Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-09-2024 19:00
General
-
Target
2024-09-26_90b199b6861d8bacb2cc73cbe3e58668_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
90b199b6861d8bacb2cc73cbe3e58668
-
SHA1
500e4e00caced8c2cd6ef253b27bb3986dcbf2db
-
SHA256
12adc4e1c9c01c2fc0d9d47f40584e970441feb3317f0a880231f40c2d56199b
-
SHA512
224ca21d1d30d3ee3690573b59bec0afe05813dddb3093ec37b0563ed780d6854bced45ce6c33cdce7350d82bc1efe77e5a637fb342a0e107163f3ea820b4fea
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-26_90b199b6861d8bacb2cc73cbe3e58668_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-26_90b199b6861d8bacb2cc73cbe3e58668_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PDmuvMO.exeC:\Windows\System\PDmuvMO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BDHCzDE.exeC:\Windows\System\BDHCzDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uUYgAkn.exeC:\Windows\System\uUYgAkn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbIipxt.exeC:\Windows\System\pbIipxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWZJLKH.exeC:\Windows\System\SWZJLKH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvtnxwg.exeC:\Windows\System\kvtnxwg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcOIBfH.exeC:\Windows\System\mcOIBfH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEKCkUR.exeC:\Windows\System\pEKCkUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BqOPJWU.exeC:\Windows\System\BqOPJWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSPYLxa.exeC:\Windows\System\LSPYLxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IVcueMd.exeC:\Windows\System\IVcueMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghmLdCM.exeC:\Windows\System\ghmLdCM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xZqdKFj.exeC:\Windows\System\xZqdKFj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qnoHxZy.exeC:\Windows\System\qnoHxZy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nvmCrLO.exeC:\Windows\System\nvmCrLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJNrXun.exeC:\Windows\System\GJNrXun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WjEQWwa.exeC:\Windows\System\WjEQWwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vhQjhLL.exeC:\Windows\System\vhQjhLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eyWdGGm.exeC:\Windows\System\eyWdGGm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrAeHRE.exeC:\Windows\System\zrAeHRE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhfjxsR.exeC:\Windows\System\jhfjxsR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD507d27194b9e7ac687ade0d68fa633941
SHA14d82770c489b2b604595959962287413dc34fb19
SHA2565bd51313141512f80946471fce277a4e2b1f9f1767870808715eece1e9d1caa3
SHA51257f85469e093aed6c5737259c1c84f445990b375963c057919657b0a121d4c3fccc64c049acc58a1d4b5444724aaeae7de5caf2bf63c96a7c596051581f858ca
-
Filesize
5.9MB
MD50b3d39a046600a3e6b116e1acf8f905b
SHA16b1ead87aa36775dbda855fd2e0f970cfafc3725
SHA2569090ac5163c22015a4782058e1a2439cd57e24ae30d329ff164479384c5e7753
SHA512bfd604985c26b64b23e6a0e6019e2c2723bb11a86359e1e37378d7559ced6602691f024b0bf3bc5a42148ce4c4db2713462510ebf57e2e02dd741d4871046304
-
Filesize
5.9MB
MD57fe2392f5dceb5c5469ecc15711cde2c
SHA1753dbd99bc57d0c283192fc5e7800e73c6397d09
SHA25606eabbf3a5605a286973733fb7d135b5c8d103544b2d29cd7a25f4b56e47153d
SHA512549b020c066e01892b161e9331f4601cb6317e9da4d5c74f54a238b0f37dff2ca171175369fc722a9d4ddbd44c87d86a1877222250d53021015fe02f34ffd5ec
-
Filesize
5.9MB
MD51dca31301671a6ae373205ede533e5c6
SHA1cf233c78f6ea67f2a11f9e610cafe325e83a5354
SHA256e51a13f104c0e3ca0cfd2232632ef15131d7ca6ffc853ce3a94a173aeb029542
SHA5126c2659a7e70d1caff0897def645b566a9dacd833ecbdeb09fa03d6bcdd34da21ad033fc7e0c045ed91ab09901e60ed670a17710821e18c25d6e251e6601b3d96
-
Filesize
5.9MB
MD5b366d012674f7dab4af8ccb37fcc3f3d
SHA178f4be32e2ca3d83a1d51cb87678734aa5e5c881
SHA256d9ffae02d817c1fba05988c8ce5683260010707079205fa43904cd8b0b748547
SHA5126218bc9bec18a33a916d0081c6e004a61d84f5b6d8ace202d86908dd7a26ddca5fc0773c40bc7df1f32cd72d8e7b5e0761471c70fb5bcc2e7eb08cfdea06e335
-
Filesize
5.9MB
MD56b223e822f9ea236722c9ec1b5e3855b
SHA1283bca2e0136eedbdf479d5cd346741ac6d0055a
SHA256b1ea2878a37f8449ae2dc1da0ee86064b695086b5b3788c225aa650d1881e21b
SHA51253b36d00452b4f479bb3bf6f89284d2eb41ad60ec207ac3e5ad0057897d1af1c61fa58114effb559702c17924cfb4afec188876efa48f56272104acaa578924f
-
Filesize
5.9MB
MD5e141c29cf06d9a2de4f52de231af1128
SHA1be85b7bac61c504b55439271afb19ff5ee8d0e56
SHA256ebdfc9daa57338dff30eb18b92c1a47de878bd4ff84b2a0c561534363798ba1a
SHA5124335b79ed2dc6f3f4cc2ea921b5afa7e6a3ebab26fae81a1bc6285406ab715fcc13336328f9399f6e92dc4ab3622517741dcb49500268cefb08b55a70645c07d
-
Filesize
5.9MB
MD5d7b96c358c543d213963e19909082850
SHA1111ae6f8609e90968990d36835f17b05dbc214c8
SHA256af1ebbc6ad21afc605148e8677fd053ac7f4046d2f981bce81d3107859236f31
SHA51290f3229b4d0fbcf5ead0790874fedb4a00dce2ed15a1e61a041282f463d77d7428ccc046fc93986376a2727a842e5654d6a1881e01118201546275a50192f301
-
Filesize
5.9MB
MD593146dd14be9a1b8a45e82d72ab3fe5d
SHA11b70217a650925601da6e97d3497871818e532f4
SHA25629a7cb397b13b1a99efb8ca8c63dec770875b1c3ed5ed0ce2b8115ea2648a8d4
SHA512290ed01b280785c1cf9664e587e5ec6b8d6416d5a4c30189e81aa500892ae469934d663855e5106e678036cc014e6849dc788e1cdcdc276a64b04bc80c91afdf
-
Filesize
5.9MB
MD5126ccf77ac148f79b6d17a6431774523
SHA1f7caff45a1e03a89b3237426963f28e4d723db0d
SHA256df860e4a867f96a5170a6f0b6cfb658dec9119a65757f24eebb3afda4e42703a
SHA512ba4c29860b3560aed88282f2572e927d0a1a81a1b356bd29d1742affbb83fcf15a893f386451a28e30d65b8306b30b978fabda95d5fc30517c72baa8a9ff6457
-
Filesize
5.9MB
MD5c67080fadf2522b088416f0969cbd87e
SHA152ecfba2a644281018ec793758e4c56cf0d5cc0d
SHA256427cc10c7b65d4d8ceb454a00175418031432865e803805b4c4013e62477874e
SHA512e5334d207aa43ef41a3afd952bd2c27f86cef6667cb6aab82f7771a68668b66ae73dc7e09d1c0ac27111ccbaae7a39529ea99658e5fb15fa08b2b8aeb174f3b6
-
Filesize
5.9MB
MD5185cbc8ccecfc9fd558aa9f85124663a
SHA1a8d24b6f934a4e0accc1f8ee811b622cd0d969c3
SHA256abf2216bb22a1edbc10a73e11675792d56b423d59db036662fe8eda32a91c0ed
SHA5120eb9d0bd8218ab31a4ddd4c2a64773814c0cccfeb49c010824708575a0ea20a26fd5660bd993f185f12b37901c5558e9a9c7c999801b90c7423fc37a45477ccc
-
Filesize
5.9MB
MD5d1cfb4203b50b4f1db690af66baea84a
SHA1c7a4049639ac24b2fba8e4d5dde4b8741c790b74
SHA256a17c8a57e69add12985f852a6b716c9c686baf9e5da4a0aa846cb807a6418ea3
SHA51266aa3fd522659e4d42d7b678ba8fed8c047e4cb091f1cde8f7d06878471f7d8d43e7f8b9d25259f79736f935675c89a9cc6008d8d6c57518d78c0168066885fd
-
Filesize
5.9MB
MD5e2c9339f1ed29664485df0a983f02f54
SHA1da1f30ce984fbf926f22fc4efaf764b474d96149
SHA256ae150563c1c5dea1ada84ff8c58d56f188b80240aa71399faeb236ce792e5daa
SHA512b827d71b301c9c2d567132ed5074dd7d63bed1a507d2fcc281d5401d52414a99191c857c17dff672d3087d4b78d0072901afde205655ee46abba507188ed446e
-
Filesize
5.9MB
MD516110261c7c255593be20b21235b7c77
SHA1ff90083cf87b3d6f88a236c63bbbf59efe5cf3c9
SHA256cb6524d18c52921437ae400341622deeebde9e3776b1d6d6fafca4a8ecc94b7c
SHA512a269dfbca3c8718d7bb62317e115ce162f376c42fdb5fe414b616dd9567c271ba9c1f5b154e41219a4d86124f1caca7a806aaa19e67e76503b1146fca5b92116
-
Filesize
5.9MB
MD5c355e0c0d5b2c3ed4d1d31c897c116cd
SHA101e6465d96307ffa9e08485f40c51ebbfc35b068
SHA256eb6818e47846e6aeae4b3e288cbfbfd3b235621261ffd0cd0f11a3317ffe4b4d
SHA51295ae5fc2cac9b3c7240e737fe06ceeb8632ab6057cf49b3794229ee70b262e98088fc95efe35e34736fad6a7a771428fb996d1ea2ad2c6c9795b5e266042cab8
-
Filesize
5.9MB
MD5692062419f023c43f976d49e5e4a5dfd
SHA1cad91043e0ebf1dd594d7fce94f196638d5717b1
SHA256929ca9f7a92eaccaf02714f1c3696d22a348860963ac349252a9c1b3bce6bd1d
SHA512a8ef88218d9c63512ecb450a1dce8ce7b46325c647321a31f1356d2760e51b4f2da93b5f73f2f7eddd12af07a9213ac2bcd58365a9ab9bf36182a531c79daf32
-
Filesize
5.9MB
MD5d167b1895b24ff4a33f8f459051e6610
SHA1d7a540ab18f98e2d6084faf6233a1755f52c8c36
SHA2562c0ec9c726d29e2fd3cb78511cac6bcc87729112d7110eb82b031dad778d702e
SHA5126457c64f29167528c7397a19244f10450c3c64f30655043a3346bfe4f9a5f122a9456ea3ba35278012c26fd0128f7587ab928d0d2fc70ce8c5c3dc6fe4ae99a1
-
Filesize
5.9MB
MD5e18628f26a2c3ea6da382ef4f43e6219
SHA1100f5c9a9f65acf1c5b73848304a8bbffab0911a
SHA256058878d7a94975eee6c3c926a542fbd8f8a8e7c69022c7156f04a0daced8609c
SHA51289ede193c5b428f943f8c1020d64d36e57bf7f12092e07126c737102a8518db537b93bb598bb2c646069e915e0c4f7a23b4fa6f3da53397cdf307e8e41de2bf2
-
Filesize
5.9MB
MD5655cf5cce17fcaceb13ac7c09786d127
SHA15c64be879bd17f70f6d743e98b650f731c141104
SHA256229a728546ba6186461aa8dc60243c03b3e7acf48b162f5bf973150df4cbca02
SHA512d8a4e099fcb3c7e09b5180e982d18f7ceb9941ca39270eb5b0259ab55e4d36a63f705f96efca4c07ef890cd6eb4c6f28c97e729bce84f8050fa8fe174044a657
-
Filesize
5.9MB
MD5e1b474e961d474154d7e8f6015c96feb
SHA17525d53c6ec135bec66f82e4277927ecd432001c
SHA2562986a2d2f359979e3e1a0acb5b16f29965e16752bff652246d2900544657515d
SHA512be41c0cc51d9cf77f65c393b2a4465f260c66adc34b7462932c46e83d7c00eb36f214ed3ae99a24035e5ceff2b7d3df091cf3e4919db1dd42c9fc2810631b717
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB