Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 02:49
General
-
Target
2024-11-20_730bf266126f0d6d419d4663b60a3741_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
730bf266126f0d6d419d4663b60a3741
-
SHA1
6aa4cab50da2af4f90ce9eef07809ee2870e8ae3
-
SHA256
17a7537f6b044c0bfa4c4ceb8b22aceeaf12d07f62fb5f10adec232cfe350ee6
-
SHA512
ed04b0a698d134e22376429c5de8f19e6aec09b2b5286269e56c3ddd7207b7ab9f582b64cfaa59900a7d48942aa28b02712aaec407a36d006a4343e01544ee9f
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibd56utgpPFotBER/mQ32lUq
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_730bf266126f0d6d419d4663b60a3741_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_730bf266126f0d6d419d4663b60a3741_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\arBdmMG.exeC:\Windows\System\arBdmMG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjdLwQG.exeC:\Windows\System\kjdLwQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\opPfKuI.exeC:\Windows\System\opPfKuI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qCNbwfU.exeC:\Windows\System\qCNbwfU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWICMdB.exeC:\Windows\System\uWICMdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXxFEiJ.exeC:\Windows\System\WXxFEiJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzkmFWf.exeC:\Windows\System\kzkmFWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwLtzmP.exeC:\Windows\System\AwLtzmP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LQTSPPK.exeC:\Windows\System\LQTSPPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mgZsPBn.exeC:\Windows\System\mgZsPBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aRafJBF.exeC:\Windows\System\aRafJBF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kLwHJaz.exeC:\Windows\System\kLwHJaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqXCNyd.exeC:\Windows\System\lqXCNyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\crBAlqB.exeC:\Windows\System\crBAlqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\klZBhxi.exeC:\Windows\System\klZBhxi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrDBiYz.exeC:\Windows\System\lrDBiYz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QpudCMg.exeC:\Windows\System\QpudCMg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oJHTtJj.exeC:\Windows\System\oJHTtJj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\alntbZo.exeC:\Windows\System\alntbZo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fHCPmhd.exeC:\Windows\System\fHCPmhd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hpLOQFr.exeC:\Windows\System\hpLOQFr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5929ca4bbe871726141636d7a2ab850e4
SHA1b3781bf022037d8b0e74ea78e097d792e53e7384
SHA2567d6c6fe99e86b31e55e440d521b6bb75f3409b931228849b56fdc3ee6d6a0adf
SHA512b78c20aabc563c24fcc9199a723ab00cc88e8c317279fd7c6f23b7a6d864f8b662e9f37e6f828b4fdc6a32951ed220bcfef2fd12cba06990c6f65f4b92fdb53d
-
Filesize
5.2MB
MD50514663464de2a339c96f257960f8bd0
SHA10a0cfca922af4c8bfe0b4153bd9d649771f13ced
SHA25638b7b2156e39a50ad3d6e530f9f4386f6b369631c6bc4c10b6420668eef4853b
SHA512e11f867697c8b1079a1b6995494fea779e4e755ff9e5048959541a8621d53b1e973514d00fe6db13a87e425e6ecadb91146835ab342d8c299387aaf1e12fc2f7
-
Filesize
5.2MB
MD54ba07a1d3d2b816a7fe2ee830cb8b320
SHA10b9494a16b509a9c2be0ba668fec49251dfeae13
SHA256ceae48435c03f5da5277e2934f16e8c7b1a459fb588a7fbf3ba8f8b93f29e159
SHA5124a8f73363512f25bd62517dd68092ecf3fa17c45469ee24a0bb12d5c19d928f036dc9e93af31ec75d31d2a1122e433d86e8252f0a8c61147cfa96f6f0f82d65d
-
Filesize
5.2MB
MD56cc4163c16c3013d4156672724021ef8
SHA1527add3d43193950d8beddae5a2edf47c6fd74b5
SHA2565ab93c231dc4ba25f0b918b5d92b16a37b3f39e7c2a50252221e92f4a3a87287
SHA512c76d7d794644a701138510103698636ea88620b1c679b11d835e3806e6552e60b68f384dc61e0577fe8a88939b68b16f706d86d25055897c3b62d1d6ba77643b
-
Filesize
5.2MB
MD5905274309833625f4fd907b2613a4cb4
SHA1dcd70ee40499a6c039a01da0522f44a218db1e3c
SHA256b62085cbf4e0ba9463474e0db6f97a37e63f6262d1be58ef61fccd581fc42741
SHA5121ccfe73a9018d649bc3cd6024cb0914e297343b5a056891663849bb4d78322661bb0e20c24bf530df6dc8a17fad5d57ee3abe45467f37b2299085ee292917022
-
Filesize
5.2MB
MD5e882f47aee82d197389cf1a636de6612
SHA102d283f1f5a371e913e7d72f299920b8f10eb913
SHA256df84a1bdae28e45676d186907bf05c228bda1a85069e81a5eb066516a3c08763
SHA512f3a14fc88ca00ba603db03fd6b8233d991cd0d00a284dbecab33a15867664b08f9f6a27e0a220cd260a81a6a91d6eb516331fbfcc4e94eb1f3fb56000a071a4a
-
Filesize
5.2MB
MD5d782bbe5d2bca4bc5cbe628d00723def
SHA1213f22e2d669c3cee8cfca29145cd3ff0898c37a
SHA2560ec8ab6158bf536f46187b9aa64f42c05d534712fe90b3cd384b8362fd5f667b
SHA512899362cd2d82983463332aeebe02014f01a527cec1f23db38255eafee2bc8914cb96cbff21d6a92c79da63798d2bef5adc94994c87955a67ade26327f7996654
-
Filesize
5.2MB
MD5a01c47f632a04f26a730222c0263877a
SHA10391ef102a1ff6cc2bcc94af2dd23785c96052a0
SHA25645a7ca5684d2304a26f8b5e6cfef5a5b73f990c37d1cdae360dde6b20ebb7cf6
SHA51299db7b0d41f7295572af79360e5beb81797acadae8002218090c7b1c2b8b618b88b46dab35d24c1708c2e747f9f8adbdc08ba365d73720e578cac6f9f1a1627c
-
Filesize
5.2MB
MD538b4a9ce680ca400f55b08f945e68c95
SHA1c0af3afc0c2060f81ce69c0863e9ff84acdf572c
SHA256935d1d08bd8d2ab750fc7ae16266be294984702ec989562333542dbf9c9f0518
SHA5121c5ffe65b7388496c634a2046e6cdfefd5d0acdedc377dbdc6e077e336594d711b12aaaaac2b565351cd78d4a2db210e63dda327d72078312240eb0874b9dcc7
-
Filesize
5.2MB
MD5c7fb138e63b7c8438aaeb2165fc2bb73
SHA1a0134cc466434bd5df063d29788ac8915fb4bf22
SHA256de6e653a62c6eef8b3224019e927d3d85c753c4840e8883ff33191011885f151
SHA5122f31f437a9650d835210cdde80384cbd06c11341583d4d1c6dc01a8973a53fc2b8869cd66eab65c7e50a5f2eac3deb33bf1631d64396317a14b3642722afe4a1
-
Filesize
5.2MB
MD570866ea2ea694ea3fd60928bf1c0afa4
SHA17af77636b8e91f8dad003f6ce63eba8f0d9f2ff4
SHA2563e37d4be936024d820440b408e4a7a0c55e0d87cf573941d6514fe3beb5d0a3b
SHA512ec8a504c1841c8dfd0f9c078da7538022f033be453f4607bb91f9ff20bb82ccd927dd2eb0a68cb910f2aa1d4af6f2ef3e8fdef096869e9e153d0d78919b2ad0d
-
Filesize
5.2MB
MD518a6c0a5364b22368e7a8c1fa73f813a
SHA144ca202a9ad029da3ded36b3308b7f0f74a09939
SHA2565b701170495fd5df69f7e1dc6651733440d2bb2a95b0884c84ff9965d7f21a8a
SHA512bb921fe9f17ee878cc84bbde3d025e1089b34d22ca25bac9057267e62d39df19386eaeccc8858a42f2f5f0cf26143ac585cafdbf58be189915c810f765f0cec1
-
Filesize
5.2MB
MD505224193cb633034973f41b7696936df
SHA1a8221c33f7af69e56d422cf5a3b916d80cd3ed33
SHA25648ca9399d7898a6ca438c1334c17286c963fd6efe59776c0e0e10c55337fea45
SHA5124314b961fdb9acd009f6082ebf6e73876c3d58a112a99be839cca6694ab31833c8e76fb9b7ad14c1c4a61ecba46d3e69c48d52cc9b2a737b580eaf0357d99f4f
-
Filesize
5.2MB
MD52b3086bd73a2654d103ac7cb3e6a070a
SHA18429a3621053438c7a6be2d0159f0c38df4d8764
SHA2565c58f898f567b45f2d512f459f44b4f15f2ac78fd1227184137c86f46be8e976
SHA5124551021e8629cad5739dfb9c72626127e7f105fd2132e8b5d125841f68a742ea2f9470be6c24e079ebceccdb4c14c0529aa2d3623d2d7c068ad443572b875219
-
Filesize
5.2MB
MD560b6df75f1036db4712a937650d2578f
SHA13909cb6fff7d5f3f8ab7327f486ebd935332ed82
SHA25660ab45d7e952b633a8b7e5e09b4923f9c976aa2f0589d14d9880bd1f57e5c3f0
SHA5128d652ea438d00b406610658fbcd18384a7032fb9f4946eb693e8aa11ffd19468d65bcd1730a1c7c77a7ba77570e8192c3972f7e7b3d2dacc2c59643a887a2586
-
Filesize
5.2MB
MD5c6861cb94522ae4a84f46ffb33d746ed
SHA148f3b40cc4ed7c6e5c983962ac1e68fec96e95a8
SHA256b78f33c008e54b5843c216a684ced29589050aa85e016050fa66fc02260ffa6f
SHA512819e9ec25f1e98eb6c32d69ac30113cdbb4352c0ef48ad48c6f4b6c7a99b319562d376402aab1db90394856281c4ae03e2a29aba285bcd4af6893f17d4db9172
-
Filesize
5.2MB
MD5c6d98a5245d3cfc944c29a19d966748b
SHA18f89c7380e05c6dd37401fff8afd5856a556b760
SHA256468bf4c89e0c3ef509e4d6a14e30bb92718f93d655ccc0aebf4d6f3930c53e75
SHA512c92582f43e72f3a4898882c66f07c31330458c0bdfeb345c759d4d9cb490a12f5806521101e699377184a6a829491621281a756ed5c4ec78d8ae13b4f03195d1
-
Filesize
5.2MB
MD5700ddcf5f943476ae20c08b8afa3c686
SHA189283cdffe6638dd61e48d77bc0144d4318055fe
SHA256c0cdf9cf7b9e3c8355840d48bd37ee1fc73ebb998395655c3acfb86e733182eb
SHA5127898763574748503c115236e25f6da91d82a9d8d605ab39bafc5decd72015371781d292e508799af3dff6d4ce97c245f6cb3ed7badb541c7c199395e012ec774
-
Filesize
5.2MB
MD5393ac6b8d380520c47adcee23a4cf7b4
SHA110262fd47455b4a2b1617478d674a68aeb306f30
SHA25653c28c5f72994ca2707c6a7270064f789fd9322bb05db84f3fb67cc60ef64e89
SHA512ab92b9446c3a00d93f709205b171f512dcc35b5a19592e759f6aafe7464fc08d3b1135455cd71059f383f2650a22656efc75886d52d1deb80606e750376c861c
-
Filesize
5.2MB
MD5cf2d7bffe36f9129089182da9e783027
SHA1c7df31eafec4b36500bdcdfccf75297cb3d688d8
SHA25689d77cb9324aed22886b7838b8b268d8691fe31ce69a0efe01471b9fe30f29e4
SHA5127811c7aa7b1c3d0dbf42d80cc712453cadecadccd121ee58c2048ae960e97b265ef936f17c480f5ca9dc6c5e0d4b79ebfd0b7d3b6d2471c6f9622d6ccca291a7
-
Filesize
5.2MB
MD50d73391c826ff0157d1ba38a52d79ac3
SHA1f0f19d46a8ca06faf7676ecf3647e2047a63c65d
SHA2565c6dda2333f1d567a6c4356fd801255a1d8b0d462f98f7e1aea752af9c4e3058
SHA512c7358be45e59bc9ce6f846182b532c20b74614b71882f7cf7bd5176b834c18361e74d79f6f364cfa614665e66f40343dc705109b6d991efd257889515ab84f46
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB