Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 02:45
General
-
Target
2024-11-20_41417e29135f4e7f95970a163f87ca6c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
41417e29135f4e7f95970a163f87ca6c
-
SHA1
123c09e91e0fdff4afac1a96ad0b4952e280ea04
-
SHA256
77bdf30a3d17efa47d9ed0bb786e84f4223adcf6089e9bc5b5fa91a7becf7b0c
-
SHA512
4596db4f0eea55f3cef924816ede3a1b55622ac5c325c28f474aaf20698bdf0dc231f3ee0ec95d65b6c852eea2eb780f19b80acf05dd29cfd3fbb223bba9eb01
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lm:RWWBibd56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_41417e29135f4e7f95970a163f87ca6c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_41417e29135f4e7f95970a163f87ca6c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OIjHYbT.exeC:\Windows\System\OIjHYbT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZdxzOh.exeC:\Windows\System\MZdxzOh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iikfmsX.exeC:\Windows\System\iikfmsX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmNpxuX.exeC:\Windows\System\CmNpxuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxXuhCs.exeC:\Windows\System\lxXuhCs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tShJleU.exeC:\Windows\System\tShJleU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EjpxgWh.exeC:\Windows\System\EjpxgWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KFjzTKx.exeC:\Windows\System\KFjzTKx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lDiLIuv.exeC:\Windows\System\lDiLIuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CNhBHdh.exeC:\Windows\System\CNhBHdh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SOysnIi.exeC:\Windows\System\SOysnIi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IBgtafK.exeC:\Windows\System\IBgtafK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JpWQWLd.exeC:\Windows\System\JpWQWLd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BHxIrFC.exeC:\Windows\System\BHxIrFC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CPLPSYr.exeC:\Windows\System\CPLPSYr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NvZYxtG.exeC:\Windows\System\NvZYxtG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zmSAKIG.exeC:\Windows\System\zmSAKIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYeolmN.exeC:\Windows\System\xYeolmN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRtkeNl.exeC:\Windows\System\sRtkeNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bSVRiDh.exeC:\Windows\System\bSVRiDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VUNhGFX.exeC:\Windows\System\VUNhGFX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD507170837f51ba4d3a14a2b13bb5c02b3
SHA127a805fa7d0ad36cea36bbd0645373717a9ba44b
SHA25686ec386e19f860bdf799ee33d2a9f7de3f55a101d9d9c67d3cf584aa910fbf90
SHA5128dce176ab2ed4ca0a73a616e96bf47592da538d81862044479d0a59cc2c6383285bf0ebda787d13d034ad119c0e30ffacf7b2ebc6e1905c704a61f614d8a903a
-
Filesize
5.2MB
MD543ffe57cc903a98b0c1c5e7678b4d095
SHA1536d41d72b83c0fb4aec6d09a61de3730e6a7740
SHA25618d263b2b8d9d90033d702321e509b5a17c6f4ce46122ef17c685e9b9fff368a
SHA512d99ff73233801aadd027fa368d7fa358b94f7f3c8cd220bbff65d123654660edabe17928293c637970bdfd8efb83fff791ca7c995f51f5c4db7a7270ca1c1eac
-
Filesize
5.2MB
MD59c912351ac0ca7b75d017ebcf8ab09f1
SHA16429e15fe25661a48c5bf3bd17a7f0785b0ab35d
SHA2564831b630f9b7f71663ada93230e087357b89fe0f7531d61af12e6480a9875714
SHA5121900a6fc2bc000836e699635329bcd87fb851550b05e089e74351cb2b67c02b542450b11d3de1b245be6e16b4392cea886da7981f2e82c65e1b4a31f0c1a93c5
-
Filesize
5.2MB
MD5d07bdb965d07ce6376d505efd46b155f
SHA1a750e7a675abeb3e54caa0a2efe38a7171e39b73
SHA256d048df46b7ff586482632919bba0ff76fc5bb6a102ffe791d0feb6bb3de34fb8
SHA51282bc325543982513603ae530eb3f9c68dcd0583a260af0f91067116aebe3884af6ba12ec6972cca837aa795e6e4ef255fa9a3b62e37f2dd7716c8db14c7fa637
-
Filesize
5.2MB
MD5989c7956bc4dc5885310971897a16975
SHA1b82b1c357c5c9433d2d3b593c723cdf2a71ed3c6
SHA2562a26b09b660ad34140467507023246ecf2217e1060dd52a6b73f80165a6477c9
SHA512e5b7186ec49f50ea3fe9ff9d53053aee982198dfd9a01b53d7d820cd77228c2981a7756e98d71c252141fb35dbb8deaef5465ff377c567165413aec9e23def2c
-
Filesize
5.2MB
MD51545baa367b8577b83493687093e4e16
SHA1f25b5488ebb75766c56b070f91dcb657aa3086d8
SHA256404a3848ad3ae7a275b9601bbc8dc662352b28a08142053e633b646259535540
SHA51204828f1cb7b0c60169cfa24b63ef424732464880a3511f77a14d45b9a95d885d9e5ccbd86848afbd7a01d244887c97eebb55f0a1daecb2ceecef19ca2fc42f9a
-
Filesize
5.2MB
MD5e74988a2a3e23e0028ad06f3686c0e8c
SHA1fb524eddc5bf93e8bff8492c9766e5f7e18fd45d
SHA256e890b7deea30a39d49df84ba3bba78d732301e92d341dd62b0a781a985af50bd
SHA512e4749ba42168a8bd142c74cae51a2179ba4bfb57e1b95080460e094019c481ac5cde0a7c776163af292c86b717ed451e4e3c7b65b162deb73cec97b33bfa28e6
-
Filesize
5.2MB
MD58248616b7bdadaa18f7d489a161f018e
SHA1ffd99a543e37226b1b94e72a200427e97b049f7a
SHA256a61c6d2db1dca8f571dbd3676e3d36cf24811772a70482605e864324e385b1cb
SHA5127466a333caa5a2524b9b703f076547b3dec27c3fed88b32a5c0d6f1fb05aca9e9e8c4b1a8b4c98197375f964b5653d88241b73ed2a0a5886d5b689232939aa9a
-
Filesize
5.2MB
MD58dd25f50e294dcfb157c1859edd4434e
SHA1a93865b39638671c81430821668ec87f1686f122
SHA256699a7ebe43f213283d7e1b8d6f9daf190435b96ec15f2da1190b6a6e39125aa9
SHA512bb1c57d069a5b8ed03728b854be236084eb3ec40b46c2f75096b8d7883337fb6428fff542322ccd8e6f62fe26a01fff358a24aedbcd0fb9d142ca06376050b0e
-
Filesize
5.2MB
MD5c9c3477918695af48f25f7f132d4250e
SHA1bc9f95aff08f85c392fe2a09b88e52f0915e5eeb
SHA256c078933089ab003348ab062940c81eac76b0d00a300a432d76f6cc7ce1f2815a
SHA5124642a932953bedfa8ceb124b4a58d3f45860163715778e76fd04251c4014ec602eb2d498df9fd92f20c2a78dedf85ba808b5aa84da975e9f4dd052a930e4165d
-
Filesize
5.2MB
MD54f0829bd4b5836042aec9086ee4e5ef9
SHA10df0508b96ffb047cb57cbc2453a4428bab6112e
SHA256baf85ead54c3b25bb3ea35fd95bf4b074cefcf06cdb404d0e48fdf4837705ec3
SHA5122a3e726df3307db2ec955bfd8db33938b23d7110ca746bfe8c0ddab84769f87810d09e59c369fa0be8a84ac40787e0ec8613384f68fd3b193c29665713fec4c0
-
Filesize
5.2MB
MD51e141cba32a10a0834befaf137328157
SHA11a89d0ab48097b215aa437d81172043e5e952f99
SHA256a71a53bd6972a088915b43bd5797e8ab3a5b496f6800d24ed8bb881c60b24b18
SHA512c567da94cf35b674295f397820dc5ac034787753585ebb8db936b2576fe90f70353ef8cf0027bcb7c50f8135b3ce514cf5904e7178a71c3150368c5cd8f8b326
-
Filesize
5.2MB
MD5dee667a5495a194a33df76171e13a6d5
SHA1833c8bc4f4e013910e02f7d30dd37a71f447b880
SHA2568016a78a1aad641cdf42f6b9dc9084fd3faddc4d49351ceaba54f9c4a6409e76
SHA512d0381b990181339dea49357716274962f5d7de5fe0d7660396f495ed85e424a9723e37861f16ff9e6803fbe9dc4838e48acf1818c83bd6d4a37f5909b4fb9875
-
Filesize
5.2MB
MD52ceed98f2fef42ded55c08976c80cc02
SHA12847c223ee705971e9ab9e19fea6037fad7f0b29
SHA2562790dd9f7e986e00f49458eafa398f78cefaefc4ae334f707a2c14e777baf995
SHA5129ba99e9dcf7a3dbc91800dcfa14de9c18699a84b641eb757b24ec84441127daf74d55a667ee5f26ddb6dc8ccac4b933a0568a9e725bb20e2c5f24e09ecd9b59c
-
Filesize
5.2MB
MD5e887fcced9f30cf2b30f8e7d13eea8dc
SHA1b99569a25ccb5437be463e327cb9f56c02af61e0
SHA256c7cd6eb25cc1acd18f5e65459309a85bcfdf84c90c630d11a89d53c94f9e1fc5
SHA51237412f043dc5c5b6703cc84df1c235887f761da15f7853b41178d1e81e102ed220b254ed344cdeb54ba80741e7b06033e7f8704f203aab2a69cc72a283717e3a
-
Filesize
5.2MB
MD57297292252017e953050298a3dfd6a00
SHA16b8fcb2c01520f1310b6a29a7d51bce052e1c027
SHA256f1bac0ec1e93ed4e4ff548ed7df12605c71554e0b4889ed5a0d64c02bfc49e39
SHA5120fff3a47536eadc2f5aeaae54d89e24c345f1c22050669767767d5c1333ef71f70d1106aead3025147c02cabfe016fa80344a2cd86abb45e47b08ea5fcece7ba
-
Filesize
5.2MB
MD5c1aa75815cf47b685c99a55d5d6c90e8
SHA14f4bc478e4a0e56176e992ccc2c913134c59e2c9
SHA2569d2dce9f786fb88514243152f38f2611fec4c35d4d30f525798bfeeec6bc10e1
SHA51224378a763d5002b48a094032e76413236d59bda05a029b63fdd41252dd8a5e234873b8f7aa0adbeb1b8f5d6e720920e114cead679232be9066d8da3dc0a70920
-
Filesize
5.2MB
MD51517d5ca7180e12f7c7c83d64403948b
SHA17daf3de8cd17182058e96a2474d524c2fd9a6fed
SHA256a565afad2a6199f5cddbb0cb0eb116fddfb06c46b4446f949c011b267ae489d7
SHA512d9da88edc7501284b4eae121c3c0173c9ef235fe2c8dc193dc263303ace9fc89a959c5cf0d224ac360fd1efbddbc30c6e98c44c243f34d6323eb0e8a45360bcc
-
Filesize
5.2MB
MD5b1e99b791fb75710c5932d25e27a0f6a
SHA16d6aadedba5026f69841a66fa3cb09f859e5e448
SHA25617b3b80bb7d967d6cb814b4dc37b25a353c68ad27c0dcba1978ca35b1411ee73
SHA5123fc65bba93b42965bf5ad4d32db8bbec296a05b70862b15b56e78413b6b7d99481e6a62dc2aee131d5e21332151ff0a3df6612da824945ea094cfec20d22e06b
-
Filesize
5.2MB
MD5811786ba051cf508a8a876cade971fa4
SHA1af997c136c77b0f4152875d9e17dbd91463d9b42
SHA2564549074d6e838387ae02e42d81afec5dc8fcd22e3c2bbcad9fac4bf7df34cd58
SHA51218ce88dec592e19998aa54ded62dccab6c311459e4156c053605eadca9870cf4536806aa2dc7360d3925d7a2126dd27dd920913cad4fcf367102098b084f3e26
-
Filesize
5.2MB
MD512e9ee0d0a9b1570b9d5ccd82a30e744
SHA1eb694dfee2f06e8d4d75cb2c81012946b5ee0887
SHA2562ede6d7642d8c47dfb3af3f50b0129172ee302d552989007eb3c7ae472f798c8
SHA512bf0a2d883cd4d04f4dcd66e51dd1d7730519130adb1e506f8c832fc267f3d2171bfff94d286bb57f05cfe6f6c106752b1780570eed4aec5e90c98658b09b5d43
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB