Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-11-2024 02:24
General
-
Target
2024-11-18_f1385ec367f9bdae15a47ff6261fbe00_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f1385ec367f9bdae15a47ff6261fbe00
-
SHA1
d84a6707aae4a5708d9790d6594a53fa13b0596b
-
SHA256
cd7bcaaa615625f009c81d5ab4a4814ed266fb2caa149481a938c00dc9eab00d
-
SHA512
4d176038b3130afbabe3823b0e324654a56a886c8c3e10ddadd34cb3db2cd24761422b3d33d08d00ff0ba2296fb9f9bf2ea0d82da6ac600bb52e2010e8dab2a9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUR
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_f1385ec367f9bdae15a47ff6261fbe00_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_f1385ec367f9bdae15a47ff6261fbe00_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\PxeUIEx.exeC:\Windows\System\PxeUIEx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xayPQOR.exeC:\Windows\System\xayPQOR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CySTfRc.exeC:\Windows\System\CySTfRc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XTckojW.exeC:\Windows\System\XTckojW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pOCDiJZ.exeC:\Windows\System\pOCDiJZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TNJWtBJ.exeC:\Windows\System\TNJWtBJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KehSfpU.exeC:\Windows\System\KehSfpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWDwlsi.exeC:\Windows\System\DWDwlsi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIaRljg.exeC:\Windows\System\wIaRljg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zYuqmHI.exeC:\Windows\System\zYuqmHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIDTACS.exeC:\Windows\System\xIDTACS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zvMZuzo.exeC:\Windows\System\zvMZuzo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ukZGttd.exeC:\Windows\System\ukZGttd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AMUFAHK.exeC:\Windows\System\AMUFAHK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rPLvpcx.exeC:\Windows\System\rPLvpcx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LIOZKYw.exeC:\Windows\System\LIOZKYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NQkmaKc.exeC:\Windows\System\NQkmaKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SUbHqYu.exeC:\Windows\System\SUbHqYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UTzzYQn.exeC:\Windows\System\UTzzYQn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZROJpl.exeC:\Windows\System\fZROJpl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RicfhBE.exeC:\Windows\System\RicfhBE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5826349ef4bf9c37fc8a1bf0a77818379
SHA19db0208abc77cc5463e912a7023d41d91d78f12c
SHA2568147e5fa0481364b272d536011b69eff493d466c78fcd6a00045ec6c975de1d1
SHA512bc967658dffd18e9584dfa2b537b384182e12abd80a970e976eebbca2908deb4a22eacae734ecdfce14fb9f45b82a5779774dd8088045ddc497cb54d5f8a4fb6
-
Filesize
5.2MB
MD5b2a492a6952cff1c827e5515a8e78b9c
SHA111165d0cafced12b41c9e2d4d4a3090490ef5161
SHA2567aeae66a29dbe0da67c69dbfcfeb0c33df471f938a93575bf292ae9e370d92ea
SHA512592d4cdfd54f6312827fd34a3ecc459553bb86b1d5a6234daebdbbe466535f49cb02ba5b49314939b9f6327f4e911f24638ebbdbeea1c25fecea91fd68df4b7b
-
Filesize
5.2MB
MD5d7f87730cc28e1ca8e22160284962926
SHA154aac9f1f28dc50043ba9bd22fb29620481d43fb
SHA2562b2973e2fad868de82b1ba6dd9a1d892462e3749da76e57d628e1b534bdc1bec
SHA51221bf192bfe41928b1082cfb52ea85c4b94ce91a6a57706483f3f77b64d43200db9fff4741ca3cea1bc2ab100dce626f01f592042904e20e5a034c19fc0044711
-
Filesize
5.2MB
MD5cf3cb68a9f93691822508a1725ba687e
SHA18b30630817e9ef8d77a749c93d10c3b34ab222b0
SHA2567293ee137fed965e385d6b995989ce832cddd3ee9ac0274bd0e45b08325a558f
SHA51243c1b1d56b6a95b5700d7fd4d27675c8f5745fa9a15c6ef88712e9b453da252eb8f98e1af9648a66ed7ced4d79c427fac25939ee96f3531b2c5f288ac9896832
-
Filesize
5.2MB
MD5bf8211943d6675a251e36612ae2f6722
SHA1b9634c1b4d5181d09df196e0adcafd0b1a348d66
SHA25633362e7335b8898c50985c3306fe408cfe6221edcbf600bf71a6a17f2ae256de
SHA512f5b332e73a99bb48beec46d5ad05a57cc836b379e125a5325fb76a41853effcdf50825efef5dcd399730aaa40d96786d79f97d519d6fab825073d0ee7542323d
-
Filesize
5.2MB
MD521e122f59c57ff059b818601f4b6987b
SHA11fabb9beee24eeb2357f457a9d2c9ef994861d41
SHA256b9d68fb52509b627ac33e432fcf3a8d9c6b6d5732132c39c64bc9fb099f0c868
SHA51231606cd162d4f4075805d2f4bfa53dd9c495380cb56ac0cb5f5bfb489447936bfe98be030062337f769641e8f376de6f911ea5089ab18fa439819ab533581bf7
-
Filesize
5.2MB
MD5be60463ee80fc3b52c2ce0774f00aa25
SHA1378e46d812f2e878183a202f70e2831b76ef8046
SHA256a25e5b02054c48e12050006004511441a9497f5a4e5f672ca49c7d260d964e3c
SHA512155006d82ccd6f5e8040af1619464556cd75d6c9b66739407509164de85f26497377443f8aedb54a10a5ef6af594d85700602faecbfff7e7bf5680d828de699b
-
Filesize
5.2MB
MD508d8b96a5a9a1828061ebf92419cd35a
SHA1f9e721a3a1d349b6ce7ae3803c53aedec7fc8533
SHA2563ef808efe30c226ee8963925a7050d84e895cf01d244049e6fa3fdd61d20afd2
SHA51249a716dbbdad97dcb864997c88a27c2e416ff90295ebac8069285d43a1c2817e77e7763f48883593a3198d4530bb1b1ecb724c01212ce5ff140473e2501297f4
-
Filesize
5.2MB
MD5e331e3780cba3918f592511de81ffeab
SHA167d54ec840be735ed37cbb1b66cc1fb7939efda8
SHA25638cff9dcb00e79f9f09c5514227e9ed4a8fe04f31f66c8035abfbed334211fca
SHA5127e38c109b3d4f3507cfbdb8327fa31e13663e79d7fd98bbd20958c475fc5eed3b8845413eba3f6a8f85e082f9f49bb47150f3723882f55fde6bb8c3e2b0cb3bd
-
Filesize
5.2MB
MD5ccf3f58e351e588c2df3c7af8d12b10d
SHA1dab0cc6660d3a3d798c08cf623393249db5e24aa
SHA25616eaf27109d89f834c2fdb34eb733b58bc56c846c1c353363204a9dbc89f68cb
SHA51260f879482fb46d70d877fc61b5e861da5a068d12b430056256c810b9ef49f03f84aca3761f92c5bea0275ae994701fa0c0efeef297417527fd73cd0318b63c9a
-
Filesize
5.2MB
MD5101326476684b78e01bf4d625a6f04a3
SHA138cff17bcaf558408da53e05825649869fb8337d
SHA256352b87700d76cfd60befcecb31307a48d008c26d98b47ace4eee6e1edee3ef73
SHA512101ea50f1b8ccfa649b4312d537a80d48884da5454ca0f03cf3f69cc1b45690d911df6eda7a7adbf4433134a245ede74b4fc7d4a33eea34eb9edbf9444c3b81b
-
Filesize
5.2MB
MD5b924cc7a8c4b331da589073d72d4782f
SHA1a07529b2ac310b666e852b3d0153254861bfb0dc
SHA256a5399113d193986e7915c4c33c5b98df8806fe88d998a792d9d04863d04a7812
SHA5121cb8e09607bc3dda7ee54ef93a9e8f472665d7b460d51a769f79502ed5f2105bc9feeaaaa5532c8c818e9f40a21e6542df7345b5a0c215ae0205bee9686116b3
-
Filesize
5.2MB
MD553c1ea902d88144f7334f3ce45693fe9
SHA1293bbc5c129f31c9bb1b5cef4f569a2013f31b59
SHA256ad82ec549a8906c549b8451a0b9a23587d7cbe3a8fb8c4c8abfd749606a753f7
SHA512e4fb11fd131655f4be85356259970c34fb1419d64d1842eea7c521c1ec822fcc34ae27f0a9fe4b65aaf7fb3975b105d20bdf5a516a74224f297f3a626d36b908
-
Filesize
5.2MB
MD5d5e6ca94608d7de86c30e15504c139db
SHA145370b6dc650917d079ea9ba63a26eae8ebc5391
SHA256fd83bd1a23303df48dd246b255775cef8fa1ae711f80ef7638895018ff612d28
SHA51297d329e171a84faf78d48b0ac364adf0c1d4597e3475945f116090338525e64ce59d8b88de017a38ac999f8f69d0832476067b0ee4c4002a9f1cb5e0cbabe780
-
Filesize
5.2MB
MD5d6115888a381d6d72f336eb85ee02c9d
SHA1593304eee3328518bd2dd4840ac2f7158bffaf39
SHA256403b1a604860a2ebd97374fb695958b84ff8ac772cacf484ec8ad4b36aa1d3cd
SHA5125e9d33d78d6e85b67cec2160e1a3c738a0b3531d84b6118a4418226c9971d41dd44d8e6932b1dd1d8e1ebbba5e50193e2c6634240abdc56427da032d704109e9
-
Filesize
5.2MB
MD585111fe8e2e0cfcddec964c97797d2c3
SHA10cb31dedca93f1a608005e1371d26a2e9f015859
SHA256b3943702ef623a35fb2efe1742d5e628b2c1010548e4ce31812dc46ce33e242f
SHA512fdd9015e6debad638928be313e2e475b02b3b873bc458cba947b5db8f32921a03f49a508b258d4a6bee38065860adf5f6cf552c5b370f7e1efe0722f18034084
-
Filesize
5.2MB
MD5fa3889ef84f6aa0804ac19baa1cbd1b6
SHA13ea5cfcb10ac31692b9ade2d0c712b98f4105172
SHA25605e86713b5eb4236ea92e170c6474f49555e88f4963474a94d67d2f3543e972e
SHA512708202fa6aa63a9bf08f9e367f1c4bb7eddef9583fdd6476154a743eb2bfdc18ed04616089365d5d30d6a0052fca7c7b1dd704c1c17ab2aa73693eeabe181e85
-
Filesize
5.2MB
MD5844a6068cc17df7964c110b85c858919
SHA1a06db72c537077f452f074746016928322cf9eb3
SHA25646e1c067cf68be31ff9f0e1362ff49b7ba3f6ba9a1b96a60871924508b7e4f9c
SHA512c39a292c8319978377948e78bf4c4d3b153b0a8f4ce895c0302d615dc5f37c03a6c1f9e6c3693a6f52f3879c44a0a5f65956e66e015693849a9ea5983571a05e
-
Filesize
5.2MB
MD55030827c6c5f3a9e49026536964761be
SHA1957a0c968cef626621207891b9e5447b2803ef48
SHA2569debfd1c6bc83c03d2a02f72099d15028464894c0179a23cf9151454fcbd1bd4
SHA5126fa4baa7c86d125041f26b5cab1c638aac0b7c96fb0843b663ce4b01ad4a991b8d3e0d1b142622d4961022e549dbee4228cb460c7a3c1ca54229ca75c679ddbc
-
Filesize
5.2MB
MD5fa113710e90d78e43567cb5b9ae85f32
SHA1c577315b2b5a35bce9d403ed670122f224e80217
SHA256df75058189346836108f7116131f0d5f611b5fab149f36d5900718fda0c671a7
SHA512fa696bde577dd6b36ec765012fa8d781b94057954ff2fbac9806e9ab6b069d50181ebf442ab3869f091a9bfd1740fd5a4f1662b6fda79f5731e6c7816543a5d5
-
Filesize
5.2MB
MD57e603bbe44815cc0c9114746633981fe
SHA13555e10f26a0224b033fb523538d7b9a425e2a8b
SHA2561ef584ad68c1705331e8d7b847f1e9531091b1ed6e4202d6dd35b11fa0c07948
SHA512b707b30ba29826934566c584a346baf0df53a3a81a9f84fe1eec799426fcff186a351abbd4aa6efadc3bb343f5d6d7694ab60e97307e4eb2a32e09bd706cf640
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB