Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 13:03
General
-
Target
2024-11-23_e727c9b5becd56c434ce1d7d4247f8d4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e727c9b5becd56c434ce1d7d4247f8d4
-
SHA1
0a5e86323da25deb53d0227bb296aedf81be0884
-
SHA256
85591d0f8567eadafdf51cb881ef28b93a06265f89573555a5c9843a713b4f9c
-
SHA512
f42ed876d2b8c6d4af72e68667d29adc9d23a30647e8819e7dfc2aa128bcbd77e0f75d9db3ea572e5cab7cd6d1c83f15e5ab8d087f06c8b5f76b5b5dc2834091
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_e727c9b5becd56c434ce1d7d4247f8d4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_e727c9b5becd56c434ce1d7d4247f8d4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\VefncNt.exeC:\Windows\System\VefncNt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GeaMlTc.exeC:\Windows\System\GeaMlTc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xASLqTq.exeC:\Windows\System\xASLqTq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EHPcAjI.exeC:\Windows\System\EHPcAjI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atjsmYU.exeC:\Windows\System\atjsmYU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GAVtOQv.exeC:\Windows\System\GAVtOQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GTXTIUE.exeC:\Windows\System\GTXTIUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLrQkEo.exeC:\Windows\System\LLrQkEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XfBMtab.exeC:\Windows\System\XfBMtab.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qobjzod.exeC:\Windows\System\qobjzod.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PuuDapm.exeC:\Windows\System\PuuDapm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTSFFGV.exeC:\Windows\System\cTSFFGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KfJXvYA.exeC:\Windows\System\KfJXvYA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SlnGbNi.exeC:\Windows\System\SlnGbNi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fdtdtaY.exeC:\Windows\System\fdtdtaY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PLKBQkl.exeC:\Windows\System\PLKBQkl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\liYEpys.exeC:\Windows\System\liYEpys.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uZtvJwf.exeC:\Windows\System\uZtvJwf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ODJoZYm.exeC:\Windows\System\ODJoZYm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nKaZvlP.exeC:\Windows\System\nKaZvlP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xkpbEZI.exeC:\Windows\System\xkpbEZI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d02be193138add26202a50d8d8c2ee2c
SHA1cf3a0a7b2b145c6546afc3174949000c3f11e014
SHA256aad91a1b5d08ca28344782bc8c01147738d81cba220edc06afb64a326e7d227d
SHA512256d770b421ea09956ff3c4b2f6819deac91ba07db3a8dbeb4162b958d1f59410b22c9302f968174bd085b412fbba21e40ae95f3479218f14ca3a7841cf01110
-
Filesize
5.2MB
MD55cd5c2bad45ba6651619fa9bb46b8bba
SHA1fd40c69c225cf95667f3dc19bd39067f78d9dec8
SHA2568f3e4c3a389902f763ce191268e0e484fc594613db62fc3f117c13053dd0df57
SHA5128c3a6fe537abb7c20fd16691ebf6a71333effd1099b178e403a0c549efc01e9058ed3cac1969a5f76bdf3e2d8d6bbc723076ad5960498b0bed657d4693bbfd7d
-
Filesize
5.2MB
MD53677d8f214c348f46453c8f2e22dc334
SHA1f86577e6ecc0dec5b19984ce226c34b150eeb39a
SHA25644f25e98042a36f990246644cb718eeee652d3e481fed0b36f1e641f3abb5efb
SHA5126214c775b1b73d3037bade9bd415214e81722b2837a2bdde7b4acc6379db80ffe5c3aa3821c361fba59883326de05a3de3d90074e2323f3081885b185494da82
-
Filesize
5.2MB
MD5b86f4d98350d1a6ec0d0a4a9a8eb7bcb
SHA1024c5208fd29291afed1e838cb9fb8323606a133
SHA2561dec4e4365568377dc9a194a7fea90a6e30d964736c858ec5d7d71248025b321
SHA51215e2734ee938450989165956ea9b2063665cfc74e358fe4598531abfff99645a6c7f13a0b0e4908e00175445acaccf74b1e474795796d21e39e3d67e7f8639b6
-
Filesize
5.2MB
MD5512387337770119fe9d3cb277495b719
SHA1c7cfe2cdafaca9ad3c12794de76066d0fb69383d
SHA25687e6095df1b28f3f11a169c709f32c13326e6f8b40298067a51623fe1072a352
SHA51240637de43f6955782c373e3204c7e16b481c741dec10eff54c3cd298026238a38595628354feb731a20cac3d3df745f8d95b50734737bf5dd59e368d239b2447
-
Filesize
5.2MB
MD5d22c54c46fe8f5e46556242649ebf296
SHA1e414bf257927d17c6e9e2a9aa85307cea2317f65
SHA256f8d34e56d3ea485ceb67646d1b0f69d4108a9eb1622f0ed3e622f91690970e5b
SHA5123c8f4a051b300844cc31204c700058a8f6ae87e559b860aa09945fb112252d81c13da05c8aca5cc77f92dc7ae3706fc5ce32086b57bba16014ea202e52a03401
-
Filesize
5.2MB
MD53cfa25526d0e5f6ac80cac4571d47e96
SHA1d4732f42b5590e8b2af2531e6a6cd439c2f14817
SHA256dbe3cf5bf4da0ca8ce024b5aa69a429334137ffa0af29fcea3e4060ea9548c08
SHA5123eb87a516efd726f02726fc621eb46c7eeb12d0121e846671815c1d03a0340249a314c2ccbb6dddd5c24ca32bae8a421869cf877da48b56fc383560170a6b540
-
Filesize
5.2MB
MD5dab5b1bc008e967d9fedd41833403491
SHA16089c8c93e5ed71219180a315283e86f184583e4
SHA256653ba3145b44b4ef808d455e80b027358417d0521fe5ba217c4251a2c6974912
SHA51292755d062853799de596ba68a3bbb8786f3debfa42f5b658e5d12955334611709e6fd0ecce0641ba1c6a88f887d0884b9703f5cb5b8acd12d559d6ad87a86319
-
Filesize
5.2MB
MD592eab969863b6e23c40c55717f5bef0b
SHA15e1db085b8c67cbc534b27c9735aa2c62d425f3c
SHA256130ab4750e81fd60ea80abc049b31cb10484f27232948a7c9a62a2a3c3c5a017
SHA512ce0ddf4862dd68f9c8c832809081340d66dc87932336555a429750ae58270214c2a2689b7f16b0f4141a1e55674681c3e3d95b923cd70593500e8869076b4258
-
Filesize
5.2MB
MD5ce40f3696cb61c3318e36252f92d1b4e
SHA1c1c157eca6221c0b34670f07845e49a9e93a8fc1
SHA256b0f49e7f506f425bd2513af24a3c4bc70a4f96cc033265b172a254e93e327576
SHA512608b48333459e4a8d922977716f11f12523e37b13e15775897a843234ca307122076ba8cb637f0186832eb3164d84af8e90fcbc4d793d7d6bb334f2fe388ab19
-
Filesize
5.2MB
MD582f8dc7127d05d730ffd08412472c2a8
SHA1e3a8a4514e3a22b0e5b3ba2dda1279ca5003a5d6
SHA25682cd836188d4a2dfce54de9e6d27c4e252272e84418bf92b3566579954b93959
SHA512149e5ef3433a4983a150de7ad21bc216ac53a0bef023f89a28e5942ade4702cfd30256bb2b236717c0ed53ceea122c351ee507c8472f76edaeae41e5992c571a
-
Filesize
5.2MB
MD54c10d920c238f5d0a831d6f86d4fb4c9
SHA11a855218315b717339a3587c5d2a3e068d0bf7da
SHA2565a2c5b3eec9631da29bed67bfbc1331c716821d4b863216ec250edd83a72bb6a
SHA512afacceaa00e75725af363641c36739940cf46e4bba558644b2a17b7bca659d9bacb41884d45ee2d8316f23d611d2366283794b8f75135487d737ae0d7f8967e5
-
Filesize
5.2MB
MD55121483a95a88af9ddef501cafc2bc2e
SHA15d1a4036111c1ac403f0c38773ba7f0249f9e9bf
SHA25621fe761bc909cef9dcb2fef23e0d2e1eb7f055a065d9eea707b880b14def1d38
SHA51274e0ca061d2db822e5971bd33e763f4dacb433b567e364713ff251f551ecaad41cc5670d2309e464e9910e390373e11b8c9a7a485d6e59d77a8457b8b3c06845
-
Filesize
5.2MB
MD53c223a4abb328db491d42d6e6ea31c85
SHA130c2b65f485313e18f8d345d4e3826eee4c1ec69
SHA256123f6639540dec5b716a866efbc7d9252a19051e77fdc345b538557ec25805c1
SHA512d025787f1d71c10b4358ebac6b66190a4d80154967285a0ddae3e3b8d6aeb13e00d13d95df73ce34dcb351f1404dce2b80227054c318a0e1bdf32d8fad49c20f
-
Filesize
5.2MB
MD5b294c542f6c2ff163b1f0ac1916e3d0e
SHA159964ef80940674f54e330043ab93d4750aeda4f
SHA2566912aa3696900387e13a506a7a30743b8962fc76d7e19b950098f9e05a438ee2
SHA512210fe0c91a2b14e4f82255305d0614de61b43c0eda299dbb1f44cd975d3a8df8ad3a3d973adbb5f2ea9def46d3ad646f8373a0b97595966f2fa8c1acde5e9ef1
-
Filesize
5.2MB
MD562be475e791d6d5f03e847637f8d8a0d
SHA12115b4e498b64142ad266b705748442b9e7ee02e
SHA2564cdb82c3239221e20cd0321eaf9ac5455e9c7e6a67836d5b80ed98f11c3a16dc
SHA512c7148db471db01d929204a966ac5bfd164bbacdd29804bea5f34bee0dc0afc9ac5e9c4082965bc29a22c941f5a3c06d5ccd9b0890b263e8eb25c1a6dd282118f
-
Filesize
5.2MB
MD52bb2e55669ce18af99cd9a5eb7a3d333
SHA19b266e7981c1aa473a1687568c7a2a9b8d5f80fd
SHA25603e83f1b08e3a09dfd1d54e8e0da4f1b32d54a2e9ed8b2c399e30d2160eaebf7
SHA5122b0eddf7ddf5f832d4db273a436ff9f40e68307b6f35390bbc8e0e6b4003270791750bbf31e6abd0ac01ba3f5ee25d805464aca3ebff0937e8e896e37c056e0b
-
Filesize
5.2MB
MD5161c124e9818a778a3619938bbb9c623
SHA1031ff498432437da1cd0c993054e2785a88402f0
SHA256774d4d74c9b97f26871dfda02d022e034f5c269155ca369b5990cc0f54f118a0
SHA512d69cf41a38d8c43c0b31a78dda417efa307e4ef3012d6b9fbb39eb0a72d70aae7161a67e6c24513900336d6150879ca0ecc6eda1ed2da7eeaccabfc9497d08eb
-
Filesize
5.2MB
MD5a1e78ce7343ae9f8b0e4cef3abde8ccc
SHA1f099f2007ca7c744415cc5f3cda8c3a559b0abe6
SHA256614bfe70ad519b2bda36c41451ddaa948171a789e94cf698cbd7a1dc9bb8684d
SHA5120dbdd82b967d9ab576e882e3331ab62b6eb4747a659f1d73dcd932addff90084e1ed7f2360fa2ca2fe19ebdf32aac4914a0bd2a548550e239971c34f4e75a87a
-
Filesize
5.2MB
MD58a1a87a7f2641ae8ba3cadf131c0399f
SHA1c47d9f43793be0269267747d0737057c8ac8b763
SHA25672ef7c590e9ec49dad241b7230947da23638187dffd30f47575e05799637a972
SHA51259ff5235fdef837d717de0c94c92f52c64878d009af0b558b82855a583592886603474d2cae2b2e6e66797ccfe5b5250896741cb27b4a7d7301615ec641ca17c
-
Filesize
5.2MB
MD575016d0391aabfbb638826bec978faee
SHA16a7ba3542ceb229521ca1482e1f9069fed3b620b
SHA25668b5d8c1b670e9aa3fe9c9e02048c97e31a81d3ee0d4b2174a622bcee1d3d67a
SHA5126a28ff41300323219cb1dd50f2c5b37ccccf8b4b5cce02c2aebd7e4714cdae1655da7256c8f6fe5c266406b2ac8dbd756328b6300157a1188c68b1a3295fe925
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB