Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-11-2024 02:01
General
-
Target
2024-11-18_5899a7b8ae8d1dfd4b273989a82b8fbd_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5899a7b8ae8d1dfd4b273989a82b8fbd
-
SHA1
83c943ef583811f61ee2c8c5de7a87537f88b31b
-
SHA256
d46de897c3037a8d75b8d8edf0ac2c3646a68f948c2720b80fd07dc2c85581eb
-
SHA512
13027c7cfcfaa588a37895a1a84237b485ffcaccb060f84a238b9f9ce0dae8dff8e7077741d6997983b7d6c24fd7cbd0758f6605d56d9723f248431abf524717
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibf56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_5899a7b8ae8d1dfd4b273989a82b8fbd_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_5899a7b8ae8d1dfd4b273989a82b8fbd_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xqCHPVy.exeC:\Windows\System\xqCHPVy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XnmzhDV.exeC:\Windows\System\XnmzhDV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bekhUUu.exeC:\Windows\System\bekhUUu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ANKYtrA.exeC:\Windows\System\ANKYtrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxhCIVA.exeC:\Windows\System\FxhCIVA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cwgmCBT.exeC:\Windows\System\cwgmCBT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zFubbjP.exeC:\Windows\System\zFubbjP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNOQPmX.exeC:\Windows\System\KNOQPmX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mHDBzSE.exeC:\Windows\System\mHDBzSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aQJCKTH.exeC:\Windows\System\aQJCKTH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jxIIpSm.exeC:\Windows\System\jxIIpSm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qpZJNeS.exeC:\Windows\System\qpZJNeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zFrMVyU.exeC:\Windows\System\zFrMVyU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nFfxNaX.exeC:\Windows\System\nFfxNaX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVVkjuH.exeC:\Windows\System\iVVkjuH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MdBWpLC.exeC:\Windows\System\MdBWpLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzbBdRb.exeC:\Windows\System\nzbBdRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rXThNUI.exeC:\Windows\System\rXThNUI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hfREvnp.exeC:\Windows\System\hfREvnp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nsvcOpA.exeC:\Windows\System\nsvcOpA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RWdlypN.exeC:\Windows\System\RWdlypN.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54af296d47e2cebf4266e7b4b5e85bd21
SHA17590c38b02c37abfa7d6d3a7288fe772afe0ba8b
SHA256ccc5631f83624482053952338fea47ee4f33c9856cd5e6ed2710fde50e897e6e
SHA512b2f63a2f7c18a686c4b6da6c393029b6e5712aa6078f4a1ace74e82de1c33b22922da5c4c68123a70ec5a6f549b300fbbad2849aaad62b0038eda7c967b3db85
-
Filesize
5.2MB
MD5ddf42744f0c920692642c970ddcd2433
SHA1be89558c057b9bf9f0795f762b09d24fce1435ec
SHA25643b71a293a06c4343cf794362de03b393cc401832a1bce77185d3f491d017d75
SHA51247c09ee148fd1a3a6ef132511fa32eff17a87aeea8c065e2713db2cd11f6b34723ca63f38c3ff92229f6c145981e7cf12194cfbbe630ccc739aaee447058daad
-
Filesize
5.2MB
MD588aa78ab0038da9b5438d0c0082e5c62
SHA128b0a553acaf50f34475f62d7a0e211f6d2f980e
SHA25673f294e395bdcfc5318d8236c21e18e45f638791267e422c1fecc343d4865251
SHA512dc2798e9d113a76d4465d7fe075bfac9ec9392957de45c746a98c755c7974eaff57a9d71c13cd8429ef9fdba63ad4a979b5de00d752d4ac49b68ef579c4216a7
-
Filesize
5.2MB
MD58b10a0310a47963aaabb79c159d74476
SHA1f9e2354a5a24ddc3f48e243e2bf8c55e3e814c7a
SHA25616b66b5b86b5b48c54faed627b819dc0ce97b61f38cc8a9f0b0b51713481ec66
SHA5125942cbfc54e3ab89cf735520d079ac81bc9b3faeccba32c7876224361e7fc28c3b18d67a88ba0f573190a5c71581d4430ea6885a594aefef8a6747e944d911e6
-
Filesize
5.2MB
MD5c2767c7dee9a05fc63ba413f08e6aa9d
SHA1992b5e480665d7c54f414497e422c5df4bd2ae70
SHA2565f9eb46cbea24e7d6e200b214f5cac697285b1ea01de26689f798ada4eecab71
SHA5125696bbec26ac3bf2d2609d9e113173a6b1cb12734a668757d6b074bd4c229677409fb9248b2697883cb04872c7319eb507148367a401097e2d18a422f2ec7305
-
Filesize
5.2MB
MD57ba5735dea3f6ab532e1afed28e5b0b5
SHA1a9780d1104500e34a4b2c119c2ff97116183dfd6
SHA2561a9e823e624ecbae5bd29d9277a11274be697dc5553989c55dad221e267c1c06
SHA512212058ccd94cd5fe505de4a0a3a0637a498abb16e4056456e0787189dfe28adb6f512e44366316163f8f544c7dd18ec7c0c13979199cd484aadfcb8ad1fc618f
-
Filesize
5.2MB
MD51229924ca8f9f0b51275101eb5b9ff37
SHA1c006b751097aa51ff2f11d3f9772d5086e04a925
SHA256dc774060c35d1110eca959eaf1a04be6546009486e0a1f54cc09af4a4687423e
SHA512ed33cd0eda95c862d2e13b76c48ad42990e071cd5ce96ff2c18beacf1402f8ca0f927d94105641c52992b67261325147c767b3b83cfd402f74d1b7964b863ef2
-
Filesize
5.2MB
MD52ea808308266c853571093e34551da95
SHA1de038e5d5545df67f6baca9f6f103a5497bf17bf
SHA2563c32eb2e46b869096428e090aaae46a76599dcf06390a4424df9d602e9ff7922
SHA5126cc9287fb5fdbeac1577b865eb29a8d6c85d2c478070ac012ddb86b85e69bd6b35c64640053f18f5d33f372438e098a52d92d8825182cef0346772192a2994ba
-
Filesize
5.2MB
MD5d1dbba7d417d3ef78e2bba0d69875bf4
SHA17fa56a7eb1fe54ec8a7d058721ad8ba23be6487d
SHA256006d9aa5d2d875a2b24d97166ef5959c5c084c81a1afb5eb0a242a573af9de61
SHA512b20ff71b3c3852eec91dc571101cdad288e39bd54df6f39761b20cb182cf935ab94c0c93c184c98e3d5e4bec9087bba70d17f2e9fbb08b705da881ea09d81657
-
Filesize
5.2MB
MD522f4d81b6a0978332ee979389939bfd4
SHA1cc7b6ba02faaf930fcf3667c2775d610f1e6c7d4
SHA256c661875e393b71b4afe0f09346d1a1408517a9fb35fac5a4d6a3c0e1ecd89117
SHA512bc519be5fa99fd8daad2d8de289485cacbd24109e37a8ebbfddf9430c199d3a9f63691fbf015f2b12e5fdabca83b7494febbf2f12026dca1d790a3e92e27482f
-
Filesize
5.2MB
MD558986ec003bd3331674d7811a96f074e
SHA17f38e48729f451b5359641f7847bba355791f02f
SHA256b781829535a14aa3567bb490082e9907827f9710124615799b32dfe0ada7fe3a
SHA51270ab45881119c5500f64023d7b128c73401c1f9b21b13c1f674d48a5aac79da79394c3dd9b401eef569fd871c4c5e26d6940494dd489ae2857884e7aa410ace4
-
Filesize
5.2MB
MD5e2ba4de9cd0d47a5389d747dd0a44e8d
SHA1a5d3f734d8f66b2f9d567e12ea58be3dfe137837
SHA25688e9353380c25c8cf891706eadaa997f29d37f6b41e4eb4f6987640a35802acd
SHA5123e7815c4ae10775cdc3f15cdae61a52d6315488697ef3641957724a3992868833c7f6197f70cbdeb461a8e51846b6d2064214ca1cb9c1a531d4b8bca0c098d3f
-
Filesize
5.2MB
MD564a2be84b2d70c71b772f94909ee47e4
SHA1229133d99b4593b8d881121885506ab9d7b7ad91
SHA2566867b6cfdb79c7c22200f7d3c8967c3005197f7309e4a519d55899c098d6a24d
SHA51279b9a2acfe6d773d5a10c392f4685c2148e743c619093564955fb2f60e9d4540a5e1ac517ececc52c33bbcd21bab52a289498e656b5f14699308278779e107b4
-
Filesize
5.2MB
MD5b98ff29886d2db34f8fe89a197cbfabc
SHA1f02e686e830c2f4a15eabbfd48ddacd7297e26db
SHA256c1c5ceab9377fd58bdc04fac3b4af5d9389fbf4e4c83a4c9bbb4571cd7268cdf
SHA5126af5fb89adfc18c77db4ac0d24abd08d925d7e6de6481e1a8a93c16cd227bf03a9aaeadebe2f5942adff892bb065c4a82ea4b9bb9ce83bcff8c87d7df2d88442
-
Filesize
5.2MB
MD5a570e240cf5192259cd61a48d03cc87e
SHA140060c03a8f24982d70271545eb8a6c57f2416ae
SHA2563f93579b92e1aa5475b51d4c612d19632e72e761cf1a6c17797ba5c3afb5fe0f
SHA512e83f67ab501ae54d9f98bd0da9f52ffb6535664e864aa1f0a12807a85b69abada611ec8428b7d10c1b5aefe6e630b395ca472d1763b706690483b2f591d0f2ea
-
Filesize
5.2MB
MD581b3ce62dfe509f957a0ff0f3047d45e
SHA1e8cf8e50b47f3a9fb1b8069d77045ff62ee541f5
SHA25698a15a29799a0d22322dc45834834c28b52be58ac9880c70a4b1a97c083caf28
SHA512c30bba32a77d7a94ba890bd11ef813002d2335f276bf4981e5a1fd8dfc92d32b0151bf174673a548fb98a83d00c442f40aab6000ced587bdb8aa2f09e9c7af83
-
Filesize
5.2MB
MD57042c4ca3ad2d21be608a22608d0968d
SHA136faddf9d7be0b3bca552159f7c6324eb6e665af
SHA25629b961131183fc42e59448a48d65f2dc0e689136b4eefaf9715483320d933bc5
SHA51271a6dea1e5d9250292c97912b3de2fa524ffd4a46ccf54d2618b5e0ad8a64ed81e2898a88fed9abcf092d4f6e4f991dd8199fac36254e9b50acc6eb7858a16c8
-
Filesize
5.2MB
MD57e49d34b38d0db1f7710d8e44e9b54c6
SHA1534974c92b55c8c8ff1d003b07cf86921e971b7b
SHA25696aa8605a7fecd60219b25ea611c457c33403f7dfb98723a28346b4ebc52555d
SHA512dbab9649cd8c9b896f3b946d717e48d569a27b49a7d7d5f8cc64e3941846cbd74f69c796c84e921405b2262fb862533f82e1c428c6310abf85ca22c419875af0
-
Filesize
5.2MB
MD506bf48b440138ee0d21324ff12499839
SHA189267de3beb4b63b9a65e5fa331044ab450b9cd3
SHA256ee31150beea92147d0a079504d6c42e24ef8d1a3869dde21471c8629530ddb89
SHA5124061f7d2dbf65ea67bbbd1b8160cf1f7bfdbb294d73bc5cd8c0630a50963d61f58397b2593a825868fea276165e80338ca51488445ed69bc92a3f78f6d00bd27
-
Filesize
5.2MB
MD55b4a950d72e5a4e2d1fe8c6d621b3e9c
SHA1e03344de2c6df332200b78d4b37008f23e070103
SHA256a082c68fc06716cc107fbf133578afafc30827e0c8294491587b24d6f867b0a0
SHA51284437ba87f596c1a9e41c01654429f2549ad55899e675f09daac19299640cbeb8d978a5c1d902409dbc276fd9ae306a7bfb7eabed5ba6c65c4ba27c708ab3ea5
-
Filesize
5.2MB
MD5e1aa937eb1a5a8e0b3c7c6b065711aad
SHA1dd0868deaed0d215cf6f147e8d12d7aa4c239ea1
SHA256f59c7cc7daef33b5e0e4b5b847e4a206e55ab8079d6466dd468f2cc7e598be74
SHA5122ff9aa7a7e852d1a28389c9904f31c1ca28b6f7e527da6d9ad913130ac94bbbe72edd5f5cd7034f8e335caf3b974d17ae03c3633a292bad5ea8a3568bc328c4c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB