Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10-10-2024 16:34
General
-
Target
2024-10-10_84a230300a698214a84c5cb5843709b1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
84a230300a698214a84c5cb5843709b1
-
SHA1
e3467c801b93e4ef3c0250fda3dc1aed363422dd
-
SHA256
06efaf9abb560be7c6700daa4255ff9fd70fc03797644aca0a7900b4f4774a1d
-
SHA512
1fbe9169f7f644dffdd2733125ca9eb1297308bbd63e1c72d3083bef4fccec68f3287840a5faf819074c5e49f2046323db2a675b0dd00df2a1726beb32a4ea10
-
SSDEEP
98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUG:Q+u56utgpPF8u/7G
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_84a230300a698214a84c5cb5843709b1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_84a230300a698214a84c5cb5843709b1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HxmYXXE.exeC:\Windows\System\HxmYXXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AtUTEYE.exeC:\Windows\System\AtUTEYE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iaHbNbr.exeC:\Windows\System\iaHbNbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPgkQwK.exeC:\Windows\System\PPgkQwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIVrBpW.exeC:\Windows\System\SIVrBpW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnNQMWC.exeC:\Windows\System\xnNQMWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QHdxflU.exeC:\Windows\System\QHdxflU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jyFHCLE.exeC:\Windows\System\jyFHCLE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\INqDIGO.exeC:\Windows\System\INqDIGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EFEOeqC.exeC:\Windows\System\EFEOeqC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJboBnc.exeC:\Windows\System\eJboBnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NaMwlqg.exeC:\Windows\System\NaMwlqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MAnaCEQ.exeC:\Windows\System\MAnaCEQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MfBNKXD.exeC:\Windows\System\MfBNKXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quzEiTr.exeC:\Windows\System\quzEiTr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zDGSrPp.exeC:\Windows\System\zDGSrPp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iozvfiA.exeC:\Windows\System\iozvfiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sAUwJVx.exeC:\Windows\System\sAUwJVx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gSPFHRT.exeC:\Windows\System\gSPFHRT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIelPsl.exeC:\Windows\System\TIelPsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QxbEKIX.exeC:\Windows\System\QxbEKIX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD594cbc4b024eb718edf869c5785da5cd8
SHA1ef78275df17de05456014c9e66ef27e04439a858
SHA25658bf53d32511ae5073dff7732ff57fff15399037b4de7d46c400fb8873cfc3fd
SHA512951209d1518e8e8de42498f378d2816725f528e861f08005c3a2f2060e8922fc408aff276aaca181043bb69acf686664514943b0da65d310f7c9f00287eae1c9
-
Filesize
5.9MB
MD52d39099883383b958e81fa35d26bfd95
SHA1f72e238aaa31cfa61009ba6a526e190e0aa6075d
SHA25686daec38ffb60586afbbd3581f6edc9f0efac26039cbda33f27211349057275c
SHA5123d847ef64254ea799b9d38127811d417f7965a66f6696700cc0bad0b329a6c0d624c903d71a49531b30c63526b2635ae498b4817d110a010383164111869fc89
-
Filesize
5.9MB
MD57c19b11ac7638071d298b818b43f06cc
SHA1b952b2ea9ed8d1394a0a3ce14850c5bee5155b1d
SHA2565244a468b060c4638a2f680c251da02f8b18c09f6936f92df6f14fe898967d3a
SHA51211c7106a27b1ed00a27bf3ecb1048fc1450c82a9edbda9c6690b5bf37901eeeca005626946bcfc942caff9a045f11fb818d03a0386320064ba67768fdcdbf558
-
Filesize
5.9MB
MD5802b80ecd8703c0720d04e765e0af500
SHA1f3d8fa1c3605f52328f22286bfbf5d0929dee25d
SHA2569366bf93ccbfd395b366130fa4e4c35912b3326c6a5d28048d03bb86564e0afa
SHA51287ca07fa38505ac2457bd6ffc4aeeae386e59e242d81ee8267912f85c053026ee0b0dc8d4ecd585c59726253ba88862ef6c178384052762537697611d45f9f8c
-
Filesize
5.9MB
MD58d1516d8c8d931981982c729b69685ec
SHA1bcb0214ac380f2191128bf046bdcbbd74057e8e8
SHA25640cadde8f0c547063ad9065eda986db530a9105afe28659cbcbdb3a4e19f6aeb
SHA512b45b02f4a53bbf89e56de82b2c3f20488c7692fcb1607a1d969047dd965dfb9235c113c847dfbdcc5377ee0ebde6b229d8195b80bc4d2680818e31c329fbfd4e
-
Filesize
5.9MB
MD5bde171bc3184ac777240376d8701a2ce
SHA1e0961e1ef43b5f5e1d185a58de62e13e06261ab8
SHA256c00101ff4f24fc302fd34f1b2ffb9dd205f21ec5b80be101f3c2ad49665bdab3
SHA51288687488f83491291ef53d207f647c0efe8f23460f5878d496f313fdc3dce84b310a564aadda9397f86518cfb7a57ac8b9e28c1217134c12321c572156dd27f7
-
Filesize
5.9MB
MD51626d58560c32698fb0690d8dc31e1ee
SHA135599160993fc8687224680464820ca8f9d69db5
SHA25688131e265ddface0139c432717d14494e5842bfd94c6dac8d893bd5fe0da5937
SHA5127ee5ed420cded6911a42e5df47b0f9bade5bbc6342143b32320b150e420576e121a74de14782065039f90a6074ce2b924db8e1704384632fd636a27f3a9bcdaa
-
Filesize
5.9MB
MD5f9901f9b8157236f6d92d0693b55e836
SHA16f1948cfce715c6a2a6db225b279b5c4b287fb07
SHA2566f2a1a77c72bd9a3eb503fd38068936447c5e97e5caf14d6170559f6045deabe
SHA5124b80605b54b3da282099034b1167dfedabd75910adc50b47c9f129ed67df7e811acab4ccc14aa0a59aeed673fd429520550fdfddb2b07507420fc9ad11c7ed8a
-
Filesize
5.9MB
MD50c66b03946be561e94ab9457b35fb05f
SHA109b2cab55af0c54640436100e2c6a5a3b457d7cf
SHA256a5a4212b9d648df3daaf3ba2dfa37d080b3c7f19dc1267c2267cf7c7f3ae3b36
SHA512b51ff050438a0926f2b6bfb3689cfe6fc2ec8d798f6760bf9198f656f7c75da4185aea30a433b716142aae7264e7babf15dbd793fa7f64b750e86b77fbaaab0e
-
Filesize
5.9MB
MD5ce168fa904c2e43180ee95425547c36c
SHA1de6e914bbe1b41887fde0f827b7e0f8717d3e52b
SHA256afa2c109483b1734dfaab26bcaf65c7b63285527a5fec85b2dcc228ecf0c2aa6
SHA51273a0f6f23a94de615f1862e4357505c2fcfb3df671dd33243e6ad216228440170a2b353eac9f689fb391a6176d93dadbc8f73036a37ebac350b9800d4bda94eb
-
Filesize
5.9MB
MD5fdb3ad99d09440ef14d0a3cc1422fc04
SHA1fecca95738729b94cd6aa5da8bb5890115910120
SHA2569b47a8bfe7924b713ee4695925b6544704eddb48b924d5a5e3b347f1b80895b5
SHA512d4219a6bdd06917fe06e122a0b13a213821b53ae87069b28962ddd47bca5d43eabc248882e62fd30416c539866458c5ca095c17c625f1061e56f8735a3f706e0
-
Filesize
5.9MB
MD5fe7b119f142c50156246fcd1c9836ab6
SHA14691f3853150f1970f80ba0b139a6e742f2ed49c
SHA256842ace0344ff5c5f9019fb9af65bd75981726f5936b0ddee5e0b0a3e37c56e1c
SHA5125b81d833af382225eb39aeeb1051fd5dbfb57e1861f8c24085ca66efcbe7f1bbf5a20e418c25354ed18e9c941f37e7035f36b9023237d2f84154d09891745fb0
-
Filesize
5.9MB
MD5583ec24d5676e972cd3f15be64770d22
SHA143063ad3afeb0da295865c0c0ff3d304b6d2e85e
SHA256a24215ae96b77d3b6633c6f40b288c73bb275df5c24d4130988dd9bb84118f0c
SHA5127ae23bb18e5a1270af26afccd19c327edc3daca5448b544bfc52f1c538206091ae86ba211239e33b13726b32398fca0d20475cd300c41fc5f8d5bcfb5fe48cae
-
Filesize
5.9MB
MD5daf9a7063e1ea18aad1f6ed16e38990f
SHA12478de4ecb378a04639fd2d2c66af8a59237655f
SHA256325c2cf49445cd3e7f5fb51d3bbc37dcd4b158f0fb8ffe8cdec42ab07e23e958
SHA5129b860d6625e2f32545ad8398087a899ec820c3b2f6397631f5a3a7f8323fe9a345782dd63346881eac22755d1759c7775fa0d113740be6e5b46b0fa409b7c5ef
-
Filesize
5.9MB
MD53ffb9ebc3ec125b0adae8bab1cb41a19
SHA15290dfd69a282235fb8d0b5fb0ee5f6db04d915a
SHA256937d786a64123482fda987af628b1730edeac7978fe37ed6523162ab863aca03
SHA51277744a0bd476677a45e37f498d04c1a16aa02630aae24bfc6ebe625c3914d67a4ed68b20f3fd918ddc87c40a14b609a8d184944faf9848d6342fde62a0f8f89e
-
Filesize
5.9MB
MD50d26704093c077265d34bf3a0824bb22
SHA1d43b65b50fde88d606171773ae45b43f08df3009
SHA256a6d8f0f01e44cf93b4753412566976bc4ac2428e8a6dad7faed2870c051b9cf4
SHA5122b3f0ea8c1e0134ed6b36a9b3558b46ddfcac662c8bbeef155df92b400d035a0f442f9eb7ff9b457051887ad4a8bb8ee72555e2271295b57911bc344b593bdd1
-
Filesize
5.9MB
MD55348637b9d106edb2917a2254a42b395
SHA16d36421cec12fdef63f0d78d6893eabac008450a
SHA256bdc7397a7b2986d5a08446cd4142d418b13c9e3518cca74fe73904c4c63d5a11
SHA5122e64ca31e342781a1bb888fe4d63fdafdfadbf6b3b76d228221d3fdf06fa55dab2aab46d1c7c57aa6e54ec8e31b46059c10c27c91d81039cb486e71a9d79280f
-
Filesize
5.9MB
MD572dd32e353d9b0b164464f8e83ad2840
SHA199eefc6b76297f8b7caf4a4df022752917eae6a2
SHA2561f6f8ea6a4e7d900c0cd4a376b3e3f58da7b428902a5bd45ffa8fd03adbfdfb3
SHA512d99120a15c9723b753aea1fe27c47cab7bf679a65b33a9c8e053fa45b1a02ec8dddcbb41c67c394fe9d3e8bde76c52a8aa920dfac5c3f616e5a8435abb3cc92e
-
Filesize
5.9MB
MD50e2ce9506527f69872838cd165f9a0d0
SHA16c4600cf323318ae2f2961f00978e831b5569883
SHA2565642d130274482d7e53f5493f10d4c1a54b87bae1e34f2e5100361c1f55add06
SHA512a5f5e949564a0f70934cacd5d8d3bb8a72f43082e91ad1a36980a0d35e0056660e75e387f5b1afd8f11d1545a379ca64c858d3203ce9f06e1763ba34e4c7a6d8
-
Filesize
5.9MB
MD51e09f334e8988a56b9a094d82cc5293d
SHA19df1f98b724ed7ffe90a2e2f942f80218c0addc9
SHA25667f746a211f153da5f73d815635cb3615684adebddaa668429a5bc9ec58f0d52
SHA512235dd0a2bd5846d326dc7af3a10fce9723315d7c3d5f9da71c63f929fd4998df2668899fa5023a4ebabe2ec06b1195bec67ecb3e17072ac3ecb2509708ff54af
-
Filesize
5.9MB
MD5385eeef6198eb3387cf76ad4a357dec2
SHA11514396f44135de2608d30f42e6e4383f4a384b3
SHA25636a7a46e35a42d27517ced7ff5255034a00ebfbfda9a0462b7a2611b2c5b6936
SHA512d9fa81f9378448a48e79ac1c1b1860ec32069f7f3dd7de056d8fba195d017f28b1282d2e209561f191c63e97e417829140a3d80235a8c90e7759b4fab98e846e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB