Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 14:23
General
-
Target
2024-11-20_5a43481bf402bd0ad63c6c46b4b5aec3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5a43481bf402bd0ad63c6c46b4b5aec3
-
SHA1
7e1bc60dbfb36352349b2a60caae05fc22e5479f
-
SHA256
e0b7a6688ecc7c4316968f2e4c710a7860225733e5b6f63e7d551893c44c324d
-
SHA512
ef2b5b243011fb984dba102170294ed024249bf122261324861a3158cd173208f8e63185e2989a2cf0abe5a878ef96fba5a2a09b5ee9b697a8f585597a862375
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibd56utgpPFotBER/mQ32lUd
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-20_5a43481bf402bd0ad63c6c46b4b5aec3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-20_5a43481bf402bd0ad63c6c46b4b5aec3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FRnnrvb.exeC:\Windows\System\FRnnrvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aIrMEeG.exeC:\Windows\System\aIrMEeG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDHZRYg.exeC:\Windows\System\NDHZRYg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\meMAfqT.exeC:\Windows\System\meMAfqT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XJDCaJa.exeC:\Windows\System\XJDCaJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cuvNMvr.exeC:\Windows\System\cuvNMvr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vJnOgOB.exeC:\Windows\System\vJnOgOB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWriUdV.exeC:\Windows\System\qWriUdV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\flGOUjQ.exeC:\Windows\System\flGOUjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNlXTbX.exeC:\Windows\System\gNlXTbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wOvOJlZ.exeC:\Windows\System\wOvOJlZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsecWIA.exeC:\Windows\System\PsecWIA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zqKyALy.exeC:\Windows\System\zqKyALy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QsRVJTI.exeC:\Windows\System\QsRVJTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gkYRbPM.exeC:\Windows\System\gkYRbPM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CsULHxm.exeC:\Windows\System\CsULHxm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sMuIqGn.exeC:\Windows\System\sMuIqGn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aKcBMZC.exeC:\Windows\System\aKcBMZC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfUppEz.exeC:\Windows\System\qfUppEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DesXhJN.exeC:\Windows\System\DesXhJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gCJReuM.exeC:\Windows\System\gCJReuM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58a55674d1a9e386aad8c91e6069089a4
SHA18f56954f4b876ae3fca25998db6f4266a59d3b0c
SHA25661d621ffb6b466e1022d11aaa4d6678b45e7e07a2de41e8879f0abcc4826be67
SHA51296764bf5c30102fac8483f1529c9eecbd11b70cb5695948e47f3840351f9d08a623f79ec53665440b95a412fd26315d421fa42932a6344a1320a3c09364e6b0e
-
Filesize
5.2MB
MD55dcf0c460dccce03a4220baf5ada4a48
SHA12591fa525ee4f54310383b597c96d71b5c8b35d9
SHA256e283f7a70ec8f663960271e44a129d72e7a73cbe74f046e9026a4cf1459a1d33
SHA512371668c0f79aff3944d7fa937cac8aaebb616e44f0dd70be2586bb754c21ba0aac2f1a02b86b679c11d0e27298b1521af3f9af0504b37069664f0dd58f58d255
-
Filesize
5.2MB
MD528313092651e6d73846ada3fa22a0c73
SHA1c35a8975f926be3711f96d67acc5421e100e6092
SHA256d5aa40bfd134d3392b2be0286bd619d66a16bfd091cddae7d1011c5d0d9f3e06
SHA5125539c9567ff6b8eb85721d937c87954424dab308effe77fd190f88c098329bedfb8dee7f1f9d9f13b902f80feb9c3be7a4526b9f442daf2d7d58f31dc9e0261e
-
Filesize
5.2MB
MD536f8d305e6710ab9e453b9db136dc81e
SHA10626c8ae2f89d0f4641329ca91427c5d4dbfadc2
SHA256773efe74b9caf3b0516d94f60ac4a834f565d5f10fe0ba0f822cf930815aa613
SHA512e6bfd75c606ed97e8c7ea795a589ad5351888a438f0ca5ee7171b376519a1032cd99a3480f3c0d9d848f4282de7b05365385dcf7e7308886ab0ff2aba4e14dd5
-
Filesize
5.2MB
MD53b44d4eb268fb0a47e2e5061c6225d87
SHA1b3d454c72bb0fdaad5d004b1245159d0a1f53396
SHA256bc0d532a3467585a64ae9b7d626e2e89484171f136ba3c431c796c943b6999ca
SHA512ec88219afe0af97154edf3f08737821c2ae075fa1819d2576c23ad07ce32a74d2ebeba57cea32ebcd8677f66fe660aa2cac340ffde8100db7c694c38a826b51d
-
Filesize
5.2MB
MD58f7c44479bb37abba0edb962ad9b9cb8
SHA10991b56b11b86e2b9f53e918176dfeab2429f5e7
SHA256463125be9d4a94e0d6aa2e204a8ec0c33dd1a5a538db1fc30e1e4949f640d3c3
SHA512db313a5dd8383280c1447dcaaa2647c637111d1d936c567a7526678ca78ccd39ab5fc2876a9f49aa58c75ae166ca246741461a5bdde0866889e64d89576f2efc
-
Filesize
5.2MB
MD5ab3ac968d4db5aa4927090ac533be2ee
SHA171a1b552ec4079183f43f8bc0b4032e40000b3d2
SHA25601e02e3402300daef4c20b8542e9783ff0392c8fd4b374deb1ec6e5e8e22c90a
SHA512b4c823cd386d893863c64e8938c17fb4561113756f9b29e1af7ed7f88c007f355813099716b0910a555a2c78daa19a4b796b5d0ea131ca1a85b32a7a405a057b
-
Filesize
5.2MB
MD5dc74de760db85bb165a0548e02e9bbd2
SHA16409c2930d7df66e4c3bbee1356213a886e3adbf
SHA256a33a5db6a374764957dc291950179e01b283aa7305784f58cc6705dfdc0fded5
SHA51267e1e7cbd35b2ccfc22fda4c42bbff7fba9c0d701b548d21bd49225815902469fecea972eb1f554863cd1e3e57227dcba4620b133d86231951cf5f998d695472
-
Filesize
5.2MB
MD5baa6cc58e41f3bfc47bf41231812a375
SHA1ec01d3f84192bd804d7551ec3e5c59f807f47cd3
SHA25603aaaacab7118b1a970c2b2488df78436a3ba0b70ca6446581a6dfd84f0e9627
SHA51277d2e65807c81b9c099265059c534c50c7592ebd7326dc8c63eca10a341cdea08ee7141289fe7a4e7a694d1f9a85f5928d09751fa5fd9be9597e46d194c5f119
-
Filesize
5.2MB
MD5dc7abda0f5f06734fb1b406be0c7f4aa
SHA134b0d5950d40fde51f98769106bd4ffbdb2947fc
SHA256205bfe2a4758caa5d3279a6a38d5d0bdf61b6c9a0e178baa7bb3411676e48be3
SHA512b05ae0108f527515c9190e5ead74966ea188b0f2043a7f8578758844514dcc731e39597c575b81b65f0b0acafda8564bc0ab157969ec8c13f770ecc283db0600
-
Filesize
5.2MB
MD50a3a599bb8b5453c1e8fada63ae6c71c
SHA10a96bf84ccc81c14b6de2872551fce7162cdba3b
SHA256e491cebe575f6329854142dc9cf4b8453e0afef7028cb1caf8701026e7d12bdd
SHA512e2ef70f9ade60ed220b09df1e9bb84fe24fc1130ef154d88831c1694aa78c6c6b8deef74e230132a0a9136f7082b99f89e4640e70a4d2ef5df3fbc385acb7421
-
Filesize
5.2MB
MD56f9b03dc62ac177511d37447a728b535
SHA1014f05a2fbf6aed8b08e07e8c98730c4ce806fbe
SHA2563c63760c6eca0e8165a9820e49173c907a5072661488e76b8a76372b1b603826
SHA512333d68fd8c7e5f37660ede1b6cf2a0dea88dedf25845f3d943bd4b3a0b8d300d1abac532e7e682fb0287a65a86618fb902d965b879c414ee76d0a7d4f5bd62a0
-
Filesize
5.2MB
MD5c6cbb4364ff0d65b45dcf6f8f54ead91
SHA1cd489887abe0c8888fcc4da5a977bd05aa8bfc66
SHA256612c4a909b3bfcbb77b1d6af4a43e44f79f1471be1d5be15c329e040252ff08e
SHA512d8338b57264a989dcd2f7d66eb905c022b1b4ea4b183cb803fd44d8c0815f7931839c2f00c35b33a65f16f591b9b9384840dd58588ac459348617963f23bfec1
-
Filesize
5.2MB
MD5c4c1d95532d74975391f07cd5629210b
SHA1379b15045fcd26007f7cfc5158fa7500b65ec3f6
SHA256553eb4a9840e74e1a8af6d104fc64f6247957d0f493d8966b9665b404681e682
SHA512c7488efa57ef488d908f45622ce0363f82b81ae2fadc45e3a9b1d94a3525142e4a09ec82728b1ea853f4dfb94feef0c60a5cd09d645be2f2df58c19c8bc351f0
-
Filesize
5.2MB
MD54b2f051ed8a0f711fcf3c468314fc137
SHA151fa3b8ddd3b4fa0e8b30ec3aa8af3e2358ff686
SHA25676f74375243f78721e85724f4e67e5ab76559bddd344dcbcce7cbea15e0f302d
SHA51228d4d5475418d5741cecaae5eb771493b8aab32853445f62962b60b2ef168709cc86480251c0de4ce413b35f8ad473fa4b4a0ff0ef1e09da1931b4415181cdfe
-
Filesize
5.2MB
MD5e143107c702503e117c60af402194b3c
SHA1e0d4f004430fc6afe6e5dbb4e4355a5e306828ad
SHA256836bfabd68d352ce79ae8fd8ae2bcee9d594184aba5be661c4fa12a30e69f0b6
SHA51299425946d459287d4997926320420cd7230a7260c8cc302e2f88292cf06203c45c979427fa58bf7612636a16ba23b8a9fb5a309ccff6466107da67a910fe0188
-
Filesize
5.2MB
MD596a6be70878b9bb5aa6166850c8aca6f
SHA1af202d4975b56513b26e93d1d602bf01b72bb160
SHA256ee96540c6a7f8ad1bea6b4d5dc67b0503b1f299d83a9d92b2330932b056216f5
SHA51213a846caea5b0d75c0b0ff65515555894860246b72b00bc0e5f3a1a231f780b59b3657df7804706fea06d3ed3ca588242519e4e84a675f83c29b9b7de160527b
-
Filesize
5.2MB
MD5bc6032952058774cc2dce69d42a036da
SHA18e3573e41fc3a766378cedbd6584f86f1472a2f8
SHA256b08d2ee74ae5e4cfe042e588add58ae7cb898892f1dbbc7f30f2bae81c85d282
SHA51276712e39a686b889f8ae04bd66906d9871c10942f501c8f3a1ee6986c1e4263a81b462351adb58f889e6c0631744d1464787c8bf33b73154dcbd1967f211dbf0
-
Filesize
5.2MB
MD54168f0de0d99dfb7858704778ffc35c9
SHA121bda0ef650cc26deeba8a0a92dd299ea046cb37
SHA2563c52f247e73fdcec9036bf097a824011fe99f566e2a14df18f63733c0d0aaa65
SHA51246012d139e4d074fa59a7670710f3c4480c40c164e466a4cc3fe61f04f778a2cb811818aacdfe88d6f3a0967887df50208827dfb062910627a437c3300aeb2b8
-
Filesize
5.2MB
MD5345d116ffb994029508068c7affff3b3
SHA1ac876e8fbf3a474d3d83f548ca673645ee81a56f
SHA25600ef591d37ad647f3104d75a02ee6695b6a3a3572fd1bdacb660382798074000
SHA512797b41528528c63a712493048108b3aff0ef9c468ce89b8602f175a090d9a76a618851ae9949860c0b83377a718e22ff656dafebe5983214bdfaa683b1a4c55b
-
Filesize
5.2MB
MD551538884bf6715d0b052e8be649e4204
SHA1f59eb0990376756e39400a2fa94f012a8291ecbb
SHA256d879b72dbbcf8373816d6fc43ad641098fe616e4aa56c5a7e7a16719c4f7ecb0
SHA512cfb7e6ef19be974665062ed9af7061335cce7b0f544f0531277d87ee8baebdc3ff64d19d5fcb53b2cc3044d0d7dce4908acaadfd9b0244d0622ed9b7bd671fa2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB