Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 10:12
General
-
Target
2024-11-17_f0dbce2a9ee77cc36d383f5d622231bc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f0dbce2a9ee77cc36d383f5d622231bc
-
SHA1
35f451a6f446662ca30d2f55bcf99fae597a56b7
-
SHA256
256a6694427a368e630801789b5fb52e3d99719f3fb7bbda904fbd56769586a6
-
SHA512
2cd8257bf6c2b78995ff0a5cf5fbd3b87f6350b922661622b9a6ffd4aed8306d6644bc3012709695382077133554a58bd5b4a395f2ff754d8e708ab527d5cf2b
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_f0dbce2a9ee77cc36d383f5d622231bc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_f0dbce2a9ee77cc36d383f5d622231bc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TkaJXga.exeC:\Windows\System\TkaJXga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFckSwC.exeC:\Windows\System\DFckSwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mratAyw.exeC:\Windows\System\mratAyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGPTcMc.exeC:\Windows\System\eGPTcMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ieKhCZG.exeC:\Windows\System\ieKhCZG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EsoxBiq.exeC:\Windows\System\EsoxBiq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rnTWrUq.exeC:\Windows\System\rnTWrUq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZwBBhDK.exeC:\Windows\System\ZwBBhDK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QkfNKXF.exeC:\Windows\System\QkfNKXF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMxWJSm.exeC:\Windows\System\tMxWJSm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WpifvDb.exeC:\Windows\System\WpifvDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyvEfbO.exeC:\Windows\System\fyvEfbO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uxVvKNy.exeC:\Windows\System\uxVvKNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ggrUqHb.exeC:\Windows\System\ggrUqHb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yWHvMct.exeC:\Windows\System\yWHvMct.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yugazVH.exeC:\Windows\System\yugazVH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSyxNdN.exeC:\Windows\System\oSyxNdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IAgnpnB.exeC:\Windows\System\IAgnpnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wXYbrOM.exeC:\Windows\System\wXYbrOM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UFtJExH.exeC:\Windows\System\UFtJExH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mlHzfWs.exeC:\Windows\System\mlHzfWs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD553738c4ed976913a8b1475495530240b
SHA1c3aadc3277cf82962233807bc1c0a133e7fae9a6
SHA2560fb9b2d780c6e83b9467387b7613aa03a8f11d6fe93ac3f1b6da0e51bcc73d41
SHA5123fa8101f4b869b5ceca727a0ded7e5e0c674e4d10a0d0389f082f995acb121bc0fbe60f1881db916c14120e1c70392414fa5ad7066277798b9fbda83d4dd2409
-
Filesize
5.2MB
MD5cee58bc47ba30dfd3619528991542860
SHA1dd4ab934650f4366850f556fe965af9bf48b38c2
SHA2565acac1d9b47707e4b70f8b3d0928e811565054fccee828df242e40072c7404c9
SHA512b9fbf7f662083930e9efbee91b9ae06d753a8f97b4c3147cfb1acef4069fdd45d92faf087232eacb32232418f6aae7a8ba885ee98d883fe4b3685a6a219efaef
-
Filesize
5.2MB
MD566563d82408b2507b5c748e93567260a
SHA11ba6a7fb3075fdad34c07841122e67f5713aef86
SHA256b9ff1accb309b4deab62e2a5b48a3fe57c92897d6f52a6cf83fe80c7f9a9437f
SHA5125726c7458c8f34e4ba232d98a65cd8fb6c4787f71e7c546a9c5b1a9a81417787707637422fa018edca4a273819e48464e93acca9851078245b76907338195022
-
Filesize
5.2MB
MD59f99e98a3371ec9944fdd22c252e634d
SHA11f76b993730f0f24c8f07e2b8af9027cfeac5313
SHA2565c34ab2308684dbc814a22f798fee937056cfb8d2f832fb7ed53753e0845769b
SHA5126caf20e8af75abae9e239f24af32958e7abf0d5a009d32b1a46bf0311f85fc77b879ee22c98dd2df77576d359bd5ed3dbdabc3af77d57b6d88214327234c601e
-
Filesize
5.2MB
MD50608993981d689071359c9b139367ffa
SHA122797e211fc39e0625416f0d6b120cd2334b99e3
SHA256d89ce87e0ecbf7467f3fc571bd194cb42e01e5b7f61a5a31481a59fa26e48e1c
SHA51218d4c8cc2859401e2103b5a09a1970bbb8bcbae74f3055bb95e681a5b2181a787a9ec93467d90501efcae2f0140b70cb48894c0b59512306e697437ef3177fb8
-
Filesize
5.2MB
MD594d8afa7aba91b7624b1e55dfa7c014c
SHA17642bbd8d8ee5c46ab97fbb37333546c8a1ba033
SHA2561e34737a10097029d0e25430a01cf219d707b6d12be81968cd17d34b555a78af
SHA512e7b212b14f5f960ba8f0107ec0b5ec6cb07a4dc35a5632e88313c1e4502ddc09e89a84e5bad2cb9a70c3dd2a3d4d730f6e3eb5bb708bd0b3ef1c5ce754843f64
-
Filesize
5.2MB
MD532cc83b39c97c34f9e08e3c9a117ecec
SHA1922c060c901acec37e9c09035402d064ac351d69
SHA256849449d930523920069761b0e5a780f672110b5a104f8f758e669a3657eee534
SHA5124480fa4cea74f8af3bab8c893f74ba2693552aae5edbb2f9a97f073f4f8105945c223123a42b4ea53f47de3a7f5c26c6e300abf1318b045becd3b9e2b651be50
-
Filesize
5.2MB
MD57899a3f5c6e6fc7f9546fedb75307eec
SHA12a698279d8150ff7db8a915a3f5f9c03e406a22c
SHA25631f132131e6fa928fbbc458473eedbbd91ebd279b7f0911c292847adbc213092
SHA51206d11fb69dcb85ae6d89e38f5580d1b45cdd10ed7a50e0aa6e16bb73932c45e7adb266cadc1a101fb83f859c73ec6835eb34846ed1efef687836072f94a04653
-
Filesize
5.2MB
MD5273dfc9609864a4a6e873a80fa0d9186
SHA15a0bf9688d0d925c2962bd4eee8f6d47c89e47ae
SHA256a3c5ce6ced11daf61b289355abf37a6346349e7ce19c7461da1e1143945b3ca6
SHA5121cebf9bff11aa501723db79783c0bdf629d6dc895545d4847686b3ada7c093e72a680de51adeab9b6362e24355b3d720f0136074c968938f7c79e0058db5b699
-
Filesize
5.2MB
MD58ab7d1e5fc0618d19ed8d2a06f5de7eb
SHA19b412949be0108bfa0dc14e24b6ba9363c5bd917
SHA2561c8c3ee9639d831dc1e5fa57047a9976599ed7cf877e18c90395f7b4af784ff6
SHA512f2977cafbdfbe43c7e7c8a88d7738a53c4bd2acd47869f9048cadcadf5ec491cadb12fdd06f8984ea07aa0f9beb9e8fccf4d810029331399942593953ce92dc6
-
Filesize
5.2MB
MD5a756434d7b716010e09503005bcea49e
SHA15ea517896862eb7d3066f99c8f5e42cef9461473
SHA256ab649dc8ee149fed2f1c88b444a8fca8e9b099d34da1a59fe4749b436dce62c3
SHA512046b4c6f121db4933b2026b99f99a1573380920e50ef8e4f640712ad3b309f3f71ef08d1777e903dd95ddcb67f41ee8b94c9462028392fa89e6c0bb7e63fa166
-
Filesize
5.2MB
MD50190c032a7de2ea1c418fd045cf2381e
SHA14d867ee19d4beedf0300adc8515ca9aaa94aa950
SHA2566c46257516a06c29017846d5df4bc81d9f4d5149c73b6d929cb34e82ea3e45a2
SHA5120a4c3a657b3a563286bf37199c0be929e77b38294f31c9fc8d0f72d2afd74157056169551c07aa0a35c9e8cb5a7b81d6cf8c4ab55232d04b3f47a012e8cc46ce
-
Filesize
5.2MB
MD59225abb8724b85caa1dffdbf5dbd987d
SHA182757b3ff7f22d79b0eca78a02ae5ac2cbb6f3e5
SHA256c2475d5657de9cf005e3e63d06607cdf4bf407e036710aeb813d288293fbb0ff
SHA5123243bff02f2af6b89ddc6c5539631ee3381c69f37736fcef49a2af5ae5889b6c8b0fbdb5bcfabf2b8501e5ca15931c4b3b210686006bc3bf48278bb40e3ec5fa
-
Filesize
5.2MB
MD5144efce6573c714e064d2a560a8f0205
SHA1abf65a1c198da5f52dd9e6627b4dc5bac6426f2d
SHA2562eefbeb6c31c4b068175d66903a31ba8175be14b014ca3810cdb1857d43a0558
SHA5129af0858387ad3331ca87c16f83f9e2dad5c70e7c32ddedd9bee3bcb748a10143e480fdf5b63a4d72ba6ad804e8f23c08c85cb0156964f27f672fee1946d22b89
-
Filesize
5.2MB
MD5272ab3f40a87fdf782605edaf65760e4
SHA154cc1854cbb7b8f238646e3d5247e7e78950d95b
SHA25604152a791bee25ecccdaafe52c8d768a4b59a72f822e0fcdf19718e08c03a3d7
SHA5125c01f54a4a46684f529072a2166842b675313dd0eb62233fd95ce000011d03380dbad42db49c52a2687de792e9d14d9d5bc63eaec6a165397984d1eaf69de468
-
Filesize
5.2MB
MD5a114f8c6b02cf8aeefacb17c2fcae783
SHA1c5c8c892d2362388060ab2a8ae56b905b11cd820
SHA25610addf05371266ffcdf311dc8d23c4582f056b7e89cc93f0b0c6b833790f1b1f
SHA512fd9e866245105faea3175552b69da36a33724492e8c341378983b17b87052e5eb25ec99062dfe17f62b9af5432108d6d12829d2d2555fb130e0cea5873f0a968
-
Filesize
5.2MB
MD59e2e6040d32daa8886e16389c5bff3f6
SHA115cd207c353b5e3b48e67f4c023e8aeeb3d40c9c
SHA256fa24f6af68f50de78f3434d819f68b640e0de58a3a798f310e88cc3e82e3d50b
SHA5124219c377f0060917538bede92e37a866e52162cb29dd9cb0967085e83a2130919efa2cd234bb92856e726e1a05cc58b06491d572cce22f29a5ae0e48f6311a23
-
Filesize
5.2MB
MD505ab09d3083eed7a78d2f4e655f90fe8
SHA1d6291e2840e46911e13aa5950bc2f3e9c15b2da6
SHA256c2d0e413b5c28fed75cb32df33e9c1ee6361bf9932419b68a3a4aaed702821cd
SHA512a02a61e01f9803a26b034cc6beb2c2dd9a3bea9b5a6ccab497be4513eebfa53d21d510f06f51c5ae31c064499bd130503a08c61292df235b6251cbf3612dc67a
-
Filesize
5.2MB
MD55cb5b29cc3aa206bedff72226cd612c9
SHA1942b2b964f426e1c593593816e1a39fe3bef6a31
SHA2566786ec5b4abef82d64fcdc0b5f3e4ad62e1baa776814baf2fda4a2641dfaf285
SHA512ae553073600c526b606feef919c2cc872cd1cc766cf3c8d0b5710beb049404db08eaddab446f7c6bd5d5e460835a1544b8e8353e852dc70535ce72bfb50a18f8
-
Filesize
5.2MB
MD5818a4ba27b148367e4eaedf661bbfe2c
SHA10be7326840bf69ea449ae5c04d65c26c757971ba
SHA2569e6065338bc3447bd6bab1bf57247088459a5e2356c36ac67463ba81cd4b30e5
SHA5123079b167b8106f2f531851dc4c3757add8a4fe8f1c72c232f94f5f8dcfdde41ab7c709739b2550a0540c83a8938ec69fb6fbc369426be185deda028b1d4f2bfc
-
Filesize
5.2MB
MD537b2e112d4c18348074b4857b98fffde
SHA1bbb271ef07f93b1d2ae9d3d82645c49398b1b9c8
SHA256364bb084a8fcef44fabc080f479b0caf25cb04268a25340662a771bf85a0109c
SHA512db525464cdc96fce984c648b7621119e5772809a923bbc78617e2e632c4eeb77363cf9a9da3cd77a669e94d57030b665858e00f7e89141e975b3ab70962a2c58
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB