Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11-11-2024 21:01
General
-
Target
2024-11-11_4775b52861c72d4364dbaf393d2d33d6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4775b52861c72d4364dbaf393d2d33d6
-
SHA1
c43da631e6c63eb81af4fa4f2168ec50dd7dd03e
-
SHA256
cb3249c1e4ae6229f184b6b4cb6f0a49c2a3db5f54a10a71aaa0bbd86b7f6753
-
SHA512
62695e8a49920bd81f70849882e94c943324f04548d23bbabb5168fb099e1629cdf9959aff0de229709211a91f8022c2bdd3d830ad6761d007bb127f77a4fc66
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_4775b52861c72d4364dbaf393d2d33d6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_4775b52861c72d4364dbaf393d2d33d6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hoLQsps.exeC:\Windows\System\hoLQsps.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wlmpgUW.exeC:\Windows\System\wlmpgUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vqcXbaN.exeC:\Windows\System\vqcXbaN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRUeBAd.exeC:\Windows\System\uRUeBAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMGLJOy.exeC:\Windows\System\tMGLJOy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ceOyKjZ.exeC:\Windows\System\ceOyKjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OHJjvUg.exeC:\Windows\System\OHJjvUg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VnuysIZ.exeC:\Windows\System\VnuysIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EpLvyjb.exeC:\Windows\System\EpLvyjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgLKruu.exeC:\Windows\System\rgLKruu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iiMYwOV.exeC:\Windows\System\iiMYwOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XXofHAd.exeC:\Windows\System\XXofHAd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OMEfyNh.exeC:\Windows\System\OMEfyNh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HuvPZYZ.exeC:\Windows\System\HuvPZYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFKATMo.exeC:\Windows\System\sFKATMo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yGGhwQU.exeC:\Windows\System\yGGhwQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Xdmsfgq.exeC:\Windows\System\Xdmsfgq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQqLBiy.exeC:\Windows\System\aQqLBiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UwoPUTg.exeC:\Windows\System\UwoPUTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\blXztLy.exeC:\Windows\System\blXztLy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bJOGtcl.exeC:\Windows\System\bJOGtcl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD579f22ad5376f1d5a2b762201a8a364ca
SHA1e55a078fbcad6b6b9c31632ead0a74ed625ff6dc
SHA2569d4d8d7d05547d21892a7a8b8a288de292a62dd95d78606b0938afd1aa48a2f2
SHA51247fc28f695562a2dac8a1ea070fb42a568240272c7c4663e66eb04ba35666fc333e03ab175c0e5cfec1c93f60e5716ea4bdcb359ed93c2e83264418e70ee1409
-
Filesize
5.2MB
MD5d08a07f6caa35456dea77133cc1b7c5d
SHA1651b89ec91ea4b2c562740938e5392bb86ba0be7
SHA2561a3bdd3476406b41e54460c9d6d278c1a023bcb1a5d89431fd15df66907ce3e9
SHA512263a7e592ed1dd231ee61a4a94d362119898f43265186a94e723a7e3c2d188748ea10617e7b3ef0ed88f024cea98b4345fe9f2d6148e52aa89fc27bf855dbcd4
-
Filesize
5.2MB
MD510518b4f54226273a60bdef8ba89f999
SHA1ce43dddcee1d9499256ad4914a6a96ed94338fdc
SHA2560d4e3a82d388ab1a8a89e0dbce1e722ee8e7056d4d76560cca22dc4b2c37c39d
SHA51250bd4f3614c73209aa0e619bd4aef16f7ae78f3a880c80d2fd4d4b759a297c3e69dc1c0a8a8faa8a88a643be1f61b809ad5436fa9924e58a02e701694e50a4e4
-
Filesize
5.2MB
MD549fde17dc2e1ea59865f190b9565cdb8
SHA11a0da8ecfba4c3f348c82d21b206e4bb039fc3ad
SHA256500bf468d8d54af5f84e01931e7ee989457fb65d3a2cd76ea809d0544c6dd312
SHA5128180ebbc5f3e57d6e903c86030b238dff19f21ace4ada2b07a987c9235c04928214ba297180c08bd16c3c5913799d83e72e37262d869091765af7a0d28410b58
-
Filesize
5.2MB
MD5d4e5fbf55a317cdc3cb5b02d75810e06
SHA138689a3c5453fd0eaa23b4db6ab9e0b230e9753a
SHA256f84c52cadd24138d8f4097925c8595c2fede79c790fc109350b8b973a9565a16
SHA5128adea275c6adaea082313e12383128625035698bac73ba94e6dd11377b9c0e53f09d20610f1fb1f98a0de9e92f09c46b48525a5beba1f9e1c43fd10d74e34be9
-
Filesize
5.2MB
MD5b58a5dca8f51ff4ed0455dac121ac079
SHA1d1af058f7776b09afcc8aff4b7a40ed09dac454c
SHA25623069442f64b5233bfd41d96888f0c64de30ffac88053f4c7a193e9182973636
SHA5126161d15b0e1e77e000ecdfff39c494b3bcdcf0acf40a2578ac74351020906bf3cf70b7f658956e5f2bff3beaaa4a0f6b78ded66e4aed7e2f6fff96f9d2cb61ef
-
Filesize
5.2MB
MD5dc8a33a8c65c4ca700fc1bd6400422aa
SHA1f3b2939cf41a7e92b74f12599e99c63832b373e3
SHA256229f03d880de34b50bce12521c22f0dc37d751a7f99ddbc471c91be994777be4
SHA512ada75888b8d11365ffc37d721246c61460bb72ed444a0ba0a9bffcb5a7f9b1cd0aa525070ca6cbaebb15a8661133482289aeccdf0f369a7e2f0852dd4040ad29
-
Filesize
5.2MB
MD56fb2c7c0dcac6481a9fd02ae8eabe5c6
SHA15845e7678629546a8e9e345bfbabde247f976be8
SHA256c6cab62eaad2fa374323bc4c951f0cda68d26a98b87210d964a0f823f8d62824
SHA5121a61cad502551ed50ccdff5cea6e9435b71dcd21e9665439c2fa09d6f39d41eddbad7c07c2e58d4eac10999c8817dc53effc417cede29b887c852b368f529080
-
Filesize
5.2MB
MD578c6ea170d135469296f09c620a51e8c
SHA18956bba4c76d91783625c0b5c433a13057efa119
SHA25664acb8eebb38960ff7de7df3df4d63f6814fb75bf66adb79f530c43ed00f71f4
SHA512b3025b1cc9cd563703b5c3e2f75ecb4e44f9b7d2dfb738453b93d3c2683949ebf18c02d7eb9762744b355e7ef40a869fd2c040fc0b86667cfe23eb840cba38c2
-
Filesize
5.2MB
MD5a54ad106cbe0e49b081174ba97ba6e67
SHA1d77486da2d119795fed815a4ab0a6171ebad6bac
SHA25683c400a4b1db796f2160d57b2090a65002a5b5984a08493fc86a25afd6b5d148
SHA5129857b02f4570645efd008943324b19ec98542d2ce71fe976949a341ed8a9e672b11c80001aa33e55d715100bc16c9a72ff225d9d4be3bc4419aafd8dde72496a
-
Filesize
5.2MB
MD5f4c2ad692a06f770a029c9139ed4fc4b
SHA18f2b518cc4627d5ece4af7f165852670e2e3110d
SHA256d6aa5dd43d0fa1c60e7075b316d1a26c79764bdd57f97e3c736cc6b8f50c814c
SHA5120ee5345be8738475a58d78280c27051778b4e162283f2a2710d9a592d3de949df6865543fda0ba99bae4e3cb9ea716bba1d864f0b1715aee0539a4302bf15135
-
Filesize
5.2MB
MD56afb6862e2c9918b88963c0f4cf9b2ca
SHA19aaa7c40c8186c8e7d7ac843d93f35daac85c177
SHA256943df3a9e9ae1c3612bb20e50608d3dc9434fca3dbdf8a7bb1470cd1a87dbcfd
SHA51297048a05cf846c9b367594258aaa9e491881d6692fb52487bb771e2f7b84b3ec27ff24f2e35178d4e82e0e008c383b26c91548c3abed836c3cb30f5af5fdeb6c
-
Filesize
5.2MB
MD50b45fc4787c499f849add4ed789dcf91
SHA13e24c44d6834d3566c64d3dc69efc8530cb09de7
SHA2560b18b8dde7fbd21b0144f968595dac56adc65f4e9f2c17f565a433bb0f593d30
SHA512b61f9a78d652d858fff80e9346efffa0d74ad4548a7a79c1da3dd372e847b833aad08e33710d614dfe985a5ec887dc5a3a60322edca829fff18d413c4385a4e0
-
Filesize
5.2MB
MD57bee13303ac3db1dfcb8bfb350249def
SHA1f1604c56f0759159fd16c23e28f735416e91d27d
SHA2568f17f0d9f18733e3da1a70b842b2aab30b9c2c522672b7ab2c90b5cbf822e201
SHA512bc6d1497ecbe9b95bcb422a42f8dc821ef3b8d3b2dcec471aa50aaed39424840dee0735ee53dd6622504824ff408788dd1d93d04df628d79a49f86b75f39ab30
-
Filesize
5.2MB
MD59a7314041d2a82a9bbf6ff5d289b9037
SHA139053f7060fcd73145025ffd2ff5263cd093f602
SHA2561d41617dc3c08bbc69a167c45a043056af9a81bd86002db8b9f96c36bb7900f4
SHA5123ab0bcbb9324970bed19ae264d8f2d143514221eb156be0b8aea911c3653d07c9893e3c75023fc8bc67ac98f8c3999f66756c73aaebfe6086bfab797022a9112
-
Filesize
5.2MB
MD54c11074bcf02192d2c2f46bf607b025c
SHA137583238d0983edd6c4712c40c2287c38b08bc45
SHA256a36f94314a46616fffeda70eeb270f4bad360ff2e05d63387a29009733d5aaae
SHA512f14eaab714e84099f25b295bb0cb04fb005f0d2a3a123f7600f97b2da1f04856383b439a70432d5e1c992db6d22e54e9c2f168bc6f58b4415dc54a907da7239b
-
Filesize
5.2MB
MD52d28aae0ee08572ba611bcb3e5296a8f
SHA137996a02e508067f0402a45e595fbe2257284de7
SHA256509dc4a8b5720ac2826d4167a14dbd554de6533ff0d3ef470e10156ac39ebf8c
SHA5128f607b9979ecfbdc0cad3147fc0638794e2db6181d7edbcf07139de2ee44951d6e35bc06ce316b5ec8e2567551be084dba569299ec4271d819ea8b1747be88bb
-
Filesize
5.2MB
MD5b6a24140bfbdcf2e91216ed83e26955b
SHA1b580c7385ee848803aa61eb813b3b213657b1610
SHA256584f365e5b0fdc5a9fc76538f063a80997837fc737550a6e328d943e945a0ad0
SHA51262260ce80bd21f4e7cd978f2c8d7fda2a6360fbdee6818b7638682d41ca56d1bac135ca5c6538c8b08eff469f4851b7626fb7edb98c51d113e93b457af1d36d5
-
Filesize
5.2MB
MD575efe4d41f568befdde66c3b60be5383
SHA17ee067cee1441aa0367017d7506712d3c1e8373a
SHA25640f794e3d3fa00a79c3b9406e15f2891c3a4ff60b5d033eba39c9ff987c4b72f
SHA512ae408e8024e0fc1b3e5bfa6d5adabd816ffcacb0803372e098e2f643d216678b876f072cf1090687511db42a5ad978eecc378a8ee9a7c54c0fc8d02d118aef72
-
Filesize
5.2MB
MD590f18a6b688510171e9011b85bb37457
SHA186640b0d1b69804c793f5b6af77c2238911c10f3
SHA256c6cc4bc8f2dec3742a229828b956505607f7a9ab0769afc1ba65b23eee40ec8d
SHA512a9bc71456e06778e78a6b300720d57ab3b03bcc9d45ce7058c97006eb51adab80162f7b471e3158e762c5b077ebe0bc5056d453540f385fbdb034c9f74cd1dc4
-
Filesize
5.2MB
MD5c0693ab2223dcb677e254035c9c274af
SHA1de0148f8eb04f581bb0517f7c55c8d294da964c5
SHA2566e8b934e0982b004959ab58340212253da7311f8174711869335f88ced29d532
SHA512dce5989fb4ff5845262908f7a3198d2f3a09b5946823697ab10bc88672bcffbdfc1e23659d7c1805dfd88a68b0064c8aef957239d655edd5e7dbd626ecd5b324
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB