Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 02:38
General
-
Target
2024-11-17_bacbb5f5f101d89c81a81381f42df6ba_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
bacbb5f5f101d89c81a81381f42df6ba
-
SHA1
dd3f2726b339467d453d333786d7ad63833fc3ed
-
SHA256
00f4f7081333ad9ae46364c79ad7bb866de50b79c77eb054ec11688ceec3b627
-
SHA512
c9383ec8642d4e617cc3617620a05a4525820a718d9ba06c0dada0ec43b652869aaf6c817bc889cf6bf64fd2d1121296dd9d63eb9570b19bc1413f104184c0d8
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU8:E+b56utgpPF8u/78
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_bacbb5f5f101d89c81a81381f42df6ba_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_bacbb5f5f101d89c81a81381f42df6ba_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ANClhfO.exeC:\Windows\System\ANClhfO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPyupKK.exeC:\Windows\System\bPyupKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PObrEar.exeC:\Windows\System\PObrEar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHSpcjz.exeC:\Windows\System\VHSpcjz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUBWBEA.exeC:\Windows\System\wUBWBEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dAKWTKZ.exeC:\Windows\System\dAKWTKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AyPUuEz.exeC:\Windows\System\AyPUuEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nxcjMoF.exeC:\Windows\System\nxcjMoF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BGAmNei.exeC:\Windows\System\BGAmNei.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pirTTKh.exeC:\Windows\System\pirTTKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQjBcBi.exeC:\Windows\System\RQjBcBi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MDBBHic.exeC:\Windows\System\MDBBHic.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWHYRki.exeC:\Windows\System\DWHYRki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZCTlZK.exeC:\Windows\System\HZCTlZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISrqSBB.exeC:\Windows\System\ISrqSBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbLzpuJ.exeC:\Windows\System\pbLzpuJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eSHzsgn.exeC:\Windows\System\eSHzsgn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtZrxFm.exeC:\Windows\System\RtZrxFm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AcQjDhO.exeC:\Windows\System\AcQjDhO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGfwMeP.exeC:\Windows\System\nGfwMeP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXgMRkY.exeC:\Windows\System\cXgMRkY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d32487137b63e716c43e888019475e19
SHA15a9f61afcbfcd21388c33ff96ef3234356e1bffa
SHA25685e0fc4a583ebf29bc8afda46fc4f6e8f0261c6b9d9523199fc597a57ee7c5b8
SHA5120e9af3c365c087a994ed979c21dbece61ff891e59c88a3d4864499d95210157b97e0dec2c38e7cb9210c1969a0b04840a49e0fcca382018b5eb59906b2874556
-
Filesize
5.9MB
MD53703336dba463e9d8e8f4bbfb1b869b3
SHA1b96e775fe7bc7372d2a58ce35538e40acd4be36f
SHA25646921b05fcd9fb4cd98abbab5dad93c7304eacd88876af2be2065b13548b6b4a
SHA512ad3b1ae0c5c9be1c8eb3fe726e8cc22557bda71d0eedc104d692ef63fc70dfa5b68b8e6306fbf9645ae6cc5e4aa0caee4f9a890a21597befb09a72e806f990cc
-
Filesize
5.9MB
MD5be44fd9ea07f0f2b4d9de999c25d9d2a
SHA1b8a6b45cff01805fdcf25c2dfe92c94b41074def
SHA256518f5fca56333758f51389e9f24a1d77ca77ea85bae5282b67d700f865c20226
SHA5122c9a587f294186c0786a122ba4644b1f9e593e12b9b3fdb69bc8bf1ac3ed9d4b4f33c97e1fc4fc7d277ae6fc5c00d18061dd881bd3a0c74e0b266d8d1f99204f
-
Filesize
5.9MB
MD50dfbac2c9fb5e9323457867eee0cd11d
SHA1952957247657b1b8e1dad01e081eef8465ca831a
SHA25619b09048273d2d0edae32770b3ed0642921122d75908dbf328b83be5934d7041
SHA512b4949527b56899e0e4aec6b8f7c20911e480ebd7caf3838918b2224b69f7d8bf1be65a1e0e9fd0fa60412a5687ec47e04973f6e03f6fe8cb60d552902a967c28
-
Filesize
5.9MB
MD58ffc32ccfd60c7905dd22c508747f700
SHA12e102316b4bba62e979c5e09da3af2b2c030eaed
SHA256499fcd611fdc56e397bf46647ca2fa2dadd9e815af984550ebcea99687bdbf14
SHA51252883846386ea086e5a33f11bd35307a242c7cdd259cd0efcbb802d6c91b765bc0c9590afaea7089a30b8efd4e389bcbc341da077a11afe2ed406b6dae4a61e4
-
Filesize
5.9MB
MD5e964ffc50a0c8970e5558f1c354088eb
SHA17ce3a155a01de11679d2cc7b086b246145dc3986
SHA25642285792f8fd9e2da656f4de0f63877b760094b892beaa021f77c94774988495
SHA512b96abef26efc2a0dcaf398a706eadf669e79531d05d01b89728c72376ca72e61c75c92f09412fd10c1163766d7d50e63e8455029d0aae6030bc2ffe1cefcd439
-
Filesize
5.9MB
MD5344806ec23359e3e1c99c7d424e91acd
SHA11af5903868e276210010af49205c86064ba96e15
SHA2567525d2fe54e7a1d99b394022454ef38a4b218a2a885415420cb4af37096b2636
SHA512d465d8d27817452a1366d8232f31ee86ad34b8e1887d894e4bf491ec672b5bd29b18b96d5c8e7c2e7e6ca29b01ce6ca31b8190e7bbe393a4fe6789b3af7631ef
-
Filesize
5.9MB
MD58d0639ff38bd2c3f14228af3f93378b3
SHA142d24a814dfed37873881b95b3c1f58f82750b37
SHA25695ee3835b59e0c59fc345446a38dde039045e8d67e517fb7160f27ec00cb50a8
SHA512effd84e2161fb8456fbf945589193dfc22380f79746169b3c5c17f9ca9a19a36824b28b4318dc5246ce03ca68721f242767ff15fea64d7f7406d270c0840bbe0
-
Filesize
5.9MB
MD5d70098a01c5c567390c421a40eb4df75
SHA1ee78e31052376e1840e427e913583e35ea4dd4fe
SHA256d70422f31e77b99eeafb990c19ecc4a89534456aaf4ec5a227c81e96df0dbc5e
SHA5126fd03c7e7f72d79a662d97701d1947edfa7cab92b0d7163cc631f6a3e2c8e73d5730ba11284869e22e761a7dbe3b24b4382cd32e752c252172f292d9daf52601
-
Filesize
5.9MB
MD5a8dc07705d9dbcfc382e44c8b5cf58cd
SHA18ac577a09ff287cc8d9260561f16dff857067354
SHA256dc279d6a5d52556e3189387fef17029cf5a5f7c20cbbe48526afe5acdc42d7e6
SHA51229fb4e8c4284ce08eea84c44c38893229e528a46dd45e6a7e93e1275a2ee570214a4526b591d67e75e6830eaff76d0cf1f26b9c34d8fc5b1fce291e804bf3a8e
-
Filesize
5.9MB
MD53db4969d9fec8b8cbdd35e3bc7b03e6e
SHA1451b23df4d16204d3b0e16681319455ffb94fd4a
SHA256887d927e03ff9cbe8e3282254b82cc9715b591304767a8fd3e0f841d64aa25dd
SHA5123f07173ae6ed3e04ec588bc55cbacd7f49a34dcf5055c4d17250508cf522fa8e4854154d5887173021b8eb5436bebcf6347d2329f4629992146d1cd64644f383
-
Filesize
5.9MB
MD50281aeb12322354e4fcf135086ee2504
SHA140c08690e2cc4c2ad9e44ec3bed2bd33efcdc6ca
SHA25628cdc8737f48fdb388d4fac9cf6d9a5e4b097917a31b7d70199949ea21775d9a
SHA512ef74ebe061adaf56cc33efdfa66068995531642fc75747eeff07c3cb0fe12feed070491c29e6a3942b016a5bcaa5623d2ed6890828bd929c5fcf7c3b2c968260
-
Filesize
5.9MB
MD53081e01d1c7e571a11838fb7ca298f2d
SHA12d7172baed63365ef469a021d3b49b2b9949d17e
SHA2562d6d96a6b615fb8f077b3de3298041b69e56321709a31a1bf3b80a8200fa0a1e
SHA51216397899f1d718d12fe109275a66da8ea5504e8b9cd0a637355a8f7bc6e45cc30577c76ed773b4938057f7a3aad43728087336815d0de755b9067555ed09ef53
-
Filesize
5.9MB
MD51aa94723e9cd1fff496d3f2cd5b96726
SHA1f672d3bf27dbf257f72ac95d2bbacf92216ab7e6
SHA256f872be688f99485276d3e4e58f7bf24fac190a2eb41c228faaf649121462e51c
SHA51288dc5e173fea23a16e55a2d66bb69955556f7155296ffa8896df1679301ff5f67587a9da81f03fcdd51917d7a55768a292f2fd2e72ac0d4ab72e18f10fd9d794
-
Filesize
5.9MB
MD59295e8a766728aad1dd72ad86985232e
SHA13807ff71535b9b4a0ac99a6c84e60c3c76fb4d62
SHA25678733227e9335751e8554d233e9c4b3fa46bcf658da2ede45c4845cc82215479
SHA512a8722365b5eebb547109c15d89e392eee277fd076d13206e399a7f91f47b53e898b9f3d9d43ed18e284cd7f843ea109fdd4a75ba858f5032985764280293fd5a
-
Filesize
5.9MB
MD5aa56ceb5c823634289945409de89c87f
SHA10baa9b6665f18f790e5c7e4d2eca0095c632d44c
SHA256ac607d2baa4876e1c3cba19e94f72974643e132ed5d2e3444ab71b82ef3ace22
SHA5128f694191579b6eda3b897041fcb517512462d27cbee0824dcfa0111a2c24eaba441b0b450fa334f765b33ed03519b4f482f91721da46850ed4ceef5ccca73b37
-
Filesize
5.9MB
MD594fa39b138314e77d15db5192e7d9267
SHA1b2b1f318e78136636bdf0b4cfd47cc6fd1756078
SHA25602386e88c7f7bb73633e52b831cf80e403f311e44d50cc9f6ae7934f6e714777
SHA512fba6398582f94bae8216b0cd0dc1844e9abf5c4456b2437696ced86be13fe0af42c82035b58c4c3f6f72c9a4c11a15a088f9990bb0c20f3cc3d453655247fc6b
-
Filesize
5.9MB
MD563bf3a9d5339e726326b181bec4b9e9a
SHA1a3e828a4c66bc533df1b04cf9f35231bdcd56dc3
SHA2567a8ade91ed0b9c7293b8a48cf0e55018d4b50141ba002690041eb12621bbf3df
SHA5125b494d3b320f0aad2ca4463979d415203ad2cf291075872227220b26000f5ef411fdb2ca5df9ab2d5509aea6757a648f3e30a49e417f4770053e9f1e4bc7f521
-
Filesize
5.9MB
MD5a2873c8bcad21b55ec8788bbebdfbdad
SHA127ad1e03c8af2fcb06b10040ec70505b6a14f4fe
SHA2567235ba3668fdb658a9700454b1defab41fb4b691d471b904bdb5519b5202e6eb
SHA5120db84daab6f5734bfe6607881a5002b5ec5749bd199c6852e2b401ae96f08d5571f857b7839fcb415e2080d66f60076db879ccd770af5d11961429d93219e5ea
-
Filesize
5.9MB
MD56e28991e97025eab4a7d7c6340682c51
SHA1d7cedbd85fb84886407b43b14b643b017c9fb6e2
SHA25688f13b42d68c339254c925b5eee9c0cd5d44b29354aebaa54a43204e27352b38
SHA512a1b96fb79b2422bf45d15c71968341f67656b3728b9a9c521b84dc64c3289c3ecbb331368f1bdfa05e75257f1cb5b160cac2a6808469117916dd1076bb3df942
-
Filesize
5.9MB
MD5ebbbd635b115d98f7f15fbd1b209be31
SHA126d0d5ee840b2d0f47c3ec2772ae6c9a72137096
SHA2568f12649b99b1acff41eb532fff7fe5ab2b0ac4189283eef677c257c8fa0a5a62
SHA512aae7c62175e36d7412892fd3e1340f20db8e44151227ce9c98eddee74eacd4b93a4952024eebd2e7554682486b6b299b98ecff549ec702c52fc1651de1f8ccec
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB