Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:35
General
-
Target
2024-11-11_e3ed426e7ad495fdb649578d3e50e500_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e3ed426e7ad495fdb649578d3e50e500
-
SHA1
e95009fdb0ebd368a17c0c15750677175f8345b3
-
SHA256
2128ccac979b26d874bd54b97b6d6feaae133ddcb8340da6a2d38614c77178f8
-
SHA512
e36819585c52637e6f5eff8250125180dbdf87f3bbc68c6149d06daeafebddeae634498c01e9a58182c8e9efd883b2688571ac63592ea9f841fd6ff221759633
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_e3ed426e7ad495fdb649578d3e50e500_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_e3ed426e7ad495fdb649578d3e50e500_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qaWVsMf.exeC:\Windows\System\qaWVsMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nXAgfOJ.exeC:\Windows\System\nXAgfOJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVYxwGy.exeC:\Windows\System\fVYxwGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yabAZrL.exeC:\Windows\System\yabAZrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNfWlAR.exeC:\Windows\System\yNfWlAR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AzzYxKa.exeC:\Windows\System\AzzYxKa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzYdKaO.exeC:\Windows\System\kzYdKaO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BZsUEMw.exeC:\Windows\System\BZsUEMw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ANxfhKB.exeC:\Windows\System\ANxfhKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yINRzRp.exeC:\Windows\System\yINRzRp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ruRqFZw.exeC:\Windows\System\ruRqFZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lGXTets.exeC:\Windows\System\lGXTets.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBENEmF.exeC:\Windows\System\oBENEmF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Dypfpig.exeC:\Windows\System\Dypfpig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wvTvcTk.exeC:\Windows\System\wvTvcTk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VDHZPno.exeC:\Windows\System\VDHZPno.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssOYEoN.exeC:\Windows\System\ssOYEoN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyRlhjo.exeC:\Windows\System\GyRlhjo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EefFVkb.exeC:\Windows\System\EefFVkb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ABzvtLz.exeC:\Windows\System\ABzvtLz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wmOzxjb.exeC:\Windows\System\wmOzxjb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD550b8ea766187cf0aa5da57d1eb6b6442
SHA11df202eb24192d284bf6439c150b7071e715c09c
SHA2566d2b4a8ec4aae5e455aebe0834088c27bfa8ee023da681991b3d655f80d93d88
SHA512a8bd39072ca2f54d3073661e1b84326acf11441f08a5274736346ca9bb4c928c8cd90c90e7eb78a58ac08ddefec67c25fec3df7d9d2a6b412b6fc8c6717695f6
-
Filesize
5.2MB
MD5d8320d6b0fee56a845e3fa8e8da1ead2
SHA11a72e0afae208e684c2644a5235aeccae5bc4536
SHA256e6c79d45c2ca4fa70e3bfa9c9656ce60aeec096983044b9cceb6430cb7eaf08f
SHA512bb9366355e1d13a70b286f6a30141449d9667054cd7252f6e7698fc0873df7a10e8b0a2bb5f33f4c02ff907fc58e14b05549ab97bb73e542f5028dfe82fd3e66
-
Filesize
5.2MB
MD53b09d41343291ee74f560924db4955f7
SHA12aa391bdbfb09084092febb7779cd451554fb44c
SHA25634a69ecdcbef3fdc252e241923400f73ac59278e5210adea3c27c4eaeae9f710
SHA51241703a309929714d40958448576c3a4db726538f3c9ccf25ae9d008e04810b848f9334f6c5bdcbb2c1bbf0480709e6985cdc47c25b9523fa2d7ad08c34477fc2
-
Filesize
5.2MB
MD5978235401fac0310b3fb5c473fc8d4eb
SHA1b2029674c4a86f3a50bcb00960b4600a3aea429d
SHA2562acd0b4ef2fdcf47d1f9b6ea1cd1e34ac64579212d5e5b93738b7a7317b7bf33
SHA512d77d00ccadba3553bd682830ec4077d4917de9b3f4b850e7094eeb3c8cb0b4d81182997393f988e0011db2a17f63f3a1ea42126f126843e6b7c7d8ef7c86bb0f
-
Filesize
5.2MB
MD5b6e9fd0f20046ba8db32f09c4922367b
SHA1cbef7516e23d6e3c5bc1a0c238935038f663df43
SHA256bac9c1c90e73acf3d72f154f7f7ab77ba073483d1eeb78f95ccbaeaeb58ff9eb
SHA5128e3d6b6cec5ba615ac6b83135d5fcda60f20a836939c7e4923f4e4ae0391fc698e09c6418804039ff0e3d9a4227cdd5c8d7e3dfe707166b137687812ca14e142
-
Filesize
5.2MB
MD5a0aaf86d26937eba6a017c23d54a3457
SHA1df3e86d05e91d1099e00c88d9e88d523bb9e1515
SHA25697eb30b71b254c87a93da2886dd19d56da6cc7855f8ab3ed64399376ac291553
SHA5123816589076944618840e080240beae758abf9540c5c9f2e0fd212ccd9a2efb21a4e3604502006c76b3bb24787a6be4785fe2e6c21a4f0c53151318bf49224ab3
-
Filesize
5.2MB
MD578a2eba5e1c5ae7875fc96993fc0e58f
SHA1f26894f094856a806b1ea6ea89e93da25d5fabfe
SHA256d11f3342e1c7f34673651922a84cb0b297a1a332e6f73e39fcbb0985f5497eab
SHA5128eca863a1c33fb2cb945428111e44fcfe8a0e2881a0bcf85e83ec17ae309a408e544c91781ff13a694a0f2f98d8dcaa8f700298a4aa948e0b3a15fe6430b5660
-
Filesize
5.2MB
MD5df00a2fec5bdd5b33235bbf148734c17
SHA1405d0817e89e254f50a117610861d6d28cfd1d41
SHA2563f1675b36adb646f9f5cf20284a11895a29f3a016262a6ec61b103866fbde813
SHA5121e94990a3be90fc5b2ab4270d289e3e18fdf6213f5265742aa3090a2839ab44dab6a064a3b8c581c088e23996c44c191d7c4204c64795711c489aa0b5871c766
-
Filesize
5.2MB
MD56286f64c7909e27c4a6765e484be841c
SHA1589841fbd26cab1e591fc238504697962159e853
SHA256255171d3c179d542717839e3026c20c5b9f4569cd042f734f6e518bf74a24704
SHA5123ce6c67819d66b4d42b3c29912d14ae76d012aca9b1643e07060bb261dd5a557ecbb6eb7505e4f44389bec6fdc0335ec4ebd55ee26d6fd500c2b9061f39d8ed5
-
Filesize
5.2MB
MD50dbac0c950b0b2143467c67d21942a63
SHA14822f4b93e752ce76b4f9897662f0fb6294cbec2
SHA2562ba8e1e46ba90f4e7c0418a45c3416bf1aae6601f38471eb0ced5a9b129b77a4
SHA512ef288afaeb6816e5716510100fd0ed35e9c97385d375a7b29a8b94f07d27c18cb271f08ab3c0811e98889510e6c0ca5a8b218862c7cbc59d9b3bf04d240ff463
-
Filesize
5.2MB
MD56dd1ad354158e88557ed1e0a792602e9
SHA154116414a6c3baebd243f6d8761b899b4eb13151
SHA256a6f92801abe65c3c6a810193982f5cf8dbd861c4cdee02183addb60e2930537d
SHA51283ef36325c02742fd1261f87f6f7556a4907ca1b3429545efd3cd33631a021ffbf8dc0f32c819edb789303a0630059d874595c82564dc8a131fdefa75f7d3582
-
Filesize
5.2MB
MD5e7ae8d0bb2d8fe3fd797bd3ada43ac78
SHA14d8fe16f366dde4864b2d06642edcf9c72cf9446
SHA256cfd891d30b7c1307484f543d115871fea29156d551f50cc26e1b20d7749d71e5
SHA512feac73a0eb357ae07a51878f7b0021d7bd81743c3436cb3ecfa7e55cacda15eb111a02f3e29e04a8e32e14ce9db1220e26ff5577b6eb61b31f635e0b676f2a42
-
Filesize
5.2MB
MD5dbdc93939792b5420e437f6650e45ce1
SHA144ac2d051aff885ecc59f3850547e0ac340571d6
SHA256f1a0f6add4c1aff4014c2dd17e715e7d36b9d010963ab81c2dcb467290d6a91b
SHA512ecbf6815aa4b572d17df32622a12ecfd8463f3e28d9f3de5d9399f2a0cd3dbec940c4d236c6cf778bb50d4eac07e65a604bd6ac506b64f703e9fece2733129cc
-
Filesize
5.2MB
MD5c72d7f2aff1cd189122026f9b57166cf
SHA1c7e4bf92983eee4ba34c5718d361e73ff8fa0d53
SHA256bdaa4967ab641a8c6a1578c6c2a54a1f9dd18d84803b7388d10ab9eac7a8b82e
SHA512964a6eb8367e5251487a46a8c70c9008e77ac5ffc56a5f2db699953ff509ac0a3a95b1ccd92249a0e6dfc95cc4b397a68ed91debe6ab37f6114e243999bddb89
-
Filesize
5.2MB
MD59b996fa776fc73c7d4ca505d4f4694a7
SHA1e4a2f5da7da9691946184dea5046ab3b36181bd0
SHA2560f8fe849f5f343bbaa35b99e266eff8c73039612abf94cb9d3a98f462d89b084
SHA5124fc5284e083a1b4b53eb286a9a48026ab85b6f72bcab3bb337be3c8ac66b9a027f8679067f837e9c3af3509ec0de25134035c4709ca2012fa3f425a584cb1b12
-
Filesize
5.2MB
MD513e69d9d8e8c75c42718d3271b62fb49
SHA1fea78b4a482f693ca7be2831f4e4458a4147e5a7
SHA2567ac130d9d7e73623d70ce0c6be64c75095521854b0d6dd3c907a708be8d213e7
SHA512a225c713944865a4b193aea9d7cb5c361a315f20dfa193b6b18c2ad63bad9da9e85c86467e1a26d6035b1c438884bf33324edc1db3552703e51a56f3cd07c1cd
-
Filesize
5.2MB
MD57dc8bbb98fab35f6760efca25f55f258
SHA1ebe81b812ab3371c6d98172138e1872e21d5137c
SHA2566cf669ca272a71b5720e736e45417bca5898bdc2b9c40df557728bd5e88a3f9c
SHA512bd40950655434639d477aa7b48342f1ef3656c49ae65fdb9865395111efbb8895e6301693bead98d46e3c8649e787d368c25922abeec8536f44a35d161a86f0d
-
Filesize
5.2MB
MD5cc538491c9b2426a2d090c80d16802cc
SHA1ee3ed1e1a0bbf04da253118fdedfd11db2b0f989
SHA256df9f032a07c52d50bc564529e6c717e7fe0a1166e3737c5787ffcc47b4fef35a
SHA512d8243dc7ef06ea1e1610785a00efff701951753b6210f42490c398ee4f7e181a23c9b747681c2f94196f9dbb0f33420e4786a230be96112f74fba96140e2d759
-
Filesize
5.2MB
MD5f82012cb6ae0a425cd135292db0df3c5
SHA132c7380d2fa9a652642da7a69d56ae0a6c44baec
SHA2560898aa7b9b68079c4d6ae557496679946d1a1653e86d42e3249e68b54349dc83
SHA512bf7afc244d55fcb020bda3819852e17049f2bf633682bd725e3aab7ab7a4301677cda3d1fd5c6c0a3d76fcfbfab2b1461be5a608107348f32f0199e35412e110
-
Filesize
5.2MB
MD5ea41fc120de04dc4f4a8ab26af3c7254
SHA1e776741ef39fb85ec9df4c6fefa9df2591b66ddc
SHA256caa6e54168ce37997ae63bd822f047a5525f3cd89bd68b6d4ab68d0f58a642a2
SHA51253e97fcae8619e086c74ddbfb7813504070fcbbaa650d323a83a0aedb07751a96cae825c63cd1b5ca3a42d36c994bfb662b6f1e6bea3c7cc78c73c9c0851d720
-
Filesize
5.2MB
MD526c12e67d2e2712311dfa67a3611a990
SHA1bd996bae2c0add5666b727dd1c879885d419681e
SHA2564a6683e6abb4eecf517db473480b13978c7df713e651bfc7b75303e72634ee81
SHA512811d2f005049cf4260fb11d50fdea6b6354235ff3677885c8da57c0fa86a5472958115798a8b7b0a2b2bf4636005cb3197bb32eaea97cc7a96b2fa8f5a252fde
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB