Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
19-11-2024 13:31
General
-
Target
2024-11-19_88d79f7146d818176b1702acaf25cfff_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
88d79f7146d818176b1702acaf25cfff
-
SHA1
9c15d5ccdf013ae7d0bed21b2a8af7a401093abb
-
SHA256
3007bcbbfa8bd045255d21be82e1cc2d508f55c7cb59a8fce58723a7cdbf95a4
-
SHA512
1398fea9f2a2871b8816a8026182a3f7aab43e3d3d7bfbb128822993ee17d36779bda908cd9b8609a052df3f18f37ca69e50d0f39da968835f5c87165232dde0
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:T+856utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 56 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_88d79f7146d818176b1702acaf25cfff_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_88d79f7146d818176b1702acaf25cfff_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iXTEUpK.exeC:\Windows\System\iXTEUpK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YWacmbr.exeC:\Windows\System\YWacmbr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ebwfIPn.exeC:\Windows\System\ebwfIPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RmeLOGg.exeC:\Windows\System\RmeLOGg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DrCPuNJ.exeC:\Windows\System\DrCPuNJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFihmJP.exeC:\Windows\System\KFihmJP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CwvRAPb.exeC:\Windows\System\CwvRAPb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfAISTF.exeC:\Windows\System\zfAISTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EAqNQYt.exeC:\Windows\System\EAqNQYt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OLtiGZr.exeC:\Windows\System\OLtiGZr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TuJJwkB.exeC:\Windows\System\TuJJwkB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvlKtFd.exeC:\Windows\System\BvlKtFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMuOqaZ.exeC:\Windows\System\hMuOqaZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VOrdgPU.exeC:\Windows\System\VOrdgPU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qRPpaWj.exeC:\Windows\System\qRPpaWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WbkhIiA.exeC:\Windows\System\WbkhIiA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mseeHol.exeC:\Windows\System\mseeHol.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iOVYlEa.exeC:\Windows\System\iOVYlEa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jyRebrd.exeC:\Windows\System\jyRebrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WJQRqke.exeC:\Windows\System\WJQRqke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHibNvQ.exeC:\Windows\System\UHibNvQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD590ea36207bdee359567cedbff828fdff
SHA16272e45dcc3ed2944389e7163342734152c2edf0
SHA2568570b21e6ac5dbfc27de0ae5d7d1d1ce11f7df969f074b9db37fee83f79fc0f2
SHA512e08357f23900d01b7acf58c89acad2de1dd28c379e515e5a1e37f601d7529e53bb9dae6141651f4332012a911c68cde5fe585caefcc5700d88fb7f5b98ee1c43
-
Filesize
5.9MB
MD536cc2514c0afa2b77a432609410cb4f0
SHA121d1c743222079c6d20bec3de696c6ff478301c7
SHA256c51c4732d8f7c934dff93b7a88f4877d3ba6682c3ea9553fd7a37785b164cf71
SHA5129264b26a990b3824c9d38fa07937a022b8bb4409fc941dd347c5172b80fb9d6e8b03128fe80cd7ebef7a0c6d57cf83c99f8a98d9170664251fb007dea7d69bb4
-
Filesize
5.9MB
MD587d23bca234c4007f302c05120c00747
SHA16bd8de27a92e5129a1d43787001da5100c953e89
SHA256cdff695cc6d021be75b2bf08407048c91aa629f02e6d753569f5cb3ae800f4fc
SHA512bbc20a6b140915b58255fbf686b00ad59b4e14a7392b638329ad9557667e2e64ec4c468df193135076c915d19394f66d57a444c2853eca036e3f74c7209a07a8
-
Filesize
5.9MB
MD51e0c2a4960608a97d0e821256a438ba8
SHA1b175f667d54701150185b27d687a00c62da9b8be
SHA2569c0a873456f06e02cc240bd1f687c7890d833ca5d47bfb568da374ad00d44204
SHA512aba85e846877f79f01271b304d99fc059d140d967961a075d1eff45da08a58839b784ba40708709cbf770da4ca2bf160d5591f4bb4f80213b56bc6d9fec396f2
-
Filesize
5.9MB
MD5e1759d936da404cada9aff062b79d8b1
SHA1759d4dc8cf3f8b36f95da2e8c6c4b3d5f3ce8f62
SHA256c3be8c0be1731d86ab4d928435c86a546a87397472edc687fe8257d62ca93adc
SHA512ca3545bd722216d27ba13f4e3b1f168e2a3ae8895db6c00f186543a57f06dde3d834374b01c6ab84dc8c520d433a211e023121ed87398fa271cf02613e93a887
-
Filesize
5.9MB
MD59a28cb590b974a6e7f650b2cd3e258b5
SHA1360bae499699b9abf00f8c924568d1a2b68f1111
SHA256b10c7c3fc8667f558b0404c9932026607b116391cde06b455b0f51740366cf0c
SHA512ce403de3d547de0a33fe69783b3b22580cb874ba56744acd8828b4fe97c8b1a648ecb8f5f265d5b9cdf57df873b393993d1923fa4ea51e0f0e0d255f5b69f0c5
-
Filesize
5.9MB
MD5dd72165f4f9e66daa1b432b915819464
SHA180f074f32d670677c2786ac60255527e74838be9
SHA256510d5eca0941a69fa5795d4d6b8ed864413089146443e3c6d342a4307ad2c906
SHA51282754ba973897742aa8f857885a88280853f4cf2d65fbd4894f35afcce00ad338542999629b959da1d84f00ff3f987bab6569cd435ed22214ffc6b316b3342c5
-
Filesize
5.9MB
MD56024d111c101d883089023bfcc41cfa7
SHA18598da950b4af2dac00d54dd3ce98abf16cb262b
SHA256a3c033bd69499349922756471e14f0b0606958b86829028c3d33fc94bcd7963f
SHA51212ef3c89c4519452d95b5cda06fe9ae34b68aeadf514f1f3ea699c85b98e6ede8712d7cdec62f78c48e7d86ccf6a9b17628861d10664cef91a35f11638682096
-
Filesize
5.9MB
MD59b9dfa69a3034839172ec3313210ca89
SHA16780fca404d319b1ac1aecae524d0ebc91c8d36f
SHA256138bceadfd35d98cf19e73b934536716a60cdfdadf4f6f28142ba1df4c32983c
SHA512106c974dc74b248a1adaa27d25171daad9c2c1fc5c256a19eb3b51547d245597fed58e1d4b431e61ed4396f862cdc8a1996ba85c4144794efcffb515687bd986
-
Filesize
5.9MB
MD5d465aacd54be11a280017f6697cb4178
SHA174d849da6918a1c40fee6143e223d74f71374a3a
SHA256934efa5ef43082f323ba1f420c53847318affc9e6b8f6aebc1eadb7922958dd2
SHA512e23fe249efb9beff7c237b25736450820046dab92cb16a9541ca8b840ddbfb140421de7b3bef99ec375edf96c836a462bca8807a8951c856822266d7828b689e
-
Filesize
5.9MB
MD5e93ff7b12c864c7669fb652bf03c5642
SHA15a959332c2464f7858e704a3611e498103271d60
SHA2561492ab2f157f39e9f701eeb18b6458ac32d92cc0a36183623c3907415d9b8053
SHA512606c32fd6c6c17fd907dec6f31d9db15cf26a9486f54c737ae0d4c393c0b11aaf2c7f8f0783d921d62c93d171abd749023acb069a059a38d82e6d2c023243965
-
Filesize
5.9MB
MD54251dd5d9272c505a59140b3c23c0a5f
SHA11be773246c423818ebcb96c6fcd9a55019174042
SHA25655aa2e39498c5fbc9d8bc96b6579b90e75416f1b850f7d6f6e6627b2415a750d
SHA512d78e314e2009a8bae43f6dbac3ecc8d8cee77537304ad94cb2b06921bc73492bc441a3a1647dea958b7332157c0cadb39ccc290bda71d7f0732fd4728b858ae5
-
Filesize
5.9MB
MD5f3f311a9ba0714910d0c4cf691d35471
SHA11a046e83f966977035fb48be77ff6f9564013d68
SHA256d5e70a2329261192439cc47356aee0b1febb3e44cb076b04d59fc7681a26d68b
SHA5123a0b66454dedad543765ca35889ba05aaeeb0bfc61b671e1ce2dd5de5d7154698ecd947887c8edd6161de95de08b8ecafa1c9512d22bf52320d92032f091dbf0
-
Filesize
5.9MB
MD54c9fa291d8780080409e0d10abddc71e
SHA1c7b08e3f906e9cf8130af5d4c0b84749d758a1ed
SHA2566ceea7571079e5ab78ea808528b42c20ee537a586e407171912a0fe87dc4a63e
SHA5123c8b7a3145e3e6fb5bb2134e5c30643ac30f0f310868d4258c97dbcd4bae40f599ec8c18f3c7721cbb8fa37c20fd2569d263d61ad4ef2aa893a0d12af1e8119d
-
Filesize
5.9MB
MD5c7f1e147d6ba1c6ff9d5f37944a07396
SHA12fb35bee78e4afec4411da12f1e705c2a3d2c782
SHA256fc9adbadf60b971a89a544352829ca07d9d330338cb4f89c366804dd6e40ded6
SHA512b5c90df72fe06c68c1b6dface939d4cd65766d36d427f5c9a96b856f562571f2cfa9f1a9aa92cec6bb8f4860e09a63142d1019188ae77f4c423c555784922446
-
Filesize
5.9MB
MD57fbb7de7940566c99e7e95b9bb215e06
SHA10ac2ced4ed941f201c503411bc3b8bd45319f30d
SHA256147df663173e3ed4153fe7c468293ace8e22d5f7710eeca0a041157eb5be5551
SHA512e2238784e9b25006fd569de6f7e190456b8760e14df14bc61a8dad10410611f8801da5536aeef9ff54c688f3d112ff60aca4529891701e85a6f6a1823078fd3c
-
Filesize
5.9MB
MD5d98e0d24c6f712d623be9e4312de5070
SHA158ceceabed8211168c01ee31d192065d55d68647
SHA2561e8ad36bf6f847666a6a1a39d42e9afdead5333546acd9b0a8b221a4c038deb5
SHA512d762d7e1d2d7adb27a21faba201f173c9388a21278c4532a42bee8e84b8003a22189abf7c93bcc6e401da65fb40b82733bd2dd85684e4c1962ed48061a116cf1
-
Filesize
5.9MB
MD56e8f3a54ac028a54303431ade53b66ac
SHA13865e931c38494aec514744a465f8ce941fb1950
SHA256ab11b8c0c8db3c9e22712fbd25125db0d231a90606560f22abb1f4bc468c2725
SHA5128f582ac535a7b7e113a677639d3a669c4ec00e81d58e5713b2fd774e04f1d3aacb1d8652aacbd41f88af6e9fe031f409c963e9f667f20a06249cb8559664cb09
-
Filesize
5.9MB
MD520b6208160f7497b29d69e69dddc3944
SHA1d2586479e2a36656de6b7438909a1eeff61b9da6
SHA25649598172f11a784fd58b95ca74023d5a8d1fec6a5ceabf398863752d501ba90a
SHA5125778017b3eda59ab59055685d39c112e37041d72effcb4a418a128382e99604bc1a031f043881439a9cf7cdf08db7c83f07bf57b76bfe394dce0cecd2a675715
-
Filesize
5.9MB
MD522d1210165e2c1bc49c5062ec63a52d9
SHA1390d3c70ae8801215bbf01f1a5ca5e07729395c9
SHA25695d0fceb462e383bb7a6697a80fc6bafd9df31927a03bb2042bd65269a00b9f8
SHA5122734a5cedf9190b93d637ab0e8b43cd285364e410d597146096eab1ef4f51ebee6348ad069c12feca9358743185bdb4181e81eb320ef7f6fdd878e8b8383cf79
-
Filesize
5.9MB
MD56b8e7ae3cd7b292fe734e7bb449cbb7a
SHA15af5ffd7daf23edb362fdee48745ec848d9bf8a3
SHA256a13a69aeb0f75eb17622281a558e186c6178bbd4a24b5a6ba99ee074bcfba186
SHA512bc5c4a40a496bb6cea5732a660cbc94fc382a19a4563bada898347a83758fc52297a63a1acce5092256c2713f8b3f0121448ce40aef1ecdb7eb806b0dc901a76
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB