Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
25-11-2024 09:55
General
-
Target
2024-11-25_c1ce7e2a810d88bf36ed601459024f0a_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c1ce7e2a810d88bf36ed601459024f0a
-
SHA1
9745aa7b563e51eeea8263043da93ee63be58de6
-
SHA256
bcaac94027cc6d53759d9dc38063147d46bd6e5f8ef6572503210dcfc0340f0c
-
SHA512
af09b2882d1bd263dc258db1a3ad7d901a4f36df82efb43d531e2ccadf6e6045fd29d9cb4341dcebc7d32a0733a606bcbd4b5005cc952d23c52086279f879ca2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUK
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 37 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-25_c1ce7e2a810d88bf36ed601459024f0a_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-25_c1ce7e2a810d88bf36ed601459024f0a_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\LGKVtQU.exeC:\Windows\System\LGKVtQU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VMoxQlc.exeC:\Windows\System\VMoxQlc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aukmBCh.exeC:\Windows\System\aukmBCh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OTaHSjj.exeC:\Windows\System\OTaHSjj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WLFHtPK.exeC:\Windows\System\WLFHtPK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MTdsyGn.exeC:\Windows\System\MTdsyGn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AziXytW.exeC:\Windows\System\AziXytW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPysBNA.exeC:\Windows\System\cPysBNA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SuTKGdQ.exeC:\Windows\System\SuTKGdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cnrjdNK.exeC:\Windows\System\cnrjdNK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TDLSIfa.exeC:\Windows\System\TDLSIfa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\duEoUew.exeC:\Windows\System\duEoUew.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LrimwlD.exeC:\Windows\System\LrimwlD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDiDJle.exeC:\Windows\System\XDiDJle.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nNuiNKG.exeC:\Windows\System\nNuiNKG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VYdndQh.exeC:\Windows\System\VYdndQh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QPSLjVB.exeC:\Windows\System\QPSLjVB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aDmHhOI.exeC:\Windows\System\aDmHhOI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iPjiSIB.exeC:\Windows\System\iPjiSIB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qEGWJsv.exeC:\Windows\System\qEGWJsv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eBwxdDc.exeC:\Windows\System\eBwxdDc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD532e6ced044c5d6b5822fb104a9fc443e
SHA1dab39b35981280775ddd195800ecd7ca0342ed45
SHA2562abf75a3f66039107f56563f8c2da034418356a877a0432e7d1dcdee056875f7
SHA512dc7ceb07ade98099cfaab83278b76e907c3b1653245a94629820fc002d49f9ff5ceaa6163d26c03aceef330bdfd23b3321bf1038a4694b102119ffb3a1f77e06
-
Filesize
5.2MB
MD52ec404ce722a1f8a2f2a9bd20048ce61
SHA15b9233acee38e2b4380fcc8a2d9ecd09cd50e19a
SHA256d52a6bddbaddfafe4ae4a1eeead726618c86a3510ed0b4b546e0d8d8bd92dbe2
SHA512c1a7a1255b7947c960b3fb85298d2d35a6470b9ec86d04c84096338f4f4c310232979c9bfaa04e23acd0b59916d7e34fde56698b87c6eb31c1b6909217096b8f
-
Filesize
5.2MB
MD564dda59d0c59a90e9cfd85c859b0ecad
SHA1fec661527e5b6270bfe26af7805f4d42b13cdfeb
SHA256e61cf9e504023049ed9fc94bb7d6776ba44767cd5086c82543f4405e0f88d3f6
SHA5120d2adb981123ba7266ab4b1bffc6c25503d3d19c0a7d2c630bec0f4b442d8b808fc0020c7fec022e3f5800d33cbce638eeccf690f170699ab2edb018f3ada470
-
Filesize
5.2MB
MD57a3ae0f743e69a1f6275c13dccebc785
SHA1a85e67224d3e2cac7a5cb24f98a2b63888815afd
SHA256c722cd2dde0c4ac7f1da61bea5f0e90d4ea7fe4cfd6b26186ad5b24eaec7ed0a
SHA5126736d211863e869b3533c63ba0fdb94b212f3281541414be7bffb8ab288145a75ef1eb3dd00582dcf5dbfa0d34fecb873630e4fb7a011ee277719dc4cb3e07e5
-
Filesize
5.2MB
MD5eeddca02e014038de8e4d7e55e98ba9a
SHA179047b435acd05db0fecfcf1e1de34500de5276d
SHA2560d016fc7db52b21c35bf37bd15acb6c8f66d98684efeeb3878376429be928f6f
SHA512d18ebb57338315fd611b7d896d7e882f12fa1b410e602d6232c99b616c56b3da4e23b802b137c7f22cf53411d0ead2f1a8586f384970dcccb90bcf13c9506aea
-
Filesize
5.2MB
MD539806cd06d9dbec8e07627cf59cbd284
SHA180f1d79d4952249a911fe208072b2662992c23de
SHA25649ef469c821b4011973bcfc8b18d061587fa95820a49d09bba226ab7499178e4
SHA5125276b41254d91c1bdb7c2ed458a64dac05fb4b03f758b6377c403c7f6e6d34fbfab0cc25949d543bee501cf0f0b3c84792202959373c3bc5ac2213f27ddb2fe9
-
Filesize
5.2MB
MD536c141fe9648515a13d8237637a8b50d
SHA1992f936cdbe204a43ca10c5fd93487c801b43d0a
SHA25625005e28c986cd3816ea486541625d5f8c496fdebfabebb562e8000e9edb96aa
SHA512ed20c8605a1372781b157d26d2e04d989a69ec403a2b91f342b88cc141029d56621961ccdfb4db627adcc5b005af959f20710ae6128d73c05e8c061ffd9f9578
-
Filesize
5.2MB
MD52abef3c2a94363195d30c2a318e09e74
SHA14a8ecbfdc5c4132fa6ff0864e8f944c215ffe105
SHA25609ea6eff2f45e6cf2827e0a7de6c767674b7cb0d4bfadcc53763bee309ab08ad
SHA5125ca5d695151b254e09a5973241146b9097102aa99fa0da1389bffcff272946ad5d250be75d9d07151b5c17ea5b21a4c932c514182514c46a61d6db7eb9c9332c
-
Filesize
5.2MB
MD51dd7210798f38d362a9e0988d3c08a3b
SHA1b237a1e3a89aa5ed1cdda8c0708dcdda23f09199
SHA256f64a36a313ce823d1e7702aa7da5663ea224cc16b60ffddeb27b69db6bf283f4
SHA512b8c662a2999b81ddaa9a38cee42f47b7958a8d27e4585f58a5abc4c1178cdffe3b88b88ef94fa28307ba5654d4ceb86370d01a5d5382ee70176cef266a6d50db
-
Filesize
5.2MB
MD59658a1606dafcfeb3c270f671ac1636a
SHA1bdc880fa04f6b55c14fa6ab7e5f915e44f7a3184
SHA2563502a59b248d470a0f1bc3166704fa18098cff38c74550f7198b556fbcb1a420
SHA5123cdef46e378a6edc6938ac46433db07a2b00b9b5e2b04379d50e2a98e7404087f9030d600123f7351b2ddc049e05deb3f019c2d48373973e355a5ead69d799d3
-
Filesize
5.2MB
MD52791a5132b2412358d77fe87f47ccbec
SHA154cd907c1583d86e64ba931b527bbddd8fc2f6d8
SHA2562e6e1d106e248c22e361b6f1c574cba74d0621635458351b370f40dfb78204d4
SHA512511e960ad7222a384f877bacde78c008a77c54d5855c50abca0c3a2e1e207afbdbe0e98adba01930dac02b92faaa4b3e491144f58daa78648393ccae17c6cb59
-
Filesize
5.2MB
MD5f3a19cafe6f46f6c3fcd36af29036570
SHA1b91565c10fa260caccc16ca6ceb0c8d047008776
SHA256abe32b28f519e1906ac2fb525274176e14b7473f25fe7e3c4d2aa90d3a3ab4e6
SHA512731dad19e5de1fec61c05e0bd92f9b7df205689520becd277842b0292bce79f0e2d4bbc05058d1f5e09f7fa79e458b1f70e86587bd83f6743522755cdb0051d7
-
Filesize
5.2MB
MD594f945c4911f984dd9fa883011aea08e
SHA1a887e4047f202fbed8b3741147f7cd72f0525f6a
SHA256a3ec68f77b943c262e07ea856da1d00dbcce51223caa1cb41e11e8e72e46c26e
SHA512c723950914d175ab1e33b2797d9ff20ba7b2975ffdd187df0c69778584bee5da59973f41a0f150d7edd078ca758a35b0ff1099b3ca09bc165cc6c3bcf7d12a35
-
Filesize
5.2MB
MD5a5ac75ac5b1e2ee17728eeb155fbbb22
SHA1a09b726f9bd462ff689453f1ff810b9300fc84bd
SHA256aefcc015febac503f24ffdedf045dfa1d17382b72587a00aa358a423811dc1ab
SHA512902d7b8ffdf1eb951ff921feeb2e49f69b941125f89543eccd7b7e28379bb710b068873a56c30bfa2d94c34770e2b41dd5d76496ca646f52734ca35894399012
-
Filesize
5.2MB
MD5e890f4779fc35ec71653e60ba22b480f
SHA12c6b797cdab35a21f66ea957bbd995b82488d08c
SHA256aaf4f5aca8b40f86c20448c2a595dd9fc90bd285c70be1f0f33ed2bb61e67cd9
SHA512ab7fd39fa5944fded228cec750e4babb8ea010369d4c7923a831b520f29ee62c183d2586c6ad6d1370cec6b8991be3e8bcc0d862cce4205cd2f62dc4aade9526
-
Filesize
5.2MB
MD5296fca16ae345316c109bef010f13e91
SHA1fc42c2372fec9ff22336d4057c30a5122258c4e6
SHA256a44ff5dfb415ae77f616153569e4a00ecf38fe721972388bf2032c64e42d5ad0
SHA512f77f6aacd40395ebbb99a20deb8dc19e4486d620d25f0bcf9962f6680e24c2bea14304ca39bc0d59f0bd666ece5e079ba7d5758a5f5e3ab91ad7f60b3563fc1f
-
Filesize
5.2MB
MD5bb1326587cdf11edf43e52fafc68518a
SHA1bf6b7bc06007a539fcea7d91a7409a75916afc70
SHA256110cca5c3a874725d3be265d95db5aef8c13f1635ec373fcd30a39e8fc2d18df
SHA512da0f2a7e056141ab84211d08ac037c0bdfafef556bc09c759c6022424ad89986595905e5c618b8b080bac305b8d5b1e86c43d596b7e15fe43ed2c5173c395dc3
-
Filesize
5.2MB
MD5d67fe6656066e45eccc39076e979413b
SHA16a41f3d56492b194edc6410f1da4b0cfffc4b036
SHA25660f319e78b201a9f993dccffbbee32b84ab746974b38e663dcb80def727541ae
SHA5122e60b5ae0ec172e3b3592babfdf8c8144743c4393b2ce49aa76778fec2c72d093ca34bb7a06efe733308576cee15de0156ae716cfbc89d321bb4dc5e89abd6d2
-
Filesize
5.2MB
MD57aa2743ea101e361afea088e3ef5b0e3
SHA1fe6404c22498a3930e6631767b8e12267dbe6006
SHA256bf4ddbd0ed069da483e2c05de72c3b3b1e88cb4bface2ea4a699510a909548e7
SHA512c362f2d6696099c5d5319323eeee25da01859ef39783e11cde5800f0ac67a76551171dddc6be9c5d596b9a356c8e4ccc74c357deb9a5c9d2594aa814b77254e7
-
Filesize
5.2MB
MD50f669c485b75692643f89b2f1ec681f8
SHA1bffd6db1f2b1501da04cb3c7f697915ff33fb2bd
SHA25678e2431976aace6fc18df1a6f24d0908f87950806845933c02b4fa0542050fbd
SHA512a1eb1c9a4f44d0f698406da0ccb6625210ffa5ccc556b226b373b2f1f075c91deb4cc07d52a268f0cc393e9de7b40622f8f1057ad4896b3bcf0259133807ceb1
-
Filesize
5.2MB
MD5a2631a981d09fbf6cd8f06c967c85664
SHA174b224f5594005c633089688b25b39ffda83b481
SHA2568a63851ff96bd558ca96a72158baa8b6bcd836b83774051dc4123d47e1224477
SHA512bf80131ab5962a4b218252cdaf28154dc39c6b3cef04c2fa8a60f7fa8c0aab7e8f85f1b4d5025a98017ab7a5fbb8ec2933b50110e9cc12d0fe0aef03774f4c35
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB