Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11-11-2024 21:14
General
-
Target
2024-11-11_91c131688c9ea3f4c774dd2a4710d2fe_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
91c131688c9ea3f4c774dd2a4710d2fe
-
SHA1
2089b2b4835ee7809020722d38851e5d002976a9
-
SHA256
3f88f4ec32724d5083df9e5d1903e158ef530ed4d61929acdca1406e5b94827a
-
SHA512
9056d2b9658f0fe306f30cb6e90a4a864e28b52d96a165eaa4f78de2f29ba1bcf140a92dbbb8954257f1a31438db38040f4b07176737134cf2e3f367a7716b74
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lU5
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_91c131688c9ea3f4c774dd2a4710d2fe_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_91c131688c9ea3f4c774dd2a4710d2fe_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DatpnpX.exeC:\Windows\System\DatpnpX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jVdCZDh.exeC:\Windows\System\jVdCZDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OLZaqDs.exeC:\Windows\System\OLZaqDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtREnWl.exeC:\Windows\System\jtREnWl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QTbMAIE.exeC:\Windows\System\QTbMAIE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VPnepqk.exeC:\Windows\System\VPnepqk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lmcGamL.exeC:\Windows\System\lmcGamL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SVXZePf.exeC:\Windows\System\SVXZePf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KPxwxGZ.exeC:\Windows\System\KPxwxGZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aiRGKYz.exeC:\Windows\System\aiRGKYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\boISFQg.exeC:\Windows\System\boISFQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EykiwVp.exeC:\Windows\System\EykiwVp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ibeBGym.exeC:\Windows\System\ibeBGym.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WoAxZph.exeC:\Windows\System\WoAxZph.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzEuQMD.exeC:\Windows\System\VzEuQMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXfaTMr.exeC:\Windows\System\WXfaTMr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXZsfwv.exeC:\Windows\System\sXZsfwv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UzoYTTD.exeC:\Windows\System\UzoYTTD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KxWoBsz.exeC:\Windows\System\KxWoBsz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RJxdsvE.exeC:\Windows\System\RJxdsvE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iEpDxpw.exeC:\Windows\System\iEpDxpw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dfa0d0782c8fe3a9ca2601eb00b37738
SHA142936c97f3975b8861b11bb18917850a3867117e
SHA2562d48f27656966f70b83bfe76e54474afe2e74d97fd424845aa5b7c2c0ecf6d64
SHA5121f91cb1fedc674522d895556f622e87bd449183828d346af5061a587b7d25eb88b35680cb56726520acd2c36c16a09215b2b4183538808bcbe461644bcd0c135
-
Filesize
5.2MB
MD54aa6854eb79d820282674b13fca7a4b8
SHA1502fa9e381a22c07e9a751bc62cef35b3b69ccc6
SHA25621d259553ecb6ac497884d8b7cef8df51db35e4cc3cf652e8d781a484e52d5f4
SHA5126c017b1adfc1db7e6a1f1431cf328aa1d24da8d45e4e6add3e1588e05447a89a78fc0c437c4001dae3ce8adbe200effa1c5aae048f8d424a2da7176f39e4511b
-
Filesize
5.2MB
MD52595f2745409b92894c0e2b87cba2db4
SHA12fd874c706bbbb28c8399ebdab100951a422a1be
SHA2567f07242b494f91e13fc754ebd3eb1847ab3436be3d14c64e4968724d30308120
SHA5129641dca9ece33da936c2dfd21e7a977efe4acce987ad70ef72a428e12d25b98ad9a10ff02020cb1ddbaaa30ddd5075d02ee9b9e614dbb4f32607d3ff80005d9a
-
Filesize
5.2MB
MD5182291f9b24472578a97cf29d9e86f89
SHA1ecfb227a08883cc7a2978f252cc08a77120b46c1
SHA2563c7708b0e0f899c2d1c81ce8fc139b9e9b6852f44ed095e59e7f843250987cc7
SHA5124b171007d58441e1f7833eaa2e0872395ea5b5189e5a5b638024670cb75163dec852a40e2144d9a18cf8052462e23e77053acbaba0d5e7eb3e07cb34033f3998
-
Filesize
5.2MB
MD57e1457497e0314140e949dad81791b32
SHA164ddcd625abce518e24aaacc1beaca4dd0bc6dcb
SHA256506683608f8897c331da4045d506bcfc8d845a3ba3e8800e2deecea64e381364
SHA51227651290a9826429dba77d479d20d0438f35211f5b0b97345648081f766b68417eaf0a45696518eba9431e6edb4a8fe04de719bd07df6b9d4f99327f313735b2
-
Filesize
5.2MB
MD5f758562522c3c4676460d86ab3c618d6
SHA1c7ce2e3e0cfec5f8c249b8ce57e355a347a965e6
SHA256ad684d04137226e692441ba43cc341abb863296fc671d19ed51537fea5debf33
SHA512a004b521eb06c8e4bdda41df29c5a388aafd1e6e9e6641883ab4dcf303a3d6bdc7473bbb85d6edf4b0dc4dd81c0e0dc794a4533ceaf57a4a65492bcd5fe4699f
-
Filesize
5.2MB
MD5e8217e382e356526006c6482ca31a867
SHA18a5fcb92b891fa72f085729190ad43fc2f52b3a0
SHA256000b9f1de2da4028e54816e5a4b3ab265946d911cdd27a61de3f421c8b0001f9
SHA512639679bd295ea021944d1aa3d186dde9731e98a7f63f3506a678fb247d5300c76b55e114783460575df1b022555b6339fa187f204bed193d167a7286a38bc2cc
-
Filesize
5.2MB
MD5cca4bcb7539e6d8e40346e657cf865eb
SHA11f62719c628ee8a024c1ee16604d09413455c87e
SHA256a575c5091134ec8c76c2b5a2b4373f4b8817cd7ffb8b506734c123fd6683ff35
SHA512de35956e4f2d2a4c8ab376c40df8eef87467ce9f4c8d316390886b3e40f32b8cc64cdf816a18de6171e5a265a555dbfb3d4347875984a3d3340c2c0819ff7f44
-
Filesize
5.2MB
MD577a7ce79585b9502ecce81ebff8062ae
SHA136e1a449a0ab87f1e13d7556d4db481ba8e06884
SHA2560802324e525f842426681375872903bc8b1ef106e08d471e24461565359660e2
SHA5121fdd2408e984599817f5a4df23ca599a61d9b740b5cd14c685a3a11ffaff683e570793eb037351e2cfc4d2d9653ee8b414f979ec324f13b877ede1f35f3fa05a
-
Filesize
5.2MB
MD5258dad5e33288239e17ed3b7f280fd18
SHA19b0e9e4c9fd9fc59a04654256ebe992e57b05e36
SHA25612f82997c9a94258f0014b7b7b5d45386ab5b450ab3e9a2e77f0624cf566c793
SHA5123a40172424cd03acf4da06215f2b169b075d84ce8aefd78ebb2f978acd63431f7b5b66d54806008dfd3aea16a574a1be191cb3bf9b30e2788c21f7a74616c231
-
Filesize
5.2MB
MD5dd4ba010920f2506b3b8261c368e78d7
SHA1ac94b63287164a97eeed99961e4bf9257768b92c
SHA2565d2b8eea73185c7c65a374899a78fbcca69a2d57367b0436aa121ca79a3dde7e
SHA512d4499d2f62320d0099c5c18d12f29d49cc31b54f5598560b7d0ad188ab67780d4c25f25db4410bc81317d70a984f466a4d23bf48f9612c0f2775ddcb25e79b3e
-
Filesize
5.2MB
MD562bbe465728051cdad2354008cd08fbc
SHA1e97a384c2d09955c9bf0ed0165643155df11a90d
SHA256dee926965ed55a39914dd6934e198010e3b0e96525db0ae977f2d3a5fb4208a7
SHA512e85381692c31a24a1cf3468fad3dca0ecf7395720b5a1a33e81a727e1e550df1843954a09c117cb649a8e14d7cbb7da959c1869f01cca4c850480c878960ce5d
-
Filesize
5.2MB
MD5f096f0d699aaee982d877ef9d45813b6
SHA1da6723b2ea712041d06537b98982bd423d518fe8
SHA2569e318e76e094eaaae4dab1b127794bbcaf42d41c726ec39879d9c3aea3d77de5
SHA512a097880c32778a1006e2663813c7d3024c11d200ebf62ae100dcc169c431261c28e4410d6b7b6b9873b4dc71fa2b9795280eb36f70b616af9f7cd626c457f965
-
Filesize
5.2MB
MD511b806138d9314d664d586d648f179a0
SHA11379290230d82fe61121b428049065f414c354ea
SHA2566442e218d36a32f92e8f38efa43e0fee045c22d380c508c529d9a7b53f750ed1
SHA51262996db3411c06009ab95852d2545384ea4e4cc0d1004fb662ccda5091ff4b59a2e506baaaee84c55915d9d5efe62959c345bf3404f4b88fc2d6f8c72505db47
-
Filesize
5.2MB
MD52eb2c3a0d9555edf904be9f8ece42a7d
SHA174d304fe7f481335fe85301519dcae3436123c72
SHA25627fd0be2c415a1c61d29cbd735634c68c3526576cdf0de11fb6e08b247ee6e0d
SHA5123d923a156d58deb18d535cea4b0f0bd5124126da87e9a6dac7403296b3922905c9c3349a5ed176b8b183acb31cbb90cfad3b764efe0a8c56d52dcace91968353
-
Filesize
5.2MB
MD5acd3f47736bdae749424c37969714770
SHA1e53c6075230da89113593c9efdc5e78d70c093ff
SHA2567ad8be4eb19f417b0af83500026a5ed9963f98f1465cfa438acad37c2637f5df
SHA512aa64fdd8c4277b3ccbec6cd145bf5a0b31a0d06dacccd84694b8ae6cbf1051d299d18c0eec40a2744967ed8ac31f97ef2963100eae658dd12a6ce85c99586188
-
Filesize
5.2MB
MD56815d07bd1b8140bfa7b2427e56549ea
SHA1a08332382665a5d993e17c8c0e597bf330878e80
SHA256c77bea23a31c877692f355bc5a7a863a52d61eea56928ffdb79f93a7ff3391d2
SHA5129eafdaac1cdf1ef65d63fbb08ec29df4f3ea768a70c44b252e35a1864396180194c17c97df16339f29c18d32d9e9d3ce1c2819aa75af5ca72b8003a2004f86e0
-
Filesize
5.2MB
MD5b45e8fd6c220fdf4ff34cd197350369e
SHA12cea7899644e75fcab575a5ddf18ef3c78bacf23
SHA256f3094bf61189d6d48fbc59621d563492cf944a4aa944defa5c1e383df080402c
SHA512f80704e7b65ef33a76e1a7ea91c4ddf83b31c8a611a455ad8e01941816560b8885ad049f878a32b01d428a0a6139e64f5d9bfd6d7a2f10afe21496706d33df2e
-
Filesize
5.2MB
MD5e0668dfea38724d576f7a2b68be3be48
SHA1c9942bf072baebd512b29f18d978afb31527172a
SHA256584ae1068f4e2ca04c9758aed27d551c1e506c0c32e4230f265b5dbb3296b0bf
SHA512242004efbce1a25edffd93c074a2bc4ba6fa8759d66f72d52675dfd0670b9fedb4bb9a438b107305a20061ce514a582acca64d6ff2c035dcabe39f96e0621a41
-
Filesize
5.2MB
MD5e4810fe4d78c52d1cbe2819685b8dde4
SHA15ce3e872898bc4f38f4e6364136a1a4c201746e3
SHA25659d63ae64f4a7f8cbef95f10a6d9b8df082ec7658871340014fb54efd8f91e6f
SHA512c5684af62c1ebc5c9e9f8c7cc6f490bfa2a903c501415f0f35e34e9737bb34974fbfa570533d7718938f353f4ac72e2c5c7fbf2333b353f76f31a564cdadf6e5
-
Filesize
5.2MB
MD56a62831fb1bfd3d0f033119c57801d1d
SHA150e3f459e52e77b5a4be9ad98e21b21d94bf788d
SHA2566ab2e2d028a63ddc7e7aa1828d08d4f2818804af0eb46b5a05cf2aef773a4ed7
SHA512bc7503c8f9214723a52ef8ce46bcad60393845efe8858fe2b5e39319084719ba95bcf1df78eb451bdacec7facafee64d4f2e8da0ffcdc80a002a475980f17f1d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB