Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 13:02
General
-
Target
2024-11-23_e2a6f908933933af7ac122be89443e2c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e2a6f908933933af7ac122be89443e2c
-
SHA1
c14750318873c7de1c273159fcc414af98d478af
-
SHA256
128ca15536fdeabfb2fd37bb951392815fcea7719beac00278c8eabadf7b9ca5
-
SHA512
65650a3a23bfc704826e785781efaaf522f2a5b8d44d2f31e1eeeb0aa5ad6afa3bbc8bf2f7dc1776e0087b7d93c18dfc0de91467ed7f3f8c536ec4125c6ecba4
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUh
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_e2a6f908933933af7ac122be89443e2c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_e2a6f908933933af7ac122be89443e2c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AyMJqSA.exeC:\Windows\System\AyMJqSA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HFKVyRN.exeC:\Windows\System\HFKVyRN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WikVAnm.exeC:\Windows\System\WikVAnm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kcYAJqu.exeC:\Windows\System\kcYAJqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbxsedO.exeC:\Windows\System\qbxsedO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RSDoaib.exeC:\Windows\System\RSDoaib.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aPOfdEZ.exeC:\Windows\System\aPOfdEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqbuQMq.exeC:\Windows\System\yqbuQMq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDXgMDZ.exeC:\Windows\System\CDXgMDZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfPBFdn.exeC:\Windows\System\SfPBFdn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wKIVQDW.exeC:\Windows\System\wKIVQDW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jShFeof.exeC:\Windows\System\jShFeof.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PFjUbiP.exeC:\Windows\System\PFjUbiP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YpFjYVT.exeC:\Windows\System\YpFjYVT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyKkfcB.exeC:\Windows\System\oyKkfcB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DPZEkNl.exeC:\Windows\System\DPZEkNl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\snFBFRw.exeC:\Windows\System\snFBFRw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kanSQQm.exeC:\Windows\System\kanSQQm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nzIixCa.exeC:\Windows\System\nzIixCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gghrABq.exeC:\Windows\System\gghrABq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEkCPkA.exeC:\Windows\System\LEkCPkA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD503cdd7e9ea75a56a3d0fc30fe19f5e1f
SHA1d013b5e52e71924dbd93f7b5e34966ab03ae26d6
SHA25617ef3b4e6d4ce3afff19ef7414850f634c3a57cf45ec0f9cb5845e12a386b0b6
SHA512e03fc7f071d02f13ccede1400bdc810b77505e40a5e4f0b295adf9bda12d27ff62db0d8e6f4f8ffc150f85e9c639c1dc2a0008e280f3698ebf72a9b8914e5a2f
-
Filesize
5.2MB
MD5f018618b977974f34108280448c82ce8
SHA10c80c13149907ada6cb55714d15100f400f452f4
SHA25645862d4a7f940e037721c8cdc78ac167f4bcf3495ed24992af6686587bda0cb7
SHA51261d09a1206596317f494273d304f37c9506b8cb6410c93de5ffae3b0f264067c9946eacc70bfec400ffa02ed1acbcc0bec6c7a413c8f342d2c71726c0d844a1d
-
Filesize
5.2MB
MD51abf72e22b74ea7bb1d042f807740582
SHA187fec8836efe77ae046aea3daf4ccb7e0cde4872
SHA256fb7f4a60ee508f8a6a16e35ab8bdd645280c71e5a7074c706f8c356eafe12047
SHA5127c36f4608308a65024c0f6b8ca2ae39b33c3c9cb8edad684ed81d46a1398fe399f66069379b82012992879d8bf5cd97b1ab02c930470076618faa1ecb74b2757
-
Filesize
5.2MB
MD5d8140b96c59f1849f6d8a38b2a2c2fc3
SHA1631d8f8affede58b039201b814c37cc64078b6f7
SHA256e78ded5aec1be5843d8ee2146c191a6d925c19f902745cc5fb3e524cd34ba4ef
SHA5123f2b3c63d50634fa13d1e73e44a8064cb97adc0f53de61a8b9810dedc8178492b21c3ff536af8aeb2191959c2236b5626b5c8ebe8b3267b22fa45433c38f7ec1
-
Filesize
5.2MB
MD50dda649b07d647912dca1bc010d9768e
SHA18e98a573a095f28064aef9259f023112f20a0ebe
SHA256e2180b5297e78d8a3035cfee6a6d90fb3118fca5752e5be2361d2d48193fb1ba
SHA5127309446d374c4ce1f5255e44aadd3b0c51cc91d0c67f11e0374292223d72f5560ff60cb34c50798df30df544b449263354f15fde24a3cf5448492b8275c5f879
-
Filesize
5.2MB
MD56b3d1b141d00d36d8fb10303dbf27621
SHA1f79a0895108ce474349387ee5825f88cc803e690
SHA2564daf1bee1b80477a09b4abbb217a51886812513df837177f7048adeb0d1d3900
SHA512b953b6c08432515a769410399df561f7d4b7b3b43c8aafe61b328e41b5e29fcf0a996d6212f36b038af6abdcf59a20a89afddb599ed0b36a20a71ce39e67d064
-
Filesize
5.2MB
MD505f955c1381ae0f81e610fcd192e777d
SHA19422267686feb665e2a705d523c0c13c65376838
SHA2569c999e30b4edf9654f51d14743df258f50faad7693dd2c4e5f5ab36b00b9e67a
SHA512b82ca4fbd4111d8f4701d0053dc9ef93468e1303dcdf1340382e668db598331b1743fdb433412f787e28c660b3e318db3912c9a7997d63d1a2483861008876e5
-
Filesize
5.2MB
MD521df8487885a67fd1b5189d9289888b8
SHA1b49e9d6cf5e4bebdd1bda7cf330582d38e1a80c8
SHA256bbcf4c1802d48cfd233fc0d8a51d1b48c16b25ccc0c8728dd64e40d472cc4b3b
SHA5124aa679e2c8c132b8847c2e27853d48f4b93cc66c810e91c18bb599fb3afa40f5fc810189ce9d50404dfa90f5c00abc448b0d56a6e80a2629743831852b760020
-
Filesize
5.2MB
MD5ad9c562d70974c48bed53314d53b2123
SHA100a2fc8424f291056fbad329c7619c6cb1c99eff
SHA25665242acb14562ae85dba1a3846346b88fc88b04ffb423e7acd40a3f67c3df218
SHA512d177ab7bf7e57bf6626cbecb999d0ae4b3563a2f0ead0b1cf5d5306916e9b2b19a2db34e011bb9920371e75a3d959871e39408f6ab230e2904a759da1e116031
-
Filesize
5.2MB
MD5cdff75c74b97ba1091ddce93e9b95804
SHA12b869b25783b9dd5531359c0505fb1de6e2b7ad8
SHA256811b426af43e3c7f8f264b7753725ab64282b403c37e5be36a62ce069e06ffbe
SHA512be6fa0787c9255dbb373eb94632b927c7ad51684f0be4524be812ebe2d008304ba62454e332ad1efd3257b200a1342a454edcd06901f8d7dbaf350d1e7da2854
-
Filesize
5.2MB
MD519491e48633b96865b8e8b1ecc23f071
SHA1b7ce9362a6aca3dfc83d145cb4664c0b963fe00c
SHA2561193c1d855f8c67c9254ddc3ccaf08b3c699ad5a2755460941c01207c44af526
SHA5129c72c7fe62db5e3c9c1d7266a089ccc44e537e2616de2613485ae747578756e388ffdbe688a7534328fc04d864ccc1b843e6914c5fe8cb5427a7e190cac62164
-
Filesize
5.2MB
MD543699dcadd99d4e7874747ebe32b792a
SHA119a1f78e58557824414d33b590362d8d97e81487
SHA256cbadd4a36164fd27d7faecea742f5e6fd92d07a5ea3b442a0e5c8a9338fd222b
SHA51261ce1eea6f3c6c1c3507ce1e6e173d934aa3622d35d649914236fed33152d4924d4a0514ec05800acb6598d56f6a3bf26385351d7c01e5db06529501eaacae74
-
Filesize
5.2MB
MD5ed1ca28f242f3d461bb3f5ff4b4c6ed2
SHA16df628ac32325d34b467530f34d9950b8a7d6d65
SHA2569df52a25b34974a7a2556505038806cf341c35cbae46a70fb1bb91dd2404dd0b
SHA512751a40d2627c836b01012bde57a004e037ebe2eb6ebec34673b52ae078086f6cece8ac51a3419a1aa7f3e6e23c617552183796944c7b67fdf794a3308c7aba6b
-
Filesize
5.2MB
MD59b32571989be530237a7a3a4e847812c
SHA1d297a652243d97f2b0bd412f354e01154066be9f
SHA256db79b96e4dbd23bf4ea361caa79bbdf0e64527b236c8fa55ded12e578133cd49
SHA512843088c1ac5bbfc870e45f3a1cf02a905eb13de79eb3d5bc80bfc83c788a67ffc8d620eaccf1087f7dda3f7f4b268f6f554da923c3cb9a66314868d62f37f1ce
-
Filesize
5.2MB
MD51d632ecd3b2b29413c7df95d0762089b
SHA18e7f469d3488c8d96a32fc46a2c68e08670c394e
SHA2565690df61c6472c78dcf9fe17e7e7a1d8cb37ae90dcf328f1b4816dee5d955d34
SHA5121eed34da6f45c0b615cf632fd1d60b73d6e38056c175109cd4530c420c63873f9f172f28b409b843cd8aa0848b5049a83d44b36bbcc8783e7f544e4511007c8f
-
Filesize
5.2MB
MD5db0636f853c96fb1ae5411a455d7e3b1
SHA18901749a2b9bc75a2da8153e4706b70da10b8e17
SHA25656c595267c07d852623db9d7d9aac6d029f477b3e778026eafc9232073d4d5c9
SHA51243c3712486bd7b8e0768625dbbbf93aea2a0214e3634905017c4c3c36e2f3d48d5ce989ee89cb3069fc1788f35ce5721afc4aa7b0fbb1819d96374f796dac37f
-
Filesize
5.2MB
MD5f184a0897141d50179022f09268efa35
SHA1f54838b7c3410998cc5f4373ee8a82a0825f52fd
SHA256001ea1163da9cb296946d6ff601fd31b4b00375324584cf8d54e46d5febaafdf
SHA5126ab365c380008b688b0c4d72795c0ca96c1ee389a5cd4eaaaad6a3c70410d4fc3e9df05a34b3449471292d96787a93df5562c7290cebbfcf84084a5223a50947
-
Filesize
5.2MB
MD5a84033ae4fe45a313823a5147f79aa6c
SHA1926863502546f53f6710a61bd3d021dca331862b
SHA2563e3a2b5ba328015c7dfb9c487ad4d2645234dbb96f065110fb8652e81ca0d277
SHA512b4726f17cd283ed497c57c36e9a6da5ff96578e96b80d5e09b898e43645fdd887e08ee646935e4ba84f0e6349d3a34ee9e0283325884a65a295cf0dc2a28f7c2
-
Filesize
5.2MB
MD5ea5262cc52585ad04e715e25825391f2
SHA10b9a8ff987f613ef47bbafb2718d49a82f9e3751
SHA25646cb800f845af674894a04b867bc9ba6d1c137d5b9cd4d2e51ed6d8344130747
SHA5121e3ebf8f70e01568a50f20b574c844c392d138b4251c271bb49c4e8902f50cbfe7a18d10dcb5796b2f391ef8ed9d0d7359e3d7eed3b1bbc5ff3f690d6c5f605b
-
Filesize
5.2MB
MD5fa5690bd116e57aa3d8be3f639fa580b
SHA1a95c937048448cc350d7449e35bb3b206ab5b400
SHA256dc6726363185b692a54a0419721a3088df6a0c7b17c39f134d9325395e9efcb9
SHA5124e229b0165dbb4924c33b1e437d53b099cc3967e36a114492eed9950c4079fa497c88d0397c191996eca6c5443b143eae639dd3f12407eeea4cb0cf2d16885c2
-
Filesize
5.2MB
MD564ed0636ea798096c214ba98037d0322
SHA143b7e7ebea3639cb02b2414ecc8eb56d642974dc
SHA256647c3556ca1e8de140c8f48c2c9bb3f0c675c4b397bebc82b0f162e8d4d88ea1
SHA51273f444e954d170fa56f62b3c9b8e23297ff59d2daded0661187036c21aa81d1409821506f83e7ff589cc701bd0a22e113c93fad94b10cf5613baed0d71a97cdd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB