Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-11-2024 12:51
General
-
Target
2024-11-23_5c5329fae83ae83617c5aa58f6f24f7b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5c5329fae83ae83617c5aa58f6f24f7b
-
SHA1
136821128e727064c48a053070aeaf09bf38fc43
-
SHA256
3f0a9a4c86aa0d46f60b8162934d3832ede261583addcfd955c892c37f5daf40
-
SHA512
2c3a876f72dd92b96458300f058b020dc66b6978c0e7f6b59e2fbddad24b6c21f2f001e564dba0c1b97d8d29904278f09a509215b999c15589dc734b15fa16e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUH
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_5c5329fae83ae83617c5aa58f6f24f7b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_5c5329fae83ae83617c5aa58f6f24f7b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jFcnjSk.exeC:\Windows\System\jFcnjSk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SSUUGDs.exeC:\Windows\System\SSUUGDs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EpJsVSf.exeC:\Windows\System\EpJsVSf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\acDpidZ.exeC:\Windows\System\acDpidZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VPmBJFe.exeC:\Windows\System\VPmBJFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EsNNtBI.exeC:\Windows\System\EsNNtBI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DkYnPpc.exeC:\Windows\System\DkYnPpc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GJMFQYk.exeC:\Windows\System\GJMFQYk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNxAoDo.exeC:\Windows\System\rNxAoDo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TSVXlrV.exeC:\Windows\System\TSVXlrV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiizXsL.exeC:\Windows\System\uiizXsL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqgrKbb.exeC:\Windows\System\RqgrKbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNgroWa.exeC:\Windows\System\sNgroWa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxtvkGQ.exeC:\Windows\System\TxtvkGQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\muRuNIh.exeC:\Windows\System\muRuNIh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bjIrwUR.exeC:\Windows\System\bjIrwUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcmyNTq.exeC:\Windows\System\UcmyNTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KKEJEHo.exeC:\Windows\System\KKEJEHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AABlyrb.exeC:\Windows\System\AABlyrb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UObbHjO.exeC:\Windows\System\UObbHjO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dOOdtjl.exeC:\Windows\System\dOOdtjl.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a44916bcab158aafe9fb4de1044d94ba
SHA15c2ac8fc4f31c09c9d80c03e9b8d9eb281a20f85
SHA256bf89e07846fdae358a9145577e9c40651e0afac5818d8d9793f4de78469ea9db
SHA5124ae2d83ea10ee16da750129876553316cefec52bed60357f2ba523428263082419508e4e56c4e93981fb75bda58255673eda2feb2ec5b92f11ad5629c55eab1e
-
Filesize
5.2MB
MD5f3d42e5835208d64a9e9f3818e4a3e59
SHA1f8f7d656d24328813596bfe42b83f1f2d30f9dc0
SHA2565d50c173cb1c30e56fa78893566c352f273ea166dd52bcc0733380cc03da916d
SHA512aa864a947da1ea4bdd5ca8b4e08cc2e658dc3309c5103e4547e824cd32aec7fcc5dda71441ee4bb63737be9fbd7c417ed8b0c7e016c0b8a9f4aa93567f4cc8d7
-
Filesize
5.2MB
MD5dfebd2748627792b68726a7687984ec8
SHA1a1bdc507bbccd1b15248bf5c9d8dcd787dab55a8
SHA256aa7a8c298dc05ae604bda4a3619d539244deafaf7d59b0deeba3f016a4f749db
SHA51297ab08915fa15033faf0a60606f51b54636f4171fd3950936888cea5e94d0a8c0fe7ca48421b42c2fba480617ed1ee4e7ea568be9883687cf69112a7db9fcf3c
-
Filesize
5.2MB
MD56d278ece629c323dffe095f8d8c7576f
SHA1b13011f9cf1663cb84edd396ae487f732d81baf2
SHA2560c20f3c22a70ee8a8bcf364db9f5b31d4dd4a017226d7b28cf251061c1538dcf
SHA5125cb72df6e8525fba53ead6fc4f5cf3bb95abe5b69bc36a0c94eb9c0f2207c0203d7b600eaddc6c38ff944480c8e60a92740b34b4d0a139588861f4a52d1143d5
-
Filesize
5.2MB
MD5231ee1f1900650326531b7a9dded5277
SHA158e7f46505eb3ef1cd1f2324a58c738ee85f97f4
SHA2563d44e2394d2d48098e6ce45995d6ff7028d5c4e48d04450ad370a5f169d2511f
SHA51267f55331ef3fd82e6b38ed78e87c31393efb78f3b37091aad7348d4ef251aad196784472cfe09a724370dbce914d06cbc82c53057da77136a9413c410ada9dc9
-
Filesize
5.2MB
MD5b980cdee88b00213995e2844d0c79043
SHA1643c8493b88e1a0f9303cf3bc2034a73d52df858
SHA25625182270260484d653bd120ae4cdf0142af13c733fa3fed1b318702763ab2090
SHA512a3541ccaca20f18b83116d364ce3b750f2c92a4a46056df5d35f254ae666fd3a3811c5c45d2a9ad058f84c21dae78cb41ce9a7922936982fbc580e9c7e858109
-
Filesize
5.2MB
MD579ae38a3c8c0da8fa392ce71f6cffe14
SHA13a8a428dab52419f642f418770cbec42b7b57e54
SHA256a87f53c9849c205cc6fee742203e4d2a21cc6a551bb97d344af49e44fdfe20a6
SHA512059f239a23385b7db680c825a4dc62f6872943b9aacd1b3d86cf63dbdff1f0455685430aba907de70443b1506198f47d5daebf90e904640af7e47c57b047a725
-
Filesize
5.2MB
MD5821d41e4eeab0182d3ee2cd23fd90e62
SHA1a8e88d1cf721c1718fcf7834e115ab3511ea0162
SHA256786904433d52187e566d94e45f9bbba7c12c3206930e6dc89c7db5b843fdf15d
SHA5126c0df8d293fc8b08d90122247e8827e4375bc0fd3334910558fc75c0c4d49f0138cfdd86a0b8851e87c017815b67b195767d284ec711595f33f7914521c54cc8
-
Filesize
5.2MB
MD5a0987f328d1bef1d0b0ae387d869527e
SHA1a537701f6c62edc0792eee0e15689c34890103db
SHA256c27e75e05d388c0834347ca5ae3e4b57e7fda67c395b540a1229a728910627c4
SHA51222c55aeeb067b0973927a8c6a2387664df79ec19aec06aa8d12b36bf536e689b88d8e14aeb36a355bd24987210f4010eb16e6f21295b19106cdb481d5c5a75db
-
Filesize
5.2MB
MD58ae718731ad8600b8fdda3a98a05860c
SHA181a2fc7adb8dfb7ad676f590d8046b5ddf885b59
SHA256cf4b950bacb9cb9025cd0e5160f59fe4601b0f3d9d75a9e268d50061339fec8c
SHA512d37c1715d3d3d4ba856f94d7568bf7ff7f86539289c2d5ca8f4ce32443b7cc9ab94182a9fb8019b6a6e87ce7ede0308960923df3436cee7ffceb81d4528d2854
-
Filesize
5.2MB
MD5057a089992ef3a22b3e47bf3de70cd8b
SHA1b5e7a7179476ba9869182240d07dc5fbcca129a9
SHA25644650cc66d724056a0ae09e95ea23e7e73dca721cafdf5f46adde193531079cb
SHA51233c0425de24f6695f088b513c390266a604cbcfa35dfc4ed03b5f55d108d3916b88e14d8a8802d0105f2f53ead687bac46497d54dc438b4826c823922afae234
-
Filesize
5.2MB
MD5be9f1bb3c802e0dc674dce4de26ffcb6
SHA1013a34b396f0c5c6ee122054459c0742b47b121d
SHA2566eef17a63acdd1be36b9162345164f6e1e52d6182e317aa84d3773bed0fac4e0
SHA512018e0d1ab668e104f879b0216e431451e4d55d596d47b8bb388f79d7b527de0407b9db071091ba861c65768910b67e120561b4ae48233b0ea32ad9e5ed88c843
-
Filesize
5.2MB
MD56f73c637742f1b3b0c92fe9db0db52f5
SHA1425cf874fb071e8a015d85fcb1d022b1d845d23a
SHA2563b7abcc2ff34d48967fa8a971ddab8aedc6c5d4158cdb84f896f7df07c5107a3
SHA5127197f970b2e04fa83bb3534bbcd548881b43522ea55e05727753df1f2c346cd1add1fb87cc16109f88f652f24594497201088f721052f2dc96fa164befabb5c5
-
Filesize
5.2MB
MD59cbe289e2d76ab866fdeedd1fcfb0cb7
SHA142a5c3eca2b5596a1a1edfc44da40705839a8cbd
SHA25635303fab7efad01038e7f9f23ab4407d268e2a5a80561714d8affbe4a9b182cd
SHA512d9852b20d1ed24b3e343428575a4be5c29f703704ad5ad183980f33d9b465a8239905a89d0044a945770f928ba762f84380a93295700b0e82417289014414217
-
Filesize
5.2MB
MD5ce10108c416012c057b228f080300521
SHA11cbebbd3070485564fa9c296406b0fb8479db66a
SHA2567e39b96d492b9d00161cda1f7790ce8189a0ed13791d54b1cc16c882537c7c41
SHA51281fdc4737331a88cd5ad1342c313f279313d990d06602197ae2793844d8f5652ad96b498ddb34c7c2b00684f5f4cbce0c0e23855064a5bf0319674eacde3b8fc
-
Filesize
5.2MB
MD52db1682ba43df5f668b4b9d4ede4b81c
SHA1cfb27a94dbe4661f4c69b147467a0e8b176f4821
SHA256e4ac4eb555cd65e8ebf32c9863d1e1427f0880e76977d36714952263a12366ee
SHA5120b7946d886e5d6220e884032bf7c1292b7e840d8d1ee0ca35ffa2e9e919340f143eb606ff6526a80c373d1747c3fda8bb961657986d9cc5dd09cbc96a43020bb
-
Filesize
5.2MB
MD5c8a3a8d7c3d9e6277e9f349b564a935a
SHA11b9a4a832e8db4724dc47d8ecb52aa16e21438a9
SHA2565c5044e512e7211191c4c69aeaf02b162faf710a8e7c88e3faf0ccbd4dd769ca
SHA512bd38ea1966f11df4a48a5c0ea98957253b37fe3e7c8d0da97f4c008cf8596a6ad98e0d48de197bc8c5cb497fe64494f413532258c09c4881e4237432529e82ba
-
Filesize
5.2MB
MD585e33f4b95b0ff7f019a5330c1846b40
SHA1648d55f7ef8beed61b10b434f9e73e8bcaa127fc
SHA25665351570a6711029965d08c62fbad094f90f84d2ef7a1c8885f658306589aa64
SHA5129aa374be6e6707eb8c6bca6dd12b8ecde063dd0869337099f5a54b2de253b67b50f74ece1ec2086634fea8e484c86a579a40b7a0a24e01ff16e294c04219a395
-
Filesize
5.2MB
MD5b0c3b159fac1450ae5319386bfaa1f7d
SHA14b444b2d628737e9d5bddce2ec24d06b89b39b51
SHA25618ba77529bfc8ee6691ce59156f97d3c35a221bd0c24b7c6fe029e9998ff6ba5
SHA5120b23436238cd62804721899c3d995033a83a9defa65484439918934fa47791e6ff60342b584b144bb7b6e71f02ba956772880dc3e19f8df9160e480f51a76247
-
Filesize
5.2MB
MD536c80a4070656fc59be263ca70b4b11c
SHA1f71796f5546c5254bcb03dfc8a93cc33e38eebf5
SHA256c7f921529dcf04139872e230e394161e66ff8593b83442f9f2ccb5ebade982e7
SHA51261a672748eeecd07ddc6fd4a95e4bd41d071dedd2c848507efc1f0979849870b8571b3afe5ce65a1915cdfedfe8ed9c2574cae50512dbac3380d22ee48f76b4a
-
Filesize
5.2MB
MD51566400d108cf4ec16600ce81ac0296a
SHA1b7163cc6d25cabed7ba927d0490dff76e7469611
SHA256f47d5ba5502700d48de147844c84f93bb5b706bfe2ea93eed3ca573b8ff32cdf
SHA5127f3c5cc06679bc74a3f8f05c67ccc05d7de2dcaf92752b171bad4f54fdbf3387b082affe9c48988dad7a9bfc1beaeab49a30e1c035be5a84a7389d43937ffbf2
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB