Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/09/2024, 15:45
General
-
Target
2024-09-25_388331c407977be153036d0831c093f1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
388331c407977be153036d0831c093f1
-
SHA1
874485310492c6603b6a977ef75e782616ef1e6f
-
SHA256
c43eead33d8297f81c9483bdf9be615c86868fab45b61b929051b24ac8da2fba
-
SHA512
afd316a535ba29e7aef40afb1b71547b1f46d3b53ed7984d70a3154eadb2d8e1652bf11ffb4bcfb85d6c377ce53ef4335d514a0b62101de31f431751be87f90b
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_388331c407977be153036d0831c093f1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_388331c407977be153036d0831c093f1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kfmTlty.exeC:\Windows\System\kfmTlty.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZMPHrZY.exeC:\Windows\System\ZMPHrZY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHIwllx.exeC:\Windows\System\sHIwllx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YfLFAgR.exeC:\Windows\System\YfLFAgR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KlcpGNe.exeC:\Windows\System\KlcpGNe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PlEUtII.exeC:\Windows\System\PlEUtII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SZEuVxJ.exeC:\Windows\System\SZEuVxJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oHTmmck.exeC:\Windows\System\oHTmmck.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZUhfhnt.exeC:\Windows\System\ZUhfhnt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrzGpxN.exeC:\Windows\System\zrzGpxN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmbzlNM.exeC:\Windows\System\FmbzlNM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVGVBLt.exeC:\Windows\System\TVGVBLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DqtpsIf.exeC:\Windows\System\DqtpsIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ACwpxgt.exeC:\Windows\System\ACwpxgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RcsrGFx.exeC:\Windows\System\RcsrGFx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\syPNsks.exeC:\Windows\System\syPNsks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HcegDgU.exeC:\Windows\System\HcegDgU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hBHcKdw.exeC:\Windows\System\hBHcKdw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VmxPEQj.exeC:\Windows\System\VmxPEQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IxxeoME.exeC:\Windows\System\IxxeoME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljfxyBv.exeC:\Windows\System\ljfxyBv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56e802e3597a5ce4fdefbe71c377b99b8
SHA149f601e5627b734ed5f756882244a06c4d4f8dbf
SHA2567072c3ab96352d782b37cd3e034a15b9c6c6780a7a7524331571c469dd85e06d
SHA512fd4239855f1f25d981f5ad31baf686b2da46ce4cb6c2707d928444640d84fbd483829ef131e63b0035454cb9397145a9235991035784ba3289cb672decd86276
-
Filesize
5.9MB
MD56147ee44191fce2ba0d1adefce362d44
SHA174ed11f94d6e279b1ef032ef319f99238bcd986d
SHA256d606c127a4a49acf9f3f017a26e2645faa121fffae6d834b327f1d4debc6d6e2
SHA51234d6ff4b567eed7e7cc3d56aed77315bff48e206f67f63b031337d3f3cd95c427018421373c846f9e24719171807454f9602713ef672ab8602cbdb366629d935
-
Filesize
5.9MB
MD559aa8818859b89fa0cef9cba15c23349
SHA1d67e7794a26a2936c0d99448c667538a9d72fa1a
SHA25641f89365c5429973bfd7e0297f262204041f09d80b84ca43b2f5843765878df8
SHA51202b46048dad7a306f55ae633c1cc5a648ff6aef9d5ee8b594158c82c8641e400afb1f2f27f6108e520c29124f5f59780c1ecb301779cde0f2fcd73cccab63fa7
-
Filesize
5.9MB
MD5b357a75d8dc7febc6ae701df41571471
SHA184777e89ea95f0279210e13bdfb64650805cf134
SHA256edeb836a80e37937407eb3a285bcf9b2a244a997ed43c7f15d3458013cf17410
SHA512750b68ea4b1a048e9b4dad7307925e3d52f0a196751bb8ed64aaa9c40922f5eeb196eed1ad65ab33e870dfd2ddc3a885b6ab1d5148fa2633a0169eae5af21955
-
Filesize
5.9MB
MD5a192636e58f0dd5c59391c2620bb4cad
SHA10118fb5918abdb2b5705abf948384d24f6108d87
SHA256ba88df01b7aa8f58efdf526717b3491a3ec8e9956e7c6ab9067e1815fcebc9fc
SHA51204f0ccd2fc1edd97c4e2767cf3204dddcaed038c1d392c6e3e322e1526227aa93caf5960e1a4f57b0ce20ac3221850c6d9fb6b9c6899033e7a2f764cb36d3b87
-
Filesize
5.9MB
MD54c5611edbc15ced733650ab88a2f1f4b
SHA10e2c293b4cecf66923dbfbf39ff4224e27c5f4cb
SHA256608ea5133e1cd50ddbfb750604e9f5f08d55a95be24e13c09e0405715da2482e
SHA5128f9e4a6ddf3f96ef4011aa47f9a02c221135b38a8212ddd21d2723caf527999e171c2af1ec7063365c61eeca68395d44ff148cb3f2e91adc1651196aacaab727
-
Filesize
5.9MB
MD5cd3e1ca2d7cdfa2775cd1289f339a6e4
SHA138d4d93054d731a863762b39aa5b6d601a69ef01
SHA2561b2c7695e929c4d5e62280351b958d2d99898af4f94b476817f7cf0c1fd4b5dc
SHA512627b12755b01eb107f18011da722b6085c9ccfeeac4ecc5aa3b9903a63d4db7864651b068763b1aedd838bb42bedbf981f26590b7a5ea2e53993a8b0778354b8
-
Filesize
5.9MB
MD5f19a50649b7bb5c4b028bbddc1b3a34b
SHA14517fbc15e09282a5b6c06590b52280a12bbfcf0
SHA2569105993b25b9d74a16377d32e248028eac2a32c5f796fc07b3d36dad075eedc8
SHA51244ea0917fddc1f2051bc2ae31bab78efa693ce9cdc65a37f40637e69d857058656942228ac62ea36e17937834d4f629d04641ab7d34c7a3fab7e68852dcc813d
-
Filesize
5.9MB
MD5bc3410887502f7290fd6cac0bf697441
SHA1b377af3b405f6846d91626c20cfc85bb1240d953
SHA256e50db23f7f1535d7961508303cf52901c71bfce362ca3593eee0b5c878578d3c
SHA51287c2ea16440138b5f09143bac9e537a29b3eac9abc86d7bf26490843c0e434b1c6e3ba70e825c7a07783a26feee344771a73bb76a7b8b907f507ecdd9d46a1b8
-
Filesize
5.9MB
MD591073d09b4157fab10f915b038b37fd3
SHA10cb3eb619d897b5caa3e3635a995818cd5d747eb
SHA2568cb67b2f49cf04b969568b80f46552f9286a8559fc7489db10b5e3f922cf0161
SHA5125f25126f50a160ca24d27f26a3c30badddba91f0d5216baaf8c719fd5539ed778a47de26d7b011902f40bea02acece247b5ad3adda689cf68b56bd32246ec15e
-
Filesize
5.9MB
MD54ca7f4883e510a82b97c3e5235ae3bd5
SHA19b60dcda6b805c8615b0d431a905b1d664d44661
SHA25691119838ac0053fb5a034a3609dadfb827de112008b0bb4563ff07fe7c10abe3
SHA512393dd428b287f04200a8853ea74afba7a9916cb6e8c26ffa3ac2c7a0d5732fb455773a0e3f31cfb67c9a6fef50a7468f206b6d7c536ceab7fecaee131d33eb4d
-
Filesize
5.9MB
MD53c530b9723b1f0a0c1204285b1ff2392
SHA1b09f945f5e56b9fd9dc5efca862036228aee12e4
SHA256fafa4a8a8d402b9275a14dcfada8e307346ecb2b221fcc1a5c676cba61e25361
SHA512006b817e283fdab0df65ad873063d7b26d7303caaaffa107707253c03ec4d0709fa4a493adfd884f00caa779b5a6bc0b469b44726cd782a94d785072db0c3c8c
-
Filesize
5.9MB
MD541b0523b13d839ac4495b9c2651df4ab
SHA1220d715c9f99bc598d7ca6229f0d4765d6d49bbb
SHA25668bb0bef696d294c70cb271323aae7ba2fe8f3dbf1b6fb10cf81e13db3f0984d
SHA512fea5c20106847860649a659320fd75c1f2da4cc0cfdbd468bff75edd4d9f5808ec3ac78b2453321caa75e83eccd12aef1cc9f6f1f341cedc1a340e3133d1cc2d
-
Filesize
5.9MB
MD53fa90270432eddadedaa6b81a695f676
SHA1fba7e490235a634a7293ae1acf6db675cc8b9bf2
SHA256e4cc7d8a36c77253e52ce8c4ce7e94b03e301559c65ce034d550607986f35c50
SHA51289da2485097589c678da362a13348c9f00dab28a5135a9db983da01d097494f71f26eb9fb03bce2998a540c628df2ea8f0bf6b77397b2c6e4c8c8a0a4ff1de3e
-
Filesize
5.9MB
MD5b0539027000b7a934c9255f53975846e
SHA14a84ef8f172634af7ce8f8883f2f6d31a2123334
SHA2568a949912e90dad245382dfc5314c893cb1cda8e63458711129d76986a044a522
SHA5121846dcb6660ec102d0dafe8a6d9bf29906fecc617ca424c76ff6b80fea987d5d204b8aa8b6ac0679f0c0c9270301c9d830f3e4937b185496ff4a25f31b9fdb36
-
Filesize
5.9MB
MD54301b437f1b932ff6264732db971c82a
SHA1e139fd669ca082b6fdc3096fc37426c0ac0e51d5
SHA256f14744b6763bfc45f2fd4b657ec76cf8a8d37d7957cfad16ae9cc28048df0c92
SHA5129b4f6fa6393f00b7099de55c8358afb04222dfc529b84fa1639a0e235235bd1d51a6e699f5591b5a480638cdd46741ad43be7e07d0014fd08530b39acf992d05
-
Filesize
5.9MB
MD5dde39c7e7e8ea5ff353dc7c065793829
SHA125de7fd4725319811bc3f72c82e05c932565586c
SHA256b9a171af56bef420b88f18f43f4657e1318b475113163172d629c1da4fad1fb6
SHA512eea4151c83d74b59666cb4ae00aaccfebfad243f1e1ea07591f37d04c7a986b6515ea20b92e2da27d9643801caaaa8af8228a6d49ee0dfdfb6d18c50bee74d4b
-
Filesize
5.9MB
MD5a1735084cbdb24f601dd4bbf553c51a6
SHA15c2e2e54d6469e49d798a0a1e19b4bb2e2eb96a4
SHA256b58f443e0658dda18f2431e585438471775a691c1d7b1a430c0cb612dff16f59
SHA5120082d3981f5b068635c1b70c5aa5c1be08f9b836dba7d87fd250e9a970b0ac4f13bfe98b044384446d9b16d9f98474d7aa074a98f288ac174a82e27d0db4509e
-
Filesize
5.9MB
MD53cd38658cd1ece2fe5bb1e095add89ea
SHA1f3ecdca30855784859a1d72362f4f2d767992de7
SHA25611c56437669008ebfb7eb7c52b53c477ddb97bdc83bb707343b694d05441161c
SHA512eba3d043f685edb25f6b06f847da14b371fd7ee0e2058449c1eca91e2734d24f220a932e1725d59154051e0e02ee23adb3a87fde627bf6776d860ef9badd61c7
-
Filesize
5.9MB
MD59c0c4d5f6dafcfb7a399c0456229c4a5
SHA1efced9ec84ff39f94bb3883c282cf1f2d868ed1e
SHA256b7cedfa65b520793d697922223d8533a1d9111c3c4b82fa39bf5ff1e7c93f201
SHA512c65ddd40a25a77b3c5b9d15642b8543ae936567523f2a53b32d545f87d64c1f6216a25d5368d29fb3e57571ee85891ad45fdef5edb77d7e3a286157197059bb6
-
Filesize
5.9MB
MD51ca6702594d0e9e627ac48df6fef97ea
SHA172f3347d52509e16f97ef5584fa9b00cf26e57bd
SHA2562a3b573fba21d4e56e1187d980b06e2e21adb997a407d46e84523d52304c1c71
SHA5123a7560421cc4b015c628a28beff5b248c23add27b236dbcfa370689d218abd444ba4d79667f77d5d4817138104518321ce7d17f30286a57d6d5c33c8c805e8bf
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB