Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/11/2024, 22:08
General
-
Target
2024-11-27_c5e6a6698ff1c8bdb12a8a7aab827da9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
c5e6a6698ff1c8bdb12a8a7aab827da9
-
SHA1
80ae79f52103b6cddf152a7ce472c646a2ecade0
-
SHA256
d095e1b87f26e44fa1f88b9aa1c899b2a4abb43eb4ef92cf8ddd236a92b8238c
-
SHA512
337592d9084523e4a66d977f7ccbe4b2d9901378e8165bafc03af9720cf9e0109c6150c5b6ee62ff62493a2caa7362a5b85417a4ae0d150c2ce2fa6605d1b519
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUL:E+b56utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_c5e6a6698ff1c8bdb12a8a7aab827da9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_c5e6a6698ff1c8bdb12a8a7aab827da9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iuDcOcJ.exeC:\Windows\System\iuDcOcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kDPqVsX.exeC:\Windows\System\kDPqVsX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vSLEreD.exeC:\Windows\System\vSLEreD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlElbin.exeC:\Windows\System\xlElbin.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PfmefPd.exeC:\Windows\System\PfmefPd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\waJNnIH.exeC:\Windows\System\waJNnIH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SWYpvgB.exeC:\Windows\System\SWYpvgB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ToXejbX.exeC:\Windows\System\ToXejbX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ekYmUUL.exeC:\Windows\System\ekYmUUL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YCQUDKu.exeC:\Windows\System\YCQUDKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IHApHaX.exeC:\Windows\System\IHApHaX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ctQeMkJ.exeC:\Windows\System\ctQeMkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MGVVOGE.exeC:\Windows\System\MGVVOGE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YABkvIr.exeC:\Windows\System\YABkvIr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AQeGRST.exeC:\Windows\System\AQeGRST.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NltvrNm.exeC:\Windows\System\NltvrNm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DxQTFvX.exeC:\Windows\System\DxQTFvX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mnJjjJo.exeC:\Windows\System\mnJjjJo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GsoRNXj.exeC:\Windows\System\GsoRNXj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TxDMtAo.exeC:\Windows\System\TxDMtAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NQmEERE.exeC:\Windows\System\NQmEERE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51de4753d48dc8e2cc03d34bb8a27633d
SHA176036b2cf44b0cb195b008d166e3ba99c44863bc
SHA256b724e5c7bd7d05cb98a66745e51594cbe2695f2094a7e5547107218878cea754
SHA512b3769db671d8f8dcc4dc7f8528da7de2470a7f6911e6c81401e39ca18326d746b1aafab23ae85531ed74d7a0eb4babc27d955d81b06cf338c7030a851a74dd7f
-
Filesize
5.9MB
MD57a017ecef5b77dd2c0a74c8d0f19f387
SHA173e75edd101edfbf7f3d639d76c3f84a67fb4a60
SHA2566048d9dc0135f03c13141204af8f31c05aab6539a90a5ff263a78f74821daf43
SHA512cde67c2188c904eae2bab34d6e8e28ba083a46d19710ac40408ed0ad7b83e917508e0832d5cc1b36c7f6f7ee0d16a6b67115576ab6bbd625537309cd2f72eb31
-
Filesize
5.9MB
MD5bbf43bca2ab618a02f4fb9245820ebe4
SHA140f3bc134bda87ddf365cd4f425935ea0e3df540
SHA256671d14ef1a3e2c30e609cdee252ff9848c7f58991a7fbd391ed14ea7668dde0f
SHA512c0433e1606842ef64caed7019e07436a3dadd6618cd6b20ad58a05a8f65cb9418ee23e88ffbce56d4c667baf4ca6dd822f66508958aa865bde24fc179d9f80b8
-
Filesize
5.9MB
MD5f9f63864486a53064d8503e895718624
SHA1dbb185cbb169bca3dbd4746101fb646c40f00473
SHA256d0bd6b8022156bd4d170b9d8f65a3d91b2d6a7d59bc6fa137a8560ae767cf27f
SHA512caaf09ddc0bffea4e1701fc031a94773f9eae1729f8b293ebb27c5601d1d655ad4173a676d8292ff7c3fc596358f8976b3b72cd6b7a2b0cce7e1c33403fb896c
-
Filesize
5.9MB
MD591331ebc5a9b2dc09c53fa90e901e2dc
SHA15afd598d6cfcfed553396f5ff331f806d7786bfa
SHA2569f2d642a13473db389711e8e6239db77748e53bf464be64b0bbb8267d2d5f00f
SHA512d790bd0be52d5f9ecd5fd0f32fb29b43ecbf1f8a4452ddf1b0f2d2263a5087d982097553fd7c32d2874fdf7bf7f07716a2c2c8de76e155c54359ddf876924ee0
-
Filesize
5.9MB
MD593cb86600e7752a903e73a8114769a36
SHA170a6a1172f98c04b46c4ea12ed3f196c7aae7c12
SHA256f294939525dd532ec35f60f01097d736891554152f0585d01b862104a0b20f4b
SHA512fa1e33803ab6186cd8baccb35cb64f31d7b8a1670bfa0c8295fde61cf655094be8e96a1a471a2d10b1a68b16ca3abc26dd003be94f241a8cb66c0c4eeb4c2ccb
-
Filesize
5.9MB
MD534b75402eac80f0e54f3cf5348cbe1dc
SHA1d6a06232be54adb27913db78e7381de3afc0b48b
SHA2563fb5444c1c968f9a16a0e8c997f2c51a222ea932182daf381d8a29b64de4e00b
SHA5129e58c4b37f3b97c5560d6321ff301f36fef86497dde897769627f2ed236ac074cbf4d3b5acca240ca9d2438be5dd7141a7674ca4ca9d095f25dfb6f782e3fd4d
-
Filesize
5.9MB
MD52cabe11a31b4bd99bfad52e400e23278
SHA1e1c5a6854f4c048289dafa02eb951efa41a5c133
SHA256dd1bded4a3da3eb0c43d0c9e04223b2a1d33d48aa9dfd3928f6507cf979b458a
SHA512c3958208241f681fb161124391d29fb75d466bc3a0325a8e9915fbfe6c3dd2ba0aa96613943396f85e001573f4fd113f9d865f4c542e0f282c6c25e6ac044281
-
Filesize
5.9MB
MD5c120f26b8f04a386fdc74edf632e1f3b
SHA15c0517b428d96ef3d2dd9d0e7e0217939fafd3c4
SHA256afcf8887829ca237b447ab7f2cb75ec1cd40f2b2fc9fd53214d5cc4b87193815
SHA512a459b40470dc751b2f7d8397d8d97ab982f3dd8bc3f75abb5fa4dd23b54b19dd8e096e60742ad7916cab5bcc3880043b34c3c8ee656d92489c4dfac70979bc71
-
Filesize
5.9MB
MD54b1967fef38823d1ae1315a932defbd4
SHA1aee832fd8f67b894d4f2ddbab24705950261af1a
SHA256fe6730acc0e5e3a0b7672b2f2c1a5bbb611c76b0e37e3c884d7126eb00e96e08
SHA512d3bd8de46f34b504b0f5f25929ffba17927c388652beedf72cd2e607c3e46f2f5a581431956a71c745ee5a2cd8555288a9af38933f915a1d296691eb6f09c73d
-
Filesize
5.9MB
MD50f85747c19bd30851683b7e103e9ceb1
SHA1ef4878f7335ef92f9bd9b27a7a5dcb65d601a402
SHA256165191e044cd664ad9562a74f11256f91ba732fac2f8a8718357b5de68cd67da
SHA51244fe433a4963d423a32d2d88c771631defa212a6594ba3e30d3c373df6c6c862e231b1a349f69b569968a04b3b1bdb1a6b7905121da4af31df6921ce11c9733a
-
Filesize
5.9MB
MD5f5e7c7bb32fb398c4c9cb9e89e6098c5
SHA1498a6e26b048d6030828df220e2b459020955850
SHA256fd792e47fcb3f4e639658ed4474ea9b93cc1c0810215be388c2ee566101205ce
SHA5123c32c394bb80731994b5a52431b10499e654ad992da60c61a7f8920c68895d0215a9f3ebfdb9d786669edfe2d718f041c54b4e4eb5ceadedc9e7b0371f3eb1f0
-
Filesize
5.9MB
MD5447c1dbcbc8aaf211747e4aa52665239
SHA18fcfe12a910ae3c32e04d1ea06abaef85ce04448
SHA256c65bf4ea6ef440bf717b2e5a9f4c245428e0690d4d9268375bacfc8ad8c193e5
SHA512492e8deda5c633d13c97fcf5fe3c3d5886ef65560450d6ea0d7e28e794dc223705f42b2b38107272475ae51dd3039b5121b85d5e8c8c23f8565b5863ce58c664
-
Filesize
5.9MB
MD5e015b826139c207e09cd47611fee86db
SHA1afd5139f3c4b4a3e2082438612d673adb76acb26
SHA256c30f4000db3448133961ebfece6b95e98abb0c0844f03783638506fd6ac0379f
SHA512805c3d9e2a7367f3436c5069e79d69090f26a4d0db2695497bf6e0a9a57d4034648f409d4895569915912ab3b9b976ef9ccb40b8279873760d6451c46590e2e1
-
Filesize
5.9MB
MD5dc40680e56c3761bcaf220280de31925
SHA139fb95156155d77034d1136ce37a3dc15c233a6d
SHA25631d1eab3d7a5adadb611cf79dae1c147a72bb2502fc1027a38bd4f6f79b2db05
SHA512927cad68d4d5940deb323eacddc6e73ed1d96953c221c4a753e04081b7337f9b8ea6a229ea4dbb3291a571853af5df6a3bc320acec9301455539133a9fe3a19b
-
Filesize
5.9MB
MD59051c7830c5da912963b1019167fdaa0
SHA12bf9eed1f5c1a1acbf37e61ecf555fe7f6463146
SHA256e40bdd930dd345414ecc926f15648afd9c1552efdd41ecd789144ce287a1bcfe
SHA512e630b6e9365621cb72a8fd44064f79fba57b34f0bf3053685fc16afcd3d47c49d3915a4f7f8ac9b61e7418320de73178066bcf38199b19743d645b27635eb9a6
-
Filesize
5.9MB
MD5ae4c693826f0450c7d42a006df42335a
SHA10eaf9de6586685b97a95a9ed51a9c5705fb9fc0f
SHA2563d44010699e73a2a63bd7af678a40aa513f613984bc66a2bd5ef74d16c25e2b3
SHA512db93a24a7b47e2f60b8df2963bb465632d3202967a8c3cd805cfabef3831a3eac106f6f23cf7c5c12c78a506b54d4c18c00c04a4c7c3b8cc503ac8b83ec26cc3
-
Filesize
5.9MB
MD50054eeeab297fe006f8c313a19064564
SHA1f5a0ec6f4d371b8a8246bf9ca9d428f323e15f7d
SHA2564357402519d711b6390d7643daf547c2f7c01e3409664eae6ddaee4269342b40
SHA512e3568caa8f0f4927cb7b874752795e7e2eac58ca1a568fcfb0a92719d34894663c9a3f9fa46f9f2cd3f464334d37b274e6936b309bbf5155a09def2f0967f5b6
-
Filesize
5.9MB
MD57ce7cf777097df56ccc9954720a11fa0
SHA193456d9b8ada099e0e6878b43a0666f8e2eaf4fd
SHA2560d4c697ac9652492b233605a25244aefbecb811696b89d45a897b5a24c935670
SHA5124e90af4648e75934c71c69b3e5989b192b98287ce10809a915a0006a0a92ec69506407c832a03593b55e25492dc83112ad09d12ce020a6433c809f7da14bc603
-
Filesize
5.9MB
MD545805dbc704700db2678e6c1628a12af
SHA161e442bd32cfbd79601a4649d0cb0b4056b8c718
SHA2563b6c7cdd01f827c73c427b4efa08dba10afdb2b49434cf83693f41c74607b808
SHA5120909e6ce5fa9df1dd3a4d44fca174fe84040ae2829b7c5e164d842c1600a3fc9892ad771846453a12f33cdcfadee9e193d9cd0422fd2e9e21ae6e276d6dd2dcf
-
Filesize
5.9MB
MD55c8ff11a9ad5f003673d7f07ceb4e9b6
SHA104c9bd8ec01b76af6dc0e1cc733dda7ad838e55b
SHA256cccf9f58c41eb3192b9be694d4623b65f84d17d5e0e25e56dc805bb3468553a8
SHA5128e10857d6987fc873018543c530b19666c7ada1d3a6f5a12d7335c1fc18e1d7a1f76c446db84add91d5f1794b357626308b9376c11c45f8b1d66e12ce926af38
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB