Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-11-2024 09:48
General
-
Target
2024-11-25_3f77da2b7c954c423e461454081aaa5b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
3f77da2b7c954c423e461454081aaa5b
-
SHA1
f381e24883d99f20b973fad1e28c5a04b25a6c13
-
SHA256
1f6922dd38b2a2d1d439ac6f4d25ccf453066c3a5a50603b3405dcbef68412cd
-
SHA512
a69f0f8af10316e996c66206ac8092c265220240fca1ac7b9230f42cb56a9e6d25cd5eeeb4ef6b8f5284581867a5d2a8d3f4ecf33a8aa133dfba01b15e0b1a68
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUD
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_3f77da2b7c954c423e461454081aaa5b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_3f77da2b7c954c423e461454081aaa5b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rWJnOWh.exeC:\Windows\System\rWJnOWh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MgYUbdM.exeC:\Windows\System\MgYUbdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BcnPanK.exeC:\Windows\System\BcnPanK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsQTLAx.exeC:\Windows\System\xsQTLAx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RCNbznO.exeC:\Windows\System\RCNbznO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iBhDDVr.exeC:\Windows\System\iBhDDVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvzHdct.exeC:\Windows\System\tvzHdct.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\glQnBQD.exeC:\Windows\System\glQnBQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wyQjAIs.exeC:\Windows\System\wyQjAIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dokYfJz.exeC:\Windows\System\dokYfJz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rNSzCzx.exeC:\Windows\System\rNSzCzx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FKBViqi.exeC:\Windows\System\FKBViqi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tvEZjeZ.exeC:\Windows\System\tvEZjeZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EErwwcz.exeC:\Windows\System\EErwwcz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tHYUjoJ.exeC:\Windows\System\tHYUjoJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hvWzxPA.exeC:\Windows\System\hvWzxPA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bmCgGRU.exeC:\Windows\System\bmCgGRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QuTkVLg.exeC:\Windows\System\QuTkVLg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nQeZwKU.exeC:\Windows\System\nQeZwKU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uwSViTE.exeC:\Windows\System\uwSViTE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gWDjEqo.exeC:\Windows\System\gWDjEqo.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a7cf2670b8fb2216e4b99212353f0a17
SHA1fbcfa76e3580967630d014d6bcd02932f4fcc1c8
SHA256f72a3997576320a3ad29259c8ce1b4b243ea1926186e010310f5555163d26544
SHA512cc95d87146bfce51c5d232625c64e96bcb83daab10369ebb469f3e56b2729136f066631fa30ada8e538dc456cbe003f1f477bb42a18fa0ded78774992e375786
-
Filesize
5.2MB
MD57f3e9653bcb2de5fdfc0e6c2652ff4e8
SHA18365c2469b9cd2482090e1150b23c9d872a3d0b4
SHA256377ca93e3e7748305a13952e40e8baf5ab808baf98f8f0917e084419c4a0bf3c
SHA512c6d97b7e8509938beb2fc1b65e1681e56debe17af2c60d84ed1a8619e1b0ec508a7d43acc23cfce4d978499307cc115725dd5dbc52ac1fe4b5d144743bf62a44
-
Filesize
5.2MB
MD55d3af3af475845151727e901907009b5
SHA14d81a467cbdf0eeac0acdfbec5019f73d2e128d0
SHA256bd92c14896e07edacbb0978a602e7e66efdb741c2574fce4ebfee436b7402797
SHA51235644b957a2825d89f952100141dbeeec8a93d2893f25dbd55acfa5f83849501359ec37ff47b2f05373ba1c89b81196d6e64ab5510d4552895f79b707e4c44e0
-
Filesize
5.2MB
MD5ac8ab67515f1246aad5ce5bde090dcfa
SHA15729b5135476beda3c41bc0e0f9df1e8c5533210
SHA256098666375992748b6df28f27881a6789fb215e68f646aca12016a13a6ceb1322
SHA5128b22a483bf8ee64aa46eaaccc874c109f633b2b9cfbef8210e139ea428ad5e16e8bb9933262044369acae8e4132720d5da18f1bb501acbc467d326c4ed2368d5
-
Filesize
5.2MB
MD52c048bd1f6f79968edf08478846e3006
SHA1014e0829fd49f36c87c2d7c728649cfcecf4eaef
SHA256248bb5dd9fa9b85d2127adaeaae49d8a5974fceeb0d8ee91ceba5dde739278df
SHA5122e675e1c4508550912f623a49252c4e8c66aea075b5570cdbfac0fd47e13c8edf204146ef326ea17a1396f298cf8024a5faa624240fc3f0ee375df10dc8d1c6b
-
Filesize
5.2MB
MD56d4d59139c1b89da42c2d2a7da3f2314
SHA1fb2881e75ee9dbf266366687ccff5753cc31582e
SHA2562ae3df556843522b79c7bf56c65e3381bb77da59e83d9bc51ff0b73660da6807
SHA5126567b5eab76e5102c1558f10a39d9f13f39d8564a83d16bf6b3928f4ed6035d1caaaffd04f7437854604ccbda472b91e97b110c218d1470a056cd594dd63e60a
-
Filesize
5.2MB
MD5653115208950a2d7e2f849f672716bcb
SHA192f28cdf50d0f8ddf2aa1c74052f18859a980782
SHA256f52e4f99a4fb60da643b1a4c0a1cb30f2a2ae2e5a0f40bf72716aab717ad8ab6
SHA51225d6934ac713b0e34b1467f7b48e08c8e9cfef8b34212127735b859733c28c3c2808c37ba01857df2344c2066edd2da227a8b8af944c9aa6b223b1cf7b6db854
-
Filesize
5.2MB
MD57b917f74bd19267fd6feb36629c89fe8
SHA15fa088b4f76db01c42cd54c4b40c63d3136d5f8c
SHA256182edc497da136ace015198620cd9dc1555e5c39e3ab5d7d6d8d4e837880a351
SHA51274a4b47cb9c42f95081f60ace7db39faeff0573533d69a112c9f2f0979b78532c55c6cc97f8b34f7fbd4b8fd91aa5cc3218dba03c4fb787fb49a84d14076da0a
-
Filesize
5.2MB
MD56e38db324596cece0f65d832bcf70c71
SHA1a65b9ba5c3822607a9bcfc4e723fb3ad7590b1db
SHA256ef089648bf0ae5f6afc9063419726154a10b1aed0241dea48534629da1cfcf4d
SHA512710a0b7997388381784bb32a4739ecbcf54cf043c87405ed919a3d5eeb9fd93ea5df07b27623c01a612098c7d3601836b67beb9d0072dec0828097de087b208e
-
Filesize
5.2MB
MD506c3db34c39fd0e54911e3d93e21f80f
SHA1ee6cfbd738cccbca87f19e1b4f0856071f8e66b0
SHA2569724f66e5ed5020e467878c92dc344b1b7874caa142dd5bd17554dec54ab23f9
SHA5129ccf38076d04a5e325d1475e52d8eef313759c6791e93996aaa6595e1efb520f4f13f47292f3e4f2e02e5724e8ee6e74a469e91319b38ceff7ee9c63aaf1f680
-
Filesize
5.2MB
MD5a680298e2c7cb46638452c24c5316bd1
SHA1ab31bdbc576d908a461f41e251d1e03bf73f7489
SHA25651b0e33f39a9ef0e248aea8ac3079df03eac145304df7ffec2d17fcb6150c1ce
SHA5126db2d8126c1ed987fee5192f98bd1215f009cab569a8ba87b8e56cfd835eebca2e556660366290e6826d168bfe2396cb3bdfc0b1893db042324c0a394277efda
-
Filesize
5.2MB
MD574e869f9e376671d0b5d107c5ce94387
SHA1f4f18d0bd5b3f77917eccf768bc3e10f080ded01
SHA25684ab6a19b247d826fbc894b93adaa90bb0de271a2631434674ddc22ff179794c
SHA512a11bd2543a89f3a5c26dfce15da1d9ddd5e0ae768ccd37136c072a092dd070a4c3efcdebdb09ec0dbe62e68373ec314da7bacb4b8ca0a98f6fad1bbab89498c5
-
Filesize
5.2MB
MD55f065b048ba96e17757a11e5e0fae8c5
SHA159e86908e4be02a2e193f64524b7fe7b00e09bed
SHA25645cb74816443f763e4219a0dd0ab75ae0b07c414d6d899f1ff40a5b3425f8e75
SHA51200646e0c5dc9172816b33ee05f4c81f1847684ad02825d97efc68b343559fc0561c0f2a987834ddca1e74a75b13e308472aba3ed77c02c2428dd3f295dd1d034
-
Filesize
5.2MB
MD5e7a90e2b6917160a2e456125def60728
SHA1f7b5ae7c1f21d488e195e76ec2744ef592309200
SHA256901928128dc0c0b0b0b79c947802186eb91f8ee6265571be7f3a02ee2ec2410d
SHA5129ce92facf36aad2535840d1a7b4f7cb558d11b6cf597abfae0cdd2032072d7227d8287c6465d1306fc668c4881de841142e4261d01653c1d86da469dca982a75
-
Filesize
5.2MB
MD54e07492637c6f7fe3d18a461619bae8c
SHA103ea4a6f7310955a1ba63bd87856ca3a65d83d27
SHA256a9174e98249d26db2ac3b812604669b005bd8f70df4af3fbadba7b9a5ce5e4b5
SHA5128e253c735bb3894b3af63b1c2d6aa8aa23daae932d3161fe6c8c9233e56f1db3903d20206e41c43d2a7cdbc782bfb3c84d4c16e80fb573ef29d4144be3ee0ba7
-
Filesize
5.2MB
MD5535f833fb1ab5e84f034ea0b1ad1a862
SHA115cf14ba233165ec6ecefeb5b5bc1e8f78ef758d
SHA256eacd590e81b7ec5f0101eddf7cebaec32655c978e250947f037dc28cc6f5850d
SHA51220b6af0fc06fb9bb1922bc4ee137f8223d6a66183cf63572289d775f275b902829c05c3551467b222432967df08a9b7a976736f6763ba5f5ba4d55c91efb1878
-
Filesize
5.2MB
MD5ea2133116dee8f93b7d36020f3cc1c24
SHA1a649fae4fbd3445ebe5bca428cc0670d87e513ad
SHA256e9f8cad382aafaa421b83cd22d87a2fa2b998bb52cfdf00ff488a5db309571a6
SHA51251042a2c47dff2d2fb69cd7827d51cacbf9d439ed67ea3723d894ff2a6a84f117eeddbdc3d1fafbb7113eca26bbd66e6c12ebc792bb8fee19f7e208c8ba0f0bd
-
Filesize
5.2MB
MD5526715298ea869b9aa5444482d0678c5
SHA1dec700699702d6090edb8c9b806b8c3ee073e217
SHA25692c7a9d979409aa924ad013412afc53a006f76c30928a8386e76dec4f5e0a5a8
SHA5121a3c0915b115126e96962e598e94adefc629661c3ec72bc1f92ba38f38fe0b85c5b6ea0aebf5e4300c07ba6dd55ded1a834f04686d30e239e8a51bf988e2bdf2
-
Filesize
5.2MB
MD5cb23df7e4108d568fc7229e1e7cca9d2
SHA17ae591acc2c2a8e7e377b945345fd0fcc97eb18e
SHA256480254c0ab5d9c219ca6958719ab3217380872b563f0cf0954f47c61f02fe044
SHA5121d93a48401b59fcf2d81e3ebc5b097f7f3e2dd08f1e01dabeda63c3764abbf0e3ea22e235d42b05947412639230579dc5bc9a1bf8ea02c4765746ff9f172b014
-
Filesize
5.2MB
MD56db680b06bfcfcff144961d76974814b
SHA1429b2112e5f10cd3d9ec255488bf21f7ed3787b7
SHA256a6cda5a7a144d64db4fc96bd8201013509ececcc991f67b67f60780a2ad0abae
SHA5126d739a809ca5207737f91608471bbff5008bba41b183d1d6a4dbafd2cd548a170e038cdd13df8f5fc008be47111b3465c7b854bcfd9c971a1eb309087c2e1895
-
Filesize
5.2MB
MD58a8a23570fdf24c928bf9d1700da71de
SHA1ee89b8ee3f3d84b1d3e8b87002baac69aa55e030
SHA2564cd501adfc20656fd83c3707835d4ddc112da292d3be5d08069a955b3364ebcd
SHA51243a17e49d874e4f26de87341073d3523f6b60505afc73dd3ccf89b85bd4c4cca5d52d305bd9e717abae7268c42f00eb3d0e6ed0d15a2d73c4e59016171cb137d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB