Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-11-2024 02:04
General
-
Target
2024-11-18_5fd2801560427896fa023e85b33000b5_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5fd2801560427896fa023e85b33000b5
-
SHA1
13c098a61c854981c9819d4d64b613e6b10fccad
-
SHA256
79a4805597e0e66559bbe66a762ec33164455c23796a16dbd1ac0724710c1158
-
SHA512
240e025a5be27fada221a9f75a72e1aa981eb46c90cf8e8ad938bde95f6513cec64b9a163c1dedcbf6f461a70505d61f6a93b0c271b66ef4586ef75a636fdeb8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_5fd2801560427896fa023e85b33000b5_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_5fd2801560427896fa023e85b33000b5_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DxXPJRo.exeC:\Windows\System\DxXPJRo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qFoqJbz.exeC:\Windows\System\qFoqJbz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bWmkdEZ.exeC:\Windows\System\bWmkdEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebKfSsE.exeC:\Windows\System\ebKfSsE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwYbsvj.exeC:\Windows\System\dwYbsvj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ROcLxky.exeC:\Windows\System\ROcLxky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eVWaMaJ.exeC:\Windows\System\eVWaMaJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVYNnBG.exeC:\Windows\System\YVYNnBG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qESlncJ.exeC:\Windows\System\qESlncJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DwOhiio.exeC:\Windows\System\DwOhiio.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwlQlWJ.exeC:\Windows\System\rwlQlWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pTvNVjm.exeC:\Windows\System\pTvNVjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XzAtoQH.exeC:\Windows\System\XzAtoQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtYNbiC.exeC:\Windows\System\JtYNbiC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnGeCTA.exeC:\Windows\System\MnGeCTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DZthgbu.exeC:\Windows\System\DZthgbu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cheqDcd.exeC:\Windows\System\cheqDcd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\isRORqh.exeC:\Windows\System\isRORqh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mvXbmoL.exeC:\Windows\System\mvXbmoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bvtysRg.exeC:\Windows\System\bvtysRg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JlnRLoz.exeC:\Windows\System\JlnRLoz.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f3ed8bb2bed447a70cc2897559e929eb
SHA1a16fd051bd4fda4729b307e16c29d457b97fb044
SHA2568cc82b3c6d5e223aca903f2cc38cc94c32b72f3a63ee36a4a62616f779c238a2
SHA512b6c7c123280357585349f6c14fb23d5e6b3a79ef1cd29e937399e1e2820ec88e3dc6b6d559cc023c4e0d70d1d812d6447fd76bb6a5f1625395bb72bf821536d4
-
Filesize
5.2MB
MD565b6591a4c9df876066e6b93b64097d8
SHA1fdd68ad0e2b5f76a68df133e9099a4d9747a0d76
SHA256113485bc5c2efd584003867af17d166e8207bade022b6f102a725fca2ca06685
SHA5129334e44d6f0e8ac10ddd4eafe0f8d1d1822a7b40ce3c1271b4cf5f0b9f80e441a4d342fe14900579e17e7b4537b0879fe79346c625b75ff8b8445fae7967d14e
-
Filesize
5.2MB
MD589561de2ae3f3a3bd47b540a8f32b7c8
SHA1dab9358cdaf21165937272aa352be7d7a9e8ae5d
SHA2566ba48ae04bc9e6c5ba5f702da53191bbe5992ab3c8e1bb961ad6fd66aedd144c
SHA512b76190579c9bd982e161d90daa16fd378b08b65cf3082cbe7657d915ed62d3cd8d89bd5085274f2df5839d4c7083763c05885a297358ac309ae32f5729e90ae7
-
Filesize
5.2MB
MD5dda932955eb68fdf0287bf602721be2c
SHA11459fc42a68f33ca72b83cada9e51a7408bf2a12
SHA256e3d92efeda1a9a3e02249e90db3573571650eec9497e865cfd70d5838514fa63
SHA5127e252085302ecaff317caecf8b92f89190818e3090ee65b93218b41aba336296c254642f7096ddebcfd365b2f5ab91a56c6fd31217b01c2dfd048ecc5a43b51f
-
Filesize
5.2MB
MD596a5954ce4b1c8f6e0b2b3fdbed9a307
SHA1ec691a2f38b4018396266dea4ed5f079366c9d70
SHA256df4f99ad84291edcb2bfa34bd9a324f12c6e687b86eaabd67699ed890cc9da67
SHA5122515c2cbfb1f2f48b1c646c73c33d1a2004d59815dae989d8b726ed48323076650b667aa6d22111c8ad27aa3fa0406384453a10f2d9910d37e997b950aa997be
-
Filesize
5.2MB
MD528b3343cc069a73a7d2f653b47e6f89d
SHA1f6be91d813ef218476165398b36e99fd525a0ade
SHA256d564522642e39ff9876f75872a829e23a44828e32499645abc16f484320a78fc
SHA512d6fdd6804772d10367137080dbaeaaa3c0075a5336f2a5f137d0e641139981143b6503eb89a71b6ebe5d28704bc73e306f249b27c86ddbd2a372ec80f75f76e1
-
Filesize
5.2MB
MD57e1c4b9d172d06fcd5dbb47d1169e5e0
SHA1eff5c903ba01615fb4d2f3a44fc400d0ab531b88
SHA256461a619bad728ab11fd43a7927322c88887c8ac41a210820187217fdcb1e27c1
SHA51234864b09b8a76f904afff809cf4ac29d4308d3a24a9705c55d3173b87f347a754589d1496b00ea61318b58e7f0e42e17a9147faeb82f322a8e82757b6f8d06af
-
Filesize
5.2MB
MD5fca1b37826353778d048708ada542cc0
SHA1b01eed99c946c8d05beaf11da65834ecc8973c5f
SHA256ab19ddd123e4fa2780f2893642ab5d3d1fc4d9afa469bd682a9585b032ab0157
SHA5126d2b5d25ee4f5cbe12f345eb8c721ef9554ff01b947c4e306555d71306916b34204a1efb688c3285690967fc07fea4864fbe97073745d0004d7970dcd140a39f
-
Filesize
5.2MB
MD55df335693f4e65da75e0a67b3192d4d8
SHA15873554a27fea8ff447e67645625640aa8e320d3
SHA2564c995c9fe56e40e93a8b013ab4de86842c3ca80d856de6be622555b1dc084c9b
SHA512f39c409fa74347af8c499c946243b6490548aaa638429763a77e06e63cfc3fdad0f9298b6c04d4edffbc0b3d2f730871f065461d98899ef0fd63ae7b32e24c7f
-
Filesize
5.2MB
MD50af35ad01c7f7577377b9d3491637ad7
SHA1bea5b532b3ae4664f46e0d689095b80e547a4718
SHA256e1d6c6b540182648383b88ecdcce9f2c9257baa49cd59e14f0dd93ceaebfe198
SHA512bb13e107d5390a428aa7fd66fc86045ad0004e59f16ee60a65545e4c5b0f08c6217a6d129745871ea85fa131ca2ef67d2aaab5d7eb4758ac17295fb446ac86c4
-
Filesize
5.2MB
MD5d845dc33c27be4c799266e8c2b930c19
SHA1f8754ed8a59b5e262da171fe71193fba9513a1fc
SHA256e80311e997c8367b81555ca82e793194083ec16954318a337cdd7e31414a8efa
SHA512792561c9138a9dc4cf919ed51497f15c168028f6d6e16b5ec1873d9b8164951333a3d05ae60f33d854a88eb4d48872e3b876878c6efcacd47c017e8852ee330e
-
Filesize
5.2MB
MD5fda310b98d8005ff91dea8b285454ad9
SHA1516fee108345c39a971a801136b843f719a65794
SHA256714671324a9a89c7a6a64117d3a31f808d45c30d3a9391a88a0dd1ea4725f074
SHA512e2241528661ab46cf17acd0f7a9d8956b718f80aed751401daf796883ae194a498ad91ccc68fd5f9d297bae207971229b8652a435799cbaf5bc98e73dd705ff1
-
Filesize
5.2MB
MD5f2ed75bcce08767bc0f02775eab73c6b
SHA159780ec0b585563bfb5e9e095e586de36df7457b
SHA25624a7033186872f3bf0a8b4aeff9dcaa57c8be31993733ea566eca071d6e57397
SHA51216490a330e322ed657bd8710331a6109aee186c4ca61770e87622bb95f0e82dfa03cc7423ed6fb1a069fc9e45daebabcf12a70302a22ae0b8ef3ebcc165ca426
-
Filesize
5.2MB
MD5e4527870550d1bd2cbf554f373fbc1e1
SHA1514a1520fad6efd1e59e55c91309053126726e3d
SHA256b1923d6373eaf5089e89f095469b10d96bf1efff84c84459cbdaa953dce69d74
SHA512e2cb692c9fe424919d104b6fa7f8be591a25073f78c5bbb1467c58f081a8f2eabbafb50613140d97e8241df96fd33b5c4a7ddd4c83a8df7debf7637bdcf0e1b7
-
Filesize
5.2MB
MD55afb63977aabb42e1aeb8dfaa6afbfc6
SHA16dfd2bab7599c6f1f4a06bfd27ee6fe195fe1f81
SHA2564505a891728ebfb98134eb0eacecbe269aa22ad0dcf3abbc66183becba82e365
SHA51209e22628563e875585b457d4cfedc91c7e967a17b567f24eb8f24d8ff39bf66ef678da53fbbf44602212874bba262d56353aff5639d6f1f2fd04bc000167bc27
-
Filesize
5.2MB
MD597a0944fe0a90baeb8c1cf82be847f66
SHA12ac9ed5dc26414918b509c305040db6e9cdc619c
SHA2564992ea5ec50dbd236ef432e71a61397ee9594b9876b6e87a7ff538939db017fe
SHA5126ea05e6b4fb6d76ffa2da127d58e555d15141521452a6a20b58d79eed8b507d01dd2701c692bbd37ff598ab4336bb3fc009da14e1421d64b9fadb2565afc6bf7
-
Filesize
5.2MB
MD54f55820934f85557ddcb72f3d3681f01
SHA14edeb6d396db0eeb7e96f60263e34bec6aa2a4cd
SHA2560b27455d51d996e9d83d4c0eb0485828674c3e6872a7f06bfba3d10df7323215
SHA5123ff8a0a6b6a6ede2c64e03dac55b3529756cb0cb1f6f002fe1d27dbe31b5d28018deba157f21bb8325d93a73d0e6cd172d3dac66226da61e8be6c1a3a87ebabd
-
Filesize
5.2MB
MD57ae56e99c9de011edb242082d4177637
SHA18cc1808728ce7e6688598d0ca3145864032fabf4
SHA256f1928ccc3742a71d05ee11bd8b39511b0e771d5514b2a235e2cac3a342e66963
SHA512765f512fc6a0532627e1867accb173caa291ce07408897b211de97eef6a2c73f3013f8144663ee34fd301526b78ba0f75f536de8feb576e96ac0a380f11b1aa9
-
Filesize
5.2MB
MD5f672f7bdc14b3c26f64fa3cd596c6fe2
SHA1ca984d7da9bdd0105e5c292d7874f9e505599082
SHA256b7a382f090cdd294375a5ab74d38fc5a20d0ac46762ce30380b189c0e040efa9
SHA512e4f5aed5b016c414c2754151b6feb017c61e1c90c2034fbeb1556f93bbb352b1c045d54e9ec304310f60401a148a5cb058508d3742583bc05e26707e7e45e6ed
-
Filesize
5.2MB
MD56e7b65b38b45b2ae86daf35f48783070
SHA1ad9d90c6f34e4fdeac91fa00ddd226a4102e6abf
SHA256eda680e0cd3dcbd338d054a90a20e93791cde3275f6eef658abe87fbee451490
SHA5120ef6169652de53a217df040346caf18f94c7eee4fec1db99eaeac81e3b7bd93c0b051b971e81a0ad529ca2fa83d132ec859fc2a3ca1f9b56f9a42d7b709a600d
-
Filesize
5.2MB
MD580a552f34a0bb0aa48d8eb32269fd065
SHA18366dfdd7c23ef664cc442563f78012a08f8eada
SHA2561f11e2bb1bc7949482c04d96af416b92cca3d6ad8afd736793dd1e014641a113
SHA512fe9c4ce46d4b435968cd8c69f75909f2e325534c229b555b49f0de7c8c74bd8d2c84e8c16f3f898e04531df4f4141cacc4f34ebe22262cb5a347eaa4a3012c09
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB