Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
25-11-2024 01:33
General
-
Target
2024-11-25_7a2568097d97419cca5c8717daac618a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
7a2568097d97419cca5c8717daac618a
-
SHA1
81f4fa03a3ffbce688c39a6ce0ff33742fe1f4e1
-
SHA256
a3dc2e80939fd6b64879409263fbdea86f57d16b8601086bf8f19147d2551824
-
SHA512
fe9882ebef4ad7c694b420654e057a5d46855ec3f793908b5aae23aac27e82d7c6cccd6a74da0ce163027a284c40ade74d945f10fd9de82c6003dc69121f4101
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUe
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_7a2568097d97419cca5c8717daac618a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_7a2568097d97419cca5c8717daac618a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LyGKzXB.exeC:\Windows\System\LyGKzXB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CMTONlw.exeC:\Windows\System\CMTONlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FPCVlCh.exeC:\Windows\System\FPCVlCh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAHvbhp.exeC:\Windows\System\XAHvbhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vNXWEHB.exeC:\Windows\System\vNXWEHB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mAkVIIR.exeC:\Windows\System\mAkVIIR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMeSMhh.exeC:\Windows\System\kMeSMhh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfacNWz.exeC:\Windows\System\zfacNWz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FWAaOZf.exeC:\Windows\System\FWAaOZf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WryesdD.exeC:\Windows\System\WryesdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YcNjeAv.exeC:\Windows\System\YcNjeAv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QeCzTAJ.exeC:\Windows\System\QeCzTAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OPzMMrR.exeC:\Windows\System\OPzMMrR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CIPEYHI.exeC:\Windows\System\CIPEYHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNGRkeL.exeC:\Windows\System\gNGRkeL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AKqmfEA.exeC:\Windows\System\AKqmfEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OezvNgM.exeC:\Windows\System\OezvNgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tMDmybL.exeC:\Windows\System\tMDmybL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JgKPSue.exeC:\Windows\System\JgKPSue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sXqCRFv.exeC:\Windows\System\sXqCRFv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vjwbvHv.exeC:\Windows\System\vjwbvHv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD591261ae982442924ed29e68a536f285f
SHA1f5abd9fba83a3f1a682aa9d0f00dc94e4863a389
SHA25686e30a4de50a5621eacfb81df606b8c2491c2aa333a33f8713a88e4f47a6a45c
SHA512f9ae34a368ed5b7d1b3b26b178008786d0d9bcf46d5d50bd4e4960439758d1f9c1085aeb18d25992877aaad1e0de49648f16ccd435962b2d022afdde5789b10f
-
Filesize
5.2MB
MD5e88f23073a53c12cb9227e37b1f382d7
SHA19a3da4a40b2b18ae1d31886e605e7dc2ae6417f2
SHA25610ca02a16c039f2919a7c72c1ba52aab42202f1921e0f692e2730a9a29cbae42
SHA512b1e1a5278156713d03f74bac75078eba065d57f53d634a5dd91afeb8f5b8bcd55e7629734f25801f0b4ffb910e874526ee5c6ed4754eb9726514167a8791fc83
-
Filesize
5.2MB
MD50bc336a36f5c20de12298c2df5ff3f1a
SHA1b39f196f546edc8fb672d6242b8ef83b1d49e776
SHA256f6c577ba0f4e504054ec1bed40938cdb1668c899b0bd999371f0e69cbdd5c029
SHA512fea5b43a4b16f529289c95def4a9ddf355925f51b4d12037b10a9e2a7f1a9b940e063321504b3ae46fed1f2fcd1d647eb4cbfa4320ca0415fde66266973cd557
-
Filesize
5.2MB
MD5c8c15699148f479e0330a51cfd3a3b66
SHA1e4510106ed2526758fbac8bdaa391d7ed871736b
SHA2565d66d988bd80e7e13b66be21c2e37eae2e65f7c92919f197a0ed7833077ee9e4
SHA512f13bfa5bfbcf509c69cfd8ac096a427a206c2227415f72761ac80d5f33a3baca9df0ef35ba10a6252c0482f65d21acac07206568358262d39abf48716f18bf2c
-
Filesize
5.2MB
MD57d32648a9fd8f8fed7dbc7f4cc5b3910
SHA1266e69681b92d32eac863b61a4565bb066d4c4de
SHA25642fc3cb5f7d8dadbe842cdb96b490880529c28d0c441fdfd24b30e18b4b14afe
SHA512d097493212b5f266b4389e367fd82760076b7e1fc41912ed71c65c9c4e730ecf58d36a8e1df3e708aec1aae6c4abac0b37471f5e8871eb55f3da3ed430b2408a
-
Filesize
5.2MB
MD57155dd1ee96b2a7e3a012b99159095f7
SHA10ecb2ab431ff7e3bc9c7fd74346bf129f6a5972b
SHA256c7dd174a60ca1e2d740041667626e68a3a1c7c265c6b8c3e496ff26ba0183b39
SHA51268e3a3e93adb9bfc5c30789044e312eb827b1df1417b0c6652dbe0810c02f34692074fe8eee137ef4371b5c964b4f8d91c8c6b05627dff0a83641f3fd8ae5dc0
-
Filesize
5.2MB
MD573e5276a6e22f5d86e8e56d5dadb33c2
SHA167f303d59a260d1a7d6a015f3b35d65e3829a1eb
SHA25661be27277b67f2da590a3321796824c208bf4c650fa63e65b2a4140f40b094d2
SHA51253b590eaac9d30fa66259f678b03a862fe6d7b7fb2f3657c6b98d5b4f80574453320eddc13eb26162fb9f9f2718897e88e8a746a7b1542c4a496bbc90ce2b923
-
Filesize
5.2MB
MD582c92412147e5ad857ba129a09c0bc79
SHA13035dc56a6dc315d6091c2996f38ffa21f7847d6
SHA256f1ee5076f9470e5f7b3d64724447858e1b654beab098ad106285c2ea947c3169
SHA51229a2a1f0eea827fd1f4fe88086309f19b2573bf7da638157b8600e5a179962e64f8889fdd326f4e376fb01422be379b400ad521d4b76669fad656702c4bb656e
-
Filesize
5.2MB
MD5e65480dccceb84b4507d469b57c9a88b
SHA1fe2ea827456ddc41c22c45730fa28e81b88253d8
SHA256afabb9f1025abfdfe0dbb9be5043a130ee792d933489e7774305ab6ccc862daf
SHA5122448aa8388528aa13b380856e5bb6c476933fd0b94c8fea24f167e1af26b6b7d5489636e2b6b8581b4fbc0200990fa5717f699c5082cfe990075e0d2f310ac71
-
Filesize
5.2MB
MD5e191511015960f93d8f36d5d500767ef
SHA1398846e194c71459d7dc491565aa2f8fc466dbaa
SHA256c3f60efe032906bcf3a1a8d75b33f4dbc17a7fe404301db2a946b7c728f1398b
SHA5120bd431cded17d4030ef82d0eef48ed51c5fea71dc2945ca2358d958fe27c4fa225e9372fe2cdc53175033f11050302500fea199baabde394b0a8360f4fd60cd5
-
Filesize
5.2MB
MD5a78e463c9fe3b04b55ead43a9a89f90d
SHA1525280f8ce0bbf694f14de1bfe75b738e6fdd4bb
SHA2565853fbd7aec3d819761d9a1767a74150198aa4bdb67cc8ac743938ede16facdd
SHA51216aae137c31588e405f1c975b86327a2e1c1de9f06b7bf9a10d22469b6151769cea5696ca8cce9bf09425be397614585fc6606f4108615235296de3bc639ec52
-
Filesize
5.2MB
MD5251be9797d59cec81a57aeb759f24c31
SHA14525ba8c1707069d266b5a6b584053ece5316cd9
SHA25607bfeb02716ebcee349bfae3e3d501381e6938ecafe6572443d28ccda5b04e78
SHA512b501683264dce5643b9f6dfbb3aeacb3ddf6e5a599d263f4809bd716ac9fa52dec0fda553de52e8c149ba507a69b178d0db0f044d9aece511fd5b856029660df
-
Filesize
5.2MB
MD536064149f2d3730e4102f342d252ff25
SHA16ff51e612c236d8da668cda6ae206c8c3b96daea
SHA256db76a1c9ebb619d4bd7c0407e7a3c9387ab263a358a404ee33a5a2ddb63672a1
SHA512ae1a8c7aaf6d8fb9b2ad070fe1b099024373158fbdf3bce452abec37ee0cde88c29e909c9654a026326b7640280eda37114ec1b93e220601b3dc336efe73cd31
-
Filesize
5.2MB
MD56e5c53196654ae08afd2b6d4fc19e363
SHA1002bb02c33d6d344a586ea874521e3f7c95b458b
SHA256a3ef40860fbb79ef11abb3deb6dc7857d145f48f98a46c9b3bd6743e7f09a83a
SHA512c73a00f59bcfc0ff4dc7d859bec1d42be7cc8dda75b11c389fcb68899e1353c6c434187ede1a3101e6d27164a19116229c68080f8a33feb01314acee95d793b5
-
Filesize
5.2MB
MD57319745eed906061f039d82f8dd726c3
SHA1455ab2fef5e40ad52a78b13e0cb610d933f7aa63
SHA2568c6e22ecf362da0009c021a1f58e7fa1d2800b0cba9d2cbbb175d706ff2ab4d8
SHA512bc948212b1cf57092959a6f2b54c83bced435877d8188dac7bd518acd2a457989baff5b48886db691fbfc696b479d23924b3e87e308f92cba3aad35b7081ce10
-
Filesize
5.2MB
MD589b8e7404ced57957204d634d48e4fea
SHA16c196ae507f66ae0b7b1cc820e45a3d0b7a1faf9
SHA256494faa4248522d267aef31b0ccc69ebda410223dc5042d99a5e80d0cd5ed4ebf
SHA5124aa98fda236c0dbc9fd1f8dc18f533dcf2f601359a66d8e380a783ff7e7b96c1a2460f371ec7378417a4a2a1c80bdc348155c55e6204528aa67fec049354a3b8
-
Filesize
5.2MB
MD55f5dea45c50b730753295ded3aed65e1
SHA1f475744c41787a2508491195273b4683e25cdf96
SHA256c5c0aba1554079facc5bb9371308d2b597450a515d398cb93ec0cafea1c7ba46
SHA512712b13dc98bbf59ce0e9a4552cf4dc4fca97207d448fec879dc59b143c2efbc0ea8410b7fe8c2bcaf5be039b4a29bd46fb659e1e3c6167a1f413d74eb93ba72b
-
Filesize
5.2MB
MD53d77caebd3676f6a6a97a4cd9f249849
SHA1f48a9f7561f1d75ab3ee5df93d6c268f1d547202
SHA25665ff3edaf5fc23ad874a0842f4889280040dcec0dd4684948597decf5a454be0
SHA512c67f9050f73ee78217790f91899fbb34b1b61112c6d807196dc42c27728355ede864103cce27438e2427d984341be6edda8b75f167e9760e07ddb3d18dbfe301
-
Filesize
5.2MB
MD51084d6676dab4376287aef910a88aac1
SHA1e0d8a62facf873b54ea518c6746199339b2f6fc3
SHA256efd1372839deebc159ac322a058ed5c50cd1e7c41854c313e42989ffb1070ce0
SHA5124082ff8b49481193a0b733c20a8fce9ef5ed2a5266b6349f8906dd5facd674298ee9cd958bc1fa42bd34ec335de527eb1af6f5eb89c03252c70dee78864137f7
-
Filesize
5.2MB
MD54220bef6819b47df37336ee74e6109f8
SHA10a8e6f4c44a4134950ace965dbc3e62af54f75c3
SHA256a9003934db4f67bd6040004b64e2e4dbb00ebaa46487ca06e338073fe2a0e465
SHA512ffcb0d330a9384881e5e20a64126fbb93caf9b2a37349e5d26c3cb82c5dfab9462a0bcb4f18f82ef396d57810e7c7fcf737e5b1e1d1b42b33a3c3275063ebd52
-
Filesize
5.2MB
MD52bb3aec5415f841ca63657119691f7cc
SHA1627f82bc3ad558dc8fa831f21e720317029dc8c3
SHA2562cf260f83d82ea45dc52c9dc44471f495b0f8ea15969edf7db21f75536f7319b
SHA512c46b78db20413c948bcf69759f93bb6e595799cbe336a79d6fb0102f408be58dc5552ce0bc5aef73ce921258961d06ed0db96c9ff53c8befdd1af7f884fbbb2a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB