Analysis
-
max time kernel
140s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 10:11
General
-
Target
2024-11-17_da8f1fe5784c21bf1cd69e3a862bc190_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
da8f1fe5784c21bf1cd69e3a862bc190
-
SHA1
4578a4b71a0806b9f0dd3dba755f384479697da0
-
SHA256
ca5b36b7420bae5c00ea096b75ba2ace97d81c7f02bdc67b4bfd4e95bbf5261b
-
SHA512
48280ffd8b92ff9202b041d8f1cb4bb7c06bb69855b80cc1cccf40acf539e722d9a5255cc94cf9de5fd1c3fd774ce9476b11b59e3eb7a6ac0ebab2fdbc01254e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUr
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 46 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_da8f1fe5784c21bf1cd69e3a862bc190_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_da8f1fe5784c21bf1cd69e3a862bc190_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iBJxRYY.exeC:\Windows\System\iBJxRYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gjrLuZO.exeC:\Windows\System\gjrLuZO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqBsexy.exeC:\Windows\System\LqBsexy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QvThPuc.exeC:\Windows\System\QvThPuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edalJKx.exeC:\Windows\System\edalJKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VdsLmlO.exeC:\Windows\System\VdsLmlO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyrOSla.exeC:\Windows\System\ZyrOSla.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TOzFyej.exeC:\Windows\System\TOzFyej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHGfjvB.exeC:\Windows\System\rHGfjvB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LdqHeAb.exeC:\Windows\System\LdqHeAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GhAZVRG.exeC:\Windows\System\GhAZVRG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\keUmQYR.exeC:\Windows\System\keUmQYR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SNCszmG.exeC:\Windows\System\SNCszmG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cvZNqMT.exeC:\Windows\System\cvZNqMT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QtbIhgT.exeC:\Windows\System\QtbIhgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhrcDKJ.exeC:\Windows\System\jhrcDKJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bVSpQtI.exeC:\Windows\System\bVSpQtI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lyHqTsW.exeC:\Windows\System\lyHqTsW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evVklhH.exeC:\Windows\System\evVklhH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PjoXJRM.exeC:\Windows\System\PjoXJRM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUMPRut.exeC:\Windows\System\SUMPRut.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55cf2482a87e178883466080f1d30ff77
SHA1a04dc4e66a446105be6fbab37d9db8a46492896e
SHA256c5e53825181c9483642cfd1c05b29dc7e6951e65b6a67103864c1b551c51df24
SHA512b45e95479fce86dac742726bdc33500df69158cc8a3bc2c28ed1f6317599efd4a69fa55f12bb8e1eca7b8187b1a646cee95e0e67e3e44b1f6c5115d06685c86e
-
Filesize
5.2MB
MD5aefe2e57bc3cbb7b1bdf086da0fbd470
SHA1beb3b653a98e8fdba746cef61785663f99a53524
SHA256cb0c170538c0865bf5b6d89bc1a202e3a2bd0daa91a211e6bc28a557a6c3a086
SHA512fc3fcab862a2b236187e36a25f6d90bc2d2c2dfeb244570413ce5deabc5e65f97365723795761ebe51864af6c06cf5a3b9b74f1588dc78898343c78a5c80b1f4
-
Filesize
5.2MB
MD5cb8bf4a68733c68bc32b479b8db79aab
SHA14c32ae065b608246cbbf207093539a4b05ba04d9
SHA256ef88d46967f4e8a0a68ff5548eca9ce35b6a4b867a37f0a2595731c6ecdbb9c1
SHA512b5a9b670e8b02fcf2efd3821ea0ec0a9c30b9dcde304694eae52489bb11601ef219d2bf77a4429bf24bff649a50f0b5b5691ffae27a6c2bdce130c5cb40397df
-
Filesize
5.2MB
MD5c5b1127727291959d35073a9503f79dc
SHA1489908ba0421078dc81dd80f3dfa4cb566d0f63c
SHA2562a40919049a7fdb27baf7b9c5d10f4afc7b7beb6eb3c317db70311b3c3d26842
SHA51228d29d47f9b5ca042ad8b9d9aeea391ada9b2f292e762e76161dde32f141b373e984b7e321a0c9757597aba5c5a3ba02fbd1b05374f8f5d5f66ff5e071d7a7d0
-
Filesize
5.2MB
MD5dc7caff3461a3b2bdf7d4c0339a76dce
SHA1a8cbebcaa6e4f80033482371360956cabc7b9201
SHA2568fd4b8c179502674a229b3d0af2db5da311df0fc980ba8993aa54a3d476c1801
SHA5127543d2a32728cf4bffb2903be1c7a4fc273fb2b4edc909aae31e0abf55ca028a963eba4a0333fa9b2f9e4d2f696b4aa6a9a3172498c1b73b32c5346b74a68295
-
Filesize
5.2MB
MD5ad79cc2280e48c6739f6f87fc6d6ec8b
SHA193dc4acf0a2052e68e93d3135cea39283483d589
SHA25664e288e2f909fac9afa64ff9dfb847eeaa1b7986d8d198b6d9df4e6867c2b22e
SHA512a64596605c932d77d680d8fce82f89cd431e2a1a9a6f8e2f0060c7a7bb927aeef03408d0e42b0b95460e0e6577dac285102fbdd7a8899af76d5341ea245e8c64
-
Filesize
5.2MB
MD5550ec91ee1e0cbef8ca90f3f0bb878b1
SHA11230c05020774eecbf15882164da0e0bf7bada1c
SHA2566faa2b68b8bb65f2d1082940f134cb46f787997e73aacc86ca3660a7c7aabfaa
SHA51273a262058ed3705315e7c05395671989a3711842d1a01eff252ab0546ec0121b0ef9ccde3659d61e65752bf4f5aa74af8248db4d8488e2958fc174999c18210d
-
Filesize
5.2MB
MD57be04d989c751514ef68cf13f6460ef0
SHA1ef16ba0d2ea404cba7cfc2219f4275d7cbb102cd
SHA25653ec9fe2812411278f695a9c9ba81f5d44df5ac43cd20a9cbf14a4c7a1b80114
SHA512559c50f0bb489503170fc852aaf610e6839cd2d94e63b3c4fbe2d7676dd02ab9203cf9d409891774137a20875cb3591e0a832f097473892e258dc637a85ef7d3
-
Filesize
5.2MB
MD5fbf068e48b07ab01bda1809986794322
SHA1b35b1f05d9f31736a913a77d0bc0cdef85f15f1c
SHA256ec85607a3c91bab4ff196e5a98663dfaf3c018736499f37fe4438be2d00736fe
SHA512a74f75d4bf4f55e6303bda3126028558994ef74aa5132f833c393b379066dc37c51b408d1318462d5e7b3d3033287aa1d9ba2ea15259ac7ed35aacc3c872dd82
-
Filesize
5.2MB
MD53eb69c210a0f844dac3f3f2fb164f731
SHA1845ef0fbcd02430c7b145a19835246aedce8c878
SHA25671df2b9acf9d1656389b020bb24dd052f6153f37fc58730c8411ac7e404720bc
SHA51249791cd8e767cea67b5b2c1c6c6dd9e2eca3837113db0099c82fcea96dea2d20429743287e08002f22a6c7bc184ee3450351fe96739624c33c233bc20ec13cfd
-
Filesize
5.2MB
MD52758d6a0d9f8de7607d862a9b257030e
SHA13d9a1bdf9bba9a8b1640957e552499ad65d7315b
SHA256460f4c1a9d173b286f4eee52012cdf07585276601f1f67283ac2943464ea1bb0
SHA5126d61e7fab9803772fe6405f99ee432ff9691ae3bd5684c94db0939271a60550a2a1aeb4a5a010add7ef694d9eab229c7af18586a29b573754afe91f105246d96
-
Filesize
5.2MB
MD599f7e3a0700bb3d51cd44275ee0b447b
SHA11109a8112278fb5489110643b4ace9efe50809f9
SHA25651ce3d45badd2c30a21040a47e5505c3fe2eeab5417c92b8711ecf407eb4e45f
SHA5127d61ccf2d6a26e393df9dcff552184fd8a2772b9e526892e121cc5d14626885fe423b76b4d7ff2a8d3d5fce4ee4ebfdc91bef213d7edfe8409f1b6c5fd607aa7
-
Filesize
5.2MB
MD52bee24da6524c889191d2d393b1dbd06
SHA1c0671d091a04e14cf6b85696639986c6e9d75cf2
SHA25614abf5d4348907d60930c36ab96d5f1c00622373988bc00b0ba24f143345edb3
SHA512011b0781a5f457732285ab7811f14c123150a98504b31566ea60e51d829275e7ec1cb16b383bec661df010e5134658ac7801cd6c6f7365bf945eb559a2b51c27
-
Filesize
5.2MB
MD590ae78ffb7b35a7f4b1a555db4476e38
SHA15d5fd9909b8b22a0872285510020c71428b33df7
SHA256c86521c49d1968f94892694d6d14d6fde5094eb00ee655e815683b99306d048f
SHA512af9a0381a0ead41fc4c6891e5fabe411648ba366548aa8731423e03fcb735d06184a8f94c676301fcad17d6c4c3bf98a7d4d6a4300f7015ceb8c22241143394c
-
Filesize
5.2MB
MD5984a7084e8393e2e8dde4a33cbd455bf
SHA1b4f9e350b6151587a54d8d5d5d83300d5e07fd81
SHA256746cc32df3af676a7da1d7371c8285254e2d22c6b45a4f137873fd3cf7760f49
SHA512080c614f016d7cef92468f9afb0b5e3abb57b466da2bc8b6f9369c0d95eb0303337545a8b12ae10659067cb5832daf86f4d018cc1ae1d8240539ad6156cc343d
-
Filesize
5.2MB
MD5713bd9bb5b16ffd5980ba450c175153c
SHA12a5bc3e4623ebc4fdb665c1ff27154a854eae971
SHA2561bf952f3ba9617d293d2cd7156ea84419755915695feedb2005a6a13251ac143
SHA512aca63b0b8cf9871f98c52309ef30a8f6057c56f39e38133f364fc814272fd036cb3c6ec65ff496df740bbf09ef5e95940f144466be0fa99b9fe39b17d00d1a6a
-
Filesize
5.2MB
MD5ead88b2e1fcafa40bf60673209529c13
SHA1246494ecbbb1a06c995f13ad73c122fb0fa883f8
SHA25635ccebfb9361e51eeb3c7753eb3bb1b3c2c22f0db953d0799f3db8ccf7ebf3b5
SHA5121590e8e7aad2e2a6685f089b8625f72eb891245b2379073b6605e22845a64d5903533dcea651a5f45da3714677a6adab869732ef74cf3b651b0d748619bff2f6
-
Filesize
5.2MB
MD59aadb886a8239c574207a833dab2168f
SHA1712323b872743bf538b697a39f1d4f874d7c3993
SHA2562b455ccee5aa7fb1e078c3f5a8c337e0c89c963b891b2c50b18fbdca6b6b442e
SHA512b1bd8bd187f4e2b23708c2c102f24a3c72421b2ebebd02ea3a3b9cf3066cafc342cb4e37148a8efed9ab0a8c3d784f4039b8af9099653c984e96d1bff483a9eb
-
Filesize
5.2MB
MD501430cf15418c9a716697465a25a63ed
SHA1c38b719ae7a8a48b6679aaa23109310ef0d6646f
SHA25638e28c80b8b17f6ce284b7962ae61e19b3e5591bbb5f956cab9d45922d4afe57
SHA512d09515ca87165554851ac05e1c4941bbefaf80bc8dcc42033b18d4d3d45666d3691713a16e5eaf43f79cfff600045c98346db01d757c8af1c7453344f5de4371
-
Filesize
5.2MB
MD535d7439df205ea92cbe7e940b45804eb
SHA186444d0938b2a732509fc848339888e7afc2d994
SHA256ec82869ddd77b00abadd500c029ccde3ae1b8f28b7a90aa2231545758ea5827d
SHA5120c89840e658b4b21eeb991bdeec572e78ea3f2449bbda6c6be0f8bd5bb86128f6f0fd6f94b9c2738bc287f9af11faada289c04bb9c0d3895993e2f87f3739e2f
-
Filesize
5.2MB
MD55b4cc01c63e99cc823ef1ba30c2a3eb0
SHA176211a8892f15d87fd44fe717c2d7733dc884e3f
SHA2564f4845e2714bfc4fe2c11aed052670e146a26f8c8dcf8ad92c05bcaa07656388
SHA5120eada46d062465e6e16856a5ba618c5fb6a4ca510265ac3656a8e8bd51743fd97359c542e46549c94905e67be45628016fbb17c2e308e68a1e569d7efc2cd5ee
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB