Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 10:13
General
-
Target
2024-11-17_ff96732e7fe0d9c889c7752a069a5d1b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ff96732e7fe0d9c889c7752a069a5d1b
-
SHA1
f92cdc2782da4fa8a14952ebe5931d4bae873aeb
-
SHA256
7df55db767d4431ede8e8cb48702514a0a66d79cbab0c9efddcfb1f71c943639
-
SHA512
dcf32944fcf203b5650bb8d603889d7aaf890880c4d60892cd7fcd97afa9cf4960e2f35920db92c39e3b168af05fd2c03283f4304ed55ee859755e4d2ee215f6
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_ff96732e7fe0d9c889c7752a069a5d1b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_ff96732e7fe0d9c889c7752a069a5d1b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xjgqBsX.exeC:\Windows\System\xjgqBsX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyYWCoX.exeC:\Windows\System\gyYWCoX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FtRIGtY.exeC:\Windows\System\FtRIGtY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\efYkkrg.exeC:\Windows\System\efYkkrg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kBTgjMS.exeC:\Windows\System\kBTgjMS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QZHnbPq.exeC:\Windows\System\QZHnbPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uyTqLts.exeC:\Windows\System\uyTqLts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtcekME.exeC:\Windows\System\jtcekME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\knCCDjN.exeC:\Windows\System\knCCDjN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuuyEFF.exeC:\Windows\System\CuuyEFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvNLyer.exeC:\Windows\System\VvNLyer.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwDrlhh.exeC:\Windows\System\AwDrlhh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bKddkUo.exeC:\Windows\System\bKddkUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LdqCVvY.exeC:\Windows\System\LdqCVvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMZFODJ.exeC:\Windows\System\oMZFODJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlJdIHE.exeC:\Windows\System\xlJdIHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WPTulXD.exeC:\Windows\System\WPTulXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xGCBGjt.exeC:\Windows\System\xGCBGjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmxGHri.exeC:\Windows\System\pmxGHri.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eBGdxZx.exeC:\Windows\System\eBGdxZx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZGhxOfw.exeC:\Windows\System\ZGhxOfw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58ff01a985bde2d7f5d158203516e8c42
SHA159ab32d8f5f145ab75b736bca742922fb701a04d
SHA256f1254fa736c875f9db77e98bd4551c19c5d9258d045cfd0b28885488d2fb202c
SHA512000c647734a07b2e079b7fca19b30aa4bba0f15b0dc4360ebe014159e64b222094ca5307a1b06111116e96ac9120a173f2dc649c46d427210714c44f81147d9d
-
Filesize
5.2MB
MD597b529c5df75d8300f10affdaa3a663b
SHA161f9a4df48165457b6e4f0e1944b412444c4a1b5
SHA256f14d29189bec40a94deb1fda17680bde574c63808d05e23a19e3b05be55a1926
SHA5122a9d66bc5c3e1864ad8332e603327d0a03662a7651e7b5cb21e2caebe67aad7726cf23dcf3167b61dbaef744194a407b00216e4bcd3304b30753dcc0f07afded
-
Filesize
5.2MB
MD5092f678e598c61d3cedf546752a2b4e1
SHA129efe9baaa50c506ff1318b09d8cc1fcd05177c1
SHA256b49166bffd91c7c527afed27ddc7b8f69f1156a409a45448580678aeae8ac488
SHA5126a51d65b271605d1961c1b4efedd4bd6774234abc8528c54783f4291b2bf49c9e4a6d192a3255faa989e9aeed85eee26b3edbd90fc142ea1a490ad419d343fe2
-
Filesize
5.2MB
MD5a8d7b1cbc35892f79f82f625e76a3fbe
SHA1dbc4780b8dcec89559965714aa6d0c85175d5295
SHA256a24ca48fee58061b37269d3395689ee212d676b8c304daf92bae609fb057ea25
SHA512bc6780b8e1bcb665574626a8a92c3ecf7ed62eff19515169cb4f97fa19ce5b3a0d3bf467d327d5245d5092f2ab7758138c274a90fb2c93f8edb9be1166d9e004
-
Filesize
5.2MB
MD589a9434e31441e9b3c98f0601e2b7587
SHA1ba18cb4d72f18b9c6d45ed85edec1d5fc1fa46e1
SHA2566ed993d4ea8c1e8a3e6f242d4fc43da2dadbb40eecd31ccb48d223d7e403ce06
SHA512dad9c7d2cb90f67ac61c1b427e73c21344ad89f436939194fc2e795d888dc0206ab1b4b6521b6b670539c8114927a5395a36348d8e906b852b930ff3889437c8
-
Filesize
5.2MB
MD511ecbd81c425b5c660049e6fb7e90523
SHA149ffb30506d3999ad177879863924128ee30feee
SHA256007b68ae11b59068d9e303b5285756f7ace3f9ac1a6655e5c712fd67b147ae4e
SHA5121d47173dc97537089858c6aab15ad2a51ecfabf7ec1216e0d5d394a329ef7e5e4f90a49b10c3fbc776e61bc062d0016c6b6a86ccf7619e0d75f0e65b04e2c83d
-
Filesize
5.2MB
MD51f1b88047047ebe886cfde09a7f3146f
SHA172f1257e3e4ed7c2e99ab8a23f8fd4366241be32
SHA256cb8f253b681821ead377e1cc9aab5671708e485b976b7310bca51814c2636522
SHA5123e665696d4d52b1ae08103e36d5bc7c694b3ae8ffb0c439f5fb54f15553cc22418d7257148a52a8eca308d04765af2b14a205cea9314cbbf2a2f62bcf8a2e256
-
Filesize
5.2MB
MD5638f506116d41c304255fdf6fceaa744
SHA1cbd280efd4f1f7f576cc72bb5259d020e05e2c6c
SHA256e9f84616f97cf02506fa0681cf11f4fd4f9b02c41371b1287b759aacdeecbc01
SHA512e443a7a6e2a3321c4ff1976ea743d33d4278f8a69a4f666b814961d9c96f69eb84b959ea202f8cbfc6a19ae5b0d5ac096dcd95e8648a4cce6ec38b05b47de5b1
-
Filesize
5.2MB
MD5d733a0c9ce317ae043fd8e919e1010f8
SHA1d6f9d6ee965971da93ac49f22a8b9cb2e6611dc6
SHA2562a932444ba016c4bc61090f194055826e4906f4034458629efc707410bd121ec
SHA51215a3120906838029c7de8bdcc9123b04908e58047ca1cfc7b009eaedd99df0324a0bb3ed215a20ec2a3d3d7aa5b4d90e36c4524de82ed6011456e8b8a4674de7
-
Filesize
5.2MB
MD5d2b5a1a0dc94c3d52e0a50e32d57c16c
SHA139456539051006ee7bc925cf695f11b64bf8e594
SHA256031801403be15649fee5db88f7766c7fc965a702ece48cdfa83cb76ad07c5ddb
SHA5127c72530b1cd1557b8940496d7b8f5540ff7c61cf3a897bdeeff5c52f70c56e67c2f0fbbdabcaf98099d1acd22dbe8260475ad6e2a7533c767e53a79a2ab130ae
-
Filesize
5.2MB
MD51d5412fcd822b8144ed42a6f4bd60d90
SHA19a7d89517a4f7f4cf7d3d94afa8a6647a9b89bf1
SHA256b9c4b4b4856d0d3d8e1187065559db537c6f52345233c37fe9a021c24e05873c
SHA512673898d00e012e174352ac929084d9e03d5a6c5bd44a462c52d9e3874040f618d5e5fbc384cb2c93de6cb0b067c5a7fd93dc7a6fca74ca0c4e746c4a838ce15f
-
Filesize
5.2MB
MD5a4bc05ebacbdc9cdf8ea0b091f688aa5
SHA1a6fedda682a84a7d48874f54ea818faef9a7df65
SHA256e5f3b5ac8a05c68bbbb25e01bf47fdb95c15932f88421c56ddc7e139fb743f58
SHA5125c89351bb827dad98ed252ab68c0cb98ca51594c9efc0d9344b57a37f64ffc5a5aad32a57087fd588660f2b64be15f8b530cbbbd8fab268b2d351af605449356
-
Filesize
5.2MB
MD53f16fc3b1727388af4a0f6dad0f186e3
SHA1becf1f988d2aea8203e646dac46e5c2e3e98d757
SHA256fe3894479cf7886bc3134d090d50ccfbf52acf25a5ee59cbb3d9fab9ee8bdf07
SHA5125c3c1c5d67912cffe2489570451c63f84bef9000ed0cd0cb3b030fa18382f3836d6cacbbec98a97f9f51f561760e00ded2057852f72fdb1a3b9cf58902b01e86
-
Filesize
5.2MB
MD5a8cd9061eb58a50180cd701b808be529
SHA15636df0e8b782b8d5f41da94ec830e2969b0fc2c
SHA256dacb6b6f5bf762a2ae9cfeda57bf042b80d7ec35430b2a5a1fec334fecd737f9
SHA512fe3ee67f6f9c2028bcebad320fe4a1cdc797d3a684f4952c51da0c2eefac965fc4bf5d1cbabbaf75d972427844c1adbc91ae60edaa547034906913699b595864
-
Filesize
5.2MB
MD5258fce5fde65d9a923c3876227fe9cbe
SHA1ab687378909e9da0c28409c84cfbf25c0542c6d9
SHA2566aa0bed8f355e03b147e2809fe38dd2a915b14507d3817940fd42c137d7ca5c9
SHA5129ca7b5368879b273b54294ee2cdc72da18790fe6e90c6f1a30142dc1272bd4ea0f0c5acba942f1c9dc7970bffe7c5d6e0ec16d2f99cee7f26c382c49c900f644
-
Filesize
5.2MB
MD515283a1078754f52b33d9dc5665794c9
SHA1eaa009618b5d83271d28a98e54190327e52f18b0
SHA256c637bbd7cf7bb5fb94a78d69df72dd7b3c4ead86b6cbb08648623e67b3bc3fd9
SHA512fa1df79f56d62203743b053f18e803ff9a992b824fc101831192a2f597051e4f36b8c04e887420cf20e6cd7d5d4ded4151e499e8c45da26f1132a72f49f41ee2
-
Filesize
5.2MB
MD51cd2a3bd19e25986d856b20061396ee3
SHA17d813df15fa0382f586323d351cb3490aefa26a3
SHA256e26051c61b41c1823d8a54038025997eb3c730d8f2b741db441f119b93f2ecd4
SHA5126897d99ea2f4a06e713d869f6c938b85d36ce500a891e3fa431cccfe837752d4af481e5211300036e102334572ccdfbb47c08bf438077cf192290aca2ff79e5c
-
Filesize
5.2MB
MD534a400151ca88b2322b5e338b16a6f12
SHA1371bf5dfe176fa9b905633b146186b6aa227445f
SHA2561bc9452026688b8883c3b9ebe42e63b00738e271c32d435e29a65d4c7f3d28c5
SHA512a30e9ace7edae9ffa53675ee396e124f7f3039582adce9c6860e2fdfe436d0a1e9795ebbb87f10aca703a621d2eb717dd3fd28e92491afb1a6e010a8be4d2675
-
Filesize
5.2MB
MD53c60c9dd604612dfbc5e55f988bc5da3
SHA154b6547c6fbeabd26418eea582af5f8c69acec10
SHA2569be99a415a8beecd9211ad6e615074c4c0ea16b989727cabb7208ce96e3dcb13
SHA512a14fe4c41642e34564aa4628f8e0c55040db1f3b99323356e5b9a991a174acab10bfca836a63b2ed8750d9535b0c177dc4262fa91715a9ff29963577bf93a7f5
-
Filesize
5.2MB
MD5e659e86520b6319d088f3255ca15a81e
SHA1660ae7fee5e0bd25e6d18a01de8c1fca769d3574
SHA256c9465192ef4a1f26b38bf682ae358afd3523ef9c07a0e24387f54541d27b8d35
SHA5125c92af937d16997dfc96fe539d906faa59fde647cda2f7a504b89fa2b0e8e4ba9d7c7a69d9d80af2ede11d67542a500f7a5d1d5c0eb0d6ec6a7502b666f830ed
-
Filesize
5.2MB
MD58fb9eb980c1129c842263ee3a021cc01
SHA1b6f876c2ecf9474fd9d695ee61ca746ae094596c
SHA256180326ece62d5fbd3bea0d5d4c7db8ea2e0ca1fea0cd8476075e56be0a43be1b
SHA512d5a304155ed51e197f47dfb257720da8e2cede5d33c3baca504c1d85ce108c956325045888884d1777252f7bbdcec5dbd4abfc99f085168214c1e64cda50fdb2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB