Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 02:39
General
-
Target
2024-11-17_c4e50a4b125be27a6b2e566f11248644_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c4e50a4b125be27a6b2e566f11248644
-
SHA1
675aa29f2831eec576205cd5edbf5c5787ed52c5
-
SHA256
919dc7b21f19eba1e11816b4e5c0d4e08f9f95c05cd1c44a77ef9215955e63d8
-
SHA512
d8e82c0140ccb5679e7a5f3c4b3771f78071dc8a2bf0c6d69bcc18fe4a9b015feb39983e99bd7664c39e71ad25438ab8a4a2458b487de552ad2ad0fe4b55895f
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUH:E+b56utgpPF8u/7H
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_c4e50a4b125be27a6b2e566f11248644_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_c4e50a4b125be27a6b2e566f11248644_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BFoGLKW.exeC:\Windows\System\BFoGLKW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wMDkXlv.exeC:\Windows\System\wMDkXlv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tSEqqjU.exeC:\Windows\System\tSEqqjU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhXsprv.exeC:\Windows\System\RhXsprv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kRNtpPx.exeC:\Windows\System\kRNtpPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WaEzHLC.exeC:\Windows\System\WaEzHLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzdtXgl.exeC:\Windows\System\IzdtXgl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXQTowz.exeC:\Windows\System\aXQTowz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cBrIAIn.exeC:\Windows\System\cBrIAIn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mJhpkxg.exeC:\Windows\System\mJhpkxg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xveLwxd.exeC:\Windows\System\xveLwxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrGQpkG.exeC:\Windows\System\zrGQpkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DwThhuY.exeC:\Windows\System\DwThhuY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBwYQNJ.exeC:\Windows\System\oBwYQNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VckJxCb.exeC:\Windows\System\VckJxCb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NSeRlZF.exeC:\Windows\System\NSeRlZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbYrDbA.exeC:\Windows\System\PbYrDbA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ilgwQEJ.exeC:\Windows\System\ilgwQEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LANmdEJ.exeC:\Windows\System\LANmdEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISpbhsi.exeC:\Windows\System\ISpbhsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIOyRyL.exeC:\Windows\System\CIOyRyL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD532865f0dd1e6d495952da9d349e80878
SHA1693473b6c7fee6a3534b37f17ed00eb5d6e7ad80
SHA256eb3faf3e565304358cb8666bc679ca1d01db472c9c5f021e8ba68cb6c67ffe50
SHA512aa99fa55997a7903bf5955b36bec31dbf06b7337da327a29dab868f6abcbc93eedb87d0caf5555eb609c2a36758473d849f77a078fbfd815238b3e131dd9dee6
-
Filesize
5.9MB
MD5df5454cc0771f233215704a4d4ab4634
SHA1eae06ec00b392e16ec5bb2cc548ee96083a146b1
SHA2566486f74d0e23595adce97904a827e5d52207c9b7837e68398ad12114a6c4a444
SHA512286ee91918f1803fb063488ac822e42c16d8d07b59b9d040ca61edfbbd62889600dc3c58bb584c8b2e7449800d5d13f5bec43038a03a5f0f16b7f0dda5b5f7a7
-
Filesize
5.9MB
MD5b158f7dc02c9fc31e094fd517d95fb68
SHA1e72d8dff386c216a0bcc91de4a12006835a6369d
SHA256475cbd1e7557012f0aa3fd560b24d1acd6e463e1032044751b7fa39275b4466d
SHA512fe9adf28533cc1d5a9864c2c46e98e04f43304c1e817f03822213b2baaf0fadc8b5a8dea9eb350bda5eefd3ef48c37e2fcad76bc8f331d8def88123d1bac8cb9
-
Filesize
5.9MB
MD55405b1c7ff80aa4b9bf5ad9954981bc5
SHA1ea8bb4e635e7ea1b0a36e7db52f9814d7037f5ee
SHA2563721eb5fb6fb518fe22a7ec608356961561031baebe13c16307255209985038a
SHA5122b829f5ddedf4ebc172540a44d05922a6d5daac87fe9ea6bb777c97ac3c35cad4a49e7977bc04aaae1477e8c7e6672acefe03998dd2716a37fcac294989d7145
-
Filesize
5.9MB
MD52570482692b2870c9547178eea38bc36
SHA11e474659c3015e63f69bdad2663faa28c3217fb3
SHA25637c9fa840426c23e143259c77ecf5b5c0832bf5d097e1780807cbb9fc0dae738
SHA512c09cfdb6d7d778f10e789d4b7bb8a1bf6a5c9073c8c5aed0c72d6f4e6f4dd1495bba7040dd5354dcbbc86c09fc6d21da32236ab548ed40bd046bc9c75a955fda
-
Filesize
5.9MB
MD571d25a011791c17db2cd474425169e48
SHA1b5d6e182c5126c8e9f3bcc1b9b728914c1b3b0ee
SHA2566988cdbfc2cc869056061ca7a19d549417a297abe7c65c107d796351d10e670d
SHA51268a21fa77df9855e903fe17b0c7192451bdc8fcff6b7d03793d47f45de569c9ecc363bafe794b7509ad777f1aa8afd06dfb71ea801b7bb9c245660728664f97c
-
Filesize
5.9MB
MD50c9653b8ec5162219e31a6d10ea2b47c
SHA17a2ffeae143476e3c0dcd5794cf9487b82bf64db
SHA256c9f51bae7c7c31057d3d1ab913e636dfe3cfb34a6510f2bb7a2115fa72c5b798
SHA5124e8284682db9c130d4d99fdb0cb4f3698ddfd79e35f2b332a4cdad3efa3ce217750ec3002466c1f18e3bc90316101d5966f3f5658d9adfd190f2ba6366150840
-
Filesize
5.9MB
MD5814e5d4de938b9cf88a900911ff5071d
SHA14215bf68e14e1bc506cb83ce48a349ce79291cc5
SHA2560e4c7803842439fae22018eee7286f0f08bf82fe214306a6d5db8591a7fab1c8
SHA51293bb6bab12815b971955038bb88094a6a4fb26aef74c364018dabaa951788d0a7a90df87acb68c6adce8f224cc8c1e699e2eadb6214755f04650a0b45c4f6a77
-
Filesize
5.9MB
MD5d07636d338b77a6bee8ba98f56e0a20f
SHA12510cdea76f1bbf721fa2f675ca955a44a393016
SHA2565b9ca328fc450f9175e6a29cf8a6088c072ea07a8fc726c968f4d4562007cb5b
SHA5128c3875c7a024e0908704e3a4bba7b14c8337bb8ccb389b30a1687f4b1c64f34d6812d9010ac3652e0f8dc03b5b327200a862e9ccac927ff905744b547cfb10b4
-
Filesize
5.9MB
MD59041dcbf4e07aca0d0e1fba696096344
SHA1cc2e250a1a56796a6d1778e9ce5b0e44b0783438
SHA25665113acd09b46e936aff6918e611153f1332c72ac927c6f6ef5a696781c21898
SHA512bb246594e04633e6dd0e2e3295b6543c7c38f95e1650a38dd44725fff84926e5d12b535c9a411ba8f8332aa48ca8cefbb0e80372e6db975cca9833699124574b
-
Filesize
5.9MB
MD5bc235317688b217d0c8373c67e0fdfd0
SHA10219208f9e80b6e70b9afe22181de39507da384b
SHA256ba7893ffbccc5ee87a1f7a4e97487272e7d2fe116d600247588e75e21e4138df
SHA5127ebd6f8869247ea9d64981894a8cce37b22e1538c1b0b35f2837ae13d9abdc051d81e0008f68c2d7f87c20e9f5cb6b45ac7d61140514896222ae9038320b5cb9
-
Filesize
5.9MB
MD55f01d624d9feaf79d1bfc5e193b377a0
SHA161ff3b799fa2e565e2deebbf9312df3db178cef0
SHA2564acebd8c75e167607dbc0095d0fef9e40374329f3096abad7f4c137d350d9036
SHA512a7faed2bdbc0aa04ee4b4f9c48616726a7dc8275668b8189557191bc2c9e6e1d5596c4130bc1da844ad3aaa8fde5d23cf0db540c7517c868dc0a7b2f511a2a46
-
Filesize
5.9MB
MD5234c786ceec96b9a4f5099ae89158d66
SHA1720cdc84a93d3c0ffda45090e8d2462096d4d510
SHA2563ed6b651e2fa7823340d42a813bd66967379b1d7d4bbdfb0bab349b452d889a7
SHA51231b12d9c28c0836ab4cd217daca232ff115da04eec21ac2f781a9062337e02f527ce85665d561f9a318f470f5e9ab06856e484a932d2362902138f816503b4ca
-
Filesize
5.9MB
MD5cef544d4c32ebe1be393d976cc7d6687
SHA1c7186cfeefdcb386f57c040cd5a68be82530ee31
SHA25690380a30bd182bb044dc1575709ed4b98abd9b1e12792bc719f483c95623ae72
SHA512f70370e43c25f5dbf13be83d4b2f20640db65c0642c4e5aeff728537c9db496933fc6dbf8f461c22a728222917a81f8db1419a295496c822e643e3808a2f908b
-
Filesize
5.9MB
MD54d01d2092a280bafafc999079c861411
SHA1635a173bc5254706988164e5b0e3f14c34c425e6
SHA25635501203704c5bcd214e839236a7edea834c954ac9e97e205ac75185d3324b93
SHA512ec3528f040259c161a6e04013591c4a382be8353c34ddd7ea3cdffd867900a1573d9b636f8e08b5a68a01bbc643c6f20eb80201defe8aadd3b56c306bd097f43
-
Filesize
5.9MB
MD5b553ce94460a8c333a405dc1408bf8fe
SHA1222dfa5f0524175f963eb1ae499994e25e15fcff
SHA256e7963acd5bf55057d9e1f7593532b1ed5c2d9979d07e03419fb9f93c51084903
SHA5121a2bda70c9dacf9c3198f80673c6e3922d92dd907bf5ac3b619aee2645afdd7bf521662af65c043893f252202f6ae2804520eb16db82c20ca92ac4356f09b614
-
Filesize
5.9MB
MD555e8edd2867bdc10873e8b41ad68904f
SHA16f9a7e97904d33a25d51bc5c8dc989f4d7c2017d
SHA256ca64642b089c7ea0d0052437d81d6aa740b556403784fe597c23a14481a75ad4
SHA5124bfe3a79d4661fb015ae739a9225f4441d9b137950ac57da341a7f640919804da34cb9d1a9b03e370d113e0bdac1c697684eb5fd0406433bf5d941ac829c75d7
-
Filesize
5.9MB
MD5a35dd9cc7f8aaea8597df03edd126a6a
SHA101fbdc7f2cd1f3e521c9bc2098f35e2f10ba3664
SHA2562dcd95df5a77e852c0f133b441206966b01ae8dcd256a14d44605b5b46d83f5d
SHA512a7c43020678c556bf400c780fac2d0e5137c3b89e05f71fc168f7ab8bbe129f97479f6209c429622bea7ed0fbc5ae7801135d4cc7eca037edb1d927c19dc9e2c
-
Filesize
5.9MB
MD52849a82302c7d96c97ded27b878c44e3
SHA1f6abbba414a9508fe0bb8600e8f538ee9050ac80
SHA256cebaebc4e2b46e1f1b71855120d8d43a28b005ef8cdf82ba7f4e1cbff1a48bbc
SHA5121db092bc376dc7b444d052d53684c4de1682bd02ffd1628c908c39270a1f48d5731eaf5d8e28784139c4f2efcdbf22581bc660cfd3cbfae1bd37d7d176d901ec
-
Filesize
5.9MB
MD590205ea6d4ca50086a98eec1a79bb457
SHA1d2bd7f6fcb50b6af35c812866c4246c50ec4222d
SHA25673861df5c1af01eb6018caff2c1f24d7db73951a21230cf28a229e1787b829cd
SHA512bb54b4be68c9df5433666c5e7b823e3fc2420ba259f2d20235eebbb9024297466bf99e7bb0ac6d154f23707556a7727b82b72267d6c37c2d3ea97f96c10857c8
-
Filesize
5.9MB
MD5fdc5b768c2181d23f9926a41ac2b2873
SHA1edc8752e3962325c26f7d6910d6b101862df2879
SHA256acf1e4634a14da0d714f552d6f5e0803f7b293c7a4b4dc903d11f702d9643922
SHA5122097c553f8bbedf4204c3786b3716d941ec14206bd609dd0aff7db2a21b7a14cb546630c5423fce5ef6f7f275ee7a52e84054f48c5d8ad9e2e88295350296721
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB