Analysis
-
max time kernel
130s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 02:26
General
-
Target
2024-11-17_3beb8ce713b641e76cdce8bfe850f9e5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3beb8ce713b641e76cdce8bfe850f9e5
-
SHA1
aaf7ae30f6c7cdbf28c7b57b3deb68991be6feda
-
SHA256
ee33c8b0cf8792b0354d8a8c90408cc87c31b01fc71460774fda8b4ee08b6952
-
SHA512
f5fff824fe004f3d15bf595000476cbad751644171022e2b642b571f0e8cbcfd9be36ccab49d9aa85d9d98b47a2550be913387149c6adec5266bfb43e8751e63
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU7:E+b56utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_3beb8ce713b641e76cdce8bfe850f9e5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_3beb8ce713b641e76cdce8bfe850f9e5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FLVjvMA.exeC:\Windows\System\FLVjvMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RrDzNwU.exeC:\Windows\System\RrDzNwU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eUJzTRI.exeC:\Windows\System\eUJzTRI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LjoWtza.exeC:\Windows\System\LjoWtza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlYgrtK.exeC:\Windows\System\YlYgrtK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuuEEwy.exeC:\Windows\System\CuuEEwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZJhQDQA.exeC:\Windows\System\ZJhQDQA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dLlRJjF.exeC:\Windows\System\dLlRJjF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVDSnap.exeC:\Windows\System\OVDSnap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\heBNElE.exeC:\Windows\System\heBNElE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RimzXPH.exeC:\Windows\System\RimzXPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iesJgQN.exeC:\Windows\System\iesJgQN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AaEVFJM.exeC:\Windows\System\AaEVFJM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsjELXK.exeC:\Windows\System\PsjELXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYXxFGR.exeC:\Windows\System\YYXxFGR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NwRjsPk.exeC:\Windows\System\NwRjsPk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YDLzUoq.exeC:\Windows\System\YDLzUoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXMUUtv.exeC:\Windows\System\CXMUUtv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UWlQolu.exeC:\Windows\System\UWlQolu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzMLakF.exeC:\Windows\System\RzMLakF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMkxUaG.exeC:\Windows\System\PMkxUaG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55f06a97e5adcd616257b04db7096cdd8
SHA1a798659ec15dc8c7c502cc9989fdc6e09f0a09fb
SHA256ece8c55c7d48e8554c534f8c042f637db58fb9431b115722bfc41ce48dc3cca8
SHA512e54411f6113bbc1b64ed55ec73dbb176fa87d1b2ad4eed95c42e8b31ef7ce785ccbb9172a0f747a71834627ba1ebe90d0561c697267ed647b810c9e366ffefda
-
Filesize
5.9MB
MD5d460ceaa9404e097cbaaf987ad7a8865
SHA15949dcf62f61bdb0e946770b475e34151ec5e57c
SHA256ee082e12155ac9424283cbe414d7353420a25596bfa80b521c2b2dd27b894d0a
SHA5129056b6c810da4e6fb115e68da11dc422828a9c2dc7bf21a06bfed88f4ae513cb54e1e844fd2d9da2147f979fad52f79a24174ac5ef61ab52b8a7a0befda4bad9
-
Filesize
5.9MB
MD53e9e539bc9adb3bd85461a255825c758
SHA1d4966ec8a8e16d83d6a5e5263d6a01eda33c2f11
SHA256e033fa19792a5547c9a6d8d4dca41c25147616883473a129bbded4409e1ca077
SHA5126815bd46fb6cdd0cce96c208319a388db7c880dcbec003dacdf00ecd7c44e34790f3666ae059e506c7e037a1e9f0471c62907719b94ffc9eb2b886f08917c0f5
-
Filesize
5.9MB
MD55f582d70d0c4b6aa0a9f94ef5132a9f9
SHA146432c6ea2888a0a8f478e0d53590a879da46bc2
SHA2569b04abb10af2fc99ed7ba0ed35dfc609a290183bfe9725afc5accbec662ea850
SHA51280834742162570bcd809c86d2bfbba76c29c36d4a4e71ceb462c8c20968b1c3a5db89a78c5b946d39143e8999077446df1d7ddfa2c351c566b62fd56402f1b2b
-
Filesize
5.9MB
MD53919dd7d96213ee5920172728580be05
SHA1f16252323adb782ba95a54cf78ddf8e6d671da77
SHA2567312bb4fb1c491d979e5a17e00dbfdda7b4a16110e723bf1901d294cc4f1281e
SHA5128d81208075b5957a0121b2cf65a9ba52a80e8e81c28ea14f9ad589eaefda1a48446164237024d0b4b9055892d737c9cf2a3ac337c063d721f6cb460f6ad9a66a
-
Filesize
5.9MB
MD5f93dff8f6c67d9e3f450457abb45d81c
SHA18f3aa720df59cb9e24295ce5220bca4a262b46fb
SHA256a44d185e27f66833bf222f58f9d0d883b30b3053ff5d69aca57acbca787cdb0b
SHA5123bfa15fea9b1e339175cf852cf9e6f799b4f391487799c8242cde87cb2fcc5fc2d6b78324fcd9a046efcd11dd4b1ab0d449f86677f2261b72e245464cd6eb4bd
-
Filesize
5.9MB
MD5a14d516aa2f3f2f2e1bb611b9b013401
SHA1954615f4fda1b84c8b5ec18ff74cad71d3bcfe5a
SHA256d136a76dccdc5083f537a8ad781f26796dda06fed6aafbf1dac1f65a64802916
SHA512e1ab233850387775d5fa9578715c6db6cd4a308cc936616eaa1af9877744c4b722f065566b2ada4256bfa477b7ff4f631111caaacf23552c9dcd19c322e6bce6
-
Filesize
5.9MB
MD59fdb065d2d4d59a8b5cb7ebfcef56bfe
SHA12a46436f75d8cd6ad4f16c33f6c5ebfb36b68b3e
SHA25608693b03ce3addd6178a05720d842ab3872c998446712127cfefd741d9fd182b
SHA512da3c7e2e1f754075f2dc234acbe84b4f45026660825f20c9c97074e3c4958bdb3fd2890f4df37767b44744f42cd5456f19bbd711dd5774f80500293b43266a25
-
Filesize
5.9MB
MD567b814ae6ac8b3bc1884c6f39ea05b98
SHA1c4426a60088d4166db63901a48747617cc40b39c
SHA256f5a52cddbba3e3eaffeac5fca969c1e8dcb5128464cd09db716ea68434e7273c
SHA51215761359de94c39cf390bc7f3dfea3a27626960fc25417e765e71e1d52ad51e0fd3cfeecf39a326b2b42ca55ccfae83bbc76e62665ae409b3e831a766e21a01b
-
Filesize
5.9MB
MD5c04f3079af6d7bfc62c4ec1440a2f7c3
SHA1c4cc38d54448c856ce8e7ee8a859d9c1039fa037
SHA2568c513b266b685ce696ca14d7c7732fc5a926b10c65433a4e566735fd8ce715c8
SHA512b4d9ae75fad92b68a38d6a6a9b576517fdc925394ad57c1ab731ea42b2dc8596ecf3cdfafd1d635e6d722c0533f16946c198500585dddb195b2294800ace0731
-
Filesize
5.9MB
MD54ddd3fcf8aad2611959b6fc5d68ac583
SHA15cb4e9b09ad1363a3eebf1fd4999283f185de87f
SHA256f65b6cdc5151244ecf5c86a6183b90c5adb1a5db8eba2da4c2d0147813ee91e0
SHA512e31373696c8cffa1a93f8e1b87fd5236b57634c479cec88e7817392886cac2125b5c84534a4bedb74efbb7b762e437e785b1d32aa1813eabe2675f24555e1547
-
Filesize
5.9MB
MD5e1b8bdb153290b53ba3b69e7256604d7
SHA1d5305c446da7b6e496180def23576b73e99dcc31
SHA256a821cffc650503bc3a77bb73de665a22ee6c317827cad183a76140513888492a
SHA5124fa5bce6c4eeb4760c43fb20e4bcbfafe89dd839b41c1f48e0389873638d10fe1f4ee7a10a549634a952d3b6689a162f71423d0c989aa4dfbb1d2eb3701108e6
-
Filesize
5.9MB
MD55f3a0b08a28b484cd1931f62f3818541
SHA1a9d6ea1f0a8ee8cf86492b3b087c849b579385f6
SHA25699e418b14cbeb491fd5e0319f066195ccbe323414bda0a69537e3b6ecfd046e1
SHA512b8399b49741be5e3b7e1ea23e76a3a81e8b7a9de4d8dc6af85ef03e33b91e1ff6c864719ac9e3fdbee5f4f9bdb1e3af6c96a5b1bdd0c8a4aacd8578cc4e59075
-
Filesize
5.9MB
MD54e789f503dfad32ebe3313795c8736f5
SHA1ba1907fc989bcd83acb074125f8969f2760b340b
SHA256f48c8c738343fdbaa215ea7f50e775b81536990d3376030710a721ec960de2f6
SHA512c77bcd72814fb7eb6b7f095e0daf40f71b1dbaea1545a8e2240194dc4a190e8233920e1bd7fe3cdcdd92a1f10378d330c9bf20a391ab61fb46acaef72584b6c4
-
Filesize
5.9MB
MD5cd278af084abdb6a7a793af439f12538
SHA1071e1d48d1b6182d3a1a933e003ff68ba05fa27e
SHA25619da572f00110331078f32eb9c5614ae900d6f8d35a0b74f8ba52ecb1117705b
SHA51261f441441bed4852a1204a953aa15aecd3a1e144ca715fcc9b06e8ca565feba86eb014f8cdbb29207c84830b8275cefae9740a772d7c07fe6b80d2c70ef976fb
-
Filesize
5.9MB
MD54ca96cca90d5e5b08ae30e5798c2f659
SHA17dac227815f38c85eb5b91fe3cf6562710a11e7f
SHA256a6c743e10831748d6e6073d3e8731d292d4feaf37505c493404ad85e8e2479f2
SHA5127bf32156a2da627caa1f503e5d6c13edd6fbdcd2a0c45c2a6659e64c09447304d65e7af553f89b5af8fae53cb2da4972189b1cd516c7a5d8ff0b28b2bc0ee498
-
Filesize
5.9MB
MD55b048dafeddb386357347cc82800bba2
SHA11468e5bda5d95ec8b498375c14b9f6f20fecb7e1
SHA2566568f4526ad04caac25e377c88d6b1033148f55f18280f3ad45de116baf38485
SHA512a94640b7e81749437f0e7c468055524f8f823ef74af3d2ab4ed4469ca2b2207597fbcc0bb259b3ccd33464bf9d86ede14c161e410e3fb9efe89ef4873c673486
-
Filesize
5.9MB
MD539635bba710f375cb4f6cb1cf78289b8
SHA1a000103bf37379f2b443e18b100a64b5873c5bec
SHA2564fa650b2153c462961cd04a502571c08edd34aa9cd9befd29e8bd04dc3df7904
SHA512bcc4de9b2df414c2503ff334808be9f17c8a42f125129bba51e1671577f1e7a5087514031a659ad4406bc1a3590444e0113fb499935856fb3c5f36e4937e6317
-
Filesize
5.9MB
MD58cbc265e4bbd68e57715f13f7d842a6c
SHA1f99a6d7013cd3784df585066c6a9933c88fa4276
SHA25659fbd95ff03ac95909cb70ea0460cbd62e32d8d4d104bd9e6a83107c8e198d1b
SHA51255ad85d11f508bce3fea4fe1ceba4dcf4dcaca26f53fc13657b3bccd654dbdd1c92b369d2f0e6474a39e73487cc6eaf55a73e3ac9ddde63250db35e17af36bd5
-
Filesize
5.9MB
MD50052e5a09c937dc40a0d9ef0c79c5bb9
SHA1bce20eb775ea5d3575687cd582755c45c00e7a2e
SHA2569c279c2a44da7147991d3040e22ef4674bb4a1f17b1afb8fcc99e173e0bb77d2
SHA512bd5574a4be4a12c397ffd3c33a7ecbbf8432ac35bf181ccb644bb886fbb0ca939a2335a39e24f0ef86f2ee34efe1fa8f6caf270e6f21b1c913cb5c5307f3f92f
-
Filesize
5.9MB
MD57d1153640e95c32682907be44a46b982
SHA107d47be878f290f6651def89f7de5481524be416
SHA256150d032b8aa9bac8a74cac1318782fc7173f6de7348869a84953ee2558fcf8bd
SHA512060582da406fc462400ce737110c03a3f1b097bb27f12b3dfe95fb0335180441874d3d83bb69f012f8af0862297df30f093ea8074734e52fd390e01d6527f224
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB