Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
25-11-2024 01:23
General
-
Target
2024-11-25_3f19af8f6c01b6fde64e518f668fc945_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3f19af8f6c01b6fde64e518f668fc945
-
SHA1
72090a5d32f1e0c38af79d1d8ebe68cf3e163d2a
-
SHA256
21895d473309e516ee288ee62443a0279f03334ba41f55281b3f18217c875a1c
-
SHA512
d5d962adc800bd4d74fd120eb4c660c80c5ada689844ddf4ace1e29b31d1582760f1872d33028c243cb3e35e9d52597a9aa7daaf21ea81b0295eb0d22c41a369
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_3f19af8f6c01b6fde64e518f668fc945_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_3f19af8f6c01b6fde64e518f668fc945_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ItPFpFU.exeC:\Windows\System\ItPFpFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AsGjmMA.exeC:\Windows\System\AsGjmMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVPAucf.exeC:\Windows\System\DVPAucf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKtkQAc.exeC:\Windows\System\fKtkQAc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sVsDVjn.exeC:\Windows\System\sVsDVjn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZwQAcDh.exeC:\Windows\System\ZwQAcDh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ToKlNzQ.exeC:\Windows\System\ToKlNzQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bLIcPAb.exeC:\Windows\System\bLIcPAb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRXEPst.exeC:\Windows\System\NRXEPst.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTaeZJQ.exeC:\Windows\System\JTaeZJQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OiNpuNZ.exeC:\Windows\System\OiNpuNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jieclur.exeC:\Windows\System\jieclur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BvMLnLM.exeC:\Windows\System\BvMLnLM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfasdgJ.exeC:\Windows\System\zfasdgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hRKNUgs.exeC:\Windows\System\hRKNUgs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WiYAQkX.exeC:\Windows\System\WiYAQkX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFPGfRn.exeC:\Windows\System\sFPGfRn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GwtbGJU.exeC:\Windows\System\GwtbGJU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VtrmHXD.exeC:\Windows\System\VtrmHXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZLrVrht.exeC:\Windows\System\ZLrVrht.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DuVxldx.exeC:\Windows\System\DuVxldx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5af07c4197858ee8ed7e4c80ab45a5927
SHA136afd4f473919e837479257285419ba120310833
SHA256821b3331ac9a63c933c472697a0b6d3cc5304f05d9df0b36dbc1d9c410ae6722
SHA512cb3e7a76ecbca625be0f2e8de97ecdf4988b2e32202f0d5c6044ec96ddf9acc9f8607afdeddff97b9d837508c730fc16341a814d10ca50ffde3d9eadab7087f5
-
Filesize
5.2MB
MD5b50958f584d41a4059cfa0fe128991b7
SHA106df1e323505561ca6de77d490880a6fc4fb0a62
SHA2569c146df98813d8500b012f5c3e63fc93bc73d39cdc96a973d500b7d89aec767c
SHA512c98c43142a9b29b8fed80818b5bc0dc8b3b6baf6c85c93176fb61a5f8343044cb201f3e9773380e42cd5afe07e2dfe1d78125d8bf94c4f8b6e87cfad1262193a
-
Filesize
5.2MB
MD55f50e631516950f27e881108a65257d1
SHA13565cf2c675cab661593b7a0782eaa756a3928a2
SHA256c6454b136337e64cac46160cc7062b08bf9adc933f7ebcd26b6e27c1caed31bf
SHA5120b2a95b0f201706ff4f06ddb4820daec97b9b056574d26396b0d7116ef19799cd3881089037a1c0196e961a2acfed0b5c12707ff965c6cfe46b010c6cfe4c32c
-
Filesize
5.2MB
MD5f964a469b26dab9fb00951c67095b405
SHA1492ac7582ca08ab933349344d7a605826654f939
SHA2567aacd8024d6f9589bd638cf0893e1cb0b816428038ce8d232b832b91df005dba
SHA51232799ac657c3d7119e3d7467394a20b1fa48122ff725f506dfcbc1ab430e64ad92c1a7873c04cbed9bb6d516f10b5c2f82438801e30383a076be61a0d502346f
-
Filesize
5.2MB
MD5787b9b5488235caca2f3d28b3d1a9be0
SHA1e9b97a67f3883ac4f0b5a867627a20774578d3c5
SHA2565c9e6101af3333def9c3d2d791e96c5e5e211cc08636e7a7ade0c2bf4d487618
SHA51287daacb73d9c9689639e6cafcd7575f5e7d77bc5c695a96b54387c0faa8361c0802c4504c69e38f50b723902e041901cc63f3356d8614bfed3418e6d27b613ac
-
Filesize
5.2MB
MD5dc0f6dee046739fa9e2912efb80f2630
SHA11d133c382b809eca99bfec4013a6837c22cfcf88
SHA2561ee85762182efb0f418d25302918a8e61b696a46fae0aecb9112d729227d0ac4
SHA5126b506fab839f2abf7e948e2596e5522030f9a219387428523e44f322dd0ac8face6462a00723dd9447e09d4fa4e48749c6ac100f8ba8b7ba838e9a4676f9a48c
-
Filesize
5.2MB
MD5cb4f9091222428cdd500ce17efd9f599
SHA1f33cdf01d86c0c2515511f34e843478ee14cedc3
SHA256234707425c54f5c1c5354f99c4bd37f4aa759082363ea627b4a85a61de29541b
SHA5126617615b587903df5a6ed9975e80676c3c39af3d3e9763333b05898a46ed8185e9bbb3a4d1b3696ff4b83d0e8853b2a096e8c08d2e049e848417f1d8be74a827
-
Filesize
5.2MB
MD5142c0f6be2a2d9e3c121e94e5dc9e900
SHA184c4316dc6d9080f620c4087248e7d2465e38155
SHA256fef914ba8d60d9091b6bde04cab115ed8aa6c9120a20918639c658c98e3ad107
SHA51228536bd9a5086ad8c3c26a59724f7c408a601e25f8ea42d20e1b493b6b03de9403be9129c430743b3cbb2365af79986b63f913308354a88352b184dc3aa4ec66
-
Filesize
5.2MB
MD53ad5568413da16f8172caf50827ac69d
SHA1f9fce96b87f889b777c4e969a5a04e3fba912cd5
SHA2566666e0cd50376e39e3237116ac5a162d2fa3be72f5b8fb93c65e0c3e3ebf62d7
SHA512f78032e8d0c29d9d7ecd70499ba6fb4f7ddfb0e9bf60ef91845547b15f4e5cd6f82c8362e147455c6d6205b1d0dcf3f46917e78b4c5d528a422938f4ab05e8de
-
Filesize
5.2MB
MD5ce83bcd711e46d6f62dc18e38c4cba33
SHA127251c64e603c781489686e502dbc28e3afc912e
SHA25644b70334e26d61c7e5ca4b532f65fbae44e30e9bf20a4b869a4cbc1741c55787
SHA5125d0a7aa567174851e140a60e6cbbf40bd2c7234cd6d57fafe73bfd7846fc9d11fbe887513b8bf6234f0418cc01f73f85dcf1fddc312cdb92d774021b5cc94140
-
Filesize
5.2MB
MD5345ba7b906fe04b908c6d3c93a63b3da
SHA12492cbced0a93ca9a89c011e323b0aee356d3b1f
SHA256ab4ab00d28063ff0669c113efeaf851b20f035b5a64ff9365e61e71211e11fa5
SHA512af9335917759e2580573b34a8bbccbf966eae26c189b55b428399eccd153700b46e029af7807c2ed01c51424fd078604862c5ef838b7dbf892d282565450b705
-
Filesize
5.2MB
MD59f7bd66b896177b626aa2cfbde37387a
SHA1d3f4fbcb5a9ce7330a1cc2b7cad5fb097b2224a7
SHA256d021545194636d2d36399131745230c6c4e1f9a3822c539cd64b53707c0b5652
SHA512fdcce063a797974db8f0539556f3f5404f234b60e93eb41f8a05927e935bbb312dc36ae1d8bbfc43d6fb6b507ba5c240da96f4212f6a59fe1ac9d1dbbb5d8e94
-
Filesize
5.2MB
MD59e443394eb4a612ac87e840e4d905c36
SHA1423464739e615e3d8054bd5d041fbcf1ec2b3d5a
SHA256c81f417c605001c7dea87a2187a0ab3a0c1dc33567c9c96823919c964c4aa621
SHA512c02dd626ec95ffb9098f70696eaf89789236bcfbcbd66debf3fd9a0c7d24d03c73d761a60be820a7bb5c4330a4bd9fe539f81a21e974cba20877ee55828125fe
-
Filesize
5.2MB
MD5e057b80be86d38d8f047d00a8f990b72
SHA14cae3c62a20838500b893c2903a91ca6f69f68d8
SHA256dbc91311a56447002098fa1f83b9e2da9e9ce5fe8d5cb4a294ca4e80273bf58f
SHA5122e3675ba1f7ed31e1dfe7042ac613354327dc5de3dbd865a4470bcea456975af799278dd037c27182bbbdeeb59a7901c95c1ce7c259104e7134cb557e5bb516e
-
Filesize
5.2MB
MD55c9b805a195b41ea8e64e23a95d794c4
SHA153f14629b57eab98b2f64350fc22097c70027d57
SHA256dc232ba9e81c188caa9c3b8ba87d3f2a6d5090488910b055e6d3ff5e2f56eb53
SHA51296c1813e22adcd58e291da48776d56d58c6041432ab81d8ce8aabd95e565f4433f37dbd83a1c5463f98c9005fdc2177a6a229e808b93051f35f033638d8dae85
-
Filesize
5.2MB
MD5b25d6ea0b3e8f9d9b1e0ba466431c793
SHA177bea0e4f6de75b6f69b6b7d72ce17fa9ad91479
SHA2560ad87e1288a3316ccf01f2e264e2e235440869c9f6486f68821f158d1c9290e1
SHA512ab23246649b5c55b494c4395898207fa9163651606e6aa2d44c793ae5a160c4d59eeeb0982fb0f41b4c1927c017545c420fbf769c9b86b882919253906f79c1f
-
Filesize
5.2MB
MD578cbfc25e23fb5b794fa1b4ba07613f9
SHA1df99f44ac84ab2469fe695cd8824ceee97278b7e
SHA256554cdfaf67940f8f28aebc05132c0f9828d11d745e2ac39410ab149d3b7671dd
SHA51239a198e98fe6b6c5a2ebfd0447da1fd4c7f0b02eb536a3d73946d2a42864475cc7a4384c547c79dcd53b8d33a65a1fffd01b2dc40b6394c9167db63a74915d40
-
Filesize
5.2MB
MD51b6cc18e8647f2b36710523768c77143
SHA18ebe5188bb07022eca4297860a0dcf848507d67e
SHA256991432f3155050677462ae74cff296cad19174ed4ef9fd13654de34a37c186dd
SHA512184c65be471868b7650b69add3072126900bc75b5dc228ae2604596628886272241923e623c409d1ebc002f687c826538d971fa26e4632a40f6be9e2dbefc6ea
-
Filesize
5.2MB
MD56cacecec9e6fa1d5b07aa8e0d7dac271
SHA1051b2f3ca7e096a3fff74bae4a0595062d3c3df4
SHA2562e8f69317b2bf87ac7d5c2e4f6dc0c20dc509adc4c731507a02b5aa6b863daa6
SHA512ffdd782bbf13f4255a8bfad2f7c290beef0e205cb57af1fe5b3f2e6f105e5e3dfeac95fc2fc6d855ae5f093aa6971787dada9174332479118df4d5a551e9784a
-
Filesize
5.2MB
MD596b334edf595ca3b62a2db7321de7c50
SHA13ae24d9b7c13a806c56470ae478ef8bf864e2e12
SHA2563ad9e00f5d666d5458ea0034833aaa247bd9fb39b30ddf66793fe58ccdceabb8
SHA5123517a51524949e710d29bcd793b01788845a5f04055b13d66a8dabb1eb32bf7284a0c254d4b8d34f93792290752267e603db84fdaefc7168f57f65509889f5fd
-
Filesize
5.2MB
MD566bfbd3db63e165a72990c68e77b9b58
SHA1273cbdc0fcec46f553407401fc40dccaf837e33e
SHA256f0dd0855516dfd9d0dad4a1d4831b0f9f6966f38ccd11c97b5a3615d8a21ba96
SHA51284f8cfeba2b6f9a935af731091ef34ce50d5427bd8efb132755663164dfaf3114dc4de6f8247f36d6c9bdc6d7fb53d6b8aed1ab6d2cf82ceea45d6e8a7b0c5f6
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB