Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
21-11-2024 04:57
General
-
Target
2024-11-21_eae85687ee7c925cc9573d97c5d14877_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
eae85687ee7c925cc9573d97c5d14877
-
SHA1
2f6716ceaa3624d3ab4e56fedfaea0628e6cef9e
-
SHA256
1744ba95c58ccac86f3239e50fb1b7f42b5cab656eba3f08ec83777fa57747f5
-
SHA512
46ff68ba7c6975db0d40a0e7848b3301bc78b81c3fa9ac12e0fae9b79f2ef3095826374e2270910534d778c2178ce02b3f48bce274bbaefcc4c0efe02a56aa90
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibd56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-21_eae85687ee7c925cc9573d97c5d14877_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-21_eae85687ee7c925cc9573d97c5d14877_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\cflBzKY.exeC:\Windows\System\cflBzKY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OAbzlMu.exeC:\Windows\System\OAbzlMu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTnStZt.exeC:\Windows\System\cTnStZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmLCWQw.exeC:\Windows\System\kmLCWQw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gaNGCnf.exeC:\Windows\System\gaNGCnf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzQWEAD.exeC:\Windows\System\gzQWEAD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uWHKoFN.exeC:\Windows\System\uWHKoFN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HUsSDBC.exeC:\Windows\System\HUsSDBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pnYmsNy.exeC:\Windows\System\pnYmsNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ryPUQBK.exeC:\Windows\System\ryPUQBK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xMcwlwH.exeC:\Windows\System\xMcwlwH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UPJcwdb.exeC:\Windows\System\UPJcwdb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eGcAanh.exeC:\Windows\System\eGcAanh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iANFoop.exeC:\Windows\System\iANFoop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzQsRKH.exeC:\Windows\System\FzQsRKH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uhwtSsJ.exeC:\Windows\System\uhwtSsJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FpaAlMD.exeC:\Windows\System\FpaAlMD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFWsNPy.exeC:\Windows\System\vFWsNPy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qTigotZ.exeC:\Windows\System\qTigotZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzuCIXs.exeC:\Windows\System\FzuCIXs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSzqoue.exeC:\Windows\System\cSzqoue.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5b94f8c9f912a768d6b434ed06da883b4
SHA1ae8a24edbf03f94a5d35edffc6a0e2ed0b028964
SHA256743fc0f799435a8bc9301aaa9df13bdb4bddf5478785546d26b851e3de4d96e1
SHA512f1f7419687aac7f44a2907fc73726185ca54289ae9c0b7890d4a5c8262490090127c0f547ecaa21a683d58c0e5aeca712994353e6c944dc3b23d3d1a78e6c5f7
-
Filesize
5.2MB
MD51b5ef3841bf720f6aff474a214245021
SHA1a4aed8f5871111ea361470262b1395f12038d00a
SHA2566b1c7fb80577f1dcc3b8ace056262e0a62f495fe95b585c21562d5f5c4415932
SHA512de870f9261d3ec9b7d0b20b59ce72ac0a7524bdba5d0c737213513aaeb87bb69fd35881f177b1e0726e73376e05b3dfd00b7a4535e893527c75d3a77a4e97a5c
-
Filesize
5.2MB
MD514bda2300d373377202aa32aab78be8e
SHA10095891fbc11c92b6e06d072efa59a41ca86bde7
SHA2561c49034dc0b5eb9f16484dee89e0c3b2aa7417cd2bad834f619b9cfbdc11d383
SHA512595936a0c6f94b20b1e0333a7102cda7f84a3c0ff8068d83de37a25bee09ae5905c48ea6efac7e0c78a2d3c8a6a00b5ef2bdfeac3efed9b0c2e6ef6ed961ad0d
-
Filesize
5.2MB
MD5af5b24f91fcee27bfed52825c3d4f10c
SHA1c0adc5fac07a9d4dac9f4a87e73a39dc8891ab2d
SHA256b22f5e143c1d894d4dcd5970c59428014dead7606580bb026702fb1f36986f9c
SHA5126b56650debeaaf520f546eb1e1f754dcca24c3f8848a5ae4db85bfd5c5f9020c9d7adf96b99a80b24f697b51258eea3f9ecce10ae081b0b4b9e45666183db0da
-
Filesize
5.2MB
MD58588fa7ec267a1b1e7f59e8233818ee1
SHA1de46e419e83b7c501267a69333f9816daf5ebeb3
SHA256a8d392852ffe69faeea8f446cb4038597c42b9032d837c9f33a8ebff59026239
SHA5125fb924e59da419becf371d7e172c1fd9eafea9a0c9209248dff645a54655f3bbf84933f876924616f39da7ba3290cee9f98d5e1001e7035f55f0b9d6d1a0e76c
-
Filesize
5.2MB
MD581ca0023c895d35b9930db109b169e8c
SHA1d5fd9fa43824d24baa017fe147316a4b6a3d03fc
SHA256df84f28806609c34c71f9abf0e51cd5b83f6cc7eac9860a4e8f44b3208188c3c
SHA512ba3dc7237cfc5eeab246cfe4c86c15ffc0d74f7501d5115a6c9d3aa8a0cff44aaec621c7737d3dbd80ca7eaa3f46c310040f4b5abec125d6bf3e1d72908ae5f1
-
Filesize
5.2MB
MD5fc571d5b799b584e60b31114acdb963c
SHA1b3ad500f2acb77c7f4ac2d9a902f74f4e4d1a56c
SHA256da91cc107acda392ee00c0116f2bf842e116f629918708b134fdd8407dd601a4
SHA5129df299eaf495dc5231bb34effaf760caeb522a003744e8483da2d5bb7c482e495ecc99dad654339f6b03650f6735a2f460a459c795b8c3b2ab9941d10839ed50
-
Filesize
5.2MB
MD5f275d40cd1a18adb1d37ccc4bf1ba693
SHA12bfd80cd6e2cd7f2f08b29b5b27e541fca4f8567
SHA2566dfbaa2b7f3cda544d6f63113d213c7c61c9788857d9fe495d0cdb2078559344
SHA5124cb14afa492ba7834f5a5c67a9aa5392b83063b6c627baed355fca9799b48aa618583fb544123d89960c38aff713d48bf070848dee5381b68b6c64f680aeda4a
-
Filesize
5.2MB
MD56929e45c4069017ce93ef73dd9d6949d
SHA180a8aded4d8ed15339c7f9b45bc561f55e765710
SHA256b381b370de3a3fc8beca444bb1e708ffb7e5389b416e04042f0d03c28349333f
SHA512fa1e7ec874f784cb7d7db41f4db38eba4cb9dd273f7db3508996a71248b5704420b2a743bbcafab9920f1465c478b0f3e95bb66c2c438ee330d2f6ce4359d46b
-
Filesize
5.2MB
MD5850a455b3745ecc389ba5d1b2eff1a13
SHA19aa8528e6feeaa76fc4cf4ff586e24c2ca2eb7fd
SHA256e08e709f9df30a74011fb910fe4eac775d780e24f1632ce078133750545fc8ac
SHA512ab99ed82894f217f2df494073c651592334a3be8d46da6e273fbbb1105b829021fdf5a085693fd4d2bbb64d41409df6b8a34e2d09ce5ee47bf203bd1a9b7020b
-
Filesize
5.2MB
MD5e6f0171b8c2daf517cc35a0a347e1d80
SHA1f55a53645e7de790935a30fc5b745d88f422bf4c
SHA2560b68f66b5dfd00028fadbf39681cc999915fe78c7e3d9e8355b97c80d5fe2eff
SHA5126cb91c185b12ff0aa4e8bb2a00e855a334b171b1366978804e68713c475a9967c5e45b72c77f6761571d5736dacda1f496bb78990c05f1d19eaf429672731f29
-
Filesize
5.2MB
MD545f58308a9c207f9473d9ebd21c553c8
SHA1ec8328b67968c0db5099619e5238cc045d62e94b
SHA25659dfebad8a37013b0762927cba4c33b14af8564a9ada2bb40ab474b21a426a54
SHA5124f3dcdf9f290a59b83c9d4da9e713ab2afd6b88f175d1dea603c076cca5bcf4d2180f5c5f059d443b31c48524de5775a7488437b86897f94d340de33bb5904ab
-
Filesize
5.2MB
MD54dabcf8a52c4313fc2db9203dede68c9
SHA1a414a57bbb331ba913c972edd09502adc72bddb4
SHA256f96ef42ba7eb39c1afb08ad03fa2c320059e5898dc440c561b468df6296142be
SHA5127c3efae6500a6fb0adb0be5dee753ddd75922acca86714f8ddada846fe72ab113adc0e7a8a7a956e22a7b281c98736a8d25482a733496d2e0df4d1518eeeb206
-
Filesize
5.2MB
MD5ec88955b6cff44f139357bcc89455e7f
SHA1068c6ce2f41a030e7e98b28e42963e426f858c28
SHA25635e194d4a26d9d4d1f3c9f4cc46e05b74aa2963f1ef4b344a064bb44ca7a0011
SHA51241c902712f03f2175165f1d6639300105e37869ccbc262c9b472157392977920cb5f7438a103471a63186338cb7c3783bde6b81ebd6d61931ae63decd85cd254
-
Filesize
5.2MB
MD5a945cef44279a515d47b9da6d2c59114
SHA1920839819de42c0fa0b52a72a3ab854a3d3b0aea
SHA2560fe6bd03974dee286556871dac68bc5cda3bbab8d4fae99c248a866bc81a2876
SHA512bfc20cf7f2b6e9de008257cb30f078bbde12ba7448cc2c4b0eaf18f70f5b8483d1b13d5012078a126939e498fac790858a8f89350d4c507ffafedd909d6884fe
-
Filesize
5.2MB
MD516736dd92f4c0b07b7e04352a86cc9b0
SHA17c82abb97af4c927010282978587cd72c5aeb500
SHA2561fb39b87fcd6af5a9a4cc1ee4afaf8bad8f5beae0a894810c01851faa1a31d3c
SHA5121b8c2cba95525388f5bfcd24c06bbeab3db16a60599526f24b4d72a323bd333c37a351c089db4f594ae099e18d6b0b4ed15ee23f68c91fa5136d5545b74a9a5a
-
Filesize
5.2MB
MD5eeb0e2b583e05a897519c1684b0a4767
SHA1c63352698b35b6db3700e25dfe3c0e46ec21f932
SHA256afef435f9b91b7032c0b72b1f591d0058baaa6b872902daad275bb02eefb0c29
SHA512c9f1bce3518b0a1627ba2855dd5484af70acb98799db8fddf8ddd649c8518db77bbc348a2c94f2f4faa6a8a8d667f741c21229bd2a71dea2a2e0d92a0e8488ff
-
Filesize
5.2MB
MD593209e4767fe940525fc431194b23fa7
SHA17974632993d23cd025459e2f972750f7aefa656a
SHA256490671c84039782898eb141fcd13196ab9e7150f225c76251791cf2059f21790
SHA512aafc3d77e52df2af9787c38dabff65a92b0982700b635fa553e14bc5093b92750b21808522b695c20595ac840d3d85e87417dcacac96bab91f1a59b3e876ebc8
-
Filesize
5.2MB
MD5e32a3ed71b20567cabb86c66f4da64ae
SHA193f3195a2c0e8e789f8b8326ab29a8483a4cc9fa
SHA256dd36bbc2a9d3cde0bf8dc9250808cd9a24a8e28bd0c46e1ad403c17beae9b84c
SHA5123bed65e5129ec7731b3aa7065d56609b6750ed68423ed36a7596cf867dba9e9e70b456485909f6e5ceabb42bf2412fef4743cc42099ed1988e2264284da4e3e3
-
Filesize
5.2MB
MD512c4db9eb2acacfe579fed2972bef516
SHA18fb8ecff9f59a2639bc44a0466788ff2f45f9e02
SHA256610467da03457d3883ff914e5b8a3138782e8e565a537a2a1c210fbd7866f52a
SHA512539b733d7e7a381e2b6d1e5659b28fdddf2588d5e55408d2582004d253a8497454e0937248cf6200c24872389eb1d1f3d756898e920c503feb0dddfd8a72e61f
-
Filesize
5.2MB
MD586f23a3f002e61b58d50f3d729a86ec2
SHA15ce721e2cab5fcc0538084894b678c81dafef9f7
SHA25657d162da80c962577a8061d3d6be315ec0fd6b039380920f196e06e6d10df65f
SHA5125139c158ec28ee77abe88b06072502ef1fcb5313e86f2fa380bed64e9951cd1bfd9070f387f0292817dc4ed7f5f7f2951b09a37a873230033cf566c8b42e4a41
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB