Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 01:23
General
-
Target
2024-11-25_455f65ae3c93ffc33301cdb091a6eaee_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
455f65ae3c93ffc33301cdb091a6eaee
-
SHA1
f632952563c1262f81fd14699b8479b7d6c7fe40
-
SHA256
afcda3850c50b8399fa32b11cc6b0ba797573b74a330bd37270282cf647ef08d
-
SHA512
a4dbfbee11755a1d4e4933aff79060e939cd8c34b516a11e4d0c78a397858c95500d3308805d6c4b7c4a610d60ca8ba704fe6602ee01c5efa309c53f5518631d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lU7
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_455f65ae3c93ffc33301cdb091a6eaee_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_455f65ae3c93ffc33301cdb091a6eaee_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SjRlfZs.exeC:\Windows\System\SjRlfZs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQoSTVv.exeC:\Windows\System\qQoSTVv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lUDBsUa.exeC:\Windows\System\lUDBsUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhrZwVi.exeC:\Windows\System\RhrZwVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fuwKQwB.exeC:\Windows\System\fuwKQwB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GClxSwJ.exeC:\Windows\System\GClxSwJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dJjdPva.exeC:\Windows\System\dJjdPva.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cuQCkVF.exeC:\Windows\System\cuQCkVF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cxbbwGx.exeC:\Windows\System\cxbbwGx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\grvmsIf.exeC:\Windows\System\grvmsIf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KaHQbWw.exeC:\Windows\System\KaHQbWw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lJcVNWZ.exeC:\Windows\System\lJcVNWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwhfqdo.exeC:\Windows\System\dwhfqdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MKrbOiZ.exeC:\Windows\System\MKrbOiZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLnNnuc.exeC:\Windows\System\iLnNnuc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HvzlJNY.exeC:\Windows\System\HvzlJNY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gyIttel.exeC:\Windows\System\gyIttel.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YGKwbbv.exeC:\Windows\System\YGKwbbv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pJtGDpP.exeC:\Windows\System\pJtGDpP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mbnRFjE.exeC:\Windows\System\mbnRFjE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlDVCty.exeC:\Windows\System\HlDVCty.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5437d9ff0a6cdcf5a5890d2f0b4226338
SHA1ab7feddab8bad3e68022307759b0443b5a9dc0e7
SHA256fed84c9506a250b78938fcc1fb1d0c6651541c231359486f479d7b5181087283
SHA5122cd994b650a9b31ca4d27872505d217266425ee487bc51431b5fb7f4ce563022dbc6c228939810fe799d31f556d19a739177653fd82eed0b1790731a3bd02882
-
Filesize
5.2MB
MD5fe5bc3d286fda9227dbb3baf12daa838
SHA18b35129141e5cdfb2c76ba0e8fc022ea6955719b
SHA256585d4482653b7589f9d7e33a250f453398b543c078e0079eb3d7b76552f8084d
SHA512b58d4da7dbd8d19f178c9460e72e299a648f297f9d79b95c409c4ec9d0b66b777220155e0fae09c0d48c1115577286590949ee2a82b6e774feaa02a553c61e2e
-
Filesize
5.2MB
MD593e2e2eb8d86100dda2e9cc74d37deb9
SHA1c57512a59fd246d3d117c25e3f8260363edf1f89
SHA256a0fad0901ed3596ca28ccfc7ad2754508461015c4c813364cdaa55386ee116f4
SHA51206d8ec791fd74c04b142f24679c5138afbe064bd697600577dfb67786cf43c98adc14a7dbb0be7b35258e24658622a1a3b2f46e6b2e6fc76b64cfb5b467b9943
-
Filesize
5.2MB
MD56d609e8222929f1ebfed6a204195ad99
SHA148e3afe97302602788d2457050db0276c6c13ff5
SHA256880ce11f826f54ea39e5ed666fc3390e78ce3689f0483975d0e6dae4a644716b
SHA512f4c82d85f5f7df46bb29ddbf4856e7ad343fbd4e0e2d26f37bfdb5938e8ed74af1566f7b33295a674187309bb64ececb526aca49017544736289921e4e5dab06
-
Filesize
5.2MB
MD5c79b351206f931ea700ac174d18cb9bb
SHA13ecee3ede7534aa072401d5d207271b4e4322d52
SHA2560345c871651a976d26b04ca40c7c64526bd6dcd758e882e39c017ed1456a9153
SHA5128ad6f0e68f80885f4e630a19e359f85a6c47c77f23de9395a70540d0b42e9e9ad30030a5b2f716a518360402121580a2ab23e3d266dbb393bc07e49dc985c721
-
Filesize
5.2MB
MD5bf9eddfabd807115a2a5288239d9169f
SHA1d5e0ec7752e3e75f84d2a223ab158067b16bf8e5
SHA2561a895a5529b67fa011b98cd552fb5fb99ebbe3696a7ccd17fc4202f80880cdb5
SHA5126f3e5342f9a6c6cab4155fec975bb1cc2ca0957b8b35b226027d72a23085046ae7693a3e1f5050b505865d7a4cf6316e002e2db52382f21d40524a90c0880ff7
-
Filesize
5.2MB
MD5d31cb05beccf82197df4f1522ba69300
SHA1be62ac6f3e8f86b33b2651ab22ab7384fefa434d
SHA2562e421ed74c0c0ec206fa5cdafa0e4d081273356ed79857e32c9574e1f98a3939
SHA512d9ff61d57980467563cec70a749177173c7556e89c5783bceee90d563115a1f55abff4cd7747d32335c56aa8c7119a17eead179881b80d36b96e1ccc2317d59e
-
Filesize
5.2MB
MD54164648a48417d7139f2afd1943b43d1
SHA1ae5d23fd5f7b9b8e8c120362fdf7cd7b069f7fe4
SHA2565c1731b6eba6456b73ac3e2739d04e606f9dbf13e41c15fe636c66b7de706fcf
SHA512b993d39252e80051f7e8835b2464be1b6597cf5df020a93c2bcd5f6819ff1b9a41bec03e75540f54e89428ee651753d74650fede508b94693e36ecefb5182317
-
Filesize
5.2MB
MD5af544ea5961cda77e5a3815276ee054b
SHA1b01f77279de904aaad4fc404411a866246358d19
SHA25644869de9be4a4d2436461220782f30cc5f058adbe359cbb76a219d268deefef1
SHA512909307b067faa19d1f717350d21a2c99bfb79163715cdd017bcdfe03f6aff6769d8b51d7d298696b8e2f8a427b18fd11c7738dbd2f76ac2e1154b9f460cb2453
-
Filesize
5.2MB
MD50c8781f7eecaf60e686dd18664520237
SHA1d3c68c243cbab8478d644ff7923fb0bb876b46d4
SHA2563a58ee5e8aa60cb0b19fd89ff55311136c5b79d7e92985ab52ad3c1bd85f4462
SHA51228583d87747a7a9a5ba0e418a9b6063df3bd45ab3eb975964e4800bdb1dfc18b1b3aec894bd5dc4101cd037fa73aa75810a303a823223ed4ec81a4dc0afa8b3e
-
Filesize
5.2MB
MD5cc4a72f0c130c2c694f47c10476a01e1
SHA1c25d1ee1cfa4a01ae64087780cfad781d17f8646
SHA256452e64c317b094e1090afff1a7e4ac833cfdac2b7994b7ab9972ce16a7b051bf
SHA5127aa0f6442cb0c5ce88e02361f823cf1085af86fca303309a457d854e8461c8495f4126ac371217c49c322eda8683b03f654cdf3a45cef065fc9a715110664d69
-
Filesize
5.2MB
MD59f019d68c47513bba88315996e3e2a17
SHA1ae25c1b2e64daa777757681528aae136f9230941
SHA256c29bffa495a70cc3846ab4fc8a4b851c214b3b6d965807b6cb007aaca71504cd
SHA51255ed45f160ba84c3a6ecd6c7d4b2be8401296008c24b851c67d06d836873a4c9f5c350a96f0e9254e0e55def5100463a12920b9a522f2d3249b994a1d3c3934d
-
Filesize
5.2MB
MD5a5f41ea669ebd6213261a5d9d863d085
SHA1684718a2af559d048818a4f7745c6d6ad144f118
SHA2563485fec1f74a78788d56572534dbecf3f7c1f20b93b8b0ac366d8a0fecc3d6cf
SHA512a44838cad414324eb6c0df6055a5614222f9a1f2aa9fd5b58e6f1779284ce098d17520e91347d56b042de0a7cead120e168d3bf9b3bde22851b3778aeae4f108
-
Filesize
5.2MB
MD5317b35946a7f8a5714a34fd7bfb28757
SHA196b374ff8eda14e8203fbf540556efa551322ee6
SHA2569884ee58857b37c4affffa4039c5773ec653e00517c0cf3dbe1fd3524b829f8d
SHA512254195b1897e0b611978693cf93306c449587213e36b7b58a8b40f217711840b0713356bb0d5e9efe2a6c91470c208cbed1f0a24c56228ae23a87b2c302add3a
-
Filesize
5.2MB
MD5cb1eafb6f753e235d01927d69bf4a47f
SHA144d79fc56c9a1238bcf1616c78e7d60366ebe7dc
SHA25696bb223400bcf3b91a3e6337e380fb112097704280d51d22008cb32f4471438f
SHA51242c55d3f991ea1e7b0452dfa39fd03a23852a577bb7f931cebfb8a6f929de1b02e3c63a5d49d8490aa85c54686ff19b38abdb10056094f225a71891e11900510
-
Filesize
5.2MB
MD527b874625467b8cf1e0c78a03f9711a0
SHA1b68ab98f479fe58306c8b62b40306385350a2c08
SHA25656ea00ae6eab305f6253b48efe87eea7c289d680849cd39df18edd1561caa895
SHA512c21a09b151c174bb6d7353d5125767a9d00a267c5af30bcc4068f3d13bef0154b86d7a1ba7c3a482ad101ae223f221820a46e29cd4f56c215aac97155c41e293
-
Filesize
5.2MB
MD530f1f375d275cd6af586c840ef575531
SHA1981fd51d22bf1b9f5455d114efc75559d254eec1
SHA256a112b7e58254662d68a5724e354a1d08c5c7f803a7dd554e9aba9aae7ff9deea
SHA512f911f929e61bbcae32171089febb34250f50b74051619a597c3bb90a30f3450a635fd4faefbe93aa19aba5bda776e6b134ee63d3c401d95050f56eb0b05f99fb
-
Filesize
5.2MB
MD5c8e60a63ae6f36ec92308e5b21d3b7d9
SHA14551c0ec67f1b5fd6f6a8ceed0bf560043243380
SHA256e97648d6c52e800521abb402f541daa917dbe4eb0efa6931e35fee0aa3aa8319
SHA51254bd99292564cca019feec16ccdb4470d98bd7f1dd0e3bee4a2878a55778b46119992bba08650078d8257dbbdd464c97378656e2b2003532fcc323128dd01e0d
-
Filesize
5.2MB
MD5505033ed2a9e45597bb06e42a9aafff9
SHA1acb8ab9205641b377eb84b6d7f674a0ab34f7c20
SHA256bfad3d1f734c9b9fcecc14e43c99a149064187019197a86654f988d11e18f69a
SHA5122fc82d1695ba10051954a85931194c034a131a8a1c772bee3ad8d7ef9be5dd100b4834b86d1cfc56ce83cc007466cc99df2bb8468850149f35546df5217069e6
-
Filesize
5.2MB
MD5765428b0b816d4c5adcf92f319ff5bf2
SHA1c62bb53d9da8f41f73585fe23bab12403091405e
SHA256ff7730c9ae66b1fcac00500d3e0af503522db79b84cd2a8353fa12d891407651
SHA5123517aa3b1aaa13ec563f502f36886bd896a2377a423a92f341a4dcbf00439f0c42ee442b4912f5682c26ec29e8a088a8d5433fef023993fa5e1cc980cfddd2c8
-
Filesize
5.2MB
MD5713ce8e4f0d781c9e8cbf9e80f62739b
SHA16602a7d69c0ea234892997372c3b3f797938d665
SHA256c8234a9484372138cff131621372852f75a842989d0ca21dd9ef7409d47fb718
SHA512d968fbff2b23b748947c0d1556c3eae3ea6adc0f292f817c47f39021b998ce95b22f82f96c7798d253883ca0ef9d31baf235a1ab4952661ba6f67e17442efd5c
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB