Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-11-2024 01:59
General
-
Target
2024-11-18_4e86ca03af626d463b0d53bb6b606176_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4e86ca03af626d463b0d53bb6b606176
-
SHA1
9566d577023a402c4d6dbb3977a8b3ab79f61129
-
SHA256
4232c892a082a112d2781646a6d03c45c458cf989f5ba12081a92fb7b7a217c3
-
SHA512
b02edcd0ed91139f73a70dc54f3d6bc5ee39feb37ea8ede727cd89d614ff99db584a0c7d9699905291db6eff607d0f6936afb565d8f20b42233446cce5077ff4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_4e86ca03af626d463b0d53bb6b606176_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_4e86ca03af626d463b0d53bb6b606176_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lsOLEkF.exeC:\Windows\System\lsOLEkF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nAoMKIY.exeC:\Windows\System\nAoMKIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwIsDem.exeC:\Windows\System\TwIsDem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RNWnYos.exeC:\Windows\System\RNWnYos.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMZYMTU.exeC:\Windows\System\gMZYMTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxFQjBU.exeC:\Windows\System\RxFQjBU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zMhglSQ.exeC:\Windows\System\zMhglSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QkWINIP.exeC:\Windows\System\QkWINIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WdmQosw.exeC:\Windows\System\WdmQosw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WmulBhh.exeC:\Windows\System\WmulBhh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JnZhnFJ.exeC:\Windows\System\JnZhnFJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RobRFTL.exeC:\Windows\System\RobRFTL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\goPCRNf.exeC:\Windows\System\goPCRNf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\scUzWCg.exeC:\Windows\System\scUzWCg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FRlNnHM.exeC:\Windows\System\FRlNnHM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUxJcPC.exeC:\Windows\System\xUxJcPC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LfLJdOL.exeC:\Windows\System\LfLJdOL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzaPBAo.exeC:\Windows\System\SzaPBAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EmgUPhb.exeC:\Windows\System\EmgUPhb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGNprYQ.exeC:\Windows\System\DGNprYQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rUxLrYg.exeC:\Windows\System\rUxLrYg.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59eb4df648980e002e2bd191a8129a060
SHA15c4525cdf01df94b7f37d581cd623f9825d2051b
SHA2561d54f2e40f2ed48024b8f97ddcee5b6071c84168b9feb08cf7895f3643c6f875
SHA512e08c6959dbbf8caf660836c6074c9a117bd8d7fdbd700858c7d36eb79308440a57be7e37bb1758be076dbab1764c49c2a0b12526c2d2726339dee7004ab1fc75
-
Filesize
5.2MB
MD5d3d98c78bae174e4970adc9fac2ef38d
SHA1985dde924de84fd88d1f39c2828e58024f17b004
SHA256cc07415a73b8e2f841f9503305eac150df30016fce4f8e3cb34e52ee23ade39b
SHA512a566b37f6c15a848da43859005893c9a8bc726401650d0f5cd080445d4b8cce1b8b7d73fa964ee5ac7afbf7192df1304804a01a71599b8c30ae3acb4e786227e
-
Filesize
5.2MB
MD59a41ff6f5f569c5230b203639440e745
SHA120ea31b8e1a7c47be4d68657e249e5f2576370bd
SHA256181c44ae6c73687c83c18850eefed8c990faddfb540f587b7664fa07ee0235e4
SHA512849451dcfda1d5d15b4cd4affe22808c4b5b826ac0aca98ec294b4844d1da64c2dc2450c4b6b6eaf6fb59f874d112443beca5aba2119aa7fe1c55e4d68fb003b
-
Filesize
5.2MB
MD52cf007ff02700e07ae8a337075a078c7
SHA15d35337facf220a0a65091c66f62f1b2af6b4ae0
SHA2564943c2f0da8f8bc18cd3b48884c44ffb0274d2153df33ee0157829135ee932f4
SHA5127315accd0f157ecf3a0c4249624ddd6a370b51a35a0c6efce101d2054328df31aa9c5d4fa11c426c9c47bba9594da516069d9d1e9ac809dfceb4335592c61eb0
-
Filesize
5.2MB
MD59f0875061bad4bfb17c8481882566a73
SHA157a888131820d39b18ba468a596fa2a6dead99ac
SHA256630554af148f0ffcad99e2c530cf73ab4ab9a9925b60c7f8684d2c0283eef965
SHA5125da0dacdbe7698e364c1f54bdbe8cc8d2e3fc75d3c0c8f867b710e3c4067f06b4ad8d518405796afa1be44f9d088f2dc716b8536c8c10451f8839cbf98cc78a0
-
Filesize
5.2MB
MD5fdecc0b9b365e110b2a909d9969287fb
SHA195c6d7b25437412a44260aa14503ff46da7f0668
SHA256c64cbabd59c4b526494071bfa20acdd531ddbadc4655d8d6eb497d9c7b29896e
SHA512b460467b91231b536d61c16d82b640126e3eddc5a549766e22886f345418c7f6295de574a62e7d9896685497e00e9dd2c236bbdcbac73033fd653083beb54f80
-
Filesize
5.2MB
MD56953c87903108bb2cd57049c29c02a0b
SHA1823115c90fa7e68c9c0334cba9415a95693ad389
SHA2563ff96063b017bc49513820907b73891f9e56e24d63440edb8db460e41ccea440
SHA51288a7e3b01cb97cc00b3aa9289c4f1410fed0b2ede16824296d0fc0baed35cda098b1a8a969dcdcb61f11657fefbb50d62e9b703e1ddd9581ff4f2606d0fc35d6
-
Filesize
5.2MB
MD5b10748e163b186dcef10e3c187bb20e1
SHA1bf07f4ceacce00a340e63e66b6bcd5ece405cb6c
SHA256c1a52cf321eac80cdb75c565d65414bbd8cd0e921221f70497aec4dc1b75c8dc
SHA512f1d7bd6f0f099353d69b0539f324e8a4eaaf9f55f9abbd7e259334f892349ef7db6f8fc489fbecbb45b4de89102625e1b782607999fe10c1518848ea9d7b3ede
-
Filesize
5.2MB
MD51992b4d0f119e5828adbeb9f63da32cc
SHA1dee6298c7e39b439bde92bc48e9de5524537b99b
SHA256ab69ba9e478fe049a0f5906bcf102e3a1ca409ddaa86b2aa37272fb7b63774e7
SHA512bb493f10644f1d3e025745a771cd57a1b2bc1ee7bddace5ebbbe31cab672a903ad695b7c85d718d1c188d67955af327503f05b63e16f71407d71f6c28ad51540
-
Filesize
5.2MB
MD56df75ea1202428b5094369e4bc189cc7
SHA1adfa81ded398b4b1a856e58cc633962e3c30967a
SHA256c896fecfde644d77ddcff82ed2aa785a165b7070f435dbc63b5e08fae38a9d1e
SHA5120e5f5e63afadfad1000d283f81e1c6b1ed2d2cab700ec746cdbfded62081acc07b554b9007dcfcc8ea0fcd7c675e11bab9739ecefcbf787baa710b61668756b6
-
Filesize
5.2MB
MD5f36a5b276920461a7a4333f40baec922
SHA1256d5d13b9cb7b8b7de3c07ed4646ac7db6e2979
SHA256c88a3c9444c0c940017e58c05f9120e2780c1497fa97212ea334577a5b5adfce
SHA512b79a9db7c65e371e0aa60f25cd9e080e6bcfa76400a3ba74580915da979951681430cee1efa6b1bb4cc501d8ff80c681631f3b403b434989c08cff273a9f2487
-
Filesize
5.2MB
MD5bf22a43ea7dcc6a2c70ea4c3060c9ec8
SHA173b530f28963846743a84aa3a0bb0b057af017b7
SHA256bf7a4335e1a12d9c873fa6df6551a4cecb21be06fa7e5613db3c494995a57263
SHA51211e12a34359b3d34308ab0dcb7ed2776cd6fc68b1e0a07d25b28df749747aa98c89c89f457798cb236fe176b2c299ee40d535f765de702d5d66437725a256d9d
-
Filesize
5.2MB
MD57f3d209dcf935f7bfdad021b750770a3
SHA14d00dd825552b483565dad69f835ebcbe69dac29
SHA2569faf69b7ed9e4260cbec2604c3f2513bbe52ccdbb82384cc597e814037113e05
SHA512afda5c2a9fdab2e02488f5541426296643949a92f38560cb5f8e8073fe3746b3973fbe97d19d2fd98209e48fac91281fa32472f5d221c249f7ade988f02ef04b
-
Filesize
5.2MB
MD584bc6e1f5591a5d3ae1212b9161622dd
SHA1312f3a30ae215befd0352640c0bfaf5fb72397ce
SHA256f1292f7bc7ad5e0e7b915756cf21448c47bee28372853dab409d3ef74d5e72b2
SHA512037fa802f3d73d24e53eba321e097f8637746af6b4d5aaf1172d0157750b5db2b6d7e794e992516541fd638c948b5e1373ecb561966c6bef7426f675b24d8892
-
Filesize
5.2MB
MD5ec0698c2a221a3b7cb1871ad9e29d238
SHA1c86030bf540c3f9ef18fdfaa88e442f32ab60d5a
SHA256f5d794a5b2b85e49c497a19c78476b2b2297a7dad157196f95358b9d5c135bb1
SHA5124b73c841c51f1369e77c2266d1395455f5fa6a0de741fde34d05d047e36638a55b7754fca21c3acbda5657b8cb1048662a6a9c1b15c65d201a00cc5aafe7bd8d
-
Filesize
5.2MB
MD505dad1137a66234d60fd6204c5fa6e72
SHA1bd3d75ae64a1915c1232cb6f3b7a496e8dfb1bc9
SHA2563fa751efb26052263a4a4570715d301bad24d8a8f22c9b2752c0bb369640a056
SHA512516fd004f526a7814f7133605caad0ec11af8b7d12f7c0fbc719f7fca8e157e56739e0ade5c6b8d38c46a8a3baa71d0d2d91c0ddd6394a399fb329e61b464826
-
Filesize
5.2MB
MD541969437ab0b5e7e3568f95c267c437d
SHA163b81b263d06774bc079cda7ba545d80da28e3bd
SHA256691ac38fd31f83f73a0f70c16a1236eec5ee2d1849a1b5b59254f60957836b63
SHA5126091bfa0a9bea3a70962b8025f5fd9c03cb5197185a929c112b037b786d4ccfd7f70fc37a6f6a9562cd7ece5af378b38f6fe9129f44c8fc746eebf2048e21d4d
-
Filesize
5.2MB
MD58cadc80ca479f905cb685fdf6f08a64c
SHA105c5760dfefd233d32148c550a4c064ed839f44f
SHA2561dc39fb294f13fa1661a2748c80579736873dd104d50cab63427c4f76828e48f
SHA512037455b3f81f998a583c3777dd0075e716dd8e23384b401a2698e7a1c1b2d882bf30afa7e228376d670435ad2118f37cdae6e92d7ebb491cc5398684a63cb50c
-
Filesize
5.2MB
MD5591b7bf4f16d33aab886947b26bc3cda
SHA1a4ca349bb19d072fd632ec910a57e6917061bdc5
SHA25648dc32a7f05571b09bf9faaf698c53c6cd93a5367a88190374687276912378b0
SHA51294e28e6ac051caaa8c6ddca3d34e16c5febc29ff4b30f1ae0000b32ee41e2d395e401d9d687b39e7a8b2744a39f54cbaa21962df6532b6a335e7854910e3e440
-
Filesize
5.2MB
MD5edb019d6d4865031ebfff0c698ef6a66
SHA158592ae22940e58270d14381c27289437bab2a43
SHA256344ee4be7edb724e376ef3cba6e3edcbdf3d51edfa8c8152680b2ceb7eaeb7f3
SHA51297c6e2f9b52839a4ee1078d65f82313a01ac90962fe358f0a1efc46caa38a01e2d7e14822d6bcd2a32bed7be7e078c5813929ebd0b8eb27ad9b0fbfbb1c074f5
-
Filesize
5.2MB
MD5fdfe79c3c43c3b50f04beeaa033c7c8f
SHA1b55f0382c24ee4c9bd0767bdc465fe40b43f4ba0
SHA256c92584662fd4ae1d1b54b2e9cec1cb7fe380daf81163f28fde6bdfcd569e2cef
SHA51271fb40064449883275a770b5904631bc708307514a7b9d900d9dcdc2f6e0b94a92119b211fc9321c05a3ce803f2926dae7f04ca5a88990a34ebe96dcd486ae14
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB