Analysis
-
max time kernel
124s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-11-2024 02:40
General
-
Target
2024-11-17_cd6f8b008a8dc37a48d23ec1ad7dc6b9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
cd6f8b008a8dc37a48d23ec1ad7dc6b9
-
SHA1
78a4e13fffc713907ea23e1f84cf4cfdc635a271
-
SHA256
64e5825895a8ac94f0ef4785821a017415c6aee14e037c180efc540e80d4514a
-
SHA512
26eaedc464de88752a3d1430aab798ff1ce7ca5b8c3f466d2f5030ef00b07ace696c3290eac68c20b85a440ba295d7169df5fbc0757416e3820dc56befc085c2
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU9:E+b56utgpPF8u/79
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_cd6f8b008a8dc37a48d23ec1ad7dc6b9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_cd6f8b008a8dc37a48d23ec1ad7dc6b9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qgZyrtQ.exeC:\Windows\System\qgZyrtQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oRhRpig.exeC:\Windows\System\oRhRpig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DLFWVmV.exeC:\Windows\System\DLFWVmV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GsxpPsg.exeC:\Windows\System\GsxpPsg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBukEDI.exeC:\Windows\System\EBukEDI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HGnRkji.exeC:\Windows\System\HGnRkji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kZDmnFC.exeC:\Windows\System\kZDmnFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zEDLbXE.exeC:\Windows\System\zEDLbXE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LPHGyKs.exeC:\Windows\System\LPHGyKs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hSGNYTU.exeC:\Windows\System\hSGNYTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jWBiJVu.exeC:\Windows\System\jWBiJVu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ulcgjVt.exeC:\Windows\System\ulcgjVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpKvVbC.exeC:\Windows\System\mpKvVbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UALJWnf.exeC:\Windows\System\UALJWnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CltuXGl.exeC:\Windows\System\CltuXGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sLIToTH.exeC:\Windows\System\sLIToTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYCqWhl.exeC:\Windows\System\uYCqWhl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uibuvQC.exeC:\Windows\System\uibuvQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OJIqZwo.exeC:\Windows\System\OJIqZwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VhciYUh.exeC:\Windows\System\VhciYUh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iTQEmkb.exeC:\Windows\System\iTQEmkb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e26e25439794e56d78645f15533de75c
SHA1d7acdd0d3b0c0185cedbac36d0f9e6721e7565bf
SHA2561b96bed7828f85bfbea9ccf96d8819188c4047800e85891b19aff245fa61b877
SHA512416f7de019d294398b7a8fd5b74d233a9d1d8ea728260cf5bbe6075be4d988aa014888ceb155b8accd4382b461b95680b27ecfa2fb5eab9596da89ec7c18e581
-
Filesize
5.9MB
MD55e32ea4a1c6266fbabcfdc9567ebbf21
SHA10374ab790a5a4d528172120cadb497eaf0fce6a4
SHA25633fec23e7d28251ff44b18b215f1db71086009a1e71a9dceb01fa7602ac8f3b7
SHA5120214c67e400d9d93b62870a7aacaf415f08406da29fbe87930cf8fc27eeaac8048373fbb747cabb2c59681c507e77212f35d0527f5b3ced5458d7ce5211416fd
-
Filesize
5.9MB
MD5291dc850623b2cf6cf73713d6d18b09f
SHA1da450bf5cd8aae6ea81f2f4d722b784078633f94
SHA2562af1266f67dc98beb01b72481fea4c1fb3c5071e7f6d0b8026041e443f941b4f
SHA5121bc2658da8bc64253a5af99f3b3ba939f83db299a9f3d85bcb8ff489c28d8ca95f89d6fe619d498fd3870829b036cb2389f81b0684eb9f2480a4c90f3fcf4e04
-
Filesize
5.9MB
MD5877b585362bb387b7524ba2a093d3be1
SHA1314f062021d8469062a46312885496efcf77c794
SHA25674ea0b6d622d790ca4a2dee02f3f5d70b43ee75fd6afa2400403081b5a6c18a8
SHA5128a9cfe80bb7ccdd09d3149d3b89332c9862c9fd4b222039ef0bac3bf9b6487d94f0308c5d7ad5a6b50524fbee09ffc16475a28005940740f506645a97c66a523
-
Filesize
5.9MB
MD53cd7118e99a1327bc84ae7da7d5f4abd
SHA15bf0ee231a1221ec58ac59efd6b4b21daa800849
SHA256c558ab5c78df33b66e6a9a69f7d36f5c11d9ef3531ed5a3b1c9ed56093e39a36
SHA512eaf57d2686f8864cc41e390537a6008750e007d54df122c9e4660bd2727e2cb435fcc93e94c193752f046b81e7b18c0715823b271eb0cc2f5a35ec2974c7a88f
-
Filesize
5.9MB
MD54f5a30fe8e1f300e85168b223a7bc74c
SHA1b6edce5f269afd07d78c0c50c1f70a937a77cb1f
SHA256542ad0ff4e61e46ae58b6d0a5b991507f082f4b77923f3bc1c2b65c7fb725075
SHA5125e15994f51c633cce05e6967e875a46b9389aebbbd6fac3c73932220d7e388965ca414c88464312e15c10a8857477008e1c48c17e3869b7ca1d71978001d32bb
-
Filesize
5.9MB
MD53af4ef9e209cf2017bcf9504aa752976
SHA1293affadebd4a856b82e7f75cce25a822c446bcb
SHA25698328445a00730aa230684e159b2dc7ef04c227737d59917abf2f55407965aa8
SHA512809d0d1868ab0f1e66cebd17c85239d6ac86ffbfb5ddb6942bab0c9b2b402d145b7118fadd51e4de67e0237ad76a4a95a2591f42449b37956d070484effb9fd8
-
Filesize
5.9MB
MD586c7697b0872e10a7ad04b950f67e519
SHA1e75856768a85268c9a9d48e4d3a17ce5eab03bd8
SHA2568a325604c7d94cffd435829d998aaef1cfbb057001ba4f8b0039e4cdeff7a615
SHA5120a85a8dea9d33d5b2f92f7689a5bd3569f7bc2c3842c2addc5e4321bbad41d9d527dc7249133377ab534297a58ca6287f0d12787d5e66de40d4091feb6e66dc2
-
Filesize
5.9MB
MD54d2c6356460ee86d68777f5af849522e
SHA1914eddb19570c038398e5030d3fdc74420a71fc1
SHA25606eed998fb2af83ccdcfcc163487657c3e8102dfb51b61a82e06e059e006da38
SHA512614b48e8f3784142868571deea6825bb536b27cc1817ec7809327dc3539e04c2baef1b54e64ae87e8943cd9ea2fc20210691b916e34cd41fc9c51d24475a2da6
-
Filesize
5.9MB
MD5f5ab9bc62a2bf765f08aa5acff9556f3
SHA1f0f68dfb694b6481d567dd14cdba6ab245d3f637
SHA25608032d80d1f70553c901858e0bbabfd2e5380c098af73ed1fbd44ca4e1575fa4
SHA5128d013be06c73ff33237327ef9c8c3a7d9725506f56137b66a5a6392e08bd72c6b11677c3a9a187c9d4e96403d931c31127e802435ec42fb9b03f753defe9e5e3
-
Filesize
5.9MB
MD58035011094cea1e262e67cf0ed47cb5a
SHA1ea9caffb2bcf967a2bb3d5441302b56d0fee94bd
SHA2569de79ebe6c192b460346f3d196d85538e8902cdaf96c6ed644a3d4ee13129eb8
SHA512368b14db3ba1d692fef5b070e08b0d7cb191801230048db539580624236efc6d95dfcf95c1ad70f75a78a8fcb6212fdc1d53048bbce787d7c2e7bad23590c9a9
-
Filesize
5.9MB
MD5a831c4341ed3f022cc3c567e0be3422c
SHA1d2135ec3f31c5e24b8ee82b3c2c57dea6334d322
SHA2562915015854b42fb394ca93ffa29885e35916953ecf2c0e86cf3cb6f17077af55
SHA5124b593dceedd1d14958b7e602564f47dd7540c6116bc62fb2555b1e8cc11a0bde480ab66506fde0f3454dc5a7a632984cddf5f1b8dab81cbc3646d4b6edf33395
-
Filesize
5.9MB
MD53d8e98f39c5c60240d45438b1bb75fff
SHA1e40e120909b95467ca50feb7f1e40f66e1d0ac41
SHA2560d121367edb83fb723bf6711287d988f2e181a3d2a438d9dcf2169b042716444
SHA5121eee7dccef7c1ae0cb1cca8f5f4a8eddbc4f59ca3a3ac08ade110ec271506ea5247fc1e1b186b6520eba0ff9374cf10cc382ebef27b706a7e1e9d3ef5e48a48d
-
Filesize
5.9MB
MD52c2bbf93ea49a209b4f6540183f398b1
SHA1067733b3e6932d0e931cf54d779bb0488bb38e27
SHA2564da97fc9ad6bfa0b49ec84a2f57e112ecdd7e958b1c17ca6061fc1bad5eb2b0e
SHA5127e40185ca2328ddfa7dfce19579b672208795faf4deda4e2e39009dee935935a871f6df988a3c5d1a0bce4f8d700cefa2ed8afa0f7e56979c7ad3d4f0ee651d0
-
Filesize
5.9MB
MD51afad947a2271e38fac7b3a22917aebf
SHA18087085ccd5b868c6c91e654d0f867b1bb5c1069
SHA256bc4195480562123cce39d449ea6703a991fba7ff9f34a62d4ab3400a1432f4c8
SHA5129c4253037de80dbf932389034aeef30403d1c126d64184e3fca03dd4caa15d9bd02e1c9a332d3893c6143a915d395ee447de5b8256b9d6aad6a7988126cfa99f
-
Filesize
5.9MB
MD5b4eaf28304c6f3ca5b6724ea345b888a
SHA18d0d8be39c6da36182c97d58806176306a9345e8
SHA2565810c16889d20757441a782454430fd96874143ba120b74ddec18e8c00afca0e
SHA5120115720ba57b6a0ad7a2a35984ba6b7c5f25f1c8fbe0fb303fc8e8a0d743398c574482cf4c2a7155beebfe40139a3884619298b78e9cd2928a4be8cedfce4089
-
Filesize
5.9MB
MD59613d05fe9e2d55e15effc56b41030f4
SHA12d07fdf4addf47a0e0c74d1ef67557ab8ab03993
SHA256fe85dde993678be3764f30df9de2ef08c9adf73c2fc23d76e29535f27b802aac
SHA5121a426b8c8996d667bfa99bc0660e81d2bcbcb7fbf80e8686c7fcc9118fe0dfceb878d106b9873d4397f9c853f2f9869afa3637f069dd36cc83dc66e3d2b48819
-
Filesize
5.9MB
MD5ef7a448b96e4c2d8e305c67ee297f38f
SHA160cdc61ba4afa67805efeaed2ac24290919c6986
SHA2564c6488bd840105e69adf7dd55eb9ec3acaad971ca406b8ed6dda482153bfa078
SHA512101e8c08ea51df6bf702d4a8be19b0e8cd6f706c09568761d99c23b233d2217c36c2b9d837e08191e992c512715c4d92b3d99d1a982106c2e09703fdd695a93a
-
Filesize
5.9MB
MD52d5113c7aaf294206801542709049bf6
SHA1202e115084732f914c678556eafef87f0118014d
SHA25687350d5488cc836af83f4616585ef763309881aeb99c879f939cf8309190619f
SHA512ad231837e03405fa82bb1dea0928309ba5dc715c0670f5758a054de9151bdf0b036388f657eb8b7dcd47d051639491832914a4bd2e989fe4c63b8436e155a104
-
Filesize
5.9MB
MD59e808ab485f8103ff4d8fc64d9dcb6c7
SHA17f0adb319ea58b93df20d77a2db4392fcef82967
SHA25676fc883cb13fe41a13bb691d975929ed40bc1c4ff382ce9497eb36ff3663e894
SHA512e339ea17baf830f9af97c63d155667a013db0eb5bed5117645871f4874daee5d247893b171f83b3253d71190878f28edbf245f704fb7086d86bebd6e768250a0
-
Filesize
5.9MB
MD5c74fff5e8b66914606b8daac882e6c65
SHA1329fa95f57a5069bd2590a864a058981c01e170d
SHA2565669324405a78973ff074511593c087ba270e23efab0b9235bf9758b564bc3d5
SHA512510afaaae7f858c1ece31758af78fc31c501eb920d461f8ac970b09193f459df14e96e5098f9e9e991b283496f80094a8d0f46f36f948018ea45c7040edd9919
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB