Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 20:55
General
-
Target
2024-11-11_2120bafe4f7de928a213d07c6b3eec9b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2120bafe4f7de928a213d07c6b3eec9b
-
SHA1
f142c107603035aa5f8e40acea8d6f46b0690f63
-
SHA256
f0047782dea2bf970af1fb09bd346ba26c68797a7949f4a4b8f90155674f1c92
-
SHA512
64c6e7c4dd636632c9554587f16655558637562b7f5dcaf373d5d0b85bf95612c909e9ca0cba56c0251f602d6b16b2dbce0fd011ab7512c2c87c4b90d2f07ffb
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_2120bafe4f7de928a213d07c6b3eec9b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_2120bafe4f7de928a213d07c6b3eec9b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gYiWrxJ.exeC:\Windows\System\gYiWrxJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dGIxXkx.exeC:\Windows\System\dGIxXkx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEKZNjA.exeC:\Windows\System\rEKZNjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJhYhCc.exeC:\Windows\System\VJhYhCc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vMqAcqr.exeC:\Windows\System\vMqAcqr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PtUXqru.exeC:\Windows\System\PtUXqru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mLXPtvM.exeC:\Windows\System\mLXPtvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTMkLlR.exeC:\Windows\System\bTMkLlR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RHsqtiG.exeC:\Windows\System\RHsqtiG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbWHLMv.exeC:\Windows\System\bbWHLMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuzHUTw.exeC:\Windows\System\RuzHUTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfMFrJG.exeC:\Windows\System\NfMFrJG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcVyPZq.exeC:\Windows\System\qcVyPZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYPYaGU.exeC:\Windows\System\OYPYaGU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ScYXANK.exeC:\Windows\System\ScYXANK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FXKbyCg.exeC:\Windows\System\FXKbyCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ILoyJkR.exeC:\Windows\System\ILoyJkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EyCdfCt.exeC:\Windows\System\EyCdfCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CnKaMHM.exeC:\Windows\System\CnKaMHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBcIkzi.exeC:\Windows\System\DBcIkzi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFYmHOg.exeC:\Windows\System\vFYmHOg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cb08519bf5bbe5dcc6fc057a57fbe4fd
SHA1be69012e29a47122ec2a9c0b62ca59a9a667adc0
SHA256fece08e2ac92b344aa8add0abf3a87ab8b32551a4a8b567c8c16cd29bb0b5230
SHA512dd12e004255763c0c38c65e7cf8270642b79e55aeab16e4b3d96f903262c94a9adbf46bb76bbaec1301dce61c6b1b501db63c06fbe9c60e315e8c314f743e20d
-
Filesize
5.2MB
MD53527ec94ddee0676e4107aae06dcdee1
SHA1ce4abd1fe9718516cb80526d025de26eb475e64c
SHA256a555a72cd9217b7f65c955653373a0df380b802972b807b4ae348f25c36b5db7
SHA512dbd21626a70e1c9e028141cafc161f0cbc591380a8a0b4517a8bd6f3d6c295fe6e684757b89951c6deff962304942d5db83ed24aefaf4b25d2c5e860a10bb19a
-
Filesize
5.2MB
MD59c4afb1ebc1c62a2bfdfb7275586af29
SHA15782e1272a269b290da892f6666d5b55f0699f7e
SHA25653f9349db7d24fa4cec618fee4896d458c8e70c1814e37ff228e17d02e1ef399
SHA512b25186ee013b774784d9e6cf297952501e8c92aa717dc67101f1370310696bbe915adaea1f6cab6fb4b2a824c7b6bdf4e3ee6f95676a03df365ccd2896abded7
-
Filesize
5.2MB
MD5d418fcd81fa5f12d1c2bbcff436e0b3a
SHA1373889d3d899b9ffab6556a71c30ad55723d2380
SHA2566609d0229c0223ad0d6034c9dd34314f1ce1a4f9db0a18e806a2a958027d3f48
SHA512ed29981cdd11acc7b5c94570b8a0b4c0b16ae6e07047ad99888fa0355a206591c096d026ab4c638b1f7455fd32d244caa3ddccd8c4e1a9c037042772cb3f834e
-
Filesize
5.2MB
MD56b1f04cd1a73c9a7f1823db14718ec17
SHA177bf614c59b2c3e98307d5e6e362f02dd705c8a4
SHA2569de8cdb70b6f7e523d0f37776dbff131b8c92d69a2d1137c2f8e79b8acd0024d
SHA51262d869f6e0159440818e3313389831d0b5e5a13592e4d5a74f83f3160f3dc156478a5d32db5943b14928de0c878f7e492646af46c96d43dc29eea148e926a788
-
Filesize
5.2MB
MD5cd08eb7c9202f77c9fa4b0cfabffad15
SHA1e32b6334296ec4beda175620a3052cb926f325bc
SHA256dc642dcdc08aa046c1890ab62ed02fcd9da3fda065bc48700bd1c634ce346308
SHA512d4da4a8ae4ea25c95a0985b5540497dd63e113419aea1496d5cb4503163e9aa6157acb4d105c7cd42aa8d9afafbbf4cbd6d2d41ed90753c0ecdb551ea75d4b0e
-
Filesize
5.2MB
MD53a273ba945e64e59cbdeea2ae1ac714a
SHA1d109381b5bf95b38042fc309a00045bc1fbc308d
SHA2565b39a7b48352708f269b47e39961db316905d8d3c0f45b075b6a6d1af64043ae
SHA5126e3b3041dd21f549fd4a82680775d98815deaf13144670ccc62f2ea163bc6498178c9842f8d26f963f60be3fe6faaa41314dcb5251a7ef80bbbf892e90a23cb5
-
Filesize
5.2MB
MD5667489c24f4916d9335c50b9e467d052
SHA1204d5f14c5ceb5491053bbfd9f319a16f1b337dd
SHA2568bdf206d4e1ff413a832a842f7070d2a91a6c39e2294869c99d4146fc4449ff0
SHA51254f6e98c069e84bf41bed534af7bae0c9903e3e6dd0c960ed0e45594faacf2eb21f13599d90622775640fd362cac74e3ee182717285a4af42763fdec9cec373e
-
Filesize
5.2MB
MD525d425b6f9ab1273a04bd6dd73d33774
SHA1229a6ee60260a43b531bfdc50333abf21b58514c
SHA256d0cc5392bc89d8e0111b4fd708bb1d95ddef8785d7b95d06335ba1fe519b0a63
SHA5123ba45950940ada27fe0d0dec27eef6e343e6bfb6864f868b0eeb6042c2e5d20e6b37f2a1b784f98a587384abf52b050a5eff0dc6123beec055c8b1482c8ef83d
-
Filesize
5.2MB
MD50ee59bfb537cdbf287fd7d1262dd2d35
SHA1c140950303c1bd5a3c98a3d99ebd9cdb77cd2949
SHA256f0a4289609064f1af53e017446372b91336301657b1caa866b90e33a2386428b
SHA5124b01d2f62090fded5bca513943b3294f24eedd54cdb7932460d6ebcc3021e83eb64da30d26ffa3a5ce188243298980b74a70e60ab98f1e44f27c9187e6ddcc80
-
Filesize
5.2MB
MD570180da9aa495d0094669703d5ca987d
SHA14e831a48b5dc1d3ef15845077d565accd43c81e0
SHA256e93640e34b8d17b8381d87ad0845cfcaa5572f4ae729d80d2a8d6424b95d3608
SHA5129bcc8dfdefcedb35566ccbbac36f14e194b90a3a5d56b3dec1f2b11abac8cfb68b677033d37890ee0efd09b9a69413af2fbca33f50e27cff1d992204107f8ba2
-
Filesize
5.2MB
MD5d13d461b7c55af6dd5789e06aa979813
SHA19212e1beb06151c405293ac267be4c7d1eaf8146
SHA2562ba88f7416f44c674b19328a9e7f71a670552a70b401f9981be63f32b949583f
SHA512e58ded8582f63bc41c006bb991645226937c43e42a057f0abfb9d933a447112be34ae5f70ffab028b622268c263e5bb155b27f26d129239faa7dcc329eab0d41
-
Filesize
5.2MB
MD5ebcd3a7c19d0c08a54ac0aa824b95029
SHA1d2b083fc63c4669209de09dbcfe9eecee2ffa8f5
SHA256d6b1be2512cec52a29514b5d4f6dcb02d1a7672995393b6fc738a7d2be5d031c
SHA5124568ec271abc6967d316fb8bcf5a6fdc5904b445ca3bba3ca08c41cdf1da0afc19b734b8f4c8de83136f850f1a4db5eb1536c281bee14c7e014c6f211c1c6a89
-
Filesize
5.2MB
MD59daa7592f6149bc7d7761554c783a860
SHA1e22b6026b339d1ea83a15b5f75d0c7206a3e2bc1
SHA256e0de0a01888a5bab7f8718270ee0ac25a28220aea179c8a3881bfefd4c45b84d
SHA512fd9abcf64937a301ae172a667c9a1f3dea83c6847f7448e0add3a6f60aa497eca4588835bb31b4a161f2c0a6b27046344bd1cad9bc4710b129cc4821f0dab3fe
-
Filesize
5.2MB
MD5be0f6ee433dae1887a924ad582828ffb
SHA1edb7a62d56378a757f74908e5a6a7447b5f5c5a2
SHA25639281a96e0a05064761209e384eec76e3e2b9557bea054ef04e00ccb4ee91af5
SHA512649df8ec92f3f488a17d86f500cf05cc8904fbe02e104771879ca73cf15753670503cb8aa88a46af6d9457e1fc951200b40aa06fe6869e09ce003755a18addba
-
Filesize
5.2MB
MD5feb3af972df96e25dc4b79ba9d4253ac
SHA1911398f0ee6aa6eed4a565298ecb5d5bf3c9df28
SHA25647c660b020cdee98894e8517d9a06859c529d2e3025a880e94926191c245804d
SHA5121f7d2cc285073fcf60706ca83cfb93508b4cf3e3f3173d48d3c403a635c482a2c2d2e95017456b0a4c7d8ed4d7ef9e3ebc479ebca0f21675a8f6c52be135cfe8
-
Filesize
5.2MB
MD51b78e8b16045ab94664131d3bb14d45f
SHA1aa125cb98f1596136b0bc10c0424ad551e5c087a
SHA25659e855f4d5fcc6bb012a00d930c5d444ec089d54e32e0982633e3afc08e0b52a
SHA512ab83d21c87f5e39cb7f9f4e74c5187b6478dfc47227eb4e3bae023892d87342803ca8e62750b4401bf3d378ecd43dac2fd5df322f4c09a5e4c19222272c133bb
-
Filesize
5.2MB
MD5271351ed6c362f047fa83a217bee122e
SHA1d77e641180f94641338ed952e7501c649bfaf468
SHA256a82d00bda18184e61a9e100daaf203065b35fb23b3f941a32074db1da386c0a7
SHA512850804cad3fe4224af6db69d1bbc54fa431ca73405e51f9026705a488d6655b1a41f1332d1a636efbacdfbb00b64f8c5bf034f8d7f020bb157d56c1f15321400
-
Filesize
5.2MB
MD53e6ffe842f0b9aee610caba12e408c1b
SHA1d4f93232af2e38da2088dd7d1b6ff755fd9b7f67
SHA2563da52f0857877db65c3040a19cde3a839c9acc776f4632b5de8080829c84a186
SHA512caf2e556bdd6ad7396c21ba60f5e95b17b9d0854e49d8e12bbe986d77f7f53acf5157d429fea07e0562e7fa5cc2606805435d507e4d78d7f9be9b06ef43f8775
-
Filesize
5.2MB
MD5190a6ce02109ca8732106e19da4e6c68
SHA190f41238692ba0889ca1fcb345944c8e11bc98f6
SHA2564f589b09a5e15c056dd0b6607e1158a0a9c7c7111af116286a39f519d3cc5ac4
SHA512606dc6b7d422bda6d539aba3027f9feac63662e663daccbef505fc3bcf0f14c45ecd42a0a190a54dab1ba4dcfd525edbc62b472ba47a153dc47eddae2e4f0cdd
-
Filesize
5.2MB
MD5d276779dbac356cf1c7261153bf51578
SHA1479f36bfc32e59fd9c49a4d46f0644e22743a665
SHA25605f42ef9caeaf2adbcda13e93898d3942fda1a9d138b8f22acd533fd72bb4ce9
SHA51297f81311d60307ca05f95cbd7bfc8042d2af3c708fea1c4309c0068687adc33d3aa9720451dcc2488c851d17976b9c57c4a9610df34da4a9d5f1cdf81464dc65
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB