Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
11-11-2024 21:09
General
-
Target
2024-11-11_d398893307b4557dd895e0be662b8f71_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d398893307b4557dd895e0be662b8f71
-
SHA1
6a2d2e8c6938e7fc11e4414fcd42c2690cb2f7ad
-
SHA256
6dff815adc9ce1e46582cbcdceedbcccaf3c838a4ab19ad6a0e8e220b8f1e22d
-
SHA512
a793428c18a6df511854eeedb23217c2ce2792149c2ba661fd40ec9dd9ff7b6b4ec8944d97d33f555e719cd6eebbaad9cc902237dac8b6f7ab86a5aa68992d65
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUI
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-11_d398893307b4557dd895e0be662b8f71_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-11_d398893307b4557dd895e0be662b8f71_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\EtSLcJL.exeC:\Windows\System\EtSLcJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OXqtwTE.exeC:\Windows\System\OXqtwTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tXDdRER.exeC:\Windows\System\tXDdRER.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIceztq.exeC:\Windows\System\pIceztq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ykPQPpK.exeC:\Windows\System\ykPQPpK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iTXBLyg.exeC:\Windows\System\iTXBLyg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MLPepJK.exeC:\Windows\System\MLPepJK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glFmSNB.exeC:\Windows\System\glFmSNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uMZXYZI.exeC:\Windows\System\uMZXYZI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCFLxpP.exeC:\Windows\System\qCFLxpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OsncJef.exeC:\Windows\System\OsncJef.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\whGBzGH.exeC:\Windows\System\whGBzGH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntPoajO.exeC:\Windows\System\ntPoajO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qykoDZj.exeC:\Windows\System\qykoDZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pIuaKiI.exeC:\Windows\System\pIuaKiI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NBTxPbE.exeC:\Windows\System\NBTxPbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxckXGT.exeC:\Windows\System\ZxckXGT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IrREKEZ.exeC:\Windows\System\IrREKEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EEtTpqj.exeC:\Windows\System\EEtTpqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Oorpxez.exeC:\Windows\System\Oorpxez.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrhHcjs.exeC:\Windows\System\OrhHcjs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD563246294694ecbdcbdc8624dca91543c
SHA1ffdf4b79904cdad018a0e76c62b3a8e2b0514376
SHA2566d18046c2879da49082d5a8a74419bc3d6dedf097f406cda32aa9d418c6974bb
SHA51294598a5b69e39170664bcc13a58fcf694ededfc1dfa53e6eae019c71de3ced244cfaf7e6da561aa17aeaf0f69cbc486e5827bc21d8e5542176791863bfc552d6
-
Filesize
5.2MB
MD5c6af6bb85948cc9ebac070c1f7f2ff51
SHA1df02182bb7fa62e50e6797cf0c8af860e64b4d8e
SHA256896cf037c0824188946aab7a910100f530e1b57c7dec7f5b41c3d8705d36c736
SHA512ccf7a2a96ee14ad184a07e01e52a89280d7287e8ddda2e7821a4984b4071586e6e3821dcef1cab5a9af33f053a084c657b0fd9e1e6d794610be8b9a632a963e0
-
Filesize
5.2MB
MD527d366b3a33c1f19eec1cc105fcbc84d
SHA1b064146f5fc859dfd9431e600ca0ca3a738a5168
SHA256e7d148aac7a3538c7bf0865799ee0d91025f1f258a5b748ba0b3db1aade8ec5b
SHA512e0ca0964692c9dadbdcc508900e25874a88444cb46a070d90e6e073cfff0b84f88c9db60a8cc326b0ddde99116c572d8803d9c3e039ecef976c2de1838713c62
-
Filesize
5.2MB
MD58a4e6ad1bb7de044369468abde24a50e
SHA16b367c8116924015f463a5e67a31974212b1a1f7
SHA256c4173070bbce696af88fd897c5d5aff1e451d2610e88a3c09f0a5b4d708b7d78
SHA512b87a9662a4bb568bac958cfc9fab5c7a0a2f0ea62d0549d5c77e3280a4ce189efcd4a58f49d894954ea59329809352f01335c023ffcb27ef5c2cb3a2a0c07634
-
Filesize
5.2MB
MD5bcc35ca568760b169987ec32a3cf3607
SHA1719deedd53f25bc233888190a10198a391e13803
SHA2564773697034c6778e08ab88c2ceac18833e8224d7ea048edd8f68f34864fb6092
SHA51299dc93455e43e33880cb49a71427bccb30d63cf3f78a7e09bb233379180ba24e2867287db8725ddfc3f082f8abe8b4fd69cdc234bd379e6bf63d44b30ccbf040
-
Filesize
5.2MB
MD557ea80cacdcde94807a0d032160a5da5
SHA199934ce4a67cda5e350770d4540bf57a1732e3aa
SHA2560dd8f68f371f8eda0bca8660493d2af061c9c92c8af42a0e8e95f899b2decc96
SHA512c580b15c351ff49c7153ca164644048a3b4caeaff3b8c895623b1f1f031cd6e22c19038990e9d58b1d6a4b153ec629085869ba75432a723cc12fa8e2af871065
-
Filesize
5.2MB
MD5457e9d777f901d2014369ca4153d4e89
SHA1ee1c4bbe077996b5e4ebc58083107dbfde75b157
SHA25635b5343e4055883855868ac01add6ebffeec365a0bbef77b3d8e24a8edad157e
SHA512b499e08cf2a003c26ca828cc305726845ede89de2ec0d3b0567ba7eb775132e9eea257731fa52069c7d147ebf6bd49f7da6bfb10f0447e9d9f38cc4148b2b45b
-
Filesize
5.2MB
MD56ccccfc809091c702664f09232181937
SHA17dd3d0c44ecfa9aa30addb2c2cae543c60c4f554
SHA256c4521a5198459f42bcf7a71315885193853c09758bff21d83acf812107f5dde9
SHA512e9825225dfc0a6dfda9970fd53b79b65cc8276f3d1041622dac91e1db3ddeb0a4f511da97ec69b79e530f4a77cce6d63b869baf014a362f93c9ef753e22fb398
-
Filesize
5.2MB
MD532c16f7709248c3a5611e5e651fe28b8
SHA1948f30a73947aefbd1526e8df93fb13f12a0667e
SHA25646755278ffda5aa290d3ca98d36b8b71848a8a807c876438420c4708fe44105a
SHA51216ff9af0eac364287d3bcd854864818464ecb9d5554a8daec96899b4609e299dd14d4bb9440bce1d5b8e0c7d2ea3b7da1f43e5d029fcd3842e93cbf0beb6e32e
-
Filesize
5.2MB
MD5d2f65e14ca7da75c3cbb67e9457aec22
SHA1ebdaaad345a1927d967beb180aa5252d8859b291
SHA2566e74a412e2d289a588392ad44b2ce48ca480b361bf01bf5e31b817735c3b068c
SHA512982ffbf523cf1415186ddfe0975a7da3c4610e7e669ecf7595d84ccda2a594ae0c88cf0d3f428e4a298121326f30716eb330d53011868fe48d882839ec38ee38
-
Filesize
5.2MB
MD5fe21e16358de5c2818b50d083cdca304
SHA1ce676790427895bdd47136fef12148bbba3883db
SHA256fa86058832d3416b1e023a5133326c0768b533209583954f2ab52fcd4da896cc
SHA512b005718ac4486c65f940833c89175c61c49b189262230e021b250fb8e7961c681258be7093d4cc7b2a742ab1d4193d4684409fb8ebc662239e3906b5b184a91e
-
Filesize
5.2MB
MD566b24d704157d44c977b0e0ebda75912
SHA1da3b69a0f80c5623e30e671ef842ebf3679af8a6
SHA256c34604d3c76ba16db01cde4af39d0581b81297c45f5514d486aaa7fc1889c528
SHA51290837cca7578bce838246c496091419750ccf8de5368c15d527e92102d01a68359bcef558315eac8143fb384262b2a021097c3a9c39d7b3697086861c9442b59
-
Filesize
5.2MB
MD56b63dc4a002f930e1f0c72a25b085e3c
SHA1a0b21e208de00c1082ad079fb788eb9fc410ab6c
SHA2561797f898aa1290e793eb259debf4fa0f7ce960ac87c322126b3fb63077f690ed
SHA512459054f1d992494cda821edadbbfc3fb0ffdff3246cb3c17349707f67f7af39c51de8b5c47e257f27eaf97208315eaf351d07d2976dca98758f762142aa17931
-
Filesize
5.2MB
MD52617ef961bb793f74c5cd7429c41ad14
SHA199c513f63daebf2ad03c3423a80cc71a706a9dc7
SHA25626a584c9a0fe3e115cb7af86cb1ed57522ba7486376a4f585e5e98713039cff4
SHA5121529c3a5f9d7da6e727468a9575258989ac903363adcd8cd599734bc3beb7abc8fc46ecf81170b3d3034e4656623274d621edbab3a9be04b01cbb63d01c5e5e7
-
Filesize
5.2MB
MD5c9d744e9a9e4d6dd793460202a518e7a
SHA194afe0c986d0f83a2b5abb71a3ddc4dc30c8f61e
SHA256ee75ecf81fdbf5772bc487d4a4f942225e49c94431b0612305db3dfbc4a1213d
SHA512b01af7a1e9ae9db5fac5aa525f84ec09eb67d1ba041db1d2a4e86b66dd64448e79fa2f8550221a5daef9498600d83a53ec1b13ce429cb8898c194a18c9323880
-
Filesize
5.2MB
MD560a97a1e98d730b2738de0af0997755e
SHA1481f3f0d5cd252384e9d65062afba2169984bf78
SHA256cde010abc3539faaa6d1f54b904333f4777c1aa87d8d729282fca9a27cc2a11e
SHA51219757fe3a3e5acc1fd780a2910bfb24454387ea95aaa753b60a0ade49924cca68741ad41efbad97854bfd91ee1e08139d3dcb5eacd1207bc970d38db3a7d7fa6
-
Filesize
5.2MB
MD50dedb642474e1a5a561ca0cee0efe71e
SHA15c4e5247520ceba3bd09a6a796517d3891254cb0
SHA2564faf9776c6772d8e51265429e74138a8454cf39194ecff03d7d6ccbba1f28697
SHA512362708a068d9dcb77428f8b7118a1faa681af89fdbf177199d3c469d040951c1d440c9700f1ac1297e1783e3e35bd910eb6c2964704dd64d4d87580dab4cd062
-
Filesize
5.2MB
MD5052e8b96b924668cc23407fb969ee801
SHA1d1804eb57a852b20784baed28767fb1d20f46583
SHA256d2a8525581bffbce059d9435aeef60852e41baa0942dbb1034a839d1f41e4343
SHA512271b45ef1cc13b270bac0d107919c467e4f87635cbd91fd87d4e68805f07c73a6b27a20cd1886fb11d4e6fd5e55909191975f5dcffad82d1a6f5cb4d192280ac
-
Filesize
5.2MB
MD5c5cc2bb49e2d894d27eec1871caef074
SHA1cfbdab050b246514da0e32353ebcc9f45c364cae
SHA256e475c248d88d8b831a775b6ca7430f68aa7d516de324b3247cb8b69f67e01992
SHA512c81d8ecbcaa27677772a4982174a83c22223eda0ea954e75a924592a60145761b4aeffd8e9aeea431795c86f0190f9c4771705aacc2f08eb4bfbdb97f6b94458
-
Filesize
5.2MB
MD56b0ed6054abca7b3466add893247c7a2
SHA1a46ae33d5872219ff70c9fbabdf84fe331966c9e
SHA2566c2e2c2a27bd08deb095551a3513ea52334c2b268114db0b0f89017a178d6a6d
SHA512120b774d810f8377636e66d5acac37ba45edfd1b78b0a205dbc6033cb8c9c137c1387948697b7e1367200204aeebad00176c882408e5bc8b3c7cebdcc74fd1cc
-
Filesize
5.2MB
MD5dc943e15c04294ada0fd72ed861f6c22
SHA15cbad7b03608a43b331887145f448070f716a44e
SHA2563d9dc90033ab141837bb0f751b879fc02c9a344cd0565dd366770a7651d7c1ad
SHA51232aee28cbe90cb91eb9f7f4564a4f5cfee7298082613758238beb18d7c31925bed67df3bd85cf360b41c72298ef3044d4bc6c5d55794eca8b0f84312838f7a02
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB