Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 18:55
General
-
Target
2024-09-26_6faccb1348cd217dd84fd98a470eaa3e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
6faccb1348cd217dd84fd98a470eaa3e
-
SHA1
76a5797f4026662940786656802879f85cd549b5
-
SHA256
3a159e8566b3a706c8a02b35f7b0f88a744a33cb6b8fe2494899a2fc8b18dd13
-
SHA512
f087f6ff62800ea465c29b30d6cb361c34491b0743c15a9fa57ecd7fb4086a4ab93fcb3771835a737e02ee0edab5aef4da1d57d225b2f20b0f896f3b42f1a315
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 57 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_6faccb1348cd217dd84fd98a470eaa3e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_6faccb1348cd217dd84fd98a470eaa3e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vyusSvZ.exeC:\Windows\System\vyusSvZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amPrQQI.exeC:\Windows\System\amPrQQI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AaOVQEa.exeC:\Windows\System\AaOVQEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wevYvBd.exeC:\Windows\System\wevYvBd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzqptaL.exeC:\Windows\System\gzqptaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiamOih.exeC:\Windows\System\BiamOih.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eFChYYD.exeC:\Windows\System\eFChYYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TSPYjYG.exeC:\Windows\System\TSPYjYG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNMIKeE.exeC:\Windows\System\wNMIKeE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWGtMmO.exeC:\Windows\System\qWGtMmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dAlzFoU.exeC:\Windows\System\dAlzFoU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkhCIpc.exeC:\Windows\System\RkhCIpc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QixKHxO.exeC:\Windows\System\QixKHxO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQfJwqP.exeC:\Windows\System\dQfJwqP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLJLAQm.exeC:\Windows\System\mLJLAQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKvfUZB.exeC:\Windows\System\sKvfUZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mOsVbHl.exeC:\Windows\System\mOsVbHl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNfrprz.exeC:\Windows\System\sNfrprz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WrosCmp.exeC:\Windows\System\WrosCmp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNlCphn.exeC:\Windows\System\wNlCphn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kosVoIU.exeC:\Windows\System\kosVoIU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5249f5dd2f4dc7bcef35d917d746596a6
SHA1f37b22c0e28183154835c2f96b9967b21872e22c
SHA256eee1b8c5a5cd69e255caa7a05926cb4db694013da689d7533f9357e5c8e5a01f
SHA512c211d68bb0a1eba05a950c62b1412cf9f09eaad79c223f368b40d273a7a0629b268b1be5eb190152501e4b97b8467e81fa768a4da033e42747085c33fb615f5c
-
Filesize
5.9MB
MD5e37146b81f64c475c89586b54d8d7464
SHA1cbf790e0dbd0639bf5fb0cb48c80ee2b25f26ff6
SHA256827878b4bb08811c5904e47a551f19b16daa66b21dc1ecf7da295f2230ee5206
SHA512e9f48a74da49f1bcb32078c655b480ae07caf179639065aa005bd180b22ba4708c3345e8beb3ed1952dd6b98444cb495c62fc7bbdb1cf341e98664f019e619f3
-
Filesize
5.9MB
MD57e63e8bbd185716bfec2d93cb9cc0248
SHA1cde00b758e73399f422bb63fe385a8c996b2a484
SHA256a65819a7ebe5a27a438b787814e2e1e833b45fbe6aa329b78c3ffd96ebdd8ecd
SHA512540bf524d532cd865c7115fa4d5124963d7df2921fe9b09009f56cbfa5df40337d35a29c06dce031552b4748283fa7d5497b628fd29d02197112dfd457333346
-
Filesize
5.9MB
MD536e5e0ddb639e99dbed2dd1d92c161e8
SHA112f103331a6bb8bd1453a258fd6134869ac1e48d
SHA25690f87a10a138dec1a994194c18ebfa88bade021b723470b7ab35bdd56b60ae0d
SHA512bbcb9d1f39a05d114ae68d3f8987f79539af11cf765f2ffebe460e954cd1ef347c5fa2fb8363a60713c6298ecd543af1b040227964d34a3582ad01158ca445ed
-
Filesize
5.9MB
MD50a393342ac623bca95bcaa074fe0e8d0
SHA1adb6aed79c36bff55ea6ec4e55744507b573813f
SHA2564ac6d75dce5bca9593c4ac12db3af9f9b7b3975bb09e8012caa68a5b2f28863c
SHA51200e3e48506b54685b915e23b01b40c655af29a1ba6a788a116d85b8a7d720e0a7c5c82744f2cf91da94bb4ad3ec6dcb5d69dc5e04ca6af205d5af3f6fd22e48d
-
Filesize
5.9MB
MD55143642206eb6cc8f04e12db9eb73147
SHA12ab53e3485c6161c6da54997663a5e094a5d3405
SHA256288ce7fc412a4f71b0cd170a54e3e4be91a5ad13a1f50ab82bede79663fa89bf
SHA512f45087251fa3b0bdca6fe47dc331c13038d105d096659aa5d4d305b9426c420e1366da61dbe7500d513e9fe36242f4d4b4e9503ab5fe33519089ea2153e72e86
-
Filesize
5.9MB
MD585b3bb1398b11b3730d4615ca766485f
SHA1f60c0197e8c6fb96a1c029e68c23e22e7088d3b2
SHA256594d78ea5fead0326721bcb3a686a11eaf12dbc46c41028fc90a492eda0a2599
SHA51281f384afa8dd1c000d01efac270828f7324d47e2ddb9448a6c4775958a5d73aa9c4e121973bcd3b7f93503cf5578b30962cd4d4ddf78d8f2f99ca15b09eaeb3c
-
Filesize
5.9MB
MD58cdd3108faecbf48adc0f6eab8a576d8
SHA1a6341d690f48b02c7eb6850915939398224fd350
SHA2563a6ee1d0d07fca595c3ba10a51e794d00349984b1d7ea6364354edd634295b15
SHA512ca48479d098be24e35e400b66ee84b74262162007aafd37e5ade8f5ebfdb567963c2b78e0171bf4bb505c18e45d33fbf5c45444340daf222de4deae22b789bbd
-
Filesize
5.9MB
MD54beb7ec271bd1095b8e3f0b82fe8f9ea
SHA1f4f8fb941e9ceb9bb9dc81ab8f1b6923b9097f82
SHA256dcab8640202884822b4dd7a3001fb30a2ce11188cfd4bc9a00c67dad51de654a
SHA512c9f8d200ccceaa03e423f3ef1e4dc35d25ab98cc6c9b618297d310b09fa676f9d84e131c82f0799ba7832038bc00bb9c4f9dd968eb2380ddc6f9aa72f8c7009b
-
Filesize
5.9MB
MD530a12cf41cf1612ab2e175b837624a78
SHA105285947043e53f7a8a26fd2446fdf44839d7783
SHA2561c467f8e951f3c0d207871258e22f6e6f02d977935f325cdc115f72c564c53cd
SHA5128bc17b37f8b838bedb7fdb71814a02be50988e677f54b46834985e97633aab08bb0d28e6a91a3b6cd450b75f399daeb387383a683a52abf85d2a55d9231ee7f9
-
Filesize
5.9MB
MD5b23c36be2ee2ee4585cabeb593bc120e
SHA1039ca757ddde4dec94c4a01549549118e0d699b1
SHA256d9aa2ef944ab549d781f2f970c95a5dfdffb2cbf673f699bedc7d0d97b94d286
SHA512d0af057e707dd0b61b57308de16e3b9e084971414f4e552ab4e24d73735a9fc5c6f89e13e580e404b781201400995be63167cded6ec99066d4dc9177960f1a3b
-
Filesize
5.9MB
MD503c381af79514072b5e255fcb2963e20
SHA13f7092088a67728fc7eb312b0be6f08c70a4e883
SHA2563d6606354e2cdbaec70d3f06eb46af9165b0e5663aba99b9922191b205cb4ca0
SHA5122c5fffa8e1fcdb83cea0a9e91a8b51175e2924a0c1bb2c2852a5efe9fecf7afe956631c6abd76289088c95414d88635409a532f217db994325831013cd978f93
-
Filesize
5.9MB
MD57d876fc16211ade298117e5432d8913d
SHA1c032b68ea705fc254ee68516e7df4bd465b38546
SHA256bf2a4012a8aaba8071615de78fb8ef84e54f2563916e118fb0ecf8f71a7d8bcb
SHA512c1460d319781d99d78b0bc527e8d98f53003de3522ed71adde87bcd441119d17677557474a9bd1222c3eb55ddac6cbc48ceccd0237c9d459c895655742dddee9
-
Filesize
5.9MB
MD53d0ce063b998d593c27f94e54ae87209
SHA118ad0761b57c30e604ef7d7e5f52274056ba1254
SHA2561dff661b2802566734e63d9e24d8402c35a1cb8186eb6748783c71501852910a
SHA5126672e07f1382d6a30c1e192a0fcd2f64b1ba8e526c8acd459ab5cce034935cbd85c6ceb9dd1b5305f0d7297e845e2c393d4f73c4288ba78aca08958dd3709744
-
Filesize
5.9MB
MD558d9a34abb3cb90e64f43c690f31af5e
SHA153d0a56c4f1e35a54906b67b5a1e00e2ef992a1f
SHA2564a0a453e68d3920802c01851225b99a389166847df1f81b30c7a247992da4f5f
SHA5126d9f1047a5e2d0547fd8489f9dd6c4b63fad2be9348a38651a08d53fc3ceb5318f4f6394d8322bfcd0ce853a51e35043c60f36d3e178a8773a935145b1157164
-
Filesize
5.9MB
MD5963641a28c9062c407daaaf30eb48adc
SHA115b1704ddece37726709f6edf3f7047bf3106cf2
SHA256f53ea0032b6ceba312dfcc39445f7359bb4b3311d1adad624f3c8614d640fc63
SHA5123429b4e2eb83ff5f5a1a9f0a14b45dafa889dd698a73db45a5bc09648feb7385482bcf565d1b96cc1d3c7facab27d1ac8ebae00990c30c8455fcae2b449364ea
-
Filesize
5.9MB
MD53cf118241b5d06e32a1483ce38862889
SHA190f4fe2b7e607bc542d3f836bfffddc43ac771e5
SHA256637b7814286e33b8c2fc5056c06300f7e2cd56fd814726fb731e56b8f83ade63
SHA5127b8c698fb6db0f9abb43edd6d9684c81eae2264a185ddb78ec074fccb83c742346253f7a0c7d75adf10c4c3455f49221c0258b29358cce2187161777088eda4f
-
Filesize
5.9MB
MD58bcf5e6363aeaf813c9b6d8db86c4b08
SHA19fbef0f85b15c82fbb1a1e44d3bafac2ea79deea
SHA256c564b3e8a57f0123cc4de70804f9fc368f65fc6a8a8c879c52ba3f4613535c37
SHA51266f2c831a2afd253274a2b6ab1a73f1a2c1a7270b697f30fa696aa64ee2939b18664b50d62740877bb82ccd6058b140190bc6e4e85e90a4d83a37e4da61b06c2
-
Filesize
5.9MB
MD5075dee11530eaaf55f822b3b5ac2d718
SHA13004f23745540d2c472ad5216e8c9ec56628dd65
SHA256919a09ede729f8585b2d9f06ac7f10ca4d123daf249d047659dc610834d812f8
SHA5127db741724776f226c58744c30d3dc812dfd42ed1a18e49f863aa63c828430369debe3d50fededf7329f001c8b4fed8c4f8cb29dee9287756a1065207355f9bfe
-
Filesize
5.9MB
MD53c4105d421dedadc59571701b881c0e6
SHA17a3cb6c0bca42b95834105a1bbb1b95d0e4fdb6d
SHA256aadba3b0ae6895d483b448c6efd4df46016418aaa93952bdc8921502c22605ca
SHA512d7b5571f29e1ac0992d44db4f70a0bd4d07f0acc20faa16ea668301776fb69e2df3865e1addcafa4770ee53b0427d628d315b1b77eed113aad1a125a80a75be0
-
Filesize
5.9MB
MD5d90fc4dbe8653ff2aeb3064c85e42840
SHA128abc88188b96c2e39b857720b63ac9a825f7a0c
SHA256474c783348ed55b6802e26908915459f915564dcc25fccf1c837b11734b0953a
SHA512feb320f17377e962a243275099f7b44f0c4b9abe7ac2ac8e28b1338aa44ddbc4555893b01a6caa7a5641bfea1631978ee308bb721aec3799a92e032fb9656176
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB