Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 02:23
General
-
Target
2024-11-20_286627607bfc6de4d3c57942a38bf36b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
286627607bfc6de4d3c57942a38bf36b
-
SHA1
b8ffe75761737eee7c7c3a883bff0e6f48e7f426
-
SHA256
097996579fa1845bf2c7c5c7240f2d2dbe5f72a0c006c222b13584af537ae6ee
-
SHA512
5cee6f799af7684ce02cbc3907d6a9d806131aa3ffb0a31a947def77164850708fe91597957c4d0564cd83a3a8e5bebc90887c09d6575aa439d57617069cfa7b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibd56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_286627607bfc6de4d3c57942a38bf36b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_286627607bfc6de4d3c57942a38bf36b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ckwczBu.exeC:\Windows\System\ckwczBu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GZveMDC.exeC:\Windows\System\GZveMDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XFAnLrz.exeC:\Windows\System\XFAnLrz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RnkBasv.exeC:\Windows\System\RnkBasv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fqERWgc.exeC:\Windows\System\fqERWgc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJGiDyF.exeC:\Windows\System\XJGiDyF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zGclLvt.exeC:\Windows\System\zGclLvt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjSQPPQ.exeC:\Windows\System\HjSQPPQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OnrlZdQ.exeC:\Windows\System\OnrlZdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\svUcKJc.exeC:\Windows\System\svUcKJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CpSjGzR.exeC:\Windows\System\CpSjGzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYjbFfT.exeC:\Windows\System\hYjbFfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGJHcbG.exeC:\Windows\System\JGJHcbG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PaTAuwa.exeC:\Windows\System\PaTAuwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GifCfdU.exeC:\Windows\System\GifCfdU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ynLDNXI.exeC:\Windows\System\ynLDNXI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJZLwrO.exeC:\Windows\System\eJZLwrO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rnZNNwC.exeC:\Windows\System\rnZNNwC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gvodiRW.exeC:\Windows\System\gvodiRW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nyjGIeY.exeC:\Windows\System\nyjGIeY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CuWNNsV.exeC:\Windows\System\CuWNNsV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5805063bb03fa950e549609f0ddfcfad8
SHA15e19615c8cea9db29d1ac92fb61106a29da96f35
SHA256c9a38dee6d0436c6deb04e47e0a1ad2009474c345eba7dbae6d9649ee627556c
SHA5121c1a21345b50eb0260a72d1d129adce239048d345f8cb1910161cc63bad3cbfe79425edd7e51df82c2def265dac8173f68ef9e62919937710b430ffe0204363d
-
Filesize
5.2MB
MD5b53c4f1f0b7d055ea30303b1ef56ebb8
SHA17ee6745b46be0361e758e364a1fe281d073cffb0
SHA2567d31109edfcb7de692a1a78dcf4877c98d930e33fd71980fdd80dea94f861040
SHA5124305fc31b26e0a9c77e1cda77901d9d6eb78c535f595b2642b38a9a78b66311db0538678625bdbfb65af86ee50d4a25f3571f759347569f87c4419a76d80ccb6
-
Filesize
5.2MB
MD5121b2686c58e2c829b1b5ed8e598fd57
SHA1f274c1967ccd9558b6895449c7274644284208fb
SHA256da941b91501115af139294750bd3189ac450e5c356c47fb4acbbb678f699547d
SHA512894b895007b2f937942509ecf47fd26a731e4369c9856db4918641673913a65361636f578cf6a3d686a62a1983d5ff25ca4608df2c5ac43bf0a9a2b2cfa22c95
-
Filesize
5.2MB
MD5b66b13a99dd0861296427cb1a0277757
SHA12e82e69c8770fa6434fff35c8d545ea813f2b287
SHA2562d4ad42eba9073b25ae7fbb0c85e9e057498ae3df3172a836283d8175ddd37ec
SHA51229b28a4cdc2e9fbad64c1552fe03043eb7989b8a73b65ea33a81a2289dcc78d8dcea054bbfd08febb0bac65d8ccb6d63e201969e088cc121e4992ef062aa41c6
-
Filesize
5.2MB
MD58d2b2fd063110e5aa7bc15c0bc3ca711
SHA160cd86340791cd7ccd683cb78e63837e06a14eed
SHA25651e630091f0c218a9072f26adcec3acaad70df021c3d810a80610e626f32f93d
SHA51275e4936d93118d8cc739c46c3bd17749f587f8f58f9a6ffccf24228b9d332469cb0810e33638f9dea6647b59a230cda11c64f3d78572260d5a3ff60b5cb23977
-
Filesize
5.2MB
MD5a5eab2de20cf92d840417a6ce71cb93f
SHA1ffc003b47fbec785234ed9bc7937a8d76f956ab3
SHA2566a3f903890bfbe30edbd176ac7d4eba35c7af6348880212b6d1325497de0edcb
SHA512302a6452b08a19595b82bc6bcadd90431a915a5d15b4c08aaa58033f436891d4bbe47411a3a787b597105b852096b0268c080b23551ead5f2d13c92735daa24b
-
Filesize
5.2MB
MD5ff60ba2857a75f1ac9c4c4943b7bfa2f
SHA12162a8a2f4fdf45e53887ffdd4b970978b897a8e
SHA2561c1364a927edc4ce92babfb2729b0fe7fcf00530ed55eda6a450b9297456e7a6
SHA5129ff1d8bb57727ae6791fbd9dddc11f26f36de51dd3410a6fbbf93fdaf44bddf4bca26a02677b7022866a9b3b7a8c664e3522c6925f7aafce3552a86c53103661
-
Filesize
5.2MB
MD5d032664fe1c9433d7e9b79c015fcf707
SHA10d1078fb83544370144f0f98fdd83ee7b2c77e38
SHA256df58858331825299ffd306b276d1f7eb21b6e421bf4bacd0fa4e13c7bcd79f37
SHA512b91da2f59a6b85a6c3872c0a2f72a87f1510e3534fd4fbf8e70bc5d4a12d6eaa6c61612578ec93ed8d4e7bd81ba71951def5f1f6dbd655f379f7190dfb0fdeb7
-
Filesize
5.2MB
MD5c6926b74828cfc8ffe4c765c0a66b9dc
SHA157c04572ff07fbe103de1e3585d7976c231ac250
SHA256de7220c0a657a26199baf5509d4adb45bafcdc82f684c4be33738a06d6f3f39b
SHA512ee403ae6b2db06ede12f4b653a9119fad30f9b23f5c1230867c0312d654b4eef59925b762f0196da3a2b3b3895d1330d0032708fe5e365780471b229a949eb61
-
Filesize
5.2MB
MD54b00870e32eb7d843727b3477cf48a7d
SHA1a83922df79909428ecae8cb073c5a29a1bb1b827
SHA25631d9ab11901df3d17a7c7d3d98ed531767475e4e66d9e639e24ab242e97f9985
SHA512d85ea0524bf09fed89ac94cddaead0357ec20f4ec984dc33b023e05eac11de54b5fb1e80100a7d816e39cd7fd6e420d4383d114a2735f05062d35598dde3ded4
-
Filesize
5.2MB
MD5fe9057d7aa740140678c7c87e66f262a
SHA1d6a6cd0de9fe53ae96a6100d53269526d2debe14
SHA256c86760e5e1f5e90c01d7ccf6d2516df0030a51495cd01ed310a66770a5d2f554
SHA512f04f4b78f3f0298651bed5a782c96209ed42a850d87ec1b21b8c86a1a491dde839b869d5875a6f3f7129bd973b3832ea12731db13216cb4a4b8d11e5b07dc6f5
-
Filesize
5.2MB
MD5bb3d962aa0a46ddb9aeb50c27a458ad8
SHA1110373a780eb87e04a29ee2fd236833f55a1a092
SHA2561434138a7e5fc2d6518d9a411aedac980dec09acae4e61f25380a906061dec73
SHA512b8526b7b462ea6b27ef9343b72f819b74acfb7e6848ec5efd363f9a5a90826dea64d9b7cec356fdc61b155d336eddb9a2a27121333be3ffe76861fc22a616ff1
-
Filesize
5.2MB
MD5ccd888710d5cf7a03a4b3eae45cfa0a9
SHA1ac9d258e90ec289196f98a60b1e9f90165b532d1
SHA2561ae928e60bf186ac8da316a0897f4735eae06de436228daed09f042e49192957
SHA5126f90ae0f2d861ecb54042518d5946b271ccefae72d7073dba916a954fb78d86fea12bbffe3adf75228cd045fc2c53dca5417322d8eed286b20bfd00a256a1244
-
Filesize
5.2MB
MD59dc527ddb197431cf9cadfa46ef035d9
SHA1c4604101cfabfd155f2650eb722a9b1776957aaa
SHA2569731a58f59f1a8957f1716ed3f60f89402106ae1dbbf88731d4d67a9fe1c8b44
SHA512021d6c92c9cc50481f50be5965d01176992fb1de30b1ea6a22dcd7975925c404b97333abbb938a696723c10cfeadbc12a672e801efe91df6614fe730998e3201
-
Filesize
5.2MB
MD536068d90ae0ee07d51dc6e9620bd23ee
SHA17d96ec2a594dd8d74037cf387f1fe01bafa50716
SHA2562bff593498d064fcec73bf9458c3c8c0a9d896c84433976cfb9aff66624c2421
SHA5121a1b7e8fc6d3d956ee59a6a141820c012f16ba5e62b3efea8cbc45a8a9228cb345f0783f7406b83a13330eaf3aba17694df47c0a111d74b0b07af40752cc6809
-
Filesize
5.2MB
MD56c9950460335ab6d8af2d7d666419821
SHA13c10da4e47591e826089b19b857a6ff94e424773
SHA256be5c00fc7461a09b0c6e46fee31e9be9cb4758fcee45a29465f4f659b85f02f9
SHA512b545d943a7a62634d166c943d13964c6b28d1babbe3e046d713cd131f29bba9f478718a68cd64c751a44ffde5d4bda9074779da4dc5c367e0f0d6d3bf5e9434b
-
Filesize
5.2MB
MD561b658fcfdc37f4512143d1123a1655b
SHA1ee58543c83eabfa5aaa3de903723c5b3c8b6a120
SHA256c108b4d38291b44be49651048971cd8dfffc57f77433f6bb7cfde4dcc802015c
SHA5127cc0b96b071d647da71a444ae9ff88f561be752a2cdf552ebd2d843e3a3ee1cdb256e733e91cf30c689384aa62018b2a9c8bd6a5f78f1aab02f9c72868c793c9
-
Filesize
5.2MB
MD54e9373fadcb870d3c714ee6c33496566
SHA1763700073986ed9093a783766e05b914aa3838f8
SHA256b0ee5e845d2f67d9a49b6c11384737a0c29e70cb4a45b0133df23931404c662e
SHA512021a72fb21f23cd531de72163a0ef9ab6df2c2ade2dd6d3fca18095c64d42d31e59433abba029c8faeb03237c395be4f5e1a098df38e91350788cb177d17f1f7
-
Filesize
5.2MB
MD5623ec155960b63327a44fe37739dc79e
SHA15fb040e6538f2d405811a6deeed8ed8ed1e6c46d
SHA25658d3d8f5b02e5dd3818ff229220f8a8ffad8b3a9bcaebf61118026fdebb4cc86
SHA512e56172aa438e66aa27733a87455bb3b1303992d90cf25ac51457bcb05e84db5db9a976d8406d4b3ac7638599df0223c4f3108d908bdfb2206b4540b9abf2b8bd
-
Filesize
5.2MB
MD590ddc284a630dd2c43034b5eb4d98624
SHA1bdd49f79bd8f42482e91b58c27a56b50bc7847ea
SHA256c8838c2e8a5176f732f9580d528388bcf2df4a971382d01f5a1343658f3a0910
SHA512e03d9311b257f239ebee7d31f6a58993cee70a289f438ae67e4b2b3ff66bdd69356f05dbb4727ebcfed5c513bb42109c6064e23ae522ca708d1e3eb48d1bdb1f
-
Filesize
5.2MB
MD5251bc827dcf6b95c8eecfdde708def34
SHA14246fd36968f738208a36eac0067147c7232022a
SHA256871ffeb46d68ad41971a75286d1e1d9f85984aa4baef421693f6ce85ada5b75c
SHA512b5e8b6c56c3f753c7e776c9bd896efe9136beeab34f101ce41e9e20f2571b8ec139449e92b19a2c4d7c38afe554952541c6ec71b703f85f8a63c06f55b93e5a4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB