Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/11/2024, 02:19
General
-
Target
2024-11-18_b9bcc6e1593df29ec0b85d97a252ad9c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b9bcc6e1593df29ec0b85d97a252ad9c
-
SHA1
b10cb8f3875c4410c49d234801f9978d79ab6a4b
-
SHA256
208c9710f6607f1d0041952b5ba86f862b1d960c4a89ce227095941017d027a1
-
SHA512
e4c6cf3787037001ce12b857f4df320a2874092ed3f7c98a1892d9ad838f3994d450093b9ec5844ed2ecd8759c45820a6cfc6bb0279b17eb541309693f101b34
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_b9bcc6e1593df29ec0b85d97a252ad9c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_b9bcc6e1593df29ec0b85d97a252ad9c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RnSLuTM.exeC:\Windows\System\RnSLuTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeLterc.exeC:\Windows\System\xeLterc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\faTGnDQ.exeC:\Windows\System\faTGnDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNTLGyr.exeC:\Windows\System\iNTLGyr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHWNTCu.exeC:\Windows\System\tHWNTCu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgOFTEB.exeC:\Windows\System\pgOFTEB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eKUSAHO.exeC:\Windows\System\eKUSAHO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LshcKtn.exeC:\Windows\System\LshcKtn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hTMHYTO.exeC:\Windows\System\hTMHYTO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiSJzmK.exeC:\Windows\System\BiSJzmK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AibFtjn.exeC:\Windows\System\AibFtjn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIKHlYU.exeC:\Windows\System\SIKHlYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hXpqDfc.exeC:\Windows\System\hXpqDfc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\grFTnxu.exeC:\Windows\System\grFTnxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NHnHVkt.exeC:\Windows\System\NHnHVkt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFlhNAN.exeC:\Windows\System\PFlhNAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\saQXsUx.exeC:\Windows\System\saQXsUx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVpYXLr.exeC:\Windows\System\tVpYXLr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnBRNZR.exeC:\Windows\System\QnBRNZR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tKgUeaq.exeC:\Windows\System\tKgUeaq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IdZsrqq.exeC:\Windows\System\IdZsrqq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e0ed472127d191386a18e17356aee657
SHA1ce7fec50e8e6d0cd93d25643a7b76d3db28dd1cc
SHA25680be822246dd9775f3cebc14350668dea40a31c80dd60d83e66ecb2a38eb4f7e
SHA5128836fde6268492728d316cf8bcf1a1867d48bbb24670967da3015240560a8ac9ce107fbfc93e5381dafe5705078b3b463953f1566f7e231525a18051a2c41d08
-
Filesize
5.2MB
MD5e36bd1eadf8a3c721e10bd927f1cdff9
SHA1788600d09c24067fb7655f8c390a5b21cb61865d
SHA2562eef4cf3e39e3f39397034be8d12240d2dbb0cca5759370b145c7c5cfe16fe21
SHA5121901160bb871dd9d05ce3263b7e0e25f14374a6efa0b23394d397edf0cde35d1945bf5dec059b8d3b1020b48814f3796493d248bb94fea7ebb9710a315901d48
-
Filesize
5.2MB
MD52f0dcd9cec29a06922eb35aab2f23fb7
SHA101d6f9dbce77f83d0e5744b2c777189cd86affd1
SHA25662fcd879ae0c73975a568d28e0be544a2a9194faa144d5ae0d6eaddeaeafc4d6
SHA51262fba51b0398a7eb0c3a8f116ed7bebf31d5f0fa0948cc08c690177939616aee83bd6e2afc6c832803bf2772fe67c313647b0a3cb9c63778be4d9b9829df0f1c
-
Filesize
5.2MB
MD5062e55afa4f4a61ca6b3f2cefb3c4e1f
SHA123b3ac824e10ee4a4703d3f620019cf4123500fa
SHA2567ec81d6b27ed05ac25a25bbbc2c4720f39879eb239ed6d70c5bf814de7b3215a
SHA51216a751dc83f18f23a0083ba8f13a95e8a0c3c28b888216fb492438ee802de7c74b573c28f0f04485756b2bc0ba29c911d1de46cec6f0fdd51f8760238a00119e
-
Filesize
5.2MB
MD5ab77cbe1d921a4d5cc3d3e6daccaabf1
SHA12d6307b4e821ff1493deb7cd64b614f1c62ae88b
SHA256cf020786b4e951a461f403a8c236915a106086ea138046b6119ae54b4ee6245d
SHA512169c2e6b58f3bcef80076b49eec0e3bd001291d13739b07f5ccf95e442659233df6b95ef25c8e2dd3eced30ced3d9801a64ad1da64fe537a8ff713a898bea8ca
-
Filesize
5.2MB
MD550eb10e61477975b8db17a5c60afd1f6
SHA162195f029a747fe96cb074256dcd4ac0c0984786
SHA2567b749d762b633b073f9ea586bf838fa6208c519ff49ef160e7c7a96deadea8b8
SHA5121af1c110774c744f1c9f97692c2256f032903ae205200c9bdb1ca78b04a8c118b425099750b2478c151e51f3d72bbcf2cebac70d5098acfbd343abca55f7034a
-
Filesize
5.2MB
MD5e57e5a7af98bf62b91c029284a34ba09
SHA1ae3b3dadb57369bbf5780b4ec0f485e9a67c0be5
SHA2563e062fbc255859c6b9eff066b8edef967b0f714909db9946154eae542854846c
SHA51237472e9770330785fe050d083169f01ddeedfee1ea25f518ee97d278979d2b091e677dbeffd2e8f5dd39a1eaccbb458a05691de1afe1884c41ee529ab3786c72
-
Filesize
5.2MB
MD5611439b9d37ffdf4c221c0bc0b8b1260
SHA1e593fd00dd03d3abb34ee42d7065a79eb74532ad
SHA2566d4e0a24a348d635fd6fb88a9306bed4de4419d778cef02995065236adb74439
SHA5125ded1300279d3bcbe2cb72f1e4516f42c6accb27619be25614d08a0e4f29dcac87cf06a846ac3a193471835ae7cb1fd53b618926ca3431937aab252b48fa0665
-
Filesize
5.2MB
MD5cba9c2fb04cd21cd84cdd14a8398a4bd
SHA18ef095171d3c2335b2b505dfdbfc04ab5fc1a64d
SHA256ca51f26fa40e249c6676632f1b8fc28e78d49cba8326c4d4838801fba9bb77d4
SHA512ebae74cbc930cb032054202248795249f7f891d1b6c67672ca5c666548af1042a27fedb10c27a452f7ad455f684926cb5b197467eb93253159237a665c0ce418
-
Filesize
5.2MB
MD552fbacf7f738dc4fd1d1fe972e5fc300
SHA1a25a044e41cd2107528e080fffbdd725f6295798
SHA256f4291fdda61769e96f109f59d505bd0b9aada53a3d14a128da4bc82fdfd851f4
SHA5121649333f103d25c9228794159678db1d0e5ce65c5ccc0402e41fe8a3cc7582d15d2c1d4bfff505e0a22cfc7ceeb01962526659f82599097ceca179f4aa697e19
-
Filesize
5.2MB
MD582d09c35f99de70a4b13224f86103444
SHA1f345fd2665ef2cc6b3ef38cd774d44213e14ef83
SHA2564c9ca7a326a8fab6157968a7b21d80d205c080ee0b152e28775316714340db8e
SHA5120739944ac13959d703ebb90d7494cce93e7e1991b53af005ae67734e82c691bab3cd0796234408157f91ba449f13f3be9c62d88765fb8478903dfb34c38ce255
-
Filesize
5.2MB
MD5009c6db2c878953912213de4e88becd3
SHA115d2c90fb2a42cff2d61114db777f194d1dc4089
SHA256eae53154c5376b73f1c451ee18944ba4233994c2c1e274142b79fc004a107c3f
SHA512eaf5423cd1b88c8f8fe016fec2c2ccf888f3a016fccd63f6e1796608d0c32fdf0bfd4337e806adaa785efdd165d449abd48c198e616f05476ea3c9cadb77b3e0
-
Filesize
5.2MB
MD5b568b9b193187eb1e7627a29c5f2aa06
SHA177a05af3d4193f20c800e6be64151eb0e7df79cd
SHA256c04882218921bad0f95574e70ed62829990467eb3558e2fe00692c2684459b4c
SHA51250b42862030ed0f7103abd5ff4f34aa4d4c6ed21bed0f329620979e5312bba2ca6c6f4b73be3ff111ffe6381b143fdeb235dc3be90034b5388673fd6b6589433
-
Filesize
5.2MB
MD57a7c97186a8c584c7140413001f82fdc
SHA1931be0a6d5375f00a4fe1de9935ba97fcfbfb426
SHA256c0d02a1fa72d5262100fa8d0a38a33256de3c22c347c305d2e22ee5597b3c5e4
SHA5120457fb9d5cdae0fa656c7a120f67cf4925913f909d2d247407b70bdd97ef5046fdc94e31a2676f54bc6455f939632360b830f2947a250cdd4577111cdcbaeefe
-
Filesize
5.2MB
MD504646ec5cc294e521f28269ab1c35919
SHA102f931d2329c23979b539035fd30c0c49159a65d
SHA256609f984ae635663f424f8617e78a7c9c45273d0080f469983ec6c3376ca56daa
SHA512b52b50d7dffdf2da722138c1800fc28b40f9d5b744fdb5f9a0de640514533c52122af8a12648fb0cc5479be99ec505886a040cbf0072727172ba7a671856dd25
-
Filesize
5.2MB
MD55226310589f93cc4c25e57b7577f507d
SHA1846edafd555f57e658a4caeaa660663defd275e5
SHA256b1c26a4717414e3afb5fefb35edc6a006abcf865c0f612d24547b755c1ed820e
SHA512c668cc7727edebf7b1c44a9e863c3dcf4c382773b2ef7ae9ba5d59a389305c610d657f38770acde4197038de3353910245183e64cc229ad5841c250e08231ec0
-
Filesize
5.2MB
MD5cb2027e3d50370667c816cd587ae0ea4
SHA1c42a154aa71e2275903b0412edfda33c5f65aa05
SHA256bfd72d24e6d6105f8c01d16936b1b26eecc82ec446c022b3e94df5a8abce2a17
SHA51246ce24f91e53c70ef673150c9181cfd1ee0d56e5f1534985c506895e654ed5fcd6e762644964948029fdc8313af979051f64468c166114bb2142e6850af4a8de
-
Filesize
5.2MB
MD54cbaa32917b1d7bb37d3a4269a331205
SHA12c7cbc724cb07ffa083fe7a1eb261159f830f854
SHA2561c2d86f68106741992a1bac6e1da155ffb7c5fa1e3b00a9e7a022b21cea87d11
SHA512c72734fecbd95b7392edcb7d1dc981d33e16b890975ead7405d0e6dd0e1a4335fde331538bdd1098397c9ebcbc40bb2af68b276e6112173e491bce4b371c0092
-
Filesize
5.2MB
MD574aa819a19b54d74558580bc71369fd0
SHA1f84f07e327951c301f0bffb2394c7cba8a2b8b31
SHA2565301142ff71cc2847b46a0dba0d843543d3a1627574f6e237a16405a3d8a03e2
SHA5123745e1317c2f3efb5cbd38d232d13087bf20f49d838f5b37d2c4929f77edc0f7b2601053563b1c784e1eb823a7407b35a01f9d51fee02fdf038149ca3f814d4a
-
Filesize
5.2MB
MD5d464224ae0702058c5cf6b5715adc0a0
SHA148f989be7487022a3aa925287596b78b13505fac
SHA25693d2eaf29e8f268c6f59aabcb4eba9ff12baba7873a82005ae4f0eb4dd4cf6aa
SHA512ed5ed43e0c3bf590923df2ea363feb65b4ac1074a021abcbb26f4cf4c2a18bbe1f85c5b22a381cdb8b3afcc4fda9bccc68d81645114b407310208b46a48ba932
-
Filesize
5.2MB
MD59f5c91d7c19cb277837b93dc21d5b3c2
SHA1cbcd63b817758dd6d2b2ef57acaf2f4bdceee80a
SHA256e635f7a49d07dd0a955f929ae4a4acaadc64515d42d185a4c6b170fb1d2742ae
SHA5120f84dbc60e72c3063f1ea0cd2a15b0070a185af081c4058b7a652424c4344d5a5753aa6c2af88d4e5496b64eda1c39a9e718c74368add06c38876f6ee7be6320
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB