Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-11-2024 01:24
General
-
Target
2024-11-25_4d12b892da437565632f3568d7ac510f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4d12b892da437565632f3568d7ac510f
-
SHA1
a788b7866e73ed0def7776464facf0310be9523e
-
SHA256
39e0db56bf46a0bed1a9bd8b46380e381f3481abe6e4688ffd5867fc0787c93e
-
SHA512
4021afac51c7a0611f2a6230b625d993d745f9f8403e030991caf146bf3c575e9cbb0a6a4e6fff007e14baf1dce1f85f442ce33198a09c544e668da4aad5a48d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_4d12b892da437565632f3568d7ac510f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_4d12b892da437565632f3568d7ac510f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\zwdkfQH.exeC:\Windows\System\zwdkfQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgmQOsS.exeC:\Windows\System\MgmQOsS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxyLqxr.exeC:\Windows\System\oxyLqxr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ucxzTdH.exeC:\Windows\System\ucxzTdH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgWpxFt.exeC:\Windows\System\kgWpxFt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MuVOTQa.exeC:\Windows\System\MuVOTQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EypGOOi.exeC:\Windows\System\EypGOOi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzgQslt.exeC:\Windows\System\SzgQslt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHfQCMA.exeC:\Windows\System\qHfQCMA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PCQSXjg.exeC:\Windows\System\PCQSXjg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WVQltgk.exeC:\Windows\System\WVQltgk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evxbUFE.exeC:\Windows\System\evxbUFE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pwbluxk.exeC:\Windows\System\pwbluxk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HjDIqmC.exeC:\Windows\System\HjDIqmC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MrFnxqe.exeC:\Windows\System\MrFnxqe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqqGaNT.exeC:\Windows\System\LqqGaNT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fMGocAL.exeC:\Windows\System\fMGocAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XySYBuS.exeC:\Windows\System\XySYBuS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RknCBiz.exeC:\Windows\System\RknCBiz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BKMGeFx.exeC:\Windows\System\BKMGeFx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\urgbOSd.exeC:\Windows\System\urgbOSd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f0c0e67d03a8c03c7cfc55fa1b2cfb1c
SHA18b4b37bc17b7869200ecdf7759bb9e42bb7d1e32
SHA25697f1d3d234af4086febaac90c7c5d2e58d4b770d73666fea77457d295fac1bcf
SHA512ee53d8627eb1fbb2c383de404045fe4b8d118b9c97f59ead2277a0b2a3749a67dc4219f70de17c2a0abee8bab755eb50e9675abd60342029a0d1e00193d06c69
-
Filesize
5.2MB
MD5cf15bc5d74e8c4b5290a91b3adb7ecda
SHA16a1d7fc6a70a718058e56317c2577407b76d7666
SHA256912a321ed769de7fcf027985f8286c2b914ba2b62e6cfa5931d99e6f7218277f
SHA512b8d3f92c99abc84d9d76040f1f3dafdc793ae17f71acbdedba7ebd76c38dfc30af5122f94aeca4e01b10f8ed65b551df870cbeb84fe500bbba6615c99fb5c065
-
Filesize
5.2MB
MD5fe12fb9325950e9d177c55a2050146c0
SHA16e5d95d210bbb77e1364c3e486473a4fdd12eb27
SHA2563e227d11933247f6e6da7cf26e5d25929285cfaa0aa4696bac1935da6ae681e3
SHA5126bbe675fb47d2d3323dcaae3e3415855c07aaaffd433425e27a3840ad4084701db1af89f8e56b41d2678feeea055b7e666ff127076793fb5e12b742de79624b5
-
Filesize
5.2MB
MD53fb448ce70a71b8cdfeeaee121affd48
SHA1e1e83f3d5cb8ae06187aac5b2d54d9e2d444a8f8
SHA256e42cc142419d498a066d9b6e82dcb0b932263c642f0b079575f72d0efb23a66e
SHA51252b2e8e3154f44574ae6c277f58f6c4193d577c4d142e6be9e7629f8a542cd471501eb4f73895536c240ef2d198749689a9c359285e7d5a33fb2cf3ccc61c1a5
-
Filesize
5.2MB
MD5ad7c95daaf1da4bb3fe3237cb2edbc27
SHA1014af3191363e630eef985931e9c9b2618dddb97
SHA25676206d4668e1cb633a89fa5904a1af01cf7330024467a6e24181edfc93f41ea6
SHA512f1226286411724da5bc96126277e2aaac63bb620fc354a3b51b77852fbbd3d87818b1a6677e17556d8697e79dc5e81676d468e3197175928eb3054c15ca76ee0
-
Filesize
5.2MB
MD554608e11997e9a4123dc8d4440c24c7c
SHA1199e88b0f16af6d79897ee7054b9f9e7068e202f
SHA256fc98b5f6e71f6a4df16368c8c092ebf1d2e2f8cb6f74f9bafd1356cc3ad23ded
SHA5129171c67ab862ff901316720b017c920fb8a121301d811e4291db8b23cfaec6ebaf68f20e58bf78bf35ab61678228163328a2034344d9c4c8790047ed78e01e8b
-
Filesize
5.2MB
MD598b06a9d9a7c574966bd15450e23e06b
SHA17a9a9cb89f2584b3d5b0f38ed0246ffdf9e393ea
SHA2562a087230aad0e0bd8fdbba00b7f14e8a9f1d22f6e2ad1661a88c7046ddb7baef
SHA5121811adc60e00ec200006947ead908e1b393e46b742eefcfd204a7d145926645c1dbd9784932ea73cb7c91c44bdc2bf9c5dca8380de24491316d5a24a1c3490a0
-
Filesize
5.2MB
MD5dea39f0de13a38df28bcb71f321fadaa
SHA19d4d16d0c240a9f9987f0863b35e019235473865
SHA2561973c1efc9592d2973648b5e9573dcb40ac7736be604daf1f5863a6652ae42ce
SHA512e8e4002c2451a0ec94464f07cc10dd59d34480a16c677331f8f5c498041078ad45507e3720b5c01ac88b69c897f895015428da146697fb35ae1cb7cfa087949b
-
Filesize
5.2MB
MD5feabe4a3d849e4a8d6989c35a831660c
SHA17469e7f2908280363b33452aa614bc28e75156e1
SHA256607394304384807f85c23e06f30e8dba7e5d092619fa980ffcc90c4069d109b0
SHA5123574c0f1aaab22cce433e5e2c1d94b0f67e2cb91f562d24bbf4ede1fad33c8d77759bbe4db87d7f9ea061dc7f5b5a49ab6618409b755adde5e4ce1ba828847a8
-
Filesize
5.2MB
MD5291256c498a522463489bb0a877f0c38
SHA1f16ea509bfa4cdf9c18332c450cab0540bda91ff
SHA256f9a938735107b833a65925f4ae59d260db5e65ec7d0dd0131177d593b5750b71
SHA512a282c8e48b9056af3521480f100034d5ac2750185cbf676a62b2f7e4e5a5670b8d1e90c7ad7d07061348098d1396b433ddf39fcc15e00544370dbdfc470b033c
-
Filesize
5.2MB
MD523b10bd499a1919ee6b8cae4b63dbbda
SHA11d4ea0b3e3bbb1553bf069fb5c9fd3df41f18199
SHA256e9599a02fffde9f3a761f6e48eeaa6c72bd655b394ee092cbf5c9b8af6e83511
SHA512350bbffe28971fe31edfa25839abc7be3b5415185bb9fc4a24e178471db326256d28599ced3372c788d2c366184e0b6dcb0e9d59fca4317f6859e0e1b612a9be
-
Filesize
5.2MB
MD5f95e9d7a0b5a50e2207359e0aac53a01
SHA11625f13c712620777646bf681b640e86d461f066
SHA256336ba2c191867e7c377f9efcfaa5a6fba77e1f2629449ec8b6e2abe8aae10d58
SHA512b520102a9fbce6dbca620817fc95e806130b6a87ddaaf03a0ac941414cf5e67984fedcc8d1b39e347f7ba274400928987726fbd064850e48fd6509ca3efb964f
-
Filesize
5.2MB
MD52df886cf8df0dd7b5d71b642e838e242
SHA108bb3c49f5a00d7d018f4f2458171c5db305576a
SHA2566d750d62c0afea77b60b5586a374ba77467abeec554b8cf78e00b4df6dab08bc
SHA512c8e1ab11a574f31c670b499368f077fff60239a9324d88b16f1ede34de6f3a93e3b8f0e93bab7f111a426a7c57356998b527cdb3861696308077fb0ebed17bf0
-
Filesize
5.2MB
MD5f38f7cdae425617cc669504724ef6b33
SHA13fa80d011f46abc0483c7bfbbf2e4b717ca1dcdd
SHA256f0a2c89773a5637061bd8469d69ad2ac823542398c6091aeebf540981805b5f0
SHA51286aa847577f39c8b88f8ec34dc9ec6b37913e3d88d50fd7b8a6d14d3321b1363285c418ff75869025e4893fd46a5d018eb986eea9297f5a582946bdd7aec1f10
-
Filesize
5.2MB
MD5b43bb0f38d4bcac2aa68140d50c5feba
SHA19fe191c11035a5a7991c43d58522b6df358d26f6
SHA2569aeb5fd65d4e1f4e1dc2e8eda2f659bb9286bce3efdb20d2f6c7068310cb210f
SHA512831b1f11db71d8d87a11b1c027cd111258ab8fb97cfced3bb7b68c067ddc4c9b524184988fa06af22f30ce24cbdfb0540279fd3a903b82d9705cebbc831234be
-
Filesize
5.2MB
MD532380a66249a8227d1f359aff0c23b3e
SHA13b8bb89d4a979464a56fd1f911f5ad7e3eec0035
SHA2567405223c08fe7341f6cb8576bd260f031b2689d0a48eea0a54ba70095c99d15d
SHA5126a186643d6e0d28ef1bb3783fe70377d5a7c190a334268eb3105e6e2af1905ea39d1e4a35045f2211807db9948ad24df66eef0509b452b30b40fd5bbfe62099c
-
Filesize
5.2MB
MD5395f12aa9ce819d6cdaa3cfa091fe0a3
SHA143eac30f5ae47230492803636185bd497c806082
SHA2565dc8ba23c423c384b6244477e0109c0b117d358b9cab85b94c1a1e618748a50f
SHA5124be093d82b41e346d3875569b5dc10188f8dfd6fa0b85accde90bfdc8fdd7812730201171ba34ee0e5c88e3f7c92ff7ed6c10d3206e5f4a95a12bea5eaa2997b
-
Filesize
5.2MB
MD5c8867484a86c216f7f03a273fa9f8d6b
SHA19e1c86347f46f06b9cc5bc3756dcf7c497406b11
SHA256013eaf55cc18ecfc3785f93bebee5c408001b0b48f93b167cb4549ec5fbbd184
SHA5128a7933ac065b99aead4cb6f348ada8a5916cb1e567cc75415b4f757cdd1ba28698a9b1bcee0b4d61626e0a365f28a85870ff47984479d5e18be77b187a130c5e
-
Filesize
5.2MB
MD54668b88143274fa12240f1335f479ce0
SHA1ec6f9a2e8a49358f406a4b30ce139864d7cb3fb0
SHA25685a1268db0bc86304be0707b15f0f4def82aa675296ba32008b34571bf9e570e
SHA5121b5e172a2c660d7883bffeb0ee56930ee17623e883d636edac7e991109284acd02dfdc03b60c732f153a4f9b6fc194f4bc71c71a719a6dd5926fc5020c39e368
-
Filesize
5.2MB
MD5a71e48d116710a818bd01e3b770b2b45
SHA1ae62d2f00f09cfc484400c6cbe11dd1e7c8e401d
SHA2567f7967bb146cf8fa895ed2f215eb9ddda71828265a30acde82a3bf5f128341dd
SHA512599c24c87c147eb2fa50b29d586a9d78e3be493f644862b633b012e0f85729e46e5f91d5c271c2cfb81644946e564488298f14062919dd911557adaf272a015c
-
Filesize
5.2MB
MD51132be250bce3a6c9178b82e7c5c3e23
SHA1e8cc4a9fde4e54d3dc6359d8f92cf8f872a6789a
SHA25695bc3990d0b3e04d5488f4cff6ffddf5d148218c85d5b2c6a437b6c244bada46
SHA5126d578dee9ce48b4ca36b90242da2d3c5eef716315e3a745c5e03a6d5d33f84356e44bfd8ec076fbbafb7296fdd506ed4aa18526272a103da88a0b7c886e078a0
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB