Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/11/2024, 02:42
General
-
Target
2024-11-20_0e3c29e5e3d7e67267937ca50445c5b3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0e3c29e5e3d7e67267937ca50445c5b3
-
SHA1
2d314157bec446f8fe40a45ca46f9d71e22e41af
-
SHA256
f3fb7a63911e578afc464b351d66438d50672775f983abd7acba179dd3384b15
-
SHA512
7bd097a70595ffda6ea1badb11887f496f69845350905cb313486bfc986df69064f6d6a62bf3a1ffa955f48a2d84ea2e761925fedcfecabfb22f04208379c3fa
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibd56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_0e3c29e5e3d7e67267937ca50445c5b3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_0e3c29e5e3d7e67267937ca50445c5b3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LOqiOTA.exeC:\Windows\System\LOqiOTA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gYKkJGb.exeC:\Windows\System\gYKkJGb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDzTOWD.exeC:\Windows\System\dDzTOWD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWyrIvz.exeC:\Windows\System\FWyrIvz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YQmYGYj.exeC:\Windows\System\YQmYGYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fxEcQeP.exeC:\Windows\System\fxEcQeP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ASeEkbC.exeC:\Windows\System\ASeEkbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YtOBnwH.exeC:\Windows\System\YtOBnwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KfoGKbm.exeC:\Windows\System\KfoGKbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KlprSZJ.exeC:\Windows\System\KlprSZJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwHLmkw.exeC:\Windows\System\iwHLmkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YSKmyil.exeC:\Windows\System\YSKmyil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AOiOvxw.exeC:\Windows\System\AOiOvxw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yDREHBC.exeC:\Windows\System\yDREHBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IevWyqw.exeC:\Windows\System\IevWyqw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QSVHyQO.exeC:\Windows\System\QSVHyQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\feQooYf.exeC:\Windows\System\feQooYf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdhQSlR.exeC:\Windows\System\FdhQSlR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\amAFVNh.exeC:\Windows\System\amAFVNh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JquFMWz.exeC:\Windows\System\JquFMWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnvBLeJ.exeC:\Windows\System\AnvBLeJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e690739c330cfa5c3274813808f6b0b7
SHA1841dcc9d1673fe5e7a08211fb2f4d234ed02e9ad
SHA256562489d91b74f65b794de2c5c0bf51c9885a0e545f382fa7aba9d7ed7e7e9d5c
SHA512dbc4999d234ae85cfaacd36888175e005b9f4357cd2f3c47abe5ac727f3d96c3915fca755438ca13203b9c5d08c1e712686eefdd53bd3755a4824575356ffda4
-
Filesize
5.2MB
MD5fa3189a638caf565d92ee5ed1aab30b0
SHA1514fa646a830c4e81af111ea8ea431302165ee80
SHA256bfb7fa99b76e51426f94dd19d3c86cc36040f024a0e40ebc619940aaedeb748d
SHA512c3cf9f8830df6b6c26eef1f581f84b3e25f4b4e56cf10c7f173b1cc4094df1d2a4f6b9945d34d22c9875c5c1fb8f9d09bb87cc08df32be3fee6fd4658aa86d61
-
Filesize
5.2MB
MD5d3e8841b13e49b04206814f8f1dd93e5
SHA17cb9f36c87110c958ac53b1eceeada2ddf353527
SHA256854b8f872e732b8e7bbc367c702896e9269f365c3dd91a0a7775f19f52cea3dc
SHA51279131316f6665053a93bcd79893faf561a832ef0790af08d9aeb208742e858c6c8f40f988b43d50648d0b1fc37b88ac44c308143e4b022b425a885270de767a1
-
Filesize
5.2MB
MD5af1757fdceda6d1072f292f12c5e4746
SHA167cc13ddadb3a83ef406ffecad113056545cc209
SHA2562c4460275775230cccc991355563491d6de851bfd96a29e7449395352d592e45
SHA512d2393a7da9df2ecd22cd397b900980de20c9dcd56959959cdb21cc79132ab9edad2423ae14e29e729213742bbfc8860e6d2a3d033033cff893bdccbf02f62f47
-
Filesize
5.2MB
MD5249d3e5d70e538854333cc4cc5cad78d
SHA1a69130d2f8b4cda673fd3f47ffd18b8f035c941f
SHA2560aafd54d936ee3f270f23a76b9ce44b483c463b684c672f9dec477ddab6bda3b
SHA512bec4d67c045dc82932a19222f2908aca87f18911e70cb523a8f7ad1f68c1eac3690a3600b46433d0681e302b56d6300549c2660c80ec91c78eea9073883b3401
-
Filesize
5.2MB
MD5212de329e9a9ce6b8d3fa00e0e4c9e9f
SHA1fdf468411002a5be98675e24e69fda8cd04599c4
SHA2560c852cc133a224c79fff514db05e6765af2fedc91ca6fbb27b08c6b50b77fd91
SHA5121ab0a02bd9ee54f528f461a764f08dc91cdac0a70b8a3e09882ddad553445901d102f59489d8d18dc976d1c52fbd6100f83bda4c39d687c323581e666503a0e8
-
Filesize
5.2MB
MD54beb9d715ec1558e4b8d9561453267f6
SHA1ef8a2adadf6cdce4bf2ef716b363e56c09580768
SHA25649b69b29edc86ad9d9e578da1a90a52775af60b267714caabe42549059afec75
SHA5126f46ef95a81701daea2d3b47d00da501669c032397638e1391da423cdcbf72ba18fb54dacd5ebc38c66eca6eeae30f3b9072e2d69d8d8ee59642b5f094ea0789
-
Filesize
5.2MB
MD520f5a6943cfd697846e403b1a67ca930
SHA1f948759c9cef707f6d11169ee888d8a279a36c20
SHA256bccc25fd2e730135a0599f74637ada435feaff71d3e81e0deedaa96f6803e04f
SHA512ca2a0554499f237198aba3065120dee9cc8c40ff4c7cb72d06cac236687be9a7e28e45d60b47d804afea9dc7ef50deaf7dd9636edb1340a63617ca7417e1717a
-
Filesize
5.2MB
MD556a1dabbe28b6a14d11a3a526493cebc
SHA1e87cd9968d49b9e33d8dfabf40da52d1bbf629a5
SHA2565d68b5cfe74d98295ea5943e8995b40678915faec39c7ff03da625c7a5f3af9f
SHA512e2c958ceedf49bd9e81114ccb975404eba4c4be227a638c69ca23f6e6f6bf48bfc48422d9dd86cf09bd25c245cf9d88e4f654658a040269942da149dc0facd34
-
Filesize
5.2MB
MD550b1e3599746f5c19d4e7f6ac0e30cda
SHA1bd4d2d0884ebc4f83cf45b7afcc61ed4e06f0b5a
SHA256ff6c3e97e7eb359dd21e4068d91ae9be695ab64471befaec618ba7de1cfee011
SHA5126cedbb26891788cf6e90d201d20a18384bbbbedd8d74f08b5ca903ad1d1407ef685982375874bf1062bf235bfc466764a8a6991b86aac7cab139ea225fc2ddaf
-
Filesize
5.2MB
MD537599d509797ab215f33f71ee824ba62
SHA12c69fc0f61178da93825246e51e38a6ede0fa899
SHA256febb6770c536294dbd165a1953faee17347c3024ae9a4f5310e02dcf11109185
SHA5128a0aea68261e501315aed13edc7838e27896b561b5f5ac653541e4c31b8e15ad6c694256f0a06516323dddae8eb944ffdbebe1fa9faabea1ad54f215d69d8b02
-
Filesize
5.2MB
MD59bd6d7a45c921fb45b875a7692352732
SHA1bd0084b8800652718418f32c13188f7eaab35ab0
SHA256b8a6947ff9f6db25e5a6e1c68a7e92982d3968ddde7d28805d426539d4ef5265
SHA51211c3a3b986fc4758225034456e18a490d0754ebf87a4b0965cf4d962c1f5912a0d6935971b8a892261e41becacdcf309afdb495833218a16bedfe086a795b2fb
-
Filesize
5.2MB
MD5a485fae2d62334006ff91494c7b64b26
SHA197e713fc163bac27e50ca49f5ec0bbdee8221340
SHA256dacb2c86b470ca02226892aa5d1a582e8ce592f6e3d361122f5da7de3bdbae9f
SHA5120bc24773e622d9d15eeef08a4dfcfaff537bf742222cb414f2eeeed76961da1f9991d362998c36ba880daeb286c957a872dd2641c4f943e7a50c340648843fd4
-
Filesize
5.2MB
MD56226bea3200ac5d806ff85aa8dddf600
SHA1289ad8029862e1a5b0289cf14e765212a02fe516
SHA25602cc2152fff0c11233ae90c6046542f04e7dbc324506c230c64cf51326b264f5
SHA512a57ea5c68fd460ec5dd9d8542c75476a3993c503476b84cfb575ae1fc047c700f58a5bb3f8083294f3cc2337f7f6a9485f9919cb16ea8b39c5e603d21f4a638e
-
Filesize
5.2MB
MD54c07b24dd5aa3d31b30fb537d59d6b60
SHA16146703df2ee1464d73bf5581517ebfed0367195
SHA256fb3577e544624acf6bd7146c36d39fdca3154531f966f315f4a5eb91133ea408
SHA512fa2a3fc741ae39445f355598bbca883fca8ff34f1381a83f2094be99beb8994bb60dbaa8dd62e47eca91e8f5db072a9c8d8cec32f51df92354622057e684ed4f
-
Filesize
5.2MB
MD5d7ee33b6c8d9fe8dad08b599c03c95be
SHA1909944b7b495e528bb7c048207b925a0a3132419
SHA256469f1f3f409a1f8e3414a9c27271a68bc974432b658a700c2b20faf555d47a09
SHA51249ae715764d3a0b16b3e8b32336ad8fb41c7bd00036cba41475892e6cfdd7a1e110e324d80075d533461c280934ca771b74c2bc91964bfea31db19005bfe78fc
-
Filesize
5.2MB
MD5767ef288f75e2c750ab44d4994078c9d
SHA19727a6c8d9afab84c282388c147124ea340665a3
SHA25616e28bd80addead1b5dcf758aa5b3dacda920b89e802b26a3f89f73a92bb7bd0
SHA512b8efe93f2dc338f13db1c83faf8444fc55d6a6ed5a5b27346da8979bc7d37f07b6c7a6c8e02f00f39b341dd0640b1fe68ca6e73409cfdca7631335ed3b55dc32
-
Filesize
5.2MB
MD5627457106e406dac25c9bf12257e8b96
SHA14960322200c5ad3500e3701230affa8c24eec9d4
SHA25635b46a8475db3581b4ed40b341d98d3677d319e47409da4c4c0191808e554bbf
SHA512a5769d27fdaedc17bb01f5d3a6d874cc21721062d38d2e7fede1c2d47a7fc2da05cca5236f0d25732e5a05e0178064a82357e85c55ca07ba71f9249499f2ba4b
-
Filesize
5.2MB
MD518e12dffdcba68cbfa531fdaa4b3939f
SHA169361446a89f396cdcbff298b53bfba9e827abcc
SHA25670530aa678b0911cbe33c699f611972334df31b842ce63a620b45e71dfd176f3
SHA512a82919112b6294072b62147fac75a411d3e2dfab0ae1b08ff84ab01572378075f181c8551e7078551ccfff340b92a889680b8674d1365e74f76e09d3231ddb8a
-
Filesize
5.2MB
MD56106f3de1ae8282d1bb6f8d473ed0c1d
SHA1d6a5fbe2e5be5bb5c2bd9bf8ef4a809f4c9d0a53
SHA2562308038cd3eb074e3a192665b1930dba582b9e581393ac9a77da4ab98d3ad657
SHA51206c44c957577e7f06306ef817d28b1b775d6b087fd758f56340bd5ab4743e03447229a5480147acd65f17bfd2a48e4102888ed2542dfaeaa52ce51c8176c0901
-
Filesize
5.2MB
MD5b3b88265090a6d7d6c8a5ab0e68f7ec5
SHA1b90742d9a82de222c7e0f3111fc8b5c3aa2b4f09
SHA2562d1d588f21973132c38870243a4f4747be1699ea97a35bb72e405966228420c9
SHA512768d24ee0c2a12dc9385fa77abfc91cb01d92e90edbaa110f929c31984268eb3b6c2c929d9e00801b7998aa84e0e0a84c16fa55460840313660cced2a7ccdc43
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB