Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-11-2024 12:30
General
-
Target
2024-11-23_1f21191fa53be26c229412fe969a989e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
1f21191fa53be26c229412fe969a989e
-
SHA1
11f94aa04c9484bd5eb32878cd1f4d72c35d84e3
-
SHA256
e4154a16137cc9e54323a90c722dcc1310ae0e7c8a2b574b7a831ab5be3f80c3
-
SHA512
1b97b2dd6cb823b2778f2da203b576ad49dbc9dca1738add47e4c8465421d6f6fdfc1f4ab12871a0c8dbba9387f192abb9d6d28a418eefaa991d4fabc0b4ef79
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUp
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_1f21191fa53be26c229412fe969a989e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_1f21191fa53be26c229412fe969a989e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\AwbhgIp.exeC:\Windows\System\AwbhgIp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ziCFLeW.exeC:\Windows\System\ziCFLeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TCVoNXV.exeC:\Windows\System\TCVoNXV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nEPxJJq.exeC:\Windows\System\nEPxJJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IFYfyYn.exeC:\Windows\System\IFYfyYn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LmjKwVR.exeC:\Windows\System\LmjKwVR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnGXScd.exeC:\Windows\System\hnGXScd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohYDCfh.exeC:\Windows\System\ohYDCfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VvMYcIN.exeC:\Windows\System\VvMYcIN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pGDHeDa.exeC:\Windows\System\pGDHeDa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSzqKnA.exeC:\Windows\System\HSzqKnA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WoagXLB.exeC:\Windows\System\WoagXLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cuaQvpZ.exeC:\Windows\System\cuaQvpZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OWKJuTX.exeC:\Windows\System\OWKJuTX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXtwCmV.exeC:\Windows\System\aXtwCmV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qfOznRL.exeC:\Windows\System\qfOznRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiGPdrQ.exeC:\Windows\System\hiGPdrQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TfSnlUd.exeC:\Windows\System\TfSnlUd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yyfCubP.exeC:\Windows\System\yyfCubP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uPjHzXe.exeC:\Windows\System\uPjHzXe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XtVTiWP.exeC:\Windows\System\XtVTiWP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD502acbbfd12b27f49ade7a1196e9b80bb
SHA11643e7400a61166222c784a4acd5d3725aa972cb
SHA256d101d488d9e5fed2ee55dd32f2c2f8feb857f7c19539195dc607aa521eaff8a0
SHA512e9797ac8c94f4ed7e7608602302435316b51b3d7cd3a6b074f828581bf929cd21571fa0e1fc8c937ea614ad57c96066ef338c1289833a8cb58a172513da9a362
-
Filesize
5.2MB
MD5b85d8e01ba53e993c39aa248e2bf75e3
SHA1a10a3a93b3398093a04ac7e99c0a3dbb50d53c80
SHA256065ed271d9bc83c48582920019f30992fa24f3e40c3a00f3be25da39b4d9cb8c
SHA51255d25f133812447de35ea0d6d4e1417f4b009025d52b7fc8b11f8ab8e9f4d38eabf1425e43e4a76356f4e50cebe49c0b51ccc165d1b2934be36b28eb7c932e6a
-
Filesize
5.2MB
MD5139df5c2ad3ea1ad8a33037f5a32e45b
SHA1afb819a1cf524bed4dea89bc2005cbf57ce70a4a
SHA256c3ad63e9c2be40b7e72027a69d0c26f2f06dbe80e1558218b984d7c04529a46a
SHA512ee2354fd1f95e2500dcda0b15d5ccce7b7a473d3f306fb053f89e4ad022743d5fecce0e7305195f8d9fca7c2f6d8059bc8f3034f388f118038dd7c515aa660c2
-
Filesize
5.2MB
MD532119b9e4ce6f754fb3c7c061fb6a909
SHA1be23babd2a3a991d830714ea5a544bb1a125a456
SHA25606d7119fffff9bc7a52f045c81fe8a1cf609555f477c0d9cccdc402c07338a10
SHA512ec836e512877bb2b98e8254c4b29b5d950957ecc5a3082a186bf675514e38f9e43f15941f665b43c5e9a38dad96763108a9f14c7a61d5a730934f0b1288dc3b4
-
Filesize
5.2MB
MD5680ecfe602db8c4026af635057206b2a
SHA1f9e492f9c5850c6177f1b5caef3a51c1826d6ff9
SHA256f0da4babd3f08b28ab349ebf4c9bcbeb00fa4d766a7e13112b5405df1d94feea
SHA51282a31a30c683c1465f5883b1f4cff04890d293c786e2351237e7fe7f6c560e29ff406d6662fd42cbcf5ee93e6c56719215a0ba9564b41ff81303cea51842977e
-
Filesize
5.2MB
MD583d81d016f941a5a033497b0e0554090
SHA1c1c7edef7e0b35ebe5b40dace1632d7d87616f90
SHA256aaece03758416c86cb5bcb3b489313f6d11a81f989421ef5bdf19f035dcdbbdb
SHA512c8267e3f02861d42fa230f1fa55c7bf6f02e6124b733bb9182ad5dbe3f15cd7b899785fc2304ce9f0222694b50919bc8db56cf1368ad7b64183e4ae379e7253b
-
Filesize
5.2MB
MD56b53af03c0cffa76db544c87f5e91c5a
SHA1ecfe8a60978ce27ee6bf939ddf56e14ddc392e91
SHA256a56708ead686d1c6c427516ce85635e0c42232d8b8626d1cf09e64c3a87afbc1
SHA51287dc6f9ee9e04524f545ad1645914ff3aba8458da56039a973daf66ff2b8d4a00ffd1ec900b387854e14b1cf916342bb00beb955bc2e1dc94f129beebfcac879
-
Filesize
5.2MB
MD54a3f6a55c61683f7a37f6269ee9adfc1
SHA1a46672d32823853cc1da5502ec2a049632480969
SHA256b9d3a7e7f2cd68626703993bdf241db1af1acdf001c87864e4f2425a9a67d39a
SHA512ba69afe55b5f41158ad69a74821e76e50474562e49d0e2651de4da3f5c2c2d85aaecdcb9465cefa5fdebee3abcf94841ba9f51b05a81b1773054aa8257ae8e45
-
Filesize
5.2MB
MD5460dc7dad8db40d39eadce468c89cce0
SHA14238e23745ac2d441bc1259b896bb3ff509ee76b
SHA2565320532441ba9e778d78e89f95cb1bb92b379170a0e8c779df2eac9711095b32
SHA512658617eb5e6fe5158e5f81d7fc8dd2321886173cfc733f5a57a48ecaa91cda6c25b771e042712e8227d2bdd31618987e25fe7f429f1868d37126091e12d5c643
-
Filesize
5.2MB
MD536b36faaaa5559dbd43dbcd852e2782a
SHA1e2f762e3b6fd011407870ecfeac6990e21770978
SHA2564d530df2aa7b22c271f75caf0ec362baee5f2d420ae57af8fbea6f12156575d1
SHA512e1675a145714acd6ddcb14e3773f9079221e3a9d903883b1406c887d7cfef1aa6c8bd3325506c7649293fbddc225b41a8f0f8ccf6b798f6a5ee4e1d89749a38d
-
Filesize
5.2MB
MD57eb0202f83f03ae8189afd5408927879
SHA19e7942510534d9b51ecdb9706707588d34687964
SHA2564fa91bd29f4f2c062889030484509db2f435561fd136d78ab3baad51f48676bf
SHA5129acad8af124d8a0d112fff680334f9f5487705b8270f1ef7879f999cff6fe7c160dac73f8ebed9658a84f1730eae6377749dd1e8bf6b7627b525d85ff5865fa8
-
Filesize
5.2MB
MD5007bcec3cb2b49ae22e9201bd8bd5f65
SHA17ab0cca35f96b74c91c61c9a219aa43068b45757
SHA256d315cc3918594b0ac6b96203f29f53f4e643245920311d7e03e6f167e6344ff6
SHA512f84baa1b684349d9966b62bfa65760d6f0c286a0b4174593ea9df39f4d66213c26013985eb6e30b0aa98e42258af3001e21fff96c00e7c70e01b1e82892c3f16
-
Filesize
5.2MB
MD5cc0a083f371ece195ab83dd4a257ba10
SHA1cb1757a2794a8f8b229139d8ce4b9ec0d0433cb1
SHA25608f4931fccbe72456c1cf7f808c4e1f475f23218b4d7e4f424f5274986db6398
SHA512765493c664ec41c86434146c651c00099e268b9fd5496554f8b76b2f4e64d1f06d2149379db21d55af5c6cd4682054c5137c447b10f002b244cf09fb88f7e61a
-
Filesize
5.2MB
MD5563c52c32d4c12386dbb793e637aa2b0
SHA18b8da821e2643c19fca19f20e5aaf98440bee0d8
SHA256f337ba76e2fbbe7dde562135fde1d2fe7cddec7fc15f6030ac8654de96d235f7
SHA512594f592df073755218676d9cbb007e5511a87e57a836c5155aa7756df6dd805b8d8aeda9b6c2db460a2fec468e7ff59ca5d1d9416e52b5c7b802a64bf12c41d5
-
Filesize
5.2MB
MD535f4a8805414a7afffa742a8b937d71a
SHA157ddc1d08f9747721cf26fa42577587ff08675e0
SHA2560f082b66a967db2f101df29f6ba8c7325b6b5c4a9a6f13799b2d62bf7baaed56
SHA512201769282d39c5ecb1eb0077cfc44a06365989d654791b0605dd03835dbf85d3faede48af57645365c085234ac505caad3501e665bb5e7b01f28e9ebe557fa70
-
Filesize
5.2MB
MD55dab3c7e6d2b1348bb635818e6dc5236
SHA1420dfcae901ca866adc100e32169cd02f4ffc596
SHA25698af320b5dc69ed0e85c5e5977aea1b85c89725e15496ea4fe5648724286d8ab
SHA512700286fd95a5668ae200dd13c9dc3e9d3b532245a7838cc57b88916c2d9416419f55f6de88c48d16cf5c4d7b5f1b108cf3efe491f00f3947958ca7121bff9750
-
Filesize
5.2MB
MD588c26461c8a245cdf96734be810b7775
SHA10004f7d5fe4c5124beb85c41a25ae66bf476b6bd
SHA2569f8c3822fea768e5ef73843e05c9767f94954fc0d99130f146c673236d2fe138
SHA512a9902c0a4c09cf69d5f0dcc7789badee5d4166ac6a0584de54867d9ef5271150bc0d9edef6f7e1692ec9e7574ef0264db3e268c64c8434dec3eaa1b988d82a25
-
Filesize
5.2MB
MD52da321aa6a0dfae9d086a705aca28168
SHA19cd718ef0b2a45f5a6077a53d674622272aba786
SHA256b68aa17b79b57c7a5bbe68e8a3d351169416f4a2dbd90258ebd7f8a9427d2417
SHA512da1e20e9f24bea0896c02054577b7908e15514b05a0cc7ef6756097dcbfb50e2a1d19e8c8399227fab94a7984c386491d2f98e80fc84de4b8c536aa28f74ce6b
-
Filesize
5.2MB
MD548825df170149fa5c5786aefe109d6e7
SHA112faa9d107a781e98cb8f3187da113b7c4e80a67
SHA256fac93397899524bdef2803a46a485d364a7513bf14ec1f6bf9a7011b22248971
SHA512a81a2df1622ea9bd45ab87dcf3d3e8301578a81776d3d737c47c4ce5d8d128dcf5fb455928d610e1a564c424856b5db7eceaa28f0e9c73bbf9d50d8e6f69af80
-
Filesize
5.2MB
MD59e82c4442b4746b443ef7dced7463650
SHA1385871c6183ef78871e2458d58281314808421e4
SHA256c5ad9ac1f99e261db98ab66c6826bc4604f6498047ab673400912f1cba6c77cc
SHA51283944f10dab75346190a4e04953d4ace1bbbb8fb7a77b0e61a6056a56988fc54eff7c0dbb742ff9f5ea67806bb4f49b7a9b3869fe162282386f93c79b83e7094
-
Filesize
5.2MB
MD58075b5e2b01d68d62387743e70bf7edb
SHA188c847bcf1f432e5fe6ad37708da2bde270ceabc
SHA256b7b295e46882e28b1ee778388b8150a8804ce18b2d0c1fb117585df998390466
SHA5123c7126f9e725fd2e36ff62ca179fba8c072b1882f08b6c1375051c4c381ac811624ddcefc4622a3f4dc5e132214702dd0d8e89cce904cba8701bf524b9a744fe
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB