Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
11-11-2024 20:47
General
-
Target
2024-11-11_0594623017c66d26c2f97ec314990943_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0594623017c66d26c2f97ec314990943
-
SHA1
77ce3e8647350c1305a04b2749009b6b03509924
-
SHA256
700f07d9e2e4995c1960723c63cb37df7630b959c1f09f2a6ea50087186c3fc5
-
SHA512
b2d0da7082fc6764986f6eb314fab7bde54871e4d1b2e0c03c618b444e343fb05a98fa0d948021dc8770bedf364b5fec3f0c22e4ef5719322b711a28c69e5be4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_0594623017c66d26c2f97ec314990943_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_0594623017c66d26c2f97ec314990943_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fylCIBa.exeC:\Windows\System\fylCIBa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aVMJezz.exeC:\Windows\System\aVMJezz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJxcOia.exeC:\Windows\System\GJxcOia.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZhpKSCp.exeC:\Windows\System\ZhpKSCp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztxEQSK.exeC:\Windows\System\ztxEQSK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqRorwV.exeC:\Windows\System\pqRorwV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yipxuOX.exeC:\Windows\System\yipxuOX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjSlgby.exeC:\Windows\System\rjSlgby.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPmhBmf.exeC:\Windows\System\iPmhBmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gHeeJvU.exeC:\Windows\System\gHeeJvU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BnoxjEv.exeC:\Windows\System\BnoxjEv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnQEeSZ.exeC:\Windows\System\XnQEeSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CubboFm.exeC:\Windows\System\CubboFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVNGnHn.exeC:\Windows\System\NVNGnHn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FJdQzhI.exeC:\Windows\System\FJdQzhI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLDwCPA.exeC:\Windows\System\RLDwCPA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMKIfDH.exeC:\Windows\System\TMKIfDH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SOTziqW.exeC:\Windows\System\SOTziqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iipzBTq.exeC:\Windows\System\iipzBTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQlTsHI.exeC:\Windows\System\RQlTsHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kVIaCXC.exeC:\Windows\System\kVIaCXC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5dd9792d9d69c6c9345752e3fc0073a91
SHA11a0209f25da9643f479438dd8e1d8b11ce4ec46f
SHA2567126e89836a579dff5bcbe8894913bf501ec60bb7521b942a4c013c87a1a6ffc
SHA512eb422e5b10361c7aa397273d7479b624657155ea5cd3b8469822c923b81bb89d42b7c0ad3f53a4388319afb1d9d1a8b53f8592bf7ad6108c27650d6c1112f609
-
Filesize
5.2MB
MD578ac369e480645ac95ea8d2387469e40
SHA1765470246019e3fbf09a0f63f962f784121d035b
SHA25615f5bf74b3e63a8b4586b3f4c95628480bb88885e8844118e111511306556bfb
SHA5127d0f779db4f8e1236f04e8250a8915809c21588f4e9b95450b09cf1588102c6adf3b4cb72912bbf41767072976d4582a5cff10be2d964701e0770cb4379343f0
-
Filesize
5.2MB
MD530f02fa82de82ddd8c0eff998a899f04
SHA16f4878affce3ac818f0eff055ce795c85da68af3
SHA256ba0d4db3de6a83faebf3747e7d87a9598303d28e046e92046f8ba31eaa6a346e
SHA51249d02cdef2e571f2874e42faad6fa18970db49807fefa51fa5a5cb58047aac68f4563a763577fd788acb90e429616da766f4a75214b0b0c75f1d2767616b7edb
-
Filesize
5.2MB
MD52ef2f75195d639a4cf4101ca198fc3bf
SHA12d7b68b3d7aa4bc82d2d20b487fd2181ba29f8d3
SHA25679526f2407d31ac7ee37948cdcf1bfe3cbbe5debab8b5586fc24736df0a38751
SHA512f47d4da4091c921c94d40c38abebd85ec8fc922e9b6cdeee54aaaa147b9f1fb32ac4036bc38021f293d412ca22b253a0a2015202c6dc0f30a5c96cf8650325da
-
Filesize
5.2MB
MD58a2cbaa39a9bf947dda1a9f3c74c9dd9
SHA1ca7fa20bb1e44a08a69fffa87f406cf695e7eca5
SHA25642353b2a1d2c138fb8f439ceb89abe430d60fe71000ec72683bda4a42395dac7
SHA512fa476fc5c6fc61435250adf61a087545d01456e0df062d404b12c4662753959b49ad5d2577658514c86136f7b6b54f120d2dcc6c47162fd802dc2e248c0e01f3
-
Filesize
5.2MB
MD53fd08c4ec7a2092fcd4400be2f14e509
SHA1dd0b6c99da0274244283663fe7e3a705f040a9ac
SHA256d449dcb1ce62ea932771d28fc9e15a305fa06d7b8269fe93e77c0fb47f8ab56c
SHA512e96ff4b4ed14713c7e151d4c53fdae5360c93af80267ddd2207b078f37ea29cf933a11ea42e4420bbeb4a7c30db0cbbe7c0310326415903db1e49e301dd9813e
-
Filesize
5.2MB
MD55b3faabe42aed7ac2ac76d5288445129
SHA12152efa72db25ee570e8f983413cdd6b39da9869
SHA256edbe91135e92625b9db5ae1592e60c9c3f266e83252d371e00d10e714eca7fb4
SHA512dad55643e6df675e672968d91c413f36bf8fa876c2be023b201b2c5999f92d1102a80f984008fbcc944387a4661fdf5d64f4797736bf8254580db737a2c71edd
-
Filesize
5.2MB
MD5dbde27623bc8f79e4c77a880b4329931
SHA18ba152f4d0df5de343440fbd27d79980e69a0fbf
SHA256ce131461c0ff50ffede81ab48bb4c1b051010c11290f7869d278faf4826fff15
SHA51233c1d12d23845cdf98ae15d0425d7763af232e181a0ff03802cea321e0259e8958c5f36fe10b91f82b96fe46ff7de317ec8a3cc1ead60391f4c90efc2dc3af05
-
Filesize
5.2MB
MD5019cb2e6b9aab38a270ff9d5ce581260
SHA148afd65e34c247f1bc5a0cd923259c1e69c79247
SHA256ae16d2954529f2156ffed123a3f93831fe6b5e05fd801bbc30845dde2dd46530
SHA512c35507454cfadcfeca5ad77218a0de9b6f142251b1e1bc9375ab08df4bcfbe80417cca36e49ddd6e407c7d93d32fa947ed5e2f1b38631aeefa9fca9f9d4e1df2
-
Filesize
5.2MB
MD5aed3363e4bf28a909c350d737f81cf94
SHA1d6c2fb4b9c85b2734e9ad1bb9056d7a45293a4cc
SHA2560725a5179efa22bc8889d603dc6288947582a687d8f3b8a47677ceebbb31a2c2
SHA5121f1283949a42b7eaf066aa5e560437ebd182a36b9c541b0d8fc4b2977dcc497f68c566dc5eee4e007e323aa990f6fdfd60cd8b9701999308c364cb3426472730
-
Filesize
5.2MB
MD59b66fed1c98a8277e97d23115f3b2451
SHA124f29befede35ea8300189d9eae05ec9a5a2864a
SHA2561c8ce2213af70c083d6fb0989fdc6168e0761908875c22a036c7758acbb46ac8
SHA5128e386ace977313dddf7c9263fd4d27367aa9a99b4aad7b1ec4416db21e96115fd2497ca44947e61b0f98b766078f0508ed38d32795fb14c39044e0fbdbea34d0
-
Filesize
5.2MB
MD5d9ae6d2ce31fd7bdd3b283b0f717e49c
SHA1f936d3302cf1e08b9b71524b9e957623173f7a40
SHA2568bc8672420123eca883f76d6894d6aaee3712372d45cd056bb7a304e39b13691
SHA5125b6abc28646d7b976d910af1250a27a226d046013c6e8310475f502433e553818b2f0fc0766a2cae351f9102bb612acdc33f86f3c9583999c71e97a0aa626b47
-
Filesize
5.2MB
MD57d4faaaabbf0c99fce3586a8c38a6ce6
SHA1b8919e10053437e55a0abe3a5b999f4b26da0c30
SHA256a238f02bd211df200feb47af334d6ab04d243d78105f1f05d79b9857fa87d740
SHA5129699e4bdbbb869479eb4fe7e62082cf87d2936b80a8c88dc9bce79c166146bf028ceaee50c32a3df97d6b14683a6c6b3fa48dc746a329f8b16cdb74823ebff76
-
Filesize
5.2MB
MD5f0ad9471e60038135b3b5b34c070dd7c
SHA153955c9659218486780bb318124d3670abaf6f1e
SHA256296c73afec54e4a29b6525a6e63c6381674892376eb9bbcd4257ee164ab70f0d
SHA512b137eb0586bf9364fba958a18a14e3393e7635bfcd9e5a15273405f3dfe0164b0d8679ec2117c7397db4902747e8c07c3df7500baf171be5ead76fb1f171e454
-
Filesize
5.2MB
MD55ec9d4201b18c109bd4400e01ffd5771
SHA18fd5e4b07b1718d586a80b1d6a073e6152010c02
SHA2564f3c5777bddd1650592ca9e215d23009346b880f4831446498407168319f9567
SHA512c05f2bc68c76f0ab8fc077b4f9a193353523a232761422092b7058b0a6044df298a5886991bed13cd7aa8af72993e85486472944b2ed6ea01313632e010071df
-
Filesize
5.2MB
MD574010a8d13628a181bd0d9348356600c
SHA1bd2164c77c808d415b6bc6f7e6d1ab50a3a3a6ee
SHA25679c0c73b4e8e6ef17b47a0a8c12c81c6f6a2fdccea3800b5681d19741777b731
SHA512d1b7515cbdcaf623074f02541e9cd9b9ce50aa308c760fc56674c55f3754a9bc678943f47d64dc8b4d831e28021425e2ec19fe58dae2668d4822e9122e6f77ed
-
Filesize
5.2MB
MD5f647a8b106b430d37b214cbd2ffdbcc4
SHA124981b67d4c1b6118339c47f151e4a2cbf24fec8
SHA256fdd148463da43f55038919e3c267fbb2327f7007eaa7ec854bf75c161923a611
SHA5129f660fd3b632b042b651e246eee429d8ad52f0a49840c14e0e1e603e77390811a94deaecda9e6dae3429c32f27a4bf27019ae1f57afa6cf1e763a64f7b2b9659
-
Filesize
5.2MB
MD5bc825ede1b14405044b56209e8e427ba
SHA17234c6146dbbbb4047d9f8232b7ec80b54b9ffcb
SHA256a7169e8cc288ca396ddb1ad3056dbeeee9608699ae3a7ba137933d9330de54ad
SHA512828158b837992fff9c83dd0b181c11de6debd22d53c410e018156d498e84a68759b3f414f61a5a665e25cab727aefdfc3b5379b2d32b08e2d0d445bf073c2d67
-
Filesize
5.2MB
MD5dc6d3076257e44b1a7eaa4fe51d07db3
SHA183717a0f9a3098c4c94cab2676bbb24f456bfd7f
SHA2569b81e59a889c64d143972b3e9d2efaeb0daf5bdfca6f53e488ad6d4455536478
SHA512fcadc4bc1386880e32c975c821bcf0a39a9bbfb73b72ecdba29e1af0f2d1bb3bf80b1aa3c77f5e12787049e1f8f4984e67f7ea129f89e781e2e61bae8f315f40
-
Filesize
5.2MB
MD5f2a68b0b6176154f0d1468e47802d50f
SHA165b79e41f834bb7f83c8fc941fbd0f475f74b57f
SHA25679335d47db79bc78d080c5ab09f779e144538afc6e94140d3011e3789eb06e43
SHA5121c2b68eb5ce2f02e6b8137c623e0c75613dfb28e06a28d16f73e9e70d4b550ef1bbfc4484108b47545aa3e188cfa699dac9a8332919d05dc82b8c2a8b3b446ec
-
Filesize
5.2MB
MD5e7b7b02a8041984274fd471c9cd89609
SHA1d2f07366509818bf2ad2948a12187ab9a6a6c475
SHA256b1d1929adec59d017ceee52566f93853c703729a5db0523d4eb10df0fe80b04d
SHA51268d5a239b6abb6c2417d01e8d47d0ba04f51d6514727e618e840e086e32b676a4a7553637b740ad37bebb52d8cbb6a272c33b9868890613f0600aa774206b452
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB