Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 01:39
General
-
Target
2024-11-25_98e8cd35a89cfa35d476d0c6eb1bf290_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
98e8cd35a89cfa35d476d0c6eb1bf290
-
SHA1
6783c09d6dc4420a1555b537dcfb473764aafac8
-
SHA256
1c4a5d9d7fc7c4baacef4b115da79e906a81300315478b397cfed300d65970cb
-
SHA512
d0ea7d96b756008e49ad08a808d3a19c4abfc881bea66a76f17009b4eb30b31ce2ed13f894096b0fb4250771bbec72f788235bc7989132eb69299636e75d0bb7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lU3
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_98e8cd35a89cfa35d476d0c6eb1bf290_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_98e8cd35a89cfa35d476d0c6eb1bf290_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\HoqblUO.exeC:\Windows\System\HoqblUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzXyNtF.exeC:\Windows\System\GzXyNtF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hiszzvi.exeC:\Windows\System\hiszzvi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBXDYPo.exeC:\Windows\System\oBXDYPo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtHJDSO.exeC:\Windows\System\ZtHJDSO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psMtIWA.exeC:\Windows\System\psMtIWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YgjEmLg.exeC:\Windows\System\YgjEmLg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\POHyxUJ.exeC:\Windows\System\POHyxUJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lftOvqB.exeC:\Windows\System\lftOvqB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aleqvur.exeC:\Windows\System\aleqvur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wNDNzgo.exeC:\Windows\System\wNDNzgo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iVDTDai.exeC:\Windows\System\iVDTDai.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NROqLBE.exeC:\Windows\System\NROqLBE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mBZczFA.exeC:\Windows\System\mBZczFA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SpILNfR.exeC:\Windows\System\SpILNfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Bnobspl.exeC:\Windows\System\Bnobspl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OuJpruQ.exeC:\Windows\System\OuJpruQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlgMoTl.exeC:\Windows\System\TlgMoTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aavGwka.exeC:\Windows\System\aavGwka.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICNevfz.exeC:\Windows\System\ICNevfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hNHPKud.exeC:\Windows\System\hNHPKud.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD55cfda419536d96ccec1d83bd88b0c7d8
SHA136614f7d20b5de5202d0af3fabe684f178771de9
SHA256b3d07b6bc53821dc8c59795ca372f71cad0681bfd2bd5065962e893a103cf4cb
SHA5127d2db5d2fd8e2b2187eaac3ae8b65efa4b69d57040481949d4be14be7e02dd0bb028a2092d7b038f33b2fdb8cea6d2d4caf2dd28a8ee267ed88380b12a737fd7
-
Filesize
5.2MB
MD5f31b09a6ba84f4bb2932df05de4fea7a
SHA19320bb22d761f1d122282cb9eeb618d4a6c0a0d3
SHA256eea7063ebf316e2838b139eb97c92027e6f01c637c8a4a60328dcf4f55ea59eb
SHA5124f793247e09b475844f4c890b1171b0e08c3732d556c7ffac285304640f66165ee243b5adb0ae69ff561524a3c06d26c8c8a765a77659a6ed9a1a5eadb80fc24
-
Filesize
5.2MB
MD5bb046d4a11066e778d184dc15c755f16
SHA18772ccdb58ad577070020a7776b29b83bd04b77e
SHA256dfd97a5b45aa2b48f45f8e5568385585bfde5930062cad92b8f3efd9eb15de58
SHA512fd03bdcd6db72472f9791dbdb9be78a8057f43858f34538d5cabdf5fd44a10744ba0cd6d6069161ef2392a42635b91ebe0a7a88e32b34a3bce2414c6d6df857f
-
Filesize
5.2MB
MD575372f8278e4593e09f062ad02aa697c
SHA1df7fd05b6075b87becc54f06531ae858ca1358b9
SHA2562d4f50e72c4724e1cdfc6e3c04642b67e7ad2f836e8d4ca3eab17f08a62aaa48
SHA512b62a51728761ef99d86453836be4a857b032baac7fbd356281e7dbc75980e1d4d8d7704ad3197baa8821fe6d81e496fb70212e35c92892b63dc968bd28094ade
-
Filesize
5.2MB
MD5c1870a3664b77011805eb6bd4daababc
SHA1010d0305ece3862432d2cf3f6c55adc86fe7decb
SHA256da305624a319e2330e354c724a9e33f340646bd536862f8ff2e05f2be9561567
SHA512f1fc9f7115a03695577f228161819c406ca3c435457046a83641639aa2d41d9757aae2390c790ca52bf6decc023d856f332d7953c7fd204a060eaa4dec7988d2
-
Filesize
5.2MB
MD568632fee24c2d282097cbc8cb891f22b
SHA15e2fba97964ba9f4e8caeb9207986aaada64a469
SHA256c6509c2113a275cd4416eacd89efd49b243c64c81fa46e28c9a409115949bf76
SHA5125a2241b08ab1550a31dd938e7d55fa4a771a9402a72780f993a27a5bc89b4fcdbba84a93eec2f63f9b73186d8daf193afc98a986eda104d88e5f8f776a294f23
-
Filesize
5.2MB
MD5447f3ba9bb3228e7b01c552b32512ba2
SHA13a21f81a5dc39d5e97768b0e7cf338304125365d
SHA256cf90790e1472d4de156eecda2e90a92f9292a4892a744d341eeb417c335c24c5
SHA51222fdf7146b3d8f8e172d1fba8d2a860838186f10e8b0c6b60a61d6eafd35adfa9901344edcc64d3487848e1feaafb8035e04f56d8ab50d5a72dd7570c6013dc7
-
Filesize
5.2MB
MD5edcf213fea9bb12e3a53be03109d5520
SHA1611cf61732f84c15299e9cf574d490002052ab59
SHA25678abeb23a129bd41e817703e97aa093c3365031c59e4647923a8cdde90cb3f92
SHA51207bf9635da1ff37b5776763a18207f612d522b6e2d54af34e93172730892edfd391e9f053e98cdeb93af2bc0b121895eeac96296a9df2607ab1ce67fae512dd3
-
Filesize
5.2MB
MD51aac253f76df45338d2061513c9dc978
SHA1a0e5a9c5f880bb23bb8f22fe62af650c9e87b0c5
SHA256f04ffead853a8b2deec8aa1c9e95a15866faaa054f80401aaadac7ddc1e6a92b
SHA5128b1bc8271bb5315b73274684dfd1cddfd62b10fc1bdd759df15a9618eb3d341c3e2488741f45b5e687c81ec4703eb205745a27be5d821e2e0b58f93b70dd334e
-
Filesize
5.2MB
MD56a5af9d935127aaae8e1a00fe0f81e0f
SHA1c44d628948ed48d56d184116156b910c8c9a4e05
SHA25694e036fe622e060eab826dd915b3d2f28d60e8f4c2872f672db0da0ed7f37e21
SHA5121495afe1fa992bbedc6837fc44c597193ae055156224f32c1312f26cb57ce811e00b61424d2c26ec3bbbafcd581542dd8b85548ec47fb221e4a3a3359e91d6a5
-
Filesize
5.2MB
MD57ac9de47837e4c41c52e11960a133c94
SHA17b666cd99180a4852c860f02107f6bfb28224ae8
SHA256b0b8da07f65e83fddeef0b172df85c477bb41904fd9b2cc41cc044887450abf8
SHA512bde3c1ba16fcde4e49558db8b1025c65a91cc4cdeb24b29975a77512d967bbea220b78c10410970273c9cbad50cea4966a306488e98acae5d949e5595e7adb0c
-
Filesize
5.2MB
MD5686bc2686daaa700a5c0e950bafae211
SHA10ce4aa0a2b0072375701f15b1a6ac123012ea785
SHA2563ae936fe897c04b24f09d672b62ee4efe32233c7b6830243bc60fa8f2ed97045
SHA512fb7eb2ccc075bf35917d6d8c4f9d3520867fb8179e5ea734397ad10fe50d422d222938caa76e09130aa4e271b3c5cd33c3f6eb48fbf75398081ca3c101d42336
-
Filesize
5.2MB
MD5e95199e59f1d32764725f8b9c5f15cb6
SHA11f8c3045af7510dd00725116eafea9be6203f815
SHA256a8972c3756918b813e63a30f8144d0577447bc27c3f487b8128beddca19c6324
SHA5121442a7fc85266f4adaf04d5bc9fdf2bb807f9260719b6b1516017fc2c592a419efd174fbd59a49d75d3c87ff8682b7c94086d29ba810bf7c7ebcbf4384ab7b16
-
Filesize
5.2MB
MD5a31d22a2af3a4315832b4c135b3b7f15
SHA1368b47cba449fe595e060f0edeb1ae78bb132fa7
SHA256e3bd229ee72abf24589cb5fcf3abb1723403d9f18aca9e62924eaa104eacd978
SHA512451bff6775b6e2548687983a2da20825f0b4d1a906b85c5a799a44f60026eacbd17fb616cf8e02080c2873f2ca3914eef72b0881cb2096afab898240714c6aff
-
Filesize
5.2MB
MD5cbbfc3dfb5aea0870ff093871b6c5e62
SHA189a1631bd7c506ee374abf737c39366c9e768c8e
SHA2564586247dc3a12f7504d9abb9aa38a0c26b8dbba07528502387d9061e40d6f156
SHA51268192f861984d805c9f7332cef84366f5b4409b19b32cd1ae8efcb10473d012fc32a66baf6af7ee50bf415ba3eecfed964154b0778782f86a0c9d4f2fbecf50b
-
Filesize
5.2MB
MD52fdbebc535981d540725ebe35d7ee6ec
SHA1f9b5b9d7cca663741471f6fa7000ec5ad29ee039
SHA2563ccdbe8def307c49383a992eada81689312942ea331ab235a4f74c973a46ca42
SHA5123f4d6640edded6e72479f6048faa9dad94baf5b327ca6290afd9b687813ba5b00332a3600e2d0305323b09b4864f26be35b7d4b6d6fc6575fab337f2da68e966
-
Filesize
5.2MB
MD51f561ffcc0682edf3b01eba1396dee29
SHA13b8d7a3739e1dd4b56dd4a84be7dd3beb74172c4
SHA2562d52f4bc23d9fe849e5d93dfb6cc70bbfe858bcfa3aef5a80e18c3c4fe132e32
SHA5127e166ea26e7a4daa1fb71e98b5ba3472ef3ce4398f524e2dcddf3812b1f4dac8d4216687238c9c2f4ed687563fbadc45d44e0c41cc1c27ed2fd0874b323c99ce
-
Filesize
5.2MB
MD50cbb4e764230d7a08d318592f0f74e16
SHA14bde14c2285c819cf719704a604d8bed98c62906
SHA256fb7a1f1c7beb0a3a8c0acdbdb4ded846b9bbf3fa28571bf311fffc02782e5956
SHA512e14fc2e3cb0d0c116386778ac5776ec216cb911d9e1872aab86a88e15eb782e28a3e0a8690052fc0cafa66997b07e556b561a85dd5af5eb1e653473162502547
-
Filesize
5.2MB
MD5cb0df270cd4df1b621631ed4f2820047
SHA1af17d95f98594b3250254e8b4595da3030585364
SHA256a2dbc6c56b480671b11e028c6230fb2bed12b3f321374301a7e24b55830366d8
SHA512c945bc98ea82de90d877cc75be20c8558dcfd9984a65d463473586f170d98b3e5b0081bb91667bc85385c5b3ba4f44c1416eb0711520c04f788ef7e644d1f386
-
Filesize
5.2MB
MD5a32d456ef55793a035cab0418d81c0de
SHA10f17551f29e14f149796d4fcaaa31d156a7d9486
SHA256d8479bd395ed18ed92638f592f31b549d2133436a3319a79cc9a94111e73396b
SHA512caf08686e8fe2c3631954bc7a71501d29c0c7e19ccdc07bcea202945af86ff16f820468f82edd854b5b25f1527e389d77aa3d81d582a96b7bd2e3e0e9f2ac639
-
Filesize
5.2MB
MD59d610ae1f2096e919583de9dd8c73d3b
SHA196f0553f6dd9058ac7b3763b9e2f0425cbb66335
SHA256660393569c2b9dee76cc90b6bb16492ea9d0caeb1efdf825b4d867fdbfe57492
SHA512ec1f07469b53957810307690c3a19c1cc88d143740b63e08c254b6ef701f8724569def7698d17171dd22f478c548af372f76a0ede552091a80d9e8fe605e64e3
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB