Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-11-2024 07:43
General
-
Target
2024-11-18_7a52c26e02c8afe47dbc7fabaee8bdc8_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7a52c26e02c8afe47dbc7fabaee8bdc8
-
SHA1
77cb7c4524e8b9f9153c2eb999715e99fbb976e9
-
SHA256
4c4776dee5ffc86a5b19db43a7ccaac8254a599e1e4eb5796d481c69f2e379df
-
SHA512
075d95962153daf08318a9d197e98295a02705d180a6635055975fc5e483f9a6d5afca41e6d07e6fb6d5c5e3f221a6766cc5bc716f4182bfad1678b24dce4640
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_7a52c26e02c8afe47dbc7fabaee8bdc8_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_7a52c26e02c8afe47dbc7fabaee8bdc8_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ShjmrqH.exeC:\Windows\System\ShjmrqH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xaEPntX.exeC:\Windows\System\xaEPntX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMlYwgX.exeC:\Windows\System\DMlYwgX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebhoCEG.exeC:\Windows\System\ebhoCEG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sbhyvbf.exeC:\Windows\System\sbhyvbf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zZYFwQL.exeC:\Windows\System\zZYFwQL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YjbStMe.exeC:\Windows\System\YjbStMe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SkmsSdm.exeC:\Windows\System\SkmsSdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lCIoXpk.exeC:\Windows\System\lCIoXpk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHATdhj.exeC:\Windows\System\hHATdhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aRFwDni.exeC:\Windows\System\aRFwDni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKxjERc.exeC:\Windows\System\sKxjERc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fVjUSmC.exeC:\Windows\System\fVjUSmC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rHBELmq.exeC:\Windows\System\rHBELmq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RVIAisO.exeC:\Windows\System\RVIAisO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsBzDII.exeC:\Windows\System\hsBzDII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Gukrwar.exeC:\Windows\System\Gukrwar.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FVeyCLq.exeC:\Windows\System\FVeyCLq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nwEgiuW.exeC:\Windows\System\nwEgiuW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgxElOi.exeC:\Windows\System\MgxElOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XKjcAuR.exeC:\Windows\System\XKjcAuR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57c4878b1a291d4813c155c2cbfd32567
SHA1e11248ef418910e1121cfae9c023cfd2974964bc
SHA2569248666a83ef206d55f9b1c2361893f31f34ded316188e81d1e253c046a64bc4
SHA51270e4e120cbd66a7ea6f7f1c3b495d38146697ecb29e539ffc986d6b38de75ded12b47e47e2a067d5271636114360745dfdf0ba0febb407e5fe9715c44860c612
-
Filesize
5.2MB
MD57116eda68a6b1f01e9ca1589add07590
SHA1767bcd9fc823a68b5105f6b0a42214e22f71e644
SHA25620dc485ab8bafa3e3c2b963ebe6aa361e0c2013f2dd743858bc50807db8fcd7f
SHA512e61dcba472d18d9200988203327a6769b20ad2064241e22763f1407a594017281f350df951054f23360bbac916e1892b78aea46c91beb6436c08a251813ae9aa
-
Filesize
5.2MB
MD5253d4a5be817a04d8fa5299dc685e664
SHA119ffc9de15561a1b99fe95a274ad277634eeb2ff
SHA25625dffe0d1d799b5fec78d6ba222acc546a32d22c6027c833c2e9a7ba9be302de
SHA512b90f110a83bfc01c29e7eefbd81b86ba20402478afcc1cc3855bd091aa0decefe3a4a0b88baf82b16639fdf57df90013360a3f79416cf361f5112ca36f2d7a23
-
Filesize
5.2MB
MD5eba87ff8ec557237acffa593accbf91f
SHA132a55c9765a7ae14e7ccba7947a9c50357ed0911
SHA256235c4befe682ce33d838618a34d4c5d563d27b47deb61cfc2f6b517a7ba43157
SHA512f49d4caabf42889ba80083ea7b620645305457ded5ec001600453b1233b69ba23c0ede8e9f80c2c83fe39d6efb951ccd6deaaa5d43366fd0a1dfd31e05c21163
-
Filesize
5.2MB
MD5ddde4d642b113961b6a10fa07430a70b
SHA1e733a8e84d05d6512096a7ecdbab077674245263
SHA256cf0905a7003bd0445bea1fda10b95b6330374a7cecb76b19e9ae4f3051c20a87
SHA512c443444218c03eb8110aa9ef2c58526375756476edc53e884ac62c5f881ca2c6f0fb45f11b93e17526fd97503d4e19e9090148b12d2b324656624167a9068ae6
-
Filesize
5.2MB
MD5c88e956569b19ad79b1e637b55822c45
SHA1d7723ae7c212073fa729da4dea3e294c36ca207d
SHA25652886c67e2179381601e850bfc43dde57f0d7e1a23c2464989e08ec658ade45b
SHA512b9ab602833ba16959c0b8b83dfc32b4bbffa8bc77d6ca453915fbbf6e05fae1fbf5c6b09e087325412097b102f00f9d42722456fb870d6ca621a18053ce58639
-
Filesize
5.2MB
MD5e4b7e590ed3a3eee12062c3e6d43307d
SHA188c36e5277163395c8fbb8e7879e19ab94bae75b
SHA256e4c506da4fd77bbaa8ab43f35d88c7a6e1381df5d31592f222f2c507c8b917d6
SHA5125b315cd14447946a537f49edddd5f2c886eb9adb4d0d6404949d1744668dcff6bdf83118bb28e9d34c4014952d4ac3f7ac8fc390de09200f104fe762460f0b35
-
Filesize
5.2MB
MD55960652c8782edb01e833c36e520f20d
SHA1e871a94e3188382cee7ebdf4b4d0c01087ad3676
SHA2563ca1837de57585cba638906b3f574ab4a718179e5d18379979313ae5f8044b07
SHA512d1363668a2086e7b9d6266d32c7e43df436ecd0eabdb5b5439d9432650906c4cdcfe89499f529845ceb6c379e027190af3d7031aa9e27979e177ee5e19f8c096
-
Filesize
5.2MB
MD54d9c0163aa7d3abf45676c654dd20706
SHA19f59f5ccd9eb418147df67b550fdf6a289c230c3
SHA256eb0c168af73e102fb325a9e00253bff055810896381ba2e2850447c1c3c161d1
SHA5127768578c87e0f8b76a6d8aac0fb3b4901bf279e0b0a353341eb90093a19ea450b451baef4fdc0721e5a9976681597d1c667e838127606682f1d9698c998d13bc
-
Filesize
5.2MB
MD5964386b5e6fdbcc52320fc5dc880d9b9
SHA1e12ddfdbf97de18223ac48661a29f1840a37506f
SHA256ada3cf8ef202107b302bba9b3568c52b77757c37348fa5a60d15e3b21ac3c64b
SHA512957d03c525fc9cf1404cd6a11037beefceef3ba278fc984bd25d6b53499a35605e7fbc129ee0c47233c401c6bf0e45ae7c4bf9e264b3d1aaa8154c4892000323
-
Filesize
5.2MB
MD5759630f508aa0ef31d8373263f396db2
SHA180c0b9a302682b4bb6509ad28d34852140eadf83
SHA256e6acb567cc554b3c35e669a1a9ef5a143c60e4647d2038f5188b212e2499a8e1
SHA512c1ac208f0e0afcaf7aefcc936e3440ad6738c19213f37414cf397093f529e4fb78e9a81d581dd3622920874f0bf35cb7fefa175cba6d4a073d6b16e37538f9b5
-
Filesize
5.2MB
MD51cf4599fcf630f753d3012a5ae5b4d7d
SHA1180eeabaa9a78bb0febcb5589e023a4167f610c3
SHA25637a515bad98c170e3a6eaf6c09209912b786de0ce9db4f9ffd159ed972b52654
SHA5120b2613356ac935c5ecc5247c3c9ecdede5771e2e571e944b70b8fd13c5c0bdceb5ccb944876da3184b47cab1ab750177f067292cf9898bea70b8e00fc9007022
-
Filesize
5.2MB
MD5539423434a40cc784300c888f2884a99
SHA182e279290586d76034668e0fd39758c85919efad
SHA25683fc1373207bc6c80e365ffcb1cb0320250207900b81bd62f45efa8ca78e10c8
SHA512ba1bd3537f27dbbb45c1e932b36edfda96630b0e2c1eb06b2b75998d87fa8ca7c3e29139643710d69aa5ad1acd06b5d0d0dd5844e31e5f4aa00af7415d7e7690
-
Filesize
5.2MB
MD58496328e0b941f04b4f1d6e1f17775c1
SHA147c8660d55912f7f72f0a09353e02a9f8f8fe091
SHA2562865c186470a8f37b3c7dfd51c99fdb1bf5ab5dc95de06b196bd5176d565e30f
SHA5123d3c492713f5d4c7c4b82bc1989c9f4b96d0901a64d4a825f702defbd93693e4229ecbfe2754dbc681056b28b0b30063e376e11f9d46a9ed42d954fe2970a4c4
-
Filesize
5.2MB
MD50f1d9f2819eeb53d16146334acaffc4d
SHA157cd483ee55267fb6e04b95d0ce352f0feb38b62
SHA256c8958843df6f06f371ea085058bbe7cab86a470917924cb652c2ddb4d39aa46f
SHA512951a0bf9d583baf698a5d863f349cad6bd83bb66d42324d486426d408eb2b95cb6601539de5340c030ebc4b70aafc6e63b5a051799b3616cc9187d6f4cf0a467
-
Filesize
5.2MB
MD53c65d3a4d354139551c55f20f2e48d0c
SHA1e31593512604008896c4d9793112a49e0283460a
SHA25653fe37e06c84aefb9b25b366d509dfb1f5aa20f42165cded80c8b4dc3ac92c10
SHA5122bf561a483fc0c3f397dbebbe4283089d37c6e338105522b80542be76ec580c1eccfdacc29b32fa5e6938fd9f0acb85b1a3f655e93bf80b296d9f8997554f7f7
-
Filesize
5.2MB
MD5c834060472d2a106b7f9a8854b04f024
SHA179cf9970fbce37783c4e78e3d0f09a9e39d370c4
SHA256007b25ede7a8955517b79d3b05fafcfa38ec9ae0ef8ca322a71e3c0f9d8a3a87
SHA512050238947c6302c19aea78d2121f396ffd46ac4446e5aa73f248f515ef07a2a928f10305bac7495c501241df399d1228db9249a8ad4b2f86ef693fa6bdcd7db7
-
Filesize
5.2MB
MD53e14089aa38dcb9eafedb2443a107505
SHA11f59177d7ab2207cd8d844f0c77adf8ce75212ad
SHA2565d03f2cc74092f0e6352516086db74e5471c881773c8cbb848db988fb51bad68
SHA512aa2af400176ae93fe56656d1f232effd7f1f8516d82480a6ca2e5879e205fec271540ba6fc73ab9048e12b8314d00b1bcf91c095b051c1a26c319d5d20de797b
-
Filesize
5.2MB
MD5e10df80cff4146cadbf1ab74a89bc7fd
SHA1a3cd06cdd02d7f6914cabaa96bf76f3ce4724b8a
SHA256988f8739a13d8fc808721216ef1978d5e6e767784c3cf7bd8e32b4ebd1e1ec83
SHA512bf52e001184fc99f94a63766088356849948bad2f48cd30bb25ccdbd18baceaadd573c6617ab50401b9e0cc43092a1e871a33cbf7777520f5ebbd5b74714c8a4
-
Filesize
5.2MB
MD5819a52cb9d7ae5d0b7c42fdd8f39a747
SHA10455bf8dd66e0b9e63644cbe8c57bda651c3a1f4
SHA2564b33e079e5c91fa5d90583724841909873675bea3c8a9e76a97586dfbc451f65
SHA51221c7bb705e6c73ef65a167aa96426bf0c1325ad2ed511752e7cfb04f32acdac2414c8b9045bcf90e69565e9ce2a0966541702cbfc8088933d56671cdff81b18b
-
Filesize
5.2MB
MD52aba225849e6d74a78dabc22f9ced59c
SHA16e12fb9293d602cacc20a065c642cca841e214aa
SHA25618ad75f16d06eb6675831ab6205573b1eb9335310479e971d93c09a49e09e6c0
SHA512885173e8c08a2c0da95dc095a352bd5fd6eadad019a91ebd17e94bfd40c24dc669c33e5a30054cdffdd5f752e9feb62f55cdae3bb7b5b03c59580df108966c8d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB