Analysis
-
max time kernel
140s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/11/2024, 02:05
General
-
Target
2024-11-15_43a2c86e693f46dae0cd570ec5c0584d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
43a2c86e693f46dae0cd570ec5c0584d
-
SHA1
ff50d4e864646f5d14241b59359f12c75067d5f3
-
SHA256
626fc6ffd0789756375b7c924a05b30745a1bedb55fa9974e8be838c0647a81d
-
SHA512
76624c7572838b564852c25d5a3d4ee973fd3d12f144730e45e93cc4b302d6c1881099aeba73555322663188cb770be726d090dfb745f0ceecaf4fab40cdef04
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_43a2c86e693f46dae0cd570ec5c0584d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_43a2c86e693f46dae0cd570ec5c0584d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sIVdBAc.exeC:\Windows\System\sIVdBAc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YddCOxh.exeC:\Windows\System\YddCOxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtiuRmq.exeC:\Windows\System\RtiuRmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\goMasMc.exeC:\Windows\System\goMasMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRNfZnw.exeC:\Windows\System\eRNfZnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oexHuAn.exeC:\Windows\System\oexHuAn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWhGeIx.exeC:\Windows\System\cWhGeIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ogprebj.exeC:\Windows\System\ogprebj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CeSNCca.exeC:\Windows\System\CeSNCca.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mYDneuy.exeC:\Windows\System\mYDneuy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ChNHvsz.exeC:\Windows\System\ChNHvsz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tWgcHiu.exeC:\Windows\System\tWgcHiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SaztByB.exeC:\Windows\System\SaztByB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuNbHEP.exeC:\Windows\System\BuNbHEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vNynelo.exeC:\Windows\System\vNynelo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIinNgf.exeC:\Windows\System\TIinNgf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmGjPbC.exeC:\Windows\System\UmGjPbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EZXJpjU.exeC:\Windows\System\EZXJpjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pWXKqRR.exeC:\Windows\System\pWXKqRR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dKUcCyr.exeC:\Windows\System\dKUcCyr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qnZuefr.exeC:\Windows\System\qnZuefr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e3158baeaf5f76e39b08113bc7ad1dbe
SHA1a5894e655be490baeb122914ff0caee042dd0c9f
SHA256ae4039250273b603a3ce4dc42892795353ae969e90a6a301c2712aca10824b4f
SHA512119d6a1799d6b7fa8e9b77f9c74a1674014c6a60759282515e7da2dcb4dea255fb9f0281a141e458d85317044120aae9ae0a6f19ad1c178b2d2c005bb6fdde2c
-
Filesize
5.2MB
MD5caac45052cf7e502ecac168b4f8ae7cd
SHA102ce6ff6b124486dcec115b8317a9d24dd7f8584
SHA2569752890263a6318fd9949eb08515e11c63d7d04e96889226e43f976d019c7c68
SHA5124a61f27a34d5aafe88ca33bf873f816eb791e5e01ca6acab2ff56c2225bd2a9eec8445bf7065afc05fc111c1741a25247530a99a528cbfe1fd0f75c84ff30296
-
Filesize
5.2MB
MD5ec33dd5ce592b91182660a66bb904513
SHA13c36dd6c0186ddb3879e7eaccbdb6d7e463e4e25
SHA256f6bf029ce951833195d03abf1f6b407afd7dcea9d9446c1d3acf056afaa8d2d9
SHA512decf1a64e16497ff3a90903b540a6228b3f8e754be58e73663bb8cba64c4e9711c7726d43676fe01cacd2aa98e891d9590042343107133117c1af9bc27e24b14
-
Filesize
5.2MB
MD5c7d639c78f5c76e41980a7ceb65fbbc8
SHA10e2b71482b31e368b404ccea663ef80e4b32b993
SHA25652a3133fe690e1c6f73bc59f504759887af6b83ae60036ae5b51395e91916096
SHA5125c875e3a72e671161b945392bd3464f837a446274b606cddca86935dd7dd147e1e936da021f6307ef7ea2c861d4b487ca3630224639599b78077d47bc4cdcbff
-
Filesize
5.2MB
MD51126fbe0d6094074ec9f197f5d766e41
SHA15c5bfe678e2961d8324fa06368b60c103580088b
SHA256b7cbfac06630cadbc0df7f08825af8fd6b3ca5d687036d273766605c51947766
SHA512b181fef62a865cc41b5a2a452ec51a29a64710cec8b5b79fb74d3e012c7f942379230c0c762786bb10372abab9c25d0a959def6cc0deccef6d8ebfe583903424
-
Filesize
5.2MB
MD59fe898aa466005113e7fedef6514147d
SHA112b28bfdfa1f2fa0f51792d1febf0749fdcc7688
SHA25623d277558a3c0de7a6b52f98cd1ed767ac1ab13a89c7f8961cec1095ede16473
SHA5129995b89df78e0ea78bb1addeda92006a050a5a0f6f21910e0b927a3bf6e4568b4e54a9de249a87b25f7230905661c9b993ffd1b3d1e06fffa5c05cc488e04e53
-
Filesize
5.2MB
MD59c5c96d659047273d85364e0f349eeee
SHA12302bb4e127f96e79231cb69a6f8d9026881c02e
SHA25656496f8ea3e1ad2c4e354ee41ddfa2e447ac25efe241d3dd985f3a264df4cd28
SHA512e37767fc45f99b38bfe469532056c144131c15606976924f28f939cf1c7cab9f2821acf33527e38e4e4fa67f1daf22c793ac6cb611ffc5de85632ef3da467d1c
-
Filesize
5.2MB
MD518309d9da5725a99e6b1b6dc3a529066
SHA1a7baf8676635d74ce589c12ba29b75736e6ee911
SHA256f983e88558565e2bb59c8ed3c3e25b7557273f0013ca0ae5e3484e3aeaa08c8f
SHA5120fae6cf2bea535ebf613ab8855de138d4f49af9d2179c5ae1dd2b34bd59b4d5142a2fd9620bd57ca03f3d6280a6a66e4165dfbaee25279033f7d2f444e361a57
-
Filesize
5.2MB
MD5339473833ceada4a0bbda0421fbcd562
SHA1eba9c4cc60c14b7f5de499d41e456f0b8884c352
SHA256bc8d080e00d258a6e78cc19c0c770d370c0d136c6357cf64342b1ca54a45f9ab
SHA5127544b258e43da5fee58f49faea2c7833a39a0a1052eeee4e9cd9ccc7d34e2afd4ede21cf9d523d023a391dcfac119eae78a6cea33aa3e016e187310d1b443ea8
-
Filesize
5.2MB
MD50c9f07e1d1029707d4b16a95302d27d5
SHA14ae67130d5ae741cd93c5dd181960189e3e3eb7f
SHA2563f4933c6f7439e0858c4678df674595fe167fd3a3a641475084c9c11c86f9937
SHA51215d1aca77419a16d4b4eae37324d2e5ee1cf45605f13d5d9912f6c326fd0c8f4cdf4626798f6af7e4c99b53c39d2eb8bb7e960e95d6347fd5ae86a97300a2b95
-
Filesize
5.2MB
MD5dcb79cededd974998aecb5b9a82e0aad
SHA11ebfbc14c438f6465167aa78218eab4ddd0cef3e
SHA256d820b6269d46f7d84d5d4fd8c97d9930ffd44f9a1a8bd2e43e677adddaec0179
SHA51235157a3cdd3a5f892980a0148fe88c4f1ba9ae51905946fcc13f6b182cc9de5dc42656d44d80e29caaa491ef5f0f2916bed89d3bd20d592e990da98708539db6
-
Filesize
5.2MB
MD53811917224ea3cef175bb3bf8c077a98
SHA150e0cc2f74ba8a9695f6e91b589128ad3c707769
SHA256695856acd78c510463667a5865c686ab854d56fe258a079dbddc38aad7181d2b
SHA512d3ee71181ec5bb0dcb0553c0f8ca876436cde6a22cb126c16f0f23582f5bffbcf2b027c91d56cd4e25e95051bb9182ed52c6febd17c0a54849e500cc135ab19c
-
Filesize
5.2MB
MD5714cf935fec58e085ac2a69187d3152c
SHA1dd3f953259d66afbcf4243302d4940a74935e223
SHA2568d2051f433f26479b58e20e6bdf1ab5cb18af49bd1641c669f266cf8f1c3f434
SHA512e5aadaa840a89501e82ac0c108ecb0557f2d8b51a906bdcd03ad76ae160ad808f53c82771802566bfede6215e8bb1bae63b41133887e54309f656804fb3f615b
-
Filesize
5.2MB
MD5be6d6cc74c5b06757f5e9392c2bab27e
SHA12e984c70facd116d87b8cfa966b266066bb785ca
SHA2560147be3757145adae83063055ff413fb938acbd9732f3a3ffcf49cf7f193bd01
SHA512e9887e3d9a91e01205f1ccdcc96ce98579612ee59a9cb1e0c7c65a823a462de955dba62649e5e1d6e110f15ccd6e81fa15c51dc8387cbf2dd68930b4eb243bf5
-
Filesize
5.2MB
MD5bf2e5a3660396f8174fdf56fe426a0da
SHA1fd44b3c38ca4b722368ca9f5d06571885f86bb52
SHA25636222b035bd91051c953c11782468703a67274f3615d3e7d4f32f794a1f8cd1d
SHA512b469edaee18f6feb85ca5807a398637ba391ddb12c6b5913475c9db26e70681ff313ee9bcd4734c7517b38fcf55f41a03a21e97964f08002167c85595ec8d0f5
-
Filesize
5.2MB
MD5b10b293541d10d0541324c179b270ad1
SHA15ff4a887455cae4f07ac115d6e13e76111f7338b
SHA256ec65712a8a5df14c87a23f319e2fe9583a7982c5e404f779dc44e904fb7f6bd6
SHA512dd38bec676d89edfaf8cc6dda5b9595529739942f5997d5aa6f00af2862f065b7303334a1fc22f9cc596d440689c5e9ac1fbd27cae0a68c7bf6715f31169ed8c
-
Filesize
5.2MB
MD5308df5c307bdec09dd4aab2b70750102
SHA1580170f8c021fa7fc8c77bcd5e76c1691e5974aa
SHA256d7c40e7f98ef58516e9a7cac7f94cbb092c4c3fc88ef7801e7601baab2969782
SHA5126875fb8f5cd6b61ee927d20ed3a03a08e32666c23632a7d170d924a5b4cacef4ebee9b32e157cb3fa3b693a36f1b18cc843e03e432544778868884c15ed99bb2
-
Filesize
5.2MB
MD5bdd03f2f1b642559c3efea788906c6db
SHA1e8dbeb07baafa17a245854502ec74cb5d47b4e49
SHA256b08293fde75efc304827d2120f26607a2b2359c343ae33fcb027a8c4eb8b99e5
SHA5125647398ccc39fec54171b8086a678dd45cd5198fe692f343cd233d123adeab271d944fdc2958beec27020ac7c7bbfd0c0747658371af04cc1ffd86a93ac0bdae
-
Filesize
5.2MB
MD5d14931f130235ae692aeaa4d0afbcc22
SHA141fa8951af6c37d86c0e5f30ef02fa16a534b9fe
SHA256a6d175b757db6b2c8f184ea8e1db9e12a04c47d08a5b12b6fe0755d2b2648ca4
SHA5126370abdab5cf0a426f7d78b60f9e42c097d0b7ad33da66c43a11c005c33e42d4004463d81e50cfb7fcc929027211669cdb46609ae3b661290c39596ddb202464
-
Filesize
5.2MB
MD51595524b6b1bf64671e378eea9be0c2f
SHA11450f720098f36a30762e65eb7fb601e06a81559
SHA256e4ba2dbcc85d27a60ad2c1b6164125c86d9dc291e8a8b64293319c2dbf024d8e
SHA5122f45efa47e220ef67ad69b16b7e8b41ad1e619243dc1d3a5c7df3e3978f0136b8a0f00973b2493e20dbbd409d1a0cf911acb4810646a6b6ccee63d1be505ccf7
-
Filesize
5.2MB
MD578b27b522d7b9ad979e804aa1a254d39
SHA166e54228b074fbd78f45912b2d0336fcd8993be4
SHA256637fd57dbaf8bbdabf7e40fb51e5dd8d3c7f0b563c994a925607858d23d2bc13
SHA512c7aabf7b8f5214e3178cb6b1d3fa7910465bcf6be1ed7ea1d1f373402120d5efd153e2f0cd2a04245fe2ab5d3aec65947e1f8cb9c058d3a0d43caab12f6db98d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB