Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-11-2024 01:50
General
-
Target
2024-11-18_20d07cc50602b45ce29b64e2603084f6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
20d07cc50602b45ce29b64e2603084f6
-
SHA1
e6a719f16d93582cfa70410f52756e04f2e4e232
-
SHA256
9e8b56f7ab0760cef4a7f0f7e80e847e1392e7c30ec84651f3bc29067b666f86
-
SHA512
1080a372e9c0f1a87533036ffea8c0006e4437eb95ea8c38c089cfb6040dd7a9cb69cd91481f125fbfba446ebbc730a1f0347c894be7c779d9adac3c26798f8d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUG
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_20d07cc50602b45ce29b64e2603084f6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_20d07cc50602b45ce29b64e2603084f6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nvAjwbA.exeC:\Windows\System\nvAjwbA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPaKDwx.exeC:\Windows\System\nPaKDwx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UNxeqrX.exeC:\Windows\System\UNxeqrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BjPhCrl.exeC:\Windows\System\BjPhCrl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DTcdIrG.exeC:\Windows\System\DTcdIrG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RrWZKpV.exeC:\Windows\System\RrWZKpV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiPccpp.exeC:\Windows\System\CiPccpp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IvZHhzh.exeC:\Windows\System\IvZHhzh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XQClVnR.exeC:\Windows\System\XQClVnR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UGGcibJ.exeC:\Windows\System\UGGcibJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWBzqVt.exeC:\Windows\System\RWBzqVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yjgFZlS.exeC:\Windows\System\yjgFZlS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HQqShpg.exeC:\Windows\System\HQqShpg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SKeudHW.exeC:\Windows\System\SKeudHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bnEIcKB.exeC:\Windows\System\bnEIcKB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xZWoPPc.exeC:\Windows\System\xZWoPPc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qGqnCIb.exeC:\Windows\System\qGqnCIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gptujAt.exeC:\Windows\System\gptujAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WagtdDe.exeC:\Windows\System\WagtdDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxsJyNf.exeC:\Windows\System\mxsJyNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vLRzEOj.exeC:\Windows\System\vLRzEOj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5528dae116c4dfd3b745b51f13a36f51d
SHA157792ab7ccfa34af89fb2e8a27dd1b21f9cedb77
SHA2566ae430bb34cb720c744553e43cb445f1839b5652bc2e820e9811900ad246a529
SHA51233bcd48be664bde9557f252fe0ef899f6803669441f0268a485ea4f4e41e9e8fa643680e8df055cc5acf4b225cb616baf2ed1ee2d28fdcccbe45d9e93fc2ab9b
-
Filesize
5.2MB
MD5029040f90f3029e923bf2aa742163f65
SHA1b5bc442fdc56dcc19a2944713abd0aac0537149a
SHA25678f17478bfed13d61761dfa3a848e37b0a3ba4b3aabfc88c9c347d5ec8b5ff6b
SHA5124fb173d1a2cf83f785ffc0d119b1ac5cfc36578ac4392479695bfbc4aae77537630a0754b79ada01e8e3a78331c90de0e24f97eca0865316aacafce04c630226
-
Filesize
5.2MB
MD5db41dec406655dad9d8ce8e4e0dba668
SHA11384ece498615857262eefe47ead5fad113532bf
SHA256ddfde5ed6b8d7f66a096b64669c1f4df582668b5ebad0c7fdb4e6fd3155b9dff
SHA5124a18308e6f8163fa02e621f8fe5a86955b6431f237f90d5a007e1bc5dbf9c7d7fae35f729375d54e9f3f2c2e237fbdb6f6145bd3b38a09ce6cc29a0993a4e3fd
-
Filesize
5.2MB
MD5ef414e78d94c9ef42f8be8c4909c62e9
SHA138b68274ac279c5aa317f585fdb21b5dba82cd2e
SHA256b817b1b2da548dd54be8ef726298dcc79a5d5134dc8abdadc3dabaa8b175ef3f
SHA512edbda807fde6198c02bd88c490e5d8773e74df7d3db912928932cc9d94893b82dc3b4743d6639f97f503dea3f2823fb2662770bf8ce40c69f64fe44fbfef30d2
-
Filesize
5.2MB
MD5630a39c6aed991ead2331b3529a1a560
SHA18a55ed6c952d765aae5b08fb8f69955dccecad6c
SHA25672013086c8d4f797834b1dcb4746c128c8264c35b86d1dda5792829f283ed840
SHA512dce9c4d7460661c58368fea2c65cb4dff600fdc1cf7c5acfdf661c037dffcddb15c5adede06ba279f3e622188b50623568bee07110023900b4cce878f3d77b77
-
Filesize
5.2MB
MD56543e0d2a46a8aeea8d4e3753cf6d5b6
SHA143263c874d91bd9f1bd00222397549a57b9614e7
SHA256beed16975ca37bd6c3de9bd9f27492757a692bc7aeda31b8c3977fce0134ee6e
SHA51251a2ffda4f4bd339dc7ee68441fa735ba86cb8d825b77c8d58bed9f77088d948669a75a9abe22467b2a55b13dc056924e1870a17e7bdb1b91148fe181f3a167c
-
Filesize
5.2MB
MD53ece1e797be90944f1338c1bc2cd6781
SHA14fe3852c8bb930cee5ceed41cc898079d9b4b380
SHA2563660a898cc133e8f00307397b9958bfd7447164db8105aec3ca8d47cbf55e4f8
SHA5124ab02eb9cd65b923a93b92d3ecdb36ba1a9e956e26f941901d5e91910efe7533884d306f3ca804e02d8aa413569748ca126b6cb68e683b8e6ff0d72a949d3cd9
-
Filesize
5.2MB
MD5419b41d5e2d1a62f0ac1e665cbe0df5c
SHA173b648649a44c9a74d4dbdf29a76da3e0ad492e4
SHA256257928c77b980bb164fcb792c2833b2d090d5988249db5181c8dbfb8c1079b32
SHA512c7c8d4cf5ab0b4807b7c2e98df9e03e34220c6d99145a28b0b45a044db89fc359c4f54aed26c1c88c4593e340fa118df504cd14bf2eb2ad2c0a43cc65fc050e3
-
Filesize
5.2MB
MD56dace4696ffe9c0b2be968928e6053e4
SHA14caff4913ffc5c1b235b5d9d6f123d01f289530b
SHA256070c6b88210fd135e369677f89e519a4ade34eb4fe1e36eb444f0625f2e96bc1
SHA5126ff2db667952ddeac676c35f7acc4b53bce4de2a9144f0eff0673f71b6adf37490dbf87ab1c10039358debc40ce7b5aaffd8a38347dffad2153715c8a2573e11
-
Filesize
5.2MB
MD53bca897b6751edc2fd10f378c571b56b
SHA1e6409fa176057c7ea990b840df1efd2c521c6904
SHA2566ac93922fd18dd1a7531bb141efb37c0f5d25b23a64be871a3698afefb420498
SHA512b2c6ce6fd1b343f07bddf9754a8824c3d0ce2af9194ca7afc011709cb6d2d1461f31011cd54a0da2256ebb5568658c95fab659a3c4d4b43f9506605feb95808a
-
Filesize
5.2MB
MD59b798ec41fcfbecfdf6db05988747c5f
SHA120381a883b04a2e8dc21bc9078f54278d772f2bf
SHA25627f1a4f99667ef195e8405381309c9e2715a114bba8ef3940e190f44677b0c2a
SHA5124f3d4b893aaa6e9b154884cb49a008bd074bc98ba28200903264057031ae808ded3cf0dfaf11cca49febc87b2438fbe9036cdeb6388bd01ddf5045949773e92a
-
Filesize
5.2MB
MD54db3e9c680ac6b67817c58d4bf1f02f5
SHA1d840d8c7d88930dac6be7ae25b4f074a22819e17
SHA256d84d6e699168ee5508f9f51c971a793ed40650b55284e123ac53faf4865db986
SHA512bd04f7a28e9399185958bee6b461fd8297b68dd28e6583b133769aa488e7245b3336afbd44012c0a58039a02bbcf1576adcc5ace41431a76bd359be889f94e3f
-
Filesize
5.2MB
MD589522391b248860fb2b4811f2811a948
SHA14fe819ea8fc0eb74d1eaff31d5f97ab8ddbd9557
SHA256260cac23c527f4155b3955a855ecac3f279911192b87774cdc8a1dcb371b0c76
SHA5121ea3c2ae2ed78780d28c0100a8217f3c14e349d80d0de8a3d424bb862a3dfdb3503997ab6a4c24820e45a673ae3b63f7c8359e5e04fc1ed5eddc443ab0756b63
-
Filesize
5.2MB
MD5bc67a69bcd2ce1a9a61e9665963c6fe0
SHA1b9533a5adb90f75a3942ab37b35836673b86ed82
SHA2563fd0f8d4e25ebceab8a8ad29fa258ca4ada3a762315aed1da256552fad9ee4e5
SHA512a2a424ee444efa01e0a5d08ac9ccc339059b118dafb7adf90629b407557aa4bfcd3d4f12014a6ccca3530ae83c2422a526333f940c22dcafe385835f42a2b393
-
Filesize
5.2MB
MD5c81efbc3853765f2fef176cb3060b2ba
SHA109fd532e5c1f7f47da527317a8bed4e22305e38f
SHA256b69572639096628da2ca9d0bf89e4c7728d2a0912f0fef4dba306dc78aa4b698
SHA512a11e20e9f23d9445d34bd992b3636450dd424252adf8a553bf023dd4cc4a7c1e3c83a919af1ec9395701abd38a094382a3990fe5221fbb917cd73d0e0ae592be
-
Filesize
5.2MB
MD558ebbbd9224b9471d8ff1c8e80ad03de
SHA16b77552be670fdf571c53f5d0295fc0a27da1d3a
SHA2561c3d10297a8785b3c114e3aefcdc5d54668725a37ffc06cc444a5d5809963f2d
SHA512687f317443dbaa7ed925cf7cf2dbb6c6580c538b43784d1a53bc6511e0eb4c70df5255777d43f007ea1aa6389d923b0f7a9425ef4af2dc615ff58a64981f715e
-
Filesize
5.2MB
MD5e567b1dfbb7df71ea5e8f7b250288e42
SHA12dc61d8b8da627f54da89b802d34f2a4049e6306
SHA256c25efb9bcb0f0c2e992ee0ec43fb83201b700c788bdf742738a48a968efc330d
SHA5129674e6ce8289f37169508c2d45543a935ce428fcf3738395c4ec4e992ce3df920c00aa8b779a002f25a626dadb0f89e704bbf7e67fe969fd1a5619a61f4aef02
-
Filesize
5.2MB
MD535e30b71ddb411f37e4c3afa318fc881
SHA1078727f4423706639f21299bac6508c38568dca1
SHA256b432bf5697a6fa671b42f97d39db625601288dd7ed8c6a7d522110d238c0bd62
SHA5128d9e13a75538a8963768d39f6cab8c28a1caecac695b0a05e7dd6b87de984c969657f42f6a1dd89b8856681e6e0287ae9c04f4427870a0ed23460a90a9bedeeb
-
Filesize
5.2MB
MD5cee299e4577cbc52e10b3f1be4d62fc6
SHA18208adc648ebeab0bf3c18e9478eafd977996c7e
SHA256bbb92dccbe8716d083310efa8834511fc33cfe97acd5ce4fc48cede9b473a831
SHA512ebd685dc7d20367e2c0ce18b42edbe518e7dd9a2c99c23d8cddfcfe0ed80136d569e7bbd036de6406ac2f98003a16bcda2cc9f4a218745db7cc09011d1124045
-
Filesize
5.2MB
MD5a237d76ad9442614f013fe5c92149396
SHA1e13332a8a7e463a7c68dc1de8fcb0dd5df09dc32
SHA256f32f3d6ba78f8badb4f1615589708b7d39574dbfeaf5115773adf502bd81c3d7
SHA512e8f9e287a27dee15615adc6a88037af4f8966c723ad0220b924171ff2c85dd6ebb0f02d42baceaa2a316a9b8bb27beba6d46c149398b1e0194e73fe0cb5d9daf
-
Filesize
5.2MB
MD58a704767b4f9bf0696e3359b5c07caa4
SHA149b7c91dfae45dea7662ddee9b97a821886c737f
SHA256158f5e8e5ab1624b988c26dd504f2a48e159f530d6628d54b38de57f5a25b12a
SHA5129a6e67add7973b253936f891eb9791ebd48a1cfda998ec9859545d48abce0dcb0f5bc801e85f617c91b6bdb818ffdc0607e4da2af3ad71e24c79d4cf7ca5220d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB