Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-11-2024 01:34
General
-
Target
2024-11-19_3db0c15dafd6a009dd6f63278c55c12b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
3db0c15dafd6a009dd6f63278c55c12b
-
SHA1
630b74e582002c44e841b70583c041da103cf72b
-
SHA256
e71d3730c8c2386dd5e780ac7de4c717327d945a168d8e950964342ebe2b9ef2
-
SHA512
ba081e27e3e9edf8fbcf3aceee9094ea0721d7f438700ad46190742fcf16c5de634417c56df96dc347696edd3a9256b3a3c4151bf351c260156dd4eac369dbd4
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 52 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_3db0c15dafd6a009dd6f63278c55c12b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_3db0c15dafd6a009dd6f63278c55c12b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CsSuUOk.exeC:\Windows\System\CsSuUOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLJEpnc.exeC:\Windows\System\bLJEpnc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jRBKjHG.exeC:\Windows\System\jRBKjHG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRdpBMt.exeC:\Windows\System\nRdpBMt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbWpEvY.exeC:\Windows\System\dbWpEvY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FIstZBP.exeC:\Windows\System\FIstZBP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EoKlWQs.exeC:\Windows\System\EoKlWQs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PcNlPDQ.exeC:\Windows\System\PcNlPDQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CskonWz.exeC:\Windows\System\CskonWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\smKLvnb.exeC:\Windows\System\smKLvnb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AeLloMK.exeC:\Windows\System\AeLloMK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\coBcEcs.exeC:\Windows\System\coBcEcs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NYOyArL.exeC:\Windows\System\NYOyArL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUVmffT.exeC:\Windows\System\xUVmffT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RFfqNEc.exeC:\Windows\System\RFfqNEc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\scjvrMV.exeC:\Windows\System\scjvrMV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxIiSYY.exeC:\Windows\System\VxIiSYY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbMXHsl.exeC:\Windows\System\SbMXHsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LZAdnIT.exeC:\Windows\System\LZAdnIT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\leGvmqS.exeC:\Windows\System\leGvmqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkAJEKH.exeC:\Windows\System\dkAJEKH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD546e470bb2896b5d3ac5d9db1a568dd45
SHA1519ac01ab9c1870743dd48412257a5051a47196c
SHA2563ff7d0f238945fdba8275ec7718518617948398ab49c1868ee49764c90722d4f
SHA512710196a854a2c9aff43ad8b19a2fbe38501d88867a4532a8d88f61bf0c184ad0dbe926124de64af4adf9d3a119e29b03084cbbd8b11b3c88d7af446157d3db96
-
Filesize
5.9MB
MD5f0b4299a31e5bc2a68d684d0812f6ef0
SHA18e029063cbf89face5acc0525606b05979b0c89d
SHA256c1386f0228abf1c43886fb4a3df168a52a0214b7a3cbb4eeea5a4548f76e8737
SHA5123c696f2ea1ca368910d9245a260b0b1309aed6b771ede92734553696f7e97a4ccedfabe3849d2cb6541b626cb1c188ad6daa4d53d886c26b9327f48f1068d63f
-
Filesize
5.9MB
MD577a3ab8f7497c12db8ed53c20ffe5935
SHA1e6f6cecc14f806400765b2160c2bf2fc4f5cdbe8
SHA256f8fab8162abbf677e95d0af413bcb9f911a0c1cd1a988903ae634475b694b2b1
SHA5127d9bea8d5b59f69bd3e44f9057a5d4173b7c57b6e1ba7856a7bb5b4e49216a168f813bc59180179b0bc89394330e4a9ae0cbe1937480c1d481992b76c67cf493
-
Filesize
5.9MB
MD5b022c5e14e6fb63f4d4f00d64d7b0980
SHA1f341eb317f83b8e31455137044af7fa948c09919
SHA256ee52e39351caf5a2e18f705a0c993d42f7cc8fd39acf81ffaea401768717cbca
SHA5126966c90783e465b74aeea66d09045933506a7288ea23f272e0e89d0f0679fbaa20fb6d861da5c0dacbb7e0b3185689a25b3098fd5f495d34dfeee75168de7037
-
Filesize
5.9MB
MD50450493d3d8a9b93bc87c2aadd907efb
SHA1e203adfb9c6891018fe103428ff77c20ca93f835
SHA256eeac46a134a4f285469d910d077cb3fd86a1e5979d9de6cd9fbeb8dec471524b
SHA5121dece97b7dff4d2575fdc8eeb3ba1c1ac2602a0c2eab48c97d93a3a6ce794bfa19e970a286db2d439d29c943c102addfb7bd45fcc9ce7b2643587766085892f5
-
Filesize
5.9MB
MD5e5616255d5dadca9e0cbc61bd359054f
SHA149425e3a7769543ef355d0f8dd915fb04ff62042
SHA2566ad6572cc84e5f7af02ffa29bdb212ff5e663bb9febdde922a74da4eee9de4a4
SHA512db1d3fcaf630aa128331b83826856d319bc15dad27cdced9bbfc9833d5824830daa6df7279778d6a400f928628f9a7efa08381c6466d398037a6b96fd695d6a5
-
Filesize
5.9MB
MD540432ea6a5208c29a5b945d312354b0c
SHA19d58698ff6604467d19a75d74bee352cd888e186
SHA25613ef098ef58e3e7f0195a85988fdfa3798c7966a9e4afc7597ba939627ce0f17
SHA51288a93b4585d22d7f8055acf9aad289f329ad6a7834b81211366183e682273e66ba68c40b1acb8a61e5b084d781b374f79b2e712d8be01ade24af85abc9c10963
-
Filesize
5.9MB
MD58d5d807076fdbcee8301754c6250266d
SHA1df8f47d8cd28ee4997e3bbad49791c972a3b3933
SHA2569cfc71ec7b928965db41fb8a64c0895bdf62a9b31c732632f1161701fad1aaa5
SHA5126511a8c66df5a9471fc629e7952698b82a8a8a1f82c0feadc9146f9b2cd490aded48e7f2ed67d29f04243ab3a522e1cb79f91fb93c0ca78407962adc14241fee
-
Filesize
5.9MB
MD554b92e4afb3af52c2891583438c73791
SHA18e22c5f5021100ddce4c4e4a2057481e94cce90d
SHA256c95527fe3ac8fe9a9ef31e322b867bfdbf5ef3bb6b096e4b24c0316dfd899cfd
SHA512f9843dc8296bd6dbfedd45bb028eb3483a9d51fccd0fa2c37c9675dc5bf2fd785b201cbca60170e15cb1a3bc63f64efcb191912636d0812173840b7c816796ff
-
Filesize
5.9MB
MD5d1dbbfafba21ad0113f6743f99b62b15
SHA1284f90abf1ae98fe9306bb7464ccbd1ec8726451
SHA256d71eacf0e3a55ddbad69a9fd4b2114b05cb093a4d623df97a6e983e9a56e7e5f
SHA512d3ee40c2df96a6c33b8f03a50563bdc52770ecbf10a014eec63b75ee204d3dcfa5b3aaaf52e0fcc0e065732878000e8173902c4e381111a362dff33589558485
-
Filesize
5.9MB
MD597f354b2813258a408965949a4b10041
SHA106a8c92eececc2cfd5c9e84037a1a2947364f7c9
SHA2564f846650c605e8bc7b827eceaca599d5a87c4e04870314ee89db98f852354213
SHA512b0aaf7c6f1dcd1d76d350453f0bb0b2b7669505a730ab79ae3c1b7179f971f513c1f99279eccd475ff77fea6a2b4209045e3172f0ddf27caf3e8fef9609f87a5
-
Filesize
5.9MB
MD5edf849759ca1d022bab5ed17d141b792
SHA1e9946b2dd1da6fc2e73c8cd7937565c5941b8c1e
SHA2566c515c8d1bf0ba6c0ba6ca29e8bcb9724bac0a51b73b5a4e588a0a3309b16a27
SHA5121f3076e03a46d789cf5e10e47b34c98d854db12dcf5ad838ab7ce58360c32e58ec36e48c6960c6563006d28afb1e106e5f915f5bceecdc611a13be2a0bdb0e3e
-
Filesize
5.9MB
MD51fe6b39e28573a42c8c7aeac9eda4d39
SHA1deebae4b8b92c9e74f52092ac639e5e807f31c5d
SHA2565d3bd200b28f6cac3094d65e4468aa303e8e37bc99e4fa9c177fdd495f56297e
SHA512ec3461a61731ef1a7b8df3030e34dba50c4b285632d913e7fbc4345efd1796a83a3e01f319ded19f2b0778961ed8e57b3f237e4d94b367b0668e02cd0e41077a
-
Filesize
5.9MB
MD5e3613a499760572bfbb041575fbb54f9
SHA14d8f995dd440af2f928769c455e4b7321288a616
SHA2565c01e63ea846d39c46e938d571e9881deb078b4184c08c2751a8c21a57790c9a
SHA512d039f7fbd2a6efec24c17ae1791d0eed27bb78ab210df79aaef62b81720919cc5645cd23ec11043ed36eab7de6c3fdedda46292c8555db3cd12f0c7eb81943d1
-
Filesize
5.9MB
MD506d4122d1e80c6857eb43edb7bfbe6df
SHA19e0b0a706fd31b88a5ec33a285060a93e7b9d501
SHA256257203cd3fd07c84c35e4e5cc8e2db00ba5d250f039ee18f70856a89c254ffe9
SHA51273a293caf23f3dc45d98f55f6a0396f012c35a50724eda7fd3e462d98d6a5e45d4f2ad1959ab51d9f33f9578e27add59d22d456d638dcee925615028048f7731
-
Filesize
5.9MB
MD5e3af74833daa92f6e4e9ad4fc197ec45
SHA13bcae9000dda63d2a4056c853d3cd5051c90d471
SHA2565535893733b75489b6c605ea3090ebf50534f911d8b671656781b25324fc295d
SHA512f5c00284a8d9a30667c1d95b18eed5344ff456b6d1a9c943167e8f37f927a1ba3c69626fc0cf022f8cabb5cd4442b5b78492b6c099deb4b3634761a8e1aa3eff
-
Filesize
5.9MB
MD56b99f4f2fbfe3f666ac59da2058207ed
SHA193eda13b2207610248c48db5c06316384e81a7a3
SHA25699b97c903baefcf0e9a09fbb003d8f0fe0e0986871cba0f90c12ceb962c6a78d
SHA512988d0941aee9d2936d16c3452a84aad30d926ae06e3c28f7e6759d73fae15c049e9a1e5ac99c548e616f4296217802103d9ae834ab65d1738901647088e1c8ac
-
Filesize
5.9MB
MD5b5585999202a0dd1d73b3f7d469f1bfb
SHA11c11bdef68194c8b35390226a8c8836518770cf5
SHA256340e1dd835a7adab90da6ccc3f3a1ef059523cbd459f4a30dafea81acb266ee6
SHA5127ac1503a5b344250b726f23c67a6269e8a3bf8500d06f9dcb53e3fb4580d3aa90a6de29b84de83dbaa71801aacffe3912643ab81fdb068cd1c190ad71a92ab35
-
Filesize
5.9MB
MD556dc9faf566390dedb74fd7c885cc980
SHA153e1815940a74e325c5795059fa3243070e4a348
SHA256f529d73f03c791ce0bef130c771baeaf323bdbf6041fda52dfa50efb28ebc980
SHA51241ba1d44e48c3fc74502d8afb042df19c99d2b1e890cec004605cc4aa0fa6a5261a355a03cd7b12c583976913df3cc3dad263b17db81d4699dc37e19d2aa6397
-
Filesize
5.9MB
MD5db6e40a63b0b905bcf4921c69f3fdbcb
SHA117fcf32420988d30b942fc576f2799ff02018954
SHA25645aa64f8db242df0f014cd70f85b8ab713d3c01fe9e7fa39fea9d79f96a10ddc
SHA5127620fbf028bdb1aca20cd7c3be0ab9c8f703c737d77afc31d13e9833b723a23559886f7cf0ab8a715216999043c7f25e170aecf624cad4f26fcc07c9ca9f42f1
-
Filesize
5.9MB
MD541537553b52a1c5f9657583275c41df8
SHA1fac60c1645abbf7a9eebf2a8ca6b24da59ee789b
SHA2567be11d93bf913c6bdbf4d7a8bbc3faee04bd78cd5eba99386c7481d7d96f61f6
SHA51244fa0f85607ca8299097f73e482ae32eca3200ad3632fd69fe5f402a9c540127fadd53292346ab20e2539f867fb51d0203dd18000ef9494ebf8344565e1ef5ab
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB