Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 01:38
General
-
Target
2024-11-25_879d999c337806bd29b7bbc0d5bbeffa_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
879d999c337806bd29b7bbc0d5bbeffa
-
SHA1
4ade20fa079acadd0118cab11359b7c1c315e714
-
SHA256
905d69f19e0c2acef98b0a094bee101df191156204f41bd86d2bdb9dd9125999
-
SHA512
346dd7a59fdf963adb46462fddd0b00e89a02d37d9f04443437117e09b902b387be18ec8fd99f8f81631b7b4fa3ac32d9d78ade862d95e754ee25a8a1995aa0c
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUx
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_879d999c337806bd29b7bbc0d5bbeffa_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_879d999c337806bd29b7bbc0d5bbeffa_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MAJYcjj.exeC:\Windows\System\MAJYcjj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aUxJkly.exeC:\Windows\System\aUxJkly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NGhJnPT.exeC:\Windows\System\NGhJnPT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ziheILQ.exeC:\Windows\System\ziheILQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YGoUxWN.exeC:\Windows\System\YGoUxWN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zlcrEcv.exeC:\Windows\System\zlcrEcv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ktPAtOx.exeC:\Windows\System\ktPAtOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NLxGXZO.exeC:\Windows\System\NLxGXZO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GxtmUEr.exeC:\Windows\System\GxtmUEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ATXtoQx.exeC:\Windows\System\ATXtoQx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGUBNSi.exeC:\Windows\System\JGUBNSi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nipeoge.exeC:\Windows\System\nipeoge.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZIjMjKu.exeC:\Windows\System\ZIjMjKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JjrZhTl.exeC:\Windows\System\JjrZhTl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wklfhzv.exeC:\Windows\System\wklfhzv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EzpRTdm.exeC:\Windows\System\EzpRTdm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KnEXYqV.exeC:\Windows\System\KnEXYqV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xucPlKZ.exeC:\Windows\System\xucPlKZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKzkLyM.exeC:\Windows\System\uKzkLyM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QSKPMLq.exeC:\Windows\System\QSKPMLq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ePpWitf.exeC:\Windows\System\ePpWitf.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD568aa9bd97b8f92d787c537a0588ae935
SHA117ddeae3e50d2ac9a5ae965d11de7616122d82e2
SHA25623c5b06dc701bf1562b288f115d1f1381d76b3ede64361a0de5c8e5451545c68
SHA512254862214af7e01d561aebbac767c47c10b04251201eb99e95562365f2ca8ec921aaa75682fe2dec800da75cc0ec9cecc7a367d11ad684e5321f662dade36cf2
-
Filesize
5.2MB
MD53ad00f1654e5e306cbc94a9c62715743
SHA134d8b79294853bccbf4b5e53ef326eaaf9374f32
SHA256b4d1061b2edc5874e45dd7f7734cf9d88ae4e113a04e5c307a2d27b4755264f1
SHA51227fbd0cfb2f333154b0bd478814502ec0ccb42e455bc81b87dfb99844266fa0f626da43d052dce13ec789b13804f6cbe298d3b3478a51a8449a34e05853f4d41
-
Filesize
5.2MB
MD5b25bd905b4a7d75ef269990539d94e7c
SHA1aaae454654ca66fda11aac55a5812349aa05b013
SHA256db25053c69ecfcd289f5dfaf83c1b0b248bd89505d47f4a976a1e519e5bb933d
SHA51204fa892307dbeb8b01299a70b4f78afbdf3dce11bcab34a370801e49a5a33b69669fcc7a8584ce56cd4ef00df15de976e5380d28ea70eaabbaf7241c5b3627d3
-
Filesize
5.2MB
MD557c579f24ae6f23dee50a8247d0dfc7f
SHA19ae1c94a116c06ac1a01cf8c9ce3275295adad45
SHA2567f090f76a68bbcdd12e241cbf05a7d04b224fcf9bbd083dc52ed94759577a27b
SHA512a540e633cfef710467cbdbbec234c0987cf54b152564461e759e5bb0705771a567b8850c9428f14c07476c1a0226f5ddd151a6294a3de992690eb3eb8004c37c
-
Filesize
5.2MB
MD52f31d0709135e20dadb8fe09019951f2
SHA1824e6a4d529bed9fd49b877b711b8c0784417d92
SHA256a5239920eb4018df97daa02608ff523590dba8823dbe90a1a56f8f01a5272a41
SHA512e9ab2a54a93fb708d81869e7684218beb30c3b0c93414feabe6cbe0be12576b28df5cdacf8f4084fe8b15e1fd5a59f75a43d8451a38e8e6c0142844d67458030
-
Filesize
5.2MB
MD57c984a1015760789106b97324e62ddaf
SHA12fda16ce074e6d0483b0ae0d72131d655ebe0d41
SHA25635c0b3733f55251975db16afc666b5810a8a6132314c5108ace993f406455b32
SHA512495bc6c5994120fb552e0af3a6128978b3fca6c57ae389a31ddc02608fb063b7021a5d6fff5987939d58361de1cc603b80ec02d808a09636a95f59a452d4fd2b
-
Filesize
5.2MB
MD5b3d7857f4d1771b27107753add2701dd
SHA1a9c13050ff977fbea19543e3b0e4895b6923bed5
SHA256812d3c68ff3c735046c0b93b27abb03dd28122bfbd34387db2fc90e97a3828a3
SHA512b4224b505a9b0f6d3bd3cfbd09e4cc9604177b3a9796cabda455ae558cf610b873d52cc732bca9cd011499a3f1a304f2f3f856f2f332f5dd7e787254e29f3ff7
-
Filesize
5.2MB
MD51e85108e2f4d5221fb1ea5322768c321
SHA186e071fa9ee7066a8bfa17bd58bef591b170488a
SHA2566a9f57695aae171db8f91c267d9b10e449423cfa2617ea397db58924a6c322f0
SHA5124f26323c52fd27295e5a4157726230c4a4c2738ea44d19c483a3127a9be08756bc5ad494bc2295ca683ec67fb489989477d876a9347efceacb0775d1086392ad
-
Filesize
5.2MB
MD5ae98554765a65754957d8195eda25565
SHA14bb391685dea35d3dd138a5e31235e76956a22c5
SHA256e6397ce1f6fd9c11958131a2b514968fbfb84b1764171d9b30040ebfea3543ed
SHA5123d0070089f3a76fe04119a9637086b5c7833d0a1a60925825a54d3adc44e46fc6c5eb5f294cce2fb76a7ee63cc02cab6017bcf8140cdf8026b97cf786dff04b4
-
Filesize
5.2MB
MD5bfe69c76a41da6dc82dfe83a5fc11fb2
SHA1e8647108e5ad9ae3b0e9ac06d313036e41833c9b
SHA2567ac77a3dfa5f61aeec32722825f8feac81e6aa20403d26d49270e30b5f849bf1
SHA5127f058596cb1bfb8fd09fd254be00f5e29eb54feb57604597683428bfa14f12f3fc4e5f3e729b950e1de6cca53966537e9cabcf64196c6bd5b402da39a9d9ef22
-
Filesize
5.2MB
MD5df8fc24764f7c208c3475cc194544ff4
SHA182cb6320a8a32348dc945b39c197e1dc71070200
SHA256a88722cb7419c3d32d0d6004fc8cc2e8739d40cf14c6c6ad651598806c382938
SHA5121f79f179a35eaf8bcf773cba46a21e4f51aa0ae3f5ff69448cd72cfbbd34a66247895d9bc0bbc2175409664579a688995a6e5da8ef2c846695219febb1524b8e
-
Filesize
5.2MB
MD586c7146d9f9347110fef087483e2eec7
SHA1c23f1d59232f82ce452731f307dce1319661cad2
SHA256f1fbd1d3061fc0ae31683fba5aa90584e6d00b66b35359324c86b32e15dfb039
SHA512d25f6a15538b5ecd06a915de36e7cdadf39426bc16318f0d82b25efb9c7ad4c2f215c6c16725ed20dab7a09a4547a3fbc955aae49efadffbd0a56258d7b8fc02
-
Filesize
5.2MB
MD55168309351512dbaaf7edc0ae34a4730
SHA1d67bc626ff12539cac81590564c213abea2d1d2e
SHA25679728a6b1dec0cbd94fd32882f7f9851086421cac2c3becb0cac3be04df2c8f6
SHA512fd8d9e30faa8b406e3e0e61c22ed59db02070f4595b9feff45d4cc2abadb3459f3b17dac4ed67bdb3cfefecb480e26dad1e03a05d4779a3b0217679b9b63665f
-
Filesize
5.2MB
MD5237bb4b726db9e02e78a299d2071bdb6
SHA16582dc2981e01c5800cad8cee48f85a7b9ed81fd
SHA25606616514946626af4a9f09f2109a61f25b1347bbb7f54bf980d6329a5b596d31
SHA512cf24e20a6b586d255b62b632607dbcf0f5d1360d9bf42a72288fd9c29b4df5f90f156e284c48b2011dc39f73ef63cf182c14f6b402b68ed3d784f5cf14dfe9de
-
Filesize
5.2MB
MD5b879c970d35526726cdc52f8f782bc1d
SHA1182259f991dcf0922daae701f8e24dc702ebe647
SHA256aabd948b704963e731bc8e5badcdf3a13cc55720124f9bedb8de020a6cc9555f
SHA512d8c3023ff590c32a63a15b06677375e2c9a175cbaea3534a39c7504a9ba9b9ad746a9f35d7ecfa5dddbc3f4755b9cbfd735af7aac49dc5067ec6a410cbe78ca8
-
Filesize
5.2MB
MD58d8fbc47b2ee5593891c9f6561a12688
SHA12c7b1dd05c1a78017263a60cd66187de35a023a8
SHA256b47c07cc22a80211b73ad5b404d82cdcbd9c9cd5e7f9c7656cbbc22a01f8d707
SHA5121802291a6b966e2984a6aadedcbf8a518de511b19ddf0241ff58c2df41e68e22a67581718472cb539378455adbc6beb0e187e96f4fc8376fc8e1cc25e656b214
-
Filesize
5.2MB
MD56e604e8c35c235db9bbcb7a8c8ff770c
SHA1f55b3de559c5c049c243746f4a6866254cebb9da
SHA25698d111c40d722ac7d00632e513aeb09f362496ddc86641343f73eaa60352b2b2
SHA51288a817335739f0ac6a2e5163f13e518a9522808d16eef29a4a1c17596ba7442b3fff4d108e691b1ef1a38d76ea8294a30cc69752be6e27752ac22942a8af2e74
-
Filesize
5.2MB
MD5cb96303563d74fbdfa2e2c0b6a77f78d
SHA1769c4800ce7f32b9155a5290d295cb70b182e7dc
SHA25666f6ee9c41edd52d9e6d4108330b5006538088d6bd0f6ade05308d5fe5f5dc9a
SHA512809b6d8670b6332508f423a8f67fbc3d641fd54f15fd9b6bcf7c5dc9e9fb57c4cf012133eae7e21a6cd7af87e4c58666b4cff20e20bc68a7fd19fc584037af73
-
Filesize
5.2MB
MD59cdad457cd02264e4267c0a0d17191ed
SHA1048ad13ba2f6f29254f5c6dbe716f765e5a222b8
SHA256b2f03b856a48945d5f14ee0046b21d51bb334a3155fb11b90a0826a1bf52c173
SHA512bfe897651d1e6ed12af1d45b42e6b0db962166460255baf90bcda79bb9d14c628986996c57adc73a7f207350c0eb12dc53227cc2ca7b97188e222de7c49a4526
-
Filesize
5.2MB
MD592225b6b4a144eb0c6d643d352968fad
SHA184ec40f7a41ea605182a47c9fb5be23fefea4ee0
SHA256924676d229704545cef9e556ce55e347db37f918bd2ec9a1c7986a5a7b0f72e1
SHA51252a3a1d408f96cfdf13ec4bdfce913975e3170cfe0dc03387ac09723d0d556222c92cbf5c99e5731daeeeed745dbd30934b54eac46b47f3835963218b5543d39
-
Filesize
5.2MB
MD5e21812ef8cf08f4aca6af7214002f58f
SHA1647b37599e053b116a2d7eb51a7fce33cbf25ea6
SHA2564ea7c15297efc97f967726f0c37308e266cf9a406921aac4eb2e0c99b79194aa
SHA512c42f122e5aa0c21acbdb036896847d9368d2186f35ae791bfe177c52cd8eb387240f6096753d6cbb1b1b30c0b767e46a7cd85e1856cecb5aa19dd5a949eaa941
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB