Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 21:05
General
-
Target
2024-11-23_b7e1714ec7fbbc72672716a1e63f7e6e_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b7e1714ec7fbbc72672716a1e63f7e6e
-
SHA1
2b81fb1a8acb9bc2dd157c39d045b349c4d17cb6
-
SHA256
93bde989d9ecc1f99eec668819aeac5b97cafa12b1bfd5098d68e03f0df0b0f1
-
SHA512
15577d4aa7e9014c8912da8d8990cd1d410e2488cbfdb98d215e1528d70d7cfb228dd7bcc461c0ee6f85cbdb5dad71bf30d3613884d16fe226abe16ee9c3fee9
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUa
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-23_b7e1714ec7fbbc72672716a1e63f7e6e_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-23_b7e1714ec7fbbc72672716a1e63f7e6e_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ZaEOCtl.exeC:\Windows\System\ZaEOCtl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\enGaboa.exeC:\Windows\System\enGaboa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tVgbuqa.exeC:\Windows\System\tVgbuqa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ijwscbx.exeC:\Windows\System\ijwscbx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vpDjJaj.exeC:\Windows\System\vpDjJaj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OmqSnTK.exeC:\Windows\System\OmqSnTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qakZIxH.exeC:\Windows\System\qakZIxH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssSLEhI.exeC:\Windows\System\ssSLEhI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ouoDTxA.exeC:\Windows\System\ouoDTxA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Sqzrsjz.exeC:\Windows\System\Sqzrsjz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lDfePTG.exeC:\Windows\System\lDfePTG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yxKchII.exeC:\Windows\System\yxKchII.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iSxnbZA.exeC:\Windows\System\iSxnbZA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRmjaQG.exeC:\Windows\System\CRmjaQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQiqGKb.exeC:\Windows\System\wQiqGKb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iuyhrZS.exeC:\Windows\System\iuyhrZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YnOsVQo.exeC:\Windows\System\YnOsVQo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhAPGGa.exeC:\Windows\System\hhAPGGa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tZWgILZ.exeC:\Windows\System\tZWgILZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PJAXNmd.exeC:\Windows\System\PJAXNmd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\watuSqd.exeC:\Windows\System\watuSqd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5d366b5b13ebfd725e05cb4731367d07b
SHA1595e513f0496d6f70bb07016d44400dcaca69a36
SHA2560bc533699bc016394777b74ededac722b344fda20596e6c48b0dca6bbd9f98b8
SHA5125e8838f2f31f660b4ea9192e670d5038ef456a5b9e9ff155fd81dbb9bcabca552383075091a33a0a2ae7603155d9c6c44f3bcad845f90548048e345be3423af2
-
Filesize
5.2MB
MD588ecf053aec77a9d8d13794738672bde
SHA121a88742d3e7126b2effa0b7ec2b57cc88f66a97
SHA2562552f382de55da3926a32632b5bba13a23f05ce96fe88ab58b5834be278d733d
SHA512ad16c6867b82e43e2067fb6ec78255f8607040deea36b6e21f358063021d929ccbdf4556b548b11d991098a571ff2aef3e9c2c41b6f22f3658e6e462637d339b
-
Filesize
5.2MB
MD506a2503cc83533b2a0c63d219e7361f5
SHA1251eb4a1fe360f9648e344fdfa1c7c9698481f14
SHA256b83c488125b7aa612ec77ab645a6781dd5a4615963ddec42ff8f9424ae2d9869
SHA512b0ea352e97b35b0db08793abc5ee3da1b266aa68b38592132f2588faeec6b0e3daf195b2ef89c634ac743dd5ed522b567fe12f2018dfcf96837d631b462b04a7
-
Filesize
5.2MB
MD51ab05cfb96f496fd37eae990df1572cb
SHA1903f80c07deb4a3f54e9ecd014470fe5e04f3fa5
SHA256d63f0a4bbdd7dea104285a18b83ca05b9cd8bc1a9849aaef0e14c6306f6f2221
SHA51258d16f242e07ee78a7b76fa3c8a5c742d2064fc42a683fcddd22afb2fa78ad52d65b0cac8c96cb53543cabd36a7b9fa9d159f9b935d4e29332b7f6a944ee739b
-
Filesize
5.2MB
MD59d8a5b6b433a316054f447a40da34d2d
SHA1203dcc493c7419699910f7c431def191b65c7a2a
SHA25636dc41e0362d91ea7fb321b5e95653469d057945fc184d98afe008dff254c5cf
SHA512166c85f0788e8b60450e8c38db9db2bb5c1c12bda87ae7c774182e3c6c8cdbbb72c53a858d42c455325fd5499ec17c32408e21eebea1c828dc8eb5afd973d28d
-
Filesize
5.2MB
MD57ad3316ebd8f62c140b2aa12ce750f13
SHA13114ff4fd23130248ffdbbdf0d14c5bdbb968aeb
SHA256f2b616deb80b0dce5157c4cc20a98fbf41edb241e416c09f0abac6ce3584d5f0
SHA512a5ae91e4c13d4901ac9bcf872d33beaabbcd5589ab9043116ac7de311bc283b7b5747aad586d975b9acd0825c52eec8a4dc4bfc49ae0e2814adde14594736676
-
Filesize
5.2MB
MD5bfd1544e585b7c6d577bc79fe9702c4d
SHA1a7eaa6fd24dba46ffc33c9fdf2adad2fc668e269
SHA25680b9bde763067824018f770527e5e2728e93e38ebe9b651906a88035ffa373ca
SHA51238bb82c2e73bef8a2612f121b0071b1d55b34be03a702d2746e4154a1e20a51c11f2ff344565ad62973f91d9af221a9d2a9fad39504601d82cc2af72c08cd329
-
Filesize
5.2MB
MD5b2a4b397e40a204ebd7d3e39d80232c6
SHA1fe25eb10c4c8ab191d452c1d41a0d6776eb5b62c
SHA256d6e9d78975b5e65c9b711d5a17c2057cd21b48f3388bd6b1861e8fcf346e43f0
SHA512440b2441f4dc7cf08a777d0e28f94f53e479d8938ff33fae2b269b02d67828d11aca829c8a51bc57ce2073d43bfadefcf01dd285a53eac25a0fc865c81c7eaba
-
Filesize
5.2MB
MD5359e4dfaedc41b2b88b7216d446632f6
SHA1219eb1466f777462d84012a694b77902c2ce0b8e
SHA25617939aefea8bce9b9e121df197a9f02c32e347d991268d926b9f0d944ae98bb6
SHA512337768b930b21387549704c4dc5af86320aaa6f56582d8ee41777340dec1ac5198a236b7cf38b3a35d64dd52bb524c8a2a99de803c2ad795b06206994b10dd99
-
Filesize
5.2MB
MD523ce3020c2b6f31c05f37e4731362b81
SHA174b6e9c84a2cc6a7c32bd70e69f607e89562d033
SHA256870fce3eb356deb261e6e4d16021d365d3d992b3d2a10e7d308ad5f21f4b6b8f
SHA51270a253caff8e8122277c405fa9d0168001e79e388fa720f21d888e884a711b6bf9b14247e6ed1d02eb64adcdd84c5b76c8cdc3787bcd590389933ec47c1244b5
-
Filesize
5.2MB
MD57b6aca606de4850634a1439a5b3ba108
SHA181f64fd4febbb8c4d8911f0aae451061ee7a2e39
SHA2563a939cedc76eb910879c470f31767ce0deefd88cac1a6df830b1978259dca11f
SHA5125979c86e809447072e56a519d1acf823af23f3cc444af0ba0f5dbb1c3478e289e079180fa903f8a51977374d449690e0bd455d06116a2f9c4a8b744bfc7f9059
-
Filesize
5.2MB
MD5d2a213ecc7c597f839a05e170facb4d6
SHA11f3dd0fd57c79a441ed7d2634fef8d5de0825bf7
SHA2563e90240d3a9f0661b47d53259457550ebfa2d6109b75a7cf1d73d0177f799938
SHA51220e0683acd5d6cd25dcb3d630358fc6c424d8ed7c9ddb886949d387b6c0acb505bb38c1d400d46f30ab10da920a895b414632c0bc3b6eee5f26aa7b9e8cce91a
-
Filesize
5.2MB
MD55f9f310861009fb7e75eeaa171b61bd7
SHA1cf0020b10840212443df6d02b9980db7cda84fd6
SHA25659a0c666a5b18e961771ce100d4384ba7b89d5a62e20c7f731933943888f2b05
SHA512bb3e378f3390650e6cab8cadda49cf4928937c23a7340612cd9ebed48975e7f954a1cb519397ca884d699b2966b28028cf125cd8d6f1fe5e65173a7cb49bde78
-
Filesize
5.2MB
MD51e9cf224f355a114a0ffc1343e98144c
SHA1bf320bd487a85ceaef7bc22f8eab4f5a7ae4bd0c
SHA25604b7e12f8c85d55b0ecc1b5a60d896d4f5b583d3fbcd1e8d966ea61345d76071
SHA5127d1ad5d39cc61b8a8a5090aa2ad32e232e4aa00531eacb6726676a2bd07eb82f09b6e0faeb290e8ee8f6fb361280cdcd40e1508bfaf24b9d0bc554b5fabc88c8
-
Filesize
5.2MB
MD5a860ab5207dca23952aa13bbb22dc7f5
SHA1e2bd4e4d559a9e2e64ec8d479f00a7670f03617a
SHA2562c02793c62dab83dd87e3a8852384bebdd4b47fe4f58d8f523a93c88bd42c0e9
SHA512716e439c44ee2e397fb25458d6c3af44f8ae1bbb8a7d12c3f00cd747d0f8272763f78b6bbdded69d63e233042cc7fbdbda3124dfdef52e42ddeb8a62034961cf
-
Filesize
5.2MB
MD543f433d525398d81cb410cab0aa2f147
SHA197af60b301e6e9faa554a2c72ca0fb6d3043868d
SHA25621fbac93c02a2fb4cbf2bd2abbad163d660ff51cf364408e8e175bc3bd69fc42
SHA51220d7f6ae25260d911ce33859e43698d5d316e696a99cbf5918cef80012a46ac9aaddbb555474088f43e58dbf565f747e517200db9384b35349c9837d7f24e2f5
-
Filesize
5.2MB
MD5362c523d91e2ef1cf2b05b818e46ca6e
SHA12f808677f9c4e75e6146da80573c07cbb839e406
SHA2563c3914198bb1316496f20d1207cdff2c12374447e9e95b7e2ec89d1905dc33c0
SHA51203ce2fa493c4d18b37a2960b2efa0a5ee28317ac6da39da8c01e70d02420b79218999afef053746ac93aa4bc107bc53eef2eecfcdf10b80a80512aa9b68fc591
-
Filesize
5.2MB
MD5ccfdb60c466c847b43a517695d8d4923
SHA1f5eb39d1c702dc2197d7c915c17a33e1bbf074ce
SHA256c884014945cd5dad49999a20781d3a30396f2dd4c8880c991f4dffad17e1a7f5
SHA512bad8a58e362eb4877831f5716d9ac367fd9d258bb00c0d58d45aac898097b8207b12caeddad1975c4c0573518b8786692e45e43d23ac8e220c9c7ba25a0af3a6
-
Filesize
5.2MB
MD58fa1ff36a20ef71f5aa19bc222af9fc1
SHA1e25e22f1825ffcf208badf569e037b109f18064d
SHA256f87220f0c5d1f6b0dc3cbb919c8f0c6c9cf44c630c2357e8817c16079affc22f
SHA5122d72b98ea19d6c1025d5ca7cbf6480f2395a8829e6eb5bb35a81ee21985bd44d8c825e5279eb5637f55d01d7d09dbc974514c7d0adbc7ab3a32d4a04bfccb6e2
-
Filesize
5.2MB
MD55a5f13e51660d07a08a65a40a4e84ef9
SHA1583238e800719c475651ee0ca0c84add10bb6eda
SHA256871662a8ac938d410f6ca08265432d2dc8d33956442f518ca2a0aaa5fdd844e0
SHA5126239db77f499d356e9f523e2c87668ad95b83c1f33a40049cf8ac85880313ec58c41260124cba9119bdb06f7f396c937fe13acaec763101c1e2809cb845a038b
-
Filesize
5.2MB
MD51552865064091354c8fd64a7d914a4cc
SHA11e01efe62ca1ae74b8ed79c77db88a54d18163ed
SHA256bb33fff82fd7b79c97dc407edfbc418a3bca685a2597f558b0dc36ffef5ffe09
SHA512145bdabfb2de0e7953fa2306724be8532c71977995a6f46272cb5a08c6b0b7a4c04ac3f3e2c2e6e9f89d6518a12e948f4c524b4c11b476ab006ba13d20c3a337
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB