Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-11-2024 21:07
General
-
Target
2024-11-11_6696390bce0edc19bf94afb76e5544f3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6696390bce0edc19bf94afb76e5544f3
-
SHA1
af4c987f21a83f1cbed1ca856efc90e83dfd8e30
-
SHA256
ebf7e5db3ff5ddf32f8cec5c67c7de67dadf65746659ae8349748757bafdbea5
-
SHA512
073e9055bd5161b6ae0e52e0f33b32396a024133695c2f8807d9ce2554b5f821c5d943147f96ef2287d203365ce8b964c26c2ed1afc5a2be8ffd717f98aef512
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUM
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_6696390bce0edc19bf94afb76e5544f3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_6696390bce0edc19bf94afb76e5544f3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZQxWJPh.exeC:\Windows\System\ZQxWJPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AspFVEe.exeC:\Windows\System\AspFVEe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\naOyysa.exeC:\Windows\System\naOyysa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvuUsyH.exeC:\Windows\System\hvuUsyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctZKIDX.exeC:\Windows\System\ctZKIDX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lTYvtSr.exeC:\Windows\System\lTYvtSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vHAMyLS.exeC:\Windows\System\vHAMyLS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VNlsYzo.exeC:\Windows\System\VNlsYzo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rjWiKGD.exeC:\Windows\System\rjWiKGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VqLaLer.exeC:\Windows\System\VqLaLer.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BdPWSbq.exeC:\Windows\System\BdPWSbq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QacPyng.exeC:\Windows\System\QacPyng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gcilaSN.exeC:\Windows\System\gcilaSN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\quthDFe.exeC:\Windows\System\quthDFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsUdYsQ.exeC:\Windows\System\qsUdYsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmyFKfH.exeC:\Windows\System\vmyFKfH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FcToGSU.exeC:\Windows\System\FcToGSU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLhPZDd.exeC:\Windows\System\qLhPZDd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnDgItM.exeC:\Windows\System\DnDgItM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tmhzrjA.exeC:\Windows\System\tmhzrjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Uuengzr.exeC:\Windows\System\Uuengzr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD557871a21469f7b087154de0004fffc7c
SHA1f6377d133948265c54307a5a52e7eee14e97275b
SHA256aac32f4c3c232f1fcb7de1fc4f61340b1367a311e813cd0d5ad9aedec680aa9c
SHA512d84b4fcbc2823be95044ee10717070648f04900b536d7acf8aa264018927047a04630e1674d32a34f73c4fa829b2b18bca545a9c40081d3b3345a59b962a4803
-
Filesize
5.2MB
MD5f581fc96d7911e02d3a3b85f1f7a9a5e
SHA1a724235369259b251c7bcaef7040320b9851b7f3
SHA25690e40f085ed7fbea6c86862ccc8edb86d1fb4cb9196cf8fac07ea3a77dc87b91
SHA512069896f3baf6a3613b427c3c0be67505685fe335a36e77c74391a1a3778623cec72ee34d5696763b6ba149d802912b8165734cd528db618c265d9b1a6abcd1e2
-
Filesize
5.2MB
MD5bb8d8f4301c76db7f6d744fbcd600992
SHA1832b7f4e10fe06959c907b1d7a46f890cbdf8328
SHA2562be05ecd3c728de34ed56cc522084a076edfc1404cdf31661cd0f314655e2fca
SHA5129514ac48dcdba1b55050c05d569d98c8a7a9e72a27d2e564724444476a556d58c7679fb3dc9a39c79d5cde0bd80373977ad39b54c86730458ceb09f615d122ee
-
Filesize
5.2MB
MD55da345f7d98de9540dfa11ef4d8b4e19
SHA1534bf09326e9edab9efc56e176fa37ddb8fd041f
SHA2562e3df4e23088cdf3050e2630c0694024d5e5825e304097906e8960337f4af804
SHA51217b4216d0ca84c9d5309a5c5c47a47820460eb69b8eb1341bb576789152f246ea8bc04b7b5ad85ead4915e62c1744c37e628df754fc779017e595057a505c043
-
Filesize
5.2MB
MD5464fcc4656304ebe20f2d8826278067e
SHA1874749c31d881a7954ef1c468b60a8cf46573710
SHA256078d5ae46f71e1ae0d856dff70c14bc1bed6fc9e1013d410cb7090aa184b3946
SHA5126ab4bbf57ab09848bfa4ea502281c13bdaa303da6d4ee9f5aaf9e0c6a9220c97882e98e08a15b6f993a36eaeaf2480266de2d3fb68512232db401174fc31c84a
-
Filesize
5.2MB
MD5be3910098818465a72f27c01f5c092ec
SHA1d729897afa65b3a25e5c1a29ea8de9aa1b519bf3
SHA25609f84dfe38c06708a7fe363b92a39a9c27e7b72a4ef9d35bb96076a8af0bd5da
SHA512bd37a92037a3abe4d5b9ff8a2a6965e6786c65e9301cf9f1bef2212b794365df7fa7ac18dabccd7a201d2d03213e077660a68b4af1dc909d0c9382686d719d66
-
Filesize
5.2MB
MD598c56b2f45d9dbcdd464678d740c780a
SHA19018643525b0dd2ab84f34c8d462751ea35e1964
SHA2561b33108c06f11079ac99fd492e3e2e79358b8d67aecca273e649d486bcb293bb
SHA512a2c364a2e21f88365bad26642b45417737904010349757f45d223f3097889c13470d8ae0aa1f993e0687e0b2ba8a8da2770b275336b531cace52405061f92c5d
-
Filesize
5.2MB
MD508123a207598449e051eb83ff3f64269
SHA12d118c6903c5dfa604b7cebfdd5d3c35422d8561
SHA2563e557f2bbb7d831639f303bd495986bc972e9074779379fcb0f6d44565ab2b05
SHA512d3ee0416c57258a6e74ca7aca5763f6aa35d46c572eabded2705569bf8a948cd6fe14f43a8fa3fd536d8b4e01e02a19ed350e92e15e7f54b7cc1d8ed201d800a
-
Filesize
5.2MB
MD5683e05daa7378022b0bcdd220dcf3b86
SHA159d1c8c22226aa1da0215e38b1984cee07948a92
SHA256cb0738c5090cb0aade085dbe5d4c30dd69653e3403c15d7f377e818c1c437bb2
SHA5123d5bfaefba2826b28c976d8b3843bde84c3b7c477732101604845b7c9df25c891975c2ed6c94b9b611cdf2212a60a25ec2dac8c88afb616c5fda83613119976e
-
Filesize
5.2MB
MD5012821192c0d9011e04d7d4d4f5c9c24
SHA14a8fd7eb32de9b537173b1f1214ae079515e19c7
SHA256b026854fce5cd04f1a104a7085918c5d651c1423d28abe67543d76b26be84031
SHA512b0b6bf0afd66b73ddae9b5953d80d3fa1390c370a60bddfd582a127ac2e5a7e3ceb9f2aee23d8df60d7af356aed0d7bca271a75610c8074e7cbeb65d2a4142ed
-
Filesize
5.2MB
MD552f84a8092e32c2513a881c0c9836168
SHA177cf39a02468de94fdf6d50ce208740b8593aff1
SHA256b7605e5c58f339c7b75ae75188e42196ee4cb089e5901bbd30cb1981397710ee
SHA5127f34a9949f9747f418a2c089f334c7ac366a85e7cbc4b6b3a03fdd3f7e0808ac73dbb08f0e181a3f2f157eee3f94fea3ef5b57a3093023d6a0e0343248371745
-
Filesize
5.2MB
MD5fad454ab472de9ae4f8e46e93e9439b1
SHA18909f547b8b0b7fbe97d776f9855016355eec14b
SHA2569620cbf0b97899758e66a91e878349b36e4261f4dd5ff5ae3d25b027cdb60be4
SHA512f1335dbb8cd50af88167ceefa9cc2ae27cfebb05dd58fb97aa6fa5f95b04252e1b462e27818b2658e88b5a437e7fecb3652e76fe6959ddf4178576ae17d7cf5b
-
Filesize
5.2MB
MD5e9351f6e7e7788ba90cd49090ce6784f
SHA168ed707c15ec8523403ed373a58b75479b0469d7
SHA256fda02598ce067f9c02381d30dcaed30bb96e04ff9710d7f09d168ecb3207684a
SHA512962b6acec9ab8fd30ad58aa117ed464f4ac27369653c85d348e72955361aeb55f79ff3714c0fcdc3717118ff72c8fba24820c8116a4849719b79b77e99dcba87
-
Filesize
5.2MB
MD5a50e46eaf332b0dfdd1ceaf3d1b7e47c
SHA15e561637d8380ec355476a7928498c18dfdf3047
SHA25622b749f7ac591a09bce8e1f5d898e6c92b3a71b9648fe3fc9d8d203c2890bd1d
SHA5124ff0c837541641b691f717cf6a79cf73cb76983b24b8ca1f0eb62217417b272d7ad6a6a3c8522915fd9c6a639e76a00b50698308b0643f1e87994d6426d4ae33
-
Filesize
5.2MB
MD5a633873e5283df0e915507ae02baa117
SHA113402e29f0d8ebf9c952bb621e3d00b6965f5512
SHA256649fe0816fd00910b4b8d977f3e7c9c69c40d24442610cf3d0c94f3f5928f7db
SHA512ba705d0cf7437e303bb0e4bed75654bdc5466f4628daec2592a131571abb77a6935b11608609dc05a76e36674e7ec5281d0497e882e78e1830a58f97a2e3ab1e
-
Filesize
5.2MB
MD5ac17ea5c7e1b3178702147a7d94cba64
SHA14da8ba0785257e2fe1b4bc01d8ddfee5b83160d1
SHA25632f4abd86b990bee49720dfba3ea7cb45d5b0e6cacf849fd620ed64e1939c4ed
SHA512bfac9064ae181d6becc274eff15221edf97df107945139eafd2a5fef8be3963134dc7806ca93adf5fb4c0e3462f4eff8dae67f8b4f8ea7b8e9439b3f8ecc5cc4
-
Filesize
5.2MB
MD5d94dddb176fee0f66addc3e6a736e15d
SHA1e1e752d59aed5736bda388d6bad3cf1db2b74385
SHA256eb3cdaeec0bd81f7314fc878849e12871f66b704bf9b744ccbf6bb724cafe325
SHA51244c06bc37d884e16e4cfb7072ae7918cdfae3c1871ce890dd46e8ff0ad2523b34ce782f41328aa8004bcbbbbd6f4b5179cbb84f74c76c3d8ca5722d41bdcda60
-
Filesize
5.2MB
MD5899bc9b9dcbbc3f4136f6430c00588a4
SHA13aa16c9923ba3c5b34f2cd288ae2f7ed321c7dc0
SHA256bc6f25280cbe6ceb80b998cfddebd834c25a097984e6c441c135fe7cd0db961d
SHA5123b923e8a7b63c66d655a66e30a625e3c6a0bd84a769b08b6599047211d2cb21df28c27df05eb47097e41fe55bff3b6d01ef9b7aed5b7d5ccf3cf94f5c33bf4a2
-
Filesize
5.2MB
MD5177e20c614da7289583e66548cd2d5ef
SHA1186e8576b65f82e0f67ed3fd75d91f58d796af15
SHA256948ed041a38dfca7f1a8a8cb7ccbd69cdc4b026018c8ce4289fdf36d4747a1f0
SHA512a0c95d29a372f7b87f913389899af162caf4bd641578bcb60017eec543df224b75788b2e001db299a0050d86c0590eddcd52ff98a035d42ccf158223291ec59a
-
Filesize
5.2MB
MD5f29199e554bd0716022b5faf2c0d9396
SHA1820b49413954892f250a7fe3ec9488a767667c59
SHA25655a67498f2799174628f02b86c7c03781c5d71a4bbe83c4b9a08e4ad15d7b0f1
SHA512c3a0ac02db7c827d23a8284a8ffe4f8c3546a7767c4acc6432ae81beb3c7d72a11ef9706eba0a13b6223ca3919012fbff44eac8e5c7646d4b907c41df9b8f097
-
Filesize
5.2MB
MD50bf965a9fda0b34d7d4d70f946f2dbb9
SHA1736ba38cef9e6885e4e28a375f7533d4f6959006
SHA25661e585864c66c886eac302d24e7842839466301bfa3af86abe2b138cca81e72b
SHA512b92ca13a0460e50099e8dfb0c93a6410505cda5eb457f2a592458e3fdaa3a20fcc69317db4ba53e73e94b469637b616ca922cdfd430ab466b140092f716872bd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB