Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 06:40
General
-
Target
2024-09-25_e10cc851614ac9e7fde6538373b54a8d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e10cc851614ac9e7fde6538373b54a8d
-
SHA1
fb2ef5d7acec2b623ffa1d7692ae3361cab7276a
-
SHA256
e1b5582d953010e9b08be4f74242131e537de61c86965c364fad9c451cb395d6
-
SHA512
cf09125fddb02edd97d9d2b127de964449c3373f32e29137efc277e3aa6c0895b0010993db3abef269f2d2103fc19cd2412f6af7ab0aaf4d7472f3fdc7eba8b7
-
SSDEEP
49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibj56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_e10cc851614ac9e7fde6538373b54a8d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_e10cc851614ac9e7fde6538373b54a8d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GfOOVsP.exeC:\Windows\System\GfOOVsP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIUCSsk.exeC:\Windows\System\MIUCSsk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bdlRVhq.exeC:\Windows\System\bdlRVhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnDhxlf.exeC:\Windows\System\MnDhxlf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yJiEEJH.exeC:\Windows\System\yJiEEJH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMNjVrI.exeC:\Windows\System\CMNjVrI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DxmwdoC.exeC:\Windows\System\DxmwdoC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\spoWugv.exeC:\Windows\System\spoWugv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDtVhpF.exeC:\Windows\System\NDtVhpF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bjHRzWm.exeC:\Windows\System\bjHRzWm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIczNOx.exeC:\Windows\System\SIczNOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdnixnF.exeC:\Windows\System\QdnixnF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYszHXY.exeC:\Windows\System\xYszHXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNzlFKc.exeC:\Windows\System\nNzlFKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DEQgFYY.exeC:\Windows\System\DEQgFYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfbtIkC.exeC:\Windows\System\kfbtIkC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JilqudJ.exeC:\Windows\System\JilqudJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmJSGxk.exeC:\Windows\System\RmJSGxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RUZhPjj.exeC:\Windows\System\RUZhPjj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ldcrIxD.exeC:\Windows\System\ldcrIxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cgCfSbn.exeC:\Windows\System\cgCfSbn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD558796a5ea0eebe6cedbb12873a49622d
SHA152863243f8596ec44d4d0e68d7190afbc9e4a834
SHA2566bd13dfa7975c86653d0ee389cfad4425594736b23da978c2a05ee1e8d22d155
SHA5128db6ef200f9d43c98023bfb3b05e540a4b0f9c6acc847177f33a3dcbcb03a8a4c347ad207227500c223b343a51566786b248e133163930267cfe2fcb50b24aa6
-
Filesize
5.2MB
MD57f86ed9ac016f6c9fd4da52fd90a1a99
SHA169d19bb1b21daffeaee44553c35a419c9e1cb889
SHA256ff42b2fcf3a453e25681ed816150a9d872f4d20170263184001c3ae71138ba39
SHA512dca5435307e3ce9af8eb822ca31b813308281e602c7fae77d13d27b4c7c124a37db9daf856c6dc33873f811d87c58d8166d31c325b9077b3006e82dbc4f0e3ae
-
Filesize
5.2MB
MD5509383d9bd6747556db6fce0a38379e3
SHA106896dd8d9414278012ac26440f6ba1ebb332ea9
SHA256a84a84b32ba3caacb54cc306cca6636b645fb662bed92bb6a5985bfa41cdab15
SHA5127f8baf2e63216ab24b4fcd60c2507e87c40ec932f9ea0c6599fb77146cef164391324aa88f44ed4b6ef8dfbfe657c7f72d23ffcd83ab54b202d491a1914bed8f
-
Filesize
5.2MB
MD5443eff8344b9ac2ac9b920ec1123db57
SHA11d509dd857f71fc4ad897e10aff2953a0c33af33
SHA256fc30d9fe79d518cc0168b84974541f7bac170bea41fc7c3fecdbc7e9564a2bd4
SHA5127c8aa57574017864d1836c5049ec2a4d8c35bc046d6761adc443657f498d12c3c0c31484d36ecf396c54e91f0c9d0d2032fbf972c132573e186ebb9c5fbadb07
-
Filesize
5.2MB
MD500e231745feb12f79acb00b8cfba5239
SHA1b170127de6fe07253a3777d16c006abb8b450c2d
SHA2562d9ffcf6fc19cbc4dc769d79dbac111c5d0d8c6db3185cafe4d8ce5e00bfab13
SHA512adda7ddd14207b6a67fdf652b4e6a45f0c081c6817abf050192bd9fd10b1d316b8a1e28610c388716ecb5265099d61832a84247b8c7edf7aea642b96c6482601
-
Filesize
5.2MB
MD5caec8d24b53bbfe791d847458ffd2a52
SHA1487d6deebd280a5171ae1faa49725fcd98b1a7e5
SHA256f3bed2a2ecd470b3bb28b7a4243306d466660e1bf18355f2200a845124dbd340
SHA5122dbe5c897a121d5e22ea82a96c75ee89e9c15c4dcd65390c32ce073b9cd3f4bbcf3eeb1093c5ec4de7917b263bc54bae6fbebeeee1d3f8e43a9132175f2fa2b7
-
Filesize
5.2MB
MD5e946e535da6c38d6ec329e4d5dc46102
SHA1566deca3cc1f9f50ae2b819317eaae4701be765e
SHA256d52d127488cfb528c484a591f23bbd017d0b4ac59b5345273f5d6dba67ac7e5e
SHA5128022f4bb0ca02fe986717961fb256831157de9d3204a5ab30cbd1e8598d7e650c912c5fd3333572f7445ed87e14fc0d3e50516712465a0697137d7490ec59b37
-
Filesize
5.2MB
MD56c22e4de97621a953948f4e47df57d52
SHA1875d946c7e91c1650e17f9ddd5200c57ad06af00
SHA2568a439c5b45992dfba9a871864cbdeb776b956981e29abfa08e0ed7d532d3ec24
SHA512bf8e17e89a2ac32e13392c3dfb50f6757056a7e0b00cc3e41360fc4a20d1b175d0ee22eee70ca451427425ecea45d21382fdb29f6a27026fe6571d6d2da942eb
-
Filesize
5.2MB
MD59d937e103e8225a5dac828753e0c43ce
SHA1dd673cf9bcb0ea61941c7423007b5619fb712ab7
SHA256275d01f101e733758a64954c726b4d767ed2cb97d8ebf6a784a73066fe678659
SHA5122451e4f92f9f568c217b5043fb9687be5a952b8be2465368ee3d3df7ff4474e2a6fb82387864b1be9f4b80ee9b0fb69eed7be8199d07605d2137528c50a8747a
-
Filesize
5.2MB
MD5add2ab23c5293c35227c3c3a13e0d636
SHA161d6026c828d92c7ea909f0218819a9c305abfbf
SHA25614485f22683a3f9e62bc7b77832df25b0f1af0f7d13d1b07d68bc1ca6e68b93f
SHA512cf5235fe01c6e563e1c4c27062a5cd93a45ddd2fe501c8a70932a84ea657fa79d9c159e5fbc08dfb3793654d03f43ffdd46397f92b02bb452d1cf87391e764dd
-
Filesize
5.2MB
MD56b6c2c454edc79c20088d7707c7b8369
SHA1d179173e4b9887aee5f7dd1a4e63066183de0ce0
SHA256820f7f34f76b22ff4f32753a2c73b53017143d5c880354bb010a04a48275cf05
SHA5129c90b08eecfb0f55ae1d951aacbdbcea03da48c4bd7f337dd7a98bf63c4b5c55d9c3e361a4b06716fe6b2694c614c5c528b599d4e25216cc5971d19ef724a225
-
Filesize
5.2MB
MD59033b56c2e7cc427affd103787392b86
SHA11ca2b3f5d36f70ea6e67e372b0cf5d8411df1593
SHA256461c3b901e543d36aed2cceb0f583787a021707230d75752dd3d08234cb1a7da
SHA5120f843a5c49400750574c86c21f66c6a7f7aaa005467d0bcc16565538717fb228555ed3135b9456cf1d11ddfb2efb11c2387def65389a1d058ea6365ecf1cdf45
-
Filesize
5.2MB
MD5185ca133fa847f5a4ba095e59413a81d
SHA1ce6f945411d72300c31e11d5320ea84725ba474e
SHA256451463f1142cbcd1cc8f2fcf223c5b0d765c7f1a33b8de78daa614330ccb6506
SHA512b29808c0838afe1cfd0614ed307087c39b67e2b082934f8edb1722dfed5988420bfd8f4073ad6430cf4d0e6d70fb9a8df58528f48187415d48f3695c8fdad92e
-
Filesize
5.2MB
MD5706cee1d675008ff54a0b94bfb508097
SHA14c41be1868a2ea4e5ec181dc4f4fe568cd5df211
SHA256f607c48e88c4745609e766dd59b64546bdd2d7e0a4c7a74aabc8664d53aae63e
SHA5129b638dfaa40c7c23ff6061eb549c3f422d74aa58d41869ca021d39fc31094f0dc07e044308d31b08136fd5c720ea4712008b2c40f546f2f5c4f9555964f7e077
-
Filesize
5.2MB
MD5fcc07e7dd9db459607203dda3cf2baea
SHA1a40516b1bea045106e84abbfb27f19448fe3c762
SHA25636dbbd927b4b607bca20721676fad3a42e8e99ea050e950cf29c7fdf88dccde0
SHA512507dea55e1ee2eca99b5e24f4e953ac137f4f6c14f4553ae2e5c207e4bdd3a52eb5837c14a630a1cebb6383912ebcd492c71ea8ab7e53ec866c32c5fe72d1c69
-
Filesize
5.2MB
MD5d449464ad05513a98c6601aafd782743
SHA1886bce843c724020509a58489087a6ba6d7a3eb3
SHA256a4baf55279f135518c57be34a45b2479822f15b67743a533fbf18a3759f90916
SHA51299d197303e86b2345ddaa52290dae76780339a0694a73826d4090ae4d936fc84711d7e4f855e59f1ea18711ee21dfc1e328a3cbdc45d475bad3ec79ada339753
-
Filesize
5.2MB
MD58cca27159dc64a8062e1457a23e78544
SHA1e98b9484881c4ba2c58e0c12bf75dc6de233d754
SHA256caf7436070cb67812a6ee4fcea4304324908cef9a297d5f9fd40b7fa544f0c70
SHA5120b34287ef4a9aae03f6c76928197a1ff9a3b0770ee586f91bdc0e0f5bb609221e9abb7daecde49a3b4fa84396a31f3711d4c10611acccad09109c4a43bf1aa2a
-
Filesize
5.2MB
MD56f31c37477a7eb1f1579cab2025596b5
SHA1374e46839ccccf5b9d7609b98034ce83303b0108
SHA25698f76064adcb3668bc6d452e4a41fd6f27f8a1a469a29bb0e63708a77c7982f5
SHA512e497b387d488da26e64d446f01b6d865d29f8cf7a4e68995b5d0c05da6417fd7ff0d0120af26c62f5c0f8b16ae89c49977f5534cc8aac3ad874f8c3cc8d8bb46
-
Filesize
5.2MB
MD5c7020ee6de7677b617df7ada99666e8f
SHA10de6ea1d13d7a9c09b088fc7da015b5ded56a1ff
SHA256432fb400eebaa44fb1304d6ba63ac1e0968ed4cf58b19788b0f9d509e163f504
SHA5121b45a5ddb606da0042274d943ee322aa5666334a6e70ec4a5660fa42753553e788ebc51cb11429c07e8a5fd9bf5e3f11ca3991321d7b37ede75ebdac413ef83e
-
Filesize
5.2MB
MD5f5b9793c8ed3fd73a65b0194d6ab8c4d
SHA12218d936b448ce9c0ce9b26bc668806452acbd19
SHA256466a450c4621bebf3e15850fab8386bf4567741569b98b0f166ffaf41f5dfc31
SHA51248c0404545751afe29394c7a926965193d962c4ddadbad0a1bd3a01d376a29d40b8788f730552e6a6be0d08017ce24bf2ef00640c05592b080d95e3614edbd06
-
Filesize
5.2MB
MD547e70e0ec1f139dd45a88e9963621077
SHA127106f1d3ac5ae58f405d74355be605a962a1730
SHA256cc732d1d8119d224bb94fb6d8fb6912a8286e8d6ff9d0515fd8cbcef7d186227
SHA512875dad65ca8b0f460f491e5eb8e1107ad2a6e55bc25a6916f631237c0d32e2b1ed90e9cf7ae15324efdac9535e730afc5914819c476a47a4cc07534a3c3c868b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB