Analysis
-
max time kernel
141s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
15/11/2024, 01:32
General
-
Target
2024-11-15_830a33b2d3108e090389d6adb75ca03c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
830a33b2d3108e090389d6adb75ca03c
-
SHA1
8542d38cad37dd82318ef31ce8cd66c27b818d7a
-
SHA256
27e182bfd39c61229723e5222c18e6f697bb41be63ad915549a832bef00fc180
-
SHA512
578d86b3bb6bf3aa0f45a478c05c88a9cac2ed19bb4fbc9578438447d330ada51c22a1e3959122aa5e542fef4ff658cda2ac69ed3813950a3dfcee289aa0f9b8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lU8
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_830a33b2d3108e090389d6adb75ca03c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_830a33b2d3108e090389d6adb75ca03c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aCIqurB.exeC:\Windows\System\aCIqurB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbmFHYY.exeC:\Windows\System\YbmFHYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cbzDTAC.exeC:\Windows\System\cbzDTAC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sMsKRyA.exeC:\Windows\System\sMsKRyA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIerLKU.exeC:\Windows\System\wIerLKU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsxhBdj.exeC:\Windows\System\CsxhBdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xRqNDVd.exeC:\Windows\System\xRqNDVd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xrTqRED.exeC:\Windows\System\xrTqRED.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bjdimyJ.exeC:\Windows\System\bjdimyJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpGzCia.exeC:\Windows\System\HpGzCia.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmMAGoT.exeC:\Windows\System\mmMAGoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rdnXmTf.exeC:\Windows\System\rdnXmTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qXcoGTW.exeC:\Windows\System\qXcoGTW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sQnFuub.exeC:\Windows\System\sQnFuub.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVplLDf.exeC:\Windows\System\UVplLDf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fAAXFRD.exeC:\Windows\System\fAAXFRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vmltNuz.exeC:\Windows\System\vmltNuz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbewGRs.exeC:\Windows\System\SbewGRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yTxqjQQ.exeC:\Windows\System\yTxqjQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XosRZLt.exeC:\Windows\System\XosRZLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxeOPRc.exeC:\Windows\System\CxeOPRc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5824ad492f42688a753968a143f7282c4
SHA16627cefc079a92d0b1036b873aad368570768e9d
SHA256f8de4b991d2588f7331e93f43d584fe2b7b2650e589a59863ed09da7e244dd11
SHA5125f6f46225e5763973a103b0004305dffd87334989c6204aa6b0922c4de409504f96c13c9f55ada1dab803ca2f03396d388ad358df40627b6f2c9195f3b825d1a
-
Filesize
5.2MB
MD5b7f28c8243b5fc59f36bcacfaa3802b1
SHA11fceff50bb97dddb4335afa08395c9ebf8e9c2d6
SHA2565eb70fed3b85a2eb2849ed9474fd8b9a2d4e629022e94532ef5ec4d649f846df
SHA5125deac54a018974860b1d83c51c79f6c38c116c97ed9715be58d5f07bf3a3696b28421df6a5c31a4642e25451dffe8a7e2c596b3d84e6628b782b4e352210c011
-
Filesize
5.2MB
MD5f58d9102423e68b5093b056c1ae53228
SHA12353da2f7106cf4c99195a7e8e50c7512de97b3b
SHA256f16457cbd59e992e5e6edfe427d98137793b4fa35f09dfff3211e38dc1ecc851
SHA5120046310ee721da5168181f3715ddfab7b04a07e71e99daa2c5c229a336a4c316c2da1f8b1d313d3b42147400d200e38601f5750cd26130e616085f38b05b0b5d
-
Filesize
5.2MB
MD57a2308d2cf2f3368dc4c92f850fd1b60
SHA1196f28fc8e07d78ac3a4a01e1d99ebdf7089af4a
SHA25625bc171c59c239c2e7172445dede0e599edecf566eb0810a50423f9458da140e
SHA512ae254a30b82a5d7ba0b0dc2f8bf1ad905771782b628828dc3e18d14ceace77dc0863eaa656c761f5ab08c7971620ed038a9e2182229d96dc91f78afaa18c4913
-
Filesize
5.2MB
MD5e307b35c915e96728cddc97a68be3125
SHA19be6d17727aa6aed87bbd36256d5322233e75040
SHA256edb337103e690f7922014f237a972e01eeb5a5e9cee355eb03f316b3e062a87c
SHA512e59bb26c5ab6ee2b54634e6cf99aa15822ca1ca54fbb4657f27418b26fe9683dfcbf868e8a10cf79393e394f10701bfa916392b8008d133071bde32a775bf37e
-
Filesize
5.2MB
MD54d41ba5e3cb5b615251367b20cc2eda1
SHA185067ba67116a6503b2a1eac9f5958cf0adbbc21
SHA2560b1bfb55646b204cfaa5b4a6856d170cdff27951ff898e2280baf21a40e375ca
SHA512b4bed7386682c2fc843eade4a671f528c7596a37182fadb0028e99dcaf3f9a8c755dc10575bf59c82aec902ca47107d1501f2f9679cd618b7234e0a858653674
-
Filesize
5.2MB
MD5072c7a46a088533519d55173460e7268
SHA10f566ebc0ea3e7c9adcc005269023b822822b388
SHA256266f36f59286e33edbea55704fc63c1a859959b023b12bb19ef7376280927279
SHA512de98aa595062cac067ca46256d3302f4c35e6a883f48441bfff300ee1a9afe38e656a5bdd3da2fc58c3b327a474c7a7452eb35e0d42505b92547f78b4b0b2af9
-
Filesize
5.2MB
MD50416814bd1fb299b0a5a4080205e1198
SHA1c63cf53e709bdbdf169b8e9ed17186331e2b4a0d
SHA2563c2269c0bad8dded523f8158376bbf7f9f047a0e4fa9aef59937954714f16cd8
SHA512d94bce377a7bf3a68a905d466a9316ee59d666f4ecce6d6297493d044fb7a1d6b07d31582449095c115cb0e6a1608188cf824b925f24d2b063437a67ea67377f
-
Filesize
5.2MB
MD54e97d98a0ff4b7c06d7c73cd19e4df44
SHA121a7b25503d59cef7db1bc75b2995b74851405a3
SHA256765d20cd6f08e17d482e6af147dfbfff815cf74c3f7d7218a265aa1623b27c66
SHA5123cd6d6199a1cb049feedec57a7e03510c111e469bc42f4a58a8b5d8f73f48bfb0358bac1d873bbcf604485112b384a73cf7d5a2eceb458ca61bc429621215b71
-
Filesize
5.2MB
MD50e861e4b361d1f67f16ca423efd780ca
SHA1d54b5a0e9f9c9dd25efdfe720a1ae7ba2f600315
SHA2562c9a46e5f6e36b7a2792e066a94d66e93f6b6efc2f8e0ce4dfff1dfd5bad3b6c
SHA512c8440376c24c9e38753f098b13589784d323cd0dc61d7c1f34b1003c6ccdb0aff78960a4499f0d735daed192e8a8a7ad20b026b1bea61f10fab5442f736a9909
-
Filesize
5.2MB
MD5b5650230eae0622fd1e3066ea48129f5
SHA14aff7135dd191fd2ae5297ce4970452251b7578e
SHA25642048cf63b9bce42a381084946564d8d1f9d294cc4793b24eed9f282f989be70
SHA512668b4bcb9f601f705f0a36c76132ff92e65677c2b0f22804e15cd3d2151c0ce313b657a16fe68c44d665e2d2ce4112923a1f215e4d820f03a0e2bbb302a0e1b0
-
Filesize
5.2MB
MD5524d11f234f3069e866aaa0be7005666
SHA10912ca77f9564af51a332fe332a920c50ae5507a
SHA256dfd08e06b50021597cdcc17be786cdcd8eebdbdd04e5e5611aef01bd37f0255f
SHA5127f017027eaedb430cb63a42fd24ca3343f993c79cd5749ec069f09a2cecac3eb25ad06deed28340447039396274954ddec8750034eeaa55cdb811e3e802bb0d2
-
Filesize
5.2MB
MD55b8f0723c7ba81c8fcd32a66cb196046
SHA1110190ab370cbaae48de054bc00fbdd6cf231812
SHA256f78c3cb32b7376ffb84e0340b6bb9c351c7ba521e9b675b61c5bb39ed3071e1d
SHA51255fa9a53e72b75a7a059547cf37c64a85196647869db40eb7d27dd543fd517404fa56349cd64e8dea172042b78f3590e0e6feeab778a3ae59a0b292196193d23
-
Filesize
5.2MB
MD51f25256196b9dac80b958bf027a54cc4
SHA1c8dc231ce5f8f4cf4c23ee604b15b66f21ba5010
SHA2566e31debe0badf79136810b6e67e1bca9d82214eea53eb3abb4aec80ea36035d0
SHA5122141029e01b87773b60b75de3f276bce88366a0845a198c00519b10cda33e4c6b48698b31401c9830bdd0ab6c208737c13e653c6c70b7824d93bedc6c979c422
-
Filesize
5.2MB
MD5b23198c482dd43e2fb25185c4a133b4c
SHA1793e5bfa903bc61ea3b992f75b01bbcaaa560a15
SHA25690385001c9fd737108d438843ab71b704613e80bcb3dec85bc337d57135dc926
SHA512402476aff1954bb309aec8559ee67bbf5d9ccae37a4efb12c5d7bac165d7d200e9bc98a88c58a6f681d19ea0539caef7d16376e08e711648229264665593b7b7
-
Filesize
5.2MB
MD55d61c1c974744070bfa9f4dc9941f392
SHA1b1537299207a1bdc6c6ee591563a80ea2e05e10c
SHA256a9ee540cea7acba52372602b35df53553574e6a1b708e07cf37fb6b4df71a14a
SHA512f584c86c577f5c9e9d5f265a1edfc6e5b78ee41c28128d6d06a7935957b33169e90209e96a79a3ef6f92936654ed540abc35776c8a5b66b78d48c26ac6002010
-
Filesize
5.2MB
MD517d1050b078c7adfbbcee7178be857bb
SHA1c4b7cba98c29a443187b2d9143c34d2942c83b08
SHA2567aac6afde244fcdadb9a19db5f330539896b50932656b3bc2018280a196ecc88
SHA5120f8804342d0c6f3f49a9e7fe485c7a1568e0904d17ef143e79f72ac70938582cb47fdd20ff9241f9222ecc9c5f00f9693246e4a9cb3ddda02ed30f0e86680825
-
Filesize
5.2MB
MD50983df5144a4ee4830ffd3ba376a2f6d
SHA16b81540b21a711b93c80649aff1e3833cdad17de
SHA256fa530902897d038d05ae9c4c56b9e033a2170ba7977057f96071b38e0731ba80
SHA5125afcd1e4195179645ccb36ff5c736f19fda04268cb16bbeaa4964a4ab3da2bb5a4909976c6149d1aac1ad7de8ae8d8514310af710f27eb9a2c72c1ee2a0044a7
-
Filesize
5.2MB
MD596021074eb5dc652c11d60398bbabb96
SHA16b67bc4d3bc591f38b4adfd567fda44b8d212e61
SHA256df3e47761e67334853355cbea72b53bfdb9f9ab89317ec7d47e472a32cc8dd53
SHA5122523dd63e3bc2af9a149afe0d2c850b5bac99f92fd4ec7fb52ce23ce61f29651e1a5fb7dbebf9d2e344111e1c005bbd3fd2f31a2857043536396bf2fe7ffc305
-
Filesize
5.2MB
MD50cd307163310f9eb885508d0640f3772
SHA1ef7bd9b8bf763f35449c340a760c5f26f2ab1497
SHA2567664b8c3fe33e591091b97e8ee4ab10c0f90a41537810b82e5ab9d25ab152e42
SHA5126e0c69050bb71f1466282270ab9b42101740cbfcd6961556f5f61583ea9d093ad769e0164c46bcbac84a84990396ffe52f4fba713ec557cec021cea60595a67a
-
Filesize
5.2MB
MD50614ce8a5c25bd5a79b070b5b0f87354
SHA15b5d14623ceecfdc3a62bd11cca13cc2f9a1737d
SHA256fbd512a05702713a8a33e11811d7f74ca4c748dbe0a16e07bc61cd29b4d42983
SHA51232afdfdb1097fbd08d80feed98eb24953947f2130e65823445301f21c1ffd996d6fa0df47acbf2964335eb416690434ec08325ada55b035003686887147d09fe
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB