Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 12:33
General
-
Target
2024-09-13_10e5054ad25f73f984b83d70247c3437_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
10e5054ad25f73f984b83d70247c3437
-
SHA1
2a0652dd3aa84ade7a57c410654ec156c924bece
-
SHA256
e62c25526e88b79ef4786f1e67e5d94b1b5bb649200af8f8988aa5f51aec6d57
-
SHA512
a3bd988d812e6788729abc7c11dc4cf3bbfad4b8de41190d3e1bc36bc121a7cfcf2344259e029166db000bb8a598ff30c245582db81628c889510110df0f649c
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibd56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_10e5054ad25f73f984b83d70247c3437_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_10e5054ad25f73f984b83d70247c3437_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FoyZytX.exeC:\Windows\System\FoyZytX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AavGPAk.exeC:\Windows\System\AavGPAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhHCJFi.exeC:\Windows\System\uhHCJFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JokTfUR.exeC:\Windows\System\JokTfUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlbJbZS.exeC:\Windows\System\AlbJbZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fCXRltr.exeC:\Windows\System\fCXRltr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFohTsk.exeC:\Windows\System\KFohTsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSaETtj.exeC:\Windows\System\GSaETtj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KQQGMyW.exeC:\Windows\System\KQQGMyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\obfUYtR.exeC:\Windows\System\obfUYtR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELtBSIx.exeC:\Windows\System\ELtBSIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZnsqyNR.exeC:\Windows\System\ZnsqyNR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmWkEgc.exeC:\Windows\System\kmWkEgc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxFzRDw.exeC:\Windows\System\cxFzRDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OEEjCkQ.exeC:\Windows\System\OEEjCkQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwdiLge.exeC:\Windows\System\CwdiLge.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bNyryiV.exeC:\Windows\System\bNyryiV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oygYNts.exeC:\Windows\System\oygYNts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\htbQQIr.exeC:\Windows\System\htbQQIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cacyqMl.exeC:\Windows\System\cacyqMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xgCuzVc.exeC:\Windows\System\xgCuzVc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5aa20505652f064fb9f957d20fda43769
SHA10682db0ee22edf7de7dfd254a8338363fffeca46
SHA2565e618769afeac017a884f20a5b4faa7df1433f9532a00e848ceb4dad25941922
SHA512e4c481b01a0ffc7452cbe141e2276c0f86e3419b9c41fd29d921ad337b4fb416c3077b5e06dea601255d306c38877bc065977bf467915c344877092104fb06e2
-
Filesize
5.2MB
MD5e0e3d718e54c08b0635a4ef96f4f6451
SHA12c0afb93e03ad168476470ec504ee3dec304c863
SHA2563d70c2c216c04d4b2f4462e6bdca231ff7489616146b0ccca7befd1f95207775
SHA512d6f571355bd44954a8d2a8c944805999c38d7aad05905c4dfd2a9f51384560d34506fabaac3f9f0dad4f2efd823634805df523a1d0a9760cbdfe5dc758212599
-
Filesize
5.2MB
MD5f5c97e0cc3b2015d82ee6d3b32b9af80
SHA1b547486165f91c6c325d647a85e3d128f21ba436
SHA256bccb375938754e3afce7e919337cc3bca2fe4215a8a2cd8a2016c3bbf6284e28
SHA512add7603c365fc76974cbd64e353efbd3ae84b4bfa7cd7ec739ba404ecbc397534e245309055e86a101121689ca3325753db5b38da1a2bb182bf8e0f137e84e7c
-
Filesize
5.2MB
MD556e4633e15b681fdf3494f25042f4720
SHA1cf798337f642baa3eb22f848ac10c7637e744d07
SHA2569f0b9764008f1ea252bf49a391ba68db71a767c32913adff7f3880a01c30471c
SHA5129362d81a51151ee7cfa072ad39aa22569f4d0853b54110be503a59df73cd4aee568e0644e1d76b041439b85d20e42005425d752ef32eabe6d3d430b9be04f6fa
-
Filesize
5.2MB
MD5cbfdd0a6d8034b4c18b6ccf48bcffca8
SHA17520f7d9fcdef8f7882ad8cf982f9a08d5df3aa5
SHA256a6c82f6ad09c5b5514519703e14ea39d31b7aeb94cc33218e6bdae9f3aa5368c
SHA512f6d2d673e5c3bc6ae48770770da5b84037550efbfa8fb81761dcf75e81915db2cfe72f8683de6c3b795df3aae8fab5d89b1e0cdb81b87f16d7c96292b6b77947
-
Filesize
5.2MB
MD59e09fed1169c140b388b15e4d59f4f41
SHA141d2fa92de32fb9cc283034a18ac2b0f95a8b415
SHA256334d648d48d984150d718f58d549ab8a2468b9f72e226f77238276ded69d8ebd
SHA512612a81a32dbb6e332ce22254f526206acb3028a141d0503e1308123e99c220d7b98357a77203c79b080bcb563ae9bad43f812cc99dddfbd8dabef6e3d874bd9f
-
Filesize
5.2MB
MD577d2ca0340fa8e514e2b64108fd81018
SHA1444862efa43132b7a289e5a2c3eaf9b604051ff5
SHA2567a50ac12ab42f25187eeb7ff9ca8b2195c4438f55d1df54bbf98d84c136ae7b8
SHA5126cd260530f0fce9bfb4ab704bb55f9b8959c0c1c0c5128b05df82127e2040d1903c43e58a5e83eb22a97cee1634ecf3039a680d1a06b744e2b82fa12f0a0129d
-
Filesize
5.2MB
MD5da2aeec48be54bab534f91048c7f25b7
SHA135ea6fec69c12882fdfa0a45f582668b63752186
SHA256ec2620dd23d7e7b22642ef9ed0b8f85960a9ecf70b758a82cb223b3d1c0028e1
SHA51234b33ff801fb4f381adb8eb4a4726a24163ecf7abfd64a764ce3b95e13c6869a7eb9a5cf06095d54bd35f5633544b2323e861d859ea0eefcd1dc027831be062f
-
Filesize
5.2MB
MD51d17590c2ccf94c2571cc8d8e1924470
SHA1ecba0203a02b3d591fd9410d9f74616ae4620adf
SHA2560cd836319ab08de13b476b2aec7ee73b24cf4d5f82fa5a2421d0a2bc9a18a60a
SHA512db758ce348b4009affc2f79fdbd9ce4034b9f8568f8d4c3247f2787cef43cb18177c1ea9932e8ea5f2ef4be15835a463c15f771c758619d9324a0bf7dc392233
-
Filesize
5.2MB
MD59e5bd814e929aa52c139f7ff6d190108
SHA120c6822ab37d499a66efe71d6066528bbba6e5d2
SHA25654cc32414d85d50701ae5e13c78bb84b7cfda44bb06c39e62dc34db5bb4d70b7
SHA5123e28518f7f7825fbdaacc71a462e7890fae522934014e3b9883b135ca7e8199eca1c1fb8e9389569e21d4a82a5f2dcaca2c0eb5fd1c8671f6f9af4fd8e0ed677
-
Filesize
5.2MB
MD52177abbd5e087c6f0e622f6635f382c6
SHA16531b219ef8c071d878043405f898491f6850fa9
SHA25678bd0402b247492ded8d7ba1a756b34be9f43fc79210a9956c150bd1a44fe585
SHA51240748e966311868fd6f2efdb647c70d9ddf5d03de6f03b739bc8ebfe89b7c037355aa616302b838da1d4933b6a737d4977194e6ecbda3a45ff1ef717874d1c77
-
Filesize
5.2MB
MD5b76a3835f68f9ac81e5ceab6259c0ffd
SHA1f3e41a94a3a335e1ab84ae654af2285f11e6060f
SHA2569e6863e8fdb4b424841b9a91c890d6fc6c2632682e53cbc381f123742db95de5
SHA512ceba1c3a291061c275931ce907839bf68bbfb248d948d652d887985afe3452255f4ea8a310fdb871fdf27ed65a62e265a8701c7b5376ea8aab48e6a7329403a7
-
Filesize
5.2MB
MD5c56679891ad9cc6128a653ea32c40889
SHA1b868ce28a6c1c63a8c35658c18bb9fbc94a98063
SHA2562ef93fef87269604a3992afa5868dc9a80d245ecfd48d30d0411d860c01a469f
SHA5126f7b18f12a58455858362a7a6769b327cc2eecc4a9c07947f86342de055802414914de16a8d1988213eea492259842f1109926f678f5e3a1146136ec8ac0c692
-
Filesize
5.2MB
MD53d2fae3acb62ba16b9200686b88d0c97
SHA1c37b54f41e33e276233a3607582853b16992b3b9
SHA2561390bba45accb3a224eb5e775c7ac37dedf6d6b0ad59ec1f4bc6421bf579d074
SHA51257f7c69314182ce4987c4604bc9dd8f972ede496d49984636fd0190a9da2570d1e9a5427be38b02c7bad811e5b373434b8a76916a55b600bc6a89315c766180a
-
Filesize
5.2MB
MD56c62ee90af337481173e5f2a1d4702ec
SHA15b9bad16b0921c05688fcdd5f9db9f7404c256c2
SHA2561c79c2d390aae4ad8a4065267b704f65b9085f90aa75267493ac0751416886f0
SHA5126ec20f843d5971b4039761440077fb165190be8940e2a528f83fc39afd780ea7f94e8eb1f644ae77f3ceb44e2def1be6ab5667df25cafd98e0c1a3937ad37abf
-
Filesize
5.2MB
MD5c72431d4f8297ad61d82e6051c79a556
SHA1e9f46dfa2eb760f086885890c9dbc27e68451e28
SHA256d8d9a91ea680aecf47c9f0b0110ec22deb7f5d4a84355e521e96bf23a5c0d3fb
SHA512a72f71c7231d8df44d2e0c6d5d7743cf1678032583c6351da51f0d71859bf5dfb35104ce2c4c220584ed086992dc2acd0ff79c517db7ec4a9d09b74ad472aa65
-
Filesize
5.2MB
MD5fddd15e0f43bb5b59f92334de4717a69
SHA128ac6f938a6f5861e3caff185c899eeb8606fd85
SHA2565c38c91221967fe1be520722a910c2606887f722c272235a00746525afea156d
SHA512a62829e2627731cdc0bd404c9a9294470f98866fad502e97db01e5abb13887f5d61ed8e3c23d0843b28b616a61e39dbf323cc53cdf33872f550650017300f7a4
-
Filesize
5.2MB
MD5dc0dd921d8d70ac8e6b0fd61ff947166
SHA1818af75c0ca338394079efcce2622ee15424e260
SHA256bfaf3812a418147bfc6597382227faa3c32d39035de2c7ec79ab9b98c9028c61
SHA5120c44bed5e5d9899f52f99fd95d322b31602936226c6a58e06b69fb2fe7e61d04ac6b0a9523d964859ede301772b2b8d8df36f4d63e1bef95432a3327c5e15fd8
-
Filesize
5.2MB
MD504ffa095360457ff4d288331b1fb0486
SHA167619990c6e41fd06c5d137584b6492015eb792b
SHA25640d461c41b4a4249cbb6c9aaed45f854b981726ffd054f6d812afb1cdc5097c4
SHA512b1ddb157dfcdd05579699ef6b3cba6326cbfceea1abbf80bd69408b7ce8682fb7f8005dc95137989e5841f0b8fc50c14e1733084c5b0edc10609b35e8a5a6943
-
Filesize
5.2MB
MD587ae8b634371ec0ee9645cf563f9c761
SHA121ea1a4a1375a9513d3a242db24fce00f4c03fe7
SHA256a670eb08bde8459bd559d2faee25790f6f7ddb3d2003ef0bd1c8630c19ea05de
SHA512be7e3121fe88d4589936e2a32198821f21633ca62e41a162a1be5da8b06ca0e09e4c53b9011b0cb3a426f9b42f000da922ddb14b3c70c248c4b1a9b221d201e8
-
Filesize
5.2MB
MD564d154da684a1c344fcdf8ca58673d12
SHA19650423db8792f4d23ab76d6794cdeefbc2fa4c9
SHA25669a96856ac7668740327a2e15d0b59075765a8e7678e3c221a794c0cb2190f95
SHA512cfab1d537611a1afff1d64d737927efa1a12df81159fc9bdeefcf62d22242ad76ab6d504a211f4af3022e6afb1846d9b1e35a7a7ed4cc374dff917c500ad1209
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB