Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 03:08
General
-
Target
2024-11-21_26155e104534a9727a56b980358c5637_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
26155e104534a9727a56b980358c5637
-
SHA1
fcf8bd86ab970235056a45d854d173275dd1c8fe
-
SHA256
aab032ce4f8a3786a954f3af2bf936a96894b24a37c8d1d8c00255a6083edca5
-
SHA512
db554ef2c8e793a54a7a61471a2a8abefc738e65265cc8ce5b87705abad3f46ae2751bb519598ff40aef296cc3d386d71f1e739874a93beaad25e08f52240de4
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibd56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_26155e104534a9727a56b980358c5637_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_26155e104534a9727a56b980358c5637_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zipzUsZ.exeC:\Windows\System\zipzUsZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yETcltO.exeC:\Windows\System\yETcltO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QipIjYh.exeC:\Windows\System\QipIjYh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\orrVjtT.exeC:\Windows\System\orrVjtT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eRsWHCv.exeC:\Windows\System\eRsWHCv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zepmXpE.exeC:\Windows\System\zepmXpE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RctOJuU.exeC:\Windows\System\RctOJuU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ORHHkNg.exeC:\Windows\System\ORHHkNg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNacxya.exeC:\Windows\System\hNacxya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iyZwTSm.exeC:\Windows\System\iyZwTSm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WEwDfFd.exeC:\Windows\System\WEwDfFd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RuAjYNS.exeC:\Windows\System\RuAjYNS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wGLhlvn.exeC:\Windows\System\wGLhlvn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VIsIViq.exeC:\Windows\System\VIsIViq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BaBIXGe.exeC:\Windows\System\BaBIXGe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uYgzMQG.exeC:\Windows\System\uYgzMQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvkGlXY.exeC:\Windows\System\YvkGlXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jYLxVuC.exeC:\Windows\System\jYLxVuC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgvdCJW.exeC:\Windows\System\dgvdCJW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\doRlMWq.exeC:\Windows\System\doRlMWq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpuNmcd.exeC:\Windows\System\BpuNmcd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56b0d0dc662e025a980a0385a86dc2f62
SHA185dd4027858cf27527b50e09ec865ab617f1f703
SHA25648a79680f94e81b556a51d4023fa8f9d7ee0524149fdd0fc83e9bf0f76b0fdf2
SHA5122595b7bd10cbba69bc5bf6ded0626078c337d68530c72a31bc9be1eaac5be9588c61bbc33a358145dfd22302d6cb9ae4583904d986b42c649a02170665b964c5
-
Filesize
5.2MB
MD5eed25005830396deae26f601278d9400
SHA1a6a2902ff49a7943e87cd3a517d2cd7df0e7b570
SHA25631feed65c252e5130ea4d4ad13dbd0bdd53378cf0af72bbf6fa5fc7a5634b5a8
SHA51262b0b6c0c2f71683b379358869bd1423964fe5e02a3e34c2c85785af81fb7b180298cabe3a55bcf21765830368a72a68072ac719e03b1c939c6be7b53d69ca18
-
Filesize
5.2MB
MD56756bac281a30c7c3e36f60d5a11838b
SHA1bf0338061a3140d351b52623bec55178f7f36002
SHA25659f5e357ff3ae2e1cd07085b9d4f555eaa110adb37008de4c093cfdd002edc8e
SHA512600dc11ca48e000309dbdda26ce55c8850e54ecbef01a5d36ebbc66699c27c7c2f36fa1525e38054f765a630c7f1600259765ac974cc1e8b9c0246a8e180a8c4
-
Filesize
5.2MB
MD5301b53e3f30baf7b38a0702e8888d43a
SHA1de6cdc059ce3ffff43841c3cde8f01634ce2ab6a
SHA25673199001cb357f72ea74f0317c694ad9051d0f9262fd4d6b2a317333a8e42b3a
SHA51290f3f44d57eeada544b14606bfefc2a5df7c5d6995a572fc92b4bcbc6dd972ef0f99a0f802992e185df10785a0c1b69f047d55a9b12fb5532f5df0a42bb01f2a
-
Filesize
5.2MB
MD52cc612143388a5192ce2438861be5ae5
SHA1db32c8cdb433c6c00dc21e401229be266c09da6c
SHA256e7c3184494cf1f669e97181cd2998036c3cd6dfc7564a6151fe5620765a9eae5
SHA5129a99eff6bf0d2bc498148d9cac5232644678b3b52a5337f8d5113f5e442b964b75178067e76fda17e13e80b7602e7549803be98571650681fc02e425f2349224
-
Filesize
5.2MB
MD549319f2cba3ab951b64aee079b802062
SHA100b14f8e9527f6a96b9b55e05b19553187e958b1
SHA256d644ee2fc165b9aa9f6b76ac8bdbb3681fd680ecf9a53c2b6cb69ab75878d5bd
SHA512d21f5be9a125f67168c0102433e1d0b7b4050f262c46a40ebd5a0d5a17f2eccefc4e31ce56b302e096e14fe395f0cc7e362f1e1a754a34298dd1143466de4b9c
-
Filesize
5.2MB
MD58b2293cbe0b4a38342fefe5d7c4f4fff
SHA1e9e932afc2caac29fdfe2e88c3f5c0842603ed57
SHA2569dea2813771d151ecbcb84dba286302bca2006df0da1738b1e7fa75818d17112
SHA512bc70797605051fe07f49aea98904b31070ec7d8db5b562a122329d0c9129e10ae77f480fa7295db19d3a5b2812c26b6b969eb375ae21f521fe7c1c44704e50cf
-
Filesize
5.2MB
MD56244383705d37b4e9296a72f5d9f0395
SHA1af8a17d6453cdda51d43a02303982c674f63772a
SHA2564958a1e237ed5eb6b3c80eb795d982b0e0f76d1ecab48ea5e9f234e666c05208
SHA5126e9c1c2f267b39440e7681066b42858cf221f54a97217e90ac287c8b90b37a9f48e6498975cdb38e088d5452ef55657a7a1179122e352ca295709cff169fa995
-
Filesize
5.2MB
MD517b7ed402afc32540aee89c61b883801
SHA16ac5442ccb51946173cc376d6b686be76e1e1743
SHA256d54250ee4579fe5fac8bc6a7e84a3942db964a4bd0ce73db36992710e5c9b99b
SHA5128b759b46ec6155f44f424365d3882bbdc5c17d83a3285dbf136917ba27a6ed993c04537f738259f43b5d9d659c12b620b18f1e93b55a4c27e97c8cc9f7b04f9b
-
Filesize
5.2MB
MD55dc43dc6ede8bce082d1d68fb1205d31
SHA17f409ee57a8a1080bbf42a14131a39af8ad3812a
SHA2562efeeeb4989d3961f433b76ef1c8ee8c77515a527eae7ce1208b7f829e70c51e
SHA512a06d568a1698d04ecb8a5e3821d45977440cedad2c930c806069fc64dfcf05fbd8bf786711df6998d77a86de4485a3942769e86af6542c5d38634600f1dcb393
-
Filesize
5.2MB
MD5ffc189d23162f2c7a2a0c772d4964028
SHA110dd81d33c1eeda7e41a2b1ea9c6085699937112
SHA256c9ab88b7ada6425667752de16bf8a7e7dad24e5d19058c49377e400422237872
SHA5123e0dcd6f113f29a5712e2454cfcb642a1f62114e655c85f0ba85ed8739b6894bdfeee3df1f06a5acd35e65ea11dd8db7db687878115f62a1f3c820e2cb2d8f18
-
Filesize
5.2MB
MD52260ea7ca73c02641fc09f5d7adfd98e
SHA167b65cae6dc9edcd90223b657efdc3a5b7148de7
SHA25682694defa3aebdf48eaf22bcd89494d79ac827b4a4b69c7798350f1922c87707
SHA5127bb8901137c4932b20b869a2ebabca6dccc9471b66b78d298ddc45d3d3e96a43bd7eacaf5b6bafe39568e86e603e93f6b75382c7a29e8a4f69fa283d75878e24
-
Filesize
5.2MB
MD5b16b80ed6c44f6d84784ef5b5215302c
SHA11140ac4851c019fd4558bbf9b8b6846fcd79047b
SHA2567bc6810424b2d447cc4db67716a3b46a85667c481594be547dfff66c0ff2a474
SHA5124468ec3198082d021ae65600a8d414130f3b32c10d6ebc8725ae1ca35b99da39408b4618288d740b83832a87414bedcf6729a73bc8d328963ac3ef2577f50378
-
Filesize
5.2MB
MD5310f4bf9cbd0a9a4cc17bb8b58aafc10
SHA1ea1180592f007486ca3639abf134409e95dd102e
SHA256538ba6dba4f1b939b5fd1c3fa72c2d264eb333684a93ff1839c616ad5bf27f84
SHA512d247699abf32c2c62a28c733fa71bae9fe05c9a763cc329beea955f6805a683831019d269c321f32e4e71e2623cf0ff7bf020b1ef3aac5bf7b8e147db9dc547f
-
Filesize
5.2MB
MD57e227022beb788df8a1b5aafd1372fc6
SHA1c2b4ccaf5ce6711a8c444ccb2da4a8094b1e21c6
SHA256b0a6c2d4d788ff53b78aaf1d7ae37a3d8aafb3694d148bc23bc8847641813f9a
SHA51227a45aa25b4a0c8274803ae1b3578d666aa530a2fdc316f81eaa23db4187f1dbee11a0a94224fadb7349460b89939fb7b4249b1c45d2253f97cc24302abc40d5
-
Filesize
5.2MB
MD5a5021109b6eb45462156f0166856beb1
SHA1c5c1509baf15456d6bd90a53d27dd92fb1de2de1
SHA256a6b22d65c5b9f48a195bd681995fe1bec3f6424e1e7c10ba9f2792d9cb49d84e
SHA5126e0b61156d6571fe95173f4db758073b2009c05e6b1d558ff0fedaac940de2f568c5cd153265dce01de2dd1eb08d0cf49f6f99bfdd46e8cd836ef2f35f7d9145
-
Filesize
5.2MB
MD5bfcba362361de523fc08803bdedab420
SHA19da3b16e1a1f47cf78bc3b61dcae1c38f32720f0
SHA256bedc31d6fbd9e5d39df83efbca0f89e077e36c43e2bd0c45e9db2c3785774573
SHA512a151efc917dafd9ba7467072b78780c4ea040cdbfc33264e8474069f764ec46bbcd7ed591ecb3e85e70c0e6cb48206be471f103ca2c945f0538154b27b0fe73a
-
Filesize
5.2MB
MD5a08e3cd72c7e1c2c39eb5b2487309d00
SHA152788a11bea62f7cc39033476952abd87fdd6ae8
SHA2564fdf6155e705eda3379a82201190990d686a1ddc16cd77b0dbfcd72a2ba0c34b
SHA5128831ac2d598eef7785506c47832a37cffd91196a652647d305f5310a422a97d1787768c51fd56acdd6019fa451f977c205069ed5460b6cdc447939ad79219c8e
-
Filesize
5.2MB
MD523744f68da85b1431733a5ebd82732e9
SHA1c2d150d35e9f6f6b8242fb411a1cf3c3b7bbbb75
SHA256e4642d569b00c0f0b1008b00fdcfced590c53e5e1c5ba81115a0ed19ba77710f
SHA5128680e8c567eb4163ab70bc792944541ba8c65a3beaa2958ced5c528c2d68be5b63f4b4892afe6287bd79448837c0f7493609bffe663a1f3493aac714ff2ba15c
-
Filesize
5.2MB
MD5e445f916353c96b7524e12a241c3f75b
SHA1e55518b9b084d8854dff8ff16ea718400bb2d99f
SHA256f3b940c93bd9d42b12c3cee1782275fd0f0e180350e3b8ff36c5c7aa33d92763
SHA512984ca28d8b69bcf4c8dff6546932485dba9fb4236d438ed57d877806393243db75a048def8f63f094935f7c0e0e54ad70a34828c25b5549874272630c7983737
-
Filesize
5.2MB
MD55679975234376e4119177bbd1284db24
SHA13efa7d7b48d3e030f8a98be9f8e02b231b25b9fe
SHA2567ae9dcaccb7696565e614b779fd8652e5654f7694d222484a0fea75749e838f2
SHA512a714d61be4592cc5849ff80b16bab051f27aa7833a01f9d59809c57f8f284c9d1999f854dab9f8cee4d5bac58a4a79d1f9868b96f44237827cad9d4cd7e7f43b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB