Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
20-11-2024 02:44
General
-
Target
2024-11-20_27eb0f5bc3c0ec0c074dc8f0f92b35e4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
27eb0f5bc3c0ec0c074dc8f0f92b35e4
-
SHA1
b63c8a244ba6701fefdafaec97e1ee7bfbe9bcd9
-
SHA256
6c9682f9e441d85408c1d77da6d564f36c25c2b194029ebae78e51d830f2a3a0
-
SHA512
aa9f77adc960213d1fb4b979f1c986cc2e46a0db0022d5d5e133534a5476e185bd0f51733caf0d72777dbba426ab050928fe9b4fa79abac54aeb77190b8c1053
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibd56utgpPFotBER/mQ32lUB
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_27eb0f5bc3c0ec0c074dc8f0f92b35e4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_27eb0f5bc3c0ec0c074dc8f0f92b35e4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qdoKkaL.exeC:\Windows\System\qdoKkaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\brRkBRN.exeC:\Windows\System\brRkBRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jlJWAGY.exeC:\Windows\System\jlJWAGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HxzBBsJ.exeC:\Windows\System\HxzBBsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gvnPAxQ.exeC:\Windows\System\gvnPAxQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TyhNnIB.exeC:\Windows\System\TyhNnIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nPCuHey.exeC:\Windows\System\nPCuHey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKmjxHt.exeC:\Windows\System\hKmjxHt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\weifDOs.exeC:\Windows\System\weifDOs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzqPeMv.exeC:\Windows\System\lzqPeMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fgfpqTV.exeC:\Windows\System\fgfpqTV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evEJMNr.exeC:\Windows\System\evEJMNr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YRlVxOK.exeC:\Windows\System\YRlVxOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eeJwFHh.exeC:\Windows\System\eeJwFHh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUcdxoy.exeC:\Windows\System\FUcdxoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eOzMnzH.exeC:\Windows\System\eOzMnzH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BIpzmMa.exeC:\Windows\System\BIpzmMa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rGgUFlm.exeC:\Windows\System\rGgUFlm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZqMwuHB.exeC:\Windows\System\ZqMwuHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MnautOw.exeC:\Windows\System\MnautOw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cckOcSG.exeC:\Windows\System\cckOcSG.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD583e8f7a14ec0a35cc0ba18091217e64c
SHA15619ee34f4b8fbeeb8f93c910f380a38a823ff50
SHA256b6aa89b08d6c43f0e5a4c4e846296e54b401c433d7df9a0b329507c24481845c
SHA5122ee7724c4a8e7f058c94646d73429c6c86393c5c183417f04cffde73fc03ca5b350ecaf2d7791cd2069de97c60ca221776fd341e43d53ef74c9920f9e4d80e47
-
Filesize
5.2MB
MD5788825dd9165528074b962e07b178c4e
SHA15346491e34a137d1f455877ea2b7b922f37b2666
SHA2563198662c3fb1482bd30ca856109f1102170caa2f58e1f6c961531c1e1b9248ab
SHA512b4f15a8185d25ddd3b4c56bcf0fa02cd42b025534bb743fb265a31b32d96b5aabd6c1e940484327be5b9d577cb3b14a8809be905a8c08fc57361c4975e8dd450
-
Filesize
5.2MB
MD580c9cefe7d0700e546f60c8d6104c045
SHA11cc4ae17246ab3c641714a539b4b30c951051011
SHA25640aa6317d24b2a5e6dca0f239723f5b6f3388dc53b19bb832c19399f7aa9991c
SHA5126c54be3fa3a089faf0512b0c2853d117ee9b8e63f654db24528ab8f13988afd48ceeb5a0315c211147d177e7111554a1c0fe00734443ec0ff91510486fefd0e0
-
Filesize
5.2MB
MD500f05c86b8d6e6052dd3d38990768a91
SHA15b8a96abd744e61e46787704922a594e2ded8a1f
SHA2566d1241b9dcf3ca2a841af23c5ff79e9120d7b8d60b92ba3bd35bf6d7353a3e6e
SHA51277eddded518f16cc595f73d1841d15ad65d429493d1fdac7ff6ab23ab30bc47cd25ac019e3d2f172b052dc7496fcf4e3a521e0bcd123bac56d9e995ca0db3642
-
Filesize
5.2MB
MD540ea6696aab2bb962c8ce858b64157e4
SHA19f412298c8a898820a5eafeede70d351d493a8b3
SHA256119c81f72c488d14ce664a92175243d5bd06ab58a4b70a8001b9027e00dda67a
SHA512ec39a2700639f44fc1b98d4175c272f76191c6a80a4047b3a5038c6b85008764aadaf4318eee2241759e68313373aa7fd123d69a0183ea1a41bfb3e5be56d91a
-
Filesize
5.2MB
MD500d2771901e1260d16f1f3b560f47b5e
SHA1233c304d20aa3eace62392d2987c5ce88be76a25
SHA2563b8f20d75024b2fcffdf000aaa1ae01c4c633c3d3c4f5a20083895052dabed7c
SHA5121a1aa59b92dd13cd23cf4b1feee269ace5a4ad394f6eb46462648670d1b73a1f4f2c401d2f39a27170d79661c76a3a19d08fe7de7afd12f99d8d6d47a4da4ebf
-
Filesize
5.2MB
MD55ccad6a7b0e2f674da1637289ecf7274
SHA124a3289b5e4bccb9250beda968ab9d90730dd0c6
SHA256e8606b156863ebc703c8e958617689a85a6abdb6eaec23c155d5984c727213b7
SHA51296e12a480782202fceda65df8e7fd20a2f681bfa9c0258ca2d8bbe846cba0ba397c36b97759105059a66a1b9eb76b0b478c265126a9b957fc1888e50028f5954
-
Filesize
5.2MB
MD5af8437bd0f0d9e2daa0f00a0d4270266
SHA130f9c2dfc3917b424f274b4d98a5b6be702701f8
SHA25683cedaeda86cc630d8f53250d280174f7939f1765430baf78ddd9681aa1e9673
SHA512635619be29836bb5d0eeff6874049a0c58c5996cd3204ef1351aed7335ca137131787e82aa0ef4c201f37fac560a3eb6eea3f22792b6c8dd0bdce54fcf8cc110
-
Filesize
5.2MB
MD50a212162092c16d88de767408740c464
SHA19201f94f78a7629c1c946e10b3ed322b2481f024
SHA256c4f4342b881de8298ccca24b787cee0c6b548febe995ab7f345f2377189bc599
SHA512eb98ab35816b8abd49a6fa327eee73bae5af16cca1ce196f13c5ea20d0511f7b18aa7b98ebe6c4ddfa02e1f140f4044524cc30dd78a8986d92dc527afafa8dbd
-
Filesize
5.2MB
MD5e81634cdf7d508590d3d83cfa52a3533
SHA176b8ec4e15ea5e91da4813f10fea5cac3eecbf31
SHA256e78bdd4dc42cad0f5dc9b0a05bd020c86bf9aab81594d2b4061a461f1e39b2d1
SHA512761e3c8d7949aebe595176a885572c8751fd4d7d0b46fb2423e5e02237f48443860bb008ed4c45ef7dbce3cfe77e5c0e62eca8675f9638822523c2bd9f8b1a3f
-
Filesize
5.2MB
MD53ffdc7f6b9a9d6a07462ee5d536fffc9
SHA101e964706689ae8b996d5be167e74b57e538103a
SHA256375c7e491f91449fcf4cfea942a7c3c6a4e01a36b927b2189e06c81213a0cda9
SHA512dbbf353beac984af4ebe165130d7b1c8666da1da6b37aeec4a996aefd08a522ea3dd191b1c6bc16ba2888023f84f638501674d0600e04d991d5b6bec3336001a
-
Filesize
5.2MB
MD5d67998df9a135fa5fb9c307d622e6715
SHA158d506de8e3e6fdbb9112d8019355931855bdffb
SHA2567f171ca22693a37c8ce3d4a332d917f95f5f859ea20766a65e24f86966f73bb2
SHA512c2e17385aaec59b601e09c9ef1b989b8010c30a3a5a509ded98c1b9b888d075e4d8eb45292bd4c5f9d2cfb2a11d387a980dfce848850467941b29be3b581b25d
-
Filesize
5.2MB
MD54508d524a27d232792066b394a8e5cb4
SHA179eb3b4011b36d2d137b85fd27bf665a75eff543
SHA256a866cbaeae85553c0b3d5cbc4c61c930203af0f47f1d396dfaa2ce08283d3566
SHA5123146bf49f36b504631b9120b517e8cd1899bf13fb99bb8ef4bb362ddde3653b2fd5c964bf4666030db61bf1f8a5991157ea1240a576b10ecef0f7eaf3de15d3e
-
Filesize
5.2MB
MD56616012ac2b5c6f3f482752c03fdff89
SHA1924839ad8065e2d487fbb36abc3c77bc66caa50b
SHA256e0a3047240de21d992a4122ab22c82dbf760d164ab4ec7500899a1af7cabb54a
SHA5121ac4c6c237cc0edda2e3950013ab9bd75b0bb7b48d3eccb26db83a0af47837f94e11339729647854f90274dd8f3ddbf3aa4d80b6b70fb60dc454fdb95df9922a
-
Filesize
5.2MB
MD5f56a21c68004278ff250f4fa6449228a
SHA14cc6c1a781ebfd4e66041d917bae181e932abfa5
SHA256344d7a0502afb9e53cfc0ac3e5135393406fbe4d1e0c949f79b49109c32603e2
SHA512e46c7fbab88bd454a94175e04982c979bfdb9b4ad5f9f33c0e178ca4e15a05eba127b7234a9088bb8cb05d459a7be7ce77859112b00438203a1f749294ea6e1f
-
Filesize
5.2MB
MD5dc9eb083cb21b41e2cbc047c440b04e5
SHA16ac8b69fadd2fa9e60fe7feae3b1d519dce7553c
SHA2564d23d6af100b86f10b31b8e817b88abc94debaee23cb7bc868fc4780042d40a8
SHA512379e417ff4e0d4e3710948f2330190831c4a05e9fe4cdc0be5279ef03d94bfceacc5c4a7627333999148372224ba533e8bc7ac5b6965c96cc53414beca732998
-
Filesize
5.2MB
MD5d16c4a6671574ca2826242f124d4444f
SHA1623d9e3513f3a9beab1250994a0b0f82e76e57a1
SHA25689c76168aff85fb5684552cd55a7a36b347638a3d2f35d3a5e8364d6fb14b8bc
SHA5122c6b7b49f4385b5a54b6ca21ccee356699ab020cf990b3b2e0b7702c89496c49cb79ebc7a082dbe839f3c2983836ed6d8fa31828ea158d2b72e4370e19d42ec0
-
Filesize
5.2MB
MD53d2f4a63655d6389494caab4ebdd2435
SHA10a3adc7548268e1984206f324c1b97a2cd50caf5
SHA2561f90ce65e648769c1b5b0d403c645b7555828ca18523dea6a43b420409ee1c2b
SHA51270d1acf6237ca0d587a75e8b5ae0d4900c23cc78b20400886d0cd99398abace2a37900f99197c1d0d4866a542e03f42f5195f77fda7269b9c9c8da8b09cb3541
-
Filesize
5.2MB
MD5e2191c3fc2cc2e3ceeb5d2f7d4b4f658
SHA1dedeaef4d95f71aa7fcd6b6f0316bf1e45885a19
SHA2562d9be5f4ac4fd229fc84931eff2625b846c1a830e2e97b0737f82e3b8292b628
SHA512c95a12865a35c0c35cdb98659a48d5879f5e65a1c1e12d415dadf227b0f054cdb177c395d19d33ab5b52094aead5f983e00f720df4962297f6873017ac6ba900
-
Filesize
5.2MB
MD588e989c02133965fb621909115e40a42
SHA1c9a9d58cacee6d0cf7755c27b81e3b3416c61f3e
SHA256c353a37bd90b819d663c8ea44675d426a58ea6fca941f16199ced3cc6ed7bffb
SHA512d89e1f469f461754893dea0fe2cc84089968ee86419ac5b267ae48b7442380eccf83fad393bf40902f8ea449fece106b9df2582f423ea36a283dd2e6158aabde
-
Filesize
5.2MB
MD51ea247bb33f629a393b7be620f45809c
SHA1e9788abce9b14e8084d3af6f3dd215e40488eebb
SHA256d591e3417193063465820ba2e7bf58fd4fe25aa090b40ac78b62ea6122c12e3a
SHA512791f821bb0912d2917fa1c40b63049a51057c23f9a6f6780ddd7169bc44fedb04ca7c07f7c020b2eb26f8e80efc3421e1661abcaca9ee4c93a516a1381ff6028
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB