Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
25-09-2024 15:46
General
-
Target
2024-09-25_75297e0883573f17b873e0e9a56a9d6f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
75297e0883573f17b873e0e9a56a9d6f
-
SHA1
f8d4f1f1aafa7e6b9adf402bdc553b5ebdd41884
-
SHA256
923b08371139b3f662e444b8f1000f08ba9810b646a8a8203edc3a1270e4bbd3
-
SHA512
89c2689e38c8a1095c7b79b8773cf71b58a3ed5a69a2504c7d504fb6e55b73bf59d3bc316a896db61da9779a2d97e1790bc0ad5d0c4714f58aa401bd21656ef6
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 51 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_75297e0883573f17b873e0e9a56a9d6f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_75297e0883573f17b873e0e9a56a9d6f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lgYpXXH.exeC:\Windows\System\lgYpXXH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKUwazJ.exeC:\Windows\System\mKUwazJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKewXmS.exeC:\Windows\System\WKewXmS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxIIGoN.exeC:\Windows\System\VxIIGoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yioLuQT.exeC:\Windows\System\yioLuQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSxqiKt.exeC:\Windows\System\JSxqiKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hTSTyZv.exeC:\Windows\System\hTSTyZv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhAWNke.exeC:\Windows\System\jhAWNke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JOYtURz.exeC:\Windows\System\JOYtURz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLpTNkN.exeC:\Windows\System\FLpTNkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kRWJGBI.exeC:\Windows\System\kRWJGBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OJMjbVP.exeC:\Windows\System\OJMjbVP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DQFyISV.exeC:\Windows\System\DQFyISV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hequbbs.exeC:\Windows\System\hequbbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mukKdGW.exeC:\Windows\System\mukKdGW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IpqgoHo.exeC:\Windows\System\IpqgoHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slvXOcZ.exeC:\Windows\System\slvXOcZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsNhdcT.exeC:\Windows\System\qsNhdcT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKtRenm.exeC:\Windows\System\ZKtRenm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eBPAJaP.exeC:\Windows\System\eBPAJaP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DUFjqXa.exeC:\Windows\System\DUFjqXa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5c7dbe4137f977d73036f3c20bbaf7d0a
SHA1c859647ed0acb2869f06c7a921d3a5a289d9a0eb
SHA2566048f6031701b929859f951ae1cd60e66b72d93ca426061a5ea0b9c23dbdec34
SHA512c79f10989abb57627b97d13de94a4290a1dbd10e1be6dd6a53c1667f67851a065f0780b8e769fe7947660b23425cf47fff9693e8647da82e1384edc99a734165
-
Filesize
5.9MB
MD5bb80d1c076c45f73f982fe8a342c079b
SHA12520bc5ded1cf83319bb0f283dac1347a607e4d5
SHA256d8db34b6c454699f037714ac0893ed9533c35d7082e6e529d9cbcf383c912bbc
SHA512203cb2e9ff38a6b446da366bd6af6a845f3c88ca4e0c7507e271555ae73318dd5c974a2738d3808f28a2f4387ddf44b0e283ad33d14f87dd74d9a14005fe90fb
-
Filesize
5.9MB
MD5e3c2cadcae3d62b4714539b7093109c2
SHA11fa3d8b75cb0de1a7c0dc198c0325dbeaf31d0fd
SHA256c3d3b6fa06f96ad91811042fdf374cbb146204f59fd38328d0cdf2c1439be53a
SHA512bc06fe30b06224be934841b63a3d8e70913a1b752db1e1a363b48ebbdfdd605908c5e9d014fd4bbeba2961d19ad68e4653e5cdbeed6aed72b904acfeb82ed57e
-
Filesize
5.9MB
MD57711adbfda6bdc0626149a3e8b0218ac
SHA17129c149db4099b08fc9fb1108e08a38b97fa9a6
SHA2562b3ecb6c2a219131865e886fbad9d8ff79df136afdc17941d8c232d09b3a20b3
SHA5127476d84a5696558fa54f96a2b6825424080e8ac8d30203ca0cb78cc57f147fd0bba53f481bf7941808cc5cbbb4956ca39a14cf9d51964b0f8c89a53bc865c97a
-
Filesize
5.9MB
MD57b940679266e6a106eff89502a41f051
SHA192c7ffbae7b1bc79fba5eeab67130c267db9a999
SHA2564cb1f1a99c81c967b97241738f20a5bb847ed30f8858aa22e3cfdb1970fcc9a1
SHA5128b0910c922b7cefe7aa32decdf67e087a8f5569f496cbfe383627546407cd8b61bbe075a5478e4b04f5e8ea12f0aeea9800570a25520b7627f5f706eeb5c7c0c
-
Filesize
5.9MB
MD5f5e3c9df9bb8c16a8e30221a06f4b4b8
SHA194cfd2305c4cb61ff6af0dd7224a97bbcfb0827d
SHA256918b9bb11b802b7de1699073c89c48dc696b38df5eac8a375b1f84b0257ff9d1
SHA5121ed436e28e97b3401672a55548cc6d0067ce21a6c20185678d6c40256076d5627025ff93c4b83285e2752c041bde8d0b59079bdc29540fa8f6717dec0e95f0f9
-
Filesize
5.9MB
MD554a94bef18c2c20a9afaa8485523facf
SHA15a832f4d96341de49f600c94ad55b43a83fca44e
SHA25614dd4e533d86a020f63517c34b8f63dc5dab4a8e7762157c072edf70abaaf986
SHA5122a57d7180430d6a140be742ba65d09ebe0547ddeda54bd1661a77a230359702c84692498b01c50189a09048c6ec594955febc0d37b00a9e66fd29935beb284b9
-
Filesize
5.9MB
MD504fc54174959a205738698982701639b
SHA181ddb41c649e3fb6d9d9bad3ffec824c139fd277
SHA2567ca99f4ef5fb5730224dfad0c9e5f293a1ecb54ad07a8d466e289cae87b6a54b
SHA5129803e65603521b2dbb83453b15d18cb2a1a51427810ce456908325bf9b4d26f54ca7eadc6623d496544f13b4fa78c617d03f55643de7766e372c692e888caa3d
-
Filesize
5.9MB
MD502b2d2c2b8eaafa127aa76ab84f36441
SHA1fd07a565da7224ca96fa4879c35c972f3f6deca7
SHA2565bf2e2e05bac9cf983c35b32b50ecd828755605755f916b43cec5c964eaa354d
SHA5123ec7188cd5b92ad06f7e7708437a8e3182ae2436a501114af07fc89bcc161749c865241a0174fb7cd12954b202a0a5985b3b4277e7c789735e8de8e743896d9a
-
Filesize
5.9MB
MD537eb9e9018956afabbf09bfde67c07f3
SHA11903dcf37e08fc2f41fa1b7ac08d44c3c87e74fd
SHA25607e6c4e38136d92de957ded273956d20ec8f5508c87abc16ffbe1f92d9a5bcce
SHA5122d985af70d2376854a144dab84201fe211c91abb7c93b2d9036e2be16fcab0f4eaf6420947b9b975ab2bd8af0f6d12d648e99a161669767f132f742b8420f410
-
Filesize
5.9MB
MD5613a6c66e2cfb779a082af88956159e5
SHA1fe6f36b08ad8d6ddad5e20a1afa81cdf4a468b68
SHA256e62d45434f64963e039146012fa506ef5de0ae8e14aec2ea1e7c52600efcf751
SHA51247e87a1261ab7fe63092c26a6538dce13197d2d6c08831838462a577bcd0cb762260f9e29d3008b325434aebec7c626bd289817e7590f65be8f8d5d2daa2c585
-
Filesize
5.9MB
MD5029ef21480922640019c1713fe273c89
SHA10c979f6856edc83e4cf5857748d603b402e59e79
SHA2567847ad2d6e0ed724acc30f47ec5baad69a7834d0308d495f1b4e88a965456852
SHA512aa3baea2eec9de81b600dbd2d361ab7b1d68d2ada358ea09eb01011da2d316aa9ce71f889a80b33320228e763050da49dfab07f5d88299b95978cc6d313dcb5d
-
Filesize
5.9MB
MD592ddc74610880b22358cf634363b3fe5
SHA1dde5ce7246b02b00613cad379086375166079876
SHA2567262c27d5e0a25cdf9a6d6cf4ad2e2835f37a2561c534d80e8611622fba1c3da
SHA5128ab965c1a99dc1c64c461caeb9aef0f7dd1d835213b0dbc95b847791676361626bdea9ca6789bf10287aa6b8f3cb4fd620c96462102235a1cc6bbeb245c3b8d3
-
Filesize
5.9MB
MD58e63ec9f54f50307b7e092cd841a3f9f
SHA1f250adf753b5501fdfa5702c208a9adfcc6a1b3d
SHA256c1db526f940ce443a5d60871de68e2ecd741122e1d01e641f01f193702ea914c
SHA512abaf17b631eec706bb8c489911f608d4e1bba51ad86007f9d8a9f96780cbc37f6d8bc938c64eb74da252170e61468fc60ea4a22c7d6e6de3238faee5b021fff7
-
Filesize
5.9MB
MD568e3e52949e77a307062b8eed1eb04b2
SHA191d25d4bf7dfd61c014b0fc66f58c393d1de98cd
SHA2564d99024197640fc5889fe6d3822c66f7a2b99d4c5e0b41be487422c121d55dc9
SHA512649af71d11f2b215a5dbb82cf2479c7587381cc6224d9b29bc11f1ab50790a64f422654dc9d3e4bafa1d2cda8f96f075ee1f6260805ab9151619d4d7a3110479
-
Filesize
5.9MB
MD503931190697ff35680d4df0f4e56d835
SHA1ec99502893b2eab18852ee20bc69c4f98b971387
SHA25648af57fe268b0e632a841ea5ea9e34b7582cd2afd8cc66ac1fb53f51f78289b3
SHA512773cf2e0315e25ed493fecef37456fe052976f0076b5836cc5da720ea3c0f7aa34eeee3d60ce2f904bd9370e1c731bbac49d01955257234cba2deefdffa6318b
-
Filesize
5.9MB
MD56f9dfdee34c42ee42abc5e47b6645538
SHA181b5097dec30ef4c06b9cffb3ae5096e60fd51b2
SHA25617d98ef4c6df31faaa9c1c629d7eef39ae5a631a9181ccc3f3eaf89cd96505ac
SHA512340bbf35be4e4d375cf3baaa1f953dd7bab9506f21a5a3a46e9184607b61fc1eff84c039cc545441829978ff9ae4c3238690865028d4871a966ff9c94745be4a
-
Filesize
5.9MB
MD5f24f05431380386ca0a7fe1810ff5725
SHA1671543fbcef6e948f16ffffb65c04909ae274a27
SHA2562855ac36e7dc11adb2d61462b27438eb112c543222cc5fbea3b33ede90d48b89
SHA512c13e9a417ed945b020f8d70ffcbcef901fb3fb71551f5bc41aa5f3cca4a25009443d0d3417053871f2731b8183a39bb9de455bddce0a2614a3870c6824afc3ea
-
Filesize
5.9MB
MD5b46dc99bcf96c3a90f2547de3a512a6b
SHA1f99b05cbf50f813211297990cdbb9042b42308ed
SHA256e990a53b08c8ed27fdc1f03ea61f9e4753863167ba96a7d2581252420ac9804d
SHA5125fa32d0eb8ecac9bcc7087519362252bee8323b1b6d16f958e09cc75279752253cf695d93f9a86aa3a24f6bee683cc7cb81443a1077148ff9f1bd4456195d345
-
Filesize
5.9MB
MD5316912967c0dbeef0dc815708310fdf7
SHA18150d772bba6dacc685c3be55a7984735f3f366b
SHA256e962a5ea309756dbaf33ebe1101ebaba47c9afc5a6a485a203e2001d7733304c
SHA5128282b4238ccd024536e4c2f47b33f50e21de891f1772cddea45a67d818baed7529c79b1082ba6277c992a3be38971d0348520751c22c269d62a462860960f60f
-
Filesize
5.9MB
MD5408edc7fb7cee6d41a4b416b54e956de
SHA10631ac2dd127f759fd1a9e8b19d20047311cd978
SHA25603b7e3806c2fe9dbec156f2a4547900ba2deee0255864da6b533dfd99916e7f5
SHA512ca16ac812a52aa5ae97feaf4fb411bd898cc5c103dbc01d1172f0e225cb41561269bc46e9d6cb810e343aac1a4a4b153fa8c64575b0100938286dc496045ffe1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB