Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-11-2024 00:51
General
-
Target
2024-11-16_3c91bad4f2f3ec57a667e19a407ce506_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3c91bad4f2f3ec57a667e19a407ce506
-
SHA1
219d6690610cf5640825ba487635e53fcedd9a6e
-
SHA256
72e70c19dea387120774d5a513544a63b2e9a338238d58182645f8781b9b7071
-
SHA512
5ea6f98ff6254db293833d05379661b1d82cf8cc2b0289478ea107526b0d363ad49e1e186d06378406bcf5d6a038b43c82c17f842c0d0976927a05f107e888bc
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUk
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-16_3c91bad4f2f3ec57a667e19a407ce506_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-16_3c91bad4f2f3ec57a667e19a407ce506_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fqlOAGl.exeC:\Windows\System\fqlOAGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BWbwSEg.exeC:\Windows\System\BWbwSEg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDMqSAr.exeC:\Windows\System\bDMqSAr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTixjRC.exeC:\Windows\System\jTixjRC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\poYXtbn.exeC:\Windows\System\poYXtbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjYJvuC.exeC:\Windows\System\cjYJvuC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kLCgpqG.exeC:\Windows\System\kLCgpqG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzyCvPS.exeC:\Windows\System\VzyCvPS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AHCJoNK.exeC:\Windows\System\AHCJoNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aqXRPgI.exeC:\Windows\System\aqXRPgI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYlqmVi.exeC:\Windows\System\sYlqmVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pcAmvxa.exeC:\Windows\System\pcAmvxa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCIbQen.exeC:\Windows\System\lCIbQen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KmVHVEJ.exeC:\Windows\System\KmVHVEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVRfHhA.exeC:\Windows\System\OVRfHhA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QDiLWdD.exeC:\Windows\System\QDiLWdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JmEFIoT.exeC:\Windows\System\JmEFIoT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OsuCbRX.exeC:\Windows\System\OsuCbRX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyABFQM.exeC:\Windows\System\GyABFQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IgwKiIk.exeC:\Windows\System\IgwKiIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EnomOht.exeC:\Windows\System\EnomOht.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51fbc05a28e8c8818e3cdc225caea4809
SHA184acfed6139a486cecda852a151e684bffae418a
SHA2561c01d5ee2ae6bb49d6fb274dcaeb25fb7f5bbc9877a0211ce343483be2610c3b
SHA512a251873f28db24e0cba2d55f64d7c9eb99d93c841e2b3838d9e9d7d4b942b9afa4bdca30a11146eb660e738bb82e3ef0f1cd6634d44af7bee96fe3d164958245
-
Filesize
5.2MB
MD553a624c785b46fda016a639ace25b48b
SHA110b780dd8cf05b96d776e4c529c23ec30bf95bbb
SHA256c78a35d5634b6dd1ccee54716fedd0b8f58aebfb9bebcc60a748cf5f146de3d0
SHA512f9f8999af2296610f724198c3660d44416e32fa702f9da80cb8ba7e870f82e4a43d6e48209e61481bfd3ceaf26207312f41944b48637f85a20ff440dcfb81011
-
Filesize
5.2MB
MD54ae28796877907c5275fc789100c6fcd
SHA1f238e6050d33aaed9882c3b5494cc51f5d9927ea
SHA256de8ae8cea085084ff31a28da7bc76b8d72c468eaf9794addf3b5476719cc9873
SHA512f49eebe6fca82184f83a096edc85e6faf60d54aa8aa54c169a9ef39d360cab3e58881c09b885f5349d371eaeebcca40bcddc3a082b884fd72a2bec9a57399805
-
Filesize
5.2MB
MD5e46be79c259dea67a6b0b6610c13aa5a
SHA1ede205c384e04fc1e6b15969f96910f8eac4fb62
SHA25650ccf0d5cebeb781ea3efd1f1e05b2f907e489c830b09d193b6bc8dd73a4351c
SHA512c476f1aa5dec8cd3fec36a1015d650dec1b31fad00cb1c2f24eb7721763d37b49e28c8ac032a0be3ce07704f681f5c5e3841307c92e32a440cfdfa4ea3990b65
-
Filesize
5.2MB
MD517497ccdd2462f19d7cfab9a5c8f7d12
SHA1ce2dac7f08f7588a829a02daa61a3128f95632dc
SHA256ebec57913fcde0c23405ad8c9bb2c9bc3b77308ec732876f16fc92e3177a5cdb
SHA512e7682ad149f2ffa90617334a1df2c22b8ff5ca8a2aa45b6d6d4eb9da17e8edb5ffd7a23ef9a1a08c42a4f4e50e636ac33b806ad9aeda7427d71b78f969eee6b8
-
Filesize
5.2MB
MD503abd52f701d155c4e93ddd2e24ccdca
SHA12be63d500311effa0cc9b65449891e1da597a104
SHA25614d284c58a576e703f99caf7807e081a4cfe6056b677ae762425492e13647136
SHA5124baecf8f7cc7b3f1f7c8fd84dffab0bc43a4e1c0528ea0350bba247335ecae739c44417635cf57956c01c18659e1195e8ac0227dc6e96ebb3362d4ec47e96e86
-
Filesize
5.2MB
MD56376694e419c039e96e9392b896d1740
SHA1ed3c413a6cbf20800ff5599b17920a0949dc332f
SHA256701c9a48825a5ded0f9feb9fdebe4be8cf5ccf648b076491a8fb517091811243
SHA5121cf9688e45eeec6987ed43e12b26e886485497a98745c80d041591d91baca29cb036e7795314a00d2c8872e236de032574781215d888ff7279f7f44affcdc279
-
Filesize
5.2MB
MD5abeea36aa69a032ea3d45368afe0d42f
SHA1a153e4c9add3228c23cb0f5e940bd3b3b3d51093
SHA25616adef1b974393ea42fb6723358984958c2b7fb8b5c4d5b81b0c4309f076bb02
SHA512bc917a09f3a479951146c911b833e2191a8612b631cd393e833de8c5e851da922ef78b3799260aba4c516142c4c4dbaaa79d7be76174184b3c9bcb9ae9d5567a
-
Filesize
5.2MB
MD519f44524f86c48c2269e09b1de504676
SHA1a3c14a858dd63d4d5bd5e6d53b1338cac1ef5ff1
SHA25686f14831fa8b95c3721299c176af5e83e4f89a725b74ff5aa8dc1ea3328b07da
SHA512db6fa2a33c651cc21c69471cc540adf7d147966b80fd11905aa67223ee7fbc5dc6424c7872aced8e74d900e186975d78bb7b926ee680607ff65536a299cb60ab
-
Filesize
5.2MB
MD5c9c6d35cbcaeeac0375eb4083a91da8d
SHA1c528ce4985bdfdb5a74b5f31d72b2f00f31873c5
SHA256805c845984217f830c20a1997e34f693587a0de2d19c31f4ee5442170cc8ca6e
SHA5128cc1ce109bea8724588555b729cdca3900bd43fdd60f5a67b215e9cb6370e82ad65e84477723b91372b2875deeddac8c7fb220a20c24c7cc8b183f1477ebe36a
-
Filesize
5.2MB
MD5d92505be2b12467133d5d6ae6bffe299
SHA1599dd29267c4d4ef6122678e00c82625ad5bfa15
SHA25681c3b32cb4235dbf2e11b329b02356d28da2bfbfc40d08e7c46770bf36d41ca9
SHA512101d502d4244f763878c2b24f23cd6b4f7bd3258842f54e8412123ba28718328cfab31ee6334b427a02e3530ded11ea6db9e61fc2ca6542ab5e6bbaba136153d
-
Filesize
5.2MB
MD5e9bff07b64b3c66f6d229412a157f5c8
SHA19aa00790be87b2c3deb3ae6cb43f7249729002c3
SHA256722836026157f847e93b4147dac3c4788751a316f12a80f020796b6475c22f6d
SHA512e40f626d3fa822b6134656f6635f4c210ef0c897d183093922ac20e0c853fe9e783111f20cd231cd6e958474ccd9492a14540fccf9f087c1bfa72996891f2de6
-
Filesize
5.2MB
MD5f6ab32e79c84993433d3726f5f509975
SHA1ae8b0defc775f44656ce11abc36c775e5128495b
SHA25645a7ef9a67a6aa4d0a318ad4efe1086fbc60a13a3d2ebe71c9b528b58b501118
SHA51253d597510813134b4428f79c8cc0262fb62eaad94449470399273e3367d6feecc7cac129c60d90506a22e7551e92c3409e13c99baa105d70fd1c34e1b8d53a8e
-
Filesize
5.2MB
MD5e2b00abd915e6620eb0d5e04d7b87cd8
SHA1bc63eabe0e913b422da385156aa4b26c08ec6e41
SHA256768d918c1f126243784197673062d158d1e55ccbf03c252212afb5741e80230e
SHA51272c9c949631bdbf99b0f9840538634461247aa7727f4665ab68c3cb2d375f02bd9dc32d79caf3171d53370b6140509be8dd7aa1c04277b0ac2413a73b3ca725a
-
Filesize
5.2MB
MD51dd8b356e052fd42de4ea294490abd3e
SHA19dac7df71e94bf40e9b543ef4f0b2f27da3ee33c
SHA256dd028b849b3979547301f788aae72816ff9103b442e0085eb63713c5a78abfc9
SHA51217ec43d929ff45222e2c308004a92cb6d8c5e9e819b8f722e9cd1e3878705d74cf6b28da50a0bf8ae7fc5eb699e01623f8db2bbd76db90462aa1b83fe68afbc1
-
Filesize
5.2MB
MD5985f672e59780c85c4efc0d9483cbcda
SHA1b8840e254022a52b3c9c88ea148dcef5e57a622e
SHA256ba3af9ab43a826eb42b26c809fc979dd1c14563a6610f2ccdaf6a5808faa761c
SHA5125d98704db47e1e704689be4bc6c53591925c1806f777dd487c34bf11a347d47c300527f111c24d9a79afc657ae2b4bda548363728781c261004952cc5451dd1c
-
Filesize
5.2MB
MD589764c6f66193a1d376370eb8fbe361b
SHA14c10f7d7244d8f6b19d0db24a913dc6df6988f09
SHA2562201e888f680c1d5b729ea3d4e4360e48d947b16020209c7d09db3ba5f378740
SHA512b72124279b7cf7501ccd5d42e17d55dc4e3febcbafaa640ac4993be4c45d9632e2634c8a0e5aca28933cb0e8f912c612712bd6a86f7aa43ccf737a25f7910325
-
Filesize
5.2MB
MD50bd10250a0f2cab17d5fe58609bc4f2e
SHA1f58258f9210e59625e06c18c910aaa37b4e1627a
SHA2567d908e2da1d081889fe0be7e8f0e671296f5be57c87a3c3941245afecc0dea72
SHA5123a2b7effe26d0510af70e359566bc99051732d5397dd3c8af62c95d9fbf89edef60ad0bc7d97b1faf232b9a0310bbebc48b7a800fbd8527fbf9fdfcd986d618a
-
Filesize
5.2MB
MD5836f28a5bedb14805a4e2c93ceeb2797
SHA17385dfe53a9f1cc83fd408a6447530814a350999
SHA25653f582b28386f9d3896b26561706a58475b0884194ab96520d2e913235029c70
SHA5120d9f2d6f859ea04d5793dffd4b8f69ea95d6889f43f443dcb99b021c0c82dfa4bcee2e43ef6e21eef9802e51c8c5d2b497b948c0dce2cd01b682a8c530628a9e
-
Filesize
5.2MB
MD502e2b678adf78843bf9c8ae5bc27435a
SHA1ad3c5e1c33ecbd90e9f55779cb1dc8a23f0accbe
SHA2566456f8ddb3fb0cfbe2781f210a872a6783854d5fe6f5ef3a56258ceb9fb1f35a
SHA51236fc6efa4c899c87fe9b799da8f5c5118b2c577e7f9b04fa79d3221a1d607f1164b7560b6cb745dbf48d1c8e25e7526b6f06d5664c38007d1dfa721aa9a27a16
-
Filesize
5.2MB
MD584f2d3f0371642b100cb0175890cb430
SHA15044b1e604e25d38ac933a02303f46160e41e7fa
SHA25635a431ba6ba188111ad270099a203f1d012f3f615911cdeef973f17e68277aa3
SHA5128472132773bb9c476e460aff37862ecba8ea8e3a2a0c5ba2feed37f0b9e7a7ea26ef1286a2391012c9c837a2287e1546d468347ebb1e46c2968a924af01fda3c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB