Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-11-2024 04:41
General
-
Target
2024-11-21_9ce759427e025ea20d909992eb133d3a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
9ce759427e025ea20d909992eb133d3a
-
SHA1
0f4114b928841aabf63b23a5b35113052b4dc625
-
SHA256
428108c339ddcbd303ce85d6c9d0bb66acd45e07d19b3e8712a4c4ea85637353
-
SHA512
51aa7b24741ddb6fad297a447e21e85cc747da96172068e2793a0e560e24f042341592512e8e178e58f04934a573f11e30f74f4b6303db43658118b750d4990c
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibd56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_9ce759427e025ea20d909992eb133d3a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_9ce759427e025ea20d909992eb133d3a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\hcXGNRs.exeC:\Windows\System\hcXGNRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCOyVZn.exeC:\Windows\System\tCOyVZn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NlLmlFl.exeC:\Windows\System\NlLmlFl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DFvnUJk.exeC:\Windows\System\DFvnUJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmoouPb.exeC:\Windows\System\UmoouPb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpCMiVj.exeC:\Windows\System\tpCMiVj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZATpCNA.exeC:\Windows\System\ZATpCNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dkSxYsa.exeC:\Windows\System\dkSxYsa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOZcAIy.exeC:\Windows\System\lOZcAIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LkqLVVe.exeC:\Windows\System\LkqLVVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfUmTYp.exeC:\Windows\System\kfUmTYp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yhbTZxO.exeC:\Windows\System\yhbTZxO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QitGHwP.exeC:\Windows\System\QitGHwP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QVUZANM.exeC:\Windows\System\QVUZANM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aASogoE.exeC:\Windows\System\aASogoE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mxeYdLv.exeC:\Windows\System\mxeYdLv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wjpXVGK.exeC:\Windows\System\wjpXVGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\msryaaQ.exeC:\Windows\System\msryaaQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cHKtPQb.exeC:\Windows\System\cHKtPQb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XBaiwlx.exeC:\Windows\System\XBaiwlx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yMlTwTH.exeC:\Windows\System\yMlTwTH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD53c66a30406b4e8b2bbb7673cc2866e5e
SHA108ca2da98fdaba3675f6edb5aa36a0a422e27c3f
SHA256999d8486f67a8e5c39b271ee137e06e46cd747a6be7b35fc98913c0a95c10cf1
SHA512db2696c0bbf9022736c715598c161b13b0bd2f0f8f21a15eac0a5b6c46fc4b2afdcecd7572aeb2eb2d0024b68a02f5af401fac4b02037580512a03e740c93c50
-
Filesize
5.2MB
MD55298be789f38760c1dc408b284f3a191
SHA1c63a22fa62c93c050d312db050ebe9cc58c487a1
SHA2566707d151e978573a447de770b1c100ed99742dbf6bfbef4956eb957c12afa053
SHA512e0c0ce6955fea064ef98d4f3124ee5f3b2cbefe687dd7fe0eb97a577c49681a26212dc9a958aef20b2c643d48a81f4afac6393d53f3240d3a63b2645cf1cf403
-
Filesize
5.2MB
MD517aa46b3734adb28497c672bd37a7cd9
SHA195f2f20ba288fce4a7db393a52568d4e631b86c7
SHA256bbba8cd638b01101d288d28615b569cc15c4cc31253e11a2b89473e5c2dcd3d6
SHA512174698569ef34a848ae2ad346e7b0b007132b8713295f491ce749a87064e312479eeca72ac84c0b406bd9212d784825faf621558a2688540e70e148bebca92ed
-
Filesize
5.2MB
MD5e35e8344d8d57a5f86ead43ca197066e
SHA1da7439f07170decc9941d17817e7c74828e4ec04
SHA256b31456921ff1246fc806809377607f2b882b6e2059da4d8b7bfe5e9b0981d92e
SHA5121feb9e128c42bf7034a00159554fe164f5ce07f77fc9842c27bc386b93d90151a9228d5437e1b576fa15037e192f7cb93c0d33f7fca55a6f11fda241a702e598
-
Filesize
5.2MB
MD5a6d5424ac4699949391a6e9d7aa32616
SHA1c8ba55eef8fb75190c34c9d22b9f0b0b5ef2b985
SHA2566bf3c5c5e315f65d73773588e480052186204773ecaff4e8552001f9b8ea4d2a
SHA512d621cb23721bae1314ff05e6e50df30b48911eb9c5b71d89a50b334d3593017b61c76eb28db686ab14bf3345ad5b83bb18a91c8a72af297d62ee98818eaf16bc
-
Filesize
5.2MB
MD525cfd3a9447cbf51fcce7713928b16a9
SHA16a2e8bb9e2f1b614334a6156993ac06010c3bcac
SHA25645d93f09e8b78aae6049618c749c097d5d4da6ac46e60b8ee66bdd4db0b4b3a4
SHA51288e31a9cce657043626c6d5ab20b2839cc9a1575a8da51a26559ffc4b12f09190031dc18bf49bb4b084bf49ab447bc54969a2535b5dafe04179460a193237d9f
-
Filesize
5.2MB
MD5fbf89d6f6d8a9560b876f70224b0860b
SHA144b9a0f865920dfae8dd4007e9b836d999a9c9c4
SHA256c62d5febdf7abeaa31315b0eac1c10deead419c1a8f3133f5e16736d238252a1
SHA5129d259ef5ec605941e615c237d6802a854e59ded7ed7698ece52f2fe0daabfcf8764bcdf1e6ccb2d925ff973978153813b123beff777059ab20ba35e830a94ee1
-
Filesize
5.2MB
MD5fc93597eed95284c95b4e3593d0dd227
SHA1fc8ccd59c922c21f5a38ae605358e9b5a0abc6d3
SHA2567398d4be1df9866b01a47debdce43e907ec9939f68cc88a09f1a8d1d8e6d6f3a
SHA512b2532c3eebeaa0e3b78fb780e0e2d03435e6ff1b974efe287195990af0bafd9b8d9d208eaef74134a6a68b3f66e44e09a671214fb8626962f25bd7c83077e243
-
Filesize
5.2MB
MD5d94311368f8d8d1b90be9fcd7675f1a4
SHA1826c2e683468821312675c3e4555a471abd3c5a1
SHA256a609f7dc1ddcfeea37b2868e14e7af463e7ea5dd17dc31c94dc4133ad6c06e88
SHA5121f83e64cb3106ec9d8e50b7d6d6f57d87c511b7dccd6cf7c773009988dcee5d3775c0ae1d5a044db6224694c7c189407457af561050be059525fe323ce14c2be
-
Filesize
5.2MB
MD55853b4f0bcd9ea5f3c9efb9f91c768b7
SHA14b432c5e995a9adf4be2f7b74b82414f95fd3c76
SHA256236f1b676f9b8e8c1262c58b2060842a59de91fb2ee6644878aa37b773e322ea
SHA512678e4f2386bed5c96e49a754612d34404755e81db46c302fa414554a77f564eea86eaa49f62c207bf25dd448454f4995fce5e4e5ce825c0e711296d004612b45
-
Filesize
5.2MB
MD55dc107c41908c551b834ebeb3b0e41c4
SHA1e1b80a1a9fe2607398c7bf9a58c0430a3b99b5a4
SHA25692a3bdbd51a18b308bcf377d0a7028708c886cf3d4d2a36edc1f2c0968268eab
SHA512200c7982f8126a09285d4f389e9727ad821e4803406d967f9e6d6186690d027a60cb13f9763009ee695ba5d2c9e24b38553aff55268bd7eb12a1250f0ac74fe5
-
Filesize
5.2MB
MD5fc06f461118aa57fe6c91b6616a5f32c
SHA1e7fb2d7abb8eab689702dcbe88575b2a10f518c1
SHA256d91af63392ab0067f051917e0f83cd0ecd0626070b6d56fdc35c22b99b4ec02c
SHA512d0ffaca7e17cf69ce2cf493ff3a51874119387137398678d4a42ff7e461980dddee95e055d540e9f24c15195f646272ec826fdada82be36c0817c1ef9be253c0
-
Filesize
5.2MB
MD5bf474119172d1cc050453438d8b70341
SHA1e2dbd0bbeb2b43eac77095abad43f983cc80558a
SHA256a56f1f1c92a95ae87251d521f92ba00ea616ac7668a8dd44f94b03df10f9e902
SHA5125ac65e2fd9e831c4b787530d488fac4a8dfcf292f68f7855ba13d509c58be62f6440a7b523ce7e023c037625e2d2a324888858f4066b4bf9829ff7c2203d4c83
-
Filesize
5.2MB
MD50558d57f0ad7c2f3bebb7d5ed65795c3
SHA10e8ff5429055aa5baa047a53f91eddc96dd84c9a
SHA256ed5cfe896536e3c8f09584f10f03ede58650106f572b460d8af71825893388ca
SHA512d7990f6a961dcc5d27e40053c167b8fdd962cfa3d304ac6f9d161239499a696ac71e426e9229b82c3e6da318208c8cedf4e612fd99d1905d429d3821cfbae236
-
Filesize
5.2MB
MD568589ed7a7dcf4345726109d362986a9
SHA1029b1a7169f0e17e4d834d91e9b0f87cc2e3ed94
SHA25669168d7f38c63456bd5a866298556944c4ed29288e40f14e2a5c7c24077ecadb
SHA512b4123f2e14598e474237bf445a902552371095ce37604b5442f219acc4d89d7d045ffe1d0f999235f0d095b4caef1172beeeae6c70fc1d5c6f96ff22fd4369fa
-
Filesize
5.2MB
MD57cab5b40310984298541e4766c0a2c97
SHA1cbf8bf3dc102a43841874b1c5bf17fcac115e13a
SHA256f8b8814499a76dd3fe5457c10a0bdcf345c7bcc74680e6c549972d99947d1715
SHA5121aea436a78e21ed7f2089e4b6b75c1a5e83abf3f4dd038b879cc7e1c4a036d08f8cafd5c606302e4b0b9f7b390a7a59659b718c14c2106c9255f6cb5d4b39c2b
-
Filesize
5.2MB
MD57bd7d1bf4f1027c53c573cb6110e8b3e
SHA140874523c302419984b926b6a5a0617c904ce42f
SHA2566b42738a27741203cabc65ed3bb938a01f0a2f5d0f97aedb04f96a0c9cd0fa9f
SHA5126ea589ce31fe773e0c9dc98f59f6d37f0899ef2d82de363e49424dd38575d52ed7979c1496f924103f5b5068405212e895f26c6e4ac4f54fca063dfe258e9b94
-
Filesize
5.2MB
MD58c7feaa9a960c57aca6a1033bab730de
SHA1738c4fdeb4b173293f1c4303ea64b109210391c1
SHA25620d364994b042510beae858794fd773df1b89df34268c7273cba4217ed4525b7
SHA5121999cc0dbb6b4cbd1483b0b00a7eb78385d439f76b0cbab8ef413675cdb75b80246437b9a03d5c64c6d563619ba4eb74892d18d8ae47d5a5a39735f4fe242fab
-
Filesize
5.2MB
MD5ab5f6e6621c7f36d0fb06514a2ca8a4b
SHA150f7947d1baf01c40687237f87c97933701ab888
SHA256d96dc91c4c3302b890887203c832ef92cb38a8990957f8da29a92a2971364c47
SHA512112c476cb3a217a89fac418d8368f06c15a9584ed26756e0eec0ce7d3bcf13f68c7425434e9c324bf013be848c5f1ee79f8ce9fb35fef286007d892b4526b40e
-
Filesize
5.2MB
MD5a39c14632fb9f65455331098e1ca992e
SHA162958a75bc907b64355385172f7d435037b7eccd
SHA256cbfeac49e84fea0bfb16be7366e1b0ce9b0df55ab0d0b409d2ad6fb8d4e99bd6
SHA512e3cd2874a467af7f4f602a24646fd0f548c55298e0984c7642f983ad65d67bd2bb8996ae1169712f1cf14afd6d45328a3f61ace2b976e14a43bd1920553ea6eb
-
Filesize
5.2MB
MD5eab39ad5f813ec3609e2623d73a5e2f1
SHA172920ac0c3319b74339d5c76c8dcc161384fbb73
SHA25678a4c5a227507aa4ac20f8fa06f19130f831121e4343f4a5f482942a7d060bdd
SHA5122a977d51493e35b72774e0d87ba63bc951b5aded2cb0f856e39ee0bb147f30ab4e36366a4bb78e64849fa459b634065514efdefd63e9438821cfdc9483475056
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB