Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 21:02
General
-
Target
2024-11-23_0b864522fe966aad17b7a546890ea81d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0b864522fe966aad17b7a546890ea81d
-
SHA1
34927353ba74a395bd1abe4ea550ac5d657e7509
-
SHA256
38579e96b9da1e8f344c3b79f20b8ba1a2d6b41aded8520b06654ca173c185e2
-
SHA512
cff229573924ef93a7626bdc4450d6662a7c65d97120446913b36a9d49e61ed7c6796de4b9e4e0cf80b82a8e63a88f007891e72582ee760e5d676f274d39bf7a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lU4
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_0b864522fe966aad17b7a546890ea81d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_0b864522fe966aad17b7a546890ea81d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\WSodnhz.exeC:\Windows\System\WSodnhz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbmhCcg.exeC:\Windows\System\mbmhCcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piQgprj.exeC:\Windows\System\piQgprj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhJBZmI.exeC:\Windows\System\nhJBZmI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VoexUbL.exeC:\Windows\System\VoexUbL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLARVKK.exeC:\Windows\System\jLARVKK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuiNrPh.exeC:\Windows\System\BuiNrPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DZBunYj.exeC:\Windows\System\DZBunYj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBkiBGr.exeC:\Windows\System\EBkiBGr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oROTlQh.exeC:\Windows\System\oROTlQh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kOuVajx.exeC:\Windows\System\kOuVajx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\njFPSPF.exeC:\Windows\System\njFPSPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rVXxDDw.exeC:\Windows\System\rVXxDDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjGQpGY.exeC:\Windows\System\fjGQpGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rFaIyji.exeC:\Windows\System\rFaIyji.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGCecjV.exeC:\Windows\System\hGCecjV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvcnggJ.exeC:\Windows\System\GvcnggJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BkKOpwK.exeC:\Windows\System\BkKOpwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZgyOzIb.exeC:\Windows\System\ZgyOzIb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nbvKbCm.exeC:\Windows\System\nbvKbCm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IlNGscS.exeC:\Windows\System\IlNGscS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5ec646ab1e6b2fbde9a3f7e4ac1e39b0b
SHA146f537cd4d1359f4c4fedb79244b63a0b87e6d95
SHA2564210da4b214879ece8353a5857f90474a6b0844724c0900b7f4615cab600ad46
SHA512abe488b5dfeaf1ff9b0830a8de09c50c5303593a3bd270ed65d7a28044fb3a10c711386ca9b8275873506e5892f7f33f79d199f4b6729b323b7656d665e94f52
-
Filesize
5.2MB
MD562ec025d3a2203636a0539940c2da405
SHA1d19ec79779330590eca32fa2cb36d237abdc8922
SHA256519e2c3a99f15ee81706973a0b1913357e56b6a68cd21bd9a7e7cf95cd72538a
SHA512f34781306ec2c7a99e4a265686117163f181e34ca85c0bd1435a1b91de722529bcc07fbc048a3d1b17153d67fe59b6d64c58ddbb9e270e1a93214a7b70fbae97
-
Filesize
5.2MB
MD5ea5042d6983bcb1b66d4522d8d8265c8
SHA14f228b10eb317609df110e08b2aedf40bf7f3c34
SHA25647f92985725c594caad817df76232292802eafda792fd982d04c96bb5c3f2dfc
SHA5124d2022d909b2ed1519aa639ae7cbc7081c79c530c2c2ac7d0a3f37cbc349069ab7fa6301af6a4bf377c6298dbff69ce6744f0305cc10ccfd25f067250aa030b5
-
Filesize
5.2MB
MD588432ff3b214607ca4073b0cd780f222
SHA162ef4313eb3f63155bb12a2e50beaf89d6871822
SHA25645941bf3bcae417f060ffbf32c14008ff8336019ff470fc7b6515ed3c31ddc34
SHA512cb5864aa8b18520f0f86891e5744b34bb7b159007fe2af916094bd1d7fff19e7bc3e90528dba6164e0595a189f640a36aa405c7c56818ed755abe145592df0e8
-
Filesize
5.2MB
MD5896174705851cbf88560a301aa41d359
SHA1a9063d10035193ab7beb9053a3fc0af8b0974307
SHA2562be7c0d1e584f26a6adcc118ae6e8a619c4c5ac96e6c0f265b52aaeb1727456f
SHA5126e31a69ff065a72d730d79c25c161ddd89a2e25a47917956248d69e2360933e0c32e81ece8ac1293fdf921c52877eb0626eb00807b37cbce64dbd9381bec56d1
-
Filesize
5.2MB
MD5b4e01b64ddc2938e18d0963983322194
SHA18962ca8eb400baa5de8a7ba4bcd20ab7cbca3f19
SHA25665bc19b640477ba2782281d64e9efe68a1aabaadd768e257f93b219132122f1d
SHA51274c5c6e47cce4c348dcef2203745051c699154bc33f5e134cd3a846f498d696f74a6e1a00d687e4463ae8270eb4812358a7857e1f86b2eb9e45de0c8f113e7db
-
Filesize
5.2MB
MD5265e7c7e67d1f596584e45acc2a9b3f4
SHA13b8e6e0a6d7230c4bceb8c19197ea257ad097537
SHA2562d7dd192635d67995ba97f19ba9755d819beb8eb096d37a3a080354cb42c6b35
SHA5125668f10e041d7d58d1693ae10bdc370fa2604fc6b84e42061ab19b596cea029ccbd9515a6848ca0983dbf0622ee0f89105ed99bf0582b427f9bfed824e39faa1
-
Filesize
5.2MB
MD53dfec100867c89e9a34ef70721da540d
SHA1b0a1553b964f2d65da8d6e758a958e61b3634b7e
SHA2562afa2e0763fd5947870db1d3043e59f96d49f02f3a423e5f0ce1d4dc458dc665
SHA5129952c6721fc15641d856b0ec14d142ebcbcdce73e7636660b68d85ba9743e9f61eb1c351b4db6e1ae6b08f67f7362bdef6bfea30cef8b4ba9216886d47c372e0
-
Filesize
5.2MB
MD5bd908bf7fa111faf981c71fc61065e27
SHA19b92d30738cfd2bc7e5ca5ddaa51f7ee1b26ca4d
SHA25623eecbabfc5aefbafa07ad98889cb3c3bb5240d89e6b35b881a2b880049d1be1
SHA512b90bf8c302a1f7f358f26fd67abf19a158403c3da913bb33f127cf32faaf67609225c446baaa2371f0c45886c7a490ffb85d68b7199e7d3e830d2b6b32874aa2
-
Filesize
5.2MB
MD52797abbeb318e62a393fa824f03df3e9
SHA1158608f2d1b5518ae0039e8be0d188f8a4499a41
SHA256a6557fddd64444e0c597fb1bbb90dba6a3e315d59f05299f21f9207e80200def
SHA5125778e4e29873516bd54b99e51462749d683ab0016acb9b19dbdecf76f68a07d6ba930c0655463ef9ed4ed0db4eb5a72bf7283529d2ab035cf770cccef67bbd8e
-
Filesize
5.2MB
MD57d8f5cf6e36076c73ecee993482098ce
SHA1b63fa8ab73431b4f88b4ac9de2d0b1d7cddf4e89
SHA2563d17b274a7a1263ddbd5e615228242c835d126639ed503e677b35a8e95dc9611
SHA5120d62474b64171f5d31c5c6691fd1dc6a19cd06ed208224e8f5802a11175e407bd4fccba3a6eb4285b50088bc87b93ff5f7e4a3d4ef9fd4a30da52655d2c4d0df
-
Filesize
5.2MB
MD58996df94f6972840037457ccef54466c
SHA1983123990225aa3849c4a77dba86e8b9509ead28
SHA25610fa21650182ba1e415a9ce6b9ab0c9e2319aba19735b7e98741ebd8b8fb997b
SHA51253332e5d596846870ec1913945ffc5102435f739a1dd39cb2e3bd4349492eacd3c6c1c58c5e9b9c2ab05ec91bf6558d4bec63928ee8eb2ce8379a6028522ffd2
-
Filesize
5.2MB
MD5f24a1a74f29c0adca99b9073f3fb9ebb
SHA1585738f8e57c88f9286ba1217223a8d779dd5571
SHA256d7d6a8c59605a25297a8cb797af8adc1123340877f2451af14748e5e7644c15d
SHA512434e5b1933e0755ecee2c3fb71b5cdfd7b2fc4dac70c625f58bed022578c806dea57f0de8573ec0b6f77ee38aba0e25acee3e25c9e2297bdbc76aaddc93bed81
-
Filesize
5.2MB
MD563dd80f50f7341ae399a0de20ff01981
SHA14468fcb2abaedfa776705ed2e2a78cc7cbaaf830
SHA256e0f81357f6b62e5c79aa65cab4559498b7fc4268c4e95631d02cc19594d773bf
SHA512a288b93c9dac4478fc37968bc771218b86d29bf6c1959854ecbc23ca53aa68fa930bdc6ec7d7dfada1f97e472ad76e421c8820e45d14f859fd56583db9a99b02
-
Filesize
5.2MB
MD5a8d6fce7bf6271e258f19907c3f7010d
SHA14c79de8d925951b3f9f365e4f8bf61e84f462ab0
SHA2565bce6f72b7f255b228b38129d8ad202f30dbbd58e9da7b236febe434219e079d
SHA512c05b8c0baa1628f63c4ed9a5b08d6c19de130d547f69e3d96e8d789180c62dbabcbcbcca1527c8d463d59bc848414dd4453e10523e1fa027f9ca6d0497cfe6a8
-
Filesize
5.2MB
MD5484aea9eb41b9a7c1f9855eefaab9ff2
SHA19a8c152f24561c161ca7dddcc414fc70d9406433
SHA256211b7e5969949dfb36eaf87d3b07976a658c088533d965bbb72742ed2025f9c3
SHA512b81b281d381e2a178a35e967ce25119bafa058e3df3d17affa90b98678c266301035ddc604ee0e94599a2361631537a658bf498463f14c82a7a66a862a60d103
-
Filesize
5.2MB
MD5f72019152b97ded414c4eb6f8dcd4894
SHA1491bfa1b30b290df758236cf784ba511e123b43f
SHA256b5d47281bb8d056c69e815d94d543d347ae96b01df29b077f30896c14e378618
SHA51261268628127fa33896559ee91de2af8d80a62a88001e5c6f76cc3f0c18e747738d32e0ac43eda2fdad43917be88414d22b0e5cc16af8b0c07ba38e4746a70acf
-
Filesize
5.2MB
MD50929ffca84d7ddf59db018b1bdd95e13
SHA12502099a49a5e33edf2221015c7a8af1b9e0208c
SHA2568ab0f1e7111599da0b8761764352163a19ba68f195fc16a18e1d819eafdefb37
SHA512a94725c5d08d57b06f651901de948a23bc491b254965a100e7e9e366f8de7b08c9951bde45e11c14bd4be209b7acf333f4b37f816124b6b2f9ffeaa599799860
-
Filesize
5.2MB
MD55f8b0767cfb70d8c8e3d8021b366b850
SHA1bae3782a1f9c2f1dd97d3cd95e9b56e1fc81b073
SHA25606dd96f0aeb3173b59cf1c4943bfe8e37cb9ee7c919f80ae61e0a4ec08c88cbb
SHA5127fe40b15b567d12a75e267a6682de330ffd5becc8f05705a4c8b8c91d0befcfdfa78284102475a614d14c7baaa449c8eb81d24353e52a772708a0566cfe70db5
-
Filesize
5.2MB
MD535a313d3a62e172f4ca0f85693541775
SHA15bbdfdf92900520d9174a5187f597ff9dfef7156
SHA256d10ec1f25b4690e3bbe278c74dad8022cc4e2b74f61dfb1db5d8e23e1d68c811
SHA5125a7afbc80d1a0e907b7fd98ff78e1311a250d9c14bbcab417f6e94cf9374f3e3561cbe1d48efca62d1c5a788925b1e710503dece73ca4c05f37b1b89bc14ec7a
-
Filesize
5.2MB
MD5f61a08976190b5a22d1cb38354235f1f
SHA17cc0217d6cc3bd63567b5cf5626dafba0b0a92ec
SHA256ac3805b2521fc3d1aa5941fb2315e84a51fe12fb5028291f85eea56cd8888d62
SHA5122a01e7772030a79f3945d01b4da6c4e7187fa1df62419c5793c9d82750caedc667b3b6ade05e5737407fd883ed86d5c0dfd213e68a62016cd832fba5211175c4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB