Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 14:24
General
-
Target
2024-11-20_8160a41b45de5d5d2466d68bdf8fb840_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8160a41b45de5d5d2466d68bdf8fb840
-
SHA1
f8836e64c2ded0f767a69124a571fdf3714a41c7
-
SHA256
4fbdd2106b6317636925bdec856b34fd9b6b458b9618b1b6ec04081a67c81e7f
-
SHA512
a442574f89c595fe7cd03e751a4bd76d35f833d8ed9cb916fad3532610997db6d0fd791b9c0c8f8e2d0d31555ff22132508afe2307d5932a999772518a53c8a9
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibd56utgpPFotBER/mQ32lUf
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_8160a41b45de5d5d2466d68bdf8fb840_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_8160a41b45de5d5d2466d68bdf8fb840_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TVuYmhm.exeC:\Windows\System\TVuYmhm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\heVWMeS.exeC:\Windows\System\heVWMeS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSZRnvH.exeC:\Windows\System\cSZRnvH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CZAAKWs.exeC:\Windows\System\CZAAKWs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxYpiVD.exeC:\Windows\System\LxYpiVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eWlYRad.exeC:\Windows\System\eWlYRad.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vXrsQqU.exeC:\Windows\System\vXrsQqU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NhkqHHe.exeC:\Windows\System\NhkqHHe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GsNeMZW.exeC:\Windows\System\GsNeMZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DAzOuIo.exeC:\Windows\System\DAzOuIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wbOTFdm.exeC:\Windows\System\wbOTFdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TBihFvy.exeC:\Windows\System\TBihFvy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcMOKrN.exeC:\Windows\System\qcMOKrN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcoWLMv.exeC:\Windows\System\mcoWLMv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eUPlQWT.exeC:\Windows\System\eUPlQWT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GXCQgki.exeC:\Windows\System\GXCQgki.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\toOPSiZ.exeC:\Windows\System\toOPSiZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlJkWKc.exeC:\Windows\System\AlJkWKc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ADewluY.exeC:\Windows\System\ADewluY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PqVIQNh.exeC:\Windows\System\PqVIQNh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hEJUOFZ.exeC:\Windows\System\hEJUOFZ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD50ca7e76780331ad8fba5afd2297c92d6
SHA1a590b9afb4a4ddcf12dbcfb07ac95ce81ea1606b
SHA25656446c0fbc00f491d427db7ed7e11c3148025eadfca5e75f96b46898b2205369
SHA512b80cf9d0f493b676c758dbf44128c93a27caaa6c8a8c8a25afef3900c6c3481a4c429c116b8e69d598bfa822a57e165f8da0aa8bb2564a77c019929e2152dd1e
-
Filesize
5.2MB
MD51ea9e83ce3ac68eb802175e38123ab63
SHA136b5dd63a92230a892e767bd5501a5fd7e393c36
SHA256695757539bf69fc68be0997f56ca16d4605d67a8d7dba7d99f9646ad4b3dc2a7
SHA512001bc9ede50c7678e42ce669b82055afbb36378f61d11d35155829957f528a7af9892c6687859656300822c40deffcf0ff6d14dbf4febebd4b749d5186f25438
-
Filesize
5.2MB
MD5842d3fd1374f2cc2e409f3a4c28fee05
SHA19d1aff70962fe029540ed9632938b4c73247be09
SHA256c55da667150f998dace4e8f18e1353fa5a75e65ce70f5acbc8dc77a80102c01a
SHA512ba44bd0403c6d958fdb7a2036baf679b89f0f2f7a5442d11c8ebbb9140f38863779e727f134949c51be68f90488e152805f7cecf1ea1974bc492336a78cda1ab
-
Filesize
5.2MB
MD57ff827f929b665f23ec8ae27e3d90a8b
SHA1ac6d504331b3d1baa401d9d3badbf530ce97dadf
SHA256a8f7b7985ff3279783c0c343293e6b9c6ddd15ebf94135f9569b93f4da407a0b
SHA51223ce37025fcf7b93c4a249fe94dae50b776ce3553f7281dc84b81174f3449fa0345f4c48c9f3f71c7f854949b8657736c83667fbba8838f312f9361c1b94f624
-
Filesize
5.2MB
MD546df14ea9212f1151c24ad9deb5ab548
SHA1c636067a5e28df7ab5fb9768bc0210afe11972f1
SHA256f736fa5371922e2d0b5488b438123d559deed359ec16a77d4fcfad793bef0697
SHA512c15ba667310d2d48551e2c5685889e51648205fd7014b8c80cfa8bfc16258e5662cab7c3f8550e26c5010b59253545269274151cfb6a6a795cfceda89afb8822
-
Filesize
5.2MB
MD57f029bf6743cec775dc97837092a8106
SHA1ed2ac054587ed398fa65c2950c0179faa6600154
SHA2566ec592d3790d25def3ca4a3d3d434f46cafcf6030298dbdbbb8de36b58462eb0
SHA512860fe2457ce18df4afb92b9f1f508528eb1b6bea2a901ad1319765a56122bffae881db5ed7f751cda8c3f90d302d1a59b9c1757d0e3678c30e55601ef5caab11
-
Filesize
5.2MB
MD5f00164c72dcb137e0e6535fb506e4598
SHA1dbc28f127250d5ba76c04a00f80ce9ea3cd68644
SHA256ddb1a9ae136fb1695c614eff223d5a9ccd37611ef7273ed156569f2a74904e30
SHA51233f790dbddeaff7527d03fd998be502006936c9612ca602d50aeb5d6730a067eaa26faf3eb9f994b62a712ebf7fa882b252bb707aa552f098f42718b620aeb38
-
Filesize
5.2MB
MD5976ba9ee9e98b4d516e66821cbdbbdcc
SHA13ea2e446048a30c498c90edc99231423b608eae7
SHA25632bf2149023c768ee045f52f72e7f1c998085461a5fcb7699a574d085119f0f6
SHA5128dcc6305f83941c80d9b27a3ba8f4e999977291da740a4660909ff29fe428c686eb951350ae12240d99e43f93bc2be826b8111ff2dede64ef07513a5c5111ec2
-
Filesize
5.2MB
MD58476991e5a5a5412a8709ae48f55577a
SHA100a870493adacc313ddac837e7deae07fd7f7310
SHA256c71e4a46c1f3ee68f076486f408a3dc0568a03ef957d348bc181edbe6b867a94
SHA5125d5f91447271217ecde4125ebf1fd13a7045af6d441d42bad2103a0492438d6d4c693191e5477c138e58eb122ef9c043739256e1f9af452101d3922d2ed68c58
-
Filesize
5.2MB
MD5015fd6ee03794c1a4d97a99f7a88dd44
SHA14a1d89fc5302126ddd118fa2c0c235fa972b1190
SHA256cf6353bf310bfd3719fea89d42a8fefe6d8f35ecbb02a448a585258053f0fed3
SHA512ee233f6f2dfc3a799467bd3f3fa827f5c2291a38a0ab21c569c83f5bab818cb10dcb2e504fe52b4103d590b88e5357b078c5c0a177d11075797444ef5ba28f2d
-
Filesize
5.2MB
MD570413f1858b076891eb7a827591a9afd
SHA1b351ef5f29e93c08eadb06b22b34a588da6172c1
SHA256c8666b997c3e824476531a330a8ad4b1cfc57289baf5d732202ab625a0d779db
SHA5122f7e836985d98cb2ca926d32da03b17544b9ffd39092b0f80e94dcd5f1a95ca1b0123e27d92442fb430c343dc578dc8941ad9f55b101d4b575c9b17600aa77d4
-
Filesize
5.2MB
MD500b1e668b853bb886bdbfc7ec75092fb
SHA101ca4184a100a69ff4e999f10c4cadac358086a9
SHA256c28a03dae24515bca3174f33f298aa0581f88cc74f2563422ef7fee2cedfcf9f
SHA51295f8276f909425025747201317134bf918994b118ccf84ae6fb6557e9c1147922df0d68caa8550ecf4e6dcb9a838b8295de8e1e6d8b141fac06e1dd44cfe77ae
-
Filesize
5.2MB
MD5c0b17cf7b4be944319204503bdfc7f31
SHA1fe3aa06c0ab43b688ca1db84d7a59c6b264d06f2
SHA256936f3b5215091a007055dc6c1301d4bbe5df7fc49ae34042755e1d40098694db
SHA51204b53a8621a7fa5c6d7e8875e3c18388624d237beac42f87c7171b29e990fadc011cbbfbdc2219f2703bb415af3e9477d6d59fa2abdb374f0d0c7776c091f652
-
Filesize
5.2MB
MD50dbf845a7bc6b7bfe7f7095e0e80f724
SHA1a2c1ae2d1c8d6382e280c97c2d0efe44190f5b46
SHA25603dbf20cf78d6f5aa434a3a5651da8afb481447da51b4ea260d0eb03facd0d00
SHA5123d24ad25dc59060438df39b699c0438ae7bfea32bed69c613bc314aae7f463911306529bb6e2c40b3f7c62c2d3aa7555bc17410247249cd62d68758b55a62ed7
-
Filesize
5.2MB
MD50d7a792d79c0acca5fa5af4a51451bac
SHA10d1764cf2e4d97ea253d6b3258fde011b02eb236
SHA256784b49cc093163d150877fd9a08f21428cb150af4b7ed7a1d7187f6fad725335
SHA512fea961840687d118b38eb6e6b52ee06f78a331ab9c1e9ed6b8a61694c9b727b4f7ea4c57e786a70c6f2dff55fda22e9e97dc2ccaf51973d0fc308ca679d832cd
-
Filesize
5.2MB
MD5c417a4d70f46039fac2a2d65ebf47b3a
SHA139bceec61acebab88c61546bdcd752b5bfd9410c
SHA2563bf9c491599c74814ebaec47435b571d5d88e1156cc5e4addb0331c1a37760a7
SHA512e546c8e1a5dc7ebacdccbe63ac8b066d75b4cdc179d5d65e91caf9a906ec222f8b3745f83bf6438ca89c279168c3b5fa02adff0b9b99d034a901c767359c7136
-
Filesize
5.2MB
MD591d1e1771e14b47f04d9bee835ae06e0
SHA1e615eb7793b6622731b94d5db651b6a8105e191a
SHA25616e14528998e7ca3200cd66507db73ceb94d853b677ba374757d27aad3388dca
SHA5120208bf9706b0e879a86ba0309881decf7551d8cd740721edcaefbe26887477668bde38f9c6dd40796f219a1c0107490cff43b534421423d16d2b95e3936b0913
-
Filesize
5.2MB
MD59e53a03dd1c2dc78d6acff282b533334
SHA1f0d6135eabcf95a7eedb00f14fa3d6b39f336ed1
SHA2562fb67533019194c85ce3ea8d1efeaff67a1ca9cda64dd59f0230588c1f714f4d
SHA512c93251c4cb66ea9c8d346733cffcbded9928f2f43fabf78c09f851f23360f6b011476dbf2652794de507040fb233afe396193a144da68c2d89aacbbf02e5ac7a
-
Filesize
5.2MB
MD55ff26a3141a79f7784ee2af87305dd49
SHA137cfaa07ceba5a92e07a292d47c71180957b124d
SHA256c506aba4903dec8adcbf8be46742858261261cd2f67603421d9bcec60a7bccf4
SHA51246d9f53d464bfe3bbf24056a1421666a9d14646a55b80250a3f63a7e0e20d48904f8d145a811e20758ba44939abe8a9a15df97902ebb05b38b8a0737e80068fb
-
Filesize
5.2MB
MD5ae0c09dc4d7277fd4cd0abec7bf863be
SHA1107f8ea069182f805924ccaada7371468f1b90c6
SHA25656ec50ab2be0665485acdc0e19a47e70e176fee76541be356a7158087f7b7cdf
SHA5128f07c50f03fb1fdff9098b9a79bb15fb48d0a49b4b4dc1f55f323da516d503d0fc379cb81f8badd0c8e1180ccb2de05550d4cfd363a649d5d8937bb40179ccf9
-
Filesize
5.2MB
MD56c2a130732814d55122fad1b7fad4a94
SHA17c6f829be50e4ecd27a08502dc04185ae3a85e66
SHA25678ccb243ed5ae85d36cd40fa91b6b97a5dc880bc3f240e8dffa6559e1526c9ea
SHA51297a22f48f58b1a82a67647da11ce77887fb7a44cbb57b2d506c0b222694d81124d0411fbbd10ad400c7d337cadbfc971ecde8ccec1b7c96e79fa4954b24e2e65
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB