Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
27/11/2024, 22:04
General
-
Target
2024-11-27_4290a9d31f45e4aff869e74b74377b72_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
4290a9d31f45e4aff869e74b74377b72
-
SHA1
cbc28b41e99e15bd2062a0e2c50ba02cf1ebf738
-
SHA256
6bdbccd089408e35e3246f000ec860766f5ee26266d19aa17b1381ad13105dec
-
SHA512
b1489b1c6b5662f8209e694f9b64ad26c15ba78c90a841070540a72725db9ff80df94aa63e3f44e970ae2c44de7d753cecc537f66309651b73f9cd9f936700e6
-
SSDEEP
98304:demTLkNdfE0pZ3u56utgpPFotBER/mQ32lUo:E+b56utgpPF8u/7o
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 55 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_4290a9d31f45e4aff869e74b74377b72_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_4290a9d31f45e4aff869e74b74377b72_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\rhRMgkw.exeC:\Windows\System\rhRMgkw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxSDFmo.exeC:\Windows\System\VxSDFmo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fCRFhwa.exeC:\Windows\System\fCRFhwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LLHqMaV.exeC:\Windows\System\LLHqMaV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iWMJyoJ.exeC:\Windows\System\iWMJyoJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xhGGpdO.exeC:\Windows\System\xhGGpdO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nonEqUF.exeC:\Windows\System\nonEqUF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JmPoXmd.exeC:\Windows\System\JmPoXmd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TyOkPHo.exeC:\Windows\System\TyOkPHo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uKreacj.exeC:\Windows\System\uKreacj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mVmeleV.exeC:\Windows\System\mVmeleV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHQPjDw.exeC:\Windows\System\xHQPjDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UmqMHMk.exeC:\Windows\System\UmqMHMk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pyxvNdN.exeC:\Windows\System\pyxvNdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZdFVOhW.exeC:\Windows\System\ZdFVOhW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tYCchjA.exeC:\Windows\System\tYCchjA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FzkHPxM.exeC:\Windows\System\FzkHPxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\buRNdoH.exeC:\Windows\System\buRNdoH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lvrqAfJ.exeC:\Windows\System\lvrqAfJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nGgtYrH.exeC:\Windows\System\nGgtYrH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRJRoMb.exeC:\Windows\System\MRJRoMb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5993cc1e1e5dc2c0e42632928bda4a21c
SHA1928ca3b4fc57d4ad4b5cfbcbde74989625619dd1
SHA2566cba0dd0fcc421063220e9a556fa0059f1d97a5f7905ed717a6551e27b1135ef
SHA5124f43947d207bc27b9acf63c582d232ace0c5b971c903d3325352f0f1e41aa03b4c479b51e7f4c24bee97c97be90ee4790a20ba0990e2cc0d0d3d0cc17de4b0a9
-
Filesize
5.9MB
MD532012674f8376424499734a71a3fbaac
SHA163c7158a62464b2f9636923f7b1379c2a043ce8d
SHA2563bf66ff82e3efcaeecc36ee6bd928b58efea2f462ec0ebc4fd019e95d1d0a0e7
SHA512c910b75dc28ff6824d2b92202d3fc973775e2e17b4ca7f8eacc5b44cc779c7aea5ae5a1b2d72bece2e99646ddbe54587f500aa5f3150aa1e3b5204c54dd0b15e
-
Filesize
5.9MB
MD50e80aca4c2efb9d922ccd0540b0a9264
SHA1361693a435ba137f0ae7ad1706e30dd3e1aa4b3a
SHA25662f70f349d10ac7083441fd54ca139208b70d33369b538ce14554611d9474c0a
SHA512fee26d7a43bb6e561b7283e4bc46731d2d6fbea801abacd49f546286252d45ec0ae2b3193dc11201b97878e84791a6b535e940ca855ec9fdabc6142364a346dd
-
Filesize
5.9MB
MD5c2f5bf29380fc69fce85d7bcaf5b77af
SHA15738dc76bb70f41682f7d80b72f714d8056933a4
SHA256ce8e783d4bdb916653876afd60e0e8549146d73103d2e7a9afc4b9edf6b6fa0c
SHA512cf6d21797bb72df62d968ef65285940cff639f98ce9198e5a22b2ddd64955d41def461596c98505562c16367dc7f826beff4048cf024bd2e103c3aa3d69066f5
-
Filesize
5.9MB
MD5fdad4cc94618d83224ea184b301c47c6
SHA16846752d4f0f9b9b835989f32f96378ba3f9a979
SHA256343828ded075459c9ae910ac57eadd2d707b1f62cd0a27806c259db0eae5c83e
SHA512b91f447d5c1de0ffff7e4ce4084d61404ba3ae79f38ea4e2e2b18908917411bbc5fb830f279acd612127c6fd260198f8cab20feee1e6a066d3fc307f69cf5c77
-
Filesize
5.9MB
MD5989c88883ea698051932a8860996965b
SHA1388395471942464fb69009e8f372bdc493b1b294
SHA25614004f7b6895ce5901a7ebb4a10cdf3f28bb9bf592d3295bb9bdc4daea84db84
SHA512a54108c7c213b950bece6a3ff2697d2d04e48a8da4f88bae172b6ac66f5368b09ff1bb2e4ad79042f6de0031d9b4dc4596d91571dd7f064a2f0edcdd6eaf92c2
-
Filesize
5.9MB
MD51238380aa61bc64ecd59f30d850ca242
SHA12f80fd7d285e568304936df69c516180a6ff5ce0
SHA25680421d7da3e0f118c2796b3d699cca0bec6160f53cd054ae6eb0fe22cfe51ba8
SHA5124ef297e9ec7ca56de8d140612681ba5b63dbdf5c93dcae27cd8794d751c2bbb40692a813445c46da83d391fa3596794cd768b6b9a01646778931c979bc5fd661
-
Filesize
5.9MB
MD55024aaf8440669ccfcd129440f9201ba
SHA1ae8d70e2a3c42188a97d8db7fe8dc46399a6a87d
SHA25656bf62d5431c43cbc2c722ba9915a0790370acedca5a8fa32717ee6cce60f7fb
SHA512b4ddfca95cceb44e7e05cd9ca71d0edf0add01c1c21067021c23e2eeaa6891e9cdde408855c2e823a8ffa389321ae8b018e249f1448610f06782ad478f4b67b0
-
Filesize
5.9MB
MD5aa62c8ff7432c99e3abf67fab2795422
SHA150b8252c6b921f033f62168d095f8546d63e0238
SHA2561f6d0844fbbaecfcfcbced4f23b5b62b8ae3f29c1bc188d3d06cb88ae821a386
SHA512590c6b231f0f090a1bf067e7b9f2909c5932774da7e5a7a732dfa1a36f03956a7fcf4b25f1663c32c3142558dcb9cf12920efcc4a1fa22789fd1280e44e49533
-
Filesize
5.9MB
MD569a7c399bb082c2550ea76dd3575b0c8
SHA159634341ba7eed3a9db79841c92ef291a6483ff9
SHA256339f14fd9dd9ed0a1f90a37f4d5e67208cc1cbb847f95a5d4dde513add7dd610
SHA512af866c3025bac0857356b424faff15a31b1974129088e8746fe3c47d7140daeff66e36f62218ae8dcab0212e3a5179390b3867ded30d84c93319875a884f85d6
-
Filesize
5.9MB
MD555fea4011f725309d2e1406f11d9e1e7
SHA1a32f69958699f9bfc8deec4483cd5eb35d13688c
SHA256bdb60ee3f38395b9262dfbd0e39d65fc2e5014fd08c1349d2b5c2e3da90b24fb
SHA51226b47818b3a0a9cede54eb1902184a3010bed5dadf6016ba70b9c6575e65e7060c43b30bcb412a633ed3282b6336a022dd8ac5319cc0b2cd0ff8387695c010b4
-
Filesize
5.9MB
MD57eebcf3a2acf53ee79ebe8eb6aae75cb
SHA1bded1b68334948780bd1eefc4d12234d9fca21d1
SHA256ea17ed7ba302e863c49461e9db21a2ff5b85a5bea1f340a045d899005a994b00
SHA5121fb2d5f0aba4abf12ef787985f517fe61becdd50bfd5173e8c90ca2ad7c409086ae2daa569702d420b5f278e47a8d904bc2ed63148b22accb9a6667caec74ba3
-
Filesize
5.9MB
MD5c8eab1226bab414fdcc052dd9949b4b2
SHA196d5ee71290797fae0fc1d5bcbbd0e991732ec8e
SHA256f453eecef5097a0b8a2bda3f76ec63752a9444fb64e5a466a17d5da7ac517426
SHA512f2e19135e30441fab99f4fcf04a3c9cef05e16e7af8776ea40509e68964800fc5743df7986ca272437d85374bdc1b69920abd28a11d802d74b147552892ad910
-
Filesize
5.9MB
MD5f4f384695f8bf160eba6aa9ef7b8863c
SHA1162858507e7b22d486206304b526b4936166c91a
SHA256da6e002cd582a68f4df20663dae91ddda6008a75285c855abc85d7b2d1bc807e
SHA5122a2e3cb3ac51ef8cd6c23cd245b068c28e69ce1cc2faff33e7fb8abe6a98561e76e7060bea251bcda625f93188f459a483f42f765509621ef8bc16227b6dee6a
-
Filesize
5.9MB
MD5b622e90197dcd45be6f4b99614dd7859
SHA1562022a2636bf9d1785a93923e935e9f59659f11
SHA25649fc81b697313131a0738d0c938f4f92efca2cf72e44f07f8a79754fe13f8be8
SHA512c8ed9a68156f169b9fb1c936a38369ab7a631b8f6de18462a8b6346d111bc27fde05d9dd8b67adda1a56b758bd058b5900ff4cf459cc4781eb0494f76762dd15
-
Filesize
5.9MB
MD536b91e5b4f7e774fb4b5986889fbb617
SHA1ac46211296e2b98816d4f1f5e966c533036f5679
SHA256d4722cca18d67746741bd4df5139df60728457c1e0e7fb448ae440ad7c94163b
SHA512c30b9b125eb53d2b167c2a850cfcd79187743366acc077884333824d1abbddb8c478d2b982bfe28914aa23de3fd86a2baa322aa2807ea0fd4143ec700d8a48b6
-
Filesize
5.9MB
MD58eee35b912bd596a2ae7fc9c0c4e4d31
SHA1c4da78971da869000acb0458e48ba66faefce614
SHA25619290be077af5ef72a1c9b57852b12f487a9e4e55b39f5650989f817b7305adb
SHA51257aafc5d6c3f3a66d17d2fd966de9bb468717e8448cab32adde3aff06cc149efc263e4b804fc99b2575ad8d6ae5c02aae57534a1ab076252d60ba5830272e928
-
Filesize
5.9MB
MD5dab396d9a43d714eb8bf3dcaea14dce0
SHA10dcdacbb7d78ec0ed4dbabb1f9445039ccd4b1a0
SHA256b5e4a150701179bf1d0259d06a0ca3b07976f3f86bca25bf84a737c090ac3463
SHA512fc147a4debf6f716dfa6a5754e48a4c8b3f1434c1a8be2e55248c4eef66a0f21486f87d203160ea786c16f4f29314d9ffa40d1425d180469bea6c1bf7152570f
-
Filesize
5.9MB
MD5c9ddb81c941825051427e4a02d9b0d0e
SHA187281a0bce0c6cd480c64aa49888606adc80daf2
SHA256e653946a52927a033f700d3181786cc5d4d8e5951483e34d8935197a002b240e
SHA5128ec4d8b85002bb35013a077c76c5fb93a08db2d696e0dbd69dfaa5d2fad917c1fe6c9fbe66305c9d4feb751c3de0efa1518f4706a0d7743f2ad6fd23c7fff035
-
Filesize
5.9MB
MD5a47b1058fffd6299de28b7842999eb7b
SHA19804baadb1b7dfcbdb54db98abd1a2f588602d14
SHA2569c8c43f2d9b68a027a58841c41795b54122921198cbd262fb08796824299a0fc
SHA512890564e4e29a6599dd1d44d5bdc82ab720f5b47836d712001aa69f391a9ea7aa11bad7648bd162a197602c405b008d3805527dc48b6d7f85241555f0956e170b
-
Filesize
5.9MB
MD53466781393dc8893620e8b726f59ed11
SHA110429231036580bc84d37551efbed9dd056eec12
SHA256080353b3f64817db765f52d2fd9e9b554e5e0efb05ab2a7e8efc03e61337904e
SHA512bcf69f9737929536ae8fa9be35e298a341017d60dac0613e9b748309b5187ddc13e0b9319a4077541279e48402b3be32f31c264a198b94ec16a8d2878b1db506
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB