Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17/11/2024, 10:10
General
-
Target
2024-11-17_d0c8d34c55c227b977f7715e818bbb0f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d0c8d34c55c227b977f7715e818bbb0f
-
SHA1
b55fca15e57ebe6d40c3587ef85ef325f1ffe4b9
-
SHA256
3381159cd2e7ef5b48423d646d99d4a83129d8ab87a4820ddf43e85e7c93b1c8
-
SHA512
9a417b041d786903aa74ea6eba5370c6fc89d02dc2b2409c61b4c01f0ca80a817cd58f223954df240d2d36c7fae0383831797d2ec32b8a9e686beb6d9934a2d9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUo
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_d0c8d34c55c227b977f7715e818bbb0f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_d0c8d34c55c227b977f7715e818bbb0f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oGGUDev.exeC:\Windows\System\oGGUDev.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjTwqZb.exeC:\Windows\System\wjTwqZb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hutOZeN.exeC:\Windows\System\hutOZeN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XthJVYt.exeC:\Windows\System\XthJVYt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FfUivgS.exeC:\Windows\System\FfUivgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zkqsaCA.exeC:\Windows\System\zkqsaCA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SiEEAWy.exeC:\Windows\System\SiEEAWy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYhzmpp.exeC:\Windows\System\OYhzmpp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VPTZwEz.exeC:\Windows\System\VPTZwEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZADkXHO.exeC:\Windows\System\ZADkXHO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjKZDrm.exeC:\Windows\System\JjKZDrm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrRadIv.exeC:\Windows\System\zrRadIv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ofnrKvF.exeC:\Windows\System\ofnrKvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YlrMivV.exeC:\Windows\System\YlrMivV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yFhzalB.exeC:\Windows\System\yFhzalB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nfKiuZK.exeC:\Windows\System\nfKiuZK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UEptxpW.exeC:\Windows\System\UEptxpW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qUoyElM.exeC:\Windows\System\qUoyElM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFioJJy.exeC:\Windows\System\CFioJJy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zCkTGCI.exeC:\Windows\System\zCkTGCI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\soEejeq.exeC:\Windows\System\soEejeq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5780ecee18a581ce5587bcb152cdf44ba
SHA11e6e7fd6d6f8f1ae8c86dcb1fad25db4be9bf043
SHA25663065e4a31dee7ea7bb7b1c3adc9aefb604cfddf0bf5162d8954697acf6cdff1
SHA51228fa469f03889341046e7ecec8f8210939a999e94ab9bea0d396136e07f58d3da8a942bc91ff42e81a44771ac21689b64f38ea3033bba36850016ad9442abc47
-
Filesize
5.2MB
MD5a4dddeb718467c4a126528bcc0bc1f55
SHA129478e474cbd00db9af0a6e9ddd45d3c8452cefb
SHA2569b1d236fc663f6dbcc9e55202adade09b9acec6e7a214f48b5862faa8d84c36a
SHA5128ff2d0ad245f05d841cbc8a4634d153ecb65fa17579dc6d3a0d3020fafc25e64b0fd5f84e45aa993ae1c8daab1c833cb0d129bdd8d85f582226ab3a2891b6ef2
-
Filesize
5.2MB
MD503648e322009534cd6a3f788de0f8352
SHA1c36c167a86c5234c3814955ffd40fdbf6b3e7b77
SHA2566cc710c3509332d2eb2fbcad50868b14d677df7ee302116f6c16263f9a218e38
SHA512a9a1901d10b09ff468e012fc7ba9d7f33b440faee94e59b48f7157b8e95733a0506ec79347cd4ebdd61493953ed335995dc8fecdc603f59b0fc29cf47360170c
-
Filesize
5.2MB
MD58adf54baad4266e385536a382412c67f
SHA1d87a2426e6c1d7834071b89fcc5440a76d226b13
SHA256b494b865f50cad7c6205e6fb4405e896a0fa0a804b182e0a908e8b90eddad8cf
SHA5127cf328ef7f9666f19b49ac9770c7bc37069a9f3f4aab4c0b29fb15bd5b858af5885bcd105451c01cd81b280ab5d4b99c3889d17786fe3e42fcd7f45e1c275dc6
-
Filesize
5.2MB
MD58a582590ff78710b6774225377ca2c0c
SHA10f70b17fb7eff1402d70a970b0203cb257d1c88d
SHA2565b40d6987bfda70487023043ccd1e621dda68c643b925f1be1df46975db0d6cd
SHA512a6ef82ce96d1314d3aa93f1c7edac1e7e227c800c72b7a7f6dd22d291ee4f1b5e5d031a3b0869069cade60f58429ed457a15ea88bf36498e576b3ac95b2fce3f
-
Filesize
5.2MB
MD5300c573d2d83595c8f407e021c46f4c7
SHA1b098a6f094d2f002a400b022f28544501f397fb3
SHA25686ea6b868c4a82e05d7c92da6f6eff786b51876710ef1bd7e434b61d99634643
SHA51273ada08c519a11fa745069dbf5bae85c5e670dd586d9a053637826212dcf79d18b8adf88d3f776d1115a7c4357e4e81894ad6b757883cab86a45733d0771d537
-
Filesize
5.2MB
MD59f18a9b7ea48c04102dad4e95cfd7a48
SHA1da286fe13b0f25b857918ec9b215a9a378d9663a
SHA25665c4f184216ead4f86e66acbb57c45f5d80cc3cea5cd49f63dc4722385399d37
SHA512751d771546afdc10852b4a058b37c3f420788b0a43b2b78e3708ff8de1ec1537a57505f839c23ee53328a3b8264b386bf099b9bbb3bfb2d96f81e1adb621b208
-
Filesize
5.2MB
MD5115ec4157eddef3ef0f9c2f992f01a08
SHA175d0106400a00be4f40c0ecb02c54a90c20dd617
SHA256e369c7b21eff5101b2c557e09767d7deeaf6ce6e4d67e686dc7e0d635a5ef32b
SHA5129ab143652f2e64f80c846c57a32c57340293314d6cbb0cf46468e2b511624d627487dd15c9138bb15d85df3f1c7b6e73c3a25f91bf2256875b1419d2b82eb7a1
-
Filesize
5.2MB
MD5ad647c08a134c183b5fd013f58a91cb9
SHA1b725e73acf1ffa86d0b33479a6cc7c618e5562e3
SHA256a75d45c562531332685827a1506eedb65e56be0394841463788a0bc8782bd91b
SHA5123922aaf35d9e362cee1048c64eceb3b2bb014594461a885bd955186282c4070f85af426fb0032dc0d5fd02c52fbacc740e61cba88b6660bf69ee175dce343434
-
Filesize
5.2MB
MD5cbaa028a99e7dd86b68b8bef87d5a644
SHA1aa7c94ba58ae067309cf9c979cebcd02d6652791
SHA256e2a3ff6ac390eefe302de90173d94ddf4f23c6ce07a4ada018215bda8cdc5088
SHA512040ac7ea0982b129f20856eef84711f5addeaafa4086d8e844bff2df78a53d96416ec68581a1519550cbb8741ba1cccb89bccc1a0a2aa18d3cf876ed581f9301
-
Filesize
5.2MB
MD5fe8e163803380c1476071bd61a1c41be
SHA1d0c8a4a8a69701df14d014c234735bb8fb4865b8
SHA256ca211947fb20ea5d443cb556c190a681cb629fb6d16d29234ee84204f171b428
SHA51235f234586c8808fa89f46df25d8e5008bedf20b6e3abff65ea990bf52ed3e51de4f18c30e42a15b5c43d9c523306d1dfc75d48e9b40a15c149d75c61b9b22260
-
Filesize
5.2MB
MD55ae03066b26ee82f63510f38f8ab404e
SHA1a9a1e6c22d65b89fcd847ba16ca90738c20cbb73
SHA256d7c4149865a2f82bd4be1d875b2b96499d058c77901defdb4ea6194011864945
SHA5122f136bcbfc8ebe160d450d8bf33bb51dca95f3e4e152c5412cf5f2075c87d746477f2e723be993cc986447dd955aedafcc930e1953ffcf5d527f5f462cc650ad
-
Filesize
5.2MB
MD510915d8df0a8d4209e87168d4135c789
SHA1e7b0a8ed483b720cab5e3f53a34a3603d800d9ec
SHA2564d6d02f0d4d25e63d8209bb13830103a818b460e2ccd8ba0ecbe0a004f12178a
SHA5125ff4afcbeec6fb8c007d1fd649981d6f58a1ff2483d33ec71f67796b1871ac89ad42371686a3d1c224de3505bb08cc16ac151a56b115363c3b9db1f832f9b8d9
-
Filesize
5.2MB
MD5c81ab0336e269278b844c4dbe3a85ede
SHA117647aebf796c338c35356ff0b2a3e3cdb63ee2b
SHA2563b8520c117d5c22f6d17af82d0b23f0df61d6572effe84e96ac5dcee644c3fd7
SHA512d9f7ae522343028be37f6694a7918bed061e353e62769b185854a7d1b89288108ef6ab54169dc0bb0a0c2f7335016a95810958db8e3c0736452ac14da049a9e3
-
Filesize
5.2MB
MD5d3c51a1f6b1918844c234469629abb3e
SHA128f95aca5bedf757455a67be716539ce1fbf27b7
SHA2566fcac46607673d433a064a9a3104665fd3f254adeb9648761daf2c5bb461d42a
SHA512be678e5c7f9140ff77dcda32084b4ddb61b491358a7f16855bed30a389eac9b21d08d17618376ced6b49f6a49ff5d42a46e78b7a072e193c60397da0d39e7353
-
Filesize
5.2MB
MD58498ef22ff9f46158bd62765d2043c90
SHA117f5ea700bb49c37aab19b40e733133eaa217b2b
SHA2561f759ffaeb200272fb585128c6e418474f9fccffcda29311fe6d76e10324ec49
SHA512eaa2eafd833fc2bbaa8e7cc2c00932c430256f1c63a11c6e981eefff20cbfaf871c69c4282f24fa2fa9adec28ce164762b5c8b81fef5a7df380c50cc078965d3
-
Filesize
5.2MB
MD57ea559e6134f8522c51325aade386300
SHA1be6c20bdcfb81948e9fd963b8296553c5b413ec8
SHA2560e2673967bca37872647a4e5551e016577cf1962b2c9e3449fcf920ba5ccc497
SHA51212f13d15a384bf386c5b3b6deb2126117d6b65e0e81e8d2d50448be40d9b9dde4b7f7881de4ca2d0ae0f67772250c1dd9a17e07ef0ade4788bb7b07c1fc2f1aa
-
Filesize
5.2MB
MD509b9b6e7a75b994b903543de21e31a61
SHA1be1eee219a74a3eeed9f5614b995f22a74e9e0bb
SHA256d46bdc4387dead6dacc953ed36911c7c8896602ecee01f0aa5eb663d4cddb4f1
SHA5121e7a3bc2695d3256f4569919338212e69bc0c8e0c51378e6e8b05f420e9044503dc915a32a6aad975ebd7ce42cb80ab9f00763dfed1cc76e03df1791d8bb73d2
-
Filesize
5.2MB
MD554a48ea7fff0dea267694d6812438aa8
SHA18f3534cfad8c407fc9a7efd2def41519a339c362
SHA256da15d720b8f360556225f42b39342a95af93724c24a8cadea1ad56ba4fcedbb8
SHA512bceb1c9aa43dfaa8ac15ca9a3fdc7bf5403422214a44c0d73511e599705b0b388bcf022e26aeeb56b293e8280b15e3c584aa6da3f09bbbea3f9ea0b8e1a6e756
-
Filesize
5.2MB
MD57c8e18621589abc8a4de40e0853f6fc6
SHA1f93cb3156648e5f558ad00d32658e9b92fcfa217
SHA2561ff13c867bf717e3f111e27f011b549eced90bf6be7792722193247137a274f1
SHA512bc4d58f7f71e9e70a3f53226e39a4d61af4b779d25e5f4208366055dda32d90a9499b7cd0d993d06bd76cc73fe5e00b2fabab2831c7e744cf708126fa0ee2ca6
-
Filesize
5.2MB
MD55ccce004c60e35cab245c622fa488efd
SHA12960d159364f1e6e5693a05bd1a95aa08d60082e
SHA256bea2e837698ac570c1c8f81ab5f7a5083ea4cedd04e3528af323b72afcb787c0
SHA512ec8c5b1f5dc04398a2a5904e65d947faf406c904bac438af055820608c6e327f9071a6b891b4fe4f7a10abcf197f49b88e64f38ea04b5c29b61c823410ae27f5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB