Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 21:02
General
-
Target
2024-11-23_0f5d8fe67d8a3ac31d04a6246b4c79c2_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
0f5d8fe67d8a3ac31d04a6246b4c79c2
-
SHA1
71f963ca01ec9845d54713ac4370bc902fcedc5a
-
SHA256
05386e91ae5dc3b13b7c5e82183bc7c7f829b627eaf6f8cf1eaa5d3a2f9031a2
-
SHA512
9c7281091bb6b8d57faf7014cbd86b6d3ad592bd97bef6910ec39a720b96bfcacbbc71b3952bfe5a153067cbc8adb97e6734ac745eb765aa7e2abf95e84b6086
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUW
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_0f5d8fe67d8a3ac31d04a6246b4c79c2_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_0f5d8fe67d8a3ac31d04a6246b4c79c2_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kHhBtXj.exeC:\Windows\System\kHhBtXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtPDTQF.exeC:\Windows\System\RtPDTQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FhLwdew.exeC:\Windows\System\FhLwdew.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xzRBpSQ.exeC:\Windows\System\xzRBpSQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mRKWGbi.exeC:\Windows\System\mRKWGbi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cZWPWmt.exeC:\Windows\System\cZWPWmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HAwQOwE.exeC:\Windows\System\HAwQOwE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\geqjqzS.exeC:\Windows\System\geqjqzS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\emprhRp.exeC:\Windows\System\emprhRp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aOlFniM.exeC:\Windows\System\aOlFniM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TEMxqHm.exeC:\Windows\System\TEMxqHm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOiFNNr.exeC:\Windows\System\QOiFNNr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IsmYYig.exeC:\Windows\System\IsmYYig.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pqVtitk.exeC:\Windows\System\pqVtitk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uFYnAFz.exeC:\Windows\System\uFYnAFz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fSBFtIU.exeC:\Windows\System\fSBFtIU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IgLBqPq.exeC:\Windows\System\IgLBqPq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wAzMInK.exeC:\Windows\System\wAzMInK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\greamwy.exeC:\Windows\System\greamwy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqvluwL.exeC:\Windows\System\hqvluwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qeIBwqi.exeC:\Windows\System\qeIBwqi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59ccf242703c196671c423f2e9239028f
SHA1d18e763014cd5918ec3c805d431cfc5cc273acac
SHA256a64fa9e12679c0f4e8658f77389c87b4756e809e2838168ee853c295295d1404
SHA512c80806956ef9bae60a7ecec58fb6b3ce73689422a0c9504afd14b190af54296b78776f464b3a1ed0116baa4122ef565b83997ca3677120552d4a87ee0daf3949
-
Filesize
5.2MB
MD5154ba75dcf64bdf463d52a85a292c310
SHA15dce2e747d673eb383193f2091c934bcea8f81ac
SHA2566867c41300b26e5a2bff653595838b0c938261778ad05adb2d2c1cbea5c74bb0
SHA512d672a25942f61df625acf8f87f94e536c7eebfb899b0f029c64b6af04b12688e77d4aafb56fa3142731ef2ba00ee59b223b206ef4ef6ce57d59d7b1a381ae3a8
-
Filesize
5.2MB
MD56071287e5701e8ab0b84491797805ff4
SHA1281ec85eac80c0b9a854fc4a1c9063049b6e14e9
SHA256edb279eba2bc46da68831e442e07a4de46bb614a28f50165ef5da443684d75e6
SHA51283dd603021a6df8db27c8ec027e957eae3798d0a1f2446493513068c31796634663d93c301c252276483bf2e261966b4395a68e46c15aed2f248521597f14d95
-
Filesize
5.2MB
MD572ff1dc182a771e26ccb2a22de46bbbf
SHA19c31122da8c0426b5cd518950a0d5b38aef0ed64
SHA256b008d236c5f78b1c70b1a3657c9761813b1116b2fa749b889b132abd052a4ffc
SHA5127017b192dcfcac7d9db92feddaab57c273849f1e1da15a070292971ff1543c00c22813b43413ddb97c72fbecd5f05fb55555cff0d9b07da01c912332ca64acf3
-
Filesize
5.2MB
MD53ac463354e5a1caad38975fad161b419
SHA1aa1389a704dcea9fb0662c5688e99d956d57b232
SHA256fbbe8c472baf58817871bc2d742e10326df52ace17593fcf2965b2f08e77a5eb
SHA5120ae511890a7d53c407abef7ee7ececdfb8b566dc1e0b87e6af28d0d8c45f3d5e14ceb76d268f569649d8ad520db5bcdb28397c1de1267572f63be97553b71ee4
-
Filesize
5.2MB
MD54f4d94563d80eeedc221b190423d87e4
SHA1ece8b1d0cffc84dd8dabf5f6b595ad15f5bc424d
SHA25635254a1ae1d58f4842b088327aadd6aebccf422ee969128e2a140b3c8fa84beb
SHA512136c4e20020a62e66ac2265113a7a3faa7fa2fd5905f2909247256f1b72f558b810324038a0b7ee69f4cbb1b8b90214c07f8f03c7b90321215fd2e81686cf7a0
-
Filesize
5.2MB
MD5ef74696d5058db2e18fd520120bfc6d2
SHA1df8ccc47ad922450caa19cea2c74330ae8bb02a6
SHA2566b84060caff8298682d54f00f9c19afbcce7bf9ee8a7a2e0799c576d5adc7d83
SHA512a38a5950dde461507b414d46c708a53d68218676918ede09f1b68dcff2cc5fa7070ec92399a63eff31925d501bdd3593b2d2d34ea4819a2ef21d724f0fa60973
-
Filesize
5.2MB
MD516aefc140101768d0907422b2cd3b21a
SHA1031a63c464b1aebbe15d921c2d92b91190868d92
SHA2569aac0507edaa07ed9a8813c3bf73d01960e71fd2252adf1cf28332bac493e246
SHA5121a8604b0b5a13cfa736d1ad03ad91310f6603c788af8ce4aa77910bdffe5eaeeeabfdda2386bd19a472a0763a5601b60aa5ea21d636eadb582807b453a1dcaf6
-
Filesize
5.2MB
MD519f7b2b8cc0d31867438fda1bd42ad48
SHA1f5a047af698114a4bb422e17397ad57469080dc0
SHA2562df6d7fc0f1a75161a23523b6a9ff2a99122a88d253ca65189d130f611101014
SHA512cc82bf1435f2a718d276e20e56e61268420dae3d593ebc8dff06f94a93fc425e9d3459ab1f678a990308c2f8ef003e8b22c5dde115f40c72aebc5e095f76f2d9
-
Filesize
5.2MB
MD503ee8f230d16089f09bf551b3e935112
SHA1e6caddeaccdbc096e621ed4e0fd216b8f10223b5
SHA25673ffc55ebd64a6aa5389072028ef89d3e6f0fc6a78c4d39354936f36e8dbdee9
SHA5122c841072a720f17a7032532b94e4cd1161ba1c3a54b26b1878913ab9684f665870246317d853de788d964bb0091140b27eb268a27ac223dd6f8a797ca8caee24
-
Filesize
5.2MB
MD5931c3d34fb4fc960863b6f7a1547709f
SHA19ba53cfec39ff187f679a586b0bcb17e866b7196
SHA25641a0fb986586b461511e0ae93c674145708d477df60a0ba568b99f5ad464ba33
SHA512ff2424c63c8c190df00f1f6f4b0d1fedbba476b0b506269d7087ba708ae3f3dd4ca101a44b5e587ba723b1f80a3ace387e7fad17d8a433bd29a9799eebaa8bed
-
Filesize
5.2MB
MD5f9d8fdd36890c909efa2e9ef76e56a09
SHA1f10899703a1bf821995e742ee678831352fcec82
SHA256c2be95a9d5991b626c773026e774d7b069e6acf43adc80104beebc7195c613ea
SHA512e875a3ac1ba11a0a53259a456a4a5aaf2e7635838793473207d8867aa2fd46174708a7d31057c6365a27125724a936eed425257c82a248ef970a278e32ddd810
-
Filesize
5.2MB
MD57baa93584e93fdbbdb66c8dbf5abcbc6
SHA1512f063d512efa67d9b0fc11b6a398b496791c42
SHA256dc92475cbeb3de3b9f4d97306ffcd972fdf5a38325b758502531f842dae6ec2a
SHA512d409a0eff70d515f127fb7d6b79f9e370b75b698bab158a453b3b511b351b011936579708b132f61373ec292ed849ccab3cc6615d85b9d7204ddb6f31fbc90eb
-
Filesize
5.2MB
MD5d15138a3342b3a42311030b1c57d06d2
SHA150248043032dec363c269ac5a24ea8cfda9d79fc
SHA2568926433ad44de78bdec588d7ac53a3fd4d41066d4d6ac559da0773c1e677aea8
SHA512902117ed347e057a45b6f9c7ec25317a175a490cab9ac927dc794440423ff73d3dfbe76775717c47839e7aeee979d8d9c30a44a3fb791ed168a2844fc0109097
-
Filesize
5.2MB
MD5b096f80e7ccc1380157ad2b01f7a633e
SHA1fd0449135031e0db0e47045c09ce7610f3fb84cb
SHA256a25e91fd075f953b5a7bc16298986ae6a4f8c7acdba913d18b197016a18ae947
SHA512eabcd1f1fb18da66e739a18158673b42b1df5f3ed40d6e281ccf8aab84cf82c3c5bf982d8b48dbb37225b4916672df8f5e6529ce9adfa98e4e2152b81dd77885
-
Filesize
5.2MB
MD50bf549c5e4d94d1f5ea478f24e30555f
SHA1220cd64fe0b0e9aa6cb06499355477230b78920a
SHA25652bd7580d936e9580abc27f6053bcd5fdf1949bd8a871a2db43c516fb1114f76
SHA5122aaccaf1e79be663236492f26b985698aac1f786e2d8a9d17593c9263792f205372e50465cd5df702ef13ba55632000f142604e9019bb16d5a2997dab0c1b505
-
Filesize
5.2MB
MD5eb16476d8a2fa0f3266aee06c6967efe
SHA14e7355660fde53bbe7b64e5474a4a6f6d739fc0b
SHA2565c3955ee9ac3483dc1441c01496d33ea12b12b94acbd9b90b2200f06e71c4733
SHA5123196bf1ba001409ff5979f1e39896fd544fbd9a6752b5d41fc2555b5e7c8bd3dceceb7f7950511a1171eeecef835455b3bad365d9579cfe6fdce9812d6ba2248
-
Filesize
5.2MB
MD5c596b751723eaee5f22c6f724a5c4726
SHA1c90d6800752b43970afb1b9f03e6e4f0fc39d295
SHA256e3e8c0ab3d9d3ef65e8a6a03c104da764da24ca7a480caa09e81b563f095958f
SHA512c3cbe198f8d9d08c2b6a1c217472fcab2934f92f4015722b65a95136b56b7ed38c5cc3b8acbf3754ca134bcd1279af015198ba78cb7a9890c9e7c91770d54bf3
-
Filesize
5.2MB
MD58ecff2b17abd5dd6e755475c7d93cca4
SHA18a50b59e92b778f42a80d1ee9d3438a71862ca5e
SHA2569e89f017dd9fbfea7325f64c029478474aeac3cebd72c604b2b757b04e9a5b94
SHA51218114d4e6f4f855927fa626002edf19c59a9b6be349e2452a607198dccafaf2f533c76516b89551b454780679e666423930452869925bb845c0057f64ec56984
-
Filesize
5.2MB
MD5179fd8f005a75422b7323ae55498ea01
SHA187e2ddb09002b08da4d8bf41da43602067383d25
SHA256ae15e57dbdc3d794b113d4689cb4ff72d3c32f9f1c514cd95d0ad69b449bb07e
SHA512ecdf541b6440c1b58e4627bee0b7f1951cca501e3226e0ab7ea91cd03674a3d1014ff0a8653242f9ea9c374fe8ed47e98b470ee9cc9f7ee46cfabfb732be608d
-
Filesize
5.2MB
MD540c72c7fff76672b12d86c5ac48bcea9
SHA16bab2a6f9b376d5420a0faa664677e2ce2bd6be4
SHA25672d7898b2aa75d42c25e983d601937dadbf89ffd2e05a3f18b8d8d116fcc0fcc
SHA5129c217e37740732ce2e922e4953fe221db6289c0986980dbac740e118957f1ca7f1edb23e8df80f4798e00d5299a00fea0bbc2fee9abc94de9108bbac9b616dbc
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB