Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
20-11-2024 02:46
General
-
Target
2024-11-20_467785aa9694cc1d76cc41d6235e336f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
467785aa9694cc1d76cc41d6235e336f
-
SHA1
14826bb8b5cd88b8cb0337e4a62d900dab8af709
-
SHA256
b1fbc2fccd8930a6c69e1d5736c94acd05bde2d34325ea04e4df76ab2688ddce
-
SHA512
206fd2d2e5215245a67f4f09aacca312ccedecfbbf391b090419f738c127366414b70b019a7294ded3bdaa91102bb1105de946002eaf0e646c726f0091627297
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibd56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_467785aa9694cc1d76cc41d6235e336f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_467785aa9694cc1d76cc41d6235e336f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LCejurP.exeC:\Windows\System\LCejurP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcnzwCp.exeC:\Windows\System\kcnzwCp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mmHYjya.exeC:\Windows\System\mmHYjya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bSAZbjR.exeC:\Windows\System\bSAZbjR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyHPmSo.exeC:\Windows\System\oyHPmSo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bbalIEp.exeC:\Windows\System\bbalIEp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsIKENW.exeC:\Windows\System\PsIKENW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kRhUNEv.exeC:\Windows\System\kRhUNEv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KsXvvaz.exeC:\Windows\System\KsXvvaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uQVtxwR.exeC:\Windows\System\uQVtxwR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LDNBhpU.exeC:\Windows\System\LDNBhpU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UsOCoSs.exeC:\Windows\System\UsOCoSs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctnScQv.exeC:\Windows\System\ctnScQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lAlKGHx.exeC:\Windows\System\lAlKGHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VSiDHaz.exeC:\Windows\System\VSiDHaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PodAWbE.exeC:\Windows\System\PodAWbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dvtXZhk.exeC:\Windows\System\dvtXZhk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJVIGTE.exeC:\Windows\System\dJVIGTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QCLfFON.exeC:\Windows\System\QCLfFON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QolJqZt.exeC:\Windows\System\QolJqZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZKioTVw.exeC:\Windows\System\ZKioTVw.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD594a26f4aea4fc6f23fb34557079e455a
SHA1687ac0b5777daec29791f0c7a0e0f79b7a023eb9
SHA256871aa7940ee80135f1940277add5618445e8cfd273a2a9610067c37e22d660a2
SHA512c9c7ddbb7a1ee78caa9e6cc8fc4dba252a9b57a7e4d18efe84e7ab178e2989cb1a75ea0d606433a93c286ea8b339fdc66abdf1d2c7f50226eee568babc9a451d
-
Filesize
5.2MB
MD5af046788ab45487675ac45d1a1fb16ac
SHA1854fb9c8f122a48584f1fda7e548a47b5fb3ab51
SHA2569fb9e35802df5dee45b807754544462ce1c48edb92d788ae9d6bf28f5d27f483
SHA51224dae5641a6394e254060070cd6e92fbd16a6ad2adec960aa44194381f26a12800b3a88b0e82a6da4c1aa4f3002a436d3d1f422784dfd7a1d82b710c892fea87
-
Filesize
5.2MB
MD5b883a60ccfe9018fc8aff4d0a56a83c8
SHA1219331f81a528132355bdbcc82f3a6a0f7634f65
SHA256d7c288e96ef11fcb0dc2ffec18828065ef7187371dc0c8efa60242b4c9bd11b4
SHA51233578a36c1fee6685b23fdb5b87ae932a081e1a72c29197754f5c5dcac840f9a37e96d2bfd0e036b72872ecf20c146ca22e9f96d5ff2eedd3716c89727effc46
-
Filesize
5.2MB
MD5061c41efc4f5707d6fcc3a4816c4e995
SHA1f3c457df7dc2afb0c5c65484f06c186d37fe04cb
SHA2561945b7fc8c88dbe2c2393f514a83c30be6cf0a820f30e236720eea4c75642d4d
SHA512fcf0f7a3b37bf040eea4d1ad41a439d771fa7feba259e6fee108fd15034662b8603a4c5d648384bfab368ced793205107b7dcf33460f8f5621fd97af9d3d6f69
-
Filesize
5.2MB
MD501a7ed84d28397153814ec3c6faa6ca8
SHA1dc4a47679331ff9b3c27b5578cb33bc2fb0e1628
SHA25637678753b4c456fdb2b6e2a18076b40174624d561c221d9f2fd8f60c107317f8
SHA512bb7675c6b7047966fd0e4e04fa0f2232b7b59ea4c02ebf550fe05191bd2523933a747a5c46def21268e078b98ce6e28abb17a97d8da1d1d9bceb89c382a965f9
-
Filesize
5.2MB
MD5532266e091a52b2a0fc71b4554983550
SHA1ace6ee68b1154025c240a117127d9c00caaa6281
SHA25664e0e1758612f8c79608dd810b7562c2888db47066b660b3f8e3eb51761c38be
SHA5125bade213e0fcc6ec9aeaf6a5694b22014b3321ffb61565bbae72ebc3f42bd5d379d684deb2c7fa429300f42234f19cddeaa71825a4778e125e90fbf49260ef0f
-
Filesize
5.2MB
MD514c4fc5c8f59a3cd0fd50ed8bd943124
SHA150dee4810da9501a4c55d3cd451a6210a5d3a053
SHA256f18c7ad755a2d0443f38ccccdcbfdde962f6ba54dec67119176cb887b21edcd9
SHA51223678cc56beb96f8571aa21bc9654913a4640b18e2f910ba4f104dafde436ea01439064cf58595b1dcb0bcb1d4b7350ab3f68963ddd5438ebd0dd1a34c0fa27e
-
Filesize
5.2MB
MD508705ad0c4a255453ceb6d95785e465e
SHA16e94f2e5c1b8bcdd6dc65249b81bb979fb247441
SHA256570c72b9c703cec1adf5dcda375d5062fea8693fcd6e41e123640a900d3e11e6
SHA512011f7ca80fa55451be1d3eadea6d2d5bebfe2830ccb639a40fb9f421a392312d393ed52d4ef7bd825089f123c7e93e8b6374840c35f1d8e57b598b8051dac339
-
Filesize
5.2MB
MD51ff815a37d276b3469440886042df9d6
SHA19eb881fbc7dbb61a5ebc353e3c152f38d05038c3
SHA25671d2be30c39b0dc5a631453ab66fa89fc667198d8e87ce136d9d57e027986c15
SHA512dfe8131caad9c5dd0f91d0a72224751d33f384695a16eba71d910f724c96a0d2751077287f05dc3cf9c4223ab3b78e58d4c3d0e08b978138dd17709c40e9d3c7
-
Filesize
5.2MB
MD50e3256960cc2925fa8fa94196047330b
SHA13061e8b6bccacbaa4776cce043900d1f3b7f7d3c
SHA2567130f961ec51a0964b177209080ee95c2f922820e348c101ee7e20794be985c4
SHA512933e684d3bbf4dfa493506b50fe44262dd131fc121abd0badf99a71a24b6765c122ea49ddd223b3ba531d22b06ea02b8123c5946c95324621754707ccdce907b
-
Filesize
5.2MB
MD5dea5e82624f2b85cd2de5a5785555e5b
SHA1c3fb1b50c86996fb5ddce494eaecc35c7c1fe82f
SHA256e75471d825c049be8a5572b5843926bdda2bc27e923ce04ac4a5c9d01901e59e
SHA512586dc6be6cd9cf4bec068b152d9ad30ac197dd6538c595de9426e6f69e3f024fe9119edbea5abf04933c46790eef4879d2078b3ddcb55596248c3d7b900ae7a2
-
Filesize
5.2MB
MD5e47fd257afb4253d8ff101febd65f978
SHA1de50c6087665f8117efa30e46d6c72cf45ff76ea
SHA256b0f87b13d26571933b093adc0eac557b13cfcf50cdf334d89a4fc3dbb2417701
SHA5128c8a967c779f4a62d8c4751babdf9397c1186c2c5be04827b5dde5308732a19dc4c6282282c70c15fd9562136db1d9d13b332ae3e5ff741079c67bbb9fddde20
-
Filesize
5.2MB
MD52dfdae615b04f81c65e7054d3e48198d
SHA1a8d6fcbbea86ee9a2289d6845aa56bd062b18a4a
SHA25627bf1e07545c80d6cddd5ed37e4d012cd3c03cd882ee96fa1904b3476144b15a
SHA5125cad9926e8d0d4acd04ea0a3ad11a081a1c1509677b0a185b5d1ffbb01ef599099c780dc8170ccce90a814c27bd855e6672780dfdc26475f99ad3ca458b13171
-
Filesize
5.2MB
MD59e375615fb3e040c2e025c541db5d4a4
SHA129ed2e33201524a2813fb536674f471721439411
SHA25673d5cee28b37456d29c599c060f8c3f6a7537f6e644b140af04cf8cc9574a738
SHA512b76717939c809a0f59eab7c963909f37c1579a4e965554ed05859e5f0ad0a0feadf63a6035cf71ec06f5cab21ea74ef93289767d7f3bbf34627bbf830b307c60
-
Filesize
5.2MB
MD5817586fb2950178ef355461a351d4638
SHA103762a90857be221b1959502b995ef6dc1f1ee07
SHA2560abef048a0863d16f066acba749f7c2d48233b7437c10b50dfe410240852690d
SHA512a17d709cda0492a77d69b80fdee0d59b9ae78dd349f8795ccf933355893e651ad337d86894a612cb769cdf49f2f3013c184334c33c645ead1622d979ae0068cc
-
Filesize
5.2MB
MD5719551261ec20aced458db9056992663
SHA1605b4615e36c5fbca5ee686c1ed877dbe84f8a5a
SHA256c2fa1ce2f95cfbaf4e23696b64569e226d8511e4e1e2013fd476181a4a91d050
SHA512d950420dcfda4f49146d9078bf598b661f833cb7a189381c45423646fd16e927e3c505d598369ac3760e467dfda5fdd7e505ec728523fb8c43e988e2093e713e
-
Filesize
5.2MB
MD53bc7eb1038e140796e756499a4fd858e
SHA186150f7a32ca68a9738351b1eba86e1e125b70bf
SHA2564485b27f45e2f4fd3402862649ceff46d58450fc399bb8b2b8e8704c9a2da27a
SHA512149eaa40680f23534735b711601ad24864f727b960cc9da74fc5933190ed3bcb9f6c301aaeb1bec21632341707ca6e9378f739d47a82102dc0561010ccc37c6c
-
Filesize
5.2MB
MD582726250e9a4f8811459fdd46efaa9c1
SHA1fc0809a6b728081eb98302f43e741f4d2c0d7416
SHA256e3db09f3b220ca94302e6e9d3366a50278ddfac9c075ff6399120ea125a1e081
SHA512d97d8b6647e027c5643922833d609826e45b20f5dcf9e0d64987ca0635a0a4f47c4e0e7bb98add77dee06f3746cc3680d87b439ce135110b5c66c7c9cccb11a6
-
Filesize
5.2MB
MD54d6b1e209dc5bfa35e46ed365c3b3d74
SHA18629267fbc55ae4598b5e93d8978db1b0b4772e9
SHA256c9aa5e4115aea266cabfac0716cf8f10a54b9fad1a4300a47229dc67cc2420a0
SHA512dbc0fa33c86de7e017d8ed2c533119c6aa2e9a5825f20a485475d64291b06b624a0f5b5691675a9b79570a4c623b7a1f9d5b992da2e0aa194c5ef2d9a0b6063e
-
Filesize
5.2MB
MD59eb7fe61f397914979e75bc4219517d5
SHA175f4e940d6d2c293ae55575575ac4d2ac870fed9
SHA2560967f43ccb8d31649630bd80efd64728fa92bb6927fc94e3360abf26e180a015
SHA5124dda7f17a72887fa5cdd07b277116e63b9c260fb0e06681b8e2ca5aeeeba7b053343c83ed19389ad155265a884ecfc107a5091a4420b94ea2de5f5a5bad056a0
-
Filesize
5.2MB
MD540877f39ae799523e1c254233c1f13b1
SHA195d603cd70fdfbcfe9899332967a608292b58d33
SHA25647f0d8330cef07db4c9199730af667cfe6a82c85b3bc15a46146ca583401360f
SHA51284d820ab210e60192b5e384cc94418be81fb2744f484dd2dbe995f0205b2d919e66747c41cc020f09482240cf12632bf21b312a2bbf307b7e473f7db28bbfd66
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB