Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-11-2024 15:24
General
-
Target
2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
21f308bf659eb603b4df09f06e7f6641
-
SHA1
baf719af332a52d9df08cfe643bb7dac3ecfb095
-
SHA256
8ee6a69509b3669509d7fad8f87452cd8598f6221a0673b1e8f8796dec77c2c2
-
SHA512
d0f7bb575c53463a41dd60e857c1d6d463a71c7c2892112b3095212593a5e90a446d11720ae37a386297e44045c4e84b2934245c53f4ad6cd0df81ffe8098cca
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_21f308bf659eb603b4df09f06e7f6641_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SfdhKqj.exeC:\Windows\System\SfdhKqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QplkdKz.exeC:\Windows\System\QplkdKz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbVyjcd.exeC:\Windows\System\SbVyjcd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPfyVwx.exeC:\Windows\System\NPfyVwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKmHuyy.exeC:\Windows\System\mKmHuyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxqWgWC.exeC:\Windows\System\RxqWgWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlRDcYx.exeC:\Windows\System\JlRDcYx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fatNXXu.exeC:\Windows\System\fatNXXu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ceSaiun.exeC:\Windows\System\ceSaiun.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GrmROuv.exeC:\Windows\System\GrmROuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NJCRHrS.exeC:\Windows\System\NJCRHrS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZaXlcQJ.exeC:\Windows\System\ZaXlcQJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEHGdYM.exeC:\Windows\System\LEHGdYM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyJuRXm.exeC:\Windows\System\OyJuRXm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PUJmwiW.exeC:\Windows\System\PUJmwiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TVPMFDg.exeC:\Windows\System\TVPMFDg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SnqNuAz.exeC:\Windows\System\SnqNuAz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXNVwau.exeC:\Windows\System\sXNVwau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrnQApS.exeC:\Windows\System\LrnQApS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LpWgPdj.exeC:\Windows\System\LpWgPdj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gtoTYBJ.exeC:\Windows\System\gtoTYBJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f2230c657b08a3da88c7bd59c2a024fa
SHA1c4d0eb6c3f1a16f2e6db4438674946371371058b
SHA2566023c538c5cc0d3a7c0bb3df5463c3b9ca97138466f8aaa0756492308ff92094
SHA5128256df275e23f11b58e483550ed0321e180efe01589ef0122760b97d62b8820148534e33013589258198de6dfbabbdce7fd277a9e871c77c6c4b3c28f6779117
-
Filesize
5.2MB
MD5d1187f9c418b51a3b8ddfd099ad83f94
SHA1c0ef5f84df3cbacf78a0eefaadb36378ad87ca4a
SHA25630256117cf592d0df167fd95c341058361fe3995adf1432b03d0f82985e256c7
SHA5128304323b14aef0d825657116dc806f4cc1d4ff0f46ce4e562adfde24cd5dc9b22a77763884551e8b0f60dab1459ed7d81e3d64bd6e7f680096d4c63163e8f804
-
Filesize
5.2MB
MD5566b2f6bdd6943fb0d993edc45fe6f6e
SHA1559ba69100f2c5e60363ad7682815a2713b9f6e4
SHA256340c189e6efb7d95e7990a2f24741a590730674de8d8964a8c457938ae00ae12
SHA512ae837e3d34c3e21a1d981bcbd5d065f331755713ca3c78b9667d6e6b2df9eb43ca829963ba8f30e31c5f539b71491a1bce9a0ecfe0e556f74f34f5412706c697
-
Filesize
5.2MB
MD529278290ee6a42d8bce25a2b3800af7d
SHA1cbbe05b99698249d9554fe1747523e995ae237d0
SHA256442c2c30a449ceb5aa84ffc4da4e4370951827ea9614281178796ff6ee37b3f2
SHA5125958f8d26c792bdfa5de88bc73c1340cbb0b1e8c6465e44a942dbc0f13fe91583c7fc9ef662dcd6c06773412d9352594f2cfe244e202adc84b6e449cfe08d3e8
-
Filesize
5.2MB
MD5bf99febb5b0cdd32272e5fabee2cd680
SHA1b86b7c7caa1e8311e7ce6a26630941af37e2a475
SHA256449347cbfd69fbccc7fadd390830c52550ad5669625a6cd12d0ab8ec4524e84c
SHA512ebdf50c4cc2c9529335deb3f868c7add06013eb13bdb53afad15796df742e239dd1da583f65382cdd42ffc450a2733d22ba0f35406a7a04df83980df140b6867
-
Filesize
5.2MB
MD59a41bd216c76cb936e25abf97f5abe0b
SHA1262a90599fd8df3ae6ee6aa2248505fed8388cb3
SHA2568e3bdede05422bff172952d74d359a04cffbfeead774627088a47ec69a269803
SHA512c11aed479739be012773abe5df284653a16ab7f1a00d874128d3e55e9cdd7118b9a4df9e5fe5d5dd94c0e1481e8a128584f5c70527736f3156ef1ef3365f1234
-
Filesize
5.2MB
MD561f3ff90016a0ad03712a077241fe2b4
SHA126fca1791292d24520efbaa89477aa0b790a0aa0
SHA256ec8327c9960b66602009c46336eed16bff79146e990fc39178cbdd37f046f12d
SHA512c52b0213b518706ede22b34f3ba739c183665b9d44a472290d82a634ebbe7f8aeffb1402227dcc63d4b513efe7bea7e5d2a54dd005a1d6167a22ee06ae74729d
-
Filesize
5.2MB
MD5fde5b70468b7e789c2c7cb070b1bda07
SHA152f02ad0efffe2999cb710a6e27f73ea387bb64d
SHA2564eb2a55838521912129788d7a72a46f1ebca8dd38deb08379de178d430f9e5cd
SHA51213b893cfaf5a6f574e803e47b60d7627f294d59e7d1767269ec8c0ba3b2e35a975ec3ffa19131c46773b82acdc5f1bd51a45e86c62f2caa55e2a03ca286a9211
-
Filesize
5.2MB
MD5f2ab449c76a89b0d1efcbb4c8b031f86
SHA1e53258e5201ca82bfc29997dc59b77eb1b7cc3b5
SHA256ab574926aa35a5a6c2b645d61fb4b001c7dfc75b73f01f5ecf81cf37acab9f38
SHA5124446027f4e6357b02ed8f007ac390f0a0a145c8776fe8fc84e94d090c4f4595b10f4899ad9e42c515841c54d05e6bd45e4a45d06c4c9dca13b18d7593c003cba
-
Filesize
5.2MB
MD53c3afef8991c8cd91ea1272f70cfe705
SHA1263c6b40e79b192c435be19068a6577ef474730e
SHA25663bcf3d6167685ebef940fccba8bf773e223448394e6d20407891512a0beaf53
SHA51219360df81cffd8fd4564b450f8af2e4705aee8bb8af0ad4f91b4f2452f2ed5d005e82b06f2e92fa5de147756f5cc3c0162de26ac0b69258fdc3f19e68db2ffea
-
Filesize
5.2MB
MD5adc45b19147542675a67a1b7e6ca0d82
SHA13b0acfda39cf84c1f3b526d1a3b59a0cfa90c4cd
SHA2567be474772975fa2bc1cfe002dfd9926ae1c5f337f12e219ae63e164583997f3f
SHA51265f0bdac92c9038852899d508ea76f03bfe5f51b4e5a85883e7972aef60eed9f37ef8e9655aeb2df35d8b75b9e02fa28114efce568a60fc0e1660a9b7be26e02
-
Filesize
5.2MB
MD59c777c9747b6f7f709c8fc435b57829f
SHA106d49ccdeeb509677b873882785e787bf305f42f
SHA25692354bb9c7c70c79eacc9c180129885accf572807743443584735d73dbb46096
SHA5128178064e4b1217eb85d9161a29b20455e99ee3b36d19318a7d63e3e48fa18a81921e68bdc0136ba04726412f066f2df71828c8169bb54e077a6ffe13c898467d
-
Filesize
5.2MB
MD53d647f7fb32d568f25888bff87f037a6
SHA1edfc20f94823fd5748d6943a658207a0f993c1c5
SHA25618e3e5664c3b808af6a0531e93b92b8a5174d7bb250e9e7f3a7f299d66ea50eb
SHA51212f6d2a4ecaf31b049d02d4928df5610ce4d47d0dffcc6d9719a23c067ad5580628359dc5783dd81eb49febfe8bb34e72f7ae4177d48f86927ec40da1978eba0
-
Filesize
5.2MB
MD54aa6f662d2be6ce67e8cf72f6f808360
SHA1e52694a246a53ddb12e7b39f250259e89080421a
SHA256aa463188d66e6eb24b85ed5bb2cb201c02a3e1bae5ef16d56b8616796c5cacd4
SHA512308706e3315b9100c984ec433407e40bbca5f62fda6e21a3d90136aa3088d1e03b89fe1c84b85e3f5ae7b155b066858b2476333074ae352f88a8fe5ce3e7c4e7
-
Filesize
5.2MB
MD53410e27a4fd8df8af36f781abcec7373
SHA105bfa541e19e9f9a01b0e647aaf22834da9f7e1f
SHA256e1da8cdf474b17da4f1d7de6fda570c0f2ef19c4b84e8ff5cf1c36acd3eb3363
SHA5125f19cd9b3032d4bbf5fe68f63db1ae61226dae4883544840f57ea4bc4e21666b86f85c8b9998e6e7857ebc06ebd820a3f8ff7afe05a6657fa7ddb55d95b72232
-
Filesize
5.2MB
MD5782d58ef2bff216fc850d410094f96cd
SHA14035790f063aece628b50ab3a44ed51d3ceef5a0
SHA256bd651efb4c7ca15303d3f727453f3000513924ace87a311f12fc185ea38ef565
SHA51285b41f1aadc308550c706d04cd5e2b542a1b0622caf844ad084f7ce4c179cc0c669950a4f8ecabf3d144e71087f2d1f114809a46bc4dc84bc4fa62d632173f3c
-
Filesize
5.2MB
MD550e6035424b63564b86b1ecc7a6972d5
SHA12b33eae690ac7a79e054f59b5d44a6ee2db976ac
SHA2568ce994df690e50fd61c72e6fcaf443bfd2e1977591907b9e881fbd70849d75da
SHA51259a42ebb20e72d7c15a1e30cb38047f515786c3b4e6287524723fb5338d2704e7ed0167d16a097110691069a58ba403010a6448b155867b9bed0b03633156ff5
-
Filesize
5.2MB
MD5e569021c2a7179f51e179174ae198441
SHA1d157452d177252aa234b0d6f3f74366ba2abf54e
SHA256efa59a85f96046ec3178869ba0a2c719a3b99c80afccda22c0b469a5e77ba5de
SHA512c60e6dbb876dbfaec99e0e9c86f134a6f06a9187fa4c09d07b7a4be63041716e758307bdb37abb7f6ced02d8aec0ad97c15d4272fdaec511d2fc6a2d584ff7e8
-
Filesize
5.2MB
MD531f540290a49cba4c7eafee229866970
SHA18aa3a26d840eced370bc7383a5666c156b56c777
SHA2562f198b4b9e46a217b638387c5fb7a9ca4b05d244b020c588f6cebee04a603b3a
SHA5126b4aa6c8a3e435546fdf535a8d82a9c26678a30bdec3b55bb7548d54b92ba479c097d10bdc7f3084b4afd3253a8bb66205b0ac02f2a467ffd673a3b34ab0cdc0
-
Filesize
5.2MB
MD5eb383ad16d8ec686d101a1237ed8425b
SHA19eb2ce56e88f19bb507a3eb7323c04d2b7e056c4
SHA2560f33e47f604c2894bfae6972e64f3f49f588f95183a3766b64a8aba42e0c24eb
SHA5124f4a58331327112cc4362db952046b65ed313282a7dc2251ad9fade41d37bd175b7a3e3a4c1452fe8da6fa3edc0b790bca3788426d1a68451b373d5a872caf5c
-
Filesize
5.2MB
MD5c45f9b6aa51e6e58d851bea2c450b9de
SHA1af26aed2a4729d14a03fa3111a29fe88769e547b
SHA25617ba68807fefdb32029de89bf1ae2de985d93ed186b35a296edd6dc8473154f8
SHA5128e85eee0d2ebb3ade468a9e8aabaa243038a0ce460ad6c9eb5522b0e589c71e1a13388f27d6476cffd916cc90b6cba00509cb4fbcdaab1725dd4ad52ca4a7a4f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB