Analysis
-
max time kernel
140s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:05
General
-
Target
2024-11-11_61dae3a6728ea17f7d7190be065003ce_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
61dae3a6728ea17f7d7190be065003ce
-
SHA1
7f5fdc45e56635c96ef469b3f4d82068bd4f0f9d
-
SHA256
7913843f0bbdcb3082969d1ac2a189b5451446795c88bac66b84172ddf548fa7
-
SHA512
d85f61e84f06cdb1b026441cf26a9df527e75efcd672132fa3d2378644f4e0e3f9679b38c6f56c8821d6fc3e178ce402354048a9226f0e054485d0009732e0fd
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUy
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_61dae3a6728ea17f7d7190be065003ce_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_61dae3a6728ea17f7d7190be065003ce_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XILGnpD.exeC:\Windows\System\XILGnpD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WcaBWLd.exeC:\Windows\System\WcaBWLd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VrTKfvN.exeC:\Windows\System\VrTKfvN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jbEYCQG.exeC:\Windows\System\jbEYCQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpMvHPx.exeC:\Windows\System\rpMvHPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IScXIKc.exeC:\Windows\System\IScXIKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbMZSxd.exeC:\Windows\System\EbMZSxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbBKiyJ.exeC:\Windows\System\bbBKiyJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ytIcXur.exeC:\Windows\System\ytIcXur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xkIRVqZ.exeC:\Windows\System\xkIRVqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XUaPxel.exeC:\Windows\System\XUaPxel.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sAdQJEP.exeC:\Windows\System\sAdQJEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pETDZGr.exeC:\Windows\System\pETDZGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JpyKwqv.exeC:\Windows\System\JpyKwqv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OhFOvTx.exeC:\Windows\System\OhFOvTx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RiWkqMO.exeC:\Windows\System\RiWkqMO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtyadcC.exeC:\Windows\System\YtyadcC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bxxTbAl.exeC:\Windows\System\bxxTbAl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKcJQFK.exeC:\Windows\System\tKcJQFK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRvIiNb.exeC:\Windows\System\eRvIiNb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GqgdHyT.exeC:\Windows\System\GqgdHyT.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD520093baa85da549600b7387c66cb2411
SHA19c5e7daf12ed9511709fd038041ed2abf50551fd
SHA2569d710d6a8a7be34d8230c3f31ef3f815ba44449b74c2399658e4ef06cb3d3759
SHA512a9b69e68033dc79a75f650ba48d3732ab77bc4a236711a75a3b59992219e6b4e4ff5101c88494abea5c34e8ddea26fc7ca2f6a78bea9a000c6a7e71cb6850352
-
Filesize
5.2MB
MD56fd94f24b93b87c9f8c6b91761b432ed
SHA1261897023a56b7c4130dec6bf5315597fa2d2cf3
SHA256a659eaecf06e9db773a1e8c8136674520ef661abbc91b6b671296e1d171a05fd
SHA51228c84de4f3cc7a17bc99cd57765b25c6cd545c34f30095abc684aebb6584eb012e3553e166a287a2e58f612cba1731bc462f720197ed6f6a4e049421dd61995a
-
Filesize
5.2MB
MD5437df7d6c7d9485458bc64c12a2d6d93
SHA18855a85759d60ba08138889a1dde400ead84fa62
SHA2562e232090b98d0596f324e281d623bda49b7c611918bb82b29cbd0bf5377b5d28
SHA5124f87b709cdc0b64d59e5e51d8ec3a3851e1e540ca6a727b70949f013db6626f5a66eebc0b1748a44ce0a532b8506c7bc6d8a92c488e905a5688058cd561e7e0a
-
Filesize
5.2MB
MD5914964a7b6f11bbc98fb99d9c1cddeb0
SHA19281c37b024d7b43d7d943666f0b11cdd2651868
SHA256edd46bf6687b540c7d2c21e4ddb57b6893eb75435e4402da864b840bbc8f838c
SHA512f8079e5f036721be586c79724da5184a029f524d9d15db24d01c4ed315cddb57c9e371625929d68862b1c4bcd94c7947e798ee6b6ea99cc64872709885598755
-
Filesize
5.2MB
MD55e40be0cd303fa9c9aa0cd5aac172dfe
SHA18b139f9e344420c0ffe05c539a568b79da1b4e0f
SHA2568e022645c6497b5153b5426093b893163ef55144c51ee4fdd2048d4f8db42f6a
SHA512995afb0c68330aaad9b91d69764cd0b43ad6f63330b6feeaca1b158eed25dbf06051d99d45dcf64f1b1e2c7ec19ab35886e3cd291e175859a6ca250c117b9599
-
Filesize
5.2MB
MD5dee02ccb9300d752878c14a63a44e24b
SHA10f19bd5caa730f536ded86c8ec2cb9677664d201
SHA256bcab076856f234aa6b60ea09f22bc027cf8d14fa6f99c86fed4b50fc4bc66875
SHA512b3b9331a0ddcf517df11d2d74f9f8371ef644f85966f8f76a278693e152596a1b358642c7f8c24bc861b5700100dc6b59ae943eef5d03b39677027d6a34ea925
-
Filesize
5.2MB
MD57cf2cbf6df8ddb4479dde5c82529e63d
SHA1d2283027ffb9449284006c3a809dabe342e54f33
SHA25693d38e4690a3910b9afb84b68ae421e58d5c6610704a513477b96d55a1c7cc6d
SHA5123fac41d226193ee3de047cc22a81197bc643b07a4f198f54befd8a0ea11e1318fb5ced1fe4ddbebced3a1b5e34a10961a13ceb72401f763752fc234723d2bb6d
-
Filesize
5.2MB
MD504f74f5bf0a1635c55ef82f89c713eb9
SHA1394abcd9c494714c4f02669590db9531b454666e
SHA256a92e10927c02ea922d3c72de5b21e226e24ff5813b04075a17080c05003c4b94
SHA5124383e6f5b63e4b0af23011eadc41550f55a0667952f4c20403bd648e52ed1e7d7f983afa83c728aa278e7e9332421a1c03bc8d778648ac7434d93541c16a33d5
-
Filesize
5.2MB
MD52a21b904fd0d69bd2480b4f80eda5357
SHA1c87ed3a561c92cc9708e91a15a1ebdf12e3fc120
SHA256347e87e0a491d51d1f544801e428dbbc39b4a19d607ebd0194578d5cd97b16a7
SHA51220e7cb47bb57bdab0fc09319f015d8f436b5891916f288358759d60837978f9edff053b1cb689c363519507fb3f07801fe9ca54cb15d72649808d02f04d135fb
-
Filesize
5.2MB
MD51ebee1911a1fa0871af2b819ae69600e
SHA108ead55c228290939f4e6403dfb75e345002d22e
SHA256e1700d090e890716521ea353e9614ad4dafd433ac582bfb333f18631925c7635
SHA51273b52da375b00af5f8f2ae31424fd07dca4995099de76c303958862a70b508cd83cefe5d3873a9e253e8a6d666bc8be7669b2f8551def97af1f5383e16b516bc
-
Filesize
5.2MB
MD50aeb62b04d1fef59e1e3cc1549b24000
SHA146c7f331bfe8aa220d781b02746a24fbf640b479
SHA25629fa476d5ed66240e92534d0c5012767da817bfbedc75fa11880dc313c6e74ff
SHA5128349a94e2c10e79e703000ace410fb52f548b17b7b4faf1957856f1a552c9abee5be81d2d827da92eeb43bf35b5917af998d97bcc071e1b1fca6508edff4cb89
-
Filesize
5.2MB
MD59317901928016c22af400a98059de4cd
SHA195976d90f5e8a5d1d6f9fc8c94ce4ac117b30f57
SHA256ac938621233b86cd17d4b1166d10870c94c00525c2525863970d1bbda4c11449
SHA512dfcac33257747edb8e8f630cbbe50d21299ed0efd31e8439745391ed1d06d0148db0482cbf9334bf2a7ca85cacc4ad3660603240c1150fa2a81ae05036d5618e
-
Filesize
5.2MB
MD5b286a7ddb1781e8b404e61af604f0592
SHA15d872bf4f2a06c664a8b1d3658c75ff9bb7a8625
SHA2560a948156498c41cc3fe9515ace43b1296e89dc7290f95c89c24b0f7da77ac77a
SHA512fe6ef38471456dff1e8394763deeccf92794dceb5a43949f5ad9d16d631d4b5e0ae37f6daaf51814a5c5c595c984d030c7474ad6828b1a0faf985625d45cb347
-
Filesize
5.2MB
MD565236c3de136d80cef183510e9ce933a
SHA138862dfc195cdd34c7a5f69f7abbea01a6ddb970
SHA256297bbde8796938c1161f1631ab9238202cb9c9b90141368abe4ee0ddf751d307
SHA512a1d48505d1af94dcf0eabe80febbeadc6a8127f0ecc7807852a0b9a8e7cb49f2e125f4d9b9825c5604cf9d46f9dea3f51fb46d4f2fb602b9aef53200d3197b4c
-
Filesize
5.2MB
MD56b1568a5d674943286146d85d87246e2
SHA1e35bee95b1d54cb2d70a3eb15986cab8d09ac805
SHA2560ec90d736f098581d8e22e5ce0115bfd272d022f91d86f8a583ae212bbebea3b
SHA5120abdf27b0f95a8a5a84a56884917ed4a74812565a536065faf71bfec966c02db2d89df5ddd2aac322fc1b56dc358e3c8df5b5cb082b4c298ae63e0b7a73a6c4d
-
Filesize
5.2MB
MD51fd0a86f96dd544b9dc9bc1e3c326c35
SHA18632ec84b42eedae5028f483cbac785cdf8ad739
SHA2561f58d35bace513d145df771f24d53d547e7cdd4d04975c2eb674803de4aa78b1
SHA5126a3daf72231cef1c96282b27dfd0dcbefc5b886f92ef581df4bf5b1ea1448afc4b41455b8e0872fcb99f9ef380607e932388a010b6ffc1bcee3f090e78ed9b68
-
Filesize
5.2MB
MD50ec4bf56c69467df7b8cd20d5623b1fe
SHA119c33af3ec4c8fe803af309353dce3b827420a79
SHA256f8ccf834bdcc29f3496aa8e839802fa53361ccd593eabbb7fadcf5030401bbef
SHA5122847ea8726045ca647f05fa72eef2b03ad0099bd8501e6e9da889423641c8459e8713f212d25978b96e76fe4a42389fa477562a26d7cd1739818f87e0928cb8b
-
Filesize
5.2MB
MD5b389f8b741ac50f323cbe3b9576e5ee0
SHA11c140c3190abb561647a9546767a995e1ba8761b
SHA2563c844700732ed026c78ba42e833b1a54f80757f9dccd26434f1a9894be47a24e
SHA51231b355180660c3aef780e1e5820e3f2bf132caad3ec4fdeb667fa856333e1dd97627c05b6fbf62178c9ba895be2c25f8f3a47080fde355138a49c36fe77a85a6
-
Filesize
5.2MB
MD5ba209430148a813625dc4e55029f795a
SHA12dcc5f5fd972b2ebaccaadbe9a0f21d0fa69174f
SHA256b0b3ce88c9af1fa6c5c5f62ea096d320cb9e8c5776ac1440710343805bce257d
SHA5120097cf52eeb07b697db5be2be0a25a60fcacaca689376da625487aa26cdd5b2c645df82b638b3e22f89b09178c3b7b2bf96699240134f66f29b0f624854e9b95
-
Filesize
5.2MB
MD5171cf7ffa7ac1131d92baf8e352abc8a
SHA15632586fbc1576d7d77a6674242ebea3089d0c4f
SHA256785ff28323fbfb34bbfe8f730375a4f4fa5b0c53d10f8d3b8709f50158ea2eca
SHA5122076ec3d939598c2564c5011086d4240a25983704478d9b95a587b28e8db12df9089ad3600cdc2f98d7c2d1a3e3aa0fc590fa409614c76c8d00bf2c6ee485811
-
Filesize
5.2MB
MD5fb745a5518d1c6df32b92ebf08c226b3
SHA134b7443a98dba46ffd90cad565e587f02cfc9ce3
SHA2566d2a71cc2883867635c239c3ec41f8b972fb5e7a6c952bb1034d6c4e30063491
SHA5120eb2def55209d946a6703066233c46c838de66c64f3682bc30f8f21304eaafeabe2e105a77bf5bf6cf829a93d2a92ea8b2aa47f17f9b5c1a3fdc383926acc0d1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB