Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 12:36
General
-
Target
2024-11-23_3fa681447b31acb2526fd782b98ce0f3_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3fa681447b31acb2526fd782b98ce0f3
-
SHA1
543941d48fc32e8098349136e3b5c57e8262dfe0
-
SHA256
1021699ee73d77efe342e940ad76b4b886482eedb7a88a301799d41a199a3699
-
SHA512
e460d8226eebe4c7a8f06d3ab810fae1c29fc7bd9dd011afcd6ef6a53108d6fa3ff8d19aa8e460d6247f57a00fc69eba2fb3c3e53a220da43bfd7ce822a991a0
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUv
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_3fa681447b31acb2526fd782b98ce0f3_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_3fa681447b31acb2526fd782b98ce0f3_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WXizyHL.exeC:\Windows\System\WXizyHL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LlxRloP.exeC:\Windows\System\LlxRloP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AkdWLbp.exeC:\Windows\System\AkdWLbp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WitIuXl.exeC:\Windows\System\WitIuXl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEnGiya.exeC:\Windows\System\FEnGiya.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\faaTYiF.exeC:\Windows\System\faaTYiF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDiwTIW.exeC:\Windows\System\CDiwTIW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LmLqufE.exeC:\Windows\System\LmLqufE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JyDfDNj.exeC:\Windows\System\JyDfDNj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WXJnVnz.exeC:\Windows\System\WXJnVnz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tokKWep.exeC:\Windows\System\tokKWep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCKpvmt.exeC:\Windows\System\wCKpvmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jxADZzF.exeC:\Windows\System\jxADZzF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wzMwQjQ.exeC:\Windows\System\wzMwQjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lidRmrg.exeC:\Windows\System\lidRmrg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCYAXny.exeC:\Windows\System\PCYAXny.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DczQQbW.exeC:\Windows\System\DczQQbW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZZzymd.exeC:\Windows\System\HZZzymd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OIXvXHN.exeC:\Windows\System\OIXvXHN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BAnEVSE.exeC:\Windows\System\BAnEVSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eOdDMhu.exeC:\Windows\System\eOdDMhu.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5669dc0314c9a9378b65a620990f94fed
SHA154390b7d14192cfedc949310089140710df2d070
SHA2567df28c19e3711619a19ced73c784f3f5095759c904f58d2e3570f1946c7f969a
SHA512bc50a2763c0537631dfc624bfdd5debf495cc8f8e0a20336165ed3eaf7213716f557c3acb4a1b42dae78da0379e0257fcceb16431e2fb3e5735d8778e0eda3ac
-
Filesize
5.2MB
MD52e0eba2cb23258b737a1b531ff75fa27
SHA1935040b78adc21136016717261cd5bd9d5acc937
SHA2567187847ca2893651e28f68b17879934f004967be156ba82c191fc64b26cefb2a
SHA51243d722abafd0940ee94bd6b90cb1b0b069d56c8bca5c18fb41a057788f7785126bc457896f34ce979d357f85fe7db53755ed9e6a1c83c2d780d1a3e6bbb5bd83
-
Filesize
5.2MB
MD53c0252bc2478bd446d3b0b50ea23b7d5
SHA1f0a402749e09270d24350695d1571191830361f9
SHA256614c4f56444afb1bffc12ea69620e035bcd6bb7b3bfdab2d7d1da7e8b427ab50
SHA512a6997804792a9d705b1366f90370c4147c07ad54cc554b0c5a11fcf68c65964e734587be5b4abce7cf661807c8f65eb790825fa186a5e2f06293b9372483c2be
-
Filesize
5.2MB
MD507c109bde9be3ac5d281a7dd4b1ffbbe
SHA10f4be09c14aa1685f9dcc9cdae830e415aeab93c
SHA256bd66e102da8097cf9cc60f9f45a7ffecca2d33d87886b3aebfd9cc3c880aa01b
SHA5129272e8dcdf7d9d9c5a8ff0dbd67a83797107604ab428564018833abafc5511d7d0e1fe2fbdadcbf6ba833b7a39eb080fbec27deb50386dd1692fa465b137e724
-
Filesize
5.2MB
MD5faba3bdfba43aa02249f08f3bb6dd745
SHA16857ca7c1d4df1835add2a7ab87a03102c6c8888
SHA25607d8477aa2fe15380f9731fbbe24b72b98e15b93c99fe45cb6f70fad82fbc94a
SHA5129b13e3d0503bcdbd1e4e13746f112fee0ce2be10c0605832ec99d8a8689f2f2cb0b3fb86ee72811e33d477efaf51ee3e4b92f1c7be06bafe01ec99244b711e5d
-
Filesize
5.2MB
MD58db8358698d0202d4e26138ab9d794d1
SHA18250b508801e76025cce85cdc31999f32e6bc246
SHA2563b483d1f9c500253e2fbbc618788c37a45ce334be1b6d6fc8c1d28bc56323fcd
SHA512920ad90745bae616e7ff26ea3f54994b18c282d5433818f9ce03b6bc8cbba63cc095b6a8c5cd2d57b7904530934ec1e1a341d40fcbf580bac9dd4b3af64fa2a2
-
Filesize
5.2MB
MD57c77b7aba43c88a49660ebc89ed11daa
SHA10283ce9b2accd192f696ba0ff5465024b90b98e5
SHA256904ed64fba987fee7f768b76fb500d83bac0d8ca1a6ac05284a87da24ad0e828
SHA51211b1304f3b410f1c56fb52900cd94ae8f434ea3e3d014f33f348b847917e920209cb97ce456712eb943e95fc3a7dfa952b67dd2b88a133a20592df285c78a79f
-
Filesize
5.2MB
MD532ea9409e8f3c0187a2d4d0f2abe646b
SHA18a48c1dc94d9b27c9d4aa2160bfb5e3c79c16dab
SHA256921a661fe76786345bfcc0d1ffba66eba0a12d40e097cbf4ee3d33ccd5229a80
SHA51237d8231eb99352d028be10425a807fb457453e9f126eacb76dc5e760da6dbbde7e114b829f3a640b9b1ae73e8895eb60130af6485fcc7370bb944be1e0c576c6
-
Filesize
5.2MB
MD52b6bae23643c003fe147412346e89fa0
SHA1c749d5afd77290663e66a78c70b9ea0332ed3bd8
SHA256dcf13399410f99147bd4c3cdcc2738cb31cc4e9204dd5bf1d0865e9fbc63dfa3
SHA5126b338ace6f0ce85182bfc00c5b9b75e09d5eb786569452a84be1c99ade1fba8dce1bf0ee3354efe21003138a64eefa8f498c24f95ed0267cc1f36a710e29b349
-
Filesize
5.2MB
MD593f07d6f16b8df5b397faf5f7af29163
SHA19a7181c4ae207066b98371c08cff53e9529fc876
SHA256b02d9846af0038f70ec9985c3b5b3e47b7080742a4ba3e4f0982ab1a61604016
SHA512280fbd056b549ad68456a743083bec127ce349856c57ca35e9cab57b6be1026a769a60f64481bb8f074444a7ec5a28b99dadfdeb57e7b794861bfffb1a95b872
-
Filesize
5.2MB
MD55f8a2adc8a37553a7a9f6b331193c2ef
SHA1f18a5cda46c01c275b5f387584678a1416538e53
SHA256d4feceef31ebb4fb394fdbd0a1f1269ff4a5cbae7841fa87b1df810526d0d991
SHA51221720eab470d700334ff0fa3c78b1e589900af9c1ca603b3cd6ff85e2b71fea8966427abd1a6887cafc06f853dc9dc1abd3163d8748e2aa91b7cf9d92129ba2f
-
Filesize
5.2MB
MD59814fef777c6051b962fc6e415f032ae
SHA176bca3126a49434b1a9a4fb907159bf3d7da2b14
SHA2569871b9a473911a822aed896f6accd20652c6b85221876ab74b0b2e3aa25a7cd4
SHA51257143438c6b127276f5648cfa027f4b235fd690936b890f66a8b6537ca1feb8f52283ba765b38498a917b302b155c4cfb3767192c39acb12a8cdcc32cee79f3a
-
Filesize
5.2MB
MD5ee81e17901f630eb887dd06f0b04c90c
SHA1b83cafbcfbf0af3488c50205844d342d769620d4
SHA256fcc56ae3f65f983e2a03001582783bbbc5b8196f2b7fa96750cb40ad6f169ccc
SHA512447f9d1691633444294d7f806bbda479144d97dbd700a040e467a6e5bb7928b94f589b38013f1cc7bd32a96a2e6532fdc16ab0f3b5a35a2994ee5cc5a03126b9
-
Filesize
5.2MB
MD5011dcbf9b137e2d523d92ba584b2059a
SHA15b68a1f30d185ff7e90563c834815423d22540fd
SHA2564d415d703f45bfee633c66d1144c3e80f56721ecd9a1020a1225050c00c47560
SHA5127c8af7688eb764b97d74aa305f9473dde698f4d3434dcdcba74a44a62e903b991f995b047008c1d0ae19981c48a8619f30f82ef138fb9f83169cb3f51aa437a0
-
Filesize
5.2MB
MD52d0d22c3b109f515479c5d1c79b4d6c0
SHA19079877189d96f9eec1ece5a60c62b03ff2bef16
SHA2568d141c58c16712cf7a0f82e528e595133222a93c2436ac6d7e4ff60f206ce758
SHA512baeb72230af164df91183bde4234f66ff715d8b5ebd6efbf6eeefd1ebde37f2feb5e4733d3e2bc0e5757b6cbf729006ce2d364058241b95b3f41f285c6aaddca
-
Filesize
5.2MB
MD5ba4418eb138bef1dc8ed92294763b4b5
SHA13fe86a283fa16c8f08afee41ab8acea2c6ac297f
SHA2568c18e135bc1eae7b6fa45827f1283480d32e6a7ed97d78b44ec56c77f0ddf3b5
SHA5123e0894f90a1d0487fd3f6e24e724ae93a4c023269caf1a221d55abed3afc0c939c71977ebaa0d4d78add2ec7ba1d2036a4a4e60b2c31199c20b38af2d0922546
-
Filesize
5.2MB
MD5ae2f9d5753e59fbf39209b68172e42a8
SHA1efe41a9634b9f2a6a42430c99d1673823936ad2e
SHA2564d15535cab2e703cc95a07a5fb809113faed4962a292f6826f50f0fa474461e4
SHA512f52c0e34224fc1a01ad538557460ddbbf6a443a2a44f628a800697ce0d8538b6fb589613dc6de522ca8d7c84b3d5e9dae061b10f78e0c433e344aadf82e6bac5
-
Filesize
5.2MB
MD59c1cf86e7220e4760ec29ec12d861e2a
SHA1e94728b7a5e7e457bfc0b6d6fe5d1841c906bb92
SHA256151d92b1fc7ab2fc0d7bda1d0b45d3aa0285bd1a1f8ceec79f2e3bcd6188fed7
SHA51239778208779197a8ab885b07f3a71eaea0a13b71ed90cdcf9ae1539948292371446dae4be8e8bd64217533cf606843f40bdd0c7c8be35a37b5df8a768a18ff15
-
Filesize
5.2MB
MD57c85a62b1f685531d512615380bf734d
SHA1bdb32546c687a71a8e2acd94d8a57f8e43641225
SHA256ead99f3dd61300a180cad1eeb96444a5106b21a30e845988cd2a9c7512108a25
SHA512d75789279c32f8660d1b885191b47030a27d3ecc0468c61f7d42f1d1aaa1d458b11d23ec292d0d9745c1374aa9ccbc6d1f1ed2b7e0183121845060f163932d8b
-
Filesize
5.2MB
MD5d8aac1fcbca78c856a8639c1eb4e9c47
SHA1c8adf34fcaeda3d3f5d88f861ab3aa8deb2309e9
SHA256d85ef0c100f0d687bf5aac27b03dfd0ec90f82f854ae1ff305e94c6b4b7b05d1
SHA51296abb458eba7a1fd78b88db77ba1f8ee545ecd3ef4c6a7cf0060d7cb2cd8df01bd0f4f00aa517a1ee421de2c5ddbb4442c36516c03737562d91a5393ed2b70ef
-
Filesize
5.2MB
MD52c760c1c1a59122e18e8bda48edec93a
SHA127a7b3bfead466250b58e4075d56bb9f35fb03ee
SHA2569e5248c12d068b94669563df5275d63a375ef95cdb027bebf601b33ead3cca0c
SHA5120518592e8d59977b5808596218e379add8d47ce78e2b7fa067a2b5d62d8b2b9beef480976013c3a3575a966c96c91a3fd0f3cd5fa968726a6b8e1296c0d260dd
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB