Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-11-2024 02:00
General
-
Target
2024-11-18_54b76ed69129f9e8a7530a39dab9d292_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
54b76ed69129f9e8a7530a39dab9d292
-
SHA1
a6b97c8a24ea3f28bdce010c417e2a76c3f3aaca
-
SHA256
2abb44992324bad9929832e618225fb0cb3a8e18d681285211047883662fbf15
-
SHA512
146fc6eb745fddcb701f393444e4f66b3b5befd095956bd98a37701afaa392170beb4589ac87f08bdf5706572cf41fe2c84e6b89ce67a5fe4e4884077a204bd8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibf56utgpPFotBER/mQ32lU6
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_54b76ed69129f9e8a7530a39dab9d292_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_54b76ed69129f9e8a7530a39dab9d292_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xjCMYik.exeC:\Windows\System\xjCMYik.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yNjlZkE.exeC:\Windows\System\yNjlZkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fzStoXC.exeC:\Windows\System\fzStoXC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLZWJSm.exeC:\Windows\System\zLZWJSm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AppJDjY.exeC:\Windows\System\AppJDjY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AccrODh.exeC:\Windows\System\AccrODh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YbNxYyU.exeC:\Windows\System\YbNxYyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TBSTJlf.exeC:\Windows\System\TBSTJlf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UDYJAry.exeC:\Windows\System\UDYJAry.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AmwHkSo.exeC:\Windows\System\AmwHkSo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSOSpKc.exeC:\Windows\System\lSOSpKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCeQGFW.exeC:\Windows\System\NCeQGFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPoftpo.exeC:\Windows\System\IPoftpo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcenlAg.exeC:\Windows\System\mcenlAg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TdGoeXV.exeC:\Windows\System\TdGoeXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYAURPy.exeC:\Windows\System\yYAURPy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZWnKXW.exeC:\Windows\System\rZWnKXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tAyqiQe.exeC:\Windows\System\tAyqiQe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bidjeWq.exeC:\Windows\System\bidjeWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjcQaht.exeC:\Windows\System\tjcQaht.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDNWIKU.exeC:\Windows\System\dDNWIKU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD575ac7428fcecd5db0634f2a0cb8712bb
SHA185b83693f3b7a7b880253b07e7520e9436fa8a37
SHA256d213fcae2fa8ae8f3f122f29b5aa8a96cfb9ec4b668ebc39ff987d6f610243de
SHA512d2f05ae44c4f8072440cdc09a37ec229b6bb9cec6958222150f805673922a1b45cd81f5542a5a37a84d4c84cae0c186028127158bdbd6cc8d9ff7dc32c73d43c
-
Filesize
5.2MB
MD583d566fd5c5abe53bb4dcfba99bffa31
SHA1bd18390c543d0e0a0b849afcb0ac79fcf3072524
SHA25642a447aa2c5105c1cb52fb3eb59c0eb4b6094110ee375a8b06cbc715288eff0d
SHA512dc6abd9a15dca27943f2c0f9a6ae4f7d556e8a585c1529c319e19d060f768f057c913230568a7b4c8f12af24d724508b9350d20e28e132d738bbdfaf7ce19391
-
Filesize
5.2MB
MD5021247d195982da6c431c15ebd45a839
SHA10013001e65b66075a496b3b1eec752087b91b50c
SHA256cf648912c145c2c561dd4c483b21527581cdc81a1f7af17b73af1f912b982794
SHA512bed4982a33597df4d613beced2ce2adb46e339b8f1b015622ba4e527d480656648a2875c1a907bb3d7a50f32bac4c611d5190a17439cb77d85c93c95a9b81715
-
Filesize
5.2MB
MD5b838082724bb7f76437201b6300ba07c
SHA122a0bfd5bf11a8def6962b7d249aff90119947e9
SHA2561e7ef9fb3a9d33a9ea7ec620ff42ab5fe0363d02ff0204c47b785b1492ec026a
SHA512574068a7695b933d3bb01f1e2d8396b0af1a39e2ad3af39be784f208b8e4f26ed11ba6f23e760516af3c5e98103fff9d36d8c083ae6cb05089d078ff7d610ce9
-
Filesize
5.2MB
MD5a7350e161e7d3253f17dee24a5cb0682
SHA191ee1fa5b54f406404db152980e6c51f13b07fa3
SHA256831b2be46600186c2cfa83f8854bb84d162a2c7823c0cc7ea0fd0dccd31db26f
SHA512ef02d5827f2404b0337343fbce94dfb150c56e83a4ed3a709da7bc84d415e0e06562d0a7d334228af6a152463e81b91ee74cdd1af69b7bd6f74add13555c5732
-
Filesize
5.2MB
MD59d91b58a2535519e665802a7cd7cf32c
SHA1fe4c569a6ed585209e316568cadb5e39e2cdb1d3
SHA256801dbd49e403c37fcaae5a8bc8bb721ffe53aa694af1877e91e259ab2b0aa6ab
SHA5124f9917f14715ad7ea08d98b5b00f9544d5e5415270d839df89d1a87542f1dfce457992c09da8efac0744978c23237eb3705fec4727c9ebf70875e48f71826ce4
-
Filesize
5.2MB
MD5ea428171a1711069d3a103bad421c7c6
SHA175682a12af2552d62c30e72fe844de3dc8f3bc90
SHA256da82fe3771702fb8a8133fb25f1c70065f9fe7f4398a7ee0043d8c082e331f86
SHA51245299e200cf12de44f4d52970a7bf09162a8b38897c200f366135617dfc5596ce96b8176da8be7b05aec42ab5f09d653bdd10078d9efbe2f12e064977e2f6382
-
Filesize
5.2MB
MD5b846d792febacb5f89783c7ad9a2ae75
SHA18940aaee0731051b1be3584d202af54b25cb2737
SHA256a8cfbac6608bcec2313874d2d3b4247010392230a7de1a54995ec280035b2b04
SHA5122f4565d017984371e055e8743c76575e3fde00e2f1d5f42a4ab004f735500c4804370795466030bdf98305af72cc00e4594663b4eda4df98681b1e66ecf5cb34
-
Filesize
5.2MB
MD50df41eabc2066e1e76465851c1d7ad57
SHA1882639a4f2bd98792e880ed1aa5e7c45df36623f
SHA2564578cd2aef18993114354824867aa552a9895aff9cfca3ef721e575b175ac6b5
SHA51254636f279cde6d4b6d015acc727ebb56ba030e3229c455b7da605e99dd654bb5f5e83aaec9d8dc6eda3c6127b2270df3e7e381352c9d3a6e50d2cb809a2fdf3f
-
Filesize
5.2MB
MD5dec8f09517bc03da85661b48d0fec88d
SHA1359f855bf78739fb82ed8eebf5c13bdf39d32aea
SHA256b78cb737a9757bdf6488682293de6888be87ff75c8c18ab03ef2edda6981397e
SHA5122898c2f7a609e8f087c73225def599bb0114a7d7df6fbdd0dc48327bcc514351d35cc9498e96e65d88d02187a683a68566ed1de69229e75401d99006d3b87eab
-
Filesize
5.2MB
MD525860c4a3ba955184debeb81327696a1
SHA106485918c47e9600477ed9ee701f679aea067ed4
SHA2565b80d0114e3ca47d41a96ef58faa5cfdca6c3dab9b441a28e22022ae3c57f862
SHA5126da35e95ee062372841f541d5f74f3e3deb4a4d20711b5b01eb4d1d17a115cfd45cb1ac9dada2e15b15e4a1feecd2834bc85528ac7d85603a08ae5bd4186e68c
-
Filesize
5.2MB
MD5a7504be56f2e1fc32f72608088cfc2bd
SHA1129eaecd34f5dc052200350207f200fb4b62e1d1
SHA2561a14eb440f177144802d077b7ddf1c60547f5d7a066268e6cbc40b77d11d2368
SHA51231c35ac882d6ccdd836fae6466ebf20ae61760eb0396907ec4fe30f0cd691ed1dc16d6adaa1b4f5901501754fb9b738aa28ab6142ce0c6cfb155203491f236bb
-
Filesize
5.2MB
MD5a4c17aa287c2543586e0e7258ce193fa
SHA17d8dc168c3083a46bf50cbdbe3703f5cb3fe2ff4
SHA256b8a9cef7b38a23343bbb33114430f8fe22f2dbc6f86e623b2564bedca1102f80
SHA5123b0026e90f1975204acc4422514bfc1bc654f573a0ca8e091228286c3962ea7393ce4c8e5e80f3c8eb6140e80e56106cafa6c91c8f382b4d97e2dc3ac303de80
-
Filesize
5.2MB
MD50f750b1634fef3c57eaf96e6541b46be
SHA1d8be0de32995fc0157f0b417a75975eed9a49509
SHA256d212cf26ed6ab0df061bcc0595bba28e56a457601e3c67849df08811caeb5464
SHA5123b71693bd75aedcd3a0c1102c197896934a9b9d6faf3db6da41693aa19351a90ce58e5841dd48403cfe01b24f3cecf1e145fac8eef4a7179489b74581375a49d
-
Filesize
5.2MB
MD599a174da39275e2955db26cf6d80b2cc
SHA1a8d663e85f47cd8d0f9ceabe061db3642ebe596b
SHA2569c3c9c866885bc79fdb60c55dd8faf803eeb1a25d582473188d5c95ea62ef95e
SHA5127af995df73c2b85d644ed39030f10d8e82b34bc5fd91cad22b134baffb987620e4a38b4d7e8e4a498da30939d74c6f256e777a157f7fb43c7b5f5fb397f1342a
-
Filesize
5.2MB
MD580690e38742ca7c809d5b6271c9e4f1a
SHA112d1b0ae5e0e6325e2bf58ca41b435767c3534dd
SHA256012acf51e0df9b29e733b991239cef65fdaf5cb8b39b10a9afe1dd88bf7163b0
SHA512873f72114d84c31018a7bae5f3ad3c6ba2025d7b6092f2664a2e61f4cb2f5bb9949437daca2f1861633bbb22db9218c2dac465cfa290fed9b7c79cc2d816d8f7
-
Filesize
5.2MB
MD5e3e005b34959fe16bb33bb87d7564131
SHA19dc0065077da3d428e813a78fa9223fdbb8192bb
SHA25629f4c26157559c1c654a49b4a99a8217d63d63ffa6dd8949f0695646a67543e2
SHA512d54236a78333eaa961574905166956e1a0c2533606bdf442249d52c656c69c8efe13a61c56dcdbf64fc904680ef30933bce5fdc6ffe7387aae09645231a12794
-
Filesize
5.2MB
MD5bda97d4666fed18d2021819268243d3e
SHA14c45c6f2c40d36eb9abd55bf801e83f172fb66b7
SHA256b8f7c03ae2eb1611947482155d5a93d5c3a6faea575f89e9a23887ed06c4b271
SHA512e31680c88bbd6afee94d301167d26c1836415ba4f634ff82c45831b1220e9f1579fda12db7a7c07d5a3712b024623e29f9966e9ad68668f3cb50cc1253aafc8f
-
Filesize
5.2MB
MD571470b17692a2a4bbe780c7f51ec21d8
SHA1de958edaa51d5755f94bf7ef29b78580e165d9db
SHA2568a29d090aecb36f4b79b61bcff8c183d1988895e2c5397f9744626cc4be012b2
SHA51217a38617ae83fbefaa6cabe20e3607457d94014e69bfbdc187db531919376905287db37ff6ca8c25ce91bc368412ada207bbbe352f77e8a6b98b47f4608056fc
-
Filesize
5.2MB
MD53a42a864ff75aa7f866ec39b501a4d2e
SHA17af0bc8f24b658fddd44e67f091322feb88bb287
SHA2563dba3c00800f6fb399d5d852c89cbdb5945d8c24a510ebbd38909087f40837ca
SHA5120f35a8a93e19e2218d9176da2f3913a6a79e939015f7d1a916b4c406ea3796906e12ad9cbcf87d6e0e056e108e0b10d20f9c644897387cff554df57bbc5b869d
-
Filesize
5.2MB
MD5d801049810dfff57a207a655e76e9b98
SHA1861eef52f8d561e89eb88250b4b2b2cc67e81cd7
SHA25678d2c867efae666c6330ebc6c5c8e78ae1b0fd4ccc97d554c2b44e68e69bb42b
SHA5125ef0d4c3c0398cea942797d9928ab0e9564de01f634bff11fbca98b24d5e74682e71d098f521ed455a33e7b2f09c0a15140f82525733935e0f4e62f743904872
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB