Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:34
General
-
Target
2024-09-25_9a8d2d46d6a411513fc76b2522c1b1db_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9a8d2d46d6a411513fc76b2522c1b1db
-
SHA1
ab809d70f7d98cac0fc1eb310b648ed3cc693fa5
-
SHA256
d0b1ced72dd74838406ba4724862fea8cd006b4d3a7cfb18fa97a930fd49e731
-
SHA512
bd41d6b5445fab879555efc5070cf6af5d132273260eb9c22db90d1a8044e6a63f6d8d7e64a1e73f82ba6fd004a33a53ccddab4d354d9179f35f766dddb0133e
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibj56utgpPFotBER/mQ32lUl
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_9a8d2d46d6a411513fc76b2522c1b1db_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_9a8d2d46d6a411513fc76b2522c1b1db_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AejeqYx.exeC:\Windows\System\AejeqYx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJrXUfN.exeC:\Windows\System\lJrXUfN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HaeWqZJ.exeC:\Windows\System\HaeWqZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QBNlbYr.exeC:\Windows\System\QBNlbYr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uQjagxw.exeC:\Windows\System\uQjagxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jddbbmm.exeC:\Windows\System\jddbbmm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWGdFCv.exeC:\Windows\System\qWGdFCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OevtaQi.exeC:\Windows\System\OevtaQi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TcHZoqe.exeC:\Windows\System\TcHZoqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPqTCVe.exeC:\Windows\System\mPqTCVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJCWruw.exeC:\Windows\System\GJCWruw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghXsaiL.exeC:\Windows\System\ghXsaiL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Fbupvwo.exeC:\Windows\System\Fbupvwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CbgBDRK.exeC:\Windows\System\CbgBDRK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SQeUDvg.exeC:\Windows\System\SQeUDvg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAlEJsV.exeC:\Windows\System\wAlEJsV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZRubCL.exeC:\Windows\System\MZRubCL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGIzBoT.exeC:\Windows\System\NGIzBoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXRRxme.exeC:\Windows\System\aXRRxme.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Sfmcgfp.exeC:\Windows\System\Sfmcgfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNObAUC.exeC:\Windows\System\pNObAUC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ea30406554e9d94f891c92308af90b48
SHA1cb91b3766f306d9ca9866a268b4ad14711f345f9
SHA256c5da68e9f9a6031351fc5bfd72bc98716103857c19f5da4d09deddc8a6058b57
SHA512642c97de7bad647c072d652451035b8adc34ca379acf929d4598a5db0b50232256285d355db285a64b436111f75bf9164f58b38ad2f57f44adb418e6962a221d
-
Filesize
5.2MB
MD5f2eabaa9eba40b284e2a0e4413872759
SHA1db6cf58761b7ce1282eb9bcf499e17ecad2f4a15
SHA2562a7a9d836e27f52af26a4b297e825239b820be9af06a9451c717d369aff95691
SHA51297662f60388634be6f012e2f58749af76e3b483a1ee453353d579d83b78922a89cb345d103b5a20416a0ff21d54ef8741364cd5d3a72011e5a4967bc78a91fba
-
Filesize
5.2MB
MD56e282a8a561b09c6cc5fad8e98e6b6db
SHA1d979ac2e24a3567dbcf6b2a6533f878540451c9b
SHA256820efadb554fc0eeb565c4039af199b48bb5a8f56b7756777932bf09ccf2dc1b
SHA512e8b87184091e1d473af9da6f805e219a0ae4e7fdcbeda457aa8cd4c8dbed53d6a51ce93d26b9b3cbcc65cd022dea36e86222f975a3f29c80ab1b59e4f7d0b232
-
Filesize
5.2MB
MD5d56c365f98df74cee9a7fb6f5fd7dc72
SHA1047676b62810ef6095c239291ea413cb1b36cd20
SHA25688d0b5980a07ac84b8f3ea71a94ba1182e86e0e3789a8a3857e4579656e8c902
SHA51292ec7444200943290354a94a49b861a54878d95f744cf9f2c55c240e669b8a18300e17fafd836d328c5529d5f302b0ededabb2357e7e29449a7925d6fbdd6535
-
Filesize
5.2MB
MD5262d6bd5662b709176e8153b9044f1be
SHA15f9a6175f868985d107ef8702891c666b8e17acd
SHA256bcfc565239fa01cd7261ca1f7e1e3c878871c519ebd2ba010f4feaf2de87c6f2
SHA512225048719dd60c96ca6093dac3ee3bf3da83429a74923caf0d9dda4b2741b10aaf3ccd47ec8c274b7a0c99bb62b6c819a1e11ccd999ef74eb7250566fb53a7d4
-
Filesize
5.2MB
MD56e80616a0f1b40b9c6e087f9d2c16b9f
SHA130713a726ba9f2ad538190974044adf1c1c18e6a
SHA25691a7df306384690c74b1c2ecad7f22cf2590746ac5a9061ba57eb791081470d5
SHA512c1040646f5171c1d2212ebdcda9c563b65eb8f54f45f722228a8a9208942e1b65ee410710c2f3965baffdbaf0b743381fa90dbc557f9b1665713edbdcfc0b8df
-
Filesize
5.2MB
MD5525b4ecd1bcc70469d76f5d800dd03d3
SHA13987e8c464231517ad140a21d38a96885eec4e00
SHA2562edda611c1d5e5227fc2798d7b1764ed21c116127ea18474313d81bb9c6b3025
SHA512e812ac566ec5e0439449b003be7f01a51d38d34c66af17904a43f2c9146af5ebefe531b43070b0358fcc675e79a66157559792ed779595e4dd79b9dfbba19169
-
Filesize
5.2MB
MD544f19b24fda56f53abb1c60fff856fa2
SHA1546785265594b7f970e13063f33470688ef93f9a
SHA2567ca9b6f92877d85a17afecab0238a6dbb60d29bb4baf671759521dbab3fa5874
SHA512a4e77767575f408ffdbdd3e9f697e81118f27e68f605ec2db673fa76203858893d23c39e3366b2fa7175637588cdf56f76373371dedc5169f63b2022adb4a60c
-
Filesize
5.2MB
MD565e749e19cdc2d90d77f5de2f6d06ee8
SHA18260ee887a07c4570aaedc0fd4f19407b6804ffe
SHA2569b3c619c1595b30af97173f38a4d8d7d814c66f7b63ffa6533576792a2313ab6
SHA512566ee8c037ca1a4492aebfaa1f2eb0edb828460f95f7b13cfc2eca6ffb2816dbd781d100483ca2245babcaa4d2d27f37c32eb3db494c2714d2e1cd76e37ade8c
-
Filesize
5.2MB
MD59e522c2d293176ab57ee800745c40394
SHA1cb46ffb7a9749da8c40d43baabf9b29da0e9b3dd
SHA256399627711453d31371dbbe8cb4a2c4d3f4f67fa5a4f8b3faf6ec88a96c57bf44
SHA512bd8bd50e43d3955b4dc5b15576de8be09e0dec86d0d59435f720e8fe6a050e311eabf61c7fb0664fb25422f570a40cc8393af074a37e83e6ebcd51617da8f1fe
-
Filesize
5.2MB
MD5c2ed3e5590279ca26d1a1de74482cd0e
SHA1e0a80308a8983f6a7eeacbfbc8f583ff4630bba6
SHA256ad3689a6c3e9cd711e4cbf683f6069853ae3550a47322870093ab33c443a12a3
SHA512cb1e3331670cf273c1e677ecf1cf8d10f18a9ab9cc247f4f9a1328f2816004babf31b008e7e0434ab794dc3019c8394994eac3978a02c5715be71529333223ef
-
Filesize
5.2MB
MD5b01abf3e5fa40a2d9d4a6f710cfd375a
SHA14e5d6cbb4e6d950b6cae8ee541473dc6cf8185da
SHA2566fc98620d598b5cbcfcace1d2c332eef7e1c11cc834c0e073d45f64814bdb295
SHA512adb1e8e60c28f62a2fc4eea6245be278fbe51b4b59b94b735361f3e7b7adfe86e1b59c1dd41282c4dfb1480b532ad5b06081c64f255e6437fecbfac9d8d7d773
-
Filesize
5.2MB
MD53bb177d4bdd49a1bc3bd5700b996eca5
SHA1402310aad674c71707bf4205d376087324a4c6a4
SHA2566a8402878bab258f9b636a001faa3c4c05a95622f1cae0c50fc3c93391dff5e3
SHA5122017510b515e03f48baf98e52cbf25ac12158f7e14d39838e956dc3f1976ef679372dfbfc4383e87a6335d12e161b908822bf2fa7620454e59cc16ec39e5225d
-
Filesize
5.2MB
MD5dba21ec231acd974792f49cec87096b1
SHA1d3cbf98f175b150c36c9d132ce96e5e6a7fcac93
SHA256c6d4d476b329aef8caba96aaf0c79f4ea4727f21b19521641d17fa424f299533
SHA5127a7f22f5dbfc29b5307eb8711452e246d16841de5aa841a5b59ec53102f3a6bb54d686ce90aaca5292be5caf2ddd9180ca4348abb4b11d06c9f401e3bda27c39
-
Filesize
5.2MB
MD504af81ffb5a62e6dacfe94db9aff4907
SHA13353c0cd92a0657407e5599dcb14e93124a592cb
SHA256371a5eb9454416f62608e74cefdc8a2abf3ec6869b48822758dac5de0a9506f2
SHA5125a6460299580ac9a90fa8000a464baaba3d2aa43e249c7e70eab292e799e6a1ee8b389ceb828415ae04e1d15980e17c1bc0eb0ebb035d3e298bca23881e24f6a
-
Filesize
5.2MB
MD5b88bd6019fd48ccdba7728a9cbc8c862
SHA1b61cc8ba22716f5f726b79e71975fd738aa3f13e
SHA2568e86ad93c5541df9ef5dcbcef80f3dacfdc83de1c8fadcddab6fe0c10dd86fce
SHA512b92ef6d932ad844ab640eb41820f26099027982b3eb02304491d46107a560e18555e5d007f9baacc7729af2a1787b46328af4a83b85e1a84bd1a762a742645c7
-
Filesize
5.2MB
MD56c43d1ccd72e025741d4809452679af3
SHA181d5e32d806474f49b2656ede40b74e040fe2915
SHA25620e77b4cc4f8c925dafec26232132bda7258ec71fda8bb98637dc24c6d042b9a
SHA5128b59bfe40b5b19e1bcfc3d31c9c05a3bbb7abb7f458d17947d2a79f6361cdea0808b2ff2ab293a0039ae1fbab32ce1688321c3c91bd04c910d4c444585b3cce7
-
Filesize
5.2MB
MD5d33b29bb7e655828e5326aed5a10726b
SHA15f5e4e15f778bd67d7f8271f012de5ab899edb38
SHA25651808f2887b8df139b0a93500942081d1783ef36ae39357d15c428d5bd837467
SHA512b3771814248029714a73abaf8ab627c9cb23680a57bfd68a825f380ad5c99d1701d50832a635f8e9dc1ac275fad8eb5bb904f2baba9fc4d96b7c72331f6e48c9
-
Filesize
5.2MB
MD52b48e413824f86a4f32517115e2fe9ff
SHA16ac2569c01dc15e585d791369e8f122bb69ffae4
SHA256bb9fe60a4d0cf9f3f1ecf1a452f32c6c85d643bae0b0cf696c0ff9caaecb2292
SHA5123b84ab78f8613f9ba96ad6c6d60cb4e6181e464ad7d99939085daf8d5f4f6ead50bd1fecfd837bc50892cc2f12e9944257f9c7c01e8f69476fed93ffe6553de6
-
Filesize
5.2MB
MD5e056d56b08dbe4ae125339c67245d34c
SHA13f6055d1e40e6e1d290b66ddab41ac3774104155
SHA256244ec6a81ef4735b78eb152c3540d6cb0bc5d2aa0630f6e1a6189714bd60a48b
SHA51293cb2badd32b8edd2bcb5da2da8b10b9bdac17aa432764585f07d96132a7393933f6926af7b862202a114dc52533ca7407d955cef4204e8ca7e7996cd7acb5cd
-
Filesize
5.2MB
MD52ff026c46ac47d8f7e968599ef5e50bf
SHA186d74cd95ef75f066068e86f9fba97eca2a5fbd4
SHA256cea8bc81734eccf5001e6352567279c44e8b6d82880429d4716c6ff068aff839
SHA512d3256558fffddf7e216a97f0d2bd90e33d7abc1fea663652506bad14fc0f1a724e05adb8281e40f7e5a330c445b8b18d5784e8abfb0b1b6fdf1faefe5770681f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB