Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 21:04
General
-
Target
2024-11-23_3963418b17686b038bd362da1c25404e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3963418b17686b038bd362da1c25404e
-
SHA1
daf964dfdaa1891078e91855f2f7eb2ab8e967dd
-
SHA256
8d19cc5138dfa504d97257de734325f78861394eadcb60307c095d2f2d79c514
-
SHA512
b92589bbb293fdf876403123d1f06fb732dc87d6e90001078d6a86a2a35237c3e82eff03cfef79b49b7e03964bcb8a15035bb896a33b4a5d04b8245d6cbe6921
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_3963418b17686b038bd362da1c25404e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_3963418b17686b038bd362da1c25404e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OcCvVez.exeC:\Windows\System\OcCvVez.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PpVcmUP.exeC:\Windows\System\PpVcmUP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WyZmQBn.exeC:\Windows\System\WyZmQBn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DCGKMot.exeC:\Windows\System\DCGKMot.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KIIcJjt.exeC:\Windows\System\KIIcJjt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUJaAUx.exeC:\Windows\System\xUJaAUx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FaeDCQC.exeC:\Windows\System\FaeDCQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tpOgeLu.exeC:\Windows\System\tpOgeLu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HCOnnJw.exeC:\Windows\System\HCOnnJw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UnRvAkR.exeC:\Windows\System\UnRvAkR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rgrGhCa.exeC:\Windows\System\rgrGhCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjRzHHW.exeC:\Windows\System\TjRzHHW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XThvvyA.exeC:\Windows\System\XThvvyA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oQcqWnH.exeC:\Windows\System\oQcqWnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fejnhQG.exeC:\Windows\System\fejnhQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jcVuSIV.exeC:\Windows\System\jcVuSIV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUYjoJl.exeC:\Windows\System\pUYjoJl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QJNCOle.exeC:\Windows\System\QJNCOle.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bMhsCkW.exeC:\Windows\System\bMhsCkW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IjkPDjE.exeC:\Windows\System\IjkPDjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oJvzLwj.exeC:\Windows\System\oJvzLwj.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5790a5ed5f7251d8b53342113bdae84fc
SHA10336dc1151188c3af2b891d60f8ef48c0e23f400
SHA256e22ed93a98f5b0749afa392cede2c3270c6037877dc7d02044e39bb1cb49a0c3
SHA512250a6d3c551ddcbeec3b8e617f0534171583e6fbafaf8ce6d4b512905152a3f252bbdafede5309aad29769e4eaecba0c379b4eb1224d5c1a29891a2613e96241
-
Filesize
5.2MB
MD5097b9ea0e2f822b11dfc7463eecf8f51
SHA1479f2f09b350455199357c975e2f0d2aed98fc31
SHA256c54e8dde8c2b277ac9f26dd346132f27a932fd47ea31339ba6e911cf0f130bfa
SHA51296c62820f16b32ccf12c5ceb99325f25bdf7dd29d469eaf0e92a99bd75ebab44af2c5bbc2fcfd6e694c005209f56ef80ae3894f0979af3bed90876e7af252d62
-
Filesize
5.2MB
MD51d3cffc7b191a2e9b190fc20f163c47e
SHA189c22abf162f0f6a69aeef9452cdc4fde2710849
SHA256458e06e452dbe847ef0efeb3d4f03d4a1b73cdc43235150811fb44d23df0cc78
SHA512f3f714d9abee0439fd951cf79dff9cf012a7ffe2c337410fa1da442fbab6b23380ab5dc5754ea1abc28bc7ea4d5c017e67a1bee1fd9eb519ef6ccae6d0bc1478
-
Filesize
5.2MB
MD5728b3e65e3a9b34f6032c49614feeb7a
SHA1721f26f80ab4968ae13915188047b863067934ac
SHA2566b86b5736f59e10208332c4da21bcc870732a5bad593d0b860f9c88c577d071f
SHA512a26892db53cfc35f66df3a876f2bba097cd2c42fd3a69fdc616ae509834ead7a24a1693699ab0a8f6aea45421998892551b89e12f862b27dd29ad8bfb376e89d
-
Filesize
5.2MB
MD5b49bb665b20f208ed702f55c8c02589f
SHA1b89bda0e30e8db87681b7651b8cc7fe5fef8fcac
SHA256926da0b6111413e4e66237c5db51d0a30f2b939962d37d4da0bb4077dac9f573
SHA512ac847b091b0f746248de422622b37c25ca5d7b290e8f502a1a6e9aa77c4c11ec0cf0be726e4d4984b86ff0dea863f2ea1fab37ce0c56c5f7d29b16f2dae51961
-
Filesize
5.2MB
MD55b89c31ad5cf757eb975ab7edd7cd010
SHA14323e858c7691a5ba7151338b764e7032fa72934
SHA2563d97ab68c0f969c2cd49eb1940ebcd52a7a505c371287c39a8bcc5431e649749
SHA512d0c6f680fe080ce27dd0e9b6908d154fa77ade277e17ebfd38cc73e157701162a050d4cace2703792c60fe7565975e08cd7389452faada87ae04e666dfa9fe35
-
Filesize
5.2MB
MD5967d035e9075ff78949e1e79db7bb4ea
SHA1e9bec1749526151f31109d8872d23bb2f920bf36
SHA256526e19a0f7d7bdb1dfbb17ac07446ae30085dde11adec20f0d679ccffa4b90a7
SHA512a070a77ed2464aba83d068f11c217faba0c4d371ecd9c3294a49c2f1e25c488d2acb676dc7fea423cb89f698c051c4165b93ba563fa7450bb967278ed1cd58e3
-
Filesize
5.2MB
MD5730b3ac0cf1c4b933d23b1db7c3eb880
SHA15da4a1d8947360bfb6bd879bbf19c5d297a50e1e
SHA256bd8df726b06f41a7babee47741c6d68409f2afd87f0e86206321a1840df3ba48
SHA512af956a5625432707deeb890a519e0d85440087584e9918abcddff1268105c6d4d06d9fb345c5a4a0003b934009a60b5a25fa5c551ac7033e40f432226ae210a9
-
Filesize
5.2MB
MD58a3abd0e915f4319e0850c3b82852575
SHA1c66e863cb83e297b59ea9cdd81849d44fb64c735
SHA256e83f52d1dbc2eaada3d11625a17edcf27de0c6691492b0e0fead69a5f3269f13
SHA51292c943ccf5e726c6428956f8dda50de039c25f5d888df6a0442e5e17f2d6d7b914d4a4ddcb0cb945ed70d5b534ba72d348511eb6486cda34242044c961af33ad
-
Filesize
5.2MB
MD5e1d74b87fa598f9550466a6081a959ec
SHA13b7ca12fd73db4ca086349116c8c70efaceb089a
SHA256abdcf236268c1cfc63c4da92fabf392b8fa4737dd52ff53ee6911d4c1ff6d637
SHA512996d9aa9e5b06bf38b79d9c14c81070fc9d6e7b694b912aded2fe426b23d800e7dd082ac560ed9ce01e3b127da324bc6429169453444f507c737394d79d74dc5
-
Filesize
5.2MB
MD59ed02899f736a593f73692f46b3d350d
SHA17465f01fe71615646f811942d845123020767219
SHA256f118e443b4f64cd0e79f10cdb25180f16c09901d15d358cde12df90ff4b82825
SHA5129b988989a96e1da15d7d94f0299db06a9186d1ae1899c255634d275a15defd47def773a53c56ef6fff09b851178fe277e1387379ba84cbb4fb67d2096d48c52f
-
Filesize
5.2MB
MD5e53da3c1de63323ae843ebe159b42eb6
SHA1c79e8e8c99a93d37791b34340d4acdafcc73b8e5
SHA2562369e8296eb9b1756cf6d23f0f62d3b7591ceb40684bb49d1634560431041f42
SHA512456bc3b7b927a36f3fac85ec24243cc1b08c9f2f6e1e7e55475bf704db39a827d8f29ad74b8e89e19f0e5d67ce252e4047e6b478f6c57cbdef88a0f245517a0f
-
Filesize
5.2MB
MD500a9d0d94d264e185c2e4f885eba344a
SHA11d9af11d4a103140959ef040a908140acee3f3e6
SHA256d4447a2f131276bb826ef13e9c246b5c86a7667b8cf6c6233b02805b454b600f
SHA51221164a84673fcc4239d278bec26488efefb86fa89a8d9d72c769c0d1a698816c082da59e3fea22751889a350b399e670f3e201f294a530e2ab98f3de021e3257
-
Filesize
5.2MB
MD5f13746ae1bbaac6fe5304d1b186b8561
SHA12b0025b058eddabc63b90b6aa7221fccb4324c01
SHA2568ca841ba49de869ab25ec4f12f4d7e2ed8eee464e7fa2a44cd0a555dfa801e36
SHA5120ffb9d6badf3399a7127160e9558079684facc98bbeacc538a46dc33e16663331ca4cf8ff7e23b8570598d2c900c5787fc9dcad37936ad122f610ed38d06b554
-
Filesize
5.2MB
MD5c50e409124de1c61c75fd27f47d57373
SHA1be22b3b5f3e9f33534d1ee3666fa6c9e533218d2
SHA25682658e06465fb379d79e3491763e0d478556ca79c8aaca15b17b8edbf400f625
SHA512e94dd30c4e192d569544ae7e51e5066d6b867bf61bb9fa1f68a994405f064930855767b81b57e807ad4979745d5652de6ac476c33cf3f820e1d8b6ecdf5d70b7
-
Filesize
5.2MB
MD558bb89d97e69b7a38b7d8896496a942d
SHA1c827c2601a1e47f8a5d97867640f3323e4aff15e
SHA256eadb017830952097edda3f6a619bda382b7a4c198e2b8b04ccf72d97f5c55b1e
SHA512f478098f1e23f6e34d06cdd87f8ae5c40f3440b0dc20fe61722eaba1af5cb80d5380566f8ebf8f229f5eff92160748cb26f2b681be89520b7eb9fc7300aba294
-
Filesize
5.2MB
MD5a3876ea199ca545638cf8f307284a5d3
SHA103655ae06c4570937ce63a02c920671a463c96a7
SHA256616fb5f0a64717515dde8b2cda8e465b4cbcd5bdc202128a62e687864ad1e9e2
SHA512f0326f31f38728042c7705f72301a2b78ccb3217baef9f507b759090e86207751e421543974e0e4fd503656a7ecceafabe299fc19c3b8e4fcf35452872290f3f
-
Filesize
5.2MB
MD5091715da7e6235bdc04398998e923e7a
SHA174553c72b1bb9026f389e010359e343290f9b18e
SHA256dfe8c64f16a2e902e3d433a3f72a4b1ade3f95106c292e03d7f6bdcfd4f7230a
SHA5126e35cd778ecf6b61ffbd77231ba73c68f7570f77379f2efeef1977a3e046f4ae76ce3ccda18eb3d46f27859a98f8ab045bc742ec46249555725d8ab308e13558
-
Filesize
5.2MB
MD5b878b0fd2d79858c6aa6904bb7060572
SHA124beda53fc45fb17cc6a3b71bab50deaef2be99e
SHA2563227612c4cdc536a4fb7fb4a785f41171228ef17c47e7d78732de365080a6506
SHA51294ac51e249a072a1dc176bd8314968f9f080c323ee40bca1ebee5f8e99c5ff51db90989d828cde097caefdce45727fa91db13bdcd97025bfb2482f007e2f1285
-
Filesize
5.2MB
MD5c000b1b7e0f0cd6066a2fac18d989879
SHA161480dfb2843e50f974d32667c567c6695a0b158
SHA25680251f6fc5c0ceb824c38ee3be84a45a8a179ec3782e9457da957123e2a97904
SHA512be4464e53031eaf683449aa4f657a69f5cf6800bd104cdaf9d79b016988709cedc9773858233423aa17c351fe700df295c7858286c02b06918c37f59a2ce77bf
-
Filesize
5.2MB
MD525ac6f7f418d36f984cf4abb5d878d36
SHA1443379a7f9432571418e101609a16c38ca15a77b
SHA25643dc3be557d5698f5e93821a13faa8dd3a7330cf7c2dda2df69447492440610a
SHA51212a823e2eca7c617b621e59d6a53bfc5a76dbcc4f1c525bf1690a116dcbd51c6b077031f011c9ba433b1d043663ea9de74b546e9e4dd950cc9c561a8aa0787ab
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB