Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-11-2024 15:44
General
-
Target
2024-11-19_5a4def2d7bcf7a9199f6af08fe675d6c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5a4def2d7bcf7a9199f6af08fe675d6c
-
SHA1
ddd09c2822affa73f747706cd7ac4997a18a8cf0
-
SHA256
13ebf18b68e3bf15c5b430dc28f63231b298b2e2e07fdaf5e3a48af3d6213ae0
-
SHA512
ecf5974e47b1f60fa026086b4018d79e9cd0d384535aa58deb13ce437bb211ee7b37fe2cf34de0e93d749be037ffd591c5ce88c689b398adbbbe1f63a1cfb137
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUN
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 34 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-19_5a4def2d7bcf7a9199f6af08fe675d6c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-19_5a4def2d7bcf7a9199f6af08fe675d6c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xHCSGQR.exeC:\Windows\System\xHCSGQR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbVmpab.exeC:\Windows\System\TbVmpab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJfJFCQ.exeC:\Windows\System\dJfJFCQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtMckdx.exeC:\Windows\System\JtMckdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OfyWKjO.exeC:\Windows\System\OfyWKjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOqqlMB.exeC:\Windows\System\QOqqlMB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lcdJqZF.exeC:\Windows\System\lcdJqZF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ktdFBMl.exeC:\Windows\System\ktdFBMl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzoaBFA.exeC:\Windows\System\SzoaBFA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvWFrmN.exeC:\Windows\System\YvWFrmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HkJFskP.exeC:\Windows\System\HkJFskP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mSgpGTc.exeC:\Windows\System\mSgpGTc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GjfofOC.exeC:\Windows\System\GjfofOC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtkJkYW.exeC:\Windows\System\NtkJkYW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MQoobPH.exeC:\Windows\System\MQoobPH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NvgADYu.exeC:\Windows\System\NvgADYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XINxFqa.exeC:\Windows\System\XINxFqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EitbLXY.exeC:\Windows\System\EitbLXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NCkejxB.exeC:\Windows\System\NCkejxB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyTQxjB.exeC:\Windows\System\ZyTQxjB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HERKfcv.exeC:\Windows\System\HERKfcv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56fa7cccd377ffd493d85dc6ee47d1f2e
SHA170b043cfa6c19c9e3b3d02396da371cc5996f8fa
SHA2561bb06ea20a3cb54068a3fa7cbb15775465bf4d5e03fd7099f7e32168259b31d7
SHA5126a228286e479189b3d2f8f527b71116e7dd519d6da3469598507ffc40e216e4811382eddd3709953a46a3ffeecdc8f84573e65185721b39ee6eb763f2d5b970f
-
Filesize
5.2MB
MD534911f78f17420ee4b5a3263ef984ea2
SHA12bf78e938d41b72f1912687f1540f038f011ca41
SHA256f41c4945077ce6d99c2568b6c2ac3809f12359f6c1f288a63493d46e3d9212d8
SHA51226b1f38e8b4aeee2a7727a31ba710ddacc12927d5aa0614d3df277db0c8bda629371e8872cdbbf8702f2adab4cf6ff5ff9d8344a0ceafda46d61389e9ffe5893
-
Filesize
5.2MB
MD51bab42bc17ad40610d9b872f1e57eea1
SHA1d3eeed3753dc1607b432fa4464bf04cca52226de
SHA256d6cad0d7bc6d2c121fc50026523c5b7749a39daf31521ee157b7cdb33e56b8b4
SHA5126f5c843e2cc171d99d1d9e90c786ae445501e1fef524c6d1034a2e912396a82a64a4e42ebe1236e7fb51a2c0c59aa0b30f5da503cb3400a961c47c2d97e93622
-
Filesize
5.2MB
MD556f20fcf0502b8727cb5c478d0cf30f8
SHA1f2960d9035b791937e4b6587bb488c5401f74a0e
SHA2562224445ce856fc2c0dd149ac64c73609e3dab1a22bdc4de56c18e0a65f645507
SHA512bcce47f7484e4fe86a8068cfa7b7045ceba0f10f1a0f593d514aef94d1860a761830df7ccca0a20bcc5c6e9ea8c9b3cbcd2495aa7e0c9d363ad5c99d10a0c756
-
Filesize
5.2MB
MD5214e9fa781faf1dbbfb813be7c4d646b
SHA1fbfd5392213e89ec2d50b8e0785bd81a11479c8f
SHA2565f511683fac9ce819ff27f3f9079258f2df3523fd363df4378dd9ba3c9b82a7f
SHA5129a35ab1be8f64c22d8029377fb579175ae22c5f97534baded78b718f175a1b2952b0fc3c8bbc89afa51c2da232623a748411823de2c6a2b104ba7242be5865b5
-
Filesize
5.2MB
MD5dbb011f7d8f62aa46bed1559626ba269
SHA144a8899a71ddd8b3b519b1e8ca42a4f78f2fd9db
SHA256e395558f987c7be29fa8ac4822c3aba9b77f017d3e95ee64224928d86d5de6a5
SHA51282128fa2eaf684019d411d1440b93e35ba7e02eb4c186afe98e4efdca83ade98dcc81564f75bda8d33252a96fb3b492d250bfced1d84dc1987d707b25ac15881
-
Filesize
5.2MB
MD5a1e579c78ac6c68ed7cc1c8005035947
SHA167b220762138c9c3cd4590e8e5b495f270e14e92
SHA256acc266671ca5d1c542e9be93d1f4dd07f26f95fc24643aa1614c8fb2d3155fa9
SHA5126be6a5a56b5a58e1bc3837850f8e3ee59cbdd6cf719dc8b29725607d4b6cee0d8f41453d8ac9b629448e5765f62b1e51ad95a9bfcda92dc45118ef000de64963
-
Filesize
5.2MB
MD53c48bd97f76849bbf9acfc8d72caf5dd
SHA11019a900ec683dbb10b3e867455c05e915cd5d66
SHA256070d3c9a821ace8c5ca7e9b05361dab02c4f969f3356c9f705714554ffa8c3ce
SHA5120cf89bc21a232e1dd6f07115af159dc8c7c3665c07547f259c8a51514ef7c4f722c39a3a822bece07ffed70d4e3d7e9ebeb6081cbd491314aabbe955c9f8851d
-
Filesize
5.2MB
MD5e01c43baf94cfec44e207f934d813aec
SHA17a96218f5f2a1c8523f6583f5cf2943e3387f050
SHA256af6833f03c2c0c1dbed3a7e8e1f17103b68d92443048c6dadbd4d0c681109206
SHA51209f5a0676ef13b029cda2c7d62af9e21e556db6f06b29ea1a3cbe1447ba5de095c29a4a49335e03b88a80bb2096e6999598ee24688a900a48bd93061e99f9cd3
-
Filesize
5.2MB
MD561a05d66bfa4154727a25cf44e93e9db
SHA17ecc508b2560b6fa67a7a0bd59e9a0d8aa624076
SHA256c90c109d7cee9da92d19244b19f7a1b3c47f474a347c8ab37739546315f58f76
SHA512b57269f1ecf9fcc7adb3f696374905576fecd7875a47b7a49c9ca976ba2e870999a7ea74f83d35548411857389478064b7d8e5cfd5da95cb0fdaf16c2e88e813
-
Filesize
5.2MB
MD52a11f773aae9791ab4a0c34c59832435
SHA1cf02e29cd99f8adc9792cb86296af632a18c46b6
SHA25629ff274a268326303133f29ece2755a59d574b63f4028d303cfbd4cb5842edac
SHA512ac9d085a5e197ab35fd7b273dd3f1ce16465bb5e4a9a8519a6e80e6143a24a5ca0233fd6ca0f94e8b406e35929200a38aec22344742508d7df49305164dcfbf7
-
Filesize
5.2MB
MD56c93c443a5dc3df9721baf86a41f5214
SHA17dec5d6eab9696845583395b5c47a9aa787fccbe
SHA2561416a9cb35c6f1dace6d8b5370b59f453733bfc0d6589f2638fbbebc6d1ea142
SHA512eec45957cdd7156ccbe04a6b0925eb1c21f457bec32e080e6363c2c2ee44b048e9f31a007940efa72347f18adbf9303ca9ac6cdcfdc6691fc6d804ce4ec7edac
-
Filesize
5.2MB
MD5a84bf1539e366cc91695223b19a96174
SHA1edb003edbcaad33a76e6de56bf7fdb4c72b84c2d
SHA25662318284ab7de62052ded3bb62795358ae097dbfe63042ce60750363d2f27276
SHA512fd7414db01c89bb5680a0482a1616e17e7d1a31e60733c61674285c3e8cde7c41b792666fe12a4d879410bb3b27c418e9e236629bc909cf801ceeea7b7e35400
-
Filesize
5.2MB
MD5fe65b3c1291662039bcc55143f27a582
SHA1fa7a419c6b3983290e964a38c0bcc3abcc8aadf0
SHA256e2a424f92bb3fadaa6de1d52e5b44ea936ba785618a42f181f4b360cbf546a1d
SHA512aa1a5f5dc5a47cbb248c06d95bd810fe7fdda4a8264f7a274178efa0e95ccfe518bd69f7f0cab779d51285f1e9663fa671668ba05087e96d0c8aeece6a59210b
-
Filesize
5.2MB
MD5df69bf88911c01d5cd267b1b479ba6f3
SHA111461deea464fd6366fb89a112cd5fe2bab7797d
SHA2567fcd1ef75adfa30647b011817fed8986dd95b67bfe9b894bd6b851d2d1079b0f
SHA512630427ad692e0869e725726f1b5ed8905022c623b13d0858bc2f9d633c88c96b2cb65dcfe92ffac372d56a7e24558aad06ef59e1101e20bb4f7e27aa62838900
-
Filesize
5.2MB
MD5ddeba20df04a71599e932ad6e4fb3688
SHA1c47adda364e5e2d8fa7512eb8a868ab425036d38
SHA256da5a0d5408ba4d3337214505ad10ba0a8739a6866feadbbe8fc5e0aab1b90fe1
SHA5128ea5a65cb6fe582c540fc78c9b0ab9101ee07b02d2a5ffbb551e63e7eb7fb635faa93d486cb8f3c24cb56dec49903452250be6211dfc3cee2136d4d9568796e9
-
Filesize
5.2MB
MD5c92f9474937ad516752843de5b37bdd5
SHA1aca4838b6910a231d27c7833742ab1765a44709f
SHA25650ace71a37615462d2833e1b38db609804f09bf1f1d43ebbcb40a9faf88de3cb
SHA512213ad3ba819623d2384cb496de18f80d789d59ec515ecafcb511319d4715ced5ca6b90c23b26720b94a09df3032bbbccb0f55677a64b14f99b567a4b896c125b
-
Filesize
5.2MB
MD5e0887453432dbd0d5ff5f3b49d5e8ad3
SHA146023ebc72ffbd7733b5d42b521fc434291231b7
SHA256ea278193e97fc51903ecbce98af9bac4c8e88a1148cbf5854e5f4f451a58f95e
SHA512d9cc880042d26a847677577fdad9c746010d59c850c1e88178bb0b52719fb2d97a71889dda752d04bd5dd1dc90ba747cdb06317f113bcd879091db7f3b53e43e
-
Filesize
5.2MB
MD57a11bd18230097876008af3a2c92174d
SHA193e8c717e2081d80efe2e12783f78e03caeeff21
SHA256d55cbe9d7143516edec2e5d9ed55d5a227bf80ac5c751a7d1ba7a2c35a55ee08
SHA512fdb4e86f4d3ff3b01ab54280b615c2010020abdba66628581342b04bbb32bf3741a4ea784e98a5cf1cf424b9b82028ca4b53b265c3f75df574a9afbfdd87467c
-
Filesize
5.2MB
MD562e884ec704df20db3432327f1fef51e
SHA13e32ed037fc31b0548fde521c3bcd40a1686db8a
SHA25692e6257752b0aa8eb8171dc51b6c52017e169d688ad5029cd431c2379d87c60c
SHA512d0f2440a86fae658a8d96e06ee7fef1d74e3628d163872abfc55456194bfb62473a72ce987ba1b463bd9318e8788b9c29478eff77a45227a7f661e60e6e114f0
-
Filesize
5.2MB
MD595687fe9b34d127df879d02d7b7a6dbf
SHA17cf19bf8e06dc783f29dbfa11ef92e956be2f374
SHA2566a0646c2fd014acaa7194cc73157ba2c9674d3838be6a0202f533b470ba625eb
SHA5122668a2950cf798decc41b3d7f3689405b10cb4d6b94fb2e36e195a76cc487d534b443a34bb4b52a383c743df632e304869cbbc6027777b589e92753bec125fdd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB