Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:37
General
-
Target
2024-09-25_d17ec8701f6774f8f267e8e0153a28f1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d17ec8701f6774f8f267e8e0153a28f1
-
SHA1
6a2292d7b93b1360544f8f977c4be4b30788fc72
-
SHA256
26599253485331f33e906e0fca2d46e9d35f9bb00d2f9d99fce04162bd608f07
-
SHA512
7205835da72db1ea90643411ab40bf4333450589783534bcbce7a2a2ed5b5181a504c21991a78d563b977f16d031b26c248b995ca2020c98559633000ec46080
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibj56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_d17ec8701f6774f8f267e8e0153a28f1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_d17ec8701f6774f8f267e8e0153a28f1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\KVKvYYv.exeC:\Windows\System\KVKvYYv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uzrLoNZ.exeC:\Windows\System\uzrLoNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UFcDDcU.exeC:\Windows\System\UFcDDcU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhwFiIk.exeC:\Windows\System\ZhwFiIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WviQgPY.exeC:\Windows\System\WviQgPY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmFRYFO.exeC:\Windows\System\UmFRYFO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYumMLk.exeC:\Windows\System\uYumMLk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTmVWog.exeC:\Windows\System\pTmVWog.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IwNmnwy.exeC:\Windows\System\IwNmnwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pwuUBUg.exeC:\Windows\System\pwuUBUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YAzFugK.exeC:\Windows\System\YAzFugK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RZvtwYs.exeC:\Windows\System\RZvtwYs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDfsFeD.exeC:\Windows\System\kDfsFeD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qxXBJrw.exeC:\Windows\System\qxXBJrw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPlXojb.exeC:\Windows\System\PPlXojb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ULsuDOL.exeC:\Windows\System\ULsuDOL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJzSqeF.exeC:\Windows\System\KJzSqeF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOrthqk.exeC:\Windows\System\aOrthqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\csMwMdU.exeC:\Windows\System\csMwMdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfczUKl.exeC:\Windows\System\qfczUKl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyPIMBA.exeC:\Windows\System\SyPIMBA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b1991b4729677e5669bbdc2210701a0b
SHA1b09f770a5a09ff552c72cd0f2d4134dbe2bf8192
SHA25601e8c7ab8e787f97cd3d1ef623e830c703c9de4dff4628c70d8845261677e222
SHA51225c6bfc3683358941a20a8866a443ffdff1bce72e7f80531561a98a4b9ffaf802be2d8b0e7c3ea0d70205132c62f68872b9b29d30896ed3a68267daa3aff6657
-
Filesize
5.2MB
MD5ecf424fc18e06a3f9a3c55f365de235c
SHA17ac8fb2d0ecda5cd2b805f864fe19f8cc44589cc
SHA2561ea03d4c9ffcaa4b1f822e5c0ace732abd20519ad491722cf9147ff1dea60620
SHA512e2e86da0446b1c6b7c3c5f05239660d91bc0c26f82408a9be422edef09a1eaa00d6e526117b58bb932ad43be91aa292f86904dca70860ceead6a9c1c97515de4
-
Filesize
5.2MB
MD52e781df83dafd15346a8d871b4888fdc
SHA13744058ea9ada11c59ec8634aa7b2290cd7a3882
SHA256a39708159470d7d40d68390918f48fd793d8b28b5ee2aa25ef2be222bcff2490
SHA512a9d0f6cabee38f3c11fb68ea077b766988fb2aa72ff3703bf03a3f38304abc219e3249af2170901af1bc596e2cbe15c971eb09adc4535f95f64197b86514da74
-
Filesize
5.2MB
MD581106aaadf5e37e7fb17d5cd8eb3f2f1
SHA1b8bc22796169010a2db0401c3bb21581e45e4bae
SHA256171b1092f0c45df97d0ef9a7350e124c203e625db66d90dc0d421105c540b4ee
SHA5127b29ca4da9aeb59dc0e2d5c2c24d6a5c7f303b253c5cdf61d2ab47843bab71efb27827c2c1f5a8b67cd3e709c200f43124477b5d747586d49332a6151c3c2ac3
-
Filesize
5.2MB
MD5630b19ca1fcf90c5deafb896038a9aa7
SHA1ee6b70e87bfe873fa88448b8f36d5413de29bf24
SHA256350810031e2ad8e052fcba82708d83071c4fba4668e4b7657bd48c307d680152
SHA512c27db849e5c595daa1a4f11a40459ca878903fa64c83b565b0308c4e5306e97b55b3d20f8cdcc2986cf122b1257def63c427af8776f8686f75305c3cade5dcdd
-
Filesize
5.2MB
MD5e1ab19fd00eb720728b399ddf9b4efda
SHA12044a60f794a89959af11f6fdd248cc1539aebce
SHA256655fbe7f6746232ff4bff25c3f94c096a3b5fd6a5866735db1113ec3624a99b6
SHA512fb239953a0310c8747920c53d79f7d2f64825263890123b0aef30c6e717c6438cd3bf86b5b6ce44aab7c37d6449ac6294d7b2898107cae92a05846fd15abaec1
-
Filesize
5.2MB
MD59cf3173024725f22b61428d5d97d3e0d
SHA1c47b98ccc69f387736e28f304efc671b9c7567a8
SHA25630e38a26bd140da811df653ff482444f3183db68bac56b3d9a377338f945d722
SHA512ca48ebaec51e42c6b8de1057d3b9fc1342a926bb9d9842e8ed9450d9b55b50497e8c33db41520e78ad2a337377c07dca1bcdefb0f86d03fb20c0ef98ac60e5b8
-
Filesize
5.2MB
MD5c9fb071dfd9cf6a6c5fadc44486b38b3
SHA1cc082dba6607e6ec8b69f8f6e88e54464bb9bf6f
SHA2569dcb5ab5a6bee8567cf338c692f1291b75568ede5943f638014134f3a78011d7
SHA51293e9c8556dcbb7a959c8303b34aacc5f3492494f6363c03cdb4356cad8e80488047f5afee8f1011b824dcc595dbb0e9f9170601d762a4911c1e6e9110d911402
-
Filesize
5.2MB
MD53538dfd80c4153933a2d7c03d234c653
SHA1886669d343a8b84144d1339965f4a520ced202b1
SHA256c3cd473a49cb60e20790fcd5f749d728b46f61f3bfd35b29e09b10fcac638f28
SHA512a5463ba819863297c900c90dd6ef84191d154371d1a30a5b1956c306b3af32ba8770c34ac9783a123acbf1c0591f33e2ad1a53952ab0a4e2688ba6c464b92cdb
-
Filesize
5.2MB
MD51e4b264ac2e5ed2e4c0a58647bc7eb69
SHA1eea21acab138290c3abef80f825bc58d189d5d71
SHA2569c5ec8dff9fb2f966a8ffe71a4b907f84e5d9535277a34d4db78a14008578b61
SHA512ba001d6b27377b13b479a8abc81cbfad1f843a3328f97400885e3b044e4ec997549c132aa691bcc59248486e8ef3790e304744ae9c4b943aa12ac261935eda52
-
Filesize
5.2MB
MD5020cf89a6488f458c25580703d7d7841
SHA167445ee9cc270b0a8a62b106ecfe08ad02b16b31
SHA2569a202fefd159a23a3ef6fd77ea454174a84eb44272c5b716b1fd0a1b37e60818
SHA51244163639fac010819d375a6a0efb0529515264e680238d487903397016f764c5bd045fa48ce3593607e07125f3896c9d3768ce789fb1cd603eb523b94331b72f
-
Filesize
5.2MB
MD50e15a4b90fa5185acf9e7167e2a53071
SHA114043cf65426ffee956ce6f2e547c776a28dc273
SHA2564c39be69ee28cc05c894e313c444f3a578cbc03fddc0f7a7e42727a0b7fdf3e1
SHA5123c3f64d7513ee3b262e9fc1a9cd4850b947a3b9d2482be8ebd6cfdce56d3c30a9ff97f4454e842c154a1e75afe29f088d06c3b093cfc0a8c99a8a5db474eb01e
-
Filesize
5.2MB
MD5275f62e1fbced11d62faf74e70ac226e
SHA11ec797ba0a4e30399c39093ac42ff50cdfa2632b
SHA25691c6ae050f1c79fbca29a191f06789eec3e1e23e186deaceb0d9e8e4bb8c6db7
SHA512bd517d1f84853a8fc894516b3f571c1172c1503de3909183f83eb162fe67b49e7b9d72bcb6560baf92a59a31f01a41bfe8f3bb8affec72675e04411acff59eab
-
Filesize
5.2MB
MD5107ce6194a992c28736ad3415afd92a0
SHA16c2caaad3fa51c193fbec3f20bef107e6900c45e
SHA256a5dc8f303445c3986668a759a19f89d184ddebc576a8535100bc22ad94bc1bfb
SHA5129d6f05e48f4267e59aea16e6989c5234723a1bf1d9275db2e6e279719cea4796d0ddc8738b5e479eaf0da9e9de78dbdd644c9d29fbc6eae7c8a9436fb7f2f13c
-
Filesize
5.2MB
MD5b621c30e08879c22dcb39856dde8f7fe
SHA1d0918c1a2988a0733ceb63575209a8de969d677c
SHA256e4470711784e6def0866506968315c469a3b393000322f499eff0d0d62bda56b
SHA512d2882e0addcfb680020ed91cda0f265aa7da5ffad8fab1f4592a75e126405df9eadfe45146514937f9422aa00c90d10f4a2bf4a649fcf77cd0ab73472f10f0f2
-
Filesize
5.2MB
MD5de6bc0646813cb012e44dcd0c29a3394
SHA104ace5c5a7bea58be86d0d4193bfe2a31f5a773d
SHA256d97ba8a16408d7e5315cb25351597127f27a19d75b9d34e3a33b19c8a0c93f61
SHA512151dfeecda900f04c269d03f049da7484fb35288d3dd3f10e18b318dd1418a35e91ee94e72d2234d3626e5a940fa64d2f9b0fd7f3a1eed9f485c942dcfea059d
-
Filesize
5.2MB
MD5b9519d67a8c76a9e9e30b075a5e090e7
SHA1520f63d10ef9bef011bc1e0b4ecd1823d7d028ba
SHA25630c807b041a2e6d3019b5189e623cc2112f47223055c17a99eb011798abf6ed1
SHA5124272185a83ffa35b352b38f63900c126418a89a8253a01220b42625819522e13470dbba5af476a4c1241497e20a7203de53da8a4f7c103def71cbb3bd0867d53
-
Filesize
5.2MB
MD505db10653923c960020c2bc2c92bf3a8
SHA1d61d065cf89939d26750807b94f37a7e3f2d484f
SHA25656140c130d93af627148ee2ccd8414b381647180a1bce8d24751514f3e6d42e6
SHA512cc4d2f792aa54c432655314f3d4f8bb27df5c6853136c37d5d95f3da35910fd04b9405aa3522d8866919fbbf71f5bbc3fcece86911cd9303e7d2a6c2494e892b
-
Filesize
5.2MB
MD5e3402dfc9873ac37f28c573848a6b34e
SHA10e0106bf4f9e261a5ff19ef105e3d4c57f393a5f
SHA256efd8fa2683dbac424db74c6fc3003eef51878432d1aecf8686cf343eaff246d9
SHA51236503371f3043552ee3f8f553d071c7ecef5a019df1939d3abfa73966e2b4f2bf67a4bf26ad3a14b0c0133dd483105103f5868a15719885c2574213a2f5502f2
-
Filesize
5.2MB
MD5a14638c174a7264377a184571a27974e
SHA1bc69aadd7ade006d89706ba51bdacd31240c9075
SHA2567faffb45d9148db48d0cb6f1708de6a47bd883d3a220c19a7221e45e7d93e1b2
SHA5129766711ab8bb69028bff95950951ed17d2604d934b5ae6cd4367f74c92477157025ef5ad205b47509ff363a85d2802a4eed567caeb79cc51ee1b6ce7618d416a
-
Filesize
5.2MB
MD588341143060208b38a5f18445256c0fc
SHA1077a345f0c7ab37d884b0bbbaed0e10609f9bd97
SHA2563795c9625f611b05789a48eb573e1a2164e8a5ceeb32487bdbd41612ae8728fd
SHA51228aeef32453e346c74d9cd692607fdc52cf3800cfa83fc1e2c44cea80a839609af5bf714f0d6ead58d7617eb73cc6677009cd89400ae7d038d382b147101046c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB