Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 03:24
General
-
Target
2024-11-21_34a71234a2c4f6fa23051a3045563a23_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
34a71234a2c4f6fa23051a3045563a23
-
SHA1
3351c8bd1702af377f477dfd3642299bcedda476
-
SHA256
44430d9865b6700aedce9f91036ccfcc79a37c35e795d1d756d68721692dbfce
-
SHA512
253829d02f886ad8ade61cf5330500a781b81efd223ea55cc330adfb5d3ec66b9985199bd44c31156be9adf6841b7341117bafdb6ce0faa6d498086e0e90abab
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibd56utgpPFotBER/mQ32lUJ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_34a71234a2c4f6fa23051a3045563a23_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_34a71234a2c4f6fa23051a3045563a23_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ioozmid.exeC:\Windows\System\ioozmid.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BYHpLSi.exeC:\Windows\System\BYHpLSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tdyYpHx.exeC:\Windows\System\tdyYpHx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IgwfjjK.exeC:\Windows\System\IgwfjjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZxmYch.exeC:\Windows\System\OZxmYch.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzbTZuS.exeC:\Windows\System\mzbTZuS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAqERaL.exeC:\Windows\System\mAqERaL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWgWovU.exeC:\Windows\System\SWgWovU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwTzvXY.exeC:\Windows\System\vwTzvXY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhSwVLf.exeC:\Windows\System\jhSwVLf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YiZvBBB.exeC:\Windows\System\YiZvBBB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlTPiFY.exeC:\Windows\System\xlTPiFY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgjRHJL.exeC:\Windows\System\CgjRHJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SJIQvJN.exeC:\Windows\System\SJIQvJN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yiusdzy.exeC:\Windows\System\yiusdzy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cnTMgna.exeC:\Windows\System\cnTMgna.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZCNLpw.exeC:\Windows\System\YZCNLpw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVIqJyH.exeC:\Windows\System\OVIqJyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uEczWVt.exeC:\Windows\System\uEczWVt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ekxAZbe.exeC:\Windows\System\ekxAZbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YfvcKCX.exeC:\Windows\System\YfvcKCX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD528aa8402605b5508f168c7fd4ffc5e2b
SHA1e14bc22127e3d18faad4bff9178f04d427ea8d2b
SHA2564d064fb7702fb356731f3d3df8d429b88817599906f7d5d7d1ace017f76d9cc4
SHA5124908fd9abd961db7d26b246f33e099b38774c35451f98139b7413a1e3f11d1bbc363def275d091b6aa8c264bbe1fd02584e8f96f567b638dd5f58c395562f933
-
Filesize
5.2MB
MD50dc50809d561c4b9aaeb6863aeff40a1
SHA11c996cd4a7925b5639551983143489b27b946fb0
SHA256deaed0341cef5771830b2e923f6dd8c67f2bff65e7043be4502c727d402bfe0d
SHA512f656fb882a683e2e755df0ee967a6abfcc3510351bdad18c644124eaf5647f1529f557778df0edfde7ae5f3693be6de9153e3a52205c28596863d64f212eedaf
-
Filesize
5.2MB
MD5a34f9cc264ffe7138f595d79b29e143c
SHA1a4a8f6c972951270db29e6e9ade0b69732a48bb5
SHA2560363c480e272b4ca68e99314291b38db719e5aca1695ea9aa9250e65f9909959
SHA51299b0fbe0996f37c465a295645cdf95304451b0846d6195b50f188dc282905e8313c72799e07e91aa7bff534a7ab7741456aedaeeb8588febb692899de9ae1e00
-
Filesize
5.2MB
MD51db022c1825b76008e3b06c6acff53ed
SHA1105c54f6b2f8956a6225c9f4ee1f6d455929354f
SHA2564ad7a521ae4322bbafd5dc457eb86cc7c4fffd9b820c04adcd62a6871912105e
SHA512527f5682aa487d1518c391fb890d1871a64050efe102755e69e43236e8601b380ecfd0a225655a981a5d3a69c9df508f2756f9fe26c91a98a79586bb2efe7b9d
-
Filesize
5.2MB
MD57678ad8f53c4c101cdaf90769e59d1dc
SHA1e6cd4630ba8fb551801e5da550672c1a39713069
SHA2566884e14f0a82888946788dc2a3f436e77d950f3fc3953c700dd0731f0d255c0e
SHA512f5d238b607275d4b51ed6982fc278cccc583997b7c2d052b653978f5b027d8352938ed80accfc250905da67fc15a8f8c3d0ef62c97f99a53c949ead6381d10e8
-
Filesize
5.2MB
MD5cb60aa5f5c2ca4cc7bb9a30bd5bd90d3
SHA10e309bfeb9727e425f5c433960fb7b3fd63120eb
SHA2560dc01088f40c3fbe42b65516e70152477cbf267994a1d6bf555c3b11e1a3bf45
SHA5128ffbfc4d768e19848487ba1a89cb671c74c364fb6d0535a1cac0180b1478406d9982bad3b1f0d784f293e15bf3553bda07620f8ccb507a31e624a90afd3183f9
-
Filesize
5.2MB
MD5b1536961e1c63bf891eea80b14cc7534
SHA110be36c1e0676465ca35f4f706894c2b081af4aa
SHA256010c394799161ba3669447b3c1c2638234ea10ed9725aa49f44f3eae0745fbe8
SHA512c5836b56e936e7a146a1b0def5e1e949af5c4fdcae1fb1f4b9ab152c9c2ced345db33625f004ced9510d07c11acc9d48960db20c078325727dbc59a932bb4bbe
-
Filesize
5.2MB
MD5511b76adb610515bb7aa91bd52fb9032
SHA1de8ef229d342908a83d988e5846662e094d32792
SHA256082e4d7fc664d7912a4e977a189e3ce04f12ae86884545abe28dd09574c00596
SHA512ab7ad598267607c91344ad2a40092dc9c71028fb016c12e08e8feac3af956f124c1ece34e0ba0ab20e1d74d5852844dbf5e14055d33c0c7957816cd3b42c4b12
-
Filesize
5.2MB
MD54b3511289d1beab59011b5565acab918
SHA1e2e3ace2118fe5335b8e878724060faa9e80c6eb
SHA256944ce0c2460b4f69f9581c0602afa094cb41a26efef6d4f07ca42ce046baecc0
SHA51234cc844699aa8348b51961d65ccc89f404e7e36b3aa6b87cdd66231d8dea80e5f41f1db49ea677f27e56b8dc17ec6951271715a5e8b7563c52dc3206065de949
-
Filesize
5.2MB
MD58c36a471ade27bbde8a6d5af0b663d95
SHA166e8522ecdacc822277e2cbe65340362be690f0f
SHA256c103e5dcadd3b53c5e64c083505bfee9d4129c512235a5b630c0580a14c13fa2
SHA51213f3d529e1213d80423d9ef466843eec81566d6f06c721adb38ff84bb9f128903bbf99f71e05bb0c7aa6baae8708cc1ff840b138412a9d95a3d3fbbd2cc3918f
-
Filesize
5.2MB
MD5e62f0f5900fbd1c824dff1c586e7572d
SHA16b90330aee3dd47f4a21121663c59bf3de2c320d
SHA2569e081aa5faea1f6de12b165333922e75b4dbfae4a7a7bccd4adbb52da1cccf51
SHA5122139c8bccca94021e4123199d280ce1e4abfeea57c942debb312d6cddf2177cf735dea9067594123d3014006f2ddc485a13f804fb2d26d049977b8ff89145543
-
Filesize
5.2MB
MD533a7603e604545d61be68c7c87c844c5
SHA120f03f7a29252946fc96476ca7f18671140000e2
SHA25665b230b5ed0428bd3c7f1e49bfd1d45ff0f6afb7a4f7681e58a1d42258a3bcf3
SHA51235368bf90be41830efb1c1e1b4b4f2e79cb244fc4e8dd2d31b025696a69f92cd5d5c33f7edde7b2da7233dc798733109c47e3a851f507182cbe364daca7824cc
-
Filesize
5.2MB
MD57a3ca05620b1e2b9bacbd72c4c2b2565
SHA139dfa2c290b9ba46d12a4dea78b5a76efc2ead96
SHA256aba0d74e8fe76a1af922f989826fb6f4caf711694f9af153e64c3e0b31f357f3
SHA51203a00cd270d6f9f6ba643c7ab22cb646be48e2e1d62598a17e70d886bcc4ca670fed48e0ac0cde87f5c250a26a7886f2f9ea1dceff904f821032b006f9a80e25
-
Filesize
5.2MB
MD5a935194df31f138b70f402c7df21a4c8
SHA1f4adc81a7a7f6ae8b4d859026c513b4fabe45635
SHA25636c52c1bdef89a9f4528a20c3767c5fd310cad6907aa234080846a4fdec5d8b8
SHA5126c1b88729e017ceaf52fd0f85d676025f3169610dd432fc0ed8ca7650ddf8a8f91a02044cb1cc8a44b2c022bfe56323cdfd7a17f0f2baf7a53008e2ce49cf42a
-
Filesize
5.2MB
MD50c9dc180447076c7002129f907fc8d79
SHA17f612102d47231173ab48ce6db1b57f891e65d69
SHA256555762c3a495b938095b0cd617741a00b80d5ccf062ee5757ef8471e14ad9fc3
SHA51246b822d6121862df5e477d92c631bb5d55834c2c21fd772b78bd78b3a9a9741119ba7b54f79f5e6c656be762eb59cf8e323659961fc74f8336606f05829b57ee
-
Filesize
5.2MB
MD5d47a74ad513db3963507b749b2db02a2
SHA1b1b2789d7c2648a0aa2c3a597a06d4767c50ae22
SHA25659788b50a07d7d6e429a2359487c312f886d420c5cfbe5e5391e66146251ace4
SHA512f18db0979f2aa4ed711be7a667e733649eec3b262ff4f55bf36d65cdee474ded5d42174f2794f33642e134ba348e56af7885c8f2e024b0411015783b437accc9
-
Filesize
5.2MB
MD56fe332108d5ef84546c02817abbc9c0e
SHA18949dac3973fc8eab87f9ed443c3884b415d9ddf
SHA256123a0cbe072bbf5cdc043008ebd915819f73cac3d010cfc6ef8ead9b926dfee4
SHA512b9dc1ad4b2e8dc9286a6dd30baab2155a929bf0021e6cf2d7064f85baed271b3703b7b7a0492eaaf6aa1f7ea0fb832110891e158cb1cbbd3c980726bd8f6531f
-
Filesize
5.2MB
MD5e5e6a8a4480de8a188ad54de86a19f3e
SHA12a66aeb80d88bf63c294f1c3655b011615b87671
SHA256db613b89e0216602347056e48150da9da9f42c3d63e39a0dd3ae03b07da8be24
SHA512f74b5baad3a6a93818262945b94e621a8d8a99c21b0cb409fe785b8f20c739852a5838fa0cc57c2904e37e627568298b88983eb5dd25a25643ce3a61ec30c37d
-
Filesize
5.2MB
MD5b0400e7b9d9274044e8be579767dfdbe
SHA1e376bc31f807d0ae4fd9b210773361e8b819170e
SHA2561b8deb403413d0cf2646b17f14d6df2687aa5d1f6dc33473930d7f656f34006f
SHA5128bf3bd0a022b3aafb73322cd78506a7174b3c3182612dfad641d64efdf239e07879e6025f1e2820acef2be1aa82d1a391b5944b7781ea4916de8e79d514d0360
-
Filesize
5.2MB
MD5180ee8dae12292a2028762985efa68a4
SHA1a4fd241186074c19d6cfd1ffdc63fcc183690e8d
SHA25673fe01ef9b9e7b4a1f1cfe3d5d13dd6b63e6c165fcef6ff1dac04b8feee73c16
SHA512057512bdd2e5e20952289bc629d6a4da80d0ca950b7f390015912aaaba3c17cd3885f120468253c7c04ca1f8ff2ecf026ee7f23b893c7f894d1f5ff004c458fd
-
Filesize
5.2MB
MD5a0b3861b1e102db43fe0089cb3c922f0
SHA11d647b613b0ddd0a001b7aa3494c1feb3b9f0d35
SHA2565174cc201873fc60cd7e6c3e669ba4bef5786a0cf351ebead7ca3dceed9765e2
SHA5129e97efe50337bc6e8c93d9b8de2d6ea9060a3350851d3930a6c845a14614ba29b53971a58a33059ad3ec27319bdf2973133cba04be23461660b791d8aa3ab088
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB