Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/11/2024, 02:04
General
-
Target
2024-11-15_3e3ed853167df8318854dda16fef727a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3e3ed853167df8318854dda16fef727a
-
SHA1
e4c648900245da9a8e64878d2d3ef36e6c235df6
-
SHA256
7191d0259c0661e8d153087bceb961eb7e6ae992685cc83815fb42e5c4bea1f4
-
SHA512
398bb9f5b10a98e292f85f1baeaa00424c48629da1d14e0ba4874214967f6b5a44acde3946a32bc5c45337d1395d78e3533fbbf14359b1f15a4928ae9c0fe34d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_3e3ed853167df8318854dda16fef727a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_3e3ed853167df8318854dda16fef727a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yNRBvOz.exeC:\Windows\System\yNRBvOz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\odNwKwv.exeC:\Windows\System\odNwKwv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\noaQMTE.exeC:\Windows\System\noaQMTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nmiByqB.exeC:\Windows\System\nmiByqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NTHdLIR.exeC:\Windows\System\NTHdLIR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SlvniKZ.exeC:\Windows\System\SlvniKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VGuwLuM.exeC:\Windows\System\VGuwLuM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jqXmamy.exeC:\Windows\System\jqXmamy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\omfHPlY.exeC:\Windows\System\omfHPlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zuYRXBl.exeC:\Windows\System\zuYRXBl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xigzVZf.exeC:\Windows\System\xigzVZf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IjdQUZX.exeC:\Windows\System\IjdQUZX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ntssNIt.exeC:\Windows\System\ntssNIt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FkXTAnR.exeC:\Windows\System\FkXTAnR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dRweXrO.exeC:\Windows\System\dRweXrO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XyCtEDg.exeC:\Windows\System\XyCtEDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GVVnoYH.exeC:\Windows\System\GVVnoYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvESaUK.exeC:\Windows\System\JvESaUK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MpkOOuI.exeC:\Windows\System\MpkOOuI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OeQQzin.exeC:\Windows\System\OeQQzin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RHRJwOg.exeC:\Windows\System\RHRJwOg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5aa12a1ecdc36ec05451765d679272840
SHA1d3454c69102ae10f3e42f2f8f9c8b252d762f6f8
SHA25673be64de4362d8da0d9bae9a7fc7615fc6e1eaa764e6511ce8589561260dadf9
SHA512bc76f17ae9910e8ab7e592f79f00e7f9b8f271f6c4b51e2b9f1e48d377b15ad2086cab2d00268c61394773712a927920d1b01417656bc4ea4dc8faeb5a4d8188
-
Filesize
5.2MB
MD5d53a919d2fbf5918286fa5f94a5eac10
SHA1346806bbaa6e9481b73a51d155705c36391abbf9
SHA256c75b5ff10c4647f531e39eefa2ff98e19081b399929352fb9e2554d1ec98006b
SHA512a1decd02b2fcb4372d4e286db68c123dac2c06844b5aa16b2b5c312abd1baf3df48d9c61aa37b45aa3a7a8a5e50eb45cbe889b43993a79268ad6359d40b168b9
-
Filesize
5.2MB
MD5e4857b4fdb0707b1d8449ddde053dc60
SHA1ce1ed6ba49b73530cf63cec0044b6dd6710da11d
SHA256ce6a59b13955a539194c098761496f18b4b4d88613e262eed05fec63266a35e4
SHA512da5d2810336a7a0feb8ddc11cf9abe5b77754ddce52a703b493d93723e7b5b9ee03434c8bc25b6bae38e635f3904c2b0a2211cba8a5b0dd540941dec2a1bca39
-
Filesize
5.2MB
MD5db00ea35e77e8b89bfbfd15215c5f9dc
SHA19cec27084b1617d4bd4b4d8995bb1c918c5a6f06
SHA256e67236290a8383b7bac0313ab7d486bc70bb85059560ce9f3336b3d8d028e7e8
SHA5121373b3ab37bedebc8c5263448f23b9f6205494d358c6e43dd42b25e142492194f3103757a8b8f4997c22cd9c55b37db294031dbb5a4e9093dd97d4ff7e58b2d0
-
Filesize
5.2MB
MD5248b74e7695fb01a482c48f017acc59f
SHA17053c4bf46064e2728aa9a3419494fbcb11fd71e
SHA2569406f7f1632c7bd80b908a54db4ba72c9ff40862af22f857d0680c2965e13765
SHA512d7a0c0c7c2212ae848639b061ea167be62a39d8e79d8b8845bbfab6d449cc34c866218331a84262295a475a87ecfe53676bf11879f885e6cba28c4be35c4bc79
-
Filesize
5.2MB
MD58faa9447fee1496481fe705316d9d12c
SHA1fb4b7fc5f6f77df177c5805b04c867f759403912
SHA2569d018e4e4761e5151856b3fba851eb7b55159f87985dd99695f8b3d686a88969
SHA5120cd5e97b6e4c22af794e471bd163148191f3a63990128acb18a6c52d3a254ee57dccff1aab9d6d63d3e1fc75efdda566c4d666a55a0212368bba3d474e61ec54
-
Filesize
5.2MB
MD5181ca2a9639be48fbdffa9fd4eac33c1
SHA12af065d1bd26320f05659899e81cc3868d4294c5
SHA2561669817582b433b78d0cfc042ed58d03cd221bb8baab5289dc7f830f05ce2b87
SHA5129ad56804d5325fecb24bd8eddb4ffaacb2e7ac838a7c190be8fd774d814f13b1eb1e7f5ffd6138800c71712f6a8d14dc851b7c4af4f4ab5697fc01dcc75713d5
-
Filesize
5.2MB
MD5dac54fe8648b3830f8e59d9675db4cfb
SHA1d4bafb49b4c8812129ff1561b3aaaf137c6af281
SHA2563f2ea505a844b2edc618158b73153d6db6c207050b61a097c3dbc593361c8563
SHA51203f98387d30e1f0c4221c3d27235a9753d8c8247e7de54e384d49fb9fc8cb002da72adb7f5f6db5dc38ea0817d2ffa6f9c5ee5f680126e6de17823f9a5a70595
-
Filesize
5.2MB
MD59ae04acd61917de9342de83f2d2cfeb8
SHA1af8fd69b3cbd156825761fcda80d76cd5713db12
SHA2569f9d3daaac158b700d879ee66725d03bae3128d2e5dc3c2f8d5af198c80ee854
SHA512e550d131e94ef51207e65bbf4b7d96d8b91ba0868f3bef1901926794b5d701a1a4c9773ce045e62aa15bf189a885f62d42b5bd31a67e706f8abe8460bd050c1b
-
Filesize
5.2MB
MD58224aba49b99090e35d6630468d1dff7
SHA1e433bd166c8884471f892393732d3d0ddbe5b352
SHA2566c5469b3b44d3309a1f8d106f8822a353e42da999696732b3fc4f7880a782410
SHA512506eb22d54c0f8fd47c040f32baf34865fcb09a3069d1927d70843c278b89008177d9fe60841ec2f8d695f8031b66d06ab12d575adc4bfb2b54756b33ee73628
-
Filesize
5.2MB
MD5820b3a68e0a6e6c3178ed77d5a7d9475
SHA1ac53a0380cb0854c68836b9197ba5099d9fd1072
SHA256a709bca20f3746bacd1e5b4b87b7bd80da7313234e19ef66f35781ba7e826970
SHA512abb069589aa2821e8f3319687088275bb70e9d5b39c32770b10dfa1cc6b9b21eef80e278bb41d2c2bc473cd25814142226119cbcb185d519b753e6d3e3ec520b
-
Filesize
5.2MB
MD571effe22257923ca56d543d9db488d9d
SHA1e229f4464b3572815aa9fc620c87331712d72373
SHA256744667510e2bef4714f81463db6642112be8e71c8540775e2ffab9dd6bf44ff8
SHA5122226699cdc7e87664be40d36077a0dc5be4964b49b0c7c558c1423c37ef58e48172a429ad95af8d4e3e3b70fef389ccbdb1e08b6b1a9d6db80b9c258198f1bef
-
Filesize
5.2MB
MD5a424ceb650682e93c87b0a8833660907
SHA1a388eb7b27e4abe63eff217d2eebdeb79d4cad96
SHA2569797c85cda984ca2326acf33894da33233c99aa390d93c8628b560403bf5a7e2
SHA512ec1032f00aa6f4aefa56211d4ed642cdcd1b73b736dd1a7e94cd0138b3ca251f3adbbb7fd9791521ecf601789a5f5c3016af9ed9b39c0836bfb94faeb23381f8
-
Filesize
5.2MB
MD53f4624c486b4307c74bb1fd1384ecfc9
SHA1c273a2c92c87fe6bbc5fdfc0582699a67281a501
SHA25686682311b3e240309a53ceaaa6984565c834b2c023c9fb23865e2b6792dbce2b
SHA5124691df4486446c782757639c407948a81f1e310b2714de2a5e0c582f5629f78e2a8ae9d3f9b8396515432a12da6ecaaa290e0e74f6da2fbfdbb3dead2105919b
-
Filesize
5.2MB
MD5d0c38af7260e95d377a59c83d0c82c6c
SHA1743fa14552d2b908abafbdd820529cf80f91bd08
SHA256ac7ed4043df98a697dd9ffc526159d9f90903255cb7b8723b77e72236d1e7642
SHA512c80cb57e5a16ca0a0f4ff5385b37d6f08d5485405a7ce35512f13d3b6e2c1fa35676993d9a1ccdfc10c864090f80f75077623794d46a2e8e3c90101a93ad654a
-
Filesize
5.2MB
MD501d9cabff279798e9364bd2ba1266962
SHA1e5058c525aa5e134deb07b1d6d82285f84d68529
SHA2569aec103509d957018b11814c4a5899aa8d37382340b8b4fe36f210df609b87a7
SHA512638a8f79a4be19fe193e23446e94d03c3362f24bc7a0f3f18f9df7e58ca8c8f7be6f487be9948023ecaaad618ee473574b70a38d355175e32a0700ba0707cce6
-
Filesize
5.2MB
MD55339cd311574c736fc3145cd4167a75b
SHA1adce8b2f6019efb8da14a1b702039f819b3bd53d
SHA2564a23faf20f88a64e0c75c31ccb4f746c32b9122d677abe7dd5b5e43a7d7eeb04
SHA512150863ec68679219e586ad2c1428b391afa62498060e6a1ae7f72c75e91948e8f59dd0724259c74dcc618049980b7ff2fd697eeb5ab6715d9142e0fa6afbaeaf
-
Filesize
5.2MB
MD5248b1377f48f40dd5bed97c2873e4926
SHA15889a3d2a3472235bc974b822e34ffdd3f92b539
SHA25669adc91bd7dc042c0174beda3dd08441efb0329f70b41f2cc1997aeaef087439
SHA512d2c1324e2fe11c472f780783db2e345bff669d69b1822441f7ec5c716e8e3fb05c6005166a95129dd7d43624abe7364e52b288e69517ca7aca364eb284e0263b
-
Filesize
5.2MB
MD5bce1b84d926c9c0dc1fa1ad04de14a06
SHA1be5a831773bea3ddb3ff2ca723115a8a246aa606
SHA2560dfe38f4cb7d718ec40e6e9e7f330222802ff8ca1d1474fdfd19087198099148
SHA5125ebbafe2affe11a6557e1c9972d118b364b92fcba7f096697335022874e9a5b33cdc831c98f3f66f7645ddd02a88048b2a959fcba171845395b0229dd5aec5b6
-
Filesize
5.2MB
MD5039132ed798079839ffcaaf58fc22d47
SHA11b9e1ecce4add39a732713dac0dc2846d9683709
SHA256850d769b78c2affee8e78684f1c76da3e1713b6936fb99bf7512aec157fe9aa6
SHA512ff23807b6501c2e34a40e6a9a106f554e014ba087377b19e465bd9757eb14f5ee51e4cef721ea6a937f7bd87928f91c13b9ad6372af87f6515fd70416abd20f3
-
Filesize
5.2MB
MD5ff511666bc2155165f630d8890cb7659
SHA17a19a2a082ec610e20c1429b55a1c1915afbe86e
SHA256dfc87a1326e9d893318f17474ca8ab83e46c2dea48c3caf26f5e35e49008802c
SHA5127083284c4ec533a27a86225bd2c6e45f474a8067046d48f1446501a28a41065e1400d82a6acfd01d13199a636cbe277d529811018a8ea47917491b1fefcdd0af
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB