Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-11-2024 01:49
General
-
Target
2024-11-25_f26c21d5376082035012cf67fcced301_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f26c21d5376082035012cf67fcced301
-
SHA1
666960db694f6a246f7b48981f826c7466d7db93
-
SHA256
e38c6a508442c973f30458989b72b8e921a26d146774ff46a95c57b93e65e92d
-
SHA512
4c778b882b8d9bc8fa8884e109185e24ea3da07e0bbd8ea00aafb826d263c990fcc32d65cb81b0972f8d912b13efecf65b6ee5c513e0f2a761e47c7006015644
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_f26c21d5376082035012cf67fcced301_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_f26c21d5376082035012cf67fcced301_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nrJkfLc.exeC:\Windows\System\nrJkfLc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QPcaism.exeC:\Windows\System\QPcaism.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YaBbRQr.exeC:\Windows\System\YaBbRQr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rixcuLB.exeC:\Windows\System\rixcuLB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qLqEfbq.exeC:\Windows\System\qLqEfbq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UuNiiyH.exeC:\Windows\System\UuNiiyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOhokqO.exeC:\Windows\System\lOhokqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWVzWso.exeC:\Windows\System\JWVzWso.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XkCTAFi.exeC:\Windows\System\XkCTAFi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rRQFkOq.exeC:\Windows\System\rRQFkOq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\himdbyd.exeC:\Windows\System\himdbyd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wcdHJkp.exeC:\Windows\System\wcdHJkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZqYmuB.exeC:\Windows\System\PZqYmuB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vzTCuYv.exeC:\Windows\System\vzTCuYv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nRlGACL.exeC:\Windows\System\nRlGACL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HOIilQO.exeC:\Windows\System\HOIilQO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gHxjmHS.exeC:\Windows\System\gHxjmHS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WIzfVpx.exeC:\Windows\System\WIzfVpx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wxyLxVT.exeC:\Windows\System\wxyLxVT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OxGRmSZ.exeC:\Windows\System\OxGRmSZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vuiELUA.exeC:\Windows\System\vuiELUA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD58f4d6b174484bd5eb8498bf1327f4a51
SHA1be9e1509c20aa71aadc718240c99ebb64cdf7b3a
SHA256f11c190dccbc2a77cfa6d6d2fd85b4c5d58a6105b75893aaa2bddc470a689c17
SHA512b7886f1d819b79fd8510a8de3b8f08e72f3ebc8a4154e1b80b275e36f50255ca92763c051d73b85da01cf4e45112fb9eb8ede5462bc4869c0d2a7e414c4b18a6
-
Filesize
5.2MB
MD503c705fd03c01ce5cc4d6291ed77f354
SHA1f0a52205706fcd9fdb0b8ff3c1524ac22497a1a0
SHA256af0b31477e8b8cbad029e2204d35d2e3cd1b9c5abfdf477bf6d571582a848d67
SHA512b4eac1fbcebd4451c8987dda8056d8c98fe4d8dce52602ba7ebeb9a65d825612ad364af8ac9d7293ded65b67e565d25b0e2d7624dae63c14a34f505bb065043e
-
Filesize
5.2MB
MD570ed6f9b5ede478dc18779b11af3ca54
SHA120e9f63bb36ad48f7a8b5f87441cc45b15f615b1
SHA25648943a61981da6af4fb5b174373993918bffe6627bc05b27758b553bd4e112e4
SHA512f269ca26198fd14243165820e4ef6ef38041cabb3c0577933a968e2a1cc413319ffbda151632133f255f4cab94105a98c4a798877271e5135f13a1aba422ec6a
-
Filesize
5.2MB
MD5e77143d7044c337e4a5e3b69b1d8d4e9
SHA1d9652382b3f3722a238b411d6a9649c94f3b7dac
SHA2569c36f1b61c5c32123d7a54b41293a1f0a4f24362dafb380b7fd8513c50065d8c
SHA512b245982acc05e11f7e1680b61dea250b1de57e3266d484c48c7098c3b9ae59e9dbac77fe8bf333b7720c255c2e2016d048b6e99999227c77be554f842d50466d
-
Filesize
5.2MB
MD5b2f95e2e39b51cd6746ef94b39593f75
SHA1c3316cf6806bb81d98fb7e1812699219493db6b3
SHA25618c8e1b4891e708d02092a3be363dab8cd3db0960f5b83a0d8dd1786bceaf7aa
SHA512c471c12101efe19ac618800285261f5bc2ec59e82ff27d44d7f007ef3821aba6bf506f2d24dd7ca7b50614f2bf524a9250a70b2a58d81640629adc94ad7bb034
-
Filesize
5.2MB
MD5f4d9f20efe927b88921f54edde74f122
SHA16450c8d24d7a47d6b757a4788487fe783a6b5417
SHA256918c1b9d17482da7336f6795c282976515efa11c4305dc9a61bc68376b962b39
SHA51268a509c911860d00f02cc7a0981424a00002b156fced7e4241094ce3d7e9966e60e20d3f3fd6ef2a5d7fde2dedacef8afebe7128b49bde7df76faf3405e08469
-
Filesize
5.2MB
MD5acc5dad08befed6723ba6fff0bb52365
SHA1df56756464443f63abab4723c2835327c4f7218a
SHA256374daa0146ea6f7d4912c8ae27d65d660d6de4dff5fc28270cacbdcace41a667
SHA5126ece4af26f4a5c350eff4e11288bc9d3557c95861c1aa39c47299490eb5260b020479509ec54679ba0c9d1bc103b407c52168f5a3f915879d238d94b911798f9
-
Filesize
5.2MB
MD57a01ffd10602d34078c27ae5a44240a0
SHA1d044e1f58d22b116440dfd7e39d6d38e582a7435
SHA256b297743a3a4ce22ee0fe299ed178b6ea5c8b7e1c839c96e481a424d8cc23051f
SHA5126e90ffaad6371046b123348ad70d9916820ae62d70c0eeda8fb4011c6531a1dbbf278fe299094e790a1a70b0a8b9cc412cfc38dddca9be70a1be900049d54751
-
Filesize
5.2MB
MD55c4142496c4c244936b8f1db66beb644
SHA11a1a73459fd308b9f0d713b76a28b768d1d64b16
SHA2565a3f43a1023483ba9b57a33303c996ecc4ed7c2dd966cfdd7a26f238eaaa9445
SHA512d4406f2d6fb5a997c5ae56e1320b9a59349ae05ebc22d21cf055aaec488aed41d768124a109b4ae2bfe4dcf7859ab0434928e0e12f8ae68b4cae1b67ff3a4c85
-
Filesize
5.2MB
MD51e341fa008cc6beda13b67ad2fb7aa4c
SHA19ea3f5b84d156d916c7d00abd8034632077a34f2
SHA256f7e046a8ec1875065ef8386560fc61a455890b9e1f3be363db749d1297e0369a
SHA51267fb7648dbef09dedcc498d43e2ecf0b62f7a6dfdcce7681c7443ecf6544efcaea262693115b6991108e171dc3e6442e83b6f85eb70046f4e7d411dc0e877e1e
-
Filesize
5.2MB
MD548c18129c96d33303ef85f5825d8b267
SHA15489367f6a37c8f4051c40f8cd46b398576680d0
SHA2565909dd973ddae6d640ba7181691acc3d9b4a6944594ea64aceadd9aac62553a8
SHA512239e731258a45e8e1116f452dc30d50274834d40f5a691833f3c733973a48a001a077d2d8ef7a42a7277beb1eba9f1e5a5e00a9055ad1a9afcf331a09e08726b
-
Filesize
5.2MB
MD5e2822145b74ad7f675ecddc023ba76ab
SHA14c178e836b7f89a499674cee81815ec45b5e23ae
SHA256a8ca9a92ab08088e5690f01d1b7227b6cabaff4dec2666bc4a5bf3d527af5911
SHA512bee41481af0f9ba6112aa95f0cb5b3f2e5189a90f26702e5485286eac246a344b19c40a1078e22737ee973805885f8ff5c3cb654ee5dea8b03e35e7001997825
-
Filesize
5.2MB
MD546882276c0d026f0ebddc6ecbfdefcc1
SHA1acc1be2a39dec6b0970840e250e6775ac2867d7d
SHA256c81edb4257aa079b037d4fc8dbbebcdb28a3406612992041a37d3f1ef3742aba
SHA5129583561e2e3255d0dcdb4f4ae56d763ddfcdcb834ead30d7dc0cf499607d56f505dd7c1eb933309a69bc1037ebdbedbac3375b0ed581fd6b587713c19cb6687f
-
Filesize
5.2MB
MD5b61c019d67d576d344662ada074de735
SHA1fd3e9c9324c7acfbdf71cb9afb9d0d2fb85b872c
SHA256d5beb086f8cdf176de1db7c18f5b908849e9c8e8d022a03f9dbe629eaefd104a
SHA512b27fd2ec54f4b9baf839cbd01205c75c0dc33f916473881688d5243f4e8faba242d39c626637416d5fc99bc0cc4be5db685f40af638930c49e208c4f465d6166
-
Filesize
5.2MB
MD58bbe9e0a909eadc14b7fa63a1a0c9607
SHA181eaed40c146445efda661355a437ef3dbcd4d92
SHA256045f13e28c3c3b2c8812346efa7b4a6c8b1650c8e175ccdafcf526e5bcbc01e5
SHA51207e77e19b1f401c93ff03fcc8248447e237fe2807e3bc0dbfa5311b03138409399d49005e649c2ca2e00233297f83be1b33067cbd28419fc90ffb78f7702ccf0
-
Filesize
5.2MB
MD50736e83ededd84f0c140a1972256fec5
SHA11ee33a29dfe73e7198443f74ecade6065aa01a29
SHA256c576a0ed41f2004466399c46bf901640572ffa0cdd2542061176b5a11056b533
SHA5128a06b433c0eff43b9608c76beae770254ae36db00eb573368a4d05a1ca81f7de9973dddff65aedbcc8994a61f999557953c40af29ec8bcab8d93474390cf2534
-
Filesize
5.2MB
MD56782356a6f1981f0531902bf2bec8ee6
SHA1b6934b0a5e3772cf4d02b0ab26695fe5f8784563
SHA2567049219c27bc6b7ab03cb69c302bb97c35969fedaa501183725bf0b7c445a3fd
SHA5125f25987dd996ff5ffac999052e86c517bc67297de297ed3558e8eceb2c611f655792c5b848dd0cc1927e434992ce1a5ee75bd6cb0b6c95d4543934feae68d501
-
Filesize
5.2MB
MD5c98b86fd8c712498fd17598c6fe1f49b
SHA173e29b3e056364cfe36f8d95e2caa07635e2fe13
SHA256920975df33e1ffd09052af0a590ae5e1d53dc8ae87633aa91e9ce7ac1eaf806b
SHA512ef62551d6a04bc6c4b83fa15cfae414ed31e7b8213297490f2b62dbc840a2ba4362c0aa81b4d432fa51e678f62a06e40906a75c0431ab604b2bafc50b578c860
-
Filesize
5.2MB
MD516ab0d023abaa564682fb6098603e03b
SHA11c49ea939233088a96a78e25e56144a4d11e49ee
SHA25657a23ee9664212a9dd761ad5af49fb0c8efc681b14184cea6d9cbe1df403312f
SHA51200342a19fe6cf959659d5383fd22f40ca1aec2e8fee2d92e3486f445c57ca5ab8e49164c9cc9071d86a98750dfd35a59461a780fd1e867cceb201a40efed8121
-
Filesize
5.2MB
MD5188db93c7c8061e737a1a4e0860cd936
SHA161e1c4fb830c7edf8a7f689e63ea658af0a30b00
SHA256a0049a77fb313226143ee02253062a4f2e69e169a5a47e8cef2513576726e864
SHA512050817ce82ceeb8834c60c4c680abd8ef9f9b32bf63ef8aa3c048e6b7447d372755f5f3bbb24b0b873bdc55a8b58cc3265ad6823fc090d42173bd03071e30249
-
Filesize
5.2MB
MD5d0bfe78f4b68e7d987a7fab30bdbcad2
SHA11e7c7c294ee1656a8dda50b4a738292e3248899f
SHA2560b61461439b33fa123da82532da87093872617cec1d67b1cc9e93f7c6c4f0c94
SHA5120cacf9954e92b059af7de30215dd00d6d08c30c1bf60daeae76de7141e800ffad19abb21742bfd189ce9d4a3cb0d3ff14334bdc1f0ef44f4a098f0a9f2f3b9ed
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB