Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 02:44
General
-
Target
2024-11-21_1f266a8bd5f09f14a19f94246b03ef3f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1f266a8bd5f09f14a19f94246b03ef3f
-
SHA1
8929b45ab14314b8b81ed3ff557f5416919d81dd
-
SHA256
ad977b6b18127fa1cc0b2c8d4342a85f04503fe8c4d41ff74d0c6737189fe846
-
SHA512
25deda3ea711cd8d0370acb47a1da343049de4bb2917cd73af66f6157291ed33455ab0ea2ae754597f33ec218f5e0663d2440b053c970c9578394b4242621481
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_1f266a8bd5f09f14a19f94246b03ef3f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_1f266a8bd5f09f14a19f94246b03ef3f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\GMqPmvF.exeC:\Windows\System\GMqPmvF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KSslnqs.exeC:\Windows\System\KSslnqs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MBeuopw.exeC:\Windows\System\MBeuopw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mtoQwyb.exeC:\Windows\System\mtoQwyb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UIyvhyW.exeC:\Windows\System\UIyvhyW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EIeYgoq.exeC:\Windows\System\EIeYgoq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FUpWtdd.exeC:\Windows\System\FUpWtdd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jlpKhAw.exeC:\Windows\System\jlpKhAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGgYaQn.exeC:\Windows\System\OGgYaQn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HObRoJw.exeC:\Windows\System\HObRoJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sUPajmf.exeC:\Windows\System\sUPajmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BVwIjLy.exeC:\Windows\System\BVwIjLy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aEZHsgA.exeC:\Windows\System\aEZHsgA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhJsPGd.exeC:\Windows\System\RhJsPGd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iFlRnDi.exeC:\Windows\System\iFlRnDi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\prwXtWO.exeC:\Windows\System\prwXtWO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wZvXUSz.exeC:\Windows\System\wZvXUSz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AiFEZEO.exeC:\Windows\System\AiFEZEO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fvtUirR.exeC:\Windows\System\fvtUirR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OkGlzdI.exeC:\Windows\System\OkGlzdI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ISuOcvM.exeC:\Windows\System\ISuOcvM.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD597fdbb313eb537f2d29d0cd1577dd57e
SHA1c84ccd60714c335f672a45d096530a364db548d4
SHA25679c9901ffd98013f1a53a37c14591320bdb4b601af1ac3a7ff88604c7b141e08
SHA512796ca659e40303a3d3951380424c72e7c56a7128bbd2326099bff2cb9f01d7d0b3b533dd2eba9cc85c45524965d6758c51ca22ddcfbd3a91474fbf29a58a2bf0
-
Filesize
5.2MB
MD5b8e8e20bc0bfcdfea4f9bd685ba2ef94
SHA11f1b0be129d168916c4708d1c3ed58b7bec5c26e
SHA25640ebcfaf0fa4d95dae2a3295c52375e1faeaaa21c6d408ac2d63b82efe43f6f6
SHA5122a81ec5d4afc57e2376352f5e21c2c3b9954e5845312751e90e395c81efb45965cbf3007f4ee8d71d931bcab025118e4b7a4595ef26382d37705230f5606079c
-
Filesize
5.2MB
MD59c6790cc7d30f7dab85297313f02e5dc
SHA1e765cf77d54968c06f32a34e33ffded27e51392c
SHA2566faeb939604e2b7ab80dcba134298587a8d2f8e15502edf74872c530d8be1958
SHA512023771388587c4c453e9d1dcdedae9bcae8e97f518926327f25822e1bdca9425762ed215cd83016f495ad48cb28be984650d376aad376b6190e3bf61ab2f6042
-
Filesize
5.2MB
MD57d357f376e5baa0b1befdd243f3fc4d2
SHA14f4808eb055f13468ce67d3ea73132f9c19a3ded
SHA256d00bf3d3b90ae05fed7630b5cc641e9138cfd170ddc54eb88fc61fdc5812d0c0
SHA512b7fd6d36a38cc0a0beea4ca05bd44e23290514c128a73e933b30c9b084a17b82eadb3dd35ba6abf91532232659a42078805e16887f9ac718c99413472ce63a9b
-
Filesize
5.2MB
MD53dfda9fe9f5d7cd21c3a54577de59477
SHA16dd1980215ffa9e619e1eb2cae612caca12ba613
SHA256dd0ed8aa9286403d9a57a7de369d17c94f1612ee59877908135dc9397cb15853
SHA5128542f5cfda83a5be7208bb0498766d04513cc3d6f95d5e2302ae7ed1599ab1fa374cb5615545502b67af19834586bc72ee335145d1933fd527349c5e040ea4d9
-
Filesize
5.2MB
MD577f5662cc6b5572dce33a6afca71cd7c
SHA1b8a68ec7c40769e4d2aa9c42108de324843ecf49
SHA256165c28986575791c7354b23bb2e45a8f1e327b7e53dfa3e66f439c52a8661f59
SHA51202e84f09d9a5f1d69dbcc2056a63aceb993a8dd85b7434035c829f2282210625168d99a6d386be9dc72fb33dea8e657a274d65978b0d849663fa6617aeab9ae5
-
Filesize
5.2MB
MD5f633f2676b2aa317c1b1f0fd5b515388
SHA1143aa3cbf3bf36cfd279b7029869766053de6058
SHA256111040d2040fd161ac89dcc40b0cba5f36e30685cdb340026dabc22b8c4fdf6c
SHA5129ef9ef9e4a37629a3fc13851389fd25cf2d12df924f1e211d168e9cdf11afc466b19a6881379b7b23739ca5ce67925f50273478140c493ba2e68a639f483238c
-
Filesize
5.2MB
MD5877640d9477bd44bfdaac7925a8d2c59
SHA13a618db49c790e1d8a8b497a3346da45a4d0c741
SHA2564dc38d00e284c58d475eeaa873f9d8215143880a3688cbb2c28d922e33012da4
SHA512402b1a3e5d401819f2057557481908b6f9c32227df6e3395f6bb2733ec163d56513c15f5c83674cc462c6eeb35b4b69ac5b35d3c171bf190ca30d63923153758
-
Filesize
5.2MB
MD5c49c63bc84241c1c48230b5103b1c335
SHA1d99adb9f4970907912e0a723f4a1e2a17fd6b133
SHA256da17e3d18ad5b2a676af431337b9f87b5c11ace10d9ce7e56fe74cb8a6d292ca
SHA512bd1c40d072f750161d74e1285acc11d523510808c0134a4e2f4f4004cacc433ca2b49e45893623ae80af879699af8dfed156609019d30e3c805ec22d36fc4d02
-
Filesize
5.2MB
MD504d28fb628d6727fad4083cff9206dbb
SHA14cca1c61f14711f11c981bc0e25f80537a9bee87
SHA256c16c31c52e75b03a6b52ab67a5c51525ac93fcac0ab393787ba8ccf3fb547c75
SHA512dd27392373851ea4a23c46e1c4bd7fc5f999d7828e3a45f7d2e2b0a51b75192c51e304050f18f059e01ff65d490c67e310651fab5be39de74e23f3a490a487a8
-
Filesize
5.2MB
MD5568dd219c703379220fd46073ffa99cb
SHA1370f0436952e99638fd33e83371156a8f1ab6529
SHA2561a9ec0527abfc3f630d578575abfcdbed2130d43633e0f5512b9a5f10c33544e
SHA51245280d234603e8899b78477d47cade3d7a336e3d40e8527a34feced6af8dd89925321fbb5193af1f1b7709ccc79b85b4fa85b82fbc4ba26dd0eafa28fa043b45
-
Filesize
5.2MB
MD5ef08bbda83f348fddc0067bb84135a06
SHA16c297263d1083be8161f3f42b2d8ddfab4dd9a91
SHA256140c85e4bbfc6e3694132df4d73bb4217350abd821660d91a23226bd2ffa76e3
SHA5129119353577d2c87b2b4f83da3a7832f76571d7e3528b534420b7d2b8f4631c873f41515a634ac984940264c11bce2031715bc51bea2feba4d56733235b3b26c6
-
Filesize
5.2MB
MD52eca8c4ed6ce0dae73467f8ab8afe835
SHA14b3585eae612f2cc9f67ad4ba1764a43e753952e
SHA256c2fecbfe03b6ac13647a42da83fc6250a9f990546ecadb224f1a1be128dacb41
SHA5122ad508c71485769b16596b85718795bd526794e4ef44b256e389264c9a65cc386d675e74de40bd850b165d3ebc61d4118daf032fce5eb5e79710eb521d9a2e9e
-
Filesize
5.2MB
MD509b4d5c02a5bbd763dc6ae8df17a5026
SHA1c93ca2ba901b4af1137ec8bea4dd6d35a867e28d
SHA2568c1fe5279adc444d90c5f989002824e999e6f849ddb96528ec4b4d178362340e
SHA5127d9de0288f9c3462960ab654ea8805c894c2af863fd83c41a54d2d60846e34bacba80827bd8c846e77f8e948cd67c5f4d721857fb854583911368eb2e7daccbc
-
Filesize
5.2MB
MD51438999fbb3db06a7d581251fe144003
SHA1e7408280a483d912e4d0580513a04814d70c876e
SHA2564f5ff5e490e33e0c3c1ad48d4b906c69f6bb34cf5ed58aa33e22cd2675c1b021
SHA512bc1409389327da078d72a2c6e8599dad8247c7e283851c9f55396f605f63e165517786fa3427698e3bf765e196d6d0fcd06adec601dcdab4ab4f49f358e2fff7
-
Filesize
5.2MB
MD5997083bf03b5217f2f1d7df0535c62b3
SHA13bef6bc4b0a04ba10d0d3382acd3ae98f2c858bd
SHA256847efdf8accb8a514757e4e98b2155ab5d88d5e67a7539b70ea9a0c67e9b83cc
SHA5121611bbf7d50e13d4add189a4ea0c4fd720225e836cf992af430b05f2ab2bacbed406937cd4663543a71b9fd9a77d345e2565d9b224a9ded8f6ed43e22236be2f
-
Filesize
5.2MB
MD53de8f519bfb4cbd2afd05dea679b521d
SHA13c3df22bc76fc6de4c428ff107a99c7e77c0da3e
SHA256b2d12a6a03686c3ed7910859b3c1e760d665d64ea79a5b2dc85f0bcd8de98b70
SHA5127d4cc9d53723de32f0f026cf403039c40d3004d331277c7e69ccfbaf7e23c72c61e314aebb255f4a74ea1cc7dac082b5cf60e7da4aaffd3a433a4e06df01353f
-
Filesize
5.2MB
MD5849948128336dc66a8377e2128969a56
SHA191f1cb835ebf184e0c82c2846dea5b3ba67f73dc
SHA2565c68107041d67737bc9d269eedd0d12f34126d31aeefc5a951d8802d2973cffb
SHA5121276f93f18a5448b4419579e29aa0bfdaf8505cdebacb2704581a1f398e1e844108c808d0848fc57a29eee6c65ea0747847a1881ff0f25af3241d370bf318f17
-
Filesize
5.2MB
MD508a6f165aed0fc6dd5c6efc9a79e4aa1
SHA1f8c2493efeaf308518114f78e3fc232b7c09e8ff
SHA2561ba64a54d3b0a8b44af73cd7760742908c1d799779d596923e9e74ff1f02afe1
SHA512bd31e1a1422bef7928b11965c5a2c1872bf0f0f64473107172f697e2246983189f225265e493dc5b6b17b765ce00ee7ac1f1355c9880a8a40b0201d188442a3c
-
Filesize
5.2MB
MD56bf5024fe7afc8613d38f99489d08d33
SHA135196d88f1c25af041c2c07bee87d231edd1a20b
SHA2561b4de6944d41169282bbb4b9001f5f448a793b2b23bf7887917534d52c68d8d8
SHA51272d04870be5d6cc5d7b32ac3210a4dc752bfc61ffe54b9add6eb3dadc86cbb48d905045b10def8c4f506dd86a7834eac259af3b46d888555df7f8efc287c092d
-
Filesize
5.2MB
MD5c2b1f3d5a764c4607e8eca90eadbd5eb
SHA18ae1ce20736f43124b22a9cdff8bd981c0b403c0
SHA2567695f124c3f9ea753f4241b59ae4990a83a6e258d6d5ff6ac842043e649fb640
SHA5120522884b2487d276224355a433b150ae0f48f461dc2cac1b120635ff5e4a637023c54041dac55b005dc5d3c873b39cf5ad09a9bdcab52e68527bf062cba5c664
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB