Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25/11/2024, 07:44
General
-
Target
2024-11-25_8a6f6296116b50c1f23c162b292a4c9b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
8a6f6296116b50c1f23c162b292a4c9b
-
SHA1
90b3522fa704b9e6a4a6e968a86ceb8e5c1d4d88
-
SHA256
03878e6ecb183f0a426ac92b425b3166af70a286f2edab7681a38bf20605c58a
-
SHA512
19587fb5459bd5dfa477a66c4fefa2b40aefa54bd0e01842c2363e8f0dd39035742ea9e4f2bfe830c8eea3d24c008665b837cb978628916124ac1ce74c072484
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_8a6f6296116b50c1f23c162b292a4c9b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_8a6f6296116b50c1f23c162b292a4c9b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eqmBzbq.exeC:\Windows\System\eqmBzbq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FymrQcg.exeC:\Windows\System\FymrQcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SkWGhhO.exeC:\Windows\System\SkWGhhO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JJyaulx.exeC:\Windows\System\JJyaulx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VJrQWfh.exeC:\Windows\System\VJrQWfh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vOAuvVF.exeC:\Windows\System\vOAuvVF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TlYWBgD.exeC:\Windows\System\TlYWBgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QaaOolA.exeC:\Windows\System\QaaOolA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jREWieS.exeC:\Windows\System\jREWieS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bJFfodR.exeC:\Windows\System\bJFfodR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\imXoWpI.exeC:\Windows\System\imXoWpI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ODYzchh.exeC:\Windows\System\ODYzchh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qSusoTK.exeC:\Windows\System\qSusoTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aauWBzw.exeC:\Windows\System\aauWBzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmCGksX.exeC:\Windows\System\CmCGksX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMZrWWn.exeC:\Windows\System\FMZrWWn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bnlKfiy.exeC:\Windows\System\bnlKfiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzAeUSL.exeC:\Windows\System\SzAeUSL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mcyARFU.exeC:\Windows\System\mcyARFU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wHvgXXQ.exeC:\Windows\System\wHvgXXQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TeMrEZV.exeC:\Windows\System\TeMrEZV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5e80bccd6271e80340b8220c3fb0b9f46
SHA1db47009f98058e5da85fb2330fcca30d04759365
SHA2560cf3ced5d52c097570df74215a1cdd18110bf922d241b5a61bec8f865844469b
SHA51242340e7236eb373b26bf1cfef0a0e58cff97f7ec2a6dab58ce926b9c72b831ac53199768b391b951a089df4f27ce5c381d97aebd2a3956bb8506b19c2a7d617e
-
Filesize
5.2MB
MD50882c2f01fb918df58169f9badcd512b
SHA13a46e83fd1bb594a9107ad5876296aef5c4255b4
SHA25688671bee9a8c52f79d0fcbb7ae01a8c19a13a7127140049c494445414eed9077
SHA512c43d443e63122e2923697801b672f7542c51fea0cde320f52d99eb4a5b787ce6f114b1b185ae00471869117144b1a113c836268e8ef7615b8bc54105f479349f
-
Filesize
5.2MB
MD51a30d155eee9122fb717431f8361999a
SHA1285b4e52143a56941f68e2a89d1f9ea9a596e6bb
SHA256ef5579dad097f05d853de51a08846e691c07f9265e90e134b6f728c24d5c6695
SHA51263a9daa8ade3978ca1cb6bf46a9503d6f8b7ac2f549d9f3018c6d946ccd68cefb43238c142339072703ba463d1282cfb589a7ef0f7d9b278ccc9c0b278e4cf52
-
Filesize
5.2MB
MD598be586bacd2980fe71876e90575e9bd
SHA16fbcdeca1d943be5dcf6b399c0d2f6a9245719b2
SHA256e9b20cdca282727d6e5fa7413ae8f4649f71d00fdde37abc045d78f711e5d5e2
SHA512976863def2d04edcadcb2a448fc62bf349a9675e5cd6dbcbacbc5dc0d80e3ea6d083c285d925602c32b0251320db755028ddb4d91eb0c785a537ec68027eb575
-
Filesize
5.2MB
MD57795fbbb09231c3c00b6b4b8f2ed893a
SHA1c55aa68edd6b0db16be85adae64ef2155904c4f7
SHA25688214a01925cc3c089b24e7f93b636217de73028662a81e764589c8af055fb98
SHA51208fcd913b1d6614cd1ea9d1b74b4c9d3572bd5546bab8c2ae9fc68b961daaee45c6008aafe95af380eadcac24efe760eb8fe517938cae56043776dd7bd711ff6
-
Filesize
5.2MB
MD5cd4c1bf6607ec4fcc12daa7b59fab545
SHA1806a4a5d0c549b8ee6be5d08efc04b43d43bba7b
SHA25684d1445fafa43bb32d536ecd309b455695295ade55fc6b6c23c4bd5b5ad965a4
SHA512f2e8ef1fe2d51a6df4c8198f369f74c751c0bab2889fb76ee3746c354998258901af8d0dfbbe2a2e0eb40db79c464df2b0287daa6b42fa57fd1b6d3c8df2f2a8
-
Filesize
5.2MB
MD5bc62d799d6303463432e98dd07af86da
SHA19d52be240d0fe00bf95319fcc783b11947471cc2
SHA256712e659804f1c727350989bd4645db34ab89422f81a2ca755770774fa51179d9
SHA5127c9697956d23bfe9cbecec3f4d56713a62deb135227ad60e0fa0e342e4d1b7c610b82f36bdd9cc76ac5f8973fbc57d58f14519159f5ad799f88443225500e0b5
-
Filesize
5.2MB
MD52ecbe92c7e4b7f50944ae0a9d38ea0df
SHA1cc6a46346672da44a2c7c2b8623d23b1a17c0844
SHA256760e8e4e77b37d222804a77526ef75c276f5681e5b487998677c25e427153658
SHA51267904ead90938060a7001a19971787be2c2ec6323210e7eca3ea82bfb847889fbf786a4c7336f2922aa2be109d902ceb2237bfec5c70c4746b46409a614565fa
-
Filesize
5.2MB
MD51bb3649b128c33223e238ee5eff1c29a
SHA1fab5f29caf30c48c1acbdd3e403b731772834685
SHA256d8bbd0950170ed226bf74f73f4e357d0411b175010ffd1aabf12ef70a71fd07d
SHA512c50c023f529e526dd80da4de7cb257bfdd52e981910ee10391d0e5f0a6dd6e173358849fe3909535051a196f9b02bc5ea78bbc0da34cc7ebf5434fbdf626e101
-
Filesize
5.2MB
MD5ff1f09097f373f205cfced0c1b59f33e
SHA1511d97a2565d7061b55b174ea73f3bd0dc0540d5
SHA256d4e43fedae68ed1f48e893397975d709cd09014f37271931e4be5deae5aec5e4
SHA512add316df93eee134e768aaba01beb0af9bbfd4c5cad6b3fa3390592c14d6ae2690abcc1b83d0b3d98c1fd3c5f63382b683066403f5dca2df8aed9dcb165db066
-
Filesize
5.2MB
MD5c6e2d50d99026b3f5d1665e4a2c6ab6c
SHA12c8c1ff11f6c5c16e46fcefbc8e1f4d75e265b8e
SHA2562eb033d720daeb018c08366f6f7478da6b7bbf7412f49affa7209819ce43b310
SHA51268f5c91d8143e6166a9cdb21336786d2896e3ed82f0d4487f454556757041abe182dfb3122973de38ebb63dec55aef83fe33de373eef662d46d56ed064a8f268
-
Filesize
5.2MB
MD5edae4a7f4449778a818aed9597374a79
SHA1e10e71ffc7eb65d87c701adbb30752ce65daef74
SHA25693a01b25e6fa9438ca06ca70014c5ace8a361bdf38251133e3532fe46f1eb634
SHA512f754f76192fc2f0b7048026f6c2f77d0acd03ff215bfb8b130e274eb89e51a0ebf2d96f6b7fe0cd55d716dcf4c8ce51b45454c257c7ae44e4c7d1a632aa9d9fe
-
Filesize
5.2MB
MD5f7d732cce403b526ebe1599f603091f4
SHA181f14bcfb06619cc9e9c1a04fa1b13b21a809da4
SHA2568fbe171eb2722f45d84436bc0bf8175ea95cb9f805863d5f9277031e6ace0479
SHA5121f7e836830b50f409a79024b520db57d1862eb1a99f1b7d44b24e71e932bb2c934baf48bc7de0f7254e7792cc2728ce40ba983a4252edaea20dd504ee3ae284f
-
Filesize
5.2MB
MD5257a892fcb5dee81e2a87f0bfb0f74df
SHA1821104e9f14d72cfd42c5d1db1a526262c2b50c0
SHA2566a76b0f325b0b3f0baf3e5dfd4c22dc02bde2033b81f3e94ec7aa1fca05d1a9f
SHA512a199514cfcc22e9a32c71646f175a90b2bd4d66151c04ef4786dc069664938bc2d39060b2745a033e0e14cec72b84c125c2815387d29ff7754355ae58da20b7d
-
Filesize
5.2MB
MD5dae74a85545b33a45f73a16bf836abad
SHA14c31f91f4c7dcb2d1bc24346c13b04ba3ddb7c81
SHA256b76a28032a19232cd4a6c88444f2558d341c92cf9207666fc9fdc5646745565e
SHA5122149278428141475abbd5a36f89150730950976ca1deaf49c41260c7b1e8a25e0491b2970433b2669a1def23470aa134d7962364462880555f8aea11c203f083
-
Filesize
5.2MB
MD5ac865f0c1f1754764f6d85fa4a57de0f
SHA1f13bbdef3f2beae1e254d2a14aa0f3550a7a9d0e
SHA25699c21f93d93348519ee5d5b5eef924c2f0946a68dcf8712abe20db7f68bf16fc
SHA5127c4cc26edcd53de760126b6d2734f2dc37f6ff23fbabde9c48edbba0c634fa560a0e976b3514aae9952bb83e823e366bf07575d989f9e0b6e6b1f82f2c875f4d
-
Filesize
5.2MB
MD58c0e07c95f78b2cac42578ac3265ad77
SHA15274e914a5b07a1d61a8abf3c9ed8fac88b24421
SHA256dbd2490f271d56be9f70d112561800043b3a757f6ba99a984663019a3592865d
SHA512f563ac236519eb85fabf89082794b7a72fcb50510caeb8f72f9f20e0b313166d7ad2027eec3315422bc8e48e85f24df00110ffc4d89aaf599eb167fbb5c279c0
-
Filesize
5.2MB
MD570decfdf95c420d74aa5cffca1f2ff45
SHA19ede97a7c6a9ec6c79cdcc916ed1b81910e00ee1
SHA25697a065efa4071c03966522965c646d490fc63f378ca3e83ad1d7e3c30d5fe88b
SHA512d4d0148a1552abd990ddcd1c33f876d86796d3ead893cb5c9fd5fdbfd2ccf5565ea1fd288ff6e3355fc16968661b538761ff61db2b0949ef18925e82ec1d8985
-
Filesize
5.2MB
MD5e7cec57610c523175b94fb04439a1b35
SHA169613c8dbbebec459a3fb300565fa960bde565cb
SHA2564f0ff7e6411766a58ee373a7cd3de6951695cd87037056d8df5b797dc1ec16ff
SHA5125ad811145608a81acc811461628a44a0bae17cc4e83a42465c10d069e922a65354f632220b054f469544b95463b21c986ab11badf83fa2bd8d1f1a8d19c60b2a
-
Filesize
5.2MB
MD5f2d51ecdece9499d200c70ddb869d4bd
SHA1b6a5d6ba9be014c8b1b5efb42a97a4ec73e1ea0d
SHA256d4cafc21799793231b029566d59ae1fdeef4d4628ca2d60171e14a25abc7cdad
SHA5120d0e552dcd1b52b7fb5bbb6f52d3813de7bc241fff1dee9cdeecec635c2aa5fba55a9949ec95ce17a1ab878e20c98bcb45e5e1e248b56f2d58d08f996cf6d854
-
Filesize
5.2MB
MD5d826772c352a1c6920f9d5c00494404b
SHA1b45ce3ab08916c9a30959150a6431412a9c7d704
SHA2569da2751fa6f1c7b1bad2832dbd03a3a5dab4208ebd952967fdba6140dff2e9b9
SHA5127ab2f77b87e4cd9a7ef1e2985c233029a7af2453da29cb16c5532404d82a6115cd5f903043aa40ed06722451238c620dde03474a09d180c0b29b2bca5c2f3df7
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB