Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
25-11-2024 01:48
General
-
Target
2024-11-25_e821405f623a950f2f74ff9dc6ed8f1c_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
e821405f623a950f2f74ff9dc6ed8f1c
-
SHA1
a0e4b2c156e84db5d9cc881b9bf1da10bc1a28a0
-
SHA256
498dc447ba342d8eebaab0d5d4d677366abed09e11ede19082d42f880d410c83
-
SHA512
adda908f5705e5c160372f532e68c6d365e7ed6d50dec2e1ad316bd3f525f1d338d7eb7e8e0fb873a2f8a86fd759be0940fc25f243cebfb76dcd3a1219a967f7
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_e821405f623a950f2f74ff9dc6ed8f1c_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_e821405f623a950f2f74ff9dc6ed8f1c_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sLTheax.exeC:\Windows\System\sLTheax.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jsCtEkX.exeC:\Windows\System\jsCtEkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EGqlEkc.exeC:\Windows\System\EGqlEkc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQHLWGl.exeC:\Windows\System\vQHLWGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pZQPZfq.exeC:\Windows\System\pZQPZfq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fwdhVLC.exeC:\Windows\System\fwdhVLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qbMjjte.exeC:\Windows\System\qbMjjte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKLHpxt.exeC:\Windows\System\AKLHpxt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKCkZTg.exeC:\Windows\System\sKCkZTg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RHJJdkE.exeC:\Windows\System\RHJJdkE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubDQpsY.exeC:\Windows\System\ubDQpsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JhPRuil.exeC:\Windows\System\JhPRuil.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cQLnLDr.exeC:\Windows\System\cQLnLDr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhlHUng.exeC:\Windows\System\KhlHUng.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QLGiUWx.exeC:\Windows\System\QLGiUWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaJYMEP.exeC:\Windows\System\KaJYMEP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cAzKbLX.exeC:\Windows\System\cAzKbLX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRvaSgt.exeC:\Windows\System\IRvaSgt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PYCqEsx.exeC:\Windows\System\PYCqEsx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XGDuCyY.exeC:\Windows\System\XGDuCyY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\swPDjUC.exeC:\Windows\System\swPDjUC.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD52a27715fa908db98382cd83750fb24e7
SHA1ec9716404d42ddab3fb6638c94f37d9dc7766ac1
SHA2564647ada875f3996b4690e186871a959c70e98a5c7502aaf335e0cc80f2bd8c0d
SHA512d584a4f7a7c44a384067921ee4e90fcd8430418b4b00303ffaed4d7cf5fe4af5364ae34dc7dc4f0edb14cac93d748df69044a9b3a86efe97bb8415d93aca160f
-
Filesize
5.2MB
MD52a6262bb8990197e00702f73fadd6187
SHA1d8c80ba04d4c54ade54d344e05ae6b643197189f
SHA2568fc95fdfd5e63172e86c64ad563f62e523cc7c0ce014dd707b69e50d6fa01019
SHA512565faf79674e6a9572df72c7af2b69e374a9f5291abbd1a9a1e264d96485f511b95dd85706455393cc4ffc11c068ebbc44ce1bab8f5a7ed0909da9db8f11b74f
-
Filesize
5.2MB
MD5230a502720cb43f73599f2df3f5764bf
SHA1e09bd3f4e53019aa33340a61ed1d753cb58e85e3
SHA256d2ae41c10d691fc5c6481d884f04c346b556b4ead8c44b74c4f1a1308fe63347
SHA5127a5b13fa2c0dfc39015b1446bea901fe5cf695530dc82b4df6b8196bd0f58bf23993d25bee73318fa84c9198a08c02a0ef407a0c0fcd6814d15eb133d3cfbd77
-
Filesize
5.2MB
MD5d684c993f0f78cceb4f433622b94e9e7
SHA153a8e5da723188464bd19970c3e93216554d1f91
SHA256fc6374e1d95681f8d54d070c9babb86b34e81dec5b8979f67b6f8190bce684d1
SHA512c4abe9f52ab03a1f182f38412b77d7e4cda43a9ee3a33d1bf09b330b9d88b1477e81344cfe85dd80aeda74ff598e6dd97dc535c911628771ab9f3cb018ae5375
-
Filesize
5.2MB
MD5de6fb13404ee65c94b7e52ffe540146c
SHA1c9ddf600c9c9855f34736a9d1f1066fd3e2d5b4e
SHA256eb8b824e7d92c810ca33a736aef592b829c4b02cb1e31724494ae0195d75c782
SHA512b0c447a3cf627d8eada2fb993169de54c0a822b553237c7620cac81fd0baa73b04379695f59ccadba52ff369dff1594390a5d96c34fa781213f14c1d108941b3
-
Filesize
5.2MB
MD50d7d7a467d9425921ed37319bb3fb51e
SHA1e0a3b0fe8f0805c626ce07e108c7dc0aeee40953
SHA256d11dc3cb09422e66fc4e658d448c0b5f253d3eaf6de19485fecf3a5277827206
SHA51293793db10beb86ba703640e5d6551ca6acf3e1c19656c20155372a0e2925e9d385e3fda42b663b82bc3d4f5ec2f083720be58161aa292fe6d03fbfa2fae6140f
-
Filesize
5.2MB
MD5304866f66a60151da8e3ee63f0f12bc9
SHA10c00f3c71f7ee65953610266c193861dab4ce329
SHA25628c8dc6eec20254b22fe068899eafaaa8fc80ae48579b5c8b2361213b40925f4
SHA51282f4550823c19bd94f43c4b635845a107d5f5d4865af146d087e0065183da74df49bf47ffb0230ba83b9147d0903567dca25e2013a11ad7623f807966ebcd15c
-
Filesize
5.2MB
MD51401a5193a553245a2b9e5ec5a47f68e
SHA18588924cc052219a5000979fc7a0873568141ab6
SHA256befa18b5c97b0dfee668793ac030c9e1f28143da88414cd6eaa5e4a77b85ef1f
SHA512899b9fd67165214cc85b23815838a6d744da6253e2e692af56d2782e33a09042685fcaeff1fc69fa8c3a1249f6a22b5f21e28f3d8adda5c9d049c6dc80a133c8
-
Filesize
5.2MB
MD5ac86ea16ae2bfe5d933b13bea4c8e865
SHA1744c74a8fa56370c5c6e503bc49508acc595930a
SHA2564eeaec8647cc638741161fc9315818c6593a9a5462a9f14f2bc6e9e7140371ba
SHA51289fbd8b6b43c0f99b59745ac59e65217267059770b99993056b1535a204c06135998a4b3686507f3866ba7b35705a7ddf48d18ea39787dcf16f1d97aa2b77573
-
Filesize
5.2MB
MD55d9b3f5d80c4d1521119d788ce92d5f9
SHA15e7f22baf7579fa1a1e29fcb41180f9ff34f5a2d
SHA2566894b7c06a13bb7fbd4c378ea0c2939182daaebbc719f5ec0d4e9c91dab464c7
SHA512bf495b0e5a5cb2e8ca5e27503f68cb6c196af55be149c9b8b4dea916626a161ed96fb34aa8dc0548e64e6aab60996bd542a1eb82a08c59185ee309b319a9aff6
-
Filesize
5.2MB
MD56fc708149669b3107e86baeb2611283f
SHA14b058b4eed3f51c3d26b5705537f8f55128d0e30
SHA256114dd4fff529cbabf0ed115e90e0ae4ba9d54ba0fa8cdea03cd982ef45c51271
SHA51207199d33cc117e178b2b1333ce48a3ec582bee71b4c3f9e6e6497a30083b0b81d92d2a5f8255109dbb54406fc7c9f6d707f35552c7c99fe09f73801cc7f94046
-
Filesize
5.2MB
MD50c4d8c343cca528897659b7d04e1510d
SHA1bfcac6004cd24591d0f9cf0d8ac9e25099b1a31c
SHA256492e3ce8dbc96eabd12cb955ecfd96eb031ec9de96a11266ae318dbcf321c290
SHA512bb7c7a508d89b854b557bd4b0d164017fe447ca85ef874bd21a8ca15928413ba0d521b22b28f4ee06a38004f08516ef230cfa332ccb7c10fe15c55deeecd157d
-
Filesize
5.2MB
MD546fab4262aacd8aabab762c287696cb1
SHA13b69c71ad24c8f7b74409cc4d9a103b272c00aa6
SHA256f9c59a18216333c474e2411a9a4b30b03ccf20465a9ea02ef76e3efb433a3ac0
SHA512b892bc935b5ac0b3b12cae6a749a55e72e717d14d8690b6be6c1faa93bc8aff906b88d3a47dd1d56dbd866cb5c7e4abb97862d141bb0a274b6757229da68e178
-
Filesize
5.2MB
MD555bd027c2041c4d5d24f4de08353ccb8
SHA1198ec9c29b408baf6d14fae9acb377a7a08b3a4c
SHA256f31a28eb0e78afd47c17cf4ef3c1299c98aa3d58d42c1445ebec58f3b2aa4214
SHA512e6993afb613115154b5b9b6c77f521746b4801f82c373337d88137447e366dec248a063a00ee3814fc020961694bf3bf018b73c36c59bb56660fbc32d2470286
-
Filesize
5.2MB
MD539c3d2b867234b5b059aad10758f59da
SHA10ef8a3161a1ebf290ab1bc8d9aa26b7b3b6d9000
SHA256f0ee3118aa64e3b09010d5337f41c02ecf464e01352593731940dd6d8e883536
SHA512581b5c6709ef60ff8501310bae21dd17f41ee32e5c972fa58d38e6e8facb891a78c68042247526d7eb3a553dd7d8301bb37358136de67980b9014241231b3c7b
-
Filesize
5.2MB
MD542d27c6d0ffbc00cb0824bd45e3dbc53
SHA1344d29fa5d075e42de268afcc8c29c93be2d0045
SHA256a1091701b576f484637a0b560465d393551c7ab32ad9751d916fdf25fd413b8f
SHA512022f04653ba43126555371acf9dfd3536d4e2591cb8c3dbf439646d3b253d0ac21b1a6d30e7ebadfc29eee1a26ba983b07e58bea0b9a4a0c0ea8ab39b42d4a0a
-
Filesize
5.2MB
MD53caa22b6d21b37bf817004cdbd081f4f
SHA168d84bfd4d85be512a8bfb5365104dc7dde64e7f
SHA256a3dedcaf7da43433f60ad30489efd53e534de0bfb63e739d04548d1f3e2cf7ff
SHA5127472c9c894e2124b86492503badccb327ace1d8b7f5da0ad39ce4cd4e67f45bef40a25ddef87383dbf8d662b1cf4c2786ca9383130987e760c150000a9791bc5
-
Filesize
5.2MB
MD54f6e6b3e23b901d4823401fc9c90f6f1
SHA134db546891de8333fc5fd884955d89bafaad1972
SHA256301de17403e6635feb629d6024cc5d1afc090a07ff390fa5c6a376385758f6eb
SHA51237e2a130a91fb620f76c4297d0d7709bfdf487fd67d12d01b4b251301039c7de30aceeb8b2d57169b53d1bef082c760deae13ad2bb9f353350048436fc513f56
-
Filesize
5.2MB
MD5ad3c519bca15b611810695cd371887f2
SHA1d6767c6dfe4a799636d657a42ab5772b9f5f1020
SHA25610b82ee7eea2ae0021b2a1c314c6e9cd629ff18ab7b51906a7e2b9ddf43ad1b4
SHA512ee3b4c2ca6c8b4ddfed83aecd81ced718260fde8bde7dfb4941250667e5e512bbeb36aac0405f34352efd367bef59059a880a83c6b288165e181f1b1c53f12d4
-
Filesize
5.2MB
MD554fa899e6a513a5eb5de2c6f173d6821
SHA19f7e79257bc5dab3779048c8fc8343fa41a96746
SHA256ab39554329dae9736a46d4ac378db4f307232521b163b2bf7b3cbfc44e88e948
SHA512ab9a6ccf7f02382b213d4e049693502525e36dbd1f9eb6d18d16136bd26d61c7665301260abe0ba4b97d29a796361e3d6ed99680295da9f5942681f864592f8d
-
Filesize
5.2MB
MD54b30b71129e4f0f17c2c72b070d6779d
SHA1652f8fb43701883406d476c9464975153827991e
SHA256a3beda799ca8a282be18c8ab632a7c33ad481016cf4b982c237e04e0135e0da0
SHA51235a1ba607ebabc45df46952888f7b5a713e50dc548f8e991dd775a2501af5d38d402fa4bb8d2e758bd025c9e929594079153f38d87eb83a90e099b4db72fd9c5
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB