Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/10/2024, 13:45
General
-
Target
2024-10-03_10a8e01d3bee78abb96e5654a397f7f4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
10a8e01d3bee78abb96e5654a397f7f4
-
SHA1
e15e45c1eca19395944df45fdf352255651ed654
-
SHA256
e65800bb18284bdb00cc599add54d0475bbc201cf326bed13384ea1003b357f5
-
SHA512
8e34d9bfc7533a67888b870ffbe86fb3f70fd38053c56c3cf8a0ca8075e7443c5efa68ff7468ecdce34b56008f24d5711bf04b70aa1c2db642ac737c606c8c6d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-03_10a8e01d3bee78abb96e5654a397f7f4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-03_10a8e01d3bee78abb96e5654a397f7f4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fOjTmlg.exeC:\Windows\System\fOjTmlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxGswOH.exeC:\Windows\System\mxGswOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFQWXlc.exeC:\Windows\System\rFQWXlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iGdMcIo.exeC:\Windows\System\iGdMcIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piUNxGq.exeC:\Windows\System\piUNxGq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Aemmcbe.exeC:\Windows\System\Aemmcbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mWFeBlJ.exeC:\Windows\System\mWFeBlJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eTTmBUN.exeC:\Windows\System\eTTmBUN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PlKDpxA.exeC:\Windows\System\PlKDpxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQdjcru.exeC:\Windows\System\nQdjcru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFCoePt.exeC:\Windows\System\JFCoePt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVoNKAs.exeC:\Windows\System\xVoNKAs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NqdVdYp.exeC:\Windows\System\NqdVdYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gZlioeF.exeC:\Windows\System\gZlioeF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zykfAJc.exeC:\Windows\System\zykfAJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKbJsCC.exeC:\Windows\System\ZKbJsCC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\USuocoh.exeC:\Windows\System\USuocoh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ejZhrSi.exeC:\Windows\System\ejZhrSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fROYMRO.exeC:\Windows\System\fROYMRO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlgVhEj.exeC:\Windows\System\nlgVhEj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqMbyrS.exeC:\Windows\System\VqMbyrS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD547d6e086509203c1355dfe929909425c
SHA1145b6b9a5af6797ce9e14a8ca307b83f389d1450
SHA256b5e9b6a833a290f6ca32690c5d60c87259d86f11c0bbea37f270e8467f026a09
SHA512c653cd42ea3bdcfdba745063cf0a64300bffe0b7b5c40fd49553478cbc1c41becf44ad0b7549c727b866c7b9fdfe718836f35d58d7f08778efd6fcc67145b5e5
-
Filesize
5.2MB
MD5dde4d5671548be84501e5f484359771b
SHA14d0d4ac60a233e09bcd93bf7f22b56798201df87
SHA256ee69142346d657980bfe6f34d87b7a88caba5df4dbe4553d4acb162b0c0a8fbc
SHA5127efce4e0c87b22ba533e6a31b3ddf6e08ca473c5e9d4d072bca2a3bac7a2809a528166f515794715b0f2ec851156189e941785d17f7261d53ed19967faeddb0b
-
Filesize
5.2MB
MD540d2e67258b53400b83a93e4ce1a9ea6
SHA15110fb673575922ceeee9c79b73ae1d5371a2532
SHA256dcdff4937f679081ce677fcd62b573296ab0604003e69c12203b457a7d0b1d83
SHA51209c3e93e7530eb8cc6e3924e85405a70c6e53bad4d76b42fda0a4ae85425a9c6052f1992b8d674100f4392cbdc24ed7aa6dd9c97832062921a37fd02a93f5a2a
-
Filesize
5.2MB
MD564577f49d6feb339284e13d03526c342
SHA136febc42d909e5d4bc9c744892403bf01cac8056
SHA2564cd7296ac97d9a4af734f45db8984ba4c285956ab710834ce2ebb0589093bb0b
SHA5122dce362646454acb17dfb50d1caf612757138f002af6b12c7dc74a0ab67b82fa5298853f90290c92f50ef6927f2dd26ffb5555fe87d27d1b5e07a75791e5ab83
-
Filesize
5.2MB
MD5352a29c422cbc3709dc608306e4faa79
SHA152c3bc9459b6353887e56deb3cf332a34fa7642f
SHA2563b372b9549379fd9c776db5c4e01552b630927117d71a83144ca72693d7cc2bc
SHA51230a084b54115ecc314fb77296ec96a3a377c129c6e7ace683ffa5b15007e8d94e9d7396ec435331a98a42e1a70de3ef91c775ea666a56f1471f2cbf8bac2298c
-
Filesize
5.2MB
MD53be498367c158be17988d45fb4fc6776
SHA1f8ce65c3e905bd2e823731468b41f334b930888b
SHA2567553576d630a02d7959ad437fa7af300dd98f3db0cc84ceec3a5cd0938db1152
SHA5124115e838ece2b42b70d11200a5f698f0858753cafaca39cdf746e33731a5325b7c820779b37de18359924f3edd2f1b37bda53f025247e4afec422d8bdb5006bf
-
Filesize
5.2MB
MD52236f7acc7528378317bc27f8e83230f
SHA157cfb092db3be59ca7aa4f001ff83abf05b3f0c9
SHA25610ed553b535ad752ac8985f4aeb54b82ce2836008acbf25cff0050e2dbdc7803
SHA512350749917d9b53b66071f51d446a1ca7254eb2a06716097c0e63212631af74e1950c11aef84d0efd37dc3156a66d0e4949727fe395a65e9241fe936238e4864e
-
Filesize
5.2MB
MD5085fc2939e9424487315fa7d21306ad2
SHA16b97957280190e146224a506e3b117c75c2bc0e2
SHA25642f198c0516750f326ecdc373138c31980606b79b0bccc493ea9cc61330fa667
SHA512e986e2f9511e46d1e6e02746c162c09992efe7182a4f9efcd8095482649cce866ce926edd66041ad917a7765386bc40495a5b0dbe666a3d790dff130c54455dd
-
Filesize
5.2MB
MD5012c76d0a4139fecefe410d155255259
SHA16eda096eb27d6db295bc38864ef7bccadc090b28
SHA256ce6d8a97a52bf292944470f022b46b451149f3eb4f82312ce571ac8efb97a5c9
SHA5127e3a1c9136045809596f6764b045f8c67b9ed4de1668dae013d34c5a7183b2515cd7e37c68b955e0b0e3b5cbae867661f1763527bb6dc03d0931820d65b30b96
-
Filesize
5.2MB
MD5765e040ceaf4ed16aa63cf07a886270d
SHA13791ec57c31d1e0e99a1ef9920f7d17c553314f2
SHA25694fb17389103d0f3dfc7fcc505c7b2b073b2dc6892c1ab84e92959048d3109d0
SHA512c4bc54990b52d606a264cfa77dce480bc2c3e1493c6f9d0405ebee8d779fb6b14a9dec0f8c221d7b584e570537fad5317fa8f38fc856db35c82de2863b46000f
-
Filesize
5.2MB
MD555902af87e7b48b38567e49a565b9277
SHA1f26e922f4ddf68e4bd01086c01465f24d95bef35
SHA25622799df134e614906bc9abb4f96db82a4f725f34d4740576881b57a0a785bd4b
SHA512cb91e050e43b293024351db11769ed402040ec6a3b19be8b7298a60ac430ef398937daa1223e43ee35a1c485262263112924575e14110744b2e5e8245752360c
-
Filesize
5.2MB
MD57efb4b29fc967740e85592a812cb9f9a
SHA13172e4ac1a9c328d66fb3c37003bf79d1c792d84
SHA2565f24b431ec230bb208198df1f1ea3ffec1b230ac537528aad18cb3346dbdd747
SHA5126f038fbcbaa5f1a32b2d4678c01916590e1e33748df4c06476ec8d48b1ce257919709f007ec1c8b51d4f7cce05b839add343d0c02a8ff77ae2ae1c628e39aae5
-
Filesize
5.2MB
MD5823978bb56de1ce584bf81be86ef778b
SHA1c1a948d117c882f637e193e0fa0179d2dd6f7abf
SHA256f003f542e9b4b339628215732e811f02992447df0b26fa0f40c00009136d0985
SHA512cfedff311fd1c5d7494fd58b7af2e8a52a9b0fb91266afe8dd87164cf9ed8048eca5979495c9823dd47738541fda742083d6ae0b66a898dca14d137206cb474a
-
Filesize
5.2MB
MD56714aa47aaf63b67854dc092e80a856c
SHA18c3145edc3c8b5c4dce33a503ead709784818e3b
SHA256c159fcb0675c1fdc663a0d456759396f9f2d0bace2ecbc1e3d133cad8a0fce33
SHA512e4c801bd1e7a8366ba21c27430352d7a7023b6b36ea7862c909aece32b5ad82bf1e5b571c2dbefff70acdf98419d371fb99e5ef0540d75d52325df9c4ebc89f0
-
Filesize
5.2MB
MD5c278ef07a7f1bedfc779304693e32a27
SHA1dd4e3b588171d00a02b8a7f76e9c6f6347b85eda
SHA2568ccf6b47a369f3b6dafe857348486eff23fb9ed2a9fafbf0c5267cd6c49170ed
SHA512c4a8b67853dc2b41427050759fc8c31eeb6af996d037e06d14b97d4c95d4c69e3b85e70fcc09fabea494fcb5fd049b6fb2fb15e9a56f3a15a03f6ca3448c53ee
-
Filesize
5.2MB
MD5573237ba0a2351cbd984c71c466613e9
SHA12723348252d080ba23a4ea6f9a1e6d6f2f69b216
SHA256f84b855a972ab0ef4e933a50511281ad748f0d92c207f540023ec42caf3a4a83
SHA5128c8d18476d704b37596eb2c49832860bf4ca3d7e98c1521644ecfc22c3cae9b9e8bf84fdfa7aabdc64698a7a60154368a26444adc4ab2cd368a688ce59615b7a
-
Filesize
5.2MB
MD5f5044cc3babe000eb41efa1bc45d8cc6
SHA1d8d706ec597892b1f4ee0bc724a5fdef2d329a36
SHA2563ea4ab8d8630ca0557b631387b591b853ad4d87b636d3b0d718f6af58aa864f7
SHA512e4419951f10205d0b395c5b19e135da6297412cd9a88fb71b6694a261fc70b3f5049065bc333f7a4aa8adaeae612184c83aef92412713338ca7aa9ad0d75e895
-
Filesize
5.2MB
MD5c4c69008e768fa8929d75c6e8c9a8aad
SHA1b9df929edf7994e6b23dde8037f35b07e4604e25
SHA256aadadc18056ffe8eed7e2ad87d0481561624b746d96bbcadadbd21725670aa9e
SHA5122df1c0794e936a19f21bd3030d0090dc7a87ee015206a20a3d7c6f30d78eac51ea17a65dd6549b75d67804f2ad286d22cfd8e9bbec0b2e60a4ef6819c177c55a
-
Filesize
5.2MB
MD57d105613226e7b5ec3eb8d9093f83bed
SHA1a242d0f7498556d72b1a7817de9aa9d4f8f4f10b
SHA256dae679fd9f44053ec4d85d3c7da602f78f7c74a626f00111161f41f57aef6a6f
SHA5128f1c1c665f99392e599c886a63a8d41651f36be416fa3d3737e15b3699c981d1ea9a9ced19f08b7fd9fd2d5e0c7190170b4c91bf296dd9a379126fa811a0012f
-
Filesize
5.2MB
MD56aa8f67deeb15ff9f3b9c8f151f08b8b
SHA1841a5264a9d29e08f5316f3863e23f44eac56cec
SHA256cb2e10bbf9235faa6c1312e202d34e67e5ef265a2d64b58641c4fb9ce7470260
SHA5126305a2ef1fa9ec4008c87ea5c1b0a30d06c5a5a10365b40c3e3b1a6a0db4fff7c2eb628e3e2bd76a1987eaf7c01950f68dd07ec776070bb109b1e214adf08e5c
-
Filesize
5.2MB
MD5b572110202a8a9d19da76c1adfaf0d68
SHA13b81c7daf83c278874eddaf61a5dc96f47afef60
SHA256b6a3bfe0dd3d671ce2716bf24090aed521ad801b871b6b7765ff4b94b699a1c3
SHA512ba9f6e73afa8f930d1f609b1b1510ce64d9991a6ef1d06e984423667fb5e8187e46565a3b841a43696ae2ed9d2c074287f9be3f0e262c12bbfcba17401154fcd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB