Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 02:55
General
-
Target
2024-11-17_bf5f08cc0c39a143156971c903e1665b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
bf5f08cc0c39a143156971c903e1665b
-
SHA1
3a0a982886cba4cd728aa7bc21d83fa1b35b1913
-
SHA256
1cb48a8b316c729ecdff72dfb1ac48d2cc115cea9b635c086d243e88c21bd2d4
-
SHA512
8311c08beaa047c39a26c1090a890bbb3e927d1f43d2f5d9e188060329b6c5a21690205d9db2e3f41a3e886d410d6e99eac3650eb470a63dd86cf10c04846250
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lU2:E+b56utgpPF8u/72
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_bf5f08cc0c39a143156971c903e1665b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_bf5f08cc0c39a143156971c903e1665b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AsOhPlu.exeC:\Windows\System\AsOhPlu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etJlizs.exeC:\Windows\System\etJlizs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rAHtPOf.exeC:\Windows\System\rAHtPOf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gORKNht.exeC:\Windows\System\gORKNht.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MobGSMv.exeC:\Windows\System\MobGSMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LBxxrYi.exeC:\Windows\System\LBxxrYi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mGOqJOH.exeC:\Windows\System\mGOqJOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XObsXHF.exeC:\Windows\System\XObsXHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLqiYfo.exeC:\Windows\System\iLqiYfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mpXGohp.exeC:\Windows\System\mpXGohp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gwRuBIr.exeC:\Windows\System\gwRuBIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VzkOryK.exeC:\Windows\System\VzkOryK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdSvdjk.exeC:\Windows\System\gdSvdjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iumqSLB.exeC:\Windows\System\iumqSLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zITCdeO.exeC:\Windows\System\zITCdeO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eatqqiX.exeC:\Windows\System\eatqqiX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wiOLxDZ.exeC:\Windows\System\wiOLxDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pDqqESx.exeC:\Windows\System\pDqqESx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KtdlBHh.exeC:\Windows\System\KtdlBHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xArQpii.exeC:\Windows\System\xArQpii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHbsJkz.exeC:\Windows\System\sHbsJkz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5a0d89ff6355919112675e03d874c8732
SHA1a5f974c0e176b9c7913ea7922854ee16747697eb
SHA256348cc2a5fa4a33366f11fe68f69846d2aa06ffb5806aeea2808db3be715c06ac
SHA5128f28fa15ca381d6816c8d9b4f30c03596f179bd7b7697833834d230171eb487f9fe2460aa3b3f0d1b44bee74a662d6c89a8405b3339c7b20b438ff839570aaaf
-
Filesize
5.9MB
MD561c34cb5ddd6cafc54ebc172c972d644
SHA1a987d3524b21190cf112cec149e6a1d103b08b79
SHA25677a4783db0ea3fb271d4bbeb4098d643516de0734fe0dcc513b498dbf08f41e9
SHA512cb9e0b567a3647388d4f6dd895fe8eee0e138393e285053ac0ebb27e5926760c52d81b44e7e6ef2830944e54994a1b5f7c184e76ebce00ec51fd09150da5f57e
-
Filesize
5.9MB
MD5f8d779bd1e50a1049c09f31a78c55820
SHA1095725746324f727d0202e0f7506ddac489f4f36
SHA2562ce56ae135c66612b33e02d9f46e7bd7dd2cc2090f01e4f3a87b22bc0c4da323
SHA5124aaa7d827ec18fe12a89ddb6db586e248fcc160b40cd484901b8bcbb41fa283984196d382c1b2054fb819366b43db3f046dd512da3d65b52ab4b930b758efe89
-
Filesize
5.9MB
MD542f982e65d7a60a648d93b922c10ec68
SHA1603c7b6ca6d803ca98cc9d606a0788f1ac6f8aed
SHA256ba658fa9761d34d8eb48a8d4c920b9db2eee2f458e5f8ed2d56affc76e8ae8a5
SHA5121fdf579f5f21c0194815c00641f2ef90c07562a9b667b40ef5116aafec41bae463dd80919dde5baf71a267f4eaa23838997d8fdff8c6738e82a9cdebd2bb2891
-
Filesize
5.9MB
MD5ffbc029ca617b0762e3ee37c31e20d87
SHA146f29e2fc298ff71569fcad68c4eac0608d3b3af
SHA256b20dd410f6dc54827116b1ac228043a8a56686f6245e39d78cac5d8e7236b5ff
SHA51274a9fc9999129bebcc85ea31c492f8d3c1bfb0e8c55b2a93436cedcd9cf7798757b7be5ac62c1cbcc2dac77a21dffe4c9f7b74fd71d3e90cf3e7b51c960e7784
-
Filesize
5.9MB
MD5538b525f475c33a183d7a65abcecd4b9
SHA1ecf15cda9f7d58b178fc366bfb03057ec53f6b21
SHA2561729f8be84babad2a1a29408ba3a9ff996ffa196ddf4ec75314c1612da84c946
SHA5124df65334fb0186ea472b7bd479eaad75cd27692ec842d6fa53d18d6a6f9650b821b7b015ba3f2408ce1eece01c70dd916936f08750cc4864ecef9737e3d25eb2
-
Filesize
5.9MB
MD50eb0332e7f5d7961ddb37af02ec1c5e7
SHA159e0913f398dcadf35a285f6e39e09dad5f0421c
SHA256348c109b2a1c865f602fd720936440b7a25efb645b6a2c005124f71ea772e500
SHA51220375aa0a8129a5ebdd584532cc403dba0b05468d19c2af5241e81b63e692da261873ac9c15ad35497a87db949fed8d008230b17b0e1797948b45a841dd157e0
-
Filesize
5.9MB
MD5cd0687e08ed60bb4643ab99991825f6d
SHA11a45a46d9c558dc8bf82c38c2afcf72b680cd386
SHA25688cb47b0a23f055152fe5d6605f640452d3db96fbcfbbc751345c1bf747b9cb3
SHA512708f7d32e37ec66cbb066f579370ec71d49bf54a13dad15d252a040cbca214fcccc482689a6c7f2a8943eb732e6a36231cdbfdc4655723529723cbcb76f8ca89
-
Filesize
5.9MB
MD544a2f660a41eb07cdf1fc23c5eba39c6
SHA1f49e7206f6d1f09c2fd0f1f76ba3e3ea2a49c216
SHA256eac50f89abe3a216b8ba5b381a59ddba7d66b1810fb4d5d2d37b4940d3bb6584
SHA5123a221b6ded5823a342e82d763d19bc517043430525d909658fc852c40a89cd68afdc59518f7cda6447d9b15756f6cfd84a81dffa677111e6f0191438bd2dac5e
-
Filesize
5.9MB
MD531f8045ff1669715d52de591258c60bd
SHA171c3a761c461e733d0a0d8ef2244c14944435496
SHA256918d62b212be217f9d4487680d4c8500fc6e9203aecbe6ccbf773cab6912d02e
SHA51287322587a5fab772bfef601048717eb81294ab6d2c8d751bb28e37b649a216a80490c7d1dd8703204aee07a7cb7e1c7b1372395c0c8ae62aac5cf52d973034a2
-
Filesize
5.9MB
MD515672dd22dd82ab44babdb137723cdf1
SHA1a999d42eeab8adcf94cddd7e364d285fb941d785
SHA2567d4080a5dc2a63ecc043f3834a423e263724de2b33f53dca6fd4686406e3a947
SHA5120c57c68276d88102e421de0a04dff9cab97b3298fa90e642ea45b96bf4e68aac0666f0363fe8c5ba5f4cafe8b9268bd12f37a578f3b6538736f2f5ae7257f940
-
Filesize
5.9MB
MD58dd0e06bf2de40c293d61b0dccfc360d
SHA1db30de56b65e60e479c60a7ad4a86c2861e050e8
SHA2566d7ad927bb164df95fd8999081c743975c62abe6eb7b90eb9530e1e13f520a93
SHA512919368a7bd67ae3fd9146fc91748566ba7987ab0e571858e6154534a6193e4fc59209fa7eeccfce3e6aeb9f4eb64c7c14a658d87d794520c89955ddbfde52e94
-
Filesize
5.9MB
MD5e75801cf55de305d81c58f1b2264982c
SHA149c31b7ed4cfa697531cc85f3a18baffc3c7a39c
SHA256439ab4f533f17b4ab8a5291e2696cafeef4a4831083656e844693f7cb04d473a
SHA512f6074e8105ca6c040ea3c2512ff14e845f2afbb8123791fc766b8caf4bc2150949e540bc26df8f5aec55673beb2444837624fb08ae111638ea5f05bebaf1b9e6
-
Filesize
5.9MB
MD5285c4459e74b6dec348610b64ab769f1
SHA1f1a72a9324ec4b37ce611189b4abdad72c944912
SHA25644a54a9f578f546e5d55a086c7e959b55b085da7dff4cfe5f7aba4b7127ea0d4
SHA512917febc5577fabeb1e59102ffd5814790b5d9da79e43e02d9f28b1b75a2c1205920667ce3afadf49274be1467e1e26d4b38a445b943f3666d7f23695270fc5a4
-
Filesize
5.9MB
MD521a2828cc324f81eed41cec976509bca
SHA1fdaa65abfa06e0553520369f5e08c7ce3976b825
SHA25632ca9a1a3ffac9c68d5e7790dd05d9bb762682c31d655230b646310bd6fef328
SHA51275edb0891abb4b3b8d21074ec26dcfa5cb592e2c9ac84ba796e5b0e602af39d2f7dc37323828d1c227500fea724aa765daf2dca8f683a6d50ebf62a8c40258c8
-
Filesize
5.9MB
MD5c11fca534e6f049fcabd4cbef2574470
SHA19ec29284d4875e81f14c664fd0ae8bfb97e84d33
SHA256703162f303a8a3028a427bfaa086e142f069cb5528b75ce6c8d16e849ed968bb
SHA512e989835deca3688098f4ec45538c8f09b2aa1ceb3c30a381b5018fa5a82b49cff4a19101826bda4073c837b167eb0e54f55efa5a7f9ede6225892ca0d9bbc591
-
Filesize
5.9MB
MD51bc3405db111d0de3fbdf4193ba1465b
SHA19a7447ab6478618c885a6dc9e3bf7d1f0e6aa4bd
SHA2562f1c94d1baa306cb8189fe8b001ff6293ecc246c6cd9acc621a6ca4e985dd8a0
SHA5127e189e76c43ea8d14e328c1da72982ce7e25dc2a1963a07020f0d1a9b64b85a21476d3b77dd77533da203668279d161dea18056fb46684a5e7d8c9e631aafe06
-
Filesize
5.9MB
MD548d60adef00944a23e669cde1b397c75
SHA1f85d174981372075f9560983c12ac36c7037ef82
SHA25645b9715359b134dccee717b2c017d5fde1be9009519997a83d81d59bc84448a0
SHA512e596cf5cf3f506f089f99e122639a15c005a0c697580c6805d06bb405c3ba5d8fda0fef1c35d7cae2b0361a14df85609923b792e0b94a4b8d780d93b97a955fd
-
Filesize
5.9MB
MD574a566dd68612b81f68c0acfc1e065b6
SHA1ebb46351aa362efeeb407145e5596f866e190fb5
SHA256cdb0329c88e39a43ffcfc8190398ac2ffad4d682f853ee3b33e7144032d92595
SHA512eddbef17d57d402e64ba5886626c249390b5d6aaed89b9bd2603c4aa31bddfc4e048608565ebb75bd1122a8d9f5ce24911899361ecb70259e5460c2208a237ec
-
Filesize
5.9MB
MD5c585e172459b8dec401dfa0bc53c7de3
SHA1644b6084f99d50600462c3e8403b29d4a1b512ac
SHA256d70814b24383f33d618b4f8d34ad093fba15c2837dbdd1d6103314da32f7e007
SHA5127d1ba501fec7d46b896faf73d86d57b8b0c673683f8082198ccf2111b9142f082973d4b07d3853d3c5364c9336a57d7b1ce543cf79df031350356acc86d24621
-
Filesize
5.9MB
MD550e29617b75dad5cf55058df19cd565f
SHA12aea7647a4ad4b416384c8561521e6d2c796cc37
SHA25655abc5c8b99efc8c9aa6c278f40b59588f88a2c0f1522556c8a84b4713cd947c
SHA5126d541e7d9f53e855f01d7393aa9dd0018cd0b5c707eb049864f36cbd338fd6fa6de05fcd0299eb0b7fc9cd6df0fe4ffc77ef632242bf0bc9150db9a46867eaf5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB