Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:32
General
-
Target
2024-11-11_cf3430bf55fb33d664d2d8874c970901_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cf3430bf55fb33d664d2d8874c970901
-
SHA1
7897dd3b9e47707f2635724f40b57119fd47e3ab
-
SHA256
65da0d0091a2110cb5bfcd14bc79f90f276025eb7828abe30165948f1bbffd3c
-
SHA512
c86f2f8bef0ecb90467225e99de0974b0f13f2e50a19616760d7d6139246be5f7a444e77c057e1b83514da80531823b8c1307817c07dd5ca7870793e0f4748f0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_cf3430bf55fb33d664d2d8874c970901_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_cf3430bf55fb33d664d2d8874c970901_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TJDbwQM.exeC:\Windows\System\TJDbwQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QpSkCLo.exeC:\Windows\System\QpSkCLo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXEwaEa.exeC:\Windows\System\qXEwaEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfViusQ.exeC:\Windows\System\hfViusQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOzALUC.exeC:\Windows\System\BOzALUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poMXgNB.exeC:\Windows\System\poMXgNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVvojXF.exeC:\Windows\System\BVvojXF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DAAAMPH.exeC:\Windows\System\DAAAMPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLZBBUh.exeC:\Windows\System\TLZBBUh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jQBRQCU.exeC:\Windows\System\jQBRQCU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nswcuOC.exeC:\Windows\System\nswcuOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HVRNbeV.exeC:\Windows\System\HVRNbeV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzyHRaf.exeC:\Windows\System\kzyHRaf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PzUMKnR.exeC:\Windows\System\PzUMKnR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LndCmgK.exeC:\Windows\System\LndCmgK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NmKLknD.exeC:\Windows\System\NmKLknD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gptIyXp.exeC:\Windows\System\gptIyXp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELXsUuA.exeC:\Windows\System\ELXsUuA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmkckOM.exeC:\Windows\System\CmkckOM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwWJcnk.exeC:\Windows\System\TwWJcnk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbiuWTF.exeC:\Windows\System\hbiuWTF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5da4d7480780341bf61b715480c5f3bea
SHA153ce182f00a0609c43d8c2d13dfcc6517bcdf6db
SHA256723e74f6b6bee8d17f96920769d3fa36422da1044b82abead056220bd0881274
SHA512dbb74c2f1b4080ad9d4d3de1e6f6facaf86ad2aa228de272fbd15f73f1b4fcccbf0aaeee1edcae9a722293e8892a96a70463df4bc416062801feee04fd01ad0d
-
Filesize
5.2MB
MD5b90915cb64870fbb8d06c225a8956950
SHA110734b028368e2245eb8c1ea50720943f46b3d3e
SHA256cb5c8c5d8a17f1aff18313a5c3c9816dcea15703812bd4c7b51ebdba1e36e525
SHA51299257a60a149b8753911ebb8f3db2b0284a7b8f2cf69e828bdc44bb553b43f4757093fca8548fe60a57134551431761e56b1e70c8030218a32a77144f0fd7641
-
Filesize
5.2MB
MD572ecb2b16bbc92c7099c62ee1ef79777
SHA1ca694a35b8df962084e2a5fca993739e86c32982
SHA256f3ddaf634c5c210888f3a35dc312d31580521859228c9389d15c68ca03f125e9
SHA5123552527895ab2e4d0d57a4199c1500ebace031b56066ebb3aa4ad6fa5b0092e149e62bea01c4b59f2686aa92fd4df89bfdeacfea8a541d428e314d80fd985dea
-
Filesize
5.2MB
MD54dd2677eb394b399b0eb7df301f0ee3e
SHA1ff6c27ea260a973133b007e9d885dcc09e21262b
SHA25621b1a0e71135d471e050d66016924057a1b0a5989a3f550c0d9b3919ae58680d
SHA512d0a051ea1aed3c70c191c986151ca8fa9558413332e2d26960a649e935b1d3e1ee2902c603208f8a315e0022181e9e9bdb71413065a28f93966818cf95f80fa3
-
Filesize
5.2MB
MD53e717ed37bf34c0ba2ddd5e673fb8bee
SHA18ab983785466ad6cd802a957bba2202ad0cb0f6f
SHA2564b50d9dea0cb986e7b137852aa5aa4909d03b2c89746580cb1efb111d99367c4
SHA5120e5141c303a9c98270d7250df91e5a5db34fdb99354752451a176396641c4e8059d7c822d2f23d8cb781d1e67e8ab5084edef40d94aa12cb0ac1c3a55f66fba5
-
Filesize
5.2MB
MD5bcca54475836fbea325e6b4c525097a8
SHA172c255e78d8c15e5bb52c29bbfb2130756dfc640
SHA25619034cb5a86c6206519291aa75696ca113e56a4d03fd4c9523d701eb7d2f649f
SHA512af0cd712bc07d3e85b7adefbb894e66d4bea88fe331a7cf57d343aed6848edb8bf776fec80224c69da0118995b4e5b85fece73657936a8a3b7d9cda385df4c33
-
Filesize
5.2MB
MD5b0241be1aefac929f68a9a7292a77c69
SHA1e6bb135b8537a3d460ee3f65a069d359be71d8ee
SHA256cbe90841943d16198cd74c85eae737d48d6b5a69b0ff7ea71de53bfff4ce0ee3
SHA512197ad637c0c79dd6dfec3c11df656c6edf428f0deb5e5b3f1062f63d837ba55fba51282623110addde83794fb8f81c1e36fda05589aa7c63fcf5e67f1011d432
-
Filesize
5.2MB
MD5a43b0227e53c9b345af9d641ecda695d
SHA1190fa3fda90be2947e410d3660ea0bd1206800f2
SHA256ce9d82362c420e6864bcd95f18419aef4803e3a94c79e0562e4a764535575131
SHA512cadc67097b7727e1cf48cc2763aafd1fb955dbccc390e51e3546ea97d4f13e7a688723d879ffc42cee6acef2cec2af380d9349db6206d1b58c6e73d8b8b7b0e8
-
Filesize
5.2MB
MD587882206b69a9ee6b8680e74d9e82658
SHA110f169308998864f91841da017d967e4aa65f8ee
SHA25620f2c99242258d5b855f2290d7c724d514c37d4256a8b6716810500ac22e9508
SHA51246fdf08e9893e8bcc6f33c292bb6dc71dde7ab1cb0a4f28a923955aa1e1efab9e45939c22461657f73ed37c5c93e21c1fe25755d12f103f05165a53227ab7b9b
-
Filesize
5.2MB
MD536354b68601fe91c55c3f85ca3ec0190
SHA174b453e541197aec337e736c2d55248a526181c4
SHA25617d6e51c301415ed0636df3dbe3b7954f3aed46e5038e86b2dfe1782cdbe551b
SHA5125cb60ce893073976dd0ccc5086a7945e2a391b8e2b028aedc170b4a53332c6b7334a7a12f0cd906b2d9681c975d18001874be819dfb2ec5698c0c8458acee617
-
Filesize
5.2MB
MD5420fa7f8d6ac4583b45b35f6876a10f6
SHA11863cc6d7256f11cefc45ed58483b8c889118344
SHA25668a3e33ed71bdcd6b4aad71861e7f24ad9bbd386cd0197d9ac1f0310477aba8d
SHA5124310edfdf29e010ea418e63a799154d3763ab8e6ae6eec14fbc8462498be38bc657123f5a940042107488ad5f630a2b895865a8507d1773cda23b62b9f814f90
-
Filesize
5.2MB
MD5dd61f79b15fbf680bddf0786db2c4d91
SHA1a6fc34496c09a349aabf14332f1ff30c3bcbcc90
SHA256adb684c6b7de85ee38c896058200fdddad9c02cd4ee017d2d81dcec5b2f0e217
SHA51233a67e5a1804b936472d44ef15ee2c0b8645d91f9eb1ffeb58118464eed9ad1f48de5053f51afc28195d16a7d7bf5f01f43fa3f414ada6e72afa89c5ebd261ac
-
Filesize
5.2MB
MD521951f42ac3a90bc1a1c6b172984ccf5
SHA18747bac94787652b8977b348527b16eef14a7fa3
SHA256430f54ae0351f9ba18a3df54bbd3b7b4b9c98f0a3fed254553b65b85eaf74360
SHA512d881744885441c7374f6f3131f8838ec3d7fa6cb62c103ad163185e5407c6dee015582df62092af5a38d5482c053c7961be6b83e793ec1c2f8fdc5775c9209b7
-
Filesize
5.2MB
MD57556dd01343033e3dfa8f19f4bc788b9
SHA125b911e8bbf45774634ef8103437abae629ef0b3
SHA2562ad85ffeff60b5507ab9d816a9ad53c816f3c78e70570d46c665db0a87450cdd
SHA512d8d0d040ed0a463ca7f1476d2626353465152b65457ac11e4f34a7d10986ef878b07324f9c8d4605778d90bc50ef4a7e8b8a9bc86e218b666fd2f69364eef98b
-
Filesize
5.2MB
MD596efd6f4f9f324e332cd6abdcd9a6909
SHA10e956d828ffe8abb75419b5972415578d07846cb
SHA2569141ee0c57dffaad9a450bcae5705eda354e8183d0bc501ff628d46b94880abd
SHA512c6afe392868f7ff3366ca0a5e6d6ebf02f60b0b00ec7ee46d4e6c53e89e21c8077d0bfbcaee33f9f5dfdcc75bb9cfcdcc4eb1b8d50236ebc82bdf0fee158b917
-
Filesize
5.2MB
MD5e055edad3f074035633f21ab1c771d3b
SHA1a0a48f6f379d991b6d42dcddee3475523caba740
SHA256e1f19db09410301840abaeeaa7c5e5402e55a5570b2b3dac7730a7db16268268
SHA512591d5ecae4d531a41016f543cbc8b2a1238457c3390282eb81de44c5f4ebff5242b793f0266fa858b64229090cd863b68ad856ac59ce929e29e473156217a8a1
-
Filesize
5.2MB
MD5ef4b01bae0e9a77771dc3b3a7f6fe8e6
SHA14ad6b79b67fb52de41fd2ea3ba3e03d8f3d7175f
SHA256264a493ed2e82d9a7430fd35cfc5ba8697623e076092e75c66679ba021ec0fc0
SHA5128eac13fc66f786c4444d84520c10a0cc244273537dbcdca463415502a6185dd145bbd68a3bb64e141cdf47dea21b0f93bd82a61fa2bd7993c9e602c1e057a7c7
-
Filesize
5.2MB
MD589dbff32a4dd27259640cb903b3e2f72
SHA1a71ec1290f311981b0d6799f0022fa8aa03aeaed
SHA256470909db789945502d6724a8a019d2c1563b967fd871c7a14785b799d6901615
SHA512af2d6e78cc6f60ee73660058a497b0db0b07eb00b17d523581e36058a71e745a9c220eb29f732cc8c1dc6ec29a0c2700dae0cecd6dd41f8b1c543e541b66d781
-
Filesize
5.2MB
MD526d65a91390ed87578178103b2e23e59
SHA1430f2f4ac6024928136ffc506ea6444ca2ce9fd7
SHA2566c6d288a52ae4cc4822c87b6833a895b5f7d452ae9ee1671953db01463426d6f
SHA512a475d4eaf9dd8c2bdea4737bc278b45370b9dd83c6379d6beaebdfbd4a93ed0469d7a26132fa4b0202321f7de4320c0bc245d64900a4d84796f3435dd2a4bf1e
-
Filesize
5.2MB
MD5e4c88f4798684e8182de70e375ffe6c4
SHA17f3c6810a2aa6a69b46b8919a78e2e2c6dc8f5b6
SHA2563f799c37671190a5ff003c060d50e1c04d5afe905d8a497f451f1f0797fc0ca9
SHA512346e76059a2bb72a62b92a11445184caee07df091edc4c02376feee13a952879b192f27b6c15462675c7c0cdab5aead7a3fe7b9b0febc3c7adc2c2c2172ed36e
-
Filesize
5.2MB
MD5e475725428050c0139c6e68d690fa49a
SHA16091f139938999028f4947c162def0420585a07c
SHA25688a27246525671b185a643420d976c31ab373df33066acd857ed56e5a06d4e85
SHA51235117b2d7051794054dd7a327acebf114f5ce4383d1ced29f2dba2e6b0285ccac345a3753c5a0927589498f9366b2bb3914a0285f7ec2d345b0397fc9a63a15e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB