Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/10/2024, 15:30
General
-
Target
2024-10-01_fe5d65f58c7210392793f51c90019aab_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fe5d65f58c7210392793f51c90019aab
-
SHA1
f3865d8ed85a9f4ac9fd67af9eb8699e27cb7a12
-
SHA256
d989b7b6d94dad502b40057fc710b98d5a1dc077b2df6eb372e882a80198c505
-
SHA512
a2a5451f06ef81853233f9e95eed7fbeee939ffcbb75d331e01f3b739cd933d8d1a289e6459db2b20b2941f6e8ce31e5868b150dab9a4c9f91c51196456575b7
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibd56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_fe5d65f58c7210392793f51c90019aab_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_fe5d65f58c7210392793f51c90019aab_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qIxYRHq.exeC:\Windows\System\qIxYRHq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHlkSVr.exeC:\Windows\System\UHlkSVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qIpdHRr.exeC:\Windows\System\qIpdHRr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weKUqHx.exeC:\Windows\System\weKUqHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGWFvkQ.exeC:\Windows\System\NGWFvkQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPINtjm.exeC:\Windows\System\OPINtjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BlyJnXH.exeC:\Windows\System\BlyJnXH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlbPSbr.exeC:\Windows\System\nlbPSbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KkQpXkY.exeC:\Windows\System\KkQpXkY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yZvCNxV.exeC:\Windows\System\yZvCNxV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNZKxQN.exeC:\Windows\System\wNZKxQN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMbyzSg.exeC:\Windows\System\PMbyzSg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FYpYaLO.exeC:\Windows\System\FYpYaLO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HtaHQCf.exeC:\Windows\System\HtaHQCf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ksAdINE.exeC:\Windows\System\ksAdINE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efwbItA.exeC:\Windows\System\efwbItA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dtMixJi.exeC:\Windows\System\dtMixJi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vddeHJN.exeC:\Windows\System\vddeHJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfJSEom.exeC:\Windows\System\EfJSEom.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coLLDZs.exeC:\Windows\System\coLLDZs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bqUUFQq.exeC:\Windows\System\bqUUFQq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD577c7b2019386ac94b4e559fd98aaf014
SHA12e852d9b817ab257e86fc32d3bfc1ee032c8c351
SHA2566a63223f4e130831d253916fc834e714cbf97cce816d70dc3c81431c404e1e9b
SHA512522f4aacd4dd02c30ec7401c9c24c26e213c555767fec26bde3f7a20758c4865dfc6f788ffe20594769c61a0c008a0ec9e7253609445bfb9b687ceb42ea09dd2
-
Filesize
5.2MB
MD5a8770f97efbb6bb19f137c176aeb5b31
SHA19bee7ac793de870a6f2a27f5622f858dadbea332
SHA25656a42fad603b6093e25137fc7be454b93f1edc55c5bb595ede8c53a3a41b9287
SHA51287b2b15d0f8df8ac3cb81b44cab92297e27a45368701b8aadbb2ca6c1a11c479dd7bd882b9e706f3c8027b6ba744b3bafc70796c74d20663fbe47adcf35b9f11
-
Filesize
5.2MB
MD58c47c6008ffa85003fb434aa20da6593
SHA1ae4ff68271d5bca63145918b47a1e8dd202e12e6
SHA25623a583c6cf163f5e987452350bbb677e97fba3f5e9e4111072ab39e58c777a06
SHA512dbfeccf4dcddf8388c4c52021337a5d5e0d228312b569925d6c50f3ae06c9d093bc3fbedf0656748fb5f6da5c66a9cc8f86578a919e6e6029a6bdfda3f2d30f7
-
Filesize
5.2MB
MD564dd4b8231c20e335fc091ec87e63aca
SHA1cbc15bac3aa52756164828e10ffe05249de6aff6
SHA2568d46f126e52af99bdbb1b17187ef27796a6e7f36331d68b2b769922c009a9f05
SHA5124d07ea54d2832e59d7eb4d58aadf70cbac8ecdfc9335578c7ed257ad7e83014227b24f0aff9d8b1fdfc67ea7f58e5d0decedfee1cdd5714e5e46cffc7c6b0ff1
-
Filesize
5.2MB
MD53e6cdaf37a5fa6eed2ec50ac70809fc9
SHA145c65acb19ea2abe09505f7435918390cd35c44b
SHA25604e0e8c20b5b4c10fc79596abaecc86bec95225530bdab93496878c6b3515152
SHA512021dcfe7219e31a50647cff490511186316783bbea16aacdef02d821396ffcdb47cb1643bff6944a290d8f98ace854161679119f7e52893775c96a62cc7d9911
-
Filesize
5.2MB
MD58546988dcabb5a9c495f05d628050f96
SHA176f7141d158391d5abbe1b962fad4f2c5dd05c8c
SHA256eda0ffec65e95e938926f74092ddf434fd53800b3fc6d1782ee447c15f42fff7
SHA512efc3de435e05c270037078abe32019be300915404a01769e915cb765a157442e1d0c161d830ead1e53759e74fe4611289458ed360492159dbcd4566b4576d318
-
Filesize
5.2MB
MD558606c93266cd7a12dd9e7b24582c184
SHA1bb780755f370f8b537cf9eec9278ac5021499b0f
SHA2561f1a2c331b75d6d1896b7aa122b9dc3c9a0d7bdc6b47e304081ed89c247baff1
SHA512c9da594c720b9bf7ae8b3644242f75a5d3abcde7aef141f10bfbea8a3a293d78bcc58b9609de8afd1d0b7198f62b49692f63a9fe2f44650836a2561e5bf03c73
-
Filesize
5.2MB
MD5006d34b6d9f419c3ffa7a945e2311787
SHA1dbc24c7a0967c7e32d4262e6a6d555b12e3ef977
SHA2561d976f654f997b7d83fe392673a919aca5f4e67d3c95a0b004fb42b55491e911
SHA512fbf086f13e2bb2cfbfcec50db6c03355b9e15136db0f6ff60fe5428cd9cc0b403e9e60c27c0f52f3919a76575b86512d53126add43d4c906a1ea4b994150d0c3
-
Filesize
5.2MB
MD5eeceedb69e64f65458d43a374d64a4c4
SHA1587c6e9259773f058b26cbe3aaa8c3850f8ed329
SHA256c8cee426030e8df6a5ba3c8f85e37ed275b830de31d638476bbd1fa0402817bf
SHA512497db9f00b17c628a82fd61f0d81e1422e5bb99f39720fecce3a98333a8fc9b9f14c79b3669e6741e4a1dadf33717398eade6dab4db0caaf4aee666f9257e672
-
Filesize
5.2MB
MD5c6f5698e0d030a6b277dabe61809160e
SHA1b90c4edfb1b0ee72d49ab207b5dc5e9e5da7f773
SHA2563e2e3b871b133b17add435787da9849751ecb0780141d5c57a95b0e59707f5b1
SHA51264905c99ef2d87675cf3c11ef2c7dacb33b3e99ca1c7b8e3f4a6241ad6094aed40abb3d98bb051417eada9228305dd53d3ef5984b483a701b05b7002245ca104
-
Filesize
5.2MB
MD5638a22c9374aad5a0404876449b563bd
SHA1b84a5f1fbf92ada3ab638b47c57dc386bf9512ff
SHA2562978a06ba87db14f0d490ea91668d77e62adc82e85857baf565eb0ebe07d31e6
SHA5122fc9696982543e0b4c255071984f7a597b8e82af1ac20822e447c3e43a44357d7a16d2adc8c351395f88e1dad12c9c5377572ca9a78955f2ea58a11622f5459a
-
Filesize
5.2MB
MD5006017243e9aaa660fbfb9462d938f28
SHA133760ae3d6629541ffe8cd95ce7df2ce99148497
SHA256ee8120301553560c659d002bf4a29cdae650ec4784c158f9f103ab12a0301f5c
SHA512367a5c4eeb5883be827739b1f3091f9b214447c9354b8d44ce6fca2afd0f0470aa4fb16f150f9ba44da79e3ffb9bbb302c61754a1cd3107c92d4d4afb5e2a0a8
-
Filesize
5.2MB
MD5cf20ee78acd546924ad559a46f1577b0
SHA19df5c47ee61aaa64194be40316cd82d0e18a516f
SHA256995a68d67100e0d55bb9bd0b3bda57a4a392c5597cee5d66647700d86eec93a8
SHA512337d0091bc2f6e692e0b58d1326b2ac489a00f4487e25f86923c8473a25e94deecd1e91b184b721b05de87ad2420507f3f84e24c13c663f470f00f7a754d3d8f
-
Filesize
5.2MB
MD59033313383c09e050bcad201df2e0c4e
SHA10e8d91f4ba237dbc04e21e5efacf40713a5988f1
SHA25692c7df8af6d1d710d6b49ad218cfbcbe6f2620f6251852638e89ad44f4e06a34
SHA5121fb25d02bdbdaf6bf8b6527a4cc130b3770a8e341c9dd9db8116a9bddf52fd546c2fae22da480e49bbd8a4abebef5b521445a759fbe4b566b02b096cd26cba31
-
Filesize
5.2MB
MD52c2cf994c7ab9bc6fdb3cefc0c1c6e51
SHA1ef8c4a3b59df236d77c9b834f88d93903e720a0c
SHA256ab3fa02083c10f0e36b5e34ddca004ff3a2a78272008de293b31f0dc1043cbcb
SHA512db51786f949cac60c84614803f750f47f1d4239111e1b653f5cab84f9f345101157b4eb9da27059af6eee62436aa6072083c876fa558b317809b8dd85c909ba3
-
Filesize
5.2MB
MD5c6932c4c59650978d67106acdcae7286
SHA134151ac566dcb2d0890e7ac135b81fc4e7b5168c
SHA256fe62e35af2c351edb289c0fc257dc5efd6d525db594fba9735327d59ea0b6ffc
SHA5120badc1219c9207315a8cbbece884e85c131733a4b537f461133adb12bc1007a77f3fdfac3aa246251e00e0749102bed49594ad3279a1d56f8d0c0cf2e83bbb30
-
Filesize
5.2MB
MD504db59ce456abed2067734619bca44b8
SHA13dd00d44c519c2d964fbc139d1f0e6e65172e762
SHA25617396944645755d3e70aeae8f5b1289f788a30921eba23a014f1f7d01ca6ce7d
SHA5125e5f3e9b050e6f2ad1038ac99015a212b95f8079a000f577845617c06fc7a5c49f029cae35c819c22023715fe68e3f7627fe79b67141db481ea23ea66f4bc216
-
Filesize
5.2MB
MD518d2c025e0ce0922bf47fb3f72ce8420
SHA1ea9a59b888b11940a6c4cc5546d69eb58d06679a
SHA256a7b428f1b53956eab08bc3321f0e21c6042bb68191b9b4e73e9ed6986365168e
SHA51209dd93300a8e01a4a5b75d3d33f92bdcdf4d2fa6487a3ce7987bd0dd66a3e5f04120000f13660210139685fb5f1c5e04f42901ea2bd4ef6f8ef4f4e3b6126f41
-
Filesize
5.2MB
MD5bb595470f80c761c655127f80c4b0e76
SHA1370845cb5a8ed4c67197cef03e22a4bd47692f66
SHA2564d1747d99f455553acb2514d9c34f14a12f3a378ea6723b9a89541dfc5a42b1d
SHA5129585e4cc9f1ff2bf14749b4280b34fb425bcc21ba41e2fe2e159bb95725892f22153a4534991779533e628b598f4e9bee0724d780dc9def8736769b402ac1ad7
-
Filesize
5.2MB
MD57b6e3b65c9be4896b01075d6f5519d18
SHA18e4a499b40ba9d753aa4c94b7f3e9fdbb8acdaf5
SHA2569b48afd1d15d1d16bdeb21c350d5d51b2c06a1c7524323b287945fd629d3b284
SHA512bedc183e58fcd0d60377e378a63a2e9cdc791f1eb8ac91597382f028df9ce4552df0565cd5e94b342ae2db14bbf08956b74e65132b0e1b07ca639553df573cba
-
Filesize
5.2MB
MD5ef79d39fd148aaf96e17694d4a9a589d
SHA180a73e1904a5b6f0155e322909679e88a301e800
SHA256723fdb5d2cf854116e4a32e85a437dfa58c3ce74ec79753036ce5bf93671ac70
SHA512b783ad66a840a3020f5dceb796511888c89a8a4b37c59099da03f2581067cd56236a513873e1f29d0c6b0f93e23610ebdef61ac8922a554fce30046ba52447fc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB