Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-11-2024 19:21
General
-
Target
2024-11-01_873565007998c3a95a3e12bbca689002_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
873565007998c3a95a3e12bbca689002
-
SHA1
d05af4adbe1c1b9b962509a77c3b8d9180cf323b
-
SHA256
8c4f5acf8ca15b6737531b6571db71e5780dbc4593cf884228cfc285094baaaf
-
SHA512
e27caa83fc106b2c5c724083c0e9e72007df25bb0446e73edfdd4e1a1971087a03707bf7ca39e8fd558957ee75c0587a58031293aaa4a11e297d2aebe169d6c4
-
SSDEEP
98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUL:T+q56utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 50 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-01_873565007998c3a95a3e12bbca689002_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-01_873565007998c3a95a3e12bbca689002_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\dUTkATI.exeC:\Windows\System\dUTkATI.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\wboWgRZ.exeC:\Windows\System\wboWgRZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\dQWNSFB.exeC:\Windows\System\dQWNSFB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\QHCHbwW.exeC:\Windows\System\QHCHbwW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sTwbLmX.exeC:\Windows\System\sTwbLmX.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\STvpnJT.exeC:\Windows\System\STvpnJT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CigvITV.exeC:\Windows\System\CigvITV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\oZHPImU.exeC:\Windows\System\oZHPImU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\yThYHPR.exeC:\Windows\System\yThYHPR.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ZfHxpHG.exeC:\Windows\System\ZfHxpHG.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\qCqUIIg.exeC:\Windows\System\qCqUIIg.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\apUkdoz.exeC:\Windows\System\apUkdoz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RdTklmc.exeC:\Windows\System\RdTklmc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\UqzmZeT.exeC:\Windows\System\UqzmZeT.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\MeRMnXW.exeC:\Windows\System\MeRMnXW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\YwMCcFL.exeC:\Windows\System\YwMCcFL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\ejSaORh.exeC:\Windows\System\ejSaORh.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CvgetYz.exeC:\Windows\System\CvgetYz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\SYyAbIU.exeC:\Windows\System\SYyAbIU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\AdUcraC.exeC:\Windows\System\AdUcraC.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sLeRbkK.exeC:\Windows\System\sLeRbkK.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5530095030cab2652ff67af24747d3578
SHA17da68ee20c187689295696a161d83a94f7c165a0
SHA256bac2810b25dec511d195cc808cf109180ef88f2fa85ac357c025bd2f87e22271
SHA512c9b0a18757de241423ec22fea6a2d161dc6627d9240f0b6bb85f7ffa855c9026b5817bdf903f350e8a5b2dcd50a5c681c21984d8e39ed5f3eef5b3fbfce76519
-
Filesize
5.9MB
MD5b14f6b26308095651d9dca9a9a770f2d
SHA1fd2987bf56fef309e8d755818cf2686353c94724
SHA256d6a1506e7e19e3a5551ef2614a06f1a7b21bbfd73e064637ef517cbd1afe617c
SHA512be7920cf3d4f6a8b838f8eabd9e1e7891e930668c2412fa4f4b1f472e9fa7f3f0b5e80e159bc7b9450ab6ab6fd7075ca37cd7a98a06d757720a5d77b2e60254f
-
Filesize
5.9MB
MD507e8ce40ee510d754abd83db7e64eedd
SHA1001170af8e1954f10be56021f724b4b341223df4
SHA2563d579e178fd3cfdbf7fe4bbe5e7ad0913b7d8b3b309e6a640d7d36702e976c8b
SHA5124f868890e2eb352e9ff13eefb4a2e840549da3501c7d73780f9117da32ee2d4a12f729471452a9649e8dffdf48f771fb010a097bfa5fa350cb092ae5cc22c89d
-
Filesize
5.9MB
MD54f211332e0f212ce7d4a605e080eaf5b
SHA169cc439222de9573345f58310dad2042c35cfe44
SHA25632db2a414b500861e3309195e9602d0b88f8a260952c6e175badab62860a835b
SHA51281a43dc617d692b9db3c863de7fa16a26323a43cf427e8162505e4a12d375530abdbcff29308cdf094176cf88cf24dcfc84851be4b01cf70f134983c95ad2988
-
Filesize
5.9MB
MD58d309787fdba1806a9870830c2d5b792
SHA1010e33de18b39f4ac1356fa3ed70b9f863b3ae7c
SHA2564f5d7553a38e5787c46859776bd2e65d0591b2ff0f0c8c110b85219de55cbd93
SHA512571cb8f300739f00cc3a158bb01e2bb25c86398bc2a6f3c09dcb1542632c8a3b05714a225103f8e52d68bf9dd50788ca92d5e7bd4348f0782b854caaf1fe7ea1
-
Filesize
5.9MB
MD56dac81ae63c391eb200378f2bd14413a
SHA188f52c42f105132573052f98aa04114b13478235
SHA256076579ab4e16e563a12313de6afef1dd1a55cfabedb0409ba53824034230548b
SHA512906e443e19e9fb4bbf1920a5fbbdf8b77c450730ae33799f7ce0aba4ef884bdf8c4e611b1c5bc0792d53a46ab3f60decd099a6082a69c0f14cf9e7c30c66f69d
-
Filesize
5.9MB
MD58c1ece2d745bc4ddbd4aa3ec3d6dd692
SHA17145a9b20759e2596e8f472ebd677d1b534d9301
SHA256af84d4922e3d333321ce6ad885cb126dfe43a17da33bc5a3b752f3efa82c6887
SHA51219b49322c51903637a07b4ba70812f2a550b6cdca3dca7a7af484dff2e56377fcac50b98f612b3061024c2ab07c247236df41542227a813da9713a3fa514e6ef
-
Filesize
5.9MB
MD5b426ab02cc2b0963820db43aefa436f0
SHA1a7ffafb080cae5d07bdead943ea27410a3d1d785
SHA2563cbdd509803c86904ab70fbeaec235a6cb755ba61280077ff382206b025293a2
SHA512ebce341a69e85020f99b11e2cb1ca84202044bc999033aaa8eb754849ba8c926284184ede3831325698928d98c2e08dc73c48884d98a04e7b64f1af99905d061
-
Filesize
5.9MB
MD59ce7282381363c3309411082f702a4f9
SHA1dcb38569d0e62a73adbae836c75b4b2d23a444ef
SHA256d6c9e9c6e4b8d80daab394fe020577ce359511595b2361bbd2f81e94f4c379eb
SHA5122a8d1675414bba1058fbba1fd1d7eb01587cd59397f92c379440e3a15f064a58d52b86ad39a248120c1491fb0877a99d1c51de9c69d43295b2504b5e2b5842a1
-
Filesize
5.9MB
MD5ba0b70016e23c26b4ed7730c5448b229
SHA14f04592ae212cf9084a8488c5e65bd7a2ccb56bc
SHA256240972ae67ef3a138bb11ab65a0fb036faa62a57f16264d7ad507e3bb4b915f8
SHA512467f170f69bd504f944ce83f46e919b46317a3cab2f58b51a9789bec8bcc9765eb9f912149fd11d3a69b7ecb93b30ed3e644bee47a7adf3beaef307964d27a7e
-
Filesize
5.9MB
MD576d7501da80f4b83e7b6331f76096840
SHA1ab6f6af1f979b665123fcfc3c0f9b0428fddb666
SHA25609830ffba3411f2b32e15c41e0b7b25389caee23cf37f99ef526ff30e1c4ca0a
SHA5127b98aa59651d3b60d64c87696cc69107c2b776291f7b610b10a12ad07c33808fd7de5d113566ae2b447ac77584817c4f68dd6afdce3e8724851ada9c349645e4
-
Filesize
5.9MB
MD5ed972d3a2d4799d657b92443f827edf8
SHA113a4dc3c6c70b34ff06c867816e1efb8cffed1f6
SHA25621a3ec49cb75336f07475a0b16ffb4cd194387e02ee69a691925a0d6182462d5
SHA512a8551a005243c6e14238b5ef90013ce46f8744976de9109ce6ecf5862fce39fddb8a9bd02820c15223d7d51050c83519dfaa62b653cf9fe8b0bfea3f3287762a
-
Filesize
5.9MB
MD5bff194c56b7ab54dabc875c4766133ac
SHA1e84fbef6a9ea98975d34ef67f7556844a593e9c8
SHA256ba258e80e807c40886969ad25d96c92b4091f639ad2c3fd49d7742ec207c564f
SHA5128114367fbba95882ed6996711279bc6cb0feef491c2f1b9ce3dd0024c4d3f010f01a404276602ec2d6ba03482d925bdaffde826b3ec4946e8d3104bfca6dbc4a
-
Filesize
5.9MB
MD570889304287465973f28599f5e9a4e53
SHA16a08403c94d6f4d29c63babf4b7772e244eda919
SHA25615bd7cb7227e1749bc66a1c59718359f18a4b41e64d2a590356424d640e2a817
SHA512eccea4d034b5596b0407d94dbf1bf42783d0ab7fec6d3ce2c750b4f8d3685386f16aa2f046fc9e5ddd44a1ff2fe7c4471dfb9533fddb4eab5906649459ef2009
-
Filesize
5.9MB
MD5657a7a646cf2b93dac3cdfa8c92bd37c
SHA12c2dc00e8c40365a912d9d7f743310d53b4b42a3
SHA2566a474aa395987531a86967d1c61aab028808e36055471c5722ec40d7f11638bf
SHA512f01156ef2f78a74c97d955aaaed849d9e63a6888a29c4ed02af8743df90cbb7c1a14806e03423df4e01031e2b194dba7f491624c4f6abc70f084f792f0af9c56
-
Filesize
5.9MB
MD56ed47874804411dfb701fbce24672ab2
SHA16cc06e61ac7e89e764daf910583478c8878a28a3
SHA256437cbbeca14df934e90a4f579b2797405cff4d6141d99ce082bfcd769b653325
SHA512443d892d54632e8548bcfe01d3bb94732272505321f70262d16b37181b48cbf1e2ad959c1a9014d11478941915e8822e23c2fed9a0cf679eedd15600904c1e5e
-
Filesize
5.9MB
MD5f87a883dc2a9b72970bf22396049e0ba
SHA1acb3a5cafc7eb3d8032cb5b01fe47865a9fdb1cb
SHA2565ca31a1842b3909091f2b0ef2f20fa5ac0d623233265cbe23a35dbeaf74cdcfc
SHA5126f446bc28f7d73fbe77756193a6110266e5b16fb3c59515ff4a59a8affed80eeee6ff689f41e96a44fca70324d3cb77c648041dd1d5130900a10c51fcd7d5360
-
Filesize
5.9MB
MD54d3733824a7d4c7df1b7b38a07d485d5
SHA1ab86e8e03119a04bb41ede317e49a9a7107ae72b
SHA2565d8e35adf42c47c9e528c834fd57ebc827b405da31959894894b44d55dfb8fcf
SHA51211aa95f28b5ffe1983e29766c89931f1cc8b816a392c01cb255b85bd2c0cdc769f0b3d04a56ee49fd0c52ca5e4b6706073eabb5c2295fca9267ab59c9f5ddd57
-
Filesize
5.9MB
MD586f4a1c52c8699adee78ba430eafebd1
SHA159ef40f935a883ba290ecbcde4b6f6082aa1285b
SHA2563a6a4d1c28070a9f7eaab142527ac68fba782141c0730c4c78e2df041dff06e3
SHA51241bdb53f1736cdfafd76f3f44c8992920445967b8570295e19d1c2ae2d36db785e72f8a21917ccbd49920238529c9b45a7153753f08a4fa5a7c852e7103f3da9
-
Filesize
5.9MB
MD59bd29b6a6fac96e1c1a2ca1dc6f5a88d
SHA19bd582e183505e12bd3dc6ade77108243625f8f7
SHA25616d7a14568263d1b7fda6b677ef7593e076ab6e1285902daba48a894f1c19abe
SHA512b8c9178395d1038eb7b40004b512dc64b5517682786b074e89e3e982019946530fb16d76272efe7a8773dbada7487a30751f0a0a58cc4327939dbf5d2985e03e
-
Filesize
5.9MB
MD585c1ed299e45e647691a14249a2d3e92
SHA1bdab500fa13059e8d0d32f1da4ba2a889d6f0108
SHA256e9d588a4cce4a0d56628a1cc73f4198cfabe9dbd467eabc771736efeeccf539f
SHA51226b3dd1c6e763b4056266fa6abd75f626e318654fd9f3521e48f4c7c20f311d8b1b9d37ad96b3bf7d219f4f1f7451fa1ec91c8b84d7e0ca7c0b63d37be24e01e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB