Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:36
General
-
Target
2024-09-25_b54ee0638dd41e55897b53d2d9af5065_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b54ee0638dd41e55897b53d2d9af5065
-
SHA1
3de9264c025730c639cc1f9a15e6ba3e458d8ccd
-
SHA256
5046053cb4eb2abd02efa11f08e548060fa0a86c10b7ea1f55ad5e3b5b3f6316
-
SHA512
90a5d39536cbfbf280464d7c070fdf3c8ed22693a475403b5470e07b2bbe5b5b4ec64131fc81cae2c72e8ddf52738bfd99830c9dccc381e351886f3f7a652ad7
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibj56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_b54ee0638dd41e55897b53d2d9af5065_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_b54ee0638dd41e55897b53d2d9af5065_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\twxsHIT.exeC:\Windows\System\twxsHIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nyVpVqL.exeC:\Windows\System\nyVpVqL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dXGJGXF.exeC:\Windows\System\dXGJGXF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXCvyAi.exeC:\Windows\System\hXCvyAi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsFxZiG.exeC:\Windows\System\hsFxZiG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZHxfCvL.exeC:\Windows\System\ZHxfCvL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ehryEoL.exeC:\Windows\System\ehryEoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzEcWDd.exeC:\Windows\System\uzEcWDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oiQOaUq.exeC:\Windows\System\oiQOaUq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kYPiqyg.exeC:\Windows\System\kYPiqyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGBErVa.exeC:\Windows\System\LGBErVa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUWUWAY.exeC:\Windows\System\pUWUWAY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UYzNQtZ.exeC:\Windows\System\UYzNQtZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdvtDZd.exeC:\Windows\System\MdvtDZd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ViCvrzq.exeC:\Windows\System\ViCvrzq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NbFPXFJ.exeC:\Windows\System\NbFPXFJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rYKMCas.exeC:\Windows\System\rYKMCas.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iCgnGZX.exeC:\Windows\System\iCgnGZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jAgYaXY.exeC:\Windows\System\jAgYaXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hovtFTG.exeC:\Windows\System\hovtFTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLMyAbT.exeC:\Windows\System\RLMyAbT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5697395a220d72ea25fba5403dd22ec4b
SHA16b657f195662c45f058e8dd63c30e7eb44772ea3
SHA25612445f0055cee2828b1188f5f9fcab5d9811df2a9577f173c8a4acc6b0f73f2f
SHA5121cf4ff509eea37b46d05ff5d99045d73b40af4df43a88d733a030220a538624772d886b90435c5c67d418247478b33700ac46822ae62bfd1e21632af314cfe12
-
Filesize
5.2MB
MD5f4f4b1c41d2162eb2cd5a0e7bdd71d61
SHA19f5b9ff29d2383c27289c4b85ec7ea40461920d1
SHA25655f31c578145ca09434213c97b53cbc40f37c2a36d5c499cb573b86e550ebf0f
SHA512a983a35654e048eb47d8d504d2d6c908fd39a5170c22d5509f4598cf54a70e84562ac159baa0c67bc907d47033cbdeec61d551bfcdc5795549a9838bc08afcdd
-
Filesize
5.2MB
MD5faa3b34ab5229a1a6cbea6ee765d88ee
SHA154805410e7a160edac408de60c0da019c2292a95
SHA256bebdbbef989712b5631192d5d5df3332c186d1c9714b20805f84787d1ac35608
SHA512cc0e0e42369379d3f551b2a46484db50f1d2dda035a2fdd04ec2efc7521fceb14d5ddc93efa7eff337014cb4edcac2e684000041f2837fe7dfe77814522e44e0
-
Filesize
5.2MB
MD5686c35f3d30c2ecc1bba1dd12da2b1a4
SHA1534bdc9a71edc1a50e8f27423a51eb1f0eb76702
SHA256e4c065e7b2e7590de041f5b9967cfba4bf418998dadb72757f4d046d3e3b9f8e
SHA5129da942dc1dbc18fe67adef3293c16ff7fcf26ebd532e3da20b5b46183ad44c1bbf064236159dd14ec5ccee5dfac55610dc8ff155482b0baf236255606cc3b16e
-
Filesize
5.2MB
MD5ae5f06ad4777a525db0c203b3983e787
SHA13cb8cc4abe2a4b6a1db8cdfadc6f80c51d5e7dc8
SHA256262a4c8d9bfde6d3158a5b53229734d71fd868e4f4d8a19aa4c45c096e2bf401
SHA512e97a938dc3f5f925250e2721d49a3ff9a394042e1ba1b9d77c5ca4caec49f9026418f76c8cbe7ecd2f29ba06c21f78f1ecd88f51aecf6f956ee06e0ffcff6126
-
Filesize
5.2MB
MD543d5d00cac613f208157f870586e2f82
SHA111a57c3ec4b5f8db97b8f95dc6603894aa523762
SHA256869d3d0d47029883a083ab38946599ff3a784941a74c0993f5cc3f6c0674fa0f
SHA51222518d805d1535c31cf29236d3554cda32394af35cd94968dbeb6f69bacde1b92d4e68ae6d84084d4edc3603356252f626ea7e0c05baf07033d23c9a11181583
-
Filesize
5.2MB
MD5ba412bd67469f1031080c5102f809804
SHA11c21bae29af9e12119a2e600dce653e9d72197df
SHA256fd5c856c3b468ddbb3447f6de6f8ddf31847353c8125d124e95f3e25a3033e1f
SHA512e3c170422f7c851ce87edf2c56625d747d3e5db278d4553f68e82e2ae676217e85280a560925e6326380ca69e6de1210aaa27aba48e3378ac9a1f2b931588b28
-
Filesize
5.2MB
MD583df1efb4e2c6256cfcb5c32936b1f33
SHA1618a28f64c53bf75dc629c99b0010e76a4e25fbc
SHA2561546cc96b4be9c085573ff841bb18ff621703cc70e46ddcf96190a2fd06507c9
SHA5121ddfaeada9887cece9168d29afbfc38ad2d38b61b7fc46c55ae179b8cb6c5190981f069ccbca25be778e96a123101e98c23f69c975b25047882b80dc858f663e
-
Filesize
5.2MB
MD5aa5475111fba66fe70544e6975c0d10b
SHA179a9ae9a9a412b8f6798403864fe12c79966847a
SHA256a60339262c75270a8a4ada8826e87dde642e1ad3dae79cac639f494f34998e13
SHA5127f41405454ac445d69b21d3dd5100897211a6ac101974793af44cfb5109f1684b9e9832109c8e3d04740faf57f92cfaeec96d515eca9b9980213742c2fefe7e2
-
Filesize
5.2MB
MD560b8a3f327e0d687d6c8d14f5ca3c593
SHA16733031f226573e3abb381740c89a5bca507406a
SHA256a053b10eb2c405b9c9f8f18ea082a71ae0ed4936fe507c6524e2cb5fc725d5a8
SHA5126fb055791b953af0323b318bb73e12a747544756e594b869d3886d77adc479d9eb701fddb41c57d78a25d98f02eb925125eee87688dd6740ddc02cfe0662d1ad
-
Filesize
5.2MB
MD5f7a8a2cbf1dbb619b1d6df4453f49b11
SHA16d1e7bbed82815b1b987787b4c97d548a11c166b
SHA25662d326d0ca31ffa4b2a02e1ede4814b566443b6eda0039bbae70f972fd5d739b
SHA5125499e372613255cd1a53a6af77335a4fd9293cdb09e1d188e64b40fc19e81a3d4e2e32ea91552aa3af370584a96112f680198eeb6fd476d1cff6e05e0967a7b9
-
Filesize
5.2MB
MD5508413d8853a8cb09fc52fd81bfdb6b6
SHA1895f4d21de76307c3b78cae93825d96e458a5d2f
SHA25623e9c10805efe6513dcd1f59d36294a0137d4d7be20b29eaae85230d88867636
SHA51228d5e914ce952ca6d69d8c54c2736030c33532ea13d3c2a6fec3898bdc20b695cc953a815b41a51bb96bf5b21077cc66b762d29c2c7a13264df0ad3fd9da9722
-
Filesize
5.2MB
MD54f0db14f24b3f3d1ca3f2d0a92ad283f
SHA15a6d8333e638eb8923bd22b95ab2845563cda690
SHA25608fed7bfa18c3cad7d89f5ac8f9c6276c5da42db525b565595312c850298b577
SHA5128453776b651e53fb8f2076f9a9dfc69b3e4d29e027781a861627fcbf14c8302085a171ca3eecf5e1692aac6e2b5c5ffa1802777db26a6a97f223c04aed331fd9
-
Filesize
5.2MB
MD5dfe476be9716dce491dfd7e71e4be853
SHA1c9cc0371a1d6c229dc397c514992df2dc381341b
SHA256b08acc63a3f6b864f0f1c43ae6eb5f9aa8b447a24ed92905e3a46590db541ba2
SHA51290e5cf4c1017e098098369e2a627c3be75c9064ca8b5876e339537e266d77c4e30a8c58808975c649a7a4735b9b1b5907b5be8733b4c6a4b1e79bcf5caae6e60
-
Filesize
5.2MB
MD5b02fd055373e25427d1982d4b2050c72
SHA111277a9ecc0c5bea7c7461796975cf2c1ab36a07
SHA256b0a7f375401e7d206d7ff75b35b64b4f3506c3e79b1ef0a640993d78e07b267f
SHA512106980b1c90362f0fc36cd4f55beae37b8ff00ee662ea68ded0439087431373b79e55d7bec360a8106f89b2b05167b377a91c59a2a848ecb22b49f18246b900e
-
Filesize
5.2MB
MD5df256cddc93ccde1b17fabec0330fb20
SHA140dd01facbcb22a866e522f5444765c4cc5d3d0d
SHA25622885efa5287597b693acb806e64f4031556c64a6e81a1ca3626d597ea5b1af5
SHA512c46390273e882b0c62c5e311852d00e98d96ec85b6873670883b1824de0fa1f7e5d510230c478bcba4b49b1000693d8b964e37c7c27993b3be332f9b54ec4e4e
-
Filesize
5.2MB
MD51d85d936cc474dcc6aeb8fc1fa8a4248
SHA1a685d9326912f11d06a59c63ab0c6c1fe8147a20
SHA256c4f3c2b2289fec2bd8c725bd1a40609d98cbabcd397928f46f6e0b9ab35e138d
SHA5127eec01d6d70074b678207bda0ff6c3a1f5b6f3d3ad5aa13fe15556465f12820f81180d03a30a0112627844a74baa49e97272f374c6049d8a336a31bd62c575f3
-
Filesize
5.2MB
MD5dede09799808590afb67b6acc0dbe8c6
SHA1c4fc022b13d511d7af531764deabe4ba203cf2cd
SHA2560e12ee7a1ae6faa07a91ed879b7ae2ef0c4761e0267273dbdedbff546c0c4a0e
SHA512b7339e599d2735bf14dd6103e12f2755981b2210f61de310a2b51bd56edf4f1ab6e0a11b478902870a7f8cf4659b37cab75c76d07df488629a59d77ccbce4c71
-
Filesize
5.2MB
MD59a4f1e099cbd828eb35d1734dc7f6020
SHA1f7d27cf940ee2a925baf2253781653704e304fed
SHA256dedba9d66e0515f545aa482e284858dad520cb8a9ee448ff002f170d8b9f64ec
SHA51264323ef80393b2e4a1237ebfa6fbde5b36188603a7ac9e0b0b83e577d77ff30cce55f63ee05fbaa1d94bb5b9860cda09b2f1b1add0c1fd5496ba0aa347ffa746
-
Filesize
5.2MB
MD5d1f0acc2a0c13720b913555d61c56e8c
SHA170179792bb71b49bf0fc2c0c3ca6007ad3dbd743
SHA25631760915ad2d703836f3fbca67797b5350f9cfbc62919340b05016fb330360c2
SHA5129aeb9d3e2835fd01167a644b390391d62ca5fae4f8cb5cb07dcbe3a50d2c3efab99c27b9a7e67a6fb2f361dad0e35378ccc0cc05b5df8ceeedd4e5028412e879
-
Filesize
5.2MB
MD58b7fa218d1cf1165b929da77febfa854
SHA150466f57ad33b943d57cf629a5d2e30ae0e2aa47
SHA25681ed171aaee811cdf5bf16acf3d8f5f5f01750fc0cc0316e797e46ea249a440f
SHA5127988be0e293fd93fc7a03a219a0a0396ed10281e207e5e522c158f9452ff7b801ca660adca7d47ebb00975c243c7a47f6f01b41f507f5233e1364b1a47aea3cb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB