Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20/11/2024, 02:42
General
-
Target
2024-11-20_0305d5e34684137e29bebc0409fae550_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0305d5e34684137e29bebc0409fae550
-
SHA1
eff60feb95ec1d923eb332090bbd6d3ddb6137cc
-
SHA256
6b43a9c364befb360b7d01c9383624412613c557f04da49a99ecc08a3c941276
-
SHA512
496cc1b0d038af767fd5946e5883422f4c702c4add51e2d23080a4f68cdd86d2ce47bda3bd7ed7b08bd23b7e971ca0251e63eff1e04534c48b0502a8d1c5d84a
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_0305d5e34684137e29bebc0409fae550_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_0305d5e34684137e29bebc0409fae550_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aZDwvKt.exeC:\Windows\System\aZDwvKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYblLzQ.exeC:\Windows\System\yYblLzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\raVWzib.exeC:\Windows\System\raVWzib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vcGGZEo.exeC:\Windows\System\vcGGZEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ELOGEiw.exeC:\Windows\System\ELOGEiw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XwxYCkm.exeC:\Windows\System\XwxYCkm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAbrual.exeC:\Windows\System\XAbrual.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYNraeq.exeC:\Windows\System\PYNraeq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ukkBPCh.exeC:\Windows\System\ukkBPCh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IkCCmtf.exeC:\Windows\System\IkCCmtf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApRShnN.exeC:\Windows\System\ApRShnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fyuqLQO.exeC:\Windows\System\fyuqLQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gFYwXgF.exeC:\Windows\System\gFYwXgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bRAsZSD.exeC:\Windows\System\bRAsZSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fTtylgS.exeC:\Windows\System\fTtylgS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DsyhShP.exeC:\Windows\System\DsyhShP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PXEJrpj.exeC:\Windows\System\PXEJrpj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BwBgctg.exeC:\Windows\System\BwBgctg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlFvYtY.exeC:\Windows\System\NlFvYtY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fXnmqwJ.exeC:\Windows\System\fXnmqwJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgKYAuF.exeC:\Windows\System\JgKYAuF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cd87fff434bf2f45cab9989db7a74fb5
SHA1ba376aed250d39504aee2b3c9c619a5624e2a78e
SHA256933c1a0830841bfeea492bd2dc8584a3b28d893bc47a5d6a8bbedd72a1c4e5d5
SHA512b802e03e60d6f6837613c853fc7967c66b7a95a2d141bcc9b1917a7b3cda6f1ce4bf7fb76305306e81aeecb8cd8bab099a528556a956e5e5cc3bb2efd2231450
-
Filesize
5.2MB
MD5a1392cb778a13f9cf8a2497b35f27070
SHA14b52a8b4eb10a5fd447cb1e24865d952a9b33dd0
SHA25632a0e873f0624d3803a91c05b27d51b0697feb8a94bd6a2774c51d4af0ab2344
SHA5127913a15bb42081a19c56785e0c6e2efd713c76df772fa4887546811c4348412235001c275fb7ea231d3968f975b0df52d5e41526df9771fac3ca7d6b6470afe9
-
Filesize
5.2MB
MD5e3b1f625c30f7e0664e75e1ab03ebb46
SHA1671007c5e9da139d1d2e8432ec215b780265a135
SHA2566df37d5ad60d1aeb20a9f81f0c3bc36d6b22ce485cea6f5cc1356a604c443778
SHA5124ac59299bc72844700a717f7af421baa86d1dfdfd9868d38f2f88668d0b55d5f684087f5484d25023093a83388e65e70f64c39545ae49fce079472d43066a6a0
-
Filesize
5.2MB
MD5224ada454034ea9928752d59e725d893
SHA18392519296ca67cf1bb9a8559cb13253542e0056
SHA2560a7d2f40ddbb33e35b19c9c57ef00b7e1d6e1e216bd3644e24b206f6216864f0
SHA512a62f1c4e46bf6b4e488ba8b6a59d1bdb01cf821e212bb877020044e344d0cc95ed3c7975f9d63cf525bf43174c6d87e46618038788963887a2874f981da421a7
-
Filesize
5.2MB
MD523fcf7c504b96afbd65ff42d7c0ee975
SHA1e6b59891a40b953c7aa18bdfcc1a2d21c561a933
SHA256709496a27be590021209118c9aed0816526098496afb9125b605b5392d026209
SHA5125ef7d8ec50309055ec0b2fc853ab1eed80ba3d3cecede85b1abbf569b3c80ba32ba12d6c239b1a0b416b1281817c5233f3db910f30f535b936251f5a9a1b482b
-
Filesize
5.2MB
MD5e61fca63684bb623dde0c260309938a3
SHA136e4d21720b1cd08047893f98d2964d5d556e5e2
SHA256eca3b63d621a0d38ccfbde7587decce7e062b2bf950bcd48a9ff13f850eb3a3f
SHA51263917bb0ea3f71c78527a0400ee0bf4bb26cd45861bdcef282cab474db0f449a5428c0c21d891065a31b7d21b92cb0044c1a47dbc355a72e756aa795b5690ec6
-
Filesize
5.2MB
MD5dd2fa08a79ef2839aa87b3c407e1e1e5
SHA1fc1f297a8642932f7ef3453e8007ed6f55a0687b
SHA2561d4cf71f6edd4e4f8972c0fb853c47382435fe122c205b7b35ed6c779721ced7
SHA512490c3f8a7e203ba4bb0ac6dbe8cbfc5f2a02435e4065cc6fda04b46e1086080daba27dfc54fc6ad9b04246fc4327f3d01da05f3a503acf50804d5d140d431a35
-
Filesize
5.2MB
MD5fa5c22139ccd0b079b221739384a8a95
SHA15853f22259037f82417fceec5c488eecc65a088a
SHA256bf21595074f2061d626f5e1680f723072ba8f19a95a213e78f11873e9ccd8716
SHA51275d78299360e0d740e10495f4c715fe16dceabf098c3355c01282b72fb9c674af11d6b1a812d56e11acbb755a22105345d0043da838a400ed4f690b1b6d1cd25
-
Filesize
5.2MB
MD5e67922c1d36efc601eb257b4548f811c
SHA1c220c8dbbd99516a45b07fa7272d9f6e4fd2e0b4
SHA25620acdb79c50518db38da7b7ba60687c3b8d724bd773173f2adf28d5d3748d833
SHA512aad7872a49148826364d4f499964626606cf78c105db127c6b86fc8e48fedcb654c9bebe2a25fff3713d42613dc838c712cca1bfe84261a837575b91759ee99c
-
Filesize
5.2MB
MD59054421d511629f99269377e30cd511e
SHA10ac1701ae787c7c1375d65fd0c9ec54dc5ffb047
SHA256d0216e84d0711e7f14b3b7eda8113f830e7ceddf7d3c841ca9afea615cc17b67
SHA51249c010e95252e765bc143e766dd8b1d3d5e541bc4e554f9523f38247992fa4e85547f01fe48e8c54bb52c6e8780cbda2b478dc5f35c6d66beb19a0e3aca9c054
-
Filesize
5.2MB
MD50e21e523035957a4f9cb594004098d22
SHA194600cd169decac9d129ea4e53b9ce0f1edce38e
SHA2562f78224d1d528f9ff7f9c3bb3f895a33ae337160234b8468a190ddc78fc21476
SHA5122510fa00049c6eac289f32c575c8d84de545dc9bb8fca6f4799142e1f2ecfed498f20df1156b0656d347f7b321ba26ecb689aac33abc9fda3ed3dc64f7650bbb
-
Filesize
5.2MB
MD560bd48cca574fac53dd9e089b43b2cfb
SHA1dcb08b9dbc1649bac6164d8b5348020417ce8c7b
SHA25632c2002a090e0c3105532e787db89281b1c3553618f260421d8c2d18aa7adb2c
SHA51259415176bd0f03029e3d317c896e4881e098909f9bc765c7535c163ea3d8ad343aa766c514515c9e76e36fced18adc746978c3b3dedd09218051b697842e36dc
-
Filesize
5.2MB
MD5f97a28b6cd0cdae04259c6b4709b089e
SHA1a661eb14da348322698e7218d5d78c53166b6d60
SHA256eeecf143ec6a07ef777063b9057bcac35eb4fea597e16d6d85f082c2e813647e
SHA5126b1a742059eae074e52055b96fa4869467d39d5e744216c162013eae1a59f407cb915ad37572407fead4586deec0ea54cb50fd69d45dbefe66612cd7ec88af88
-
Filesize
5.2MB
MD58b5b1c918f5b8a12dcc2c8f89bc654f8
SHA14d9f6bfef7552bcc12efb9eaf800b221f4934966
SHA256430e1699900e6809aa05b456e8caaf284ddf94c1da0be7d78b316d4a79a8914a
SHA5123d33b28a9f03ef0e8b438461dd318fb04bd1092b0702d6f2dad78b6c743100f4c526b81423eb1f231cce3f5efe1486084a965bced2cceb05f27ba657eb60308a
-
Filesize
5.2MB
MD5a3b66711d32bb4b8e9d748dfd51d4ba1
SHA13eb3d9e434309f869fb278722a4b8b7bf44dce69
SHA2564fe82bfd7e74925c0d71a2a90ec6043986c3145760ed439b867ca8b0a8a9985e
SHA512ac5e2360f6275f14f74b98710c9478522c8536874ebf6062b7a1a0d5d13447ef8af4f868eaba5b46fd5cb93c1acb820a05cf0dd36bcb68daa5a325383a2f4ac0
-
Filesize
5.2MB
MD56024ccb8f7fe12514a229102e196622f
SHA1e74ed0b642ad2431de39d677d1588eeb095c6ed5
SHA25642b98c5ebe45ceccaf14930c6e4cad7afaa2e6ee292995822a602825969314a8
SHA5128aa5d7d8c0dc402662535c28bc9fd6faa2dc105f6d1c345539e8636a2ad0e1fb8159f88d7b34a1996e748a2f73468f5f981ac2b7d16ec0a7fe143e0e73e35b69
-
Filesize
5.2MB
MD588da14a38acd9114309faf48b1298009
SHA15d748a45c0c8292bf76245d62794ceae1ed9e228
SHA256e6b43749ab487698820606c9e38eabc43c6bd234fd469042cdba0a35c3a60412
SHA51206d721f89ff63a126c5fc73666f6973f41e4fd83dc70babddb00f97de15b3da9f1e9cdf7d58e5aec4265d5925760139a05bd5cbec8dc0c136a8568ae7fc278f6
-
Filesize
5.2MB
MD56bc720dec03bcb3e1c40bd5a2591d5ea
SHA1d60638043dd8b55c1d4699b4f09fe547309ce8bd
SHA25643d4fbd220065522a8eeceac431837abd58cf595c60c48175edadf9de781f4b1
SHA512b961953733cfaade96dd9c131bdc45cc1d1083a1326aed6b3220c8e1b0bb258f4816025be39e5d9453930b03ef3ec87503398c3b2f415f72cd8e176a1e2cda85
-
Filesize
5.2MB
MD5cfe4b6977f223519f0c5792537b984e6
SHA13918558055acae3d762897f19e1154803f18671c
SHA256e9b67f596c185ce1c2e1823a2949c84ba405cdd7299ee52bd391ac346fd48b57
SHA5124bb9f3c7552fdf2a1cc537f0ad13a9d4ba2517eb4b4c37e12dab0394fedcf8be644a01c4a78e5043f15d39e9feda4f0a65465a94d2309554b05c61808ef9262d
-
Filesize
5.2MB
MD5ba4245101e88dedce618e5f689588c24
SHA1b9a1ecec83603e7a420c48d67b77e5c008a861d6
SHA25602d93fe2ae2f39f9b569c04c9e059e5a8ccc9625f0ef2eff6135e2848793f711
SHA512c9a7ca80e5a9d461fb0b75ba615835cf1b5133f6e71e69ac08aa7167e9ccf3315ab5a4cdd6ef54abc54f10d44cdc48af126e71833d4edb6105f6b3f4f0f1ad9e
-
Filesize
5.2MB
MD51f31fc8fb1500be49b91a5a0a61e77c3
SHA16b53380a239a4bc6d7f68ef2d77eb7d720016db7
SHA2563d7c0f63f5a2b2cabbfdb00d1b5240c9f4ee19c65fa56136d302c66df186656a
SHA512d980abe0de91a092f2f95668837a503766e7a5ebcbea08e9e408415657875eb2f3ed64ca9dc9ca411f2cfe6b5b3b193a3872303918ef70d3db40627ea0d9a563
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB