Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 12:49
General
-
Target
2024-11-23_394f2d71e5bc4b0cd7ac3506b2cb43c3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
394f2d71e5bc4b0cd7ac3506b2cb43c3
-
SHA1
581dbd832a359f8b5756f57d6f21d02fbe5b9252
-
SHA256
22e448bf096356f93b5576582aceb02133036fb2eb0dc5d456df781acacbe750
-
SHA512
d4e879ee170d2c077435bbe183b006ad882e02ec8809ca717d51a98e9d7c69d95bc674f0fe3045bf3ed8744e906059cd3169028e614d91de12131e055775a56d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_394f2d71e5bc4b0cd7ac3506b2cb43c3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_394f2d71e5bc4b0cd7ac3506b2cb43c3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\YsLHEPX.exeC:\Windows\System\YsLHEPX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bJibbfA.exeC:\Windows\System\bJibbfA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jCXTKBe.exeC:\Windows\System\jCXTKBe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQgyDro.exeC:\Windows\System\qQgyDro.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGCfoKh.exeC:\Windows\System\OGCfoKh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lULHLJr.exeC:\Windows\System\lULHLJr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YljqoFb.exeC:\Windows\System\YljqoFb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzUOFzv.exeC:\Windows\System\FzUOFzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JHOWoke.exeC:\Windows\System\JHOWoke.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQvGTdA.exeC:\Windows\System\cQvGTdA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\khurBGP.exeC:\Windows\System\khurBGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DGEzwmc.exeC:\Windows\System\DGEzwmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yBmLKvo.exeC:\Windows\System\yBmLKvo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tcjnWXr.exeC:\Windows\System\tcjnWXr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aZhJBmO.exeC:\Windows\System\aZhJBmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XpoaOiQ.exeC:\Windows\System\XpoaOiQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mSLFGLi.exeC:\Windows\System\mSLFGLi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OTRUVkQ.exeC:\Windows\System\OTRUVkQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSiRkFW.exeC:\Windows\System\fSiRkFW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vrpJpVe.exeC:\Windows\System\vrpJpVe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KoMaHsu.exeC:\Windows\System\KoMaHsu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5eaa74f9fab91298a4710c1aebc48c142
SHA102a36a7d1db63216e41a7496528e49ad176bcf62
SHA256e75085242fb59f297ab574c34949a90e4b80769b1d109b9d7dee887cdb63f6b2
SHA51225fa1473c6f5205a759037abcfd5c0cb318f7cfed42236a70d202d53eb716abd37cf7fd8fc152bf5442d14c472d4878af86c0eaa1b2f40f32173e5bbbed8f35b
-
Filesize
5.2MB
MD5fadd9906e4adfa23f1136e5340bcd5de
SHA1123c57a4c44bd67b71dad995b71a2e51ff7fafc6
SHA2564a60ebe36f96bc435042c961faed5e468a2d6c0530c1cf1ee9817fa82a0d2054
SHA5123a6a2add9f7bb7e42419d069aec235f3d087c7ab3739eef569cd4052e39583a6ac235ee1330e247fc594e27a001839c176c0a14d77cc98cd00b9029b0047c216
-
Filesize
5.2MB
MD5fd01850571153bd423107273c8fc91f3
SHA157dde7b92973eb559243b11e3d4efbf8f4dd264d
SHA256a07b9186a21be945bf1ad9953296173143903b8c30bbe5c3ce93ade762e0b585
SHA5123971641a810f315affea28437ba252a6a2d0227ddaebc476c8ade692dcb56a4b98c5071d36d892c5d0b57825f681d04322927ee75f063310ab09988d787f0072
-
Filesize
5.2MB
MD584055d17be14988c6fb8a75cb37c39f0
SHA19d58579fcd796b8c77cdcbaaddefb761caebe69d
SHA2567f94c3d9d0d16def80b57382ea1a0c0c62ff2533403da8e588a5102ca8b24524
SHA5128c21177045a09f170ee507d0f036b4f3c056e970489d4796b9eecb2f76d3058a1f2a9e0db2340848ca21fff2c7c46569e1b4b15e9d441a210a1d79fc70c62e2c
-
Filesize
5.2MB
MD53f1fe9caa22a11ca5e89d2bd2e575eee
SHA1f5af922bf1de53bd679eeefbe87522b9705dc01c
SHA2563df27138644c4c3e9fcf9e525297f9bf922efb27a1f17537fc4528bc40ab5b0e
SHA51215d49ccc66a63ebc40c1ef0573aaf0312b8c479d5a66be925f6a3f0aeb5b42dfbb6d7c06d9043f2e9b825aa25dd749db1291904a951a90066889eae742adb45a
-
Filesize
5.2MB
MD5960100a54311c9b2cfb8aa0032bbad1e
SHA1da573840b3c9751b447e1ed8c7b698277a9f3e15
SHA256e944eced3db4e287496779943451280294234cdc3e21dc98568381dfb37d233e
SHA5121064d72b74646375842cd03063b5d290de9cd2a872cdf1046bdceb25217a492de3ca514b4d8f8cf246c0f333becaf4eaacbb00cb30189a3f341b51ea4386a35c
-
Filesize
5.2MB
MD51aee11bfc7fbf503eb15b849b3d1c66e
SHA18af23d3f9e189a0d922f79ce7601de5aa275c600
SHA25699fb48d6470ef9d446f8b05de2029f5d216ab6267b93d79b1f7712727599dedb
SHA512b16c3f08f54361dace0e0f61e10e78c559b8450c9b3277e6e786b7ae3f6c119dcfae70aa89006e5d0b24b0232b39b835a69756ac2c8db7da7c9b2af2552a9a19
-
Filesize
5.2MB
MD5a3ee4f101aa2430179073e35e921f33e
SHA1cf954c9cda61f55a9e51ba95927c950f4e17a214
SHA256b4155531746d0edfc182d3b04954ae2a02bbebc4e4e717cff219587f2d205a2e
SHA512363e3bda36d2cadcab9afa76812d2cff6079fb880cf4be92e7c43529af6c760804bdca62a4b15c9a2e380bc99ff1950f850057e37c970d530eb4547f65b331f0
-
Filesize
5.2MB
MD5e65c0f8ad9ce22ccdda6617cc5e3ee95
SHA1bceb7e7de0917c50fbd149d1d248409a8a24a789
SHA2565b54276de09c4952227e40b6c0aa2bddff29ac2a5edd48993f21af57d3f361fc
SHA512a1edc22b95db9f35c588318670cb3396d1871df0e636bfbc76930e5f7815cd4277fe4c6f8444478e4747d92ff887506778424a9e7611c8b217b76b92a887f714
-
Filesize
5.2MB
MD58808bbe81c45818849515654dd23db8e
SHA19b0fe82ec425f5a9d539dc378c63d8fc5f4fdf67
SHA2568b97b8d13380408d92b1467158420d588080f52e7102913b41b3044900e1b727
SHA512ec5744592bfdb00bd0e4c6e204ef09bf443c096f92b2ef446f412638b005d286068ed4e4f530380c6a226eb3035e9fc68bb401ca0d05e8d0e917c21c07aeb88d
-
Filesize
5.2MB
MD5559aa049ba434d043da5d4090719271d
SHA17f2dfdf639ae9c1c2214de821fcd4873477c936e
SHA2566c499e5d2933388d6437b01a5e7c02b2c5dc3f975aa6c90c6f46a9c22c52eb8e
SHA512ef90be164eabedc0bcb0e342954b441b6f395c576f125f4f9f7591eaf388e2c026bbc996b60c071169b7b4dca5f16f0a06d29c764bd34c1a836607f52037e4e8
-
Filesize
5.2MB
MD52388b168521d4cbc866ab06d43cc495d
SHA142c09f1f132caf7794128115a8e856ef619682fa
SHA256ad9302b9e74c6a8cacc3aa09384da4bb287c9b5301fd66e5453019e6b8033249
SHA51238eee736c2bbc7349c2e25df09ef85a9128f8b021e881b47b369a701282cc146e3518b1c91539414057b24968c2513df645a321d2197dd5e582a970e5d8d488d
-
Filesize
5.2MB
MD5f2d46c915c116cf9fe14f99a21ac35ad
SHA19702faa98141c9c4f1e28ada0d1d9eb0775c03b9
SHA256d3f846475bea26ccced3c75e162e0dd5a84b80d3f654f4ab32af344e43d1ce26
SHA51287c2e423eabc95d2d9051bd58847e597550af4061f4fbe8f6618a42542358dd160806c1e5d0cc383beb9a5e264f3a79bd450986e09e963974c75a006a46b3d84
-
Filesize
5.2MB
MD523cbc08ed34f4b469301e5833f2d05d7
SHA19e246e75921c828fe17b174fc2468a93af9540f8
SHA2562d8143dc5a8cd4e55e9fa2528d0206c19636054a2c3ad6e853919e7d05bdc703
SHA5121f6560984f2834c266703d8c2d536a5e385378d7258288510bc5d9ec0b88624a18cc6952dc32eed397e08ceafdcb1cd623967f65bee95f56921edfc479732070
-
Filesize
5.2MB
MD5b42a3e198f58ae8238a8dbe37b317126
SHA1f97bcc49ce36261b7ceaf1f9e0f1f92795d3cd03
SHA25647e48f2d0a2d32af671729e2b7a62293bf0742a2cbd91b604bcfcbd03a1edd5e
SHA5122ed5c8ffcd122f68c27295183b5a1b7d8020447a2141496404bf3f84469eca809daeee8225203efe5c31fbc20015887392011130a26abf67d10537cab01f91db
-
Filesize
5.2MB
MD5fb36858555c9b04f3fd36b1bfbf2d542
SHA1b70c0366ae899f191d6fe6bcb7d59ea0129abb66
SHA25695a7f5610aa15ed0a8f9e31e429d937baaf9b7b4f591d204d15fc979fad42a07
SHA512535dbbe24ef9005909e580c720f92d11a96d87403a695ac6f6457c1b51c372b778e7a9ea41956be7c222561c354e329dd09e7c1dcf10ff24ba82486631f13a55
-
Filesize
5.2MB
MD5659d6494a9b716be885d21aabc1687f5
SHA103d653e82f640cd7eae97f13aeda25500f7ec0bb
SHA2564f4f600b70dafb45043ed0e6555717a2b561ff64c6529f22335ecc5cebfe8ebb
SHA512936a19bff278b4f72a42e3aa907c74cde77e1f45258755d729fdd9ebdfa906e0e0d8e354a7d1d6da0470944d0a13fcde296fb8007b0e786ad17e89045ded0319
-
Filesize
5.2MB
MD5f714d4b337ffd6cd2ecac059dc160d69
SHA1bce7a1620f5335acc2f37514522cb189646faa20
SHA2560aa7f1bb1b04e276da8dcda0367d3ef458004ef171ddc299a900a397404b5517
SHA5124fff028e01853bbad45fe5d4a4cbccb89c45ca5546d75736ff5a5161046ea1aa69e76d7d27d06bed6b7eefad9557ad810bf0274b8970e60862c4250297e408eb
-
Filesize
5.2MB
MD5d95054c2e5db36de4d491fdaf3f4a6b4
SHA14ce09d212d2328139e9d1d90aa76f498007f7762
SHA256955b51c752fdf8ea5482a9765c109deabc2e82e865ffa1a844f936eff10ec6f1
SHA512769902a3ac87705fce9fd63f1614c0030c2774aa1d49fb46cff7b109d6bb94d9ef94bdeafab2df65958105262ffe9f68a58822705eabd9526c09c3d1e472ba15
-
Filesize
5.2MB
MD57be31397dc3509355820343ceadc110f
SHA11948074ee40a749a522bd6dddb12357009cfae60
SHA25686b7bf3783de3493f535254e07d14db5bd17eecc761e986cc83b86acb9c3e5c7
SHA512a5498106cd507cb3d6803d52d12833eaa0dd384d742f6dd8a37fa4489d2299bc342c08da87da68491b2295004829507ce318d52f6e22d2268521ddc7d08ccb7d
-
Filesize
5.2MB
MD58cf568de01218709f53b829fd6495f73
SHA1d0866463c8734e6366746dda04d62205da0157cc
SHA256053c25965a3e944167f15fd93b28cdc40858621f0ef2d6d4bd651aaef6601741
SHA512e37519d0bf9524b9369ecce216a57fb93b368e06d93ca5654f0dec4c192e0cb90a8aa7bdb2ec694b3d15a91ae90816dcc58cabe3ea67af8db8bb53cea26000e0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB