Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-11-2024 01:03
General
-
Target
2024-11-16_b6087bbdce00c130a8ac8318e5288dc3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b6087bbdce00c130a8ac8318e5288dc3
-
SHA1
a7d64805e2b9ee2b264756f3fd23ba042d98d86d
-
SHA256
2cf8bcb3982bc050556b90f9943914fb753c332484b7532e4ac74c055fbe6498
-
SHA512
fe55102f969e23791c84774f70747a72c2b5f2bb9686c016cca7098d10ad0c0769de493d8b3544634eb6e4f0d86249d0412b9d0c216037e24b1aae16a0863316
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-16_b6087bbdce00c130a8ac8318e5288dc3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-16_b6087bbdce00c130a8ac8318e5288dc3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ipAJJLe.exeC:\Windows\System\ipAJJLe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oiLTRrV.exeC:\Windows\System\oiLTRrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFqDsqS.exeC:\Windows\System\TFqDsqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FPpulun.exeC:\Windows\System\FPpulun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cVHhdSn.exeC:\Windows\System\cVHhdSn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hVocmLs.exeC:\Windows\System\hVocmLs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlEHqsH.exeC:\Windows\System\TlEHqsH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NOLzOfa.exeC:\Windows\System\NOLzOfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swClGUF.exeC:\Windows\System\swClGUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ulYYoyX.exeC:\Windows\System\ulYYoyX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Znvvkdm.exeC:\Windows\System\Znvvkdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dCDhJAo.exeC:\Windows\System\dCDhJAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KzQuMRz.exeC:\Windows\System\KzQuMRz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlraadu.exeC:\Windows\System\nlraadu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tlcpsbk.exeC:\Windows\System\tlcpsbk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UXXAOCZ.exeC:\Windows\System\UXXAOCZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ulgJYXb.exeC:\Windows\System\ulgJYXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcCmAOj.exeC:\Windows\System\qcCmAOj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NugcSLT.exeC:\Windows\System\NugcSLT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sScOlIQ.exeC:\Windows\System\sScOlIQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aDRKdxw.exeC:\Windows\System\aDRKdxw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55774fa20127da02229638f030af371ef
SHA1e27ac822417d0583afdf2187d8166a2a7d64c117
SHA256e9902b1ac57a9b7a9d73ff8315678430014b1d71d3768ab885f05d955eada5a4
SHA512316f2616009b2f542071aada5984147c2e39ca3f27eed071b1e8c6a66f3fb3f544596daa519c9a2e86cae32a244b3d1bfcd6b3596191f0b394157c8175a10a1c
-
Filesize
5.2MB
MD5519e936d2c3a8ae6761868071a8dc8d3
SHA1b5e90acb01eb4f277e5903097b067f22ec5955d2
SHA256e13a32f043a611825f0630fe496d8d80a4d633a06219f2deba39f6e5f1ef0ec8
SHA51219f2ddea72da152ddc258a4ef5b732f313915fcb6e6a3eac6e0ad7b5b5f5ddca41554d77e60c27a229eff15a6771d8d0f9430db054364df9adfd8536c424a921
-
Filesize
5.2MB
MD584251df23bdc342b4bc8ceda16e1d05d
SHA1f5fd39ee88c10815d9f18a35d9b97bcad692d692
SHA256951725952b54c293c496a5a4d3a39e3ec4835c67ff1ac18ff6fef587b21362c7
SHA5120e134ab518a8a238e323c99d70368aed2d5fded9c513694e89ed83e88a625fccd457addb7f0669aba492a2cf59a98ccdf2f75d6e1eeddb03c74ad6c188ea3475
-
Filesize
5.2MB
MD5b4f7b6ffec8500a25e586bec6a0b50eb
SHA1d6c25020c609cda59d00b05e8825d614794bf178
SHA256b0f4e4a1ba01d9ba197d4e844386541e36a9206be6120004c4bee6b86802fe56
SHA5126dd353f6c5912416b2bb480bf9f314cb1ed6788c085fa454bec2538636c28a32c8c43c05654ec3b40d38ba5b6ef971a06c0f5c129d0a58d4899c6bc941bdd2b7
-
Filesize
5.2MB
MD5edf559abb3925456fca43383fa31846d
SHA188b8c91d66f89216de6a74bd75a0bc90f72f3f4d
SHA25651e6527bbe0953eac4eb2a716bb0dfa68745a5c08aa7af7c4634c964e2440534
SHA5129d639333fe9f7cdcb35db160ae453d9f2798c349ee2b827986fc20ad7a6db05dc7ee33ae5a00f45bae764a87de7a5370bb4feb7adf86a2c959d74d67ca780cb4
-
Filesize
5.2MB
MD59149363dd4a343140474863c23a503d0
SHA15fb7eb1bf7f0412be16ef6945999605ed60c76fc
SHA256bcc6199127d6f402d70aa992b5491da7b50e271aefbfc90e7b39cccb0f924a1e
SHA5126b147f5e6d7098a4813739c2e7061e14cdeda422151fa5b180f2cf5a1dacde603d199bebe451d7f31a92baa1e67418fe15a5fdcafaf218df21e5e481bc69eae0
-
Filesize
5.2MB
MD524c8b5a5391f6475140e8477699cd19d
SHA1fa60708c5ac48e74bf43a66e34b0eabfc3760984
SHA2567844654e580949f328f13e5f3cc10847832d068750a002af62d602dcddad9caa
SHA5122e030bc85193d6bea49639284c8b4cfc91426ebea1cfc789e0423afbaf0ab19cac717ba497292bd8d1f3d26d54e624d048ba7c5e121bfc923fe585583f187aee
-
Filesize
5.2MB
MD5a8924eed600309f52c37b60b36698710
SHA18ff3801f1e41dc6d1a0ba4c94cf2e2d5bf1a8ac1
SHA256d70245dacc347c7829d2879e25d560c8afbf7e8d12a0355348261275517178a2
SHA512a97eecea1de019042fffc250acb71d1920fd8cbc8640a17c7fe168a9ec311a74abe8972646e8940b5b2c297856e111b3c5bbcf52e0566502940561ef0466c646
-
Filesize
5.2MB
MD539030ea50decc5aade9b6d5be99a042e
SHA119cb9f07389889e414ac68aaf8d2a29abd9bf9b6
SHA2568c7824aa28269c73d52d5a05d52d554e8bdc039be142bc5473906e5f8bdbc75d
SHA512579796dfc20933e66527b33366e165adea995677536abc008d2e1386540db0e17e90cf121077f0fbf3e301cad42efdcd350faa90f6381d042137a5242df3df48
-
Filesize
5.2MB
MD5954a1f7c9d5436b8b0351008ccd99af3
SHA17acf5a83b8922d123097e9ddfeb036d344eae866
SHA25632d885b3b7767395f95bdba9dd6e7e92cbb4543f31fd1e1fc1db16a04068fa31
SHA5121caaf825ee4b2763136e1b88e445e13253f713b03c92503c2d08ba61973074cce295a7433ba2df1d17ff92a6c997745070c9ff19bb194517be55879340901d4c
-
Filesize
5.2MB
MD503726c9c7ce5c863e198407a0551ece6
SHA17ec9b416186d24d750bef3bd6a71c2e2eb998797
SHA2560ffa3c69d7c9cca1904118e37ebb459d6778ddfcb7c30e7cefc66edd634a1a39
SHA512ac0ac10bd411348078eef191e51d613139e6febec9d772b46cebca6639a0b6d435c537e0dcdf6a94d2e963c2b7d841c63eec93bfa62ec23bf811dd5aa038ade5
-
Filesize
5.2MB
MD5e6cece3aa132a3b70e2af479fbab29fe
SHA1bceac797bc5ea4bae2d3fb4128aca2af9d567214
SHA256714cdd8fd6fe86c2e501721bc808d89b02cc2c4998db812577fd45a40dd1dc72
SHA5122c25945ce943554aa2d3788821c611df7a0e36cc1a763d36de68fda551e100f12cac0301182fcbc57a9480fb3e4a542988ea6830e5f88c4e77bcc278b03c032c
-
Filesize
5.2MB
MD5c29d9b4c29cc722fb3969fdaed121b7f
SHA1ecaf365a2b736eb6ca18a3266d8857d226d7ef93
SHA2567cef90fe9fb9b3bceaa5b5381602585737a20c02249b03c11d1d14e929029dd6
SHA512470455d5fb7b005b87342847d1e45c666bb55490512b0e87f9f0aef227ebc88d9e5a389e04499fda9cdc99df2faedc598179efb6bf392730c16896234edc18e9
-
Filesize
5.2MB
MD555a9a5e679fef0f0c806dd59881e333e
SHA16693494616a3c4580d931eb2ed1387b811f34447
SHA256fb38fef36bfb6727606c7065a3773c0dd598657e7b153d3546842e62d78cc7b6
SHA512132dea11379016f21e621218a95161ae7b6e5119d4a7ba8dd2e7f6b0fbb8255ceeed79d87d5570fb44d0ca2a4d9e1292e34cb521536631680cb323f7213d5e5f
-
Filesize
5.2MB
MD55b6aa18af20c19ebf4fce033883dca35
SHA19f9a1ceb19421502fd8272d12cfab10d3aa78b14
SHA256f3f2bbf86d976e66e3f312e6f660292c55a04517efb6da2cf8e2500093f0fb9c
SHA51269e1fdcab213db514ae5d31e16482fa05c0595d1152a96b50d60a58f9b41cceb72e1951601aa47bf2e350cfda95875f9bc2fff0f2324cf43ee02977155a189ed
-
Filesize
5.2MB
MD5649fd065311bea132d34d024313b0d3e
SHA1396b0d82df7ac10a5feae4d82d3e42476ee8e8d6
SHA256055765aaec287c4ec4a9f06f92e0b9ee8008088bddb017a3ba47b2c549180b23
SHA512e88b024a3f3729ee14c6704d1a12d04dee12afc60d39e5fb232d69992754deed7a03a9b26a28bfd31d0992c6250690b5a0ec09aceb97bf96318c47515e9a5b43
-
Filesize
5.2MB
MD5c470eeba799f2c225e771468c8c0edc4
SHA13cef2a66c3579026878c178a4adfd8d217fb52ea
SHA256001381452d4596b94c94a563884c5ee9298b2f23a996cfb99f3f128dd4060196
SHA5120c4b444e9100470e8f7228329741159c4f6b6f6375137086732750fc16462f732b0af934edcf721f716f679fe20f25fb6e2f71019f16d6cf8333cc4ee194e4e3
-
Filesize
5.2MB
MD5a3f67a2fb82408875fe18f808759f1ba
SHA1dbe108cf31809e8b63bcf3d730e66dd1482886c7
SHA2565bd201c2611fa1375a262068cc874e061ca190e886222d06498a0968b8ee0362
SHA5122de22619b45f3e867e0778ba7421bf4daa23c52a04eb2f166b7e9a851d352f874ad1c9b95a2a230ce88f36dd6f1a46801aa86e5df904cdb6fe90e8d69a65bc7e
-
Filesize
5.2MB
MD505bc5fb9727ae02de9aab9b7e33dd8a5
SHA1112b9a2917f45ab33a0240cfe69a5eba46250034
SHA256b2d8396abc60f078ceadf427f32c20dabc2b5e3ca83cd4f362ec1e9133802855
SHA512225a1113291efcc9f9348777ef86f6917090c6a1e1bc07bd7a6c2d0776eb476d19d40d806826a2233f1d3a945fcea04e4524f65498649ddd9089ea03683cade6
-
Filesize
5.2MB
MD5512c93ed10d9e68c501f97d6565785d5
SHA1bccbc6275974c0e53034ea8b64152040e4349b5a
SHA25646a894d6d58c150d02f8aa84a7994ccc64c9fc9ac719800e4ced6972f41ff4cf
SHA5122ea6b48f7412bbcb7eb38afe3f61128814631089ce594587c5e564829841ddeca7c1b869d3e2bff51d17a4488912467fb66060c34711b26786e337ae8249a269
-
Filesize
5.2MB
MD50fbdcb4a67a537ad458f95bf04a5ee71
SHA111746b49a57ff17f01ec4402bebb14eb912b382a
SHA25620dc3b7e087a3147460c45c3d6de5b127e0c2c4ca610e7ea794fcac26034f161
SHA512db2d85a6ab15e9afc17f9be51dd30d0f5a4645a7075314e4b24a9484de7844cf9f9c9cfd91d5abfd8ba0438bbd782fcde77c086983feb87ba8bee223c90631ca
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB