Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 02:23
General
-
Target
2024-11-17_036f3860dd51f371057b1fa8c8b96c5a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
036f3860dd51f371057b1fa8c8b96c5a
-
SHA1
a15ad9d18fd168df070931d719607fe21fc52a5c
-
SHA256
6fc3f35f6f5b40041547ca0a852b7fc37b57eb83004e7fb94877e1b029c1b3f3
-
SHA512
c7e4007a5ef8a8afc8b7dabe6ca6565b380d1e61c957ecfebb459cf36d2d9ec4d144e03f3f1110e0b02a0fdb6b6fb0203707d3391292d17439ee53b3be3602c3
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUR:E+b56utgpPF8u/7R
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 61 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_036f3860dd51f371057b1fa8c8b96c5a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_036f3860dd51f371057b1fa8c8b96c5a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\arpTKhw.exeC:\Windows\System\arpTKhw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJMJhsT.exeC:\Windows\System\dJMJhsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\crUfEEE.exeC:\Windows\System\crUfEEE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wiapFkp.exeC:\Windows\System\wiapFkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAQkTDr.exeC:\Windows\System\wAQkTDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsOPJBC.exeC:\Windows\System\IsOPJBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UFIoUOH.exeC:\Windows\System\UFIoUOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyDGeEb.exeC:\Windows\System\gyDGeEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xObsuJa.exeC:\Windows\System\xObsuJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnbCIuV.exeC:\Windows\System\UnbCIuV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xmzWSCv.exeC:\Windows\System\xmzWSCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOBzRbF.exeC:\Windows\System\pOBzRbF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PgAhifc.exeC:\Windows\System\PgAhifc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yffyOLC.exeC:\Windows\System\yffyOLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Rbcdded.exeC:\Windows\System\Rbcdded.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RGiClzy.exeC:\Windows\System\RGiClzy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWBWLHX.exeC:\Windows\System\cWBWLHX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wRFMqwj.exeC:\Windows\System\wRFMqwj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vflwAbo.exeC:\Windows\System\vflwAbo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ONqreeg.exeC:\Windows\System\ONqreeg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rrpMwtg.exeC:\Windows\System\rrpMwtg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55a9fcb7c33d24841f1e1417d6f1bfd6b
SHA12be42fab2a228214b62757e52886eafff76b365f
SHA256e9d91ab94dcffb0255319fbce63f1c2ff01f9b2b0448186f0a24c2ed6b35dfa4
SHA512a6d5c55d2818aefabd76a3fe48bafc64fd9a3a93a287ad3e53103221c3fb95405ffa019a5abe6c302956db679ea304d36633f65f72b2509b37178b93727fe24e
-
Filesize
5.9MB
MD53cc5dd28401750929c3836114965399d
SHA122167085e28736c5759977eea209645e38913b72
SHA25615abf0da5cb7909ba92dd1ca07604f221e080aa9788c289a416b0eb7bc62b46a
SHA512b5153826ac34283fa1dcf112e01d9f0eb58294b9c83cab989d816df4e161194986bd477eb50c5d219177b0c09d6749ba0933221ee9324592c8770a077c8babd0
-
Filesize
5.9MB
MD57f0136ffbe16d31bff0da321056c2bad
SHA1930eecd58bb2b50574c3c2be4f289735bf9d5c68
SHA256c177d53c53f33c3f8aca14b94458051d3804bc496f14d1ddc767ac53b81b8e49
SHA512efc4a80ba73b36dc90f79a386cdd26a3bfe21db85916855fdf9d7d67c966d61e773e4aa1af870da2008731ef5aa6bf3f056f348d40e49b58e8a72091e3f6eb23
-
Filesize
5.9MB
MD50c54b07489c383bf59aa4d52343ec747
SHA128c1521191aafcd39bd52d9d13f8146d54da15eb
SHA256761878048a3d206a246104b07401b9c88fa9691684b1475f7927e33d8b9eb7b1
SHA512d793bab1292075c60543dcf131a60e0b5fecc3da0624cc080be9566ccc2bb5441a39edc0afc2455e5598b37271ba7cefb256f42a06bcff9cc5e69d5169c9512c
-
Filesize
5.9MB
MD5cef5f014c4b940398be1186dbb7cb9e1
SHA15f6776860ff338f74c28bd601d470389b7e69c3f
SHA2567046f66962cc8d3bae6dcd85464657ae40da986b55554b0c58be829688a12804
SHA51233ae9a28dcb0d36b420b23b2957fe76ebaa78e0c1ab79089e8d545c15782049c617f3b6d518ba9a5033fdc62e72eff24121b6811a36684e404a210ded0de248b
-
Filesize
5.9MB
MD59b50ae4492efacfc44b0efc400f6b215
SHA112e0b329de5b2fcf89d6e0e858e39a16c670322d
SHA25655b6373eb8ec6ee712b673349021a4e3e79d481082aac547d6dd702e32367b76
SHA512d20e10a7aec98be9bfc21f84443e8a8a6ddd695c2bc53fc8b5fabce12b3a872f9ce40807eba502748989d1f6d3285ea3446a984d1fadef79ba700b8c47f9892e
-
Filesize
5.9MB
MD566cf39ea4223e09fe2a828b45e51ac98
SHA10e3c187e3da71f788af07d199bac30043b270d19
SHA25610bb1a50b43cbdf40aa9c4f3648e2ecc257bf0b8589a1cfe61f4705634fc4301
SHA51204be2bc5663afc7d5f8c31f30c8b7afb4b818e4c62c0ca82971ccf84f5451716aaa4b6d223bca13dbaafb4eced0eb6051837f21d78b8c118066c5427b4ec97bf
-
Filesize
5.9MB
MD57958d71c89584070d5ba71b6a3bd85ca
SHA1b1d75b07f31f30fb6e392e6d515905dc8b1d9756
SHA2560482d7aa80b2c22d5c94cf2611c05d564ead3b8b531db0f4b76812faeecf4680
SHA512392f52ae40ab60c20dc6a6be3307c1df63216e14056c95f293c247b55248d32fd78eee2c72f117128a34d9741990894dbed96aa456acb883678b6a527305e814
-
Filesize
5.9MB
MD5a2074593d258640dd5d4caa224834315
SHA1fa5d5fa40e9720133cb5b86d9b70065d0af8e509
SHA256196446958d7d0727c5012a664e96eaca7e0bd3362dc3538674ca1da390ff8c50
SHA512976ad76827ca1c138ed8be02cdd7c74e40defea235b36d06aeb3cd322f8b46bc598dd0fad23971a863bed1c9d7a9827c1f24b99c8a79ec7c3d012413fd483e48
-
Filesize
5.9MB
MD5dcb9d721d293fcd34b0287d7550b233d
SHA17412fe9b7593748e8cb9a7f623d0cc731e96c06b
SHA256fedf78f27db3571f7bc13ad39e23a47f1b834582979f5784ff942ff71451c26d
SHA512cff81beff464445941c8731bffe9e8c9898b223173a6d0441bff7ae3c9820911fb66871ced20b822c97962efeebd018a825cbd877a81bafb1f2531856a0cd06c
-
Filesize
5.9MB
MD5b5d0779b092e9330c1072fd1e4a965ec
SHA1b9e3de27b0f1e43c4e768e4308baa08436e58a6f
SHA2561e7b98d7dd1fae3ff25f145f3978cffae3309a5794b3f485924233d4dbfb5db5
SHA51290c236969bd1961c7b85c85d968e565dc718c9397f308f2952bec3e785b707d854f13d49ba5551ac66e6550ec4d9a8c4763cc72cc88b3c5b57e623786f34405d
-
Filesize
5.9MB
MD59e2ca77845d9b77d5c5fc5dc3c55ce67
SHA1a0bc6e4aaaae4cc5177f42a27d100fce3c9dfe6d
SHA25607f9c31da57c441d41506307aa1024adba95c33c643504848355900d70a4c064
SHA51291586a87db63a72dd1439cdf5a6e3f057d7a17f96784a8e987fec2044dffa8eedbe201d68025d03c0d1add733b398ed05ff735fa4df1e835bd793f151b277dd8
-
Filesize
5.9MB
MD59cf3ee9a82e0ad8ef357240af2950a97
SHA141a769fd79e361607f6470ec91bc479853fcf172
SHA256c33dde2eae0d0a46363df7324e81a0c98c20145d26ea70142882b400f4e320bf
SHA512a991b902a76e69692a2907087e598f101cf220db326027b0fc4d9825e378f923a7874440b18d7381241ca56e835fb54da6c5b06d7feed536633ae913baf45285
-
Filesize
5.9MB
MD5149d341475cf8c76afe7dfe8199f7adf
SHA15324f8c67a8c38b25bae53f1bda86bb6da359b20
SHA256e89ba7c4d664cbbbfa334f734f108de0254511e30238a469614b83eaf69ec8fb
SHA512119a9c3c87850119edcc6c10804421ba2a4b74317a67ae5197626774cd98a004a00efea426103de678105406bedd2872b65c2381ecbcfed80ca645f6fe5cc114
-
Filesize
5.9MB
MD5e56ba5852ea5df3629811aa18510575a
SHA1126a6f174e08f15bced029ea3a11a55c70b00b06
SHA2563460063cef126c390175084ea10230680836907016834d605e02d8f9e6857c93
SHA512fe42e2344436f222cf5cd8596b0d44b1464cb8a31e471c5fdba83e0dac2c14738c709efe4805df598eb879cd21c57853281a4b35fdd23d1813f098b4291657d1
-
Filesize
5.9MB
MD592efb849664bddba0fc8b0846e3ffcc3
SHA111bc415fd33478ca3cb68b8684c93b4697244d82
SHA25626b2831c1328ce610d6d3bfeb50a4b839b44195809712f4a9e2fe32bc87fecff
SHA5123dcaf2d8a762a26e55fca7a9bf865702894fe516c4451c83816b77d6d9264a03cb2a668224ce10567d69b44fb98f6e2d6da3e57e7f450f8e7604450036878ef0
-
Filesize
5.9MB
MD5bea26740107d44c4b4a868fa4a244901
SHA19e0d0ed8e23a969fd8d24f3735f9ef82c4deed9f
SHA25692a8969efa5b7d12a53cd998c604ee2144536072183ffe1e1b893e07fc697b4d
SHA5124fd52d0b3215c54f9436eb9ea671698c34c86c049a1272f0466ac1624ef0484093f2709d84b7ca831e25f411361e9cfc18f7e6cd2f69691208b025dc268c3013
-
Filesize
5.9MB
MD51b3ecbfa6c7ff6f83e9c8a84e9fb7752
SHA1d8840308a502062e058449d93a987d668a83432a
SHA2562381218ddd154753916e20a77d078f5bf194de88f609f33b2845e7b3d556514b
SHA512b1f5e90e23be859abd8e7f839f4708fcc0f44a7ca18b7e216f2621757e826dc2728540acbd98d417d25ec0b6328f98c692b30a5b6f8e5c7c8a2d35fe5bb497ea
-
Filesize
5.9MB
MD571977e80a4a9930af30df9ce47ddc37f
SHA1b205281d681cb4c49a7f841b9c7f248c64db7b1e
SHA2566778cbe474159f5e46d294ab70881d338b044a6484809f80ce724469c3af0ee3
SHA51235374bef5d39ab322f34ab2c630103c6874f79ff77b6bc65e2f48511c901e2f2a0819c1f8bd9bb85a43cb71648c02df0b04d5648a45f0ef1aa7073610ea72380
-
Filesize
5.9MB
MD5a7cdfe370c857a540c55e4fabee7f778
SHA1f4de66678c56e1e273010b627f7463cd972eb17d
SHA256e4a15102c725caa6e177d665b7e6c6b5d09b1866f7d2abe78488ae55c56d6cbd
SHA5125f3d221f479ebc548a7b0fbbcf1f63515aa1cc10741f8d8cdbbe69caf869f41482e0a00aefd457aae302b68e50805e696437afc011207497c8d50004c83a5ae0
-
Filesize
5.9MB
MD5d4149796b62204ab5a34b2843ca1639a
SHA1289259c719f932deaeb34ad4b571acad3d3ee7bc
SHA256c7ead1838eebd3f590dbef1091a0490a3e0fe6caf3a71f7be07d3d553456c99c
SHA5120bd58495c277e534b2e12e4e6f1cac3b48fc406da0c9d5e5c360a24f5928d9161893408c75c5510853c903771c65e0b468f4608198d199c858eaf0e4f4c1aa68
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB