Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 04:53
General
-
Target
2024-11-21_d5f9ed32a40cf96ebb6f8198bcef48d6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
d5f9ed32a40cf96ebb6f8198bcef48d6
-
SHA1
1eb9ddc149c046652f465bf3c7335c2d560f4250
-
SHA256
b61a33b8f3ba131b49e008cc6d23958e78b656107cb52513a6511de7ab05ab3e
-
SHA512
d711f70f68c350ef2416cce88b6f5f6cd9a41614759efe0a8e4e2021d91a13dfbaeccd30944ca4867af93639eee9416e788c0d1cd091e58624e31423c2607f9a
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibd56utgpPFotBER/mQ32lUU
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 36 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_d5f9ed32a40cf96ebb6f8198bcef48d6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_d5f9ed32a40cf96ebb6f8198bcef48d6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sRKMbLt.exeC:\Windows\System\sRKMbLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RxUOZnu.exeC:\Windows\System\RxUOZnu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JaCAWml.exeC:\Windows\System\JaCAWml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzCfpsg.exeC:\Windows\System\GzCfpsg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HwOidSr.exeC:\Windows\System\HwOidSr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eAuzilY.exeC:\Windows\System\eAuzilY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DngjbqZ.exeC:\Windows\System\DngjbqZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iQzskdS.exeC:\Windows\System\iQzskdS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RomVTql.exeC:\Windows\System\RomVTql.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wkWMwzJ.exeC:\Windows\System\wkWMwzJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iHcHmCT.exeC:\Windows\System\iHcHmCT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvetgSw.exeC:\Windows\System\BvetgSw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RyLciGM.exeC:\Windows\System\RyLciGM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPOOvtV.exeC:\Windows\System\RPOOvtV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\usNfNCx.exeC:\Windows\System\usNfNCx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DvTfTqN.exeC:\Windows\System\DvTfTqN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jKuOnIL.exeC:\Windows\System\jKuOnIL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuuytqY.exeC:\Windows\System\PuuytqY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swDmqGq.exeC:\Windows\System\swDmqGq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zrkDlTV.exeC:\Windows\System\zrkDlTV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FiGUtdY.exeC:\Windows\System\FiGUtdY.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52bb0ba39e1db086b608364adbb50ceb0
SHA1c5359e6bed3af1a651f5ad3bfac4c8990455e7bc
SHA256704b9559d7e4519bed0e2f99cfa88f36478546f3e5be59776e09b88604227831
SHA512325dd53839bc1798c4ef7ce22f4c70fe3e245c6d8854145edfe9d3ed276fcd4b571f1fbc1f961f5bca2fe23c95dbc383985b5b1f1129c95cb050e22dfe8f2a43
-
Filesize
5.2MB
MD5b90d64ac8a03295a2985b4fd407ad035
SHA1c8dd11821eafe18ae0dbc754ab04ab81ca39164a
SHA256a73cd10219179327cf0e10fe282acdfee5fac492daf3e6472898a3e50d2f5c9c
SHA512f94f166a6c0bc60805bc7255743aff1699dcbe323401339fcc0563a2bdd20dedfa874f99af192abd534f712a3f8fef12ea41fa0d152145e7f24b4b88600b095d
-
Filesize
5.2MB
MD519380784a93b214333958e01013122ba
SHA1686a809854210a1f3867fbf0d53467cab81f0fda
SHA256ee99e77795ec08edb6943aea14301dc011112d968e8181fac1277522d408993f
SHA5129d41d2ded6052de013be7038749488efe10916f6a5bed1035406b73134691fa86aa4d4a968d1208854944bec4ac2e26d3fd5a4a56bdc6f529024ae9e92821e9e
-
Filesize
5.2MB
MD5d62a5cfa916e8b46a3f69f29b9729261
SHA11b2f6d4e6960d782d602270affb96c74c7e474aa
SHA2565ba1d50740c0f99e9f3396ba44a641b3e1fbf3f17e00bf617e2f26f42c2d7f54
SHA512adfa63d13d7426837c77f7625805e9673d013c73071e3b724526645d05b90cbca30fd26e37e2fc691cc7dbd57f6d708d9f4b15ef99c2b5e9ab6a2180ace98788
-
Filesize
5.2MB
MD518c54e570151b503ce404f3a9d9d8503
SHA12fb6f0b2b116b5f09f9a466979afdb74e021e617
SHA256f5811b1915171f1c0424fb96c2606197c6d7324ce190d6dfe8dfaf3c61fc81ec
SHA512829cfddac2e2785fe95be58a4a464dc048f313b4f1cea4d9dd5dc28a5350da4f4f865394f3245ceefe15f6d8f1038092d49fe8f45e07511bff1ad9dffd22fd10
-
Filesize
5.2MB
MD5363b4b1ea205bedc821b3b024378b64a
SHA16417597ccf8c551dc356f8f2ffe2348ea42c4b68
SHA256a93d9fc9fef0de42f780aacd48d6490458007bf06dc916929492af38f17c1bd6
SHA5120a84a6e704e8f160c34088ef94cf887108904f1c73633b9ad3c702e85f0dff021be00b3a52509514459d02e432d7cfe04e8a44092dd094a9359d13fb4336ee42
-
Filesize
5.2MB
MD500b55476d76fd7c82f7818d6dd5dcc0c
SHA14c2c40d8a6bf9e65ca0bec4e48115d1e8cf05282
SHA256f4914e47e8ae9db2e22ab181793146bc40f21fc25c735d5a1285c9c208a1c347
SHA512c551829b2920218f9019356bae4297277e5b2406d08ed7c6c578aeb620b395de8c7d2a8fd6f102d77a880cdd06b77003bc592195124927c5772721e7df373bc5
-
Filesize
5.2MB
MD506929bd1e5aa43859c74c79315bfbc97
SHA18ac0123bb5db8c2fd0d2ef5e017f7b7ee87b85eb
SHA2567ea7c7c3c6e901e4398eebe8a761b403d7786c7c2e3c31ffed877ec51be22585
SHA512ba69121fc86c58157b359bc2dbadbaf7f6d07c71999dc946826cf08ea0923dfc1382c889210e6130b44865a1b50875e44d87379eb24ffe7595e0bbf37b449b91
-
Filesize
5.2MB
MD5c77c837dd73ad89f9b09f5251b0f85e3
SHA1a794e81007461fdc7f6eee9eb870fb9a0401c719
SHA2566997fb270c571611c0d59eb5fc36a02cf9ddb449e2d6ead57f94b203a0ac33f1
SHA5124f58aa8ef1f46fbd0b4c6d52a7cf5909155415cb3b7e9ddc87bb6c03741d018a14abd5ac0f5f6daaaffd5ac5750235711586afbf35b66b0d108fc1ad7298f80a
-
Filesize
5.2MB
MD518859d8ac759946c55740f0f25288017
SHA10d635d3e5e1c008d8c55776a4601b28532bcb42d
SHA256c4c85c38903dbf508a97bffbdcdf45b49821b19888d8bf49aaa361e615c3ac5a
SHA5122069a69a15e40647f7e0fab78614c5045002c526abe63f53e9fcebd616962a69d9b7c1f2d39ca50b76f29be5d4ec4ebf72b230ee12c90783252a699265c12bd3
-
Filesize
5.2MB
MD5e2385b7e036430fec6f827f3ef707dd4
SHA1c59be0a112df6cef1921067d007918b74d3d5bfd
SHA2566ca2ab7725c61b63ae4e42e8c3dcf096ea07758da8a2823a60191074089832a8
SHA512c694923bc1b0616a71d68e3df03b23bc4635e21dbe74ace1fe2012dc0b9ed24917764c55cabe3cfd0b04dbd04c2be26c2177c24c1154e3fa9d55d434d347d8cc
-
Filesize
5.2MB
MD58235a5c14354730ed6c117a629ba1ecb
SHA1cf0713f418bcd05e1557649f40c0ed06156d9940
SHA2563dc6748b8795bc2bc3748891f9a8214b5f8921d5e69d3152206d00f343988f9d
SHA512ef0c7308469ddf94e2bf096a7c2eb92bef0e0948c0bbf54d3ecf478a1890c44a3d99a0416736a0711c7ad0874b00f315219b9d6c06a2e2a652542f4acfb03a0d
-
Filesize
5.2MB
MD5a349016dd8879f89f8c88f5348c5f64e
SHA177f9a7d9a7ca113b3aa3e097d4d1d254b66cdf86
SHA256ad9450d6eba5cc4f6bff21e27330e5fc6c3e6fe2dcc5433ab76ff3598f3f4ecc
SHA5121c022e19e5410f42999a76d98729bfd30eef0ef68baec934e1c29ec76e95ffe5973658d72f52380cf2cbbb4cb8247c3e9e69bc193cc87f1555eb7a7966930ce1
-
Filesize
5.2MB
MD5ef1974965321b7efd5570c4415c997d4
SHA132928658309e9db65ace6b7437ed31024c554af0
SHA2563c199a15791db8c5c52ddc88c8a8d33c31cfefdafa76120794e339ccd3ab044f
SHA512e4e13371a38f71f781837391de2c60252d6960384c58aea4435efa18e27404b2b4c67f6878f834b51ccdba2d842ec508a0830a67e7a4327ce373b540feb5db8d
-
Filesize
5.2MB
MD5f27c0d219a2ed633fd3ba4a49d50ad55
SHA16e851240abe9868bbb13823ed05a9d8e50d346cf
SHA2560a4da41a1eeb5f052b2d2c9213d1b64a2c828a8c17c3a0dcd461622e78c01328
SHA512a13e5c82366f20f69882c9239fa0f1fa33b9c555dfef33182ae4a7904422a4ae511e52bb111da11af1165ee026c2783940c5679074a290610f70bc913921b18c
-
Filesize
5.2MB
MD5142268ebce602ff95ec87658a648ffcd
SHA1b8f3cf5f7d0adf4d708c4025c97cc0a5a6c85c98
SHA25627c1f1de2ef9e1c042d9eb5992d0cf27ee180cf736249f4de958e9de7eb7082e
SHA512d88c701cec09dbeb1fdcbdd9d16c8d0d143b2197d9d26c73c5b0372530e128a7f49759ee683c0e3795edee0b04ee79ea7b6fd79667090c2bd4d5eb600e9f8e30
-
Filesize
5.2MB
MD5cdd1218f9a67a1fab8af04fb633dbe72
SHA1c39d2cad57ebb50c70631a6f6b51f62e78c9a862
SHA256719b4d54ca1f0216c6b29a67631aed40e1697fe9aa1560b49673d0b586e30ed0
SHA5126c2d85216df1dda0a426d1bfcc429cfe5437de2323768160ed2c089e5429b76cf454170c26acfafd9ef7ad88c1d103b01c9dbcbd1384313ca1285a35821d9126
-
Filesize
5.2MB
MD5928da773f643fe939515793735ebc759
SHA11ded67e8e37ede5e5afa465ab7b9b6bfabaf0354
SHA256dbd5964bdcdbd7c5f83c4ec6b870d9959942bb3a35736f69adfedf2d5bf0337c
SHA512267d0c2889a10f64ecc93a51c9ca19c2f7da44a9ac72aed4bea9de1092ca681314ba5ab7ab2ad9ff39ad3825d1028e0b661ca2c8a416a0001c3b34110ef40196
-
Filesize
5.2MB
MD592b57eac63cdb31dd60b4b77669d2b9b
SHA153786f8816b294b51ef60d0b4e52da64be8f5432
SHA256149f3893d484e603dd9d5ab94df502aeeef2830aab909e12e95ad958c63d1728
SHA512d85cad9eab733580f4e378d37a03684bae69199bdcfc6e7115d5f8da375f41db4348ab8fa556719903a0b332feed97488b45e756fd86fdd0bb28e4c242458d2c
-
Filesize
5.2MB
MD5d77666ffed45f545b70f8a52bed537ad
SHA1d3fd50f93c0ffd39c2e51064b2df3e395fa0ed4b
SHA25608b3a3e71b7fbe96a6e2049a06b5738a5dfdc2d1654f0ad29fa0db320bd37ef3
SHA512a3a3c29a9907d2aeb9a5b4a4ad266b970e556d366291159cc2a4029da9f236c5cffb45967cb54a1829a6f7c5ba3a663f8dc4c2847519dbd76911195a70b77cd9
-
Filesize
5.2MB
MD50816c85a305911b228905774c3887907
SHA1d8d08411928efb3889fe20a37ba93b536b11d245
SHA2567b63bb1f525174d80c89afc18099249ea3e4eadd148a7face612c10f96361845
SHA512c1e5992faa13a54f0adbe2a8894e705ba05b4c6abfed977fcf7a74a9e961b2d21f09664337e39cd478fab7682e3cfbf360873990161bd77618b14da462e0ee13
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB