Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 02:50
General
-
Target
2024-11-20_ad10e3a08a8f10d7a6ceaea9881fa24e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
ad10e3a08a8f10d7a6ceaea9881fa24e
-
SHA1
b703df52275e6a6f9de6fdf6e06f0c6fc43ec7df
-
SHA256
398edf7ec3ed8691b5d8a930706b87b18d5da1b50a0457164647acfe1fc1f204
-
SHA512
b40cc323251eaa6b99be104390dc3ffdab9193d6bac5dad8444e23040252afcae80650f14d478c84eea41be5319b79016b4f00069bbb6876ce6ef3b786b369dc
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibd56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_ad10e3a08a8f10d7a6ceaea9881fa24e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_ad10e3a08a8f10d7a6ceaea9881fa24e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zPnZaVO.exeC:\Windows\System\zPnZaVO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NZoQtFS.exeC:\Windows\System\NZoQtFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mfzwwZI.exeC:\Windows\System\mfzwwZI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lrTHshj.exeC:\Windows\System\lrTHshj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AXrpCie.exeC:\Windows\System\AXrpCie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wqoBDDc.exeC:\Windows\System\wqoBDDc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTXpWGO.exeC:\Windows\System\BTXpWGO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkPQWhc.exeC:\Windows\System\dkPQWhc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sqTydvN.exeC:\Windows\System\sqTydvN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuQesRg.exeC:\Windows\System\vuQesRg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NztqHrR.exeC:\Windows\System\NztqHrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PRQqXAb.exeC:\Windows\System\PRQqXAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WWHqmDo.exeC:\Windows\System\WWHqmDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVqLWoV.exeC:\Windows\System\rVqLWoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgHnCga.exeC:\Windows\System\pgHnCga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UYdNtaz.exeC:\Windows\System\UYdNtaz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OSPeaQM.exeC:\Windows\System\OSPeaQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tjNnaKK.exeC:\Windows\System\tjNnaKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVUZCWX.exeC:\Windows\System\tVUZCWX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ueynadO.exeC:\Windows\System\ueynadO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\apnhukI.exeC:\Windows\System\apnhukI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a5d6763a1d0d0e34bca24861c61c7991
SHA167121625d2026828ad52b652b1e6c69ce1b3d451
SHA2562f56739d054dbd99cc4652a8558ebb3b55f758e6e27fa5254b33f36823553475
SHA5127beba63aa2ead48af254f95375f448a267b39821bc17259b3d81b82e97d0ab2ed87382ad881dc9465dfe5b8cf00f94e02355e8e0b6e4ad046ff7ceeaa7567c4a
-
Filesize
5.2MB
MD561a892aee4e4dee00b7bd86b01dea0e0
SHA1efd0a302bfff60bc9462824edc495572c0c9501f
SHA2566cac13102e9792a31b31d09369270c4d7f85b83ff4db6c291ac6742a5ccbc774
SHA512543f33a60614256cfb7a3f77c2a642e5a57466a0fc08f8c0a9c64704931b5f82316cbffa868fd287ed72fd0143cf873ffeba35332b5e7e8ebabfc87f267e28f2
-
Filesize
5.2MB
MD52f0b4966ff09a94f5d21be7e5462582e
SHA1cf4ef1c64bdb4c5f34baba17d43aa19526935eb7
SHA2561dacd8736c289387356d610bd4f2a58a4a163e0d01de469179c411878ff2aca9
SHA5125d2ae004e9df286b225cb2dc0364e0b8d5e1ade3d13c0fba05ca817a708c8fd7057eaf9348d75ea68800443bc2101d3465e82baff9b889d10dbb14063b391fbb
-
Filesize
5.2MB
MD59d761ad222860502c8c7c7c23d82a4d7
SHA1af03eaf5f51d3b6f84abcc23d07c4448b7dc6110
SHA2562d4e2688eda62c59680d3bc6d089602a94e1ce981132db880e3dc5c5888e1cef
SHA51284d2c512b2358c8d6eaf805839b1b07229c3a4cd54e34196aa60da13404b2b24d9cc9987452eb2762cecbba57062523fe3081c3c7bacac62db7f3975597ab375
-
Filesize
5.2MB
MD577adb4d9995136532157eb01a171d4d8
SHA1a36b7002427f97eb7aa2eef4328113b411628f3e
SHA2567698da3676d64e942800bcace6bd59f85b36c2fdeaf73d4307ed3c32db1db78e
SHA512ac6a94f6a179ff406bd76439a4916ce47a413117fa2bdcbf14b9e6349d022d86bbabde0454d05e7e6577ba3362ce223d3354423c6a5dc073372abdfc30c68696
-
Filesize
5.2MB
MD58537c88ad8e166fb36be72c0e117670f
SHA1bffd8d052b29f91ba3653fd65ee454f4a8f2c77b
SHA2560634982ff85ef3b95f6db8f632a3d116939d0195c44f712be62457ad1095fb72
SHA5125ee8fac44e22cd850c98edd2ed5c02a60eb051016372c897313690a746b1426e9501a3aede566b3e1428c92e6c67dce688a450726098dad66904ca9a0d865341
-
Filesize
5.2MB
MD5809db30539d23955a451424fba5e6f33
SHA184aeeefb40b039f7b791a8d2e2cf3684871fcf0d
SHA256dbbcbc5ef8915886c0e096512489d7d37d6d6de97d6ddcbb747edcfb2de31b35
SHA51269b88236394c4ba1f154477fdf7a7eb94a69ef05ac4cb49e9892af1b6631309c79a8150bf77287a9471c85629d7b90c66150989f0171ac54288523faeb2987a1
-
Filesize
5.2MB
MD513aa499277327151e07bd58d9e678e0e
SHA182b83dfa579477c245d0ba53c8b8bcd0ab5b035e
SHA256fc2d006bca52bd41dfb0e0ab8cd541d1972b2c4a13ef9751a241cc390601c3eb
SHA51296ba3b02523bac2917780d12c633c356b97cd504908c3694814a5891d217622a5dca566c92ee2a4e0c05beb06fc43fea1af5ee63072c0d8aa580085fe4857978
-
Filesize
5.2MB
MD5aad7cd14e49d656e6172d32d716a3e5d
SHA1dc48e33fb2fd1b5757b4616446aff94716167e6b
SHA2564204205362b135412c946420f8c023711c18d9c235b9290542ece6759edace69
SHA5128161d61205ae6288e7a0afd8b88c8a75fe5b40cca6a0882906e52b1852942c16d312d1703dce8c5917323a1914689d003b1c6835f829f1dddfaf19b88d990a19
-
Filesize
5.2MB
MD56a5117e0c5bf1cadc420da3bf5ffd708
SHA14d747bc4753a5b45dda42648bd0e874995808745
SHA256272925f4b8027825375970a95dc77ddc018a344cde1f3b26eb9e450edd48f35e
SHA512f6eddaa8e7534a839dbfbd3d1a2051661082dd2aacefa2f340ff82e7e4ddca8d90f0af6695e4bd011da53ef5f0bed2eef3c7e04d9ef385eb950ad1e28a6fbfa0
-
Filesize
5.2MB
MD5d1b8b81c92ee4b91ca5a132bb5439a77
SHA12812cc749e9d376cb87d6029db56fb888bd1a50d
SHA2566ee6b70c84a5553908f3a32b63a65eff9721dde92f876ec22422d71d24a5d76d
SHA51211aae8f2223e7c585fee6cab37549ed0a5b88167b79b4b8264d8977571c10c8002a93ffb0e3a80573626f77bfa11915ea9289d034bd46d60575c23007803a835
-
Filesize
5.2MB
MD5c12a238a1523b5064d9e2328abe4c5fb
SHA1c7e954c32087f15dbd82817d49993a66daa472ba
SHA2565e14b725ff7edb277bb885a850daf1c025436a6c7563989c2d63adc164b41575
SHA5122523181e40b6fe6888ec6880da7d2d97890039007bba513868634332f969a73009c3777ecc6e1b64416c2dfb665bc9a30c9bc4e6a53256eb08793e8f17c632f8
-
Filesize
5.2MB
MD52a75b7f7597cfa21b71680a7a69155f4
SHA16cfc8dd0b2e7e22399a3ab0c122a878341f8bada
SHA256d3d1214e9c322c1632407448e65932153c191aad8706f6c2267dd65de9d08d00
SHA5125c74702cf9222ab82d84a02e3f74f0cbd4e8e299d5e719f19343b9b3bfc1169e8445b8a1946d5a9e0f429589da12ad1e64f7697c7a1aff71c8ea9bfdac3fed1d
-
Filesize
5.2MB
MD50756e1a58ab7c4051080130d5f7d47ab
SHA198a011417c4d2b51022b4a85d0fe9f5406a56ec0
SHA2566b5bc8a97e32a9a340f763da49ad653b74b100a0fd24ffde262eef13cbca49bd
SHA512606190118a4a09855c2de1be3d3e2be48b1a671f14db60a420987ef05cc728b0a0f1fa845f706a6a3482059939210065cfafb50fdd25074ebb7ee613435ae111
-
Filesize
5.2MB
MD52ebb3430b0f128b502ec6beb4267ec64
SHA1850de033163fe64d4c4236079ff5bf228eb54cc1
SHA25671b0f82e402254f4cb7ee6a9f306eb127d51a96a986b572297f3960d67750562
SHA512ccd109675c5c2249b0424c933bfa1c92fea982b7e8eaf5ddd746b2d0365248635115e7a875467ec346f143a3f0575ac6346a9ba137f8f899ad3f698a33d362a2
-
Filesize
5.2MB
MD5dec6e2415b455fa9616e0bcbbb733e52
SHA1b248dc66c654ace4e997e83d800442a61e1b77e4
SHA2569a98182edcffff99485a2f7cd1621a484cb6b6dd8bc6368aed07681fb164c26a
SHA5126d42c550fe139cca6995463f957a31ec8c18edd35a873adaf20c6b48ff464758587b957cf6d4c28e7c9d71f5f4e8ebf25ca83e4c6778199a8f1600a59e7a0dbc
-
Filesize
5.2MB
MD5ef40684b87e3d39de866e292351efc10
SHA1d10d5a78d5a202277f305fd7cf09e775fd26d03b
SHA25643df8c749cd4b1849d7897cc06fc4debbdbf25e9bd3c85a1fa2babd22434df68
SHA512ad73ec8ae26c907292e7fae5a297b90bf16501de36bb1ffac495ce9c6251e497e4deaa1dd4f1e956fcbe6f288e3ad8464b799443a95c3b6b262241a7c7e4035a
-
Filesize
5.2MB
MD5fa5eace31908a09981e3c1aff3ed72fd
SHA15e188823a441cf1ca8e79a7116c45d19f0d76fd0
SHA2567db3d4fdad37d69efce28aae18651cc69f8afeda39377f3f80d862e922fe5f1e
SHA51296c28cfa453442e4c2d5fd5d3bdeb7db2452c14705b01ecca438c398cc14d6315faae1e26c2824aef1aa3491a8b0d610505862e8239720f7528a362dc9549151
-
Filesize
5.2MB
MD5fb374b547675807526b70d19b4400d6c
SHA18cb980feb3494fdcf23b926bb257d7c60ae71f77
SHA25644ee86f228ac87cf26c36847c4238c793d96e47f1ab79d5b3a7d984b4cf050d0
SHA51229736f39d1ed143be6b0dbdbf3f53fc037a4560f6d26f1171807307c6cf57f9fc4459477d3ffa2d871717cc6214bcc17a63ad74514399b490fe8a41b116ad250
-
Filesize
5.2MB
MD5ef47f3326405a71ee1b52ef34a81d946
SHA126d6e3458f80ed90279a96f21390ef501dc502dd
SHA256ce04ef5df70bc4e82ddeaad203b1824779412575a2f6bae768c7d1edd9888265
SHA512ee83f5bb6a289bf05c131b5fbcb9bdc39a6b7da898f12132046406e26b3ac478199279c8f5836fd9576c317dd2ac29464baf93448c3a4a84678d116263135979
-
Filesize
5.2MB
MD54928391cf89d8cddd882c769d14bc1dd
SHA17640987c8c26edf793de13130356094d9c56ff51
SHA256e7262b922774b02f00733c76af5b792f31d7c5ec67eef893a6254492dfb69fe6
SHA51207ea2edb1a8354ddd10933ad0fc718e8b30cbc624e1ed1262af89d5a3375020a91e81846b6d14fe49ef9d52f4faee9347f53135b9b6eac7fc534dea85fe668b9
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB