Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-11-2024 02:15
General
-
Target
2024-11-18_a6016ee33ea98acdaee2212d168ebbf7_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
a6016ee33ea98acdaee2212d168ebbf7
-
SHA1
2e40871d784432083befe800b876925109c0d5df
-
SHA256
fa898d29c2098544aff71ed3b9bb3822d4df6fa3a728d813be2e720079d09274
-
SHA512
0f5143c0407a9a9cbaf6d7d470ee57cdd356de93d486e8df3a37caea5f2b44e8f26e5625837a250682da4f600959f61c06bd55dff3e460d8b51e6977bb4dea8c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_a6016ee33ea98acdaee2212d168ebbf7_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_a6016ee33ea98acdaee2212d168ebbf7_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xybxJyt.exeC:\Windows\System\xybxJyt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\unWwDPx.exeC:\Windows\System\unWwDPx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aMjbjMu.exeC:\Windows\System\aMjbjMu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rarDwTh.exeC:\Windows\System\rarDwTh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MrnmGEb.exeC:\Windows\System\MrnmGEb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pnzzfwo.exeC:\Windows\System\pnzzfwo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJoNRlG.exeC:\Windows\System\xJoNRlG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oaiDOyM.exeC:\Windows\System\oaiDOyM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCYkZCw.exeC:\Windows\System\uCYkZCw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FZOaZUa.exeC:\Windows\System\FZOaZUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TAnIVUo.exeC:\Windows\System\TAnIVUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxzrOjf.exeC:\Windows\System\oxzrOjf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jWrwkhw.exeC:\Windows\System\jWrwkhw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UypXOpC.exeC:\Windows\System\UypXOpC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXhMrLD.exeC:\Windows\System\bXhMrLD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IMUXqkW.exeC:\Windows\System\IMUXqkW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EfJzPgN.exeC:\Windows\System\EfJzPgN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pYZfSvI.exeC:\Windows\System\pYZfSvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdGAaVc.exeC:\Windows\System\IdGAaVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxtMByf.exeC:\Windows\System\cxtMByf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELJBQlu.exeC:\Windows\System\ELJBQlu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d1558e1406c46d8aa2af5d706b3294cd
SHA12a01030b4c409ddda6d67395dfed5f35b8ce4bd5
SHA2565dbe02ae7cceb601af3c9e5572272c8593f2d8af9c1033ff619f01974c1b1f65
SHA512e2d0ce3937db9ad23463af0b0aa3c0f3e7d29e950fc8a4f6744f54172dd3fc4cb4476ee5d08ff8e1654ef754e26acc8ae502c08e31a7b90a1afccb4f25125beb
-
Filesize
5.2MB
MD5fc4f70f36f4f5a2fe371a757cd69cd60
SHA1eedf674a9acea6d60626b8e2991b1eba3deb1082
SHA25649846deadc24a34f1baa43774d8ae1b049418b7205f0ed097330da511f2d4858
SHA5127a7f288ce9a694df6b406fa4e22c81ed7bddeed2f84c4561bd27e28c7a5ae491e41257975af95545317f8b3004dc94c7b05c4ed37f70ade00b39c30258ebb51d
-
Filesize
5.2MB
MD5cc348c55eb9eb334902d61cc190d9397
SHA1b41318cd46dca20481159e6e40ec1355e382795e
SHA256ce851416226cb6e6f20e8d87c33d779a3c57faa1bf2f2cb61fed669c082d2de2
SHA512ce20cb6fe579bdeb8cc623bb08fc78b6eb996d093e1a8e742dc49d6442caeed594044a068201639f5087fc8e1a57682f80ab311d215e2f7c4f1e6296abf12b52
-
Filesize
5.2MB
MD503fb5285846f1cd5fea50559aa8e3db7
SHA14cdba5de2fd14dd041fc5fef2214223d0d08df4d
SHA256c37cd7ab6fe481f27bf7c1a76de9773eed2feb58a8530d27a24be67af8f9cf14
SHA5124fb2f6d6d18beb1303f462c6d55abad62207f61dd3c7b1a0962b9424d8a0acedfa7c9f061a3570d270dda2141caa99c1a1f6f6f0b2b5611aa4b146cae068e3c0
-
Filesize
5.2MB
MD5d4a1f659db5b8919b1ea060a8736102b
SHA183228e7561394c457f8dde0fda90a2d504025684
SHA25609976290ee4be58866bdcbc55f81078314033b86aa83b0f2fadcadcb756bc0ed
SHA512833e485d689ae4f3d62843e191b6458d01cbb51b675585b744a63f0744400dd9749758436356229754da8b69a523b00a9b587da75eb5f4cd7d1968c9685e15c1
-
Filesize
5.2MB
MD50d9c55957547dc672b899f9b6fc41540
SHA15339068c00253384f1e92e9516e0bb7be9384d1b
SHA256fafc72a28ca245805aafa2dae4a9e935e0e61764b3bc48667625e59732130faa
SHA5120e821a9f7a914a93f1fe53373135df75913e32ed284372fd31a550f553de499f4636dc80942c8991e5e21c576049410a61d46da23c1f6e3942ced109ce1e325d
-
Filesize
5.2MB
MD5ad68c9a3148c7a7aa1c8a31c1c5bde58
SHA12f83eb9fe86d35543f0736ccf81c0e74e59cebdb
SHA256bc5b75427ea5a7902decc1cb20f212c809ce1575ea02203e0974db69c5ae0e10
SHA5126476e391a289c9d3e8aa6cbf88ee5c993c1d200af1941abe63f8b7a0a3c552eb4ce02eb465d55555382c1c16698d3ee440c889f2f37f14b6537a5f067f249dc3
-
Filesize
5.2MB
MD5447cb62d8fe5dd7c8fd7eb411f4c3a5d
SHA131d6d42c29f8a1b2685cb66cdfb50721828efeb4
SHA2560c69efd23e509907fe7818baea918cf365c55ad8f713efaecb4f8fed49f419cc
SHA512492a2ad3d88a04627d00cf5d84487e5bacbfd421f81a208a865a016371c35d85e72ee5573de79509c9e597f17f8601aefa589484569664da42c2dc985a1e0ac5
-
Filesize
5.2MB
MD59ec34e87f0e9940eafb1b30fbc2a55a8
SHA1887e614ad6743f1bab58d49d77e56097f6eadd7c
SHA256ac510e2621c99187e8d0df890a06ce8410c96c80c857b20b5caa4baf4bc0feaf
SHA51205f165de17f3317bc1e98a7315b02b142e406a78466da538d46b6d98455801a55cd69168551e7d1d4ff121aead063cc394942a5e813a220733d11626a1573f38
-
Filesize
5.2MB
MD531bf07cefee74558e347a17c167ab842
SHA172a87d0437bcc7aed7c0c87e5d91454849fc1f54
SHA25630b55533588308acaddec836a747c426e65d9cd82583af998a95afdafe4dc01c
SHA51222b06a1811699561aebded00dabc8f52784b925cdd9ed664b818be45ec2bdbf5eedcaa34268c28e3f59949c113f5ca0d03eebae0b307e1649562cdd2c6b30c52
-
Filesize
5.2MB
MD524dce087a1e6ac67c7fb5e96b3331f21
SHA166bcb8f50a650689256f08b3f3aa9603bfd9c19e
SHA2566a0d78093b4b36fb598455e6549292dd70dc861aceb7ae5ea559a4434c19073c
SHA51277a6fcc41d2c096e17bd033886065f3356f32afbb3663ce421db1386e16f223ec3299f2b8d392aa8ee3b8d14cc02c3d039b7ca661ab69d08df84257500a8f594
-
Filesize
5.2MB
MD5e170026ee3d365fbfcc89c076934da8d
SHA168199b4b3e36884a3303728be385cf5e5a156235
SHA256fa681f30ed8e1310b4c5102246fcf46dd261ee98905848e78497e8ba797e89f2
SHA512a5b779828dbbdc9fd5c8fb963f5bc2b780339a74a441a2aa5f03e6a403baf1d826a28caff6d6f889e3d757ccfc3ee771877d42c29d9a7863c1a000a06d63b54d
-
Filesize
5.2MB
MD537b868ab7374c30585db625f52973e7c
SHA1e8b9b15ebd3e1e2794babb54097eb580922c69b8
SHA2563d4da9a890b60c1e1131e42d6f98b30cdb80077aae204ab7771793e7ce11e4fa
SHA51233898959962655a1256025090a0798bdccb790fd85c7d1b8aa9011fbbaa373ea1e6d08e5d68179bf1c9ad791bf29a16d129126c98031d81842af57f5fac9c606
-
Filesize
5.2MB
MD5bb27d10e8bce319c0bd96c6cb72ba32a
SHA1da47d08a2280605f80a09f8552ad8d4ec41264f4
SHA2562d4c45698a833779a4a26bfb9c4ff7a2b97555bd8eb6f137a2884ba23fc78560
SHA512ee4277fde3c44ec62ad69c543fdf8980c6cbb84791e52936380639ec1a518f1c955bc83915b76900c4a9fb6a9e489fe08f104e1bca87cc6735fb7da444fdd814
-
Filesize
5.2MB
MD5848ccbfd8825af1d8481f24dbafb7f2e
SHA161d8acb6dc5f8696405a5519bb8e8d1bb7e0d25d
SHA25651bf0de230ad00f11edac7af460e46a6d2c19382ed5ae62ba7106f6298c5b9df
SHA51214dd72f7de9e0b260102ec416531e94d642265ef735c6b5aa3c2a2f1e0412395725390edc8e5c56dc49316badab06f88dc4e49dcca45a7d81bcc3c4530f6da98
-
Filesize
5.2MB
MD53b41b05b8775bf1f5e24be436e79c8e4
SHA1b9ea3a319d4137257b43ecc2493f136a95747c9e
SHA2560832e0e560e18cccbffce73f6f41f687037cdf5c3e5bf8c42b7b4ceb6e4f8af3
SHA5126ccd003e2e740628933d1d323d93bf42686560cc8e9f758bde1d32669ed26f88e00991785664cd9798d442f6126a2a50f395934a79c9380879b13ab4821d85ea
-
Filesize
5.2MB
MD5ef42c12139563130a95423db4eb10008
SHA15628f88edf1d3e35f68ec6fe31918691e8bc7abf
SHA2569d3e55f4a1d1782fcfd93557da47d9ee7a9bbfc40dbab8dbe2227021667b42d4
SHA5128eb65603ae402ceff1f8b89c61d1bbc034a09b0c4592b0fa9df95fdb732ceb2ee32ee459fbb9ae52d223a325bd224ac064350098023ded94f86dcd9156e8a726
-
Filesize
5.2MB
MD59818b0211b58d3288e2ff2a0a2d6de32
SHA188f5b3f407a44639f214fb0e43feb99970bd25cd
SHA256d288ad0a317f260194c1fb760562caec460d19afcfc2cdff5236a2a42f205d29
SHA5125248bdcd8e75322a0ffd2a8c934e90446851b600e577879617187a71671c0fde00060f67bbb7de918dbf0aeb66639450a8e5eba64f95e52b1aff0b2bf574b9cc
-
Filesize
5.2MB
MD52fcbd089bf18dadc1f3af2768f01e658
SHA1317220ae79270d9b7a8573858f6b5885cb0593de
SHA2569f2a2119c2b71e4aef9b41e22a6fe1c396529ed981f1a4e9336cf9c104dbd4fa
SHA51283ceefe82cf980e0cc4c632d0608a6c390fc4d943b908a7f42bb5c8ef5f1c8d3a6f76bedc174005579ce41e1b847bcda885613a96786fcdd961e0cff1adc469a
-
Filesize
5.2MB
MD5e3ab47333b1cf3095bed1309b20cda0a
SHA1566b40183689ee6b1487a1202995d930854c88bc
SHA25685ad549ab3408a59fd8b11dc1f1e2fd8cc49e2d560659c4f1b371e6f5d5f32cb
SHA512e1d9bdf3acef26c60831bd81b8c2043130dd67d60c0be605397fbe5b92d9e1d6589a22031851e92358fba98e82e06c3d687757e348c2201746c38de2e7361d18
-
Filesize
5.2MB
MD5c74a1a8e1ca9d4cac3a60a04132047bd
SHA13fd83505dda0bdc38dfbada73789cbe6d834273b
SHA256e1b081e1e4acd09af5ee65797b860316fd3b634889254e07f9756ae4b0ef7992
SHA512553316fe88b417ee0be9db0c0efffeb76be7fbba9dcc5b0b4a00b90b7333f06b0e8e12478cc092ce5304cc4f5f23af4b599ba688d8f6ed4dace1e1ba97f15c7c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB