Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-11-2024 02:14
General
-
Target
2024-11-18_a18a628dfa0d1b814c8467e32199d5f0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a18a628dfa0d1b814c8467e32199d5f0
-
SHA1
40b0479dd4c8875993418838ec5a1568dde9d2c2
-
SHA256
37ce220f5f5211f6c465e45cf956b35d60a73c035869e83088968b6fc5435196
-
SHA512
a5ad9b0d0e5fa17c47c50e64331d56b62df6c87087b041a996da4cf1552c995be2425e6b36e7bfa3e30029ad717889fee72facf4de4ff8c42fac8bf05d41ec5e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_a18a628dfa0d1b814c8467e32199d5f0_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_a18a628dfa0d1b814c8467e32199d5f0_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NXCfncF.exeC:\Windows\System\NXCfncF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\grolpLa.exeC:\Windows\System\grolpLa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzcWCIh.exeC:\Windows\System\nzcWCIh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRnTTco.exeC:\Windows\System\eRnTTco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NywjRau.exeC:\Windows\System\NywjRau.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qlNIFwO.exeC:\Windows\System\qlNIFwO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ozkbwnt.exeC:\Windows\System\Ozkbwnt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gMVNmbd.exeC:\Windows\System\gMVNmbd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fdeuyBz.exeC:\Windows\System\fdeuyBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVUzTLi.exeC:\Windows\System\xVUzTLi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPxzDrV.exeC:\Windows\System\CPxzDrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WISJPGe.exeC:\Windows\System\WISJPGe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ycTSCPk.exeC:\Windows\System\ycTSCPk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhYiiMd.exeC:\Windows\System\RhYiiMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuXdQmW.exeC:\Windows\System\BuXdQmW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AEgbSOU.exeC:\Windows\System\AEgbSOU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eIhEkpM.exeC:\Windows\System\eIhEkpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QteYaFr.exeC:\Windows\System\QteYaFr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqyeeFV.exeC:\Windows\System\pqyeeFV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PbIvvbs.exeC:\Windows\System\PbIvvbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YNehkpn.exeC:\Windows\System\YNehkpn.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53e8330403480d83a95bc224d9ccfd330
SHA195b037aec4bc7770773e9a04a38bd1eebfbea5e6
SHA25606cf5500d567a36c405c22bbd9b89b1f1c005c2fa14af546c37c1001adced32f
SHA512f6fcc06ed4f17f695d7728712fde439857204d1463fcd52beed95238b36a1e91e277e7906c67cf0b83e59cdadddaa991bf63c6c445f69c297c2ff7f03ae7ae76
-
Filesize
5.2MB
MD533c7b95e5a0f05916957abe937b9f236
SHA19a0768a0a2589a9ff0bcd3fdeedad24b8b13423b
SHA256607c222c5953956fa8caf241dfd6efcecae82025654943282cb7144e40ea9ab6
SHA512d9499e8f8522ba9c5ab59f035c5d5e4c2b1f353244127052c4742df1553ee5ab8daef2887386695196441422a0360518a3a8e8d2c30e5db00d6df949eb672de3
-
Filesize
5.2MB
MD527ea37a56d47306aa993554f53d32381
SHA16accbff070150814fb5a2a4f1dca03bebea4d6bf
SHA256c7eb8343b352852ff92f3f123a7bd113a07cb5d718f94ab50211ca4eeac0e6e6
SHA512c08bc9b78bdd1a2e44e1805939d6580b4fd7e1ff2a33f52595554d64851b0deddad5e04b82efc8e58a91eedbeed9cc4228ebb81c2737a3ebfb9463b1d791c1cc
-
Filesize
5.2MB
MD5341d977f9d594bc630136119a0e48d74
SHA1feea67884325bec8b8c05587e2cff3235c499903
SHA256ab421189d76fa56d99bb738eeeaace7b4cf56191d0bd26e8f575d92283da332c
SHA5123f57a014e4d67b8e10de526b41eadb80f75f6566dc6ce7696c77f1922110a99ce21595046a5ca1f4375a7763133ec1dbe52599f4a16fc09b4d9c209ff645b28a
-
Filesize
5.2MB
MD546fa9824c1010aa8a98080fccae6538f
SHA1ec2d96ce3e6e0c8a1d2a6b8e58de64912c5cf01b
SHA25670e46186e224d1a62bff68caff8568a0dc69350b053045e4fc7dc70869873f6b
SHA512ade85dba412c90be9a463b7e0996e024fbfc74ec18ecd2f1aa9525d5389120e9ae9046c9913bb33d43ed17b63b0f61984a8637d1b98f29e68322c043d949f897
-
Filesize
5.2MB
MD550dc378b9cdfbafac47a17f82a38029a
SHA15d54dc4b85c930f55c6bb8c417d8751ad8b035f6
SHA2565842ed5746861c01eb8c5de345bbeea6057421e2a8937e9712ac6c8e2eeb8df9
SHA512598474fdbae0273b1b9a5f95620f2eaa8f3166a7ff7e2d6fcfb3a40add7ea2f2ef3ccf032eba50e4f4faa7cc0ff0650bbdcb08468c30e5869186abd45002eb29
-
Filesize
5.2MB
MD5407d6b9166bb83b9705ce03308b6fca5
SHA159168871a52dd0076c85b426a45e140d2eedcc3f
SHA2564012c2b68f9a87bfd64a73041d21bcdfbb1bcc6a2fa74768ecb98f8cde8be378
SHA5122ffb07717306f438ca27a7c766563903b992afb8d04f7bebe4ed351bb8c7da9704ddca475d5e0c332185097ce33e62d9023a88df802c085306ea4063484aab38
-
Filesize
5.2MB
MD5fb0899dc88ce3c0d8bc4de7e4ee496c5
SHA11a178f269176eea11e2189876c0d2653182e3719
SHA2566172195e91747a0ad06b15f86c7a39b221918779727506a3218825396e6772a0
SHA512347c991c1ea6adaa837853a4672b0c6d7b32bae8f95dc858303fe7e5086b1f55a873fa6b1c6af0045b52a9fe9c6a098069e2d73259ca8f4715094b9b22ee94fe
-
Filesize
5.2MB
MD52dfecdfc444640b4964afd6bed512112
SHA1190fe9f39c4e73bf654e394671eef7ce8e244ef0
SHA2568649c0ab06c2a31d45cdbb5eb17b772acb2577ddc9155ac511c23ed8eb8c4a8f
SHA5123ce36dae82fe27774219967b8f1a905cef5519377e3169620ba4f8947cf42eea492627e3f24684d4b8e2e43a7c2663686112181580546e6725d6355d14a27c34
-
Filesize
5.2MB
MD58dad61884ee7baf2f3845951b6326c97
SHA1be8962b10e4c010f9021d0686477bcd6eb15655b
SHA256e0a1b626c753924729b442c73c8cf7ebd8dfcdcd3ddeae5abd4d7a0eca49ef05
SHA512877ef8a947397a29cfe1fd5c9538ae633217cc8b517338f7953140da3d564942e70e5e299ca0483ac91e312d769925eb39531f45bd28f4cab4a6f89a8928fa7e
-
Filesize
5.2MB
MD5664f49526edf15626f46a6b665cd63ad
SHA1ee9f914346e7644693a572e290fc3959689b2945
SHA256a6c3d2afad19ee32196654bf14e2ea37b920231b46cf486d1f162341062d0ae7
SHA512b5a68ef3a0c9cec5f735561e5deaa64ee281d114f5802dfa55a5218f88a35aabbb560de2112ad733764638ad959da56e78a07f4256dc0cb7577601e60dc1f78b
-
Filesize
5.2MB
MD5479b74a67c701a77e456e0a0f21fb680
SHA1e5a697f667d7d570e485d2ff5698a26a3693f16d
SHA2565b96eb1b301d60466070f601ed2656440bbca1736e094e0bc97d1ca34c84bbf6
SHA512cb6d4e8e9da806968c41e76eb99e102838d4df7039c8a68d5353d3829d878655d54a81dd595cac4205d9e9a694f43acad88b91679d77152ba4a8514ea938268d
-
Filesize
5.2MB
MD5789ca04d60c3211adceeca9c0e5341c3
SHA124b494df8d36508f7c331e4985a29c98cd11c799
SHA2565deeae149c57070fd8307e61310c478859a2a53339fa4d41fc122497167da1c4
SHA5128ff169fbef3e2e969850553f013bad9bb27b58ae469045c6196d3f783d95a30255ec4876ecf2f6ea9bb6aae3c15ae38274320ee9970b4d855b7b8cf260525a0a
-
Filesize
5.2MB
MD5d21c3604847d506ff3172b7fd2c73b8e
SHA129390c9c682981451dddd0099106f4646a290958
SHA2568fd974a6c6d4bd46cd3891b13213dedc5d9675e05081c94485b9c1ee06bfb3dd
SHA5120ba2ae6a0038b8a4b0b20618441bc58b4c456cb24a9e5229de0d3ec06e589ac2fc5644234a2ab51d2f828baa847b3a4dd2aee0ecd0758936863ca3eaa7507aff
-
Filesize
5.2MB
MD503f1799ced7031f2d3692431aa54d555
SHA1bb94a2a3f97490ed76b902478adae26e02f530f7
SHA2562e18cdb7f820a0117f4a495fdd81045799549976e7dabe9421ae6ea2259995e9
SHA51272fe2c276aa66facdd99df09907c0e0fe2ce555b479dac86d6d7676f29801759044414a30ccc9cddbc25660f6333507d7e426ccce1b34f8abf120a26e6a309c8
-
Filesize
5.2MB
MD503bb2c087d457109b1fe624e12feca3b
SHA19a11d13235ece97618c0dfcef899224db87294e2
SHA256ac3ccc9174952a6c1c966ab2c0c1edbab2473f14f224feebf5eedd29c0f701ac
SHA5128902bb240ea25363967473ab0877a9a5b50ba60e62d6a327d7d24bfae00deb680e7de8bd4dafa5ed8cae942f5c57b978b113fafe1e2ec4ba3400c24904e25544
-
Filesize
5.2MB
MD5d8583ce2fef58bc4dae14da8fc72c7ad
SHA1df43dfe760de630c6fccd568c483c0eb3658ac66
SHA25673f18029b65822dcdd09e8f8db112174e6b5d2283281604c4c47c65c8ac9227f
SHA51285c72e62808ec38dade3f020cdb0372770a4bfed5a2cec491f077e1547c4698564b8ce8c6a6c2568d10c11e8d317084cbc5f52ffadccb448ac996ff1615041ee
-
Filesize
5.2MB
MD5010dc6164e8b0ed967a8388c62739664
SHA1201e880becd018876b852b766e0cd94560435abd
SHA256ae9b34d009d3dc6b36b91f8ff89441370467d904cc4b737230bd7d90577b2582
SHA5128dc6d5ab98f07edf65095fc11d74bcea30bb46c4e7b7fc8cc8f7001dca8b9afd678c59f8ae773457eac773ba8e57c3311693ba3e81fc7663932fcbd6a2fd1335
-
Filesize
5.2MB
MD5a3827cde74716ccebec76439d94d3ad3
SHA197bdaf7f6053b299db2b06207c2204212d398efe
SHA256b08ea1bc725cafd0134b8996342ec5da6b3d871d627ef6ea4528ff7f254ee8eb
SHA512eef9d5e5cfa80b4e46bfd7003351428a0b5b6f93347bcd5c7e3757ee410f453c85d7efacb8459bce4f0b61beb0c7997eddea4aa9a073d814389035a4d20f9b47
-
Filesize
5.2MB
MD5b2eb95edb5c2bd6a8c697d0445255662
SHA15ab1e2b9cffe4f5520eb8a42d4c2a20dfd19755e
SHA256d443d378e8c77d3e30ab8e08e3c02e72eb42eaeed1f72de6a9ae3a7e87c8281f
SHA512b0c3ae30d1ab68babd919e2c36b98b0741d295afb260fd46eb2e7601adcb3219e9ca3a9ff1eade3e39ac9ddb80bba0f01eff1b0efda29abb4955cbe52618a473
-
Filesize
5.2MB
MD56cb2bd1b439bf1cc5b2f6815d54c77f4
SHA17043ac602deb2dc394722584c18b86797636b679
SHA25649679c76de54acd55e12d89044420f66c7618f20b6a2319a8fd073dd2153b361
SHA51215d9a28b57d5baaa49b6c6a9453297d9a608541142bfc6269e46c1117705481fc3411eccaf594cfc907602527e38a3b49dd95c55d2fe30b76e3d9996bd627fe3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB