Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:18
General
-
Target
2024-11-11_9be3c6e9880d4d488d47c929699d675a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9be3c6e9880d4d488d47c929699d675a
-
SHA1
0e07a7c7e10956f75475b4de3acb07e6bf34f383
-
SHA256
213c149a7ee579171c88e684c093afb738ba44a1dc485ab8efd1322c16745299
-
SHA512
cb039a9128333bc9923f4615d84fbc67bf29c70f03fa73debb22644e1dde7c2fbda66df5bc2dade3c17af51aca87bcefde6d01d499e66e0bd9a25aa5a4e8cd44
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUg
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_9be3c6e9880d4d488d47c929699d675a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_9be3c6e9880d4d488d47c929699d675a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tBQxoyv.exeC:\Windows\System\tBQxoyv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyXopmM.exeC:\Windows\System\MyXopmM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\znVCoEO.exeC:\Windows\System\znVCoEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfpwKEh.exeC:\Windows\System\WfpwKEh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAVaHkh.exeC:\Windows\System\eAVaHkh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpTdvVn.exeC:\Windows\System\bpTdvVn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nrxlWZR.exeC:\Windows\System\nrxlWZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwuzzzO.exeC:\Windows\System\jwuzzzO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubbIqUi.exeC:\Windows\System\ubbIqUi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AytmpiF.exeC:\Windows\System\AytmpiF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raTwmlK.exeC:\Windows\System\raTwmlK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PTOpfpt.exeC:\Windows\System\PTOpfpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Askpuim.exeC:\Windows\System\Askpuim.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsKFmem.exeC:\Windows\System\jsKFmem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eDVuboY.exeC:\Windows\System\eDVuboY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fMdxpZd.exeC:\Windows\System\fMdxpZd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMYwcsF.exeC:\Windows\System\wMYwcsF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uLSSFqn.exeC:\Windows\System\uLSSFqn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkBIoQg.exeC:\Windows\System\fkBIoQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tlXjAsd.exeC:\Windows\System\tlXjAsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kTpLAUj.exeC:\Windows\System\kTpLAUj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54faf5850ed569f098fb7c983aaf58ab0
SHA1d4d9bf3f4b2c12ffbf8e848ed67e289d84722c19
SHA2561d124deedfe825470992261c5193daa60834cc39caccc74233bc3803019f6b4a
SHA512539684bc5fa9913395dfd216abb63b9d13b39416dc576f10f853f599c5fd7f9d891123a09a342a495d6f6d24c942e054ac27f60b8c4d6552c7f62cfbe530fe63
-
Filesize
5.2MB
MD5e94324ac45d531bf894c9b577cbde1bc
SHA1c56ba18aa07bc0509502eff56a1a66180acbac26
SHA25655ebfa615c30a0beb675491347942336bb73f5b1933b6a4abd589cfad094327c
SHA51234c5f28d363e585aa0d456dd2164e43b4030be2df6e4f0de56c21b5e07d4b8be876c34abb4abf09becdc40b7b932934625f63aa48fec089d3e71649d5a7b40d9
-
Filesize
5.2MB
MD512ce2226d383f9a8b8ef80a7ec343d93
SHA124672480d96d3048c1b0819b76ad425f00015251
SHA256aa7fa6e0ce0a07e179c6990c3ee354b322ab300b12be04a3d53e9f6027ad14b6
SHA512f8ff2b5d78b6ffc01a74bf7abf98cc566b9f30c54f0d41cb392029345381859410974d8a436bfa417e3e7834bb7b25985faf434ee29c1f144db16f1b82c8279c
-
Filesize
5.2MB
MD58d8da7b1fb5b954c2756c2fb22088d3e
SHA1670b6376ef0c139832835093548526c07b9335b8
SHA256feef719ed758a8e772abd670e592abf99b1767835604021ba9f295ee73eeda31
SHA51220a676b245a4e1efaf2aba8d33781d95dea68ce4d1a7c598b9b6f756511c3f615c61012c9c2e10344399e50a54fdc1c2ed2fd2fc451645e3b12dc23c7754b0f4
-
Filesize
5.2MB
MD54b3fa3d1c5593e3b5ae3d3656fb5d939
SHA15370f8ebd08ecc0b1ec9aeab70bebcba0859034c
SHA2561460e48cfeaef95eabbcb0982177c41377b4262d14ef63b3665b7213ba836c15
SHA51210faea9511c699158a95d36ae16105e79cfe19b8b2481e15ed23caadc246bcd1a149a72a82a3af6627767cf61d9cb210d6cab8c14a77139d63ccbd7e9f072e09
-
Filesize
5.2MB
MD5859c7e7aaf152aa7641ac351c932d08f
SHA1f4cde421f640cd2308bc23a3b21a54cbb1f5d359
SHA2561a055b3fad5a401179385da67957f3f76722b42035a7814834a4110f41c15cd4
SHA512df97f434604cf79e6bf8a4e6b6db369741b0f539c599579a742b7a58725c4a6451ec70da4e42d0782519808bfe5990f32d17f168e09d87821fb5832b7cbadb70
-
Filesize
5.2MB
MD58acfa6b025f5f092edfb4074f0c3697e
SHA19f5ecdd81d29d1ae938be8c312b06b911e733417
SHA25629e87b1bc2e2612a6944eb5c263eb20502a5e93ad82232c479d162ae2e2bd99d
SHA5120c17e40f5aac9c6bcdea556caac2757cfb4a74424e5641a5a0bdf172cfde563ea8f811d290a6e7486101d71b34328d9f7ba745d72eaff591a42517ae90ba88d8
-
Filesize
5.2MB
MD5782388b24d148eb6eaaab23a791bd1d4
SHA15ba6bf012013b79d7f3ea334787ca907be8d7c2c
SHA2566eee1470768f6dda9d7d57ce46acda41ca4a2f59ec8cd71308a76377f210a31e
SHA5123c157de115bd937009a40c888d97dd111806f01579d3100027ba27c9c5c8c90c6e38940739a96651a84ae94e91c5d27f838c0ba65a763b8b4b568aa61685d64a
-
Filesize
5.2MB
MD582d069d949674bc7b6c017d23167deca
SHA14b3e2d7cc281dff1cf0915d4a1d272ca30926128
SHA2563e3baa95f7957365298d43407b27f95e3c00fd1e6df9e8a99687ab9e6c3bcda8
SHA512bb198d388a31fd6b176f6ec67e75ba282422d1bf7b30a82148105acdbe8d505fdf2ef489cbbf34263728b0187ef1043d82f5c9d1bf04c9dd565e0b0569da7b13
-
Filesize
5.2MB
MD593dfa74b0c4d49e09313efefa5e50451
SHA1871f6a45eaccf6634b26a7175c6dd0b339ee451b
SHA25660daa73f85138437c76a55a0b541eb3d1c0fe84a37a21268a8b902b004b00906
SHA512593e41f98cd8621db45d4579571ed4cca2bdc455c9da8b51679220d2423a069f634a4113657ec88ed45f5298e6ece3921507f736d74ec7ba81dafac23030cda1
-
Filesize
5.2MB
MD554ca556a38f39113fa3284c742aa8037
SHA11184523f715d40fabe1855787d8b9bc3e7c4839a
SHA256e7c1f1493221140f26e9f9551f4c492d7852f22d526e0d002dc16f0ce7308f8d
SHA512954bf693822560a8865862b0cd9f4ad592fc5bd43dc1f21bbb330d0b4fe918b05d6f419ea50d698f7fbc79a5f68ecefb63631752f27a3019ce4f122e6c91d27e
-
Filesize
5.2MB
MD58b7af7eae9e312e46a376ba06a3c3917
SHA138616d78b24561fc42e22d5ff72c32469c95c26e
SHA256c23f6beb094e01caeaee2fe3193ada8e0d9eb0d06b817fc8fdef720d01d0aa9c
SHA5121153e6984f408ef5794cb54003a16f5379643b512a356c0e0b602c862e86ef329dd4ca10a46fb207b1eb61950bba0eba656b511869e56eeddc50429f96fe7b25
-
Filesize
5.2MB
MD5a0934b092c8f9d76d7049ec27dc379da
SHA106e8f2f2bae4e976f637d365be1c0a16832f2e86
SHA256b8863734a55ef8b014cfc47e34230a2f57fd29d6cef645bdd33d2240aad6b857
SHA512bdd109b3218b70109b486459d5f0cbd06b129960093f611735846044e43de43a98c62730926797ae9221389709f8eabb0a4dc0efc58e9bf4415fa56b39ae51b3
-
Filesize
5.2MB
MD5762b881688d4aee13bb456f45430f237
SHA126a151db250baa2e284158f9335a2fea41776fd9
SHA2563cfa12ef816030574daa24581c9f01edbfb108df8e89c313aa68fad21605f128
SHA512e5c22dbb7c01a56d5c0c26a7bcc0977d01d9b6ab6ffc1a4e8186c6913f33823694927df68a6a4342f3a27d77107c9ada81cc74df44f6e695b6453ef98a36affe
-
Filesize
5.2MB
MD50825b44a7230fa6fdefe90d0c739ddd8
SHA1b8d2ef29317c3ca9f56dc4fed674134bcdd5333f
SHA256a84d67f4b40f4d96cdfc7b712f8c165663b611d1e4ecff6217836b61386ffee9
SHA512150e8d6bf51c2f156aaa8c61a32cf4b5238c2139c2145bff4e6962b8440d324b7224e638405e22d383cc49ebcaa9223231fa6e0fc21013fd1f8225f0dbaa7019
-
Filesize
5.2MB
MD5d10a6430d6a2563d50c61b69211db9d9
SHA1a6d04ed1042e41b818a3b8de6ef866e1ee000c57
SHA256ea9a6ecf2e2d13723a8376f591827489a22359ec0ce28248ea1525620a56a9f1
SHA512406ad926ed5cdcb81c2f9ceb9b95f790913eaff9ab8d4c76a4111de9b0853f81d032548169a7c9ffde86c07684b015a34e4215e6a9a62ee1b0358b4bd1e96db5
-
Filesize
5.2MB
MD538a82b48178b1a85dcb2152e8cfbcbec
SHA1c28810e21e604963a8dbf767d8e9b4913c762a5d
SHA2569bd9d16524d77fdad6e9eff11fc2407bb7a5932150c454138617c0d685dcbd8e
SHA512d3a9e3569334fc5192ce86ad438fbc3fda1e750dfcb36cdb5a49865de6f4d1786c390c40d0f33fc9662a5aac3f5a47c15aae2e427410d11d89e7c25b19ad6633
-
Filesize
5.2MB
MD52aea464591477a67e1f221760c71aac1
SHA1ad5776d4cfbecc040fce08f6d42d3f5fbca7ae91
SHA25682190700a7527df4e03518423b6454e8a4d4cbedc1fed6f05651c09bd149de3c
SHA5129055e8846bbcb2720be943c6afb2bada10a91ee51473057860723a3b1d0d3668ed8f1929c7b70fddf1d8b6ba8d7026a9abe7f5ed375690d4928f1a3ef7990fe6
-
Filesize
5.2MB
MD574d973bcbfa66b6a1fb621289e93595b
SHA14a95a1ab45edda2e6a3da1553698cfe468ae3d24
SHA256978f8306cce4aff501b884405556482f0fc48c98e4750360e062e1bbe2db2e57
SHA5128f06a1deaba48b1d5f0e416ea373cb9e22d76649f15727a39a80bb8b03eb27031165af21344f4d55dd64c566daab6b70e834fad99c9c87a50be7da7c55902b2e
-
Filesize
5.2MB
MD566cb359df50a1478b10ab43d6b45c9e7
SHA16717a6fa72a93030ab016b39861272314d02012e
SHA2561677076035c174a6b1a17d81bee4f4f11771ee384588a89f0857063d2a8787fc
SHA5125c9920f858d23d1bb24e13493ad8696831b9db81c00e4f8167752409ad1cbf85895b4053698cf8caec8a577b782a65f7d14550e2f593469baf47ce2d30d29602
-
Filesize
5.2MB
MD58069ce77e754923ddfc0ed00cefddd40
SHA103d359b5ae667b98fa4fc1cf4c32755cd6bbc6dd
SHA256cc967f31f23c8b19e9983ca594995b6ef14d79043204b529d0ae44521dcfdb40
SHA5121221f78ea30282e3d7e3685b91bb811815b19e9766100d87692cf464fe5b895354fbf20a557e9d984d0f315adb5acd8fd051c783414dfb167572cecd9d923b47
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB