Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:31
General
-
Target
2024-11-11_cb9c0da08ed238f61d7087aa4fbb24a6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cb9c0da08ed238f61d7087aa4fbb24a6
-
SHA1
39cf48f9d63b5069f4868cf37c411c634c920fee
-
SHA256
04ad09d0c4b7c661fca85293108be91ece5fd414f85d4fbf8e5e48b525a13212
-
SHA512
2ae2034ef6bd3838494d13e75a7bc4c8c8152161e7b3efe1dca888895a6548e9f90d3a2f0d7a556d0fba68d6e75775197e3fd029708358db15f2cfa09f57229d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_cb9c0da08ed238f61d7087aa4fbb24a6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_cb9c0da08ed238f61d7087aa4fbb24a6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZrkelbI.exeC:\Windows\System\ZrkelbI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MVBiPGW.exeC:\Windows\System\MVBiPGW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NLRivAZ.exeC:\Windows\System\NLRivAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qyMIlfQ.exeC:\Windows\System\qyMIlfQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwMiblJ.exeC:\Windows\System\WwMiblJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JwpqYcs.exeC:\Windows\System\JwpqYcs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AxSCvNZ.exeC:\Windows\System\AxSCvNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vvnjPfn.exeC:\Windows\System\vvnjPfn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ozcgCFf.exeC:\Windows\System\ozcgCFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DweqjnU.exeC:\Windows\System\DweqjnU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZPNsnUU.exeC:\Windows\System\ZPNsnUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFemBZe.exeC:\Windows\System\vFemBZe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fExSfjA.exeC:\Windows\System\fExSfjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLmgtQk.exeC:\Windows\System\zLmgtQk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rJrLAtn.exeC:\Windows\System\rJrLAtn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\URunSoA.exeC:\Windows\System\URunSoA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ahgbFbz.exeC:\Windows\System\ahgbFbz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VXTYPmP.exeC:\Windows\System\VXTYPmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YiTtAgB.exeC:\Windows\System\YiTtAgB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKwvIVl.exeC:\Windows\System\uKwvIVl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmVBROF.exeC:\Windows\System\wmVBROF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d7baf51382941f99d8dd5c1262d585da
SHA1c857904527088cf0d6ae1363cf9b6a26b6a84ceb
SHA2565748e660aba43cc219b5711aa76c85e3694c67cebddb64589e8d45a3ad47d1e7
SHA5125a87fbb85110e3df737b25dbd4ed08f4a4390bca23193b18d0de08eb8c923a90468c2e3f0aba91ab72b988039ffeff0d21012c7ea99046b0bc4d88de184193fa
-
Filesize
5.2MB
MD5fe59d0832e695d012dc019bec2cc1c78
SHA1b62a1803185382d3883a012540acbfd05d5df91b
SHA256ec1d1f670fa0ea71ac463b9049e77d9d28dc4df0b75ad77f02c3f6af6af38986
SHA512346d6a6b688ac4da085929de279654431b9ccab5e0301ec7896deeec8d7c288498bfa8c33d8b01a890a2b835342246edf2ecca18bb7bb959b61b6d556167e550
-
Filesize
5.2MB
MD588c40708c9b85a784dde93f0fdb1a0e5
SHA1eac12d39e0cf76ad0becb9b53f3f619fee61bb74
SHA2560f922132ce89583fe3dd154a53b6a3512be061eccb6d922cd6223735d0affbce
SHA512ed73dad810b3940fa73c12c08509ae7b0411ff0ae75f9e81c93580cb4c60addef29ffd480a54d336369c9dda1368c92d0ccf0f4b257941b443dfded9a6e832c7
-
Filesize
5.2MB
MD5169a4127c968a421c773a2335daa309d
SHA1c0978d5a5f05d2382699e50daa81df38ac4f2e4d
SHA256140dfa31e409ca14a327eabe5b27c3e5881669195bbde787bdafa055fb039e73
SHA512a937daa0c788b204cc8207324c8628c5ea75e521f1701bfd5df651e28ecbc7af59d741d617c43c14611642cdcd0e55787b3bd0a570bf621ffb323fa2072d6411
-
Filesize
5.2MB
MD5081eac4540698f5588594f16f35b6866
SHA1184900a08a1a2b5a332aee2a40f44239b5d8b1d0
SHA2564a63abfa00bb6ca3d8796017c477e3e20d746390f689ca295992c90dbdee0102
SHA512fb00c89696b7c81f7558342b4456d69b033cfa049436ef6a38d2ba760fadeb8c21ac22e0ef4fc2da9779bccc4c2d389c14008905171ed63f4bc325db802ca947
-
Filesize
5.2MB
MD57dae9b1ae2f9cd79ca3026e576199e51
SHA19a03de376a60fe8c501a398e118c14d5c5881ff7
SHA25611d3c3acf00d7333c1e40812aaba6cb5c0992e029ef22a5735bac396136d2229
SHA512277711e2afdd07c43e75a06dc501ba5bf1485993c9b0fb810d73a29fa7594968a2fae20d1097421981f9ad468e0a5d501286b0aeb518bc748a9742237d8c731a
-
Filesize
5.2MB
MD5481b4ff7b89591fdc185e0687c8b5bc8
SHA145bf5845a04925c89b89da225d533fbd475851be
SHA256feecac87417f287231ba08f546413f978f361af739c69b395e78184679b979f1
SHA5124436e7eee46dc5a4befe679143dd1391eda87917711d900e74b0a7da87cf2831b772472eee86c2df2221319cfe0dfdb8ec4fad11e88510ee9aaa244e36011257
-
Filesize
5.2MB
MD5c54cd15b77b02396a2a1b453c2fd6931
SHA173d9fed3f723743a061b2a47ecc74036075068a7
SHA256d5d65a2b52aa2bca8c60a8a9758dc098b1183f8357a66b41b63926e1363a66a5
SHA51296b7e29302c57ecf0efb0c03712362963f04946d2315c20cdbcd37f58d8936d8806b53316ba0cf1e606d6cd79a683207386d69f573b50a68c0e624baf24b7218
-
Filesize
5.2MB
MD53249613b711dc78cf5f43da7c0a60a4b
SHA168f9098a0344f992aed678a8a2ff777d5bebb5b5
SHA2561129790eb5a1ee907bb8f81641856f67b8c955454cf5a485a3b1023d16f98466
SHA512b0a702e2620fcbe4651927d039be24c243321c930edcf9d1221b9faf24bfd821a23381b0379840d80b6da89152d4b241830b662531cb01c9228fab3fd870c326
-
Filesize
5.2MB
MD5fe46a2dc77a06a10fc87c6d4e8224030
SHA1208cb2229c74725490c7ccae5cd7f2dd34617755
SHA256a866666e9795cc6c241d45f1117ac4950c54ffcfc51a268981ed1ebdd7eeb8d9
SHA512520dc8edeaa8772c7ad407273765aeb3bdc6b55ed856eaf313eec5306887cc48881745be98c78b1a41e0e4b4fdb8073c5008a029a6ddac3ee197102e82fa5948
-
Filesize
5.2MB
MD5d419472f95b081cfec07b9223569ca60
SHA1d0b3bcef5ec726668bf8eb78a398ee1c8cc7ac01
SHA2562e9b29dac0b95c2b82f2429056e0b2293fc97b4594b573da37fcea665cc2a5c9
SHA5125c9614f43e057738db2f138b1452d49d02c3410553fe825b2c9e37e78135f53cd50df04cf32845a79bb66a2e632af3b0652dc5d7145a2e563dfef33cc9474268
-
Filesize
5.2MB
MD50760318b3e784a5dad218c5fb9fa3758
SHA190c2e5c794296c11e0e4e90053cd3d198eaf2eff
SHA256ba1a5eab995dcbdd5679d46c9e6ba5101e663b0ae8ecb529706a2d07fa5cd60c
SHA5120a9d3ab6629a3eda41da21fe5664bc42f7da93bf6502c94726e3b2ec4a8e8b8c57daa705ff69ed9b712de8996760b6373bd5d08506d07090998f0e01020b0381
-
Filesize
5.2MB
MD592a7a4d785343b444a67176801e5b6dc
SHA1bb4294f9e8e5aed74dbc512aa87526bf72e3c3c0
SHA25616225d34a68566832094988b09c18cdfd5c2fd63f1b05ec001f9d187c04bdaf7
SHA51260dba084c9aa5a7c60a4e5a9c8365796c00f5c52328406773c5d300fb96847a334efe50f9836e2dc3f87f8936733b46d37bd6b681b820599bc7193bcf90b7b7b
-
Filesize
5.2MB
MD55ea54f90a9d9085a71c7577ad2515998
SHA1d1b0f734fdf7767b38baa6f66fc0d39fc5367f54
SHA256f39d4eb81e1f4a2dedd2dcaee221dfcef1920514cd071d9f4588c70e77e83ef6
SHA51279111cbca7b3ec230e9aafc5eec16c9aa5100b96b3aaf5cb9a286f2099dedff2e6c59cac226ea4c91d5883bee6968a69d7858bcbb755b2cf35b5ab1f1ccae745
-
Filesize
5.2MB
MD5f84d2e9b4de949580e5ef9f1ce895515
SHA162638f3ca054e1412b1a3f9a708b8a42485d5751
SHA2564c138bd022e8c0656cd90f836a17abf9148a6395463489932d0ef64f42078622
SHA512986cd5e50e921fe6d67e5f962772717b148fa364abacfaad22d6ed695bfd6a9baa3d517b235a504e7584e83f056bbe867fb6a9694237e710f16aa708edcba9e0
-
Filesize
5.2MB
MD5be25331263cb9910a0a3e8243cd7a9f1
SHA1745f5c7430294bc9e75927e676c54bb95ed83daf
SHA256810e7dcc5e5d85272a7d7d9f531d2c91f013350782723f4bcee865227784d75c
SHA512000ce874d4c30b93d52ebf8b9179eee34742199f821e791d0a35cb92c2914ee4ced2fa8d34486af0d83c54f74f41574dd0ea2743c65f227d3d2b8f1925e9658b
-
Filesize
5.2MB
MD5f608d3ad180be0e209ae816c687a69e7
SHA12e522464faec6d5cd0bb7e615234321d1817f2a0
SHA256e549e34b46a5d7c2b024d47113054965d1c87cf05c2b7b836cca12b2e5c395ff
SHA512fe43e065517ccaa117044536fcdf76f6f6f6f5f47473631acb8959a8c1206ec558fc2b1cb77b1689e65c3bb5af2fc0bc90d856527a649d06ce5bd58b1ac31e71
-
Filesize
5.2MB
MD5988a1a4639a492b1e861d5b99a7ba6d2
SHA1dea278079602c310f9cff003ccb0f66ed01081a3
SHA25685c3a89686c0bd2574a0aae18ab720a2e27b56758baac8eff966c6d6e76564db
SHA5127ba8ee375efcc9fe6520237b171c61cf197512fb9dd52b48c42c5fc8c1467374a7661e3d6343b942d243d451c86639e83b2e9c74343b4925b7f25817736ea16a
-
Filesize
5.2MB
MD55c21ab5a91227109562af67148c225c4
SHA14bcc1e2061205d5715260be59b319f7683ff1902
SHA25659b9595bf3d4fd22f8af4399ca113dd8169f48b25f6904f943bbb3bba0339a26
SHA5120d6f2ebad47cc549c646f8c87ce7dc8120d3732e611e253d200b3b4c2558935018cf413da7a54b764824fdd83108cc026ba9a9e46df48b93ae389907ef136458
-
Filesize
5.2MB
MD54e80014aa7e56e359323a36cafca4130
SHA13724599d19f6e1a5abb9b2e8cfc24c66c15d50d2
SHA25636eb21e29f6d87d4e29064a4caa27614f701745f8578358c1bd1a31f9ce8c8b8
SHA5121d8c0ca8709cc946a0343c62ca40a1759bc2c4d019fe10a5006063118398290114d26e3e49883070e1c83e46aec12a33b45a9aad4da1202ba51795d1246bd28f
-
Filesize
5.2MB
MD57c441ac070847925ecce61ef96e7a0de
SHA1eccf754b9bce54ffddcba9b5ca9b2e231ef8c81c
SHA2561912834e45d4a148470e5e2e9cf57d2d24a0078957572e1cb48232aa3ada2ffb
SHA5126c05100c3a4d1e09555e33500904164926c98182d33c2f3d8579f7351e2a542f49aca4e99800d313c87cb2eea0a9a4343c5f128f75b859446979468b7dd84ce2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB