Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/11/2024, 02:11
General
-
Target
2024-11-15_561edea81eab81f7d6ede4dd19ed409c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
561edea81eab81f7d6ede4dd19ed409c
-
SHA1
372ca19783c85af3b87718288d8a12fac5f94f7b
-
SHA256
5a3aa2d791d05e1f7be8b711bf653a19207dbd1489ad7db57a78206c83424263
-
SHA512
c4998ea800284ebce6d7de7b037f2e6e618288e3eadb13b4ad08983001915bbec5ca64a4302e1a8ebdc7fb1bc010d23660031dad27c5f286f124954a8e6959b7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 45 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-15_561edea81eab81f7d6ede4dd19ed409c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-15_561edea81eab81f7d6ede4dd19ed409c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OicvTzG.exeC:\Windows\System\OicvTzG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soYXxHa.exeC:\Windows\System\soYXxHa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yaqlPrK.exeC:\Windows\System\yaqlPrK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XaydlZP.exeC:\Windows\System\XaydlZP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRdHRNb.exeC:\Windows\System\jRdHRNb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JToYeNb.exeC:\Windows\System\JToYeNb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FnIfXoq.exeC:\Windows\System\FnIfXoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlTeebG.exeC:\Windows\System\LlTeebG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYBUVaw.exeC:\Windows\System\hYBUVaw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bpISVeP.exeC:\Windows\System\bpISVeP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oDzbAro.exeC:\Windows\System\oDzbAro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcPkfRm.exeC:\Windows\System\UcPkfRm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZdZgfIZ.exeC:\Windows\System\ZdZgfIZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPPPdcQ.exeC:\Windows\System\iPPPdcQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FYiJFpr.exeC:\Windows\System\FYiJFpr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rfkoxKS.exeC:\Windows\System\rfkoxKS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgydDTA.exeC:\Windows\System\rgydDTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\saeVCAU.exeC:\Windows\System\saeVCAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NoPDUFP.exeC:\Windows\System\NoPDUFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\knZaYsR.exeC:\Windows\System\knZaYsR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIheIpV.exeC:\Windows\System\xIheIpV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51aa24b645c752d53b5541e2bf46db03c
SHA1eaf19099f6b387bc1fd4e8c2551d97811ca07b29
SHA256c68b6d1642e6a654b406579d196f16016dc213535d74561f878dfe46b317f31d
SHA512cfdec3adcd0a322374ff7874feff1420ad7d345229ef4fdd78e4ec0bd6d57c44440a41484a6ba8ac856d2686eb554bd45ec95ce9e89ca2ee428a4fc52e564b74
-
Filesize
5.2MB
MD5992c865973c18cdaaaf7a9e763df53d6
SHA11e4da05143e75245604c11a4bb33131e9af3eb31
SHA2563322c52c353f3f7466ad68b6f4ef60bb2f863d68599d3d75ff01c8659497e826
SHA512708d03b26649823a03523ae2f0d88d22fb6674fc35ea21c88d069ddfb33e3be38ac43d9a1897c7be1f068ce859730cd6cc0d9cee4baca22882f9bc5337635899
-
Filesize
5.2MB
MD5a75a2ea7f960fd23050c1bfb1289281a
SHA19f6b7319bfa0ea2a20f22d38a1d3d32efb5441f2
SHA25685d6e64449d8785b18bbfdfe0564d9e8afcc7910cd419f2aa7dd15834b272ba7
SHA512146d06d6e0661b8f6f5ef1c60273b019e6a6b011ae13b88aace63f5faa851b68903d877588a83f39784a524c43ca9e20ce2f2296f23cb7b626a48809ba62d4f7
-
Filesize
5.2MB
MD536a7cdfbda316b0b99445e5535420922
SHA1778e75fcf882d54ac8ecbd83768717455b786504
SHA25622ff4cebd38d81b8730359d5b3dd068b4737254913a117c821b9a819b3336512
SHA512a47638f39b537698708fc11a85bc5cfc6c5f23f38feb6853fb1b0942cf10d6bbbaaf8a5bf207658a313c4e22c53273ddaedb68e91817a7277b4a9134531d049c
-
Filesize
5.2MB
MD55128216ea68308f609e99a9dcbf0a9d4
SHA10519a60e34ad2d95217a21018bec69992d117bc6
SHA25624d6a498068360bdc841fcff9df031489b3c7bef0cb444c272a4c9db8c4f7d09
SHA512cf16a450a87c94d045dca23fbec400a7031dad214a6420958e747fb9a2dc49cc4a76fe4a5c11dd70c2b21317e82c3e4627c218f3d8c171f50a72e386870647e7
-
Filesize
5.2MB
MD53faf7d7bd371fa41d6fc6f8df751276e
SHA1330d1eaacc11827d57dd6f2645062d88dfeed834
SHA2569ea17cdd13c877a2ad0d2481d4a77dd4bd0c2dd7d0f6319de82d60beb35d657a
SHA5120a3b8d1129793409e12898eddeaf47c1cbde947cbefb240d477dca12edfae60d2e80e455a3b87c2280af7ace5ca3d5549947df111247367fc37c45b64d2335b4
-
Filesize
5.2MB
MD56f05d494cb9b478c4d7436113654d006
SHA14a31d86f83f2c9ceb3b81539314de97b5b2381d3
SHA2566d40e56485d2a243b48881e9072e919c147b1de3751a034a20622b4964bab84b
SHA5126b4ad3291b53da033bc0467f934bb6a133c9172ee0a9a5091732504908f0c67b05452184f790b96efc71aaed7a42fe225f13c510db5fab826e34fb7b081c4e92
-
Filesize
5.2MB
MD50745cf79a2adefa56be0edb88fa86501
SHA117811b45a04dd480b7e67402a63d022113d98547
SHA2564f7b665227e2287f0f7488c440d2bc9093421cf193d9c5f5abef1cf2f699d55b
SHA51220c2c72f96b149d402a81d78a260d0710076476c814675aa37fdf86b5a27b48a2824978cabd794cf4570931e4ed0a53ce9f76d035f4c979385bf3698a5669bad
-
Filesize
5.2MB
MD5b69daa03786e2bfce21d560ac5a5feef
SHA1c273d3dad99483c27f3f5f088b4cc768ab1a5385
SHA256383846ea3045828b66aefb3107ed8c514f0fabea8fb9cc4589272cd92eee5a6e
SHA512383c9f9cf6b0f9c4b8e0422c3d0bb661578d3b073f903e3f48c7072511d21263b2f904d87e3f6f80adcab45457ce455146aa4e2a4682af7e96e612fa248a81f8
-
Filesize
5.2MB
MD54f3f53bfad985f1bfd84ec6a9c2ed89d
SHA1d09ed21307bce373e10f04cd4a9aa63d39f1978a
SHA2560d41ab27639c7013b8d333a869b43d0ff39bced5fbf5f1ec64e5da35951040b3
SHA512479b27aa38864de8346c321c690c50bb160f545fbde6a6cad10ac12f77cd356c41ae5d52b8ee1365f810c677d4ad092b1893f564a5f93fabd47656fe568ea267
-
Filesize
5.2MB
MD56ae4e698fbc0973de4339f231ac19daf
SHA1174ad9b9846e2a1e2aaac61409865c7f057ff2d5
SHA256f3ec2d928ef6dfa8a32082bf3854ba1a345d664ec5a1a48b0c0c9a0c5918e4aa
SHA512e269662125a49eff91585d9d8048e2ef5660affbd72fadff468e9ee8267512264b190d2a931f90147d9f1635b4b80e98780a1cccff5113ee351ee35880678ddb
-
Filesize
5.2MB
MD586cb96dbe52a554ad0cc12ebdae21be3
SHA1e07ce362d49ac6ad76df7c3d52ab1b76e5c79583
SHA2560cf9488e8e6e0bd7200c3d8e305d1d232b1532b6cc1ec57d80496b5cbf8f103e
SHA5126d663e5a71b1a9cd4ec84b0418e87acc0b8f726784ba8b4a6c5207e9660bcc52e69b570ffa5fe12d74c8e0bfbadcbfe05fd358924f4ae6327df08e8f0e08d063
-
Filesize
5.2MB
MD530e4f3dc080873614474f7ed34355893
SHA1678857d014d2ea3f00069c4a14b416aef512b9b2
SHA25651607112d4055d4ea6c050f8892ac33f7be896e1c2bf6dc2baaf9ddfad38be42
SHA512d35b1da09231f029e22ac9c71392c0b4b9f6b3fbde74e2b27ef95a1dddf68e6ef5172c84e485e2406a0b78ea8e27bc8351e2e76713401cf266502229d7083afc
-
Filesize
5.2MB
MD55cdcdc8caf1de5c70903cfc72205682d
SHA1e759076a33224b00197fff87a0598b91c7105498
SHA256f23b081bfa220c6b06bb9457a8e7620128e908f4b3ba8dabc145265698bed718
SHA5125de1ba64e056f808195776b7423297ee78458df80764e1070b6069da2b48d9b816a2e2e2f8dcf0f7f5d107bc390e1aa0ec92afc54d50adb26a3082ac24f44f4e
-
Filesize
5.2MB
MD5a5538b975c1601c03154c93b3d225300
SHA10a8804d4f3910c45fce24c893d373e9e92d47a3f
SHA256d6f05c042ade18a03b03020cef0afe7531b4008618580fe3157993501d6ec5c4
SHA512b865dbd835dc654f1dd9ec7680f6576c9adfe16eee1106853253f023b8b2ae2399e4f31aa5826474b5830e7cc105b58eda7ecbc122b36389bb5530daad26cbff
-
Filesize
5.2MB
MD5222183c3da96604cf5ec0a72dd595586
SHA12f5048395eb947ff0d1ae6b3f1b5299ba36c277a
SHA2569bacf6e5cee5d77d12da9c7dea7408bd6eedf9c613262819e2f6adc5f190ddba
SHA5129374bb1f3b89e7f5ddf21ef6a88203a45f98ec07a44461c7abebd0c7c69f26e37e770f11f4949d419561c032b57f3deb2d37bb8b837ab452774b9b0ac03e78a3
-
Filesize
5.2MB
MD529221405e5b5b3809d1344114e5d1ddc
SHA19114969243ffe13a29ee5750c41e2147f9ad64ca
SHA256cc8374292ea4201d0b0bc6e8192007596b399f45717f4d77718465fe24389db3
SHA51259a58f6030e4c2d0153beca2bfa5cf68e09d2a479841a0c087882834f4d300875b3bc8f543d873a702b54825e9d424501ca86d5e84dbc11561e2c089f71ff267
-
Filesize
5.2MB
MD5bc6559155b481b69b1af1aa207a0d7ca
SHA120d382a517e9cbb839ae6214b61965f4d7bf2a8d
SHA256362dd3ef326f27115146286280fbcea7914ba1241b73ddf93cc632fdadf10d4f
SHA512557145d30ec0f0737bff558a70d87fe1a96f46991d4e9a55353a7d91497258a4552e7a1a7b9383a6913e5843ee5e46ae217553e34789e9c03dd94af4b1ce53e1
-
Filesize
5.2MB
MD56b57586dd7fd462dd94fc49a9ce40d4e
SHA1d6f954852610dd865bdb2b4ec84b1f32266ec1c5
SHA256f660fd749f97bf98dee6b19890e41047651670ce9b3e316f370bbe0225b1b140
SHA512612bd10c4b7d11f683ff28e3a8492a3ca301c7c770eb5f0d02e751641465ab671a3de36726b9ce6b97bb5a0c140cf0de041088b0d8d31ec30d241b663929bfa8
-
Filesize
5.2MB
MD5a2d5f7f49ac80926a7779b7ab72adca0
SHA1c0ec0c303d5458eb3be28c984e5d0015d1a27b35
SHA256bdd779c5c8a7bfac0991008c688aea548d12e330bd33c8a605d11a3a485933c5
SHA51222571841ac5f937de588fdea75601a1f5eebb06a78792bb839c786417933e01f02cdb25a77f89360a0b80e64aa51e087b3c1e1a64225363a39afdcb470d2aa12
-
Filesize
5.2MB
MD52459d7f8770a9941065d89e2cf4e0433
SHA151013d4dd03da92acebb08aeda254a7a1989ac33
SHA256f9f4bc37971cce40495e6b9fc125d645b67a3e104d9702f1fa29c6013c790240
SHA512993a7878de76c2e905c7b7bb726469e0dc693de7862248dc9182a1fc2b58d82f99e6dbdce6d0dd592570fee83f5e690670c1d747dc74353d683c5cffe85c9aa2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB