Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 02:48
General
-
Target
2024-11-20_66d8cff9099b11ae3cc68f74ce6de90c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
66d8cff9099b11ae3cc68f74ce6de90c
-
SHA1
946d12e0518ec2eacc5bca0f9ea87e858fa38d53
-
SHA256
d1f8f48af9e2a3df02de99c29d2cbca854d03c3d7752a7076b83f95b3c01b921
-
SHA512
2e317bde2cbd5f60bb47087399045b243d91bf6c6e5b09176015d630629527c30b8ba1dc41880044c089ae1976c8a01075bd52e0513d426edfecb1208dd41c40
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibd56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_66d8cff9099b11ae3cc68f74ce6de90c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_66d8cff9099b11ae3cc68f74ce6de90c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tWhWmVs.exeC:\Windows\System\tWhWmVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PTnMAkc.exeC:\Windows\System\PTnMAkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lEUWMQr.exeC:\Windows\System\lEUWMQr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NPzBhYw.exeC:\Windows\System\NPzBhYw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qkhfgMJ.exeC:\Windows\System\qkhfgMJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QnNxEOA.exeC:\Windows\System\QnNxEOA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JLmJGKY.exeC:\Windows\System\JLmJGKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RjufjWc.exeC:\Windows\System\RjufjWc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pGGdJII.exeC:\Windows\System\pGGdJII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DNEMtZl.exeC:\Windows\System\DNEMtZl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVQKzzR.exeC:\Windows\System\NVQKzzR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRcBCiT.exeC:\Windows\System\rRcBCiT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YqcwJlg.exeC:\Windows\System\YqcwJlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKqKJmY.exeC:\Windows\System\hKqKJmY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyPaXtf.exeC:\Windows\System\GyPaXtf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwNgSYE.exeC:\Windows\System\hwNgSYE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QjohbyO.exeC:\Windows\System\QjohbyO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hYzjLqE.exeC:\Windows\System\hYzjLqE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ySswVYE.exeC:\Windows\System\ySswVYE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YYeSMDk.exeC:\Windows\System\YYeSMDk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjiJEZL.exeC:\Windows\System\tjiJEZL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD558d5e6a5fa31bf33ea40bdb9fb2477e5
SHA1c78385b61b96e1b75647061715fa1d69cd9a4ffa
SHA256f53078eb50b560256f2a871e110e7b0f67160882198fbf018dd22f670a9b8d20
SHA5129362d3fadec825e9a1baa9b786b526b878516d257c7601f78f29c8e62443d7fbff8b9a0afb9d9ccacd420a88d0d683856dde3f5ac1ea7b946bbd019873fcaf09
-
Filesize
5.2MB
MD594fdb9f304888f49363b557a4599ebde
SHA16d17042a577dd9d1f95fb0e2b6e8c68c87db6cc6
SHA256ac8e0332cd8e7a14db6ea1d704404f07f981a2c1746a00794f0fbbe096ae0c98
SHA51245d482299f366e75d08eedc39131e1ff4aff4df6fffaa3ee662610a4c3523cb357f9eb1b6f993c86693dfab97f1d628c7329d3e666a03f3547805c8759935bc5
-
Filesize
5.2MB
MD55bf7545e07f105f98ae993e141115318
SHA18cbe75f9799d58cadc102706315545ef213c9b8d
SHA25653fd12bad7229bca2dad1293784046f134d2875a8ff08a7656a15f628602a53d
SHA512ebf09dc15896b5dd21a97428d66c64b1ca5747110a8739f92068eb03dabe9da9236edff27e439ac379e275103a2751080a886b3972a1731c5c5cd3ac121237f4
-
Filesize
5.2MB
MD5cfbae2ea183738e91be050d7f9ea6562
SHA1cb3d300bf6b5ddb4d81b14cfa574473f86445fbb
SHA2566b244e992a9d7dd0f7637864560d45e04c095c06f2454aebc06f68020833e483
SHA5126244a8c77f3cb457a62a8ed5bc8d7effe419e955cfb82e3f486e49c5c0f0f97dd9f405e59169b9aa9fee7564644c3fea5f28127d48e36c6081ca90905d4287e0
-
Filesize
5.2MB
MD5c9bbf8a7c5b35d0450722389e21ce787
SHA1582602a3be043363fc0c85ae73818ef45017adc2
SHA256fd13e78442c2164b51b3ae2cf6f999f2398218fae19cbafff6a6ffffc66896d2
SHA5126c7b809df0fcf160950913a0b9f7e7cf137aa4f0fc9946c7b5a0e29c554cd252edd9fd62040b9f158ed57845586a663bf0e03ffd4ff7a5a673a9fb275e3fbfe6
-
Filesize
5.2MB
MD537644a93f1c1362c4f26a589b254f522
SHA1286a76790d7258eb80d047d8ae94962764ac1dff
SHA256dd4c24279e560e3abd93d5b4cf736272632cc1de6c9c773874224d6404babf58
SHA51248c7e5ec2b6785ad8d450ab1dfdb8542524d95c42fdd9cee92f109f6a12f9b0b66f5939076810f6e888503bace3e6709dec388b3ec227c110224f82bde7dca18
-
Filesize
5.2MB
MD59be9e06a23be9dc6479a982f109570e9
SHA124af48ae56481ddf166e60e05b82fb6f9a35645c
SHA2569900ed09dc67aa20e2594f82af61d0d28ea7e4647bc5d3262a64099bbc177480
SHA5126fb870c9ee945fef63646b4d4226b27b69506d75a9a7d7bdb02180b688057fbf4bc65a90dee05cb0a84a16245409f895176444ccc34d477493833fe70272b8ed
-
Filesize
5.2MB
MD5208c5eb3b3fcdbcbd21175519845fb4a
SHA156bd649dc2f9424bb291e00977c74e06e775fe83
SHA256254db40edc57c3d362ccad06195bcd5dad9b94cab2c97f1e9a34e94422376bbe
SHA512267740ac84e6600d67a0bd7db3f5e6ca0c09f9efb7e0cd8f4a4d8d2a124096035ad9a60f737d1f3f1ddfdf7dbdd100be13db5e3d8f19ceb2a79f5ca44a42e76a
-
Filesize
5.2MB
MD5429e8b0ee1a634fc38a2ed0163b9cfef
SHA180c8c9f3bc8d33faeb7ea85b4c04a96936b35988
SHA256de0d857857b04c3e0cf5cb60e4168da2f646107d6277b24e3c1fb6004872033d
SHA51287c1822e1d1cf3944f3a23dd3cc9418e57c701535cbdc7af59ddfe148571082df0f8866abb0007a0e6297aedbaf05ceda0bbaa36d02db1266ccb3c478dba8dc8
-
Filesize
5.2MB
MD563026b1ed53492ab3d92e522f2d5f25b
SHA1d81b646bcc908abbb0845fcbca21fbfe7df5bcb1
SHA256e0133f55b90ca094f453c634441b1fcb26ee0a63bd010a938328ff363b948230
SHA51277ffcc1ebe241ab8cac667bfd309dc813e8c880bb8ea07e740898ab3bc42e949d73c24bf5dec0eae6cfdd16e92fdbb8fc6ed5d940ee885dacbb8d4beb88016eb
-
Filesize
5.2MB
MD5e33677283ee604a9126db3afa9d4ed76
SHA1c53c5fdb9cdb175bdebc68f4b8806e3d956be9d8
SHA2566c9252c86912ec390982ae47a3517135de58e9a678678474b80d6a6d574ce0df
SHA512339cc37cfca246ae192d6a17fa98eca345695070b4fa421f90c5bc880e9d050bcfe325a432734861efd7d131253f9236693f606030680b0e5182b8a703943706
-
Filesize
5.2MB
MD520c12d29431ddd3222ac99f469c0eb5a
SHA13657264c32e969adf6832a539c5e10d4cfd91541
SHA2566f21e7ef709913cebbdc2fad9ccb7480de8d35af61f6927bdfd7bb08e7052c87
SHA51254b46b432d628a85a176a59f2e8d7c7bce194a7b3d4c253bbe13d805e693e35db810febf6913c86499809337a3a4e1d16e8904d5ac5aa5a2edfc6ff7457c27a5
-
Filesize
5.2MB
MD5adff74c505c95a2714c5030bbfccc958
SHA187faf87c84c50f771f5143d251c122a25b634a36
SHA25692ab27573709f764ecd8234ad341bc93ff4f040d245957e7be46e3f7ffc6faeb
SHA512659109826fe1612a8b3a4c6a20e874f00b7a8472eacc7bae04bd76348572e2bdde050931c05db6b5b044293f3ba982f766314194e23dfaef8a9805dba725926c
-
Filesize
5.2MB
MD5f793e3216e7fed8f6081664c56f6a322
SHA1bb3d17f67c792b084eed92b42e712fcc8a610ece
SHA256335d35c14ea619dc9190df5a831ff36933b877d99b65bc0e86e0e6eb79bd03e8
SHA51225ee811f3f4dd56bdd039fd237642ef8ccff369ff482031a4f2b06d96f66b94ef11f4f07839b6e252641828f1b0fa29d08ac4b96ecd7d0d54b7b4c05d2994966
-
Filesize
5.2MB
MD58afac569d71ff68592a18e4940185aed
SHA15f91b08abe55d8d725016f907627bc43889b1c95
SHA256f0000573295df6022c0d578b151a214be38fc4e7a3b2e10386bd40f65c73d838
SHA51272a0c8bfff4d3ce81f7036284b8ed13183c8e348fca24b097b5b98302219faec6e9af092eb8e530286bf551df2e65821b7963fbec4831282baa5db505552749c
-
Filesize
5.2MB
MD560139dbf8ff8c331e1e5907f34a23b28
SHA107996f1afe5109fe210de1f90ee9e5a0da6fd0db
SHA256626424501e3d56a9388397b69eb2975e500ac1009c41f0252572ba0eb7f6fb62
SHA512c76991ae061b611fcb474feaf64adae173f989454ce666534100a420aa621536452e4413740e03f3382e0a9953ec996e24d4f4fd0ae2ce6b683b41e99e04a3e7
-
Filesize
5.2MB
MD5470e5ca80f06c2f84ccfe53b6c20452a
SHA1e845aef93e626ed655b44ab28393b7db4d84634a
SHA2568ec48e00e0baab1d4acfc9196a03dd907b140bab01b3a7042951535ad6c16dee
SHA512cb143717b1c7f9681d9377ff067076d8295800f3492413c9eae5768fcb653b9911292497f6857374f282640a39f33deacfeaadc68a7afbad4642cd3a94d19902
-
Filesize
5.2MB
MD50d6cab8f5a321853e6f2e6828e60626a
SHA10e6cef845800355fdb17228451760f9ea0f016f9
SHA256926e8aed168ade5d6f8da5aa34ba14a013b89769db42c45e445d66d2cae566b7
SHA512a35771845845feb1c228bafbdc4f11bbafc20b4be7551013c626b83d86c0ffacc87625764dace7474bf572dcf10a25457c07c41dfbd77c407bbc80563dbd794e
-
Filesize
5.2MB
MD56b99e420cc26a036632edf5e34834525
SHA1a7238df2914175466b79d34e17c187815a8e52ea
SHA25642cd4452cfeba2b530a18501fd97be2de717659a7404f5f77d64c6b896e8a886
SHA512cab34457ccd992369a3963472529b447b6508883a7c69ea1459759e47d143e40b0b3467b5ad6513e1c81202a956b741c7ab3a6665254ed5c0eb0c73b75853043
-
Filesize
5.2MB
MD52b74eb213fbf22a95312376a5b1d57f2
SHA12d652e337b085bb7a51340cafaacec0495e0f387
SHA2565f2ec3d996a324a852cb8c1f7b144ab16e14f24b484a5f4d626be30af70e8f37
SHA512effde9adcc9594c11e325ea78e7618aa7d5e374cc46bd4de43112991a510f65ac9f364da7ad73af1940e5b03c0013daeb7b1956bd2291586c0a842a65346ae3c
-
Filesize
5.2MB
MD58f1920e0e6f210fd408c17c6e8544d1e
SHA1e33a37f96f570f26587a608df45810b393a9d292
SHA256b9f19c3af98593fb3da58b0a2b96e7c5039899f36ea6dc207d271172075c5b2f
SHA5125f32202b7d0e6190f5fca984aa70b3f713d2540c60bfc2be83e077748f16c67bf8283c545ff45f730793da7edafb8dc78fc508ae3fb386612beb4c7869ca5eb9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB