Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 10:09
General
-
Target
2024-11-17_b543f236a6c63b1cfbcbd3726e5e974c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b543f236a6c63b1cfbcbd3726e5e974c
-
SHA1
7c5b11d7a34279f27fcd93341be6f5144c0d08d4
-
SHA256
163d86cde6f535b0ad31ec9184ec2281ba12d4783dd0b375f46d6e18b634f889
-
SHA512
8e5d3f23b7971e43173bdeb0a2af03051bb477345946c33099a0768829598b3e1e0078aa0e6cabe9294aa30b9d989f43319a5ddd257db5df8e0c5a9a7fcb15f5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_b543f236a6c63b1cfbcbd3726e5e974c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_b543f236a6c63b1cfbcbd3726e5e974c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nGcrRAf.exeC:\Windows\System\nGcrRAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmOHIyr.exeC:\Windows\System\bmOHIyr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vqQGmdr.exeC:\Windows\System\vqQGmdr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\abkOIQx.exeC:\Windows\System\abkOIQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QjHMzdV.exeC:\Windows\System\QjHMzdV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FCwOmAX.exeC:\Windows\System\FCwOmAX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhpfWuE.exeC:\Windows\System\KhpfWuE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TytXLiv.exeC:\Windows\System\TytXLiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mckLRau.exeC:\Windows\System\mckLRau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TgWXGVO.exeC:\Windows\System\TgWXGVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwPPjDj.exeC:\Windows\System\dwPPjDj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MwMMDGS.exeC:\Windows\System\MwMMDGS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGbqmlP.exeC:\Windows\System\nGbqmlP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rIyIEzW.exeC:\Windows\System\rIyIEzW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mwhgDkT.exeC:\Windows\System\mwhgDkT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XgjQyCO.exeC:\Windows\System\XgjQyCO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bwYBeuI.exeC:\Windows\System\bwYBeuI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Zlitlmp.exeC:\Windows\System\Zlitlmp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhuujmv.exeC:\Windows\System\rhuujmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqRodhx.exeC:\Windows\System\eqRodhx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDWArQL.exeC:\Windows\System\TDWArQL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5eb3e2283f2df4cb85bd2c9de8ddda3b5
SHA1d44e0f63aadccdef337dfe052fab3a17305ccb7b
SHA2567dde455fd253afb9ae9ec8e2ab69b6fd81f26221c5efd6ca61d469dfdaa56720
SHA512b755e19c9d0b1b6f1debe124c8bb91268e9abd5566343eb9d704372202c34cf5fcc152065f73b1b91adb303262663e7ad707d2ab3e2b5a12a3889db2db980869
-
Filesize
5.2MB
MD52368a274f1fbbfd12ec21d21ae5a7b8d
SHA11801d559ef3ea38136bc2a8f4723875336358269
SHA256d5856cdc50a7983b87b01a0d988b8fb7c3215c9efef376d0b1f19c9ea1f9b394
SHA512414fea9d2b673887e486fdbf4cd3b5ea340c0237ee0b488619f1d9ef66d22b1d92131177df8b50148902e65ec8a152f71ce945a3b17b944194a0ee0176eb1c6a
-
Filesize
5.2MB
MD57c634005727f6cf441df06b8e01bace2
SHA18537eb2674ff57b2a168639f3a6d7c9a541d2162
SHA256cdf00d0006711e4b7078d64b07410e74f2fddf6676f511ee2421cb95ecc3b98e
SHA5120ea5d5c2f8ed8b5d0446eaf6c10bb2bd91e52a2bf563a4707ef0e11c78059a47ee655d78d3a118b9d01afa0696ff84e426a66d6d05f840ff66bed32b31138c93
-
Filesize
5.2MB
MD5d4b746337e66c9da2c6371305d7ebdb8
SHA1fa8f264972e0f3345acb66de5f07a89a43a22be2
SHA256fcaf12f6dd7125efe294c7a2b7fd5e0c372b023b336600f25b1f2ec4123ec50c
SHA512633bf68543c4521afae0317a899078661dc1375c08aaf51bc62d223049f00e4609d0d302ac475e8088870faf2db57de6648863ef37fbe02b1e1d51ea5b512e7f
-
Filesize
5.2MB
MD50aaaadb268ffb457ceecea9fb4ffc30f
SHA15aae850e6ab50c535e3a9d731ced9d6f7dd1b041
SHA2567007e6b3f3bf4722c0498d6b884f9a50f7ef854c3a9c354af878a08ee67e812a
SHA5121a37a79af494448077e227acb1e064368d828b48d39be6393b60ee1864f3f8389b5c206435aa68ddd49dc8b8a9d28498a6e886b9e7ac0d91b84f4096ea246d35
-
Filesize
5.2MB
MD58f2c6b0a60bddeafafeaf831a505dfdd
SHA158f459a0a444676892956f476441e874f937e011
SHA2568b4a746dfd76ee59bccf4ce2ecd23e8c950a276fe3e64ea7e049358fd5730a2d
SHA51207a2dd12b081fbea0e6177ac8ee7fe47a9bb79269f76131f6124d70589526fa8fe1dd0934a0bad966650a1b79f3e9f805a0025307117b9eea1cd33e3d3ebd6e0
-
Filesize
5.2MB
MD5895f36db1ddd7a8a362101c359336281
SHA1e0f699715640d91efa57af7830be865ac4cf35f4
SHA256c0ec8e22de552ae53e6ecbc0dd54673df46913efbda622ad95e1f002fb66e2c3
SHA512e888ac64955d3ad2865a57ed243865d10624585dd11ef8f0cfc248d24a075d49ca57fcc49855c29c5d47d401b8de1cdb7c1e04f858987e4f641bb79eb1f765aa
-
Filesize
5.2MB
MD56c7004066202ede4b183878e2d5a1bed
SHA18693710588e9d54326ade5fbd4aaeccffdfdc242
SHA2565d84e05b43e0a20d97d78f5a5af139259ebaa2daeefd0b861bc27218cfd9c273
SHA5127fd7b811e11aa0857339a2cf6822ffa9395e512a4dda05e6dc8f300d15c29b62232f1694775f2673b81f7b2811b5a6cbf2963402fd4dfbe24e59e3f7ac3db91b
-
Filesize
5.2MB
MD5b2e736c1ccc548392141957d735bc327
SHA1f312affe10a31ca717a46fd62524647e9fd45f17
SHA256a958eb75bcd0f49ff15197a2fab478c0dd6c527ccb95d788c1ac1a8083a70b26
SHA512e84d7ac7938c998b9b284f879be7ce9193b750f044440bdd57e613b6190bbd435bb377a9582ed545773c5f4b33d33af4de4c8e1e1cb34f712268a9821cd8214d
-
Filesize
5.2MB
MD5addf5bde19ee28e389877f52bdec8238
SHA145b9ad16db8da895da15c61f53a37b890a8e2eae
SHA256cc6d8f2231f0d1a356425e5d39e026882b12606805fa3dae771a8d1102bab486
SHA512b3e770645ee78d029794bb9fd6b87d98ec795e6d5d52ba9160ab7acaa62ccfd8f48c65ce21324b63f06fca7b9c562bc42779b3ed78ed8bdafd6bdabf10b4916c
-
Filesize
5.2MB
MD5f2b36c4c74b8a83b3179b4b2dcc125f6
SHA1cdf83c72f14a9a25542d022d84b2de1b29ddf438
SHA25632d730ea6e5f8a48b698b26dc0e31d8d852e182fa3e9cb5a5e2a3e5af4b6c658
SHA5120e63124830d1340542274351cf4b9cfefbe6006a41396c93418c5560b2b99e27a101798ff7dd31c826af05b4d96a8bb52ca903fe063b3668a5d9887a2b3b4f48
-
Filesize
5.2MB
MD521e5df94d2848788d53fdf53c894de03
SHA13ca911e5baa5f3db1d6ef735752a6974d62fe23f
SHA2567cea48b3eadfac14dafb06049a1eca1bbb80d522701577cf617c2d8dd5774b66
SHA5128ec14568b4aa9268c1e73349c40b4f88f1694d690f48358b9f80fdd6dbb035ca69ed2dced726d32025dab08ecad337a5f9312b17debdf756919b6641ffd14335
-
Filesize
5.2MB
MD5d7f7197d6675f2550600f3994b8ded8f
SHA126f4838880dc967c7b339ade5fb45ce6faa3ddb2
SHA256e7ca51e35fdd9d685578b4b33f62fa76a04caba964f2c1dc372569a817b704f2
SHA512bbcb207d175bda53f681ce96dc4041874177fecc3973e1c307390bd6b3c99dd59f883211bd47be0ecde0acba484d1f13cdefa267ac0e8d8e945f3ec106e0d86b
-
Filesize
5.2MB
MD5deee386c98c335397d934f46bab32874
SHA1ed6e2d2dd459b590c542ee0cbccee8d1e49b9be6
SHA2562ac9f7211d2fc4ba6c01d09744fa4a20d8c0c1abfff47dce19668d42507730dc
SHA512db8306f0c1ee9c88c16da8677438f870567a5b80ea366cd4ce286f4e7001fe0ac104084b454121587213bfffdcb7b96a4ce45cc68e4993cd8da54a50a4aa5844
-
Filesize
5.2MB
MD592cd4da92417c07decf8857199f8c1b3
SHA17c8bc26e0cf5f134fe212f3367c3c5f8828ad34e
SHA256c0262a58bfb6b16447d20c4789297ea141fc58c2f9fd26d021a2637dbf3e9eed
SHA512ca58b0c08e3f39f7767b94ade215be75c686d8f0d219b2008c41c42051fbfdbac8840fc6397566b289d0b631483999b6ae7179e1bcc754039d8b3e4e406b0989
-
Filesize
5.2MB
MD58e2ee9017d5d63a9667d985b3a321f9e
SHA1fe2d2235b430d5f0144d886a0c4b3f5bf5fd73dc
SHA256066156ee018aea2816a920025725d25647bb18616083745b61f00f59fac1226d
SHA5125790c8c2f5b0b1129fdcd852cf07dd867f8486b93335a985026203202bbd844f1035db1e5cda9efd5d6d95788cfea7ccf5bb539a0fffcfb22e45fdf088c881ee
-
Filesize
5.2MB
MD5fca8d0fbcb0a05614676fe1d94186222
SHA13b9d68ff8d379dfd7213361b5bff58d044abbf46
SHA256a2c76b0bc59b85ab57a598f3e26c29c56c529a359e05514cdd11eeff9393227b
SHA51218365ae84866d262f25ce0d0fe8e0556488f552c774dde47d7edd12773ef05bb8c7ac8dfb751590729d109bd40cb88fbc9dab1b5875f3838d1fe20aadca24b8d
-
Filesize
5.2MB
MD5e3359b7425f82ee38e6c46c3136e6c2a
SHA1dbe7529d6ab1d85533ecf506573b5fcff040d1d2
SHA256a2e7674ab37a22d7def83db78ddd27367def8609b62b462d7c923f4e5d321493
SHA51285bd662ca95618f2e1fb9d01a56218560fb9628c70ef829c8cdb6cbe452a06ec96727e72b96fec2258fb4a8d8d701f84e8f720d95c7689dd5c9e7251be6f3f88
-
Filesize
5.2MB
MD5a5881cdb30b86596e513bdadf1265ed4
SHA1b23f0a2e53822e0f1b1f5810ea07e92ad998a184
SHA256c70414fc0260279341788edcf50eda411478b12f73df7b41334742c114d5a1d9
SHA512902a09b0bc9bc475e952bfbd31d4197e9679445a9bfe8d00baf3e208c2372ff02d08d91152ee2503eb85a6af83e528c4a73fe339635b693f16e793255bb319bd
-
Filesize
5.2MB
MD582646b0ab8d83dbd259f09b2477ac5a7
SHA1011867fe09a4d3b01d1b2d0f605d540120748267
SHA256e44bcb867146497e18e65ae769045ba292bcf4b5080652ea10eeceddd993ab03
SHA512b401658e5a6d375fc0cc18b0940d89c13440302bd44a5d8127a0589e9c397910dd3e5c177ccb1045d7185587dd8e0a2dca9f53a449da3b50d30c3dd1e6a52f81
-
Filesize
5.2MB
MD5548abb679c10e6ea41649d7d8d11ba3a
SHA149ad34f532bc4cc86ebc207f06592c4008c9f9cc
SHA256e52c071a13784dff02ae85e13ed679ce237372385b6cb5ca17834a6f28eb1b7d
SHA512adb2bcd33d7036280865a6c295ba5dbaf2756d3d72ae7aa5d9031fba6bcfafce41ca4830d3bcc8b0787b40a0108162546ac0f0531cb29bb0fc52f7fbdd706658
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB