Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-11-2024 02:21
General
-
Target
2024-11-18_cc38ebbee6682e5b777dd158fee2a025_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cc38ebbee6682e5b777dd158fee2a025
-
SHA1
db587a74ddee1a5cdd529981b9204f52fdaff6db
-
SHA256
0692623eb0720d597542c87722f0827c726e6591982966b68c3a2a5af2572287
-
SHA512
9573211670c962bc84cee5c8ad4307b41ab297472006ebbfb14d074273e209946780c952e9f82d1b125d361dcc6b838c24349e684701c0d315c31c172908c83a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_cc38ebbee6682e5b777dd158fee2a025_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_cc38ebbee6682e5b777dd158fee2a025_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZeHHyqu.exeC:\Windows\System\ZeHHyqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfPsIyw.exeC:\Windows\System\kfPsIyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBwnOGy.exeC:\Windows\System\OBwnOGy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mjxlBap.exeC:\Windows\System\mjxlBap.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpJhYKZ.exeC:\Windows\System\gpJhYKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gIpSkUs.exeC:\Windows\System\gIpSkUs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLsBdnJ.exeC:\Windows\System\bLsBdnJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sHcceKr.exeC:\Windows\System\sHcceKr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mATGsvV.exeC:\Windows\System\mATGsvV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yogxZyd.exeC:\Windows\System\yogxZyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nClebpy.exeC:\Windows\System\nClebpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RMkCZEX.exeC:\Windows\System\RMkCZEX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LSOjqLJ.exeC:\Windows\System\LSOjqLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nlDPPko.exeC:\Windows\System\nlDPPko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pEJzjXW.exeC:\Windows\System\pEJzjXW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QYRwLzH.exeC:\Windows\System\QYRwLzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FKiwvIe.exeC:\Windows\System\FKiwvIe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifSEkNe.exeC:\Windows\System\ifSEkNe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdHBuBM.exeC:\Windows\System\GdHBuBM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oFMcxzT.exeC:\Windows\System\oFMcxzT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LmrnMBB.exeC:\Windows\System\LmrnMBB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c4c8aa951a9192dd26c342e6280c6e87
SHA12e3264882381974d2d34ec50d9edf53f9b6b4ea8
SHA2561bf0d6ff726200c654f7aa261b935dadb781302805ab4c26df9891ff8d63eaa8
SHA5126d9b2ad4f8c0c6983981fa3e1046dd6687dc92fe537c6ab4242bf641ba7d36cd15c8357455e19b1072db905ebc7a2d8af21be7e3d5b70ac276f04b087d8e6342
-
Filesize
5.2MB
MD5353d4c25d72ca655a3522d5a7c88cece
SHA17d7f2b7eaa9fa4e8f46b61d28ff46fa2b3f600c1
SHA256d1a8e3a828d8ab533a1d263afb3bc1b3c728163d8d44afc9406f625d25577332
SHA51293544ef2acdbf4fe5e6e9e823d619f51256d0a5fe173f468257ce647336ad55d072d9312e97629f3dd75d362ebaa5a8d5eacaf5e6f719cb161c8564243da8416
-
Filesize
5.2MB
MD5de7d1edb8a9d6925cd8cedd6cb7a2e42
SHA125733c1537dde0e5ad4b79e3fa277dd4c659fcc1
SHA25635cc0306986a5c745da6063d688de67316befe1f23569240ed15f9da0ecbab58
SHA512a408e41a13f1b6d7c827f12541eda46810126f99eff719803f20f21f3aef2271417da83083e7f09ed3edca78cd0b42646ef4d562a4f22b317cc2c856cae74089
-
Filesize
5.2MB
MD5d4e176e82780d9b41b230b8282142e16
SHA1e3eee846ccfeca0497c63a5910895c416333a180
SHA256718de092156727c13018bb09e59bd468b23b011450c5d72ce3e387c2f76ae87a
SHA51226345486c7b1a1cae0ccd7d684994232a66653b57f3aa16234a48e2f7e25e33c740da905e4f3d54908bd908e4a10391c2ac043707aa04f7300f26a8031fd7881
-
Filesize
5.2MB
MD551b9f37960cfe7529ad82897890e0c89
SHA1e39ecd6a6fe915496e5927f50de24c2fa83b170e
SHA256500ad12fde2f34c8d2699ec5de1b772741d94cc960730c12d15a51e04ada1a90
SHA512b25c5de38fd4120c709006ac95d0e3d34be54538ae8e9a6dc714048c7bc211ab2ac1fc94a1bf5a664107e78b7bbba3a9d7a61f593957153519cb8b9b105397e2
-
Filesize
5.2MB
MD5ffdc57b6505a7f5f45410bf5c071c72e
SHA14a601b23215151fd7da0f57199360cb1d5bd79a2
SHA2566aca8184888a1b9aa45b362a4ffeae8323c22e6d348d55a0e3357047a48dd204
SHA51258839b304b802a07e7d8ad83eb4afa48b158286e6f3f6727ac0fa63b086988da53139de132fce7eeda298dd2ee17e33f4652ce99f765297c30749e051eeb6221
-
Filesize
5.2MB
MD59dd3a98173118414cbab5727089cd35d
SHA139b5620b4514fb954379e120497ecdf1b19c28f3
SHA256f8da2d8772e7653c6fe663eb01a95dffc6a2f02ef711ba1476c28de4f4398c70
SHA512572a6e0b64d4c7a2e6ab425355d0cc434d71e91db7ef4f3f87a755dbfea10dbe78b1441f756357b12603be0d844f6c73e0c245044bfad1b8eb2bbc41fc9291d7
-
Filesize
5.2MB
MD59ef7174530738730b2fc3763c12dd5e5
SHA11d04ef79567bc65badfbbab40be0a2563408e4cd
SHA2564871c03db597568b5e101351d5131e02975e0d073b8beed6a55b75d2bd9a8359
SHA512bd13e7ea649122a35d9a7d6d7a6b2ef4bffa79f269357bac4cf3fc84a81e4d534b60539325a0583d79cfa0edcffabcddb24e77ef7ec60a085ae9a2cde29f5b00
-
Filesize
5.2MB
MD56504d321b11f7faecf57c35375e9a0ca
SHA1a842395f8a48ec0d7e91391574591f43dd3912c0
SHA25669d7a85312d24e2a0354f197a888b060d368ff504d1cdc5e64e2238083ec5549
SHA51243196312e3c44511c3d84223c0acc5b5d57e4ea17388c7d697370016628549e70f508c54d1fb151f167f6df225147b066ecd55fa198701dcd28152a3c99ef496
-
Filesize
5.2MB
MD5c18cbccb9a51b048e79a9d1c534063d5
SHA13745417f0ef39229f92b4a1a88f84b4c4b2e6783
SHA256c31af49c7aa0d6571daa35aa4a123da52163361f70433f3bd41f1c5742acfc7c
SHA512805c6006e792218be08aeb53ca12f599a814f217aa755a0976de432f05d3ee4dd4416238cb37842f07c0525e00e3996fc2850cee900eb3ea77e86770d5c4b3e9
-
Filesize
5.2MB
MD5c401e6664d2f185224e761db66c7bb6b
SHA1c89b335f55cb688760fdf613b7ba6e4df8f77fe1
SHA2568e0a685acf9540247b0af6bb07646503021e716aa394ad6a16779a54b1420b4c
SHA5125fb9abe9d0451f726a77e73d2914548f29516b0ade6323c9d188cb76973b8a9602f33f43552e1917db9ba5d99f95e8de98d25552fddf33b1690213536d48879f
-
Filesize
5.2MB
MD54612fa8e47f74bd2a01d7dddd8ce30ae
SHA16ddc999d29aaccb4833a29ad882f0413e03ae07b
SHA256fe515a085b283ce9c56fc86ea06e5ac59425422a2e8039dbf4c9c51f49db2b1c
SHA512c172a869ead8cc0413fe5acdf3ee047e12c36391bfe0164fd17c7b5a0d11fd12b1829150dae730f2e82b4a027d9281d3a90034e70b3dc216abed91428e404a09
-
Filesize
5.2MB
MD58f9423125330a10793060f9ff0d5be52
SHA1ddcdb6e6491eba7614c81c82e6cbf014e94068b5
SHA256fa12f9ec2d4950f54741921d84becaab1472d6882c25084f4ca45bf2a344dcf3
SHA5121998e9cf7a6c1edba7bbf61eb59fec42ec434840f93fe159dac95d696284ad7d78c24a80095e73921dbc61a8e3e50f22bac2f4552f9b5cf893ddeaedb5d41395
-
Filesize
5.2MB
MD503213f456e007f2dd4a01e5c669127f5
SHA1999bf8b6cb343dc571f97eee09ab07b248f962c7
SHA256e1b9d482d60d22daa067e0eec872b9efdc1b5322ec24f3049ec63a09949c33d2
SHA51217619f02fb8c4f961f5a0cac02c479845d400eac0a58203d559bed6a3507692236c61a5dfcecf46999bc252fc8940c1a6febccf5844f610c71193c37f9ae72b5
-
Filesize
5.2MB
MD57a1136e0d8a03a22dced478b65d5391e
SHA15350911fb4bda1a804050be89d28581f251a6153
SHA2563794d1901b21362c69528967c622ac9647ca69680559a23239b4509400eff090
SHA512983286b3970de763fa8d454f31a6e063d91468e547935d6475f1efc1f56e595c1178f25bb4d021271320b66791787adcab5f2cd3e81a153ca35a244863b96bae
-
Filesize
5.2MB
MD5da24e5bb349ac1eee68ac3e47f1d2f39
SHA19ac717b7cff6e611cf3a1a62f47c8aee37fd8715
SHA2569fd9a1442aebe315c9687fb2a16e9c4bb9b00557730d40cb1d6f74b6283e8680
SHA5129f6627944ff14079c0451ca4ba9f86994f4b7b0842ac6a509a887e852ab253b6f62c368ed71513cd46ae4081afdd99781300cd4d20dddf8d7c169e4983c476ee
-
Filesize
5.2MB
MD522742878e7e20b3d447f3199530bddad
SHA10bc6814e34130bbeac7ae6809e2d7f57c8d4432e
SHA256912fcf1e08214018e62ef91f83e430d0ea94bbe34241cb73eb0475226943d833
SHA5129f03a3957234b3c98abb73a80224b23c4b01cbefde84626122f1d915d45e79f96ab270c6ea11cfc62981c34295d796cad654c664b8a8a6ca9b40f2f9bab60ed7
-
Filesize
5.2MB
MD56d22e1bd2d4a8f7a67724f6499407731
SHA16ee8001ba82c0da7cf47e88244b01ca8218426f1
SHA25657409de7fa90cf9562c4ef3e264b0c37924b72690dab14b65a558be027b5249c
SHA5125ae049c4076284d2e94fa18971b50d50f787e3e9b95dd3485667cbe33e3efbc817ee5c614540193bcffc14eacb30182d045273970ca77c312471aa7d663f8a2d
-
Filesize
5.2MB
MD5b52cf0cf23341777f683421f90a8e502
SHA1b4b0f4f879e01786beb1528dd9a40caccbaca30a
SHA2562832605f6628d41d1dbcdcae2e10a1bce27ec05bb7e99005fc5127b591d42e05
SHA5122bd3f5370a90130a27bdb348fe5639cb98cfc1442859e9138d9642ddbb1f8556ba5a3ebcf3154c05f109605f2ad0ff77d866d59b91121db708ba16fd0678e975
-
Filesize
5.2MB
MD57351a572a180951893baefd9b7e5c3c5
SHA1fe9d852e5f4868c995c7bfbd21ff03af732dbdfd
SHA25637a5b2726e4c63c0093c18dbd70b9d5bd4b02724d52ff98fad26c286b3cdd48f
SHA5121564d840dd023b1d71bbd182c082fb63d6ed58d8221a01150f6b982df7c3fdf2aecb7a1538beda1bcb4120ba619b208bc92bb5b1eca7adc1d5bf1e7f1428f887
-
Filesize
5.2MB
MD547edd2466a38196798f76c4a520cd76e
SHA1e898d9328e4aaf9f8570e0d6d6bb7cb0384bcc5b
SHA2561d5cb2b749dbc4af83c55e09ae6d7bdf57a9198323c43965ff1852ed398d3516
SHA512a004a0eaca6a65b1c9d512614fb416d554f75f6f41c35cb66e499cfa701452b23c1cd9c74282dbb2c41e82eb6d3ebe9342bdfd6d338ca21b61911f91500a832a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB