Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:11
General
-
Target
2024-11-11_7bcc2babb3151a0bd9a1888d5370501e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7bcc2babb3151a0bd9a1888d5370501e
-
SHA1
6b1bb98f036de763da9655c8be9727c1d21d5794
-
SHA256
7559ea1bb99e220a1ba12b18ea8675bf7dc275a4c4548124991ead689a78e5ae
-
SHA512
2f8f935005788de4aa6b88b7ef79076f821cf8f021f0abeeab642713c70d233f6000319c1edff13221b0c72798a65be8c4818c941c085f3e7a53c91cce630c2f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_7bcc2babb3151a0bd9a1888d5370501e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_7bcc2babb3151a0bd9a1888d5370501e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zvOjiqS.exeC:\Windows\System\zvOjiqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFQWJnz.exeC:\Windows\System\PFQWJnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MIlDDUv.exeC:\Windows\System\MIlDDUv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jMyEdpX.exeC:\Windows\System\jMyEdpX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzVMqxZ.exeC:\Windows\System\UzVMqxZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhcQUmg.exeC:\Windows\System\hhcQUmg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGjKDJp.exeC:\Windows\System\tGjKDJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvKpkDf.exeC:\Windows\System\jvKpkDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIjVLrJ.exeC:\Windows\System\ZIjVLrJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KKwVeiv.exeC:\Windows\System\KKwVeiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KVXZkEI.exeC:\Windows\System\KVXZkEI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KyDFBoZ.exeC:\Windows\System\KyDFBoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IQZOrbv.exeC:\Windows\System\IQZOrbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlTHfRZ.exeC:\Windows\System\nlTHfRZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WxKfWAU.exeC:\Windows\System\WxKfWAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QIBtwBz.exeC:\Windows\System\QIBtwBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coKuQLT.exeC:\Windows\System\coKuQLT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JrOmMPE.exeC:\Windows\System\JrOmMPE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njUbjfy.exeC:\Windows\System\njUbjfy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PePOpBK.exeC:\Windows\System\PePOpBK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kyEIsWn.exeC:\Windows\System\kyEIsWn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5914f481b968ba767734cc381929e3df7
SHA18fd919b0a3a31eb9c0071bbc87254558e164c4f7
SHA2560db7e2d75d7b0f8a441ce5d3867b99ff0bd83d2518f8201eefc65a01bc1d2e34
SHA512625f0b102f17c5e35d3ea41b625b5d0c137254d85988f42f67651697037202784cda48b5de69c4ba7b6ecead090fc44b4dd417360c674c019852f3f1aeb83910
-
Filesize
5.2MB
MD5922936765c58ebe8b591122026450b96
SHA1564ab163cd2101901e3e01a297b7ee0785699b5d
SHA256af88fd9b6a627f02268e9e664d2174ae22b7663f65abc1c29448f4238099f360
SHA512a84992bf09a3ba7a689f30be4ad23e08bf0a5cbadd257fda34b452bfc229ad716995e4a5a63eb6394de9ee96508a20ad459488ad1072a4ddf6ad453815f776af
-
Filesize
5.2MB
MD5a108a624fc87136fa8532dbaef52ecb4
SHA160fd27f227b6fa4c367b395ad3658c3196be348e
SHA2561c82b26b8c59780b02b004e4c68e7c176c1fc4fbb6d367b11ccfb430e981e9f8
SHA512a0e8601dc438ad9904abb38c3e3a019f8389e767d0b136260b8f18689dcfe8e4833c19d15ca574546a51c25db1b0930d97747de30bab5df3760cf6ddb2fff3c1
-
Filesize
5.2MB
MD5c63e022a2a36cb4650801077d73ad98f
SHA10f3dc3644c49106873589d2abe5df35f5d7f02bd
SHA256c593c0affa3860b7cc7d10dab971caa39919bc993ba8c4e637d561c7b09adc9d
SHA5124d65980e154bf6c44cdbffd329fbbbd93a528323728898ef7208013c83ad0da14db8ec880a19cea21d91f504a12ba7cad52cab5fd53e8a6579bb6e7b17824da7
-
Filesize
5.2MB
MD5fb9dbe291bb68f38f099a8f4754ed0d3
SHA15b2277543de70b80b61bd1aa2a44abb26de11cf7
SHA256a3eb12965c683354368e4ccbddb79b18098898f637196ad657a3f545c4d55a31
SHA512f0e831958929828869586d773d1c5e41f6911e86c553276303a74853a9de291bf7d2ae48ac31917f7efccad370f916773f6d3564d2821d7043bd5da81c8f138e
-
Filesize
5.2MB
MD539731d3d9c3e0b9e33d4b19e0f81517e
SHA1c4f6df3d73fca5b25f44c8fa371d16f756925ca3
SHA256ee46a943f704bc498bd5bb34ae7b3334345cc9c3c91e4eb640f11c8e2765f0e7
SHA5120f210b6c2ae52f69493bd61fe116815b14f6a6c28b926538fbc328d8743b3fbdd0cf73ad87ff7b71bb52467625bd842875770f5b9d02b8191969b22864b79d47
-
Filesize
5.2MB
MD5932e039eba193cfe22c42bd2281a2df7
SHA17f61dca0d429a3f62922f9f1b1deab6a42a3ee6a
SHA25697f018d2e2a402d4d304693f10111355e96be43b874a045d4349b0568b696ada
SHA512dc4df340de7f76319a7d64108f23fa67907d70ceaad7fab86abc1c1dbdc2d3c17011df6b471724a4df1b2fbcc4e88fab215aef89217513a5f21aaa495045e2a0
-
Filesize
5.2MB
MD5993182b7c1aa4fb5c6edb0e0e7072be5
SHA1958f97a87bb32c5e8e5d7071d1535a1746ef8d3c
SHA25691ad8ec2a3b36369e7e8418185dddd3df172810bdf5008074827d723016390d1
SHA5124c95a8d4692b2e56a29f0cf25f8708be0c32a19f494a89fe9ce64ae2792a7c1d532f1dbbf29bfb8f6f3664f7cb467eeea508d1e8894ec0fd49f8056e3d11cc0e
-
Filesize
5.2MB
MD55f6dab5f0ee0832306cc89ac6ed4b7d1
SHA1507f70a323390df2da4f26a562362178b72d4b70
SHA25690a93bb66d10cabc618366ea84936fdd4a695a7dc79664b543d5ee489ce70ae6
SHA5124c8def93efb334860700216c6ea42c218c23a5694de36512e2a9a01b24a3c05cded1ac455aa20fec2a8f4293dd5d4ef9bdd05eaeb91df0aa224c5107fc7a8d57
-
Filesize
5.2MB
MD566cbee8d7c4ccbcb41315a317c8dc7f5
SHA12e52cf00508ae46c261243bf794bf6034f116c87
SHA2563bf61a8e265b4c4123699b7df720ab574567f8e47d25525e48c5d536b4536718
SHA512fd143957ed1382df09dac46409662fd97d3eff3aeee42f6f3c9ceed3c16d46a24dd78e74042cfed71593373ecde29ed90a85f8d11401acea33fc23c7bb5897e3
-
Filesize
5.2MB
MD5116016c8f93dc05ae4376d15ceba4e40
SHA1fa32fcc3d52968c6d6abf6ae726a199a7ed7e66b
SHA2566d3b424f51d732f2759ffaf1f1eb13d69a4964a6b0f98998acbfe4bf94511f60
SHA5129c14a282260cf45b77b6c7f17c2cabd6bcc072c47b5817f03cdff488618828d3cc96e488fc31f45d039312f520db2aa4919573fb64aa84f9104c784cae032886
-
Filesize
5.2MB
MD55965e623f68001d30034eb8cfc3d5fa6
SHA1e00162f5e18ff985dbd7af6b891e3072334c63dd
SHA2569a6c02870c8a692d5a383bf7d18a8a189d33c3f92f3bfda4fd28982ad9090489
SHA5120bebece3be4785af6f0bbe9f516512c3b4ba00f85b838d6842099b8448bcf33a1bb9c40776ec74cfb3350262fa2cda43f13b3b9be4f28fd1993fe678e89a756d
-
Filesize
5.2MB
MD5fdfe44c3cb0a4060b8cb9eb757fcae8b
SHA10a60ccfefda47c423c07592e45e70f8eb6a03ebb
SHA25650e4a2efe58da6b05e8b3abbca92534200ec33fef3268c437d2fa45633115ed3
SHA5121a1a5adef18e7854af2f9513265d1a413eeab44a9505f449f7d77ddff756c4ec3384b8cda4df3571ed5c1c42abe799ed583ffa47d959de9ba65b77bed654fac6
-
Filesize
5.2MB
MD598b31f9801d15757f3186b6663f39fa2
SHA1f0632f350032245c2842d7734c19d05c6d9dce0a
SHA256ceb7ff4d4b3cff0cc4b0a47207df7c7e953750c827bf0a0eea0af3e8d214776c
SHA5123f9f9cf8650c3b94af8725f327a685934151f645c6557c70060e92b76e1e7f9fc1733c9dca26700d6583eab72045fcec92cb0da3271e4d3fa4d1b65b4b696cbc
-
Filesize
5.2MB
MD5ec1293aae75e5e4935a1c05fc0e4e4fb
SHA195e4203b609b8ea71ace7cf2b030da648e31e3b4
SHA2567733e5dd1d3e70361ee9bb379339d6a86fd49cf60c8d66178b35bed2068d42fe
SHA512e79f3f6ce113ab37d3c14cdfdfd06382b95782606382a363feaefb0236b704395f99a752f0cbc16ea39417b037b327e541366c0cd99bfd98cfb33de1a998f232
-
Filesize
5.2MB
MD58e9ba69e9da74b9e57d996af06169e31
SHA1cad85a89bf2c4be610bd6cebab96ca69e7bd92cf
SHA256df6c1ae97c6d1e22c7297198474b07d387b5843813d60a1623f44ba6412213d1
SHA512a529ea1ff007ae8db7c2763659c5c4bb6475b3d222c85e0fbfc9e13f169bac17e4334e3fb51fd5b879f4c3d8a5759e79c6427f0a0b56cbbabc7674b53ff7e583
-
Filesize
5.2MB
MD5f118c71e514312fec8ba647b27409f8a
SHA1e6c11eb1422f2ca9303b736122afc2316619c8f9
SHA256e59368ce04367b431c940fefffb0f94ca1bad51ed897f6b6ca324f1e40edd956
SHA5123a0af3f20ecae7e1571ffc6ce27fe4a3c218239924c0302c45ff5650b15b7e108052b11813e9b8c887e29f1d996de325d732cd0fd31f336ad381ae9b77719c30
-
Filesize
5.2MB
MD5b4cf0e469bcae550193f27037af60ff6
SHA1ee2bca1eb1bcad6d63061546ff88e24415d908b3
SHA2560ce3c6336f1e347c788a857214c69599b679c9d1adaf24ecd250185dcbf0bfab
SHA512fb1a33669f27b90255d93fd4e44f3916cc351f1810cfee9d4ef7b49bbd0bbc2f120b344f659c3725177b97ef87dec4418bd09de80de70a7e02469428450a02f0
-
Filesize
5.2MB
MD52156d3064d08c05b200d594a5d952914
SHA16ebf7bd3f772365bbc4220e949d4a2789751f876
SHA25698cf290d5a38da00fcf19f2a6315d051b8969afce1b66355539a9e71e0822975
SHA51263e623a0a225577649c0bbcca83ac35b7301e5a031d706ffea2845c5d15ee9d3ddd9a432444d6b092af2a04a6ba347f7efb1a87779ec827832fe9366c830b2ca
-
Filesize
5.2MB
MD5fe82c824338f922a293df6f9bbe7c464
SHA1e7886e8fb0bb6ac7296efbdee613672913803060
SHA2565ae6a9ec18a89465d659d2991e55328f3a0b9732092dc9b34dfc6cefda325c46
SHA5126dbbbf6892b20cda765c0f1b241f774d1b843674a12ac64c4545b23653e326acac02fe1519ba3f8b12e9b28c62662f53fe09387d7a573c44c2696b8ba2e4a7fb
-
Filesize
5.2MB
MD5c61bf01387a9adc1ac7685dba37c6f60
SHA1dc4f5d7eea4e7a141202baa3b9320d3bbc0f9e8d
SHA256038d1e208ae210c23a59c4d10b2d3a77daa004af2a0203606ac91a87d8a35b45
SHA5127de042aab00fcf009598f8309ee9610bcfc311a632bfc8e8a77da749a92f7fc4a17ef2dd408dc9bee1e2c416944f1adca236dfb2af928fadf0ae82ad85adda6f
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB