Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/09/2024, 09:49
General
-
Target
2024-09-08_10ef892d81a870ab489ff3c740ee5ef4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
10ef892d81a870ab489ff3c740ee5ef4
-
SHA1
380235ce0b3adc307c032db7b76a60da16f7f863
-
SHA256
ecc094941280562e8dfeb979ff5facfaed33365fdae81cb7928f26d3abc825b1
-
SHA512
eef80310949e38cbf4d478c6b1ba908e0c75a1888aa62c3d8602c5341a56aa85bc7717f6a5042d7365404c1b23cb58d94bd1e0ed48957c311d4eb7c3ba327589
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibd56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_10ef892d81a870ab489ff3c740ee5ef4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_10ef892d81a870ab489ff3c740ee5ef4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GjewrxJ.exeC:\Windows\System\GjewrxJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DSnvJbb.exeC:\Windows\System\DSnvJbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\loUZwIS.exeC:\Windows\System\loUZwIS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CHsuuyC.exeC:\Windows\System\CHsuuyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryluaCt.exeC:\Windows\System\ryluaCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCotPCT.exeC:\Windows\System\DCotPCT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGjUPCU.exeC:\Windows\System\RGjUPCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cqAIeIR.exeC:\Windows\System\cqAIeIR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfEIzcS.exeC:\Windows\System\LfEIzcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MYDCsna.exeC:\Windows\System\MYDCsna.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIRYLLj.exeC:\Windows\System\qIRYLLj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwKzKLF.exeC:\Windows\System\BwKzKLF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kqTcmgJ.exeC:\Windows\System\kqTcmgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BloRzSw.exeC:\Windows\System\BloRzSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bIIgawV.exeC:\Windows\System\bIIgawV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\adTZsAo.exeC:\Windows\System\adTZsAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSAcfPh.exeC:\Windows\System\SSAcfPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XvZEVjJ.exeC:\Windows\System\XvZEVjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtubcPg.exeC:\Windows\System\gtubcPg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zqORJKx.exeC:\Windows\System\zqORJKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pefNWor.exeC:\Windows\System\pefNWor.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD512eaeda5f1cb6564a70251bc57943655
SHA140eafa695a94ab5414b43c8fc37075fa3de2eb10
SHA25638f3a1029320d5d579611ba1c1ec8b574ce56bfd0741c815169063cd4ea88d8f
SHA5126bbfe8f002e0985a493af1f9ff7a4268e84b916047468cc6ad83323f590b878b3e22edf5492c0a7df79f57aa1b0c48d01befd719608f8b0abc38827351df3ec9
-
Filesize
5.2MB
MD536038e67fc31faefe2ca1a07953d24b8
SHA160d80ec09f880b293a09ea7e62838890517370ef
SHA256392a39f6af361012c0cbdc7600ce369b0f84ec1d6da9cf08f53db8ae5608a8aa
SHA5121ba4924307a0b5d6c666b38ad6b7a2c03ed105c18e0b992badde4f13e4af50b38dbcac6c95d8d245a7bc914ea038725aa16ae309a744c999427ccbd95e36a07c
-
Filesize
5.2MB
MD51367ef13c6b4385b98e6bf453f1b52cf
SHA122243f577e01c64f6ed82ff5761f490f5bb719df
SHA2566da9dec501b61cbd12271642ff310510074c575dea3940c4b8c8b1c537fa7612
SHA5127cc213a5200ec933e8e4874d2fd874d2a8af15fe7b6d74fef0ac368eba948a93e1917b122c35941da7681a7d46ad77765587bac91f86d68de01a938abb4e1222
-
Filesize
5.2MB
MD55f0a91fb777947b3b1fe7d5db1eea89b
SHA1d0760f09c7b654a242bd77363857529250f5732c
SHA256d2849b66c3575112c48219f8c8592e2761287c694325f523e8901a7eb6c6d85a
SHA5126d73872aad25866799bff09bb7687dbc0acaafac81def654c1f794d5fab3a3bf8e3df78d5dd7eca4517cea51206c6530de0e1a8b42e038b28ae00228d374f918
-
Filesize
5.2MB
MD5c79aa8cd7f68d8f2d8150a7fd506da96
SHA14b8ace81c2caa4ecfa84ef3ddd76f2bf1a33dc77
SHA25613fb78ea89018f18d19314b8f01dca2029edaacd487f8407cd2d71921eebe2ec
SHA5127592ab40d2a88223d6fbdf53f83b1c5df499e8cafb8f004c20a9686a59c1b55465bdc7e0c796e41045fa53e6e5e5b91218713bee313eac78dc99dc3c19593df2
-
Filesize
5.2MB
MD554ce744dc6cd65cca4b6b42af2ec1105
SHA135c83524f0d3c9c0ea6aa1fd0a274b34d3549bde
SHA2563767e163b7ce4335531c1ec15f1ee0f239a3a143e04d7254e0ad5806bd4561a7
SHA5125063563e98d4e2c3ac3bd91fbd8b49e80cf81929fcf94ef3bd266bccbe1a37cf34f720b8f9943e7185b0f8c20288efa683e2eaa2b26a4ae479028e0ee3cb5a55
-
Filesize
5.2MB
MD57548426d6871c76c49c46f2c8ce6ff9f
SHA1afac5ed055609276e3a2da5a79491fc9722e9e0b
SHA25616c60d17cdd2ad4c0caa051c5d8eac2ff529a3ddd329d1f6f5b4102e1ea34980
SHA51261b476aa4f34c9c6cd611d962399ddef8ce106727cdabfc668b8b69303b8da8a01a7032cfb6f5b6435a0e24e6653fba10d0758f05aba3d5f5d1e341247305d98
-
Filesize
5.2MB
MD58211a8282f38f3c0f87a864fd8e01d44
SHA150587f1aefd15ad144526d98e6f1bf3041a81df2
SHA256b5f92d0df017296307bbce0f4d80ec0091e140ea43b653ce4e3b1529870b07bc
SHA5129dc7d9211531197b078fc7a46753c98bb11e2fa462fbf0afc302fd26cf495fcf1ea9868cd5ffa1d3a0e28262441b836bbb8d701b9feed95f82d5b1d073e3aed3
-
Filesize
5.2MB
MD5a312d3f194958b4e8f1e7232c18da859
SHA1fd605f03643a89ed7377955263b8e312bdf30008
SHA256e52a1dae16cfd26e5bf38d330b55acbc139a158a8dcc043681d3688e26f3be39
SHA5126118e2efa8d4f3e84a603bffc23da0ad1e72dcc1330b60b906f5d66cacaff486203d2ff6151f3e4ede3eb700082b4d6156d86b1e3635285317767a69dc217fbd
-
Filesize
5.2MB
MD5cc2a3a6e0b8da8cdeed5e769860c75ee
SHA146f87e8df985b2bd1ec842dc440ed4cfa52745c8
SHA2569b2aabdff08190fcf4a9ab63f03c151cad1314d91fe031192b9fedd2fd4ec1de
SHA512b5ef03421b1cb6805d2d39c52d10d585960e71a96922b9d31014a0705b5aed49ad6dca2bff3042c07a8a5f8e981886275864dacca5fa8988fc0b982b40e69097
-
Filesize
5.2MB
MD5659465fe8fbc9f353e7e85eedc082c5d
SHA14b99e571a1ee67f6860e454a23957070d3cdae4f
SHA2560b8b4383138d77edac74fa46c0713295892c86918233ba132e83075f1123da25
SHA512685d828aa99a1dce0b601d419690b47d7650cf8be5a641d9669ea2b02ca9fa51a8b8db2ff41cbea62f5ca945032af52cefb08a0ab0757ff09679db8b7a615a4b
-
Filesize
5.2MB
MD5207e2fe417916d776d303809e46770ec
SHA10b92b79aa77fba76dc4e60d684441a3da73159fc
SHA256274aa7e185fd4871da187a88be32f818909f73bbe2d74bebcd92469a9ea59f18
SHA5127d021a9bd138b161afa7963c8579355c730229542408f2f243b7a5155d9f80861acd380133ab369a652170427e6b20fdf86975a283e7bb0494534f2bd72b19d8
-
Filesize
5.2MB
MD5f621270d65e941c91511ef0a6f83681a
SHA1deeda1e854ac41e6663ca06b244bdfb61e146acc
SHA256c4cfb54ff498f31b329fdced1bb4b44b3c0e7cd2f3bee44fd2779b0682ad1e43
SHA5126389e9e1ec8864d91a0d030cd02d88ce4483876ae39840f086de25f414b3560e2cb1c06c26d49eb4c58140d4ef26519340324b8b78528a60dbb07bb8de75937a
-
Filesize
5.2MB
MD5185dad26cea4b545de6eb09d8d562b5a
SHA18da3762ad9314d611e579343e1de843fb59c904e
SHA256b3a18e3839e0f7b7dcc05d5130a5cb9a1c53ec0996e32b0bf728f376c14fa5dc
SHA5126c4ef63861d4e357fa9179d0ef419e014a47ef2537e90d6353a879b60c8ae88ff9b7a9c86ad32fdeb86b844f94b540e02fe503e9f37237de46da06bb2225518b
-
Filesize
5.2MB
MD5980691007152e5ef03d27ef3f2449088
SHA17062cd13598d7152f36e775977c29b4641e2e087
SHA256b5ed789da4786cc45ea55815a345bb231979dedb64b5c71a7e4f2fe60ced32cf
SHA512825e0bb62cbd324025cbbc33fdee59f8708e72afc9ebb73e481913e43876117e216907c5b39bcb4a5bde26f7161077ee6cb3a6f64065a46d15a206dbc37ae600
-
Filesize
5.2MB
MD51341ce7da99cc47b1179f14539442602
SHA1f75d0f197529a3abbc2d5192d5e61d78a5d4b83c
SHA2563676a382a9a48b57ce7675018d15fb8266f0474c72f579895208134e44b15d0e
SHA512413ed5ca826bbddce3c1bd4ee69bc752eb6f15238dad51211cfa63753577b767874025d4bf26e1b0bf4a105fab16ebf2dc7a01eb81fd4d9d760e7d1b82bc14a8
-
Filesize
5.2MB
MD528538c26553d99091cba82dfd85aa913
SHA16c66501fbb3e0b26badc0e225cf9c5488ec5519b
SHA25696ef0458960c9b256eca5c0da9b9362ec5a4b92676e130ca268a2027b8503100
SHA512d5700790bcd0479e6c47b563b709132ab990d5090e3dd84bf6dba0c325c032379a90765be33b641c282376083ddfa9ddbcc9abe7bd19bf7343bdbe8a132ed8cd
-
Filesize
5.2MB
MD5265ec5a8b3f895b59c440d1a6d3b1c3f
SHA1cfb3b24790e98fbf9e3c6815b125a7599870cd9b
SHA2567803fac509816b4c19803bd7de6d8cf67b04c7c462b744e17b744bb74045371d
SHA512c7dc3c0fff585499b639544473a0fd5ac67f6e1d77c292d826059559a3f94c90c16b9f64d2acc9556df5f66c0216a0344771065a915bf9020e3ab1dc5440fd4f
-
Filesize
5.2MB
MD543763eca0d8c30358f5e31312b0c2cb3
SHA1a577d233136edabea23f52230f0c83a77d582912
SHA25663c84da78e81942f9ed132014848a7393b7c08cf877df5e7dbd7887b2bbd948b
SHA512ad856be3d7c4628b07d2b2a8c37a23ddbe1e8bf74a82056ad91385574c8c4b31e9e14b2538436580da6a4d98b9278e2d194c66763f7983c3df55c204959ece4d
-
Filesize
5.2MB
MD515286a570e3f5018240500c136c290c9
SHA1e98f35ba8f1330ebaeefa96917bc0f2fc2503428
SHA256f3c63617499cba0221fe74c873592ef026ef523ef90ecedad6c94ab7479b9792
SHA5122b9fa5cf5a12cfce0b27b4bab72dd54a49f0143bff50e276d49f5d30cb6637c5a1c9cc14244c3c8fa36d19c7231004bfc168c0cc27ca8107ecfc2452c941d3c6
-
Filesize
5.2MB
MD5bf763ce0638402c51dc0d794e3f89be9
SHA1d2d66e3c4001bc296531ab695b8cca028dafa94d
SHA2560c6879a240c0382e2c08172745d2134dafa71f21aea0297925ff7909911ce38c
SHA5125e57ead7f69d3ac29f559d873ff702e964143c43372d0f8179f75296c734acb75b5e19cefb5fb5ea61aea0d0614d29a97502b57b5b55fd817d12b32375a4fb04
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB