Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:12
General
-
Target
2024-11-17_ef669fa0aa37beaf6132b9b05b594e1d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ef669fa0aa37beaf6132b9b05b594e1d
-
SHA1
4b061f6769e2b52b9ea2631d75f99543a021e966
-
SHA256
08ce4102fbc224848fbe3863ae9f59e347dd4d287a8ad9df5ea06d34c9b01f95
-
SHA512
ea71f579419d2b0398e9810cdfbefde47013128b18cb4e5d27b1c70e9c190e4be5a5beb49ddeb947f41e62bd04eea4227910c1c90677b43aca14f16114dba848
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_ef669fa0aa37beaf6132b9b05b594e1d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_ef669fa0aa37beaf6132b9b05b594e1d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\gYqEqkB.exeC:\Windows\System\gYqEqkB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\daARBJh.exeC:\Windows\System\daARBJh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmsBBbn.exeC:\Windows\System\RmsBBbn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryaZesp.exeC:\Windows\System\ryaZesp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LCejsOf.exeC:\Windows\System\LCejsOf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vgQSNJw.exeC:\Windows\System\vgQSNJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qsSAdhU.exeC:\Windows\System\qsSAdhU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zTKGHWq.exeC:\Windows\System\zTKGHWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HilADDG.exeC:\Windows\System\HilADDG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RimmuxR.exeC:\Windows\System\RimmuxR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isNxjfV.exeC:\Windows\System\isNxjfV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ViTgrPe.exeC:\Windows\System\ViTgrPe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DugNIiA.exeC:\Windows\System\DugNIiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTVAEHo.exeC:\Windows\System\BTVAEHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNNProc.exeC:\Windows\System\hNNProc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gPDaUXC.exeC:\Windows\System\gPDaUXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GuRUMRp.exeC:\Windows\System\GuRUMRp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mZGhpXl.exeC:\Windows\System\mZGhpXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKIsEfo.exeC:\Windows\System\AKIsEfo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHaNBdO.exeC:\Windows\System\tHaNBdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DBUPrOV.exeC:\Windows\System\DBUPrOV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD560f6dc5bd2ac2ecc817ed763f2d35507
SHA132dd15b9786e159c4df1a6b4ecc704b18058380b
SHA25678cf4e4d7df44387dce42bad79160447edadc4f3b8ed7d0056ce071b87f78e8f
SHA5120b90fd432674133a57e485c5f675e693bcfe38755fe858341a6c54f0553570d61c55555b18f2dba1b6d2c272dba317507170579653288ebf72be14a9b61bcc5e
-
Filesize
5.2MB
MD5ab4225b0de2dd85d9b91dcf237cea2e1
SHA1ba5634c26e96920a1a820b16e9494bde09455746
SHA2562257251f99dfd2bbb295414c9e2f5a0d9972e0fbf8aca95608eebd280a47fb2d
SHA5124a2bd7172f02682c441d26dd55005ebe6997e3e2477a344a2f2657763ff4bd668f92e60aa7f90d18142d5f868a9eec11c75ac6b63e673ffdfbfdd67ec3db2329
-
Filesize
5.2MB
MD57038b42ac17fa61faf898a502944703b
SHA12e4daca02c3bcfc2462557ab7074879a374780b1
SHA256f570c804494b0876af3519b08075b00896152a7abd5a56c2ba768560ec6f2e7c
SHA51205b5f4a1d188fa2a8ecbf6afe56f60bf08c08b59979c14f34bf0c6c473c8303dc098a689a566409dbb7acecb367b912360194dfcf2eec19af0fca3532f708afd
-
Filesize
5.2MB
MD5e1bcbd71e92f79502dc987e9b0ec5a5b
SHA16ff8817f207f064eb3aa94e0611b91a4297a2404
SHA2560e4e7a5aeca349927344446caf293e418087124438a1a6b6fceb4d77f990c28f
SHA5122a04a096dfd2a36315ca60e22b91cd5231620963cb2a78592d1bf93451419badd74f3851e94c958419152c43acb360c1e763ba1398778c64f69e0122f9405b7f
-
Filesize
5.2MB
MD5fd1b1556a76103e25ab01777369daefb
SHA1e4610a93172dc29a4bc0c7a948b060d4409ec5f5
SHA256bcaa8b38993eb0d74886d873f5a56e5d33257102d8d8d20243e81cde816e05df
SHA512aeef04282c38e56c5495ba0cd8dfb8ebd3bf4b69fa6a7523bb3a67148ffff36d8cf424baeced790e31863468ef2040b6392bcfb788be034233a0b09ac551efcc
-
Filesize
5.2MB
MD5f6c724d42840ec1988ab1a44dd6e69d0
SHA1cfad4b30684029e4b14cd04a50514c247b6ef0c7
SHA256d76a4768e78efd6e2ee79e9d53679ef306782bd5424a3cb990fe129563f797cf
SHA5122532e52182fbcaeb35ec874f36fa300d25b63d21c9f879d9313320fb048e5589116db8be8112585a060ede3f1d36ea9385c481f83801a715358d9d529c2212d9
-
Filesize
5.2MB
MD59523ae5df4f9cb37b1cafcaab4d477ae
SHA14681720282c29f88799c3a721df7fded9710999f
SHA2569e7cb39ee32fda3eb2ac8e77b0a1d5df3c9d682f8e6bd0051ecbcf48a29b6850
SHA5120116028dd85342a1f7b869b3faf567f10334c19a9b288a8781c96a783f6687b243a8ac83b559c3e9f0dd511f8fca37b3319f33063f73288f005a32b9316221bf
-
Filesize
5.2MB
MD5332ae6d04f30a6fd9a640376952f67db
SHA1aab840a67149977fa5da9b78c2deb2005b612faa
SHA25633a0596e86fc9f4fe496c3a0ff26951e8c17beecc106108f7653c5a56baffaba
SHA5129bb2f1c42314abb0195efc29cf870ecf2d3f41b0fe3b43b553723e7d26f04cc0db7964ce7b925b9bea4a323eba9c82203f7282c4ce4ec08a54df5a2a1b863e32
-
Filesize
5.2MB
MD5ad52bb78bb8e50ac1db21060d2387e66
SHA167f549fd50f1ebc8913c05ced02b959c7cd63970
SHA2565255a0efea4a8334a6033b6206135d71bcefed6775d0365ba11d6d1a4adc8159
SHA5124a6ee850fac955b870b9d64fa3a6a034a7ba37cf52a01f88f44faa50d934e7ebe70ac1ab7b962681486013c9ab91976a2f9b533e32fa0bd5d044fe6618c64d12
-
Filesize
5.2MB
MD5fe64f958d2acf708de8dd14622aabddd
SHA189b25620dbeb0fc007ec8b60507c2bd812628391
SHA256e697b674bcfcb2fb9da12f2b280e757d22ff42faae0b7decc53d8b5456985645
SHA512083f8f42b6050a405909955034d72e50165d4ed127e7de208f8bb2abace1f212406681b37e6af96939adcee6088b13bce3242b30a64b0cc35aac3867ff662e7f
-
Filesize
5.2MB
MD5bcf33a29d86c905e0be2a33bbdae4e90
SHA127eda04450ec4fb86356fafa4ea80a4f06e727a6
SHA256b7c8b91b4c2e67a9e8a9811e08da7d29201522c0ffb63c942b567bf822813d89
SHA512d81e903b5f241fa52702aa4c5f5d7aeebecb96561a834d4a85d33132fcb45c5c71cdab60571397014ef734aae51e70b05bce6791541442aed7482dba17fad5af
-
Filesize
5.2MB
MD5cfef8311d388873210ec7e23cde7e0b7
SHA165fec4ac73963724d643106b29e36d60dda9dfcc
SHA2563803e7de905e353f08086624d264bba082c3e48b311704acbd479ce767816005
SHA512b173d4b84cbd0d5dbaaddbb1c465cfd4a747ff658c5efbb5bcea1cbdeb0ea32a5ed281d79526d78d471462d16008d5fbc1926750bf51da8cd9a3f0d539299b38
-
Filesize
5.2MB
MD5b308b4074e22d04c8d290f93de7ad0be
SHA1ad45df00195775fcd93cd1014b05ae692e2bc0ad
SHA256bdcb0335fc1ea79891953d5b541ec0457bb331aa7f606fc2dfad5eae4d638c03
SHA5126d547cad254537467924adb96460f6323271a964a981d67c60a9d9110caa9fe8dab1ff893e95d5c6294427b1dc024aadc38dd88f7abf4c4b685a685e8cd8a71d
-
Filesize
5.2MB
MD5abca7b315bcc5962d6d86ab9df2d178a
SHA1c945b6b5dc339f0091a44552d96dbaca7891070e
SHA256e085443b942d799e01a1a95f6f6caaf8d7772c25bdbc63230a5c4f33caa1b575
SHA512835426cd4b12334c5af3449a48c4d746898225bb8409291db66a0a32d44f93f0eb765aed0eee46cdbb0e13e34c65e1c7a75fbe1e564df56320a35e97534c4ebe
-
Filesize
5.2MB
MD515d4850579838308bf3aa9ddacb3146e
SHA19932942032b478dadfecfa8dd72c731798d02d77
SHA256c22263e3b9fae160b96b1e3d5705ff34aba71fb7b0b1f2a8297f01a4ccfd034d
SHA512d86b4b0ea6e33072ad0a7be88b8c32ac65c6d1e418834e75406ccd454442ccac5ba69c8484a96c7dc648364e42fbc91f6fe47fd1a0eaa449e0650d5b35463fdc
-
Filesize
5.2MB
MD5877a32b33e3cb87ad42bad6c1258720e
SHA18470494f40ebb03d0bb66b74149df64fbbbe0bca
SHA256fd1deedbead64031cc66e72ed2101e469b5b58abb4934b8197b7bf241210887d
SHA5126c702db078d8db3ba1527816032910dfe1882d1c57362367cff8202bc5cabe82959a52d3fac3accc521f90cf509f753f4e85e16567e68655fc2bba05f0f6f31f
-
Filesize
5.2MB
MD5652adda28be2525384e8aec754d9a698
SHA1dca31cbc3fe0dd8065101a37692a213b873ee11a
SHA256abd97e0a48274b249bad29318638b3a940463b0b7bdbc8bdab70c35e35cfa46a
SHA512e3391eca43dd7ea5b170c15220d7b3b66df090cee6921ebc36f3452dc5eabec0f23f2101a3fb87756efc4eacb2b4fcbf4ae4acab3a59db7157a59d867ec52076
-
Filesize
5.2MB
MD5feabcc5121439e1c49e9643f0232845a
SHA1d02d5bd4a6fa5104c295d4369ae58259d7a74bbd
SHA25655bd9d9d01d2d333d94598f5df126c541d8f8ad6580d23f6718724f3af5496aa
SHA5127f9c48dfca2e20ecdebb2a69abff94e4f83c888e3ceb7c289aadad774b5b65d85d893dfeee1e8889b14eeeace0a796398da4b8cb7d7958a0ae3bb878cc645b2d
-
Filesize
5.2MB
MD54351820e71e340c175c4c658a3b56efb
SHA15eb3cdc876a0663045f6a5f11fc7cc7fdfbb42c5
SHA25647e4423fa9cd260f0cced2b121d6cbd7a6350f1fc88da807dd1e718c05e9eb4a
SHA512a2bd531729c1e161d6cddcf23b15c4f95db5139bf342b09e8a8c655a4335182acc5a847b79ed7d8e27abdc74b2bc2acb8b40ebd9e1dedf4c1e24bd619d5666b3
-
Filesize
5.2MB
MD58108c065455185ccef670a70f8adbc62
SHA19074023a9f99d1bd09ca230f98f5962fb6da8554
SHA256bfecffac7129429e612eca9096cede27462f092a88c2e3e6a952d13fb18ce6d1
SHA512c65190851041e7da7999ca11e62d494c9406eb40f2383f733d59b5e0587eb77b05f25349dce1a73b046681152a4dbd1af9fda07bd321a1cea4751d6ed19817dc
-
Filesize
5.2MB
MD50e6be2429cf727afcb777ff8ffbf3d58
SHA178fd74b66a399ab06826bb06dd089c9cadf52416
SHA25633862ab3690b0e500fc14f0e646f07450e4cc87dd90e68e6139a8068c290d6e2
SHA512b7661994751604c9a1a46be271092e0fbfaa90c21b59b423388ea32d1469641d34905f5761ab54148ad4cb60822afae4e27fac8b82a927ef185578bb96e83d47
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB