5c
-
Filesize
5.2MB
MD52fca2ca9692a93d68ca7a0bb2b21aa49
SHA1c907bd22bdaee5cba1ca0527ec3f5fa5cb19ef41
SHA256cc8fde4b5d48cac01776889a2d1b82f04d08ed9c3676906062af7b6b26685aa9
SHA512f526aece8e1d36f1e8c7aa2a8f80201f140597ad10d58954eef6d5eb42686055c2c2f148cd12cc321536c7f1aedf035b993d2a7961e7650bb436024dd91c9399
-
Filesize
5.2MB
MD5f43917e77db889dff0da229c2855068f
SHA191de73978fde67b4d9f54ab24b2c16e9a3ea2a30
SHA256f60b9be7f69e2f3330cd1b06c984f5cdef17676c6ea32d4f8d663f184f1bbbfa
SHA512e1c8533195f69ce3ec269a17dbcce59ba1508a38c61458d5263adda900edf893bc4b4ea8fd7ee67659c0718eaa58db343621b2ab9373b6e23492f7fa583e6459
-
Filesize
5.2MB
MD5023172e7fe33dd48eb0372d60cb8c2a8
SHA130327ddaaa41a68b9aac539a6b9f0c329202b7a9
SHA256d73ab4886ad0ed1da6fce0833175248ffb1fb3b4a906ef22945f18761e30d6f0
SHA512a3a846b33dc504fa3139e2fe5cd7440b366abe2d010834d48fea6381b52a3cd98831a1a87ffb3937f8c5b44324863f787b2d2b38fa57065866305ee62e0141b9
-
Filesize
5.2MB
MD59165cf6920f1fbeb9d92ef3a6b230fde
SHA10e1a355fadaa7f6a4d10a543f87e2cf3822b6789
SHA256f10957de029b83581b5f441a9b18b9dec74a58086673abb08f67298cb34a991d
SHA512ce8951194bae56bd3e68d124bd5eaad970808f52b44921583592de07be4a1aa6b2280c35de1991589d287d0e9f8bbda5f27f38193bdbd429945e6244ae38c6a3
-
Filesize
5.2MB
MD53cd9d2b754609e80c810c8feb5306551
SHA16f51aeebb317730fa9f223601837371fc4f4b768
SHA25680cab15fc270f0b436d42f61c9843df040a02a29060967cad98fc79a91f18205
SHA5123d5d370ffc5a57ebb0efb11fad8c1aedf6adc9b02127f9a74441c6e266c2f1295dad2aa956bf6ef868659e7ab171c53e8f3be19f260683d7e67e46d74c2105ac
-
Filesize
5.2MB
MD52da5edbf0c6a33d2d0bbd57cf80950bf
SHA13e11716c623cfc102c96b301a4911c8daf9df7b4
SHA2563d67326f1891bdd9d9e5d3659284a47a9455058321d39fc931cfca4cdf4be3be
SHA512ebbe863e2574eaa215caadc1dc86710460d922a84e9fbeef206e45215410f6774793a07ecfaaf4df17ef53984e0294599be3e9bd80798f3bdada6841d7131d3f
-
Filesize
5.2MB
MD520ccf43c685bfa92301e4b3a8858f268
SHA1d48a4cfcc32a5ec297f73139d9fee214d9867226
SHA25684a13712fd3bc32d86660b32dc5af6c4482cc58d38bc9339063e21d8aeed622d
SHA5124593f14b2ec946d93649e869ae23800ed8a85676d4ea448c820f8b3ab3c49b330573bb092d29eb0930592d70741d33f38670d2e7856f07889a8440512ef74887
-
Filesize
5.2MB
MD5e4c3cdd90bc3e2a4f62daece224c98bb
SHA17240decfac4c88df779fa81d65bd675acd3e915a
SHA2563dd59877547eb96e32d95ff69fecdd463cfd9cf9f99d7c59c57274c434e8863d
SHA5124c625edd7bb555c5aa9eb385d61336b7141de174fb574d2e7c020f41b591efbff7ef7872fe1ef9e3ab3a055eb3eafbed9b97113c888afd65d0295934b01b6dc9
-
Filesize
5.2MB
MD565101cb876d26da04ddcd9bbc76e8cee
SHA1bcfaad99b5a4582193a9fdb77624c3e08d6d9733
SHA256092bad16f62b408a46ef64ab12d501e565d9faf7895bc1a93e29352ad8270a7e
SHA512f72ddb0e34b605e0eb022d996d930a262564455929f232ffc20695f9f5dd83f7402ba19544bf7fdecef9a4065dae510b8e7fa86cbca8cb5d29be96e358f63788
-
Filesize
5.2MB
MD5ba3bddaf4f139bd74c536bdf46368397
SHA181fb316671054899f47f2d07a69815258b6ba666
SHA2569c56485d1fa9e5be3bc6831962d07eafaf0c22c4da2b78415434b426c64075f3
SHA51227148fcc5fa47f4c11eb105d7ec654e6a73f2c9d43e98489e50941f2e013b8ef0337b2d450bd882b06b760b2c9ee52f741c565da007b7a257993c9d048865e08
-
Filesize
5.2MB
MD5119d16f6972bddc60f9dcb4d1e041e9e
SHA1af21cee402d03664f4717a530a915d43dc962f55
SHA2564d9c6486f6ec237b29d7ec73bf4491f6a1b2a91b09c86157c509bcc59dc90525
SHA512267aaf4ff217d6766cb480496da32db10e1a9540b9526554f4fb4579b46edf4287ca1d7a971b0de10604d71e3cc85ca370b46fbcde8a964733c2293a77052984
-
Filesize
5.2MB
MD549cd8ec591b392667c487530ea1eca81
SHA135ca419df0c2c904f9c494a7d944eb618c7a179d
SHA256e778a31ed4a2e4b9da716f0afddee7cb191afb4c9c624bbd54e116c16ae0ec98
SHA512ba2b133e220f997d0061c4734182927af9a0daa96edc4bd89395a8fd3b19fd3918e553f49f3127ff16d716fc43db29ede2104bc72d2cd591e36773c8e07074db
-
Filesize
5.2MB
MD5763d1505e73121891a86386a5853bb01
SHA1fb76c19e1ef957dc706005b9d32a1b08e64ed036
SHA2568ce4e9db5d70ba233a1e6d41a8bb7102bd31dfabc498a79c405c21e9c0a53a01
SHA5120fbb71a9ea2dad1901e6f2ca0ddd180f41c5e25f06965922482cbaa4a746fe05ccaad54fafa0331e50da3927048963168976dbac7615597d9ccf2e1e20d1140b
-
Filesize
5.2MB
MD53d0b2b9f40590415e69f1e27296a64bc
SHA114366996c7626f878f3b441cdf0988526c87e1e0
SHA256858526f88bcddd3502846b57da1459e88267784b224242d39b8654e625bee5a3
SHA51293cda4e5b20f293055b5fea30c2e5588122b875eef1f1fe619e5aca5a8673b0bd31c0de2b25b165f02976d5e20eeb64e5642a36cfb4eeee0f7c538933da32f46
-
Filesize
5.2MB
MD5d8dcd5d1bfe7449b51dfb5f78e1e01b9
SHA188775a7f484ac6d7594e066aca803d4a122d8c34
SHA25695c245137508a58f4125d1009daf7b9e101445cde5bc6818403e890a47b81ecc
SHA5128a09be98894897abb0187082464a59722e73df8485478160049d1b614c9519a13b6c2672248077dd8f076a9f273edb16e42bce2b15e2a37288d2f4bbdd4ecdbb
-
Filesize
5.2MB
MD5b7b7b8833bf528b10ec6b1e973f9fb7d
SHA164156e0717a5656649ec0c3eaeb83cb49f169511
SHA2560e15c45a1edcca53d94a6bc909d5acc57de150821eca76ca1224313c07301110
SHA512cd7266fd45fb3fca64b8e64aafb54ea31358c1c5029a5540624476f5e96a7ddc4d34ff70698283f45783e70dd4814988607002ee8af2f1f6628ffe0a5108c70d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB