Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23-11-2024 12:53
General
-
Target
2024-11-23_6f99e889901501e30887096368076cc6_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
6f99e889901501e30887096368076cc6
-
SHA1
22ebb525beff67f9afd19e7d2617ca8f27dc6c6e
-
SHA256
053284abd2fb260463dfcc12cbe6e04495fd4c486ae96baedb1bc95b6b08279f
-
SHA512
27bdecb372c8ca5a4b56d027ef4eb64c502c6cbfff19095abe81a51aef81bd9bc479dce599be07f4f138da993f1b9c0eec6a3a029ad2cc030535b23916086714
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUZ
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_6f99e889901501e30887096368076cc6_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_6f99e889901501e30887096368076cc6_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yYkUeqI.exeC:\Windows\System\yYkUeqI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOBsXOV.exeC:\Windows\System\yOBsXOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjCYXdr.exeC:\Windows\System\HjCYXdr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rZjjpaM.exeC:\Windows\System\rZjjpaM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLzhWDk.exeC:\Windows\System\FLzhWDk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\phHbmdh.exeC:\Windows\System\phHbmdh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkJouDq.exeC:\Windows\System\fkJouDq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UhtLJDe.exeC:\Windows\System\UhtLJDe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYjIgVs.exeC:\Windows\System\sYjIgVs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkpBehE.exeC:\Windows\System\RkpBehE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARCBTsh.exeC:\Windows\System\ARCBTsh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GffhrnV.exeC:\Windows\System\GffhrnV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bxlgkEW.exeC:\Windows\System\bxlgkEW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pKKNGjm.exeC:\Windows\System\pKKNGjm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zeXKzma.exeC:\Windows\System\zeXKzma.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sTrGADI.exeC:\Windows\System\sTrGADI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RfCTQxh.exeC:\Windows\System\RfCTQxh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\izyjAwk.exeC:\Windows\System\izyjAwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IWzMLrA.exeC:\Windows\System\IWzMLrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RjXYnnw.exeC:\Windows\System\RjXYnnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SsmDSYr.exeC:\Windows\System\SsmDSYr.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58183eb8dc10639f9e5912668e383dce1
SHA1c799445b5b3f8bf11534014d1452a104d91940e2
SHA256991299bbc1216b5d3cba64193ff73a393a03f6f944fdad5a4116b5423fc7e056
SHA512a27f349c9c5e6a2491d3fbf7c7a44612bc2d674e3d44e46e4f6178a461f93e223d123f13bf95397c6b199c6b9d026cc976074aa7aac98e918ca03d69b1f8b1e5
-
Filesize
5.2MB
MD5e0bca80242ab37693a0bbd8fdeb30836
SHA18323cff94dd9fcb9306d7a47aeef7951eba3e464
SHA25629d308e64d23f8a1acb88e7b7e337fb9c5bc3d944a96ddf80f4b0c1dc4a4426b
SHA512e952031be893c0d95ec88bba3f522aeb35bf6c5c066a5ace75173ecc480bcd55afbe4d5b74596a0dbda816ef99879517bb06b4a8d4e170b94bb13c9a2b15c160
-
Filesize
5.2MB
MD56e497a0eda68d2c81ec637e6c3747f2f
SHA1cc1e2fae8e3a30503394da9a821e3327f86fc9c3
SHA256caf49feac19d875a6726b81a5873302dd0773ca3c7ecf7136d0dcffc082c38de
SHA512b53f783fd238a3799ef725d87bb87c0779685e8c631469024c92d5f154f1f73965ea9f7cedcc123bbe21bd893dd0748015d6fd1ff2135628930d7e9368580aeb
-
Filesize
5.2MB
MD537a6b441114a56552949c7f1d91ef7c9
SHA1ede9558521fb173b6acebf1a708653fdb87fb75a
SHA2565121f7e106deac1a261d0a8e170ead43c9101a04fb766e1068e64b29eab868ee
SHA5127da75d810ddc5ce6b58aadce02fc876e85039411807144b15016fa9600fc3a2016ef43b4ef88eeb8a61de0fbbbdbfab11dde2d4255fd7522980c3d5c0a377401
-
Filesize
5.2MB
MD5d401a95c3422a493fa03a511eb884096
SHA1b258326b73d864adc8860da0f17b0a53198fbf6c
SHA256609374b586d9ba7dfd74b6105543f2a38d69f7255a4e8152bfca437336854de3
SHA5121444e368118c8b6784948069e6aadd4d6b95c9f979bfd5a878c9797f39a30a73d16436b279d1d34868aa63610c2bd5a80465e5de286cf8afe3d33fe8b1913fd2
-
Filesize
5.2MB
MD531eab1d27f5ae51faaacf5d56ee646be
SHA1d14b9122c738af17dede6155bb02fb5bbba897e3
SHA2562ca9af8e7f55143d1a031f6ea7f585cd7f803c5b0689da33755636accfd6a1c4
SHA5122c14b5c5ddabb434ee22c32f17cb35b54bc3d63bf50bf4d25a8d596c37d3e2a9bf9d280f33842d78c789e872a0072cb4ff9814197b04a5044079574c5ca58351
-
Filesize
5.2MB
MD57cce4054cc58f8a8027d5f5025413a45
SHA18f64c616d016ea490af8f91b845d6f64e9d6e747
SHA256d64189520d1aaf7ca355ccc1a4342d0aa8242ce5f0ec092e46a77751586ddcf4
SHA512ad5e5412bcb3faec056ae59bf203fde3fa82956dd58484a9805685c15244481524124b78dd7d12e3878a22b6c55d551a39431bc6de6f9f26ec80c1b07cce3558
-
Filesize
5.2MB
MD5bb41b176d1e79ba59ebfe716a72bcc6a
SHA118ac771945860cdffce0a463df2eb48686ee74ea
SHA256acbeee65ae12c0d98800991011cc6979057d9d035a91efdf77b7eac9f145361f
SHA512b3449e1d1281b9bbd2004090d9eb8124dac66d040e5ab2915f10683a5b45248a5b0695b32f6d4d08116ee697c87b8acf379462d94b395f0924621d960602bd2a
-
Filesize
5.2MB
MD54baed996704b9ab8def75075816901c0
SHA1ad7ac9ae7b0cc299713213f35871b494e687701b
SHA25625083e2493c2956ec9851bf0c67071d54d43cf5faa955c355d75918cf3374cc7
SHA5124f7ad4a9f0cb16920a46b9eb0f24434621e5e65ab118030cd229ba8bbd045ac0a94d4b82e701676fe3cc6cd862cdee123509eb99670516bb44cd2358c44c6348
-
Filesize
5.2MB
MD52110fcd7c4a24081a2d6cb1347cff75f
SHA17c722133f778e8e3fd8191b0d33b3c0ba77f9f30
SHA256cd53a8b01c209292e6e3f824d1b6546d9f64b8e648db1aeb07ba646edad6c33a
SHA5125220013e1feda85f3cf455a63297cf0055bfe9b202143636e0c9d9e4423cf02ccad2ca0f6f230832986c4488539a72f4034622ac552a8924fc9f6ba873c616b0
-
Filesize
5.2MB
MD53be350ee758fdc5b83449627a0659105
SHA1e8310667a2b3f78206e363059d1d3aa2bc04116d
SHA256d4a5fd15989d8ff29355d7c88ac48feed2f71337d4c2a4bb5035a503e84801e5
SHA5125df3f615a498c77d93c2c485df3dae3179233b91016dbc052fc9f2917232fef5ac9b74fed90e65a28e6c8ad4b16d6ba332ae812097ac52df50673920071cee09
-
Filesize
5.2MB
MD589a14f117bced3e2c20d21ae0e738691
SHA1e8b98d945db9a4522c4d7c13ce5eae4cc87d5a9a
SHA25690c479c6bfaf8dde8bb5aa0c94bfb91282ff1a605e9bc17c56b128554edff64d
SHA512d9c98449ba0c581fe025eeac6baec7f69f7a73d468222869a5151b131553481a25815076df8657ae0bcef46fc69205682fb14adca528b7331c5c8a6ec7cfe7e7
-
Filesize
5.2MB
MD542a132306eb936e5240a2d83bc264a0c
SHA15dfc6c9c8bd01baa973fe55bbd1b3475f1b28782
SHA256b973218ecd1f3fdd6d15b1d67aa1eedf6cf2f9c259bb44621ee479c0eff1b1a8
SHA512b4f093b7e464c004d3c9fd9a07b25219c7718cb936cc10f3062e155ba7ddec51ea371e5e2cb4f572796ce4c655250b9848a4af3eb341c0daf6366e0bc515fb44
-
Filesize
5.2MB
MD5dc608674422c914434b7239653762082
SHA18e7099d2d63882d78c3f3fcd4388f05a5470930a
SHA2566644b0e88fcd81078126caf3cb12370678f7db20f988fa6807652a2c0cd732df
SHA512cdc8a0157b813ee68d9789b5740fd63b1be4b75d0a60c0ffc12feecdd3f37c51fd748c9f1751a7c1fd5541af7ba3cb53b29bdcd955fcec7e98814a074114b9f0
-
Filesize
5.2MB
MD5d04c3cfaaa7e2302a1568fcbc883f415
SHA1ffc3a4ddfcceac0b5ea18bb21de7fa7a8e2d8b28
SHA256d4dbfc565e94397e8498b83c78a598433487b0f87f8e4e660e41925a91dff628
SHA512781738a28cd15fde35da6d5fa076902473f0ea38e96defd74a5ab6e7a31c8dadfe8d70a1a5b0a072f4460d6492dc1f1defc69637b08abee5dda67089e6f53bb1
-
Filesize
5.2MB
MD5f5599de72a3e9f63a938f2ac0cc25f60
SHA1383c7de5c2a64b34e20c6c858960ad5e77d03bc6
SHA256f9acce6b14d18763f9e3650b697e72f523da74e48875940590c3c5bebd6c1c50
SHA512e8c9384edf3457f25f701961329a9d6ac6d1cf049b41c39b33b317b330c90740d2bc508fa3f95154df809ec74f60c40f59bc7a0969e1f5c09132bc2937b55ebe
-
Filesize
5.2MB
MD596638ce172c8c469f8394dc1ee83cf58
SHA17fcaaecfb6d94ea0a2283a1999538aa73b29366c
SHA256a99167a02eb72706040601860c8692c8e74fdabc9b2fbc06ab60b95ed30d92cd
SHA5122b344aaa2a5dc7ca51e20231c6aed21c3929ba19499025d35cfbf20d4b4d30242bb140e3b46ba5b8f5f1ad5a26576108fe9cd4efa7654a183909e4f85be7e1b6
-
Filesize
5.2MB
MD548635ab34806352c777c94ca636e993d
SHA137c190d3f53f38de0f0f0727ec51f2d856374cc1
SHA2562c7848b01f3d8d02258069283c42b1754e238dacaf0be754b0103d4b47f473b7
SHA512a27ff760cfecaab3bdadb344d3bdc4338eff376075bbffbbed7256a9c54a711391c7a94782e79e0860f70e91a8b87c285d33426ae0acf628af1354d9de80a746
-
Filesize
5.2MB
MD5db99547a931fd1b18fbbdec16d893676
SHA16d33705efa8f1488cfa002f62325d6e32190b2b0
SHA25667a9a7cfc137afc9697b86fdefa353e62029d81676fde2ca77c90de94f40d0c0
SHA51252e37c67f0db3d6a3b8467c0a989f483124f852acf5647545a9453d47aa77b5bac66c065d66c899a9b9b2403b829a13acd8de7fb23ccc1cab7a8e0987b17fa91
-
Filesize
5.2MB
MD56133109804bbbcd618525e72b8e1341a
SHA14eced646203cd968055bbb3916c7d693e87f9d50
SHA256ecf6c4a3315c66ee141011b5263bf76826c61771feaa21f000cdfe9f37e82be7
SHA512ec9898d7489ee00553b0926828929da06fdb5a1aeaa8760e7e6c276bb8e81a1637d0ff5001c4d42ff006c1d78d42b91b6ffefaf3b2697532eec4f3af2e9f55bc
-
Filesize
5.2MB
MD5b49d3bb368946c19391384e3daecc762
SHA1824eb324d30e3a3f993b6826a9eed4d034014916
SHA256b8eef2a369452a8706eec7b23693ae1768f12b5df4e83da79dc2d6dbf9f74c99
SHA512d4da796878d470bc22f1130f59d0be5cc04e45f45e85f21e2a2d5c12a4bd627a3bf83ffb007f00d1d7728834ca24fb91a89ecfa34c2798e15a4a7b352779a157
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB