Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-11-2024 01:38
General
-
Target
2024-11-18_a9bcd1e3392651c6a4265e174ce9904e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a9bcd1e3392651c6a4265e174ce9904e
-
SHA1
f3add6325723b34e4621b78c2b18c25aa9e90a50
-
SHA256
fb102bd06b27191d75de52a20067bb8726a06e70ec332b55c2066adf0066d23c
-
SHA512
438eff2a3191ff406ae717c02dc15aa1f307314adbb10003c7957d1764bfb79dd0edf7a13f144eaf760e21c698c13ceebb644dbe0011afd0fcaf434f4f4c4c6f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUz
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_a9bcd1e3392651c6a4265e174ce9904e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_a9bcd1e3392651c6a4265e174ce9904e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\Onqaanj.exeC:\Windows\System\Onqaanj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xWsDYxG.exeC:\Windows\System\xWsDYxG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OhjkyAp.exeC:\Windows\System\OhjkyAp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nJhzXKp.exeC:\Windows\System\nJhzXKp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtLaAJi.exeC:\Windows\System\NtLaAJi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xRVAFzs.exeC:\Windows\System\xRVAFzs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DwYzAbv.exeC:\Windows\System\DwYzAbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kaziEri.exeC:\Windows\System\kaziEri.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aTvFpaX.exeC:\Windows\System\aTvFpaX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kPoLftt.exeC:\Windows\System\kPoLftt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sacdCow.exeC:\Windows\System\sacdCow.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BUiELHL.exeC:\Windows\System\BUiELHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XinJiIe.exeC:\Windows\System\XinJiIe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cfNsiuj.exeC:\Windows\System\cfNsiuj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OUwLoTw.exeC:\Windows\System\OUwLoTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\erRBRgH.exeC:\Windows\System\erRBRgH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AenTAZw.exeC:\Windows\System\AenTAZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhmZnvM.exeC:\Windows\System\nhmZnvM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BolcPcu.exeC:\Windows\System\BolcPcu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ayDOAoj.exeC:\Windows\System\ayDOAoj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QwGCidz.exeC:\Windows\System\QwGCidz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ca8af6ed6e64d57117ccc6129b804b23
SHA1b508ac66990e747e0fe289ce2e92950304e0a3ea
SHA25622a326ef87862eb0863ab9bac39c15a8d0f185a292263eae46ba625939007231
SHA512584aaa5db1ee74fcfc623da971442fc14763a2941e0966019e764082293e5a7ce48cd9f10ce82053da53c9ff3146c5f89a097377d6cec76d56a50dde1c54a0c2
-
Filesize
5.2MB
MD551922d0b2a435de4796123de65b7fbb2
SHA1fc94997575a47b80f8baec94327aa6e35c27ff01
SHA256785bf3c447dea7ad63d3e927cd8971c2e5bd276ed68f09a1905223b0f9fd71e2
SHA512ddf97e75c2f962381e8780aa87566948edf898a82375c997900c499ee3cfde17bbd43719454eefbed30058e6d36ddd36b228c27c19059b9c1c83d8e981722b4e
-
Filesize
5.2MB
MD5874ea9eee600349c44dd722ad385275d
SHA1f244ac47ab6a3327d5fdee08cc28b9e3e56ee4fc
SHA2566142ce2277e9e5b0ef1ae82f4d5c05e97f488003f0fc2ca7bec6fbc910ba9384
SHA512b7b4d796568548331d83283804fb3991a4d40b5a9c456ce62394ca4fa943804b1b514974a3a2d1128b93e621972d5ba8c930e797bd8e6afb47d6063047828008
-
Filesize
5.2MB
MD5fdb173b4295573681b5eb56b549e3740
SHA1fbea0c344368d535b09370d467ee15f60f17607d
SHA25656fcceae40fe307da7acb7ecb1c27d510fa1f6024e5525be4803f53f2d61f007
SHA512ad9dcd6e61ead968e400462afa3642460c3ae8650036d0e4c81873b3a005f528bb49fb0edb4dc9c448521c52fad93212396e9702b89b9aec547d66aac8289363
-
Filesize
5.2MB
MD5497e47fab7ae924048b687a18decd52e
SHA1032dc9747a2f25624a23e17848912b0853b30171
SHA256c8cdc6e3251b404e13f5f303cb21c122e1a30c3fd70d1518a7f7ea2d80ae0122
SHA512f4e88a2991add418e55c2661fc78b3dc6b47f32d01babec9eea709fc295fe57b3329f393205dda8b0a03c38c82f5615e27be6ddca5ced68d910c7f3fe77e448f
-
Filesize
5.2MB
MD538a24b91a2430701b2f0b8e523edad01
SHA1fe4f320a8fe9993c38f0daab957c770e91b87920
SHA25636ba553817efffea14a5ffd4527ca031c927c35808c05b1fa12471a616bf3e70
SHA512ebbb2375ee378b75c0bb5678a2011530625484c2183329e018e62146736e54696fd5463039573692a24c1e4d77209448e5342788d892e465c47ba2aeab9a3576
-
Filesize
5.2MB
MD56de463c60b7c6a09904ee1de14550917
SHA1e67c9d57eec2488c32494f5bf93851cdea0ccf41
SHA256ec27459360579b4bb0918f8fec28e4d35f98d862b8db0c335369cb767ea9d7e1
SHA51264f7569633dae14bd4787849dc90e2a0d05527ab8d16d618149d2672c01ffc2badbf8cafb5dd4969bcff18eb95b48d16cb5d4c730158d488535155aee9e4ab81
-
Filesize
5.2MB
MD53cb6940ca1870a056f331cd4f4832209
SHA1b2bee2eedc2870aa61b43d3fdc24cf830b06ab10
SHA256c3abdb05e9e8996e87a5d100870d0f549268aac205a7ebb7cc9b31ff35ddb2bf
SHA512f9e0ecd9b880535212d1690f045bb3dcbe158c8456cbb9fa2ed21d0cae406a66987c94bd6a40d12554e71e33a64559fee2e93d1112fa7486765e3b96c5c46236
-
Filesize
5.2MB
MD5806264506b6edaa34a988c16966801af
SHA1760bf414b5d7ba38a805204d6a5a367c307c9c27
SHA25658b2cd4aca9efec815eadf1873145323ae875c4b50e6657b005eeb8c2192487a
SHA512d01c7e08f688b9ea80c923ddb0458019ab0dbc5e74f1c61fe319ff98cb074c2bcbd18d4a40cca6da8c8be85c55d888158feb9e780dd0a99fea01bd0c79ee51b3
-
Filesize
5.2MB
MD567993ca7958ed425dd0ae69d68472e33
SHA1f91a7a8eef8c9e8bad7b0d138213382756ebcd77
SHA256a9b3e11d48c34cc96ef05d2a877dec7064a1a5b85e6830538cdf6019b5eb5c58
SHA51223fb49695e8a5ea5982de1b5bd3a4b91758a21343ead496153fddba0a205f832fb84cb908ccafc3944828dfd550a180fa6fcc9133baa321620864b663675b788
-
Filesize
5.2MB
MD5faa6312a514af62437d6c2c8723d6817
SHA10d329a07421c8c27b8ba02f9631118f12e367416
SHA256e6867e2845588ca67d75c64b93564a0bd132989aef7ba4be79090fd596772b61
SHA51220b0bacdb35d285c76524e645da44ad9ec4bef36f1210929faa12c75b5dec1b4eb6026d75a6718b57db92b556c6eef1fa7acbbbbb0b80c260e089a82965cfc48
-
Filesize
5.2MB
MD525801dc7f80188e42e63abdcd9ded500
SHA1ac2fe96c0d6dcd82651ce1c532191bbe55d8d73e
SHA256b3429f13cc8921f32fac61a7871279c452b4df832605455a4f1b489b0a510333
SHA5128919ba0b664923b1620a75b73627ae5c65607eb1388554717d43c19e7094ea04e9f45b09431261e1ebe615f688bc7956ab21dc101a836b003fb55e3ba15bd933
-
Filesize
5.2MB
MD5f28052a74b73b033ba17c4d6a270efb8
SHA1f2045b771e2acb39a550844f9ecfc1c51ae627d5
SHA25688b69504a1aa9963a994270488c12f3cfef23487531e4e6786df45afc0c53c4f
SHA512362fdfd3fd169ff05abc3f1512e3c38e9a23ba47a4745ac790ed52da5ac4eb3da8539593b966eed3dacefea5a3ba15fc9976fe688c98909c0f8405d14e4b7b29
-
Filesize
5.2MB
MD58b4a3d70cfc2dc5edd278ecb07fd9f72
SHA1375a0bd32ad103f7f5feefd0256e081fa1369530
SHA256d8c74b21d86b1671c8819508d561b32423d7532eb067a71fb7b3847b690b140a
SHA512d6715ef05d2c68bda07ba3e491dae26079ea4fc88f86aabc7d0e140d71a13ef3786dedcf2ece90ae09a5767399c269bd6471f37080d9a7a65cf84a133a50a4e1
-
Filesize
5.2MB
MD51a408ee8dd14528429bb868bfb8ab3e5
SHA16bff999e15044de18f193259c7b1aa74754acd26
SHA256ec39b402e5d8ae73c8b988feef90b9843531a70947f54fbb3006b53115b73091
SHA512170c8984e74bdbae1e204933b9b382ea27c31ffb48e98bbe675d0bfdbca56a0c0393b2b3847846b1139afcf00d6d47485453a5ada41cc336217dcee4fabfc393
-
Filesize
5.2MB
MD5b43a40ae3a09b013e1f455aedc12f04b
SHA16a4e826e96f0853759a7354db2f2ff66f7cc1bcc
SHA256bfb0c7f3d993c0dd5614ce896c274a2571948bf5477a475f4ca5d1385d0240c3
SHA5129118a05e7d84563b2b86fe9e0800c783804cc1725b93a45a70df9453af4fbad0e4a1330c99bd16d8034f48f174783bc6dc018aa59fe40718c5a0ed6434f67bd1
-
Filesize
5.2MB
MD57e0a07ae7fd7dc20bd3e08cbdc1ebbc2
SHA1f3084525e3cc158e1d96f6eeec6695abaeb67194
SHA25640ad70d0a7ae693109e42c375f5154f422433c338ca4ba4f7e960f17afbe3bb2
SHA5122cb0f93b452fdd1246e2cc3f6cfcfeaaa7ce03954e1e0f9a80c2fc00734de2d9b5e5aaaf8a8bdbdd44069fc9f1f4808d559e03cbc66dbf57ada9ccfb0f58e3dd
-
Filesize
5.2MB
MD54edd8dd01ade8aa70d814122f1eed1f1
SHA1dacde86d9d58b944718258a3cc77aa2a6192901e
SHA2569c32f5c21ee8ba1cad7fea634fb29c9ea06005155d482ab1f84410eba8267ee0
SHA512158382c72f861d3d8ff12f3425456cdd62eec881c0a287d9b4d48ab7632011edbeada580845e01399b3c1d6e19cd4859fc77199c5a05df9fca2c4fa297fd062c
-
Filesize
5.2MB
MD58619ccbd822863617edce15541d25c75
SHA150882c256cef421c3e7645e69e8f04d705f71baa
SHA256fdff82b3d786c14a1d75703b6b0fd1c7c35e2cd9a3d40b16441951f4c9d0ba24
SHA512a6e2742f0d50e81ce66d75554764e1b7c4edcad9d1a497a9d9748d002fef5e793ee2ed3ebeeb73c25aa0bc9a38cc1ababf36b5f25332361fe2ae40c3459b1153
-
Filesize
5.2MB
MD53cc92a6b690279c5306b64e2d99d8a7e
SHA11816ca940d80511405028b7789aa4a70345cdc73
SHA2563b80e98b92fe1f9b47da90150beebddc4bd6e519d60ee1069dcbb5d60761c361
SHA512672cd52ac25c22cab246f8149baf3d2647565c2ec596f26a7218f3342e37bae90a3f7ee6575a879391ffbf28d281ccacc4a10f72504d970b01f7d088dc45f4ea
-
Filesize
5.2MB
MD55a22442fab11e847425803511239ae63
SHA15a18475a3b90c8a25086f5d4ad3cf64e06a47888
SHA25617d5885ddb632ac261cb7920749946ad98bce9d755bb564274ed1b2952f58103
SHA512de0056596479dd5f02ff22fdba803c23afd2858257f41e5bcecf7976718a1ddeac4e3399edaf16801ac65743cac247a85ad334b881841c6f691e285bb3efb41b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB