Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-11-2024 10:04
General
-
Target
2024-11-25_01d67b8fc67892470bb0a2fd602310cc_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
01d67b8fc67892470bb0a2fd602310cc
-
SHA1
e0dcfaf5effbad19944442483f5f2dc7e8dad369
-
SHA256
50d8caf4913b2bae990f4c22523f585704b8112a8ba312fa55b2e4a4d43003a1
-
SHA512
a94c6f3a989e51ee66b2a09550e1f2b5685f4ab882d2f1ac1af18938c699a439e53f513a38287542758b9bf361be5dd8f4b123321ecf3d4e65d16f867082d1f8
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_01d67b8fc67892470bb0a2fd602310cc_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_01d67b8fc67892470bb0a2fd602310cc_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TmihzGj.exeC:\Windows\System\TmihzGj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CmiUnni.exeC:\Windows\System\CmiUnni.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TwKFYkq.exeC:\Windows\System\TwKFYkq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OTlAkVq.exeC:\Windows\System\OTlAkVq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icFQoTK.exeC:\Windows\System\icFQoTK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RDgeZVc.exeC:\Windows\System\RDgeZVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pNsEOoV.exeC:\Windows\System\pNsEOoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbOewhT.exeC:\Windows\System\tbOewhT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OqUjGUC.exeC:\Windows\System\OqUjGUC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMnNxRf.exeC:\Windows\System\kMnNxRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqjmmYD.exeC:\Windows\System\RqjmmYD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmDsTOk.exeC:\Windows\System\MmDsTOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VSZazho.exeC:\Windows\System\VSZazho.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JQoZTHE.exeC:\Windows\System\JQoZTHE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DupqnFP.exeC:\Windows\System\DupqnFP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tafqLxK.exeC:\Windows\System\tafqLxK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kGkFGmf.exeC:\Windows\System\kGkFGmf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hAHGibt.exeC:\Windows\System\hAHGibt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dDxIcoL.exeC:\Windows\System\dDxIcoL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qcDdTjk.exeC:\Windows\System\qcDdTjk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yiuTAyi.exeC:\Windows\System\yiuTAyi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59ce5d5887be5d5def16a82c0dfbbec57
SHA1f4d55daaaf296183453072394aac381200a97e89
SHA256bdda4bc16399f0c131646a65d63d4e99d5e5cb9675338544fc2c38e798356da0
SHA512d859b3bf45c995710140a966b7bfd4dd0b60d1fe3388af3ffc4e498a612a623317574513c19c2cba8a16a01dd091b3b4c689c9c66e1e7ccbaebbd38598bcf6bc
-
Filesize
5.2MB
MD5a2ed2030f08b7920bb08ae90e3296922
SHA1fcbeaf1b59e6ee638f6dacf67be83cee165615a3
SHA256c1d46261c717c851b883a628ec76856b37dd6adb8f1061791af4121f9339f033
SHA512d9a5793091c3126bb48d7af7c9f18c7f56b894f8a8919f50af86ac62776d3948f356d5e7e2908c376b9a82572555043a5f5381d42282a485a4bd623b09d0335c
-
Filesize
5.2MB
MD55e4157af785140d7619135615775c37b
SHA19a56516b657cdc19e636f8849e443428bb6cafc0
SHA256612da8c60ddf14616fd6c47b91c1db4c93de2c6f2812ad5f7191b44b593eb71f
SHA5125cf32291a13e44e734e922d5e237e6281347be1dc1f178abea61d78e936124e8e47a712c03aba893720ca13b09a8617c83045ea53ed231a2ee8eadffc7ffc3e4
-
Filesize
5.2MB
MD52eff963fa56d655e3607843fb3464016
SHA190fc0b0135afbad660ced4c559c342cbb98577dd
SHA256a0d4e7559b899e3c9544c8815b7e753f80bda2d0ffc3adb2ce75049f1107bd0a
SHA512b3c8371bd4a758bdfe9681fcec487e23bef232d64a5ea7a5a4133b0dfd55992069c0ad4df6575f79650c0d5af0447dc3bd04792331c6c838950018d446be0245
-
Filesize
5.2MB
MD55fdc42d21b7000b3693c4e6c4e14804d
SHA12907678d4420dc33eedf96507a390980e7237636
SHA25650de8af2a83eed1512dc50cf140c12c84bff8d77405a79aaef04dee49dc14949
SHA512a25362b7e16b018b389ff347c0bd85c47b8668f008b9fbed20da72b2fe3caf84ad13e85344f8adb1b434c21d02459a6e60cd50c05b172322f0087636045b1383
-
Filesize
5.2MB
MD526e39fd90c60730cc23ec85d249771be
SHA1e2a107da0df171b675e151628db2294dd6d4a456
SHA256ccb6ac2785fcc1cbbe9b9920188563f820df1a0261dee165dea1e50be142c234
SHA512b013cbf792f157be57fd0ddf930c8e1e663fd0f1bdd3810dfc8eba92131b541cd8fd7d2b8cfa51184301b1463e8bc7c15c0463f6b395d48edf879a6e98e22451
-
Filesize
5.2MB
MD5f6299d2de3d61dc9294cf2e0bc9cd92e
SHA16d52dd9818576cba5d39d32dda5a02dfb35d9c18
SHA256058c2b0c9da1e8e2d9e947d8cf37915504d0693d3dc9415f7f1c8819eb36b936
SHA5127006fef4dbbf0846d1b8659cf3d12b09bf3f72abcb886dfc11754b8c9dba288735451c8b4cf7b25c5b864099b37c43b446f969951e6cea302cc36f96e9c0af0d
-
Filesize
5.2MB
MD540e0bbbd8f211733babc7ae4def9640b
SHA1064d19169ad7655259c617b8f5289e7aba6bb4fb
SHA256561b69d73486b6e08049b1b738401c0b07bea20b098c06b7cdff042134c4a4a6
SHA512dba340ac7cbe9438121889945ade8668e2767bb32e652ee4957640dbff726ed2845d1cf6c51a472b1e1d9901a0bdf0a8d6c9d012b148569a7539349b5a08ceb2
-
Filesize
5.2MB
MD52cd1e17df16b0d5830ac2bac2f071888
SHA19fd87238c386e7280d67a6f0fc824533edddf9f5
SHA25638f7edeebf1891aecd8a61921041691a9babf375c308f60c766118683edfb5c5
SHA512e651608d49ac5caca9be330475b9be18eb2291145516bf85fd67a167ed596433e501282817e7a31dd1c01d1c01a23ed09f543e7e9950f0c80abbd99288a48e07
-
Filesize
5.2MB
MD5e4479b489bc865a9a7f3c1cdf88df0a0
SHA1c9c6f69e03e5191392ad188c9775730f21928061
SHA2563bc90a7106d2432b4004fecef5ef1c3097aeff8a3a6d0bdedaa1cd82efd3017f
SHA51209368e7e7658c639b0aa970dd40f49877b9d04106882eed4ec905ee4f466aac1d2ea7217e65c288bb60cff8f572a220ac60a3012e9b0903efbe7d15e796a4e2d
-
Filesize
5.2MB
MD5cba8bd9efd678352e61ebf8aa85522ac
SHA1fd71fd25b66bb65d3a940af3bf66ab7afe3fefcd
SHA256439f9fe76e428082d288e8077e16a9bc257322dbc385bae8bc71387f980f40ec
SHA512ba4edac68f3ab444f943302dabf93bf396c60bafcfdf7ed9813f31b0563489dac0b9af2f45664a6cf549968ed68b88892218948d86da4c8d2413ee54fa9ca9e0
-
Filesize
5.2MB
MD5520d493133adac516f9bb5b9ecef92b8
SHA153b6b942c6d64f3a9f391a5979e3f7f7a2b77c83
SHA2563b797d83b37ef8e0cd861af4d5a1c863b68fbb5dcde9a4fb615a1f9fd5414d4b
SHA5126bad899e07860be97835238749140aa21447302a2e8fa09417941b3180dae46239c631fa5358058df688b1fb1404ce1a828a23aece5c862e768d50b2edff663b
-
Filesize
5.2MB
MD544da4577927cb4c5c89514566d8113c8
SHA17718f1cf66733cf7bf6d3009ba9f7fb3546238d4
SHA25616ffd3bd52c5cf8424faa93664f79c2345398f8b9745ded05bccef48fca1bdf1
SHA512eb26d5043979323f03436ca500caacb62364366795d6fdc19d281312b3a4ef6a902e5327e8da29a50669529ee5f869fa11a7e451011216618e5f4af37539b50a
-
Filesize
5.2MB
MD53bb33825f438897aa39dd4643f08db26
SHA14d9a4e474fa029c410e18df70a20f86b9a87c663
SHA2569169118f1cc032bc75f7be3975cce1bb31623d024db485e2dbe3c5292d451b71
SHA51218b9022ccf03adb5506d57f3af2aade64100fd2cfbb1348e68e6a0900dcc3a46c668cedecff12ac05430200ed509eb087e0f932a9df7f936a3ecb8be8d57f726
-
Filesize
5.2MB
MD5fa0897937de9d95165c3fa43e7f0c702
SHA18bfcc55b2e1e72c7ddf3ea2a7aa255b8a443ec68
SHA25660442713c761179b01c17d46407dab9bebd25025ae002e620c0f1ab606aa68e5
SHA512b43726f20646236491b6f502f50e18c41b4bc2078f06c53a52e74cfc21875d3bff2c615a19f8c68b8d622492b9b7ca5622d5ebddd75c82bcbcabacf06b041128
-
Filesize
5.2MB
MD57a14030706fd26c0ae8847746c7cb724
SHA12a8d98768c8b3c6e24172870e36b9d78161f578d
SHA2563878043d53aafea6835b7ab9dd7f775cb8b54340b26a15db93a34fbe5bbec8d9
SHA512b2da46a8a118dc697899b4f79f467d1ed935610687e5ca6133287eda52b5f9418e2b58b6b25c2e21138408d25d6d2bb86d51df8762683f1d75ee856df5ad4fcd
-
Filesize
5.2MB
MD56a2af08f3979d46ec6e7766d13ab406f
SHA13f067944828bbc6f0ffc5d218c086b2244280317
SHA2568bb6735ea6c0f5d8ddbe1f3f28374990939e64b43fa83a645c6cfdf3a92bae86
SHA512bbee563fe2f01542032b341a3adbb10a6d21c6f60a716796b73dc9090439f97fff0466a9a4f7dbc2b3ab9a7479711e2c70792e02d887e1ef5f33752ed94e6648
-
Filesize
5.2MB
MD5e6c1043cc6ad8f513dc4854950a618b2
SHA1472d856e69199268e706b84ca7926f979c2b2d2c
SHA2561e50ea221229b51f34fdfaca9e6dfdd1bb48d94d140bc0ec9ca23927d7e891b8
SHA5125d3e8b263ad74bd834f0742a41863a663685ab702f65f9967a71257dc7c6cb2159777ca62a4519c978de5f29755955d57526dfb37028cb8e622ee2c9af8bd7af
-
Filesize
5.2MB
MD521d5a000109e3196f82a3168e40b01a3
SHA1f4abc12627d15809bef788bb9ad251a553cfe609
SHA25662397dab7286458287454ff0ddcea146b734e0d5e71bd33affa7b2b6b522610f
SHA512176fc9e63ce90ff28cf2ad3311479c662d842a68c83ce11c863ba745472e1b464861ac16c08b7e299dc93113f74b6263631adb23b8deefc273fb2dbd7136b689
-
Filesize
5.2MB
MD5ccc511d9b5b1778a470a2d0122947dfd
SHA15c382ecb481396f04a6944943610b081aa042dd7
SHA2561f9c049d119db20c1c999fd174296489b8a811ee0a23359e17afac9488783426
SHA512045c41a667a744f49d3cdaefc545d63babaab1344bc9e907db6cfc8cf7d53d07d7b121187b88b4ec7a94a34a19e831e231c75aa23297f67ae8899d66a232ac96
-
Filesize
5.2MB
MD58db0cc292ea8dddef4ae5159c528e8cb
SHA17c012192b6db66b7e69a137aae10f221b684e36f
SHA25628609f242cc41bf5a70f16eee44670125ea3fa6fb3ea88da9c38907678e64727
SHA512fdbf44329eef2c8e82e463779db524b579b9ba582d375f805f54e29207c52b682e66915a68b8b267ccfec93f9677c0db13944eaaa74c906d4f3f56fae8b10778
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB