Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/11/2024, 05:29
General
-
Target
2024-11-27_b846b97ab8a354c73dc2bdc3eb45f2a4_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b846b97ab8a354c73dc2bdc3eb45f2a4
-
SHA1
bbca974599650eb3681355b0c218fff898590bc6
-
SHA256
e67d2ea5f5f047b339382ab6434d8d8cf1b8fdf4cb1ad424c521a57385dbfdd0
-
SHA512
d7b996ecbcb4d9f521a2b65427601e7606042969dae93ba0f68847ffd46153b57dbf50cb5fba1500a3ff43b0fac08b9da499ab0757a66a64267661240eff14f3
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUc
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 48 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_b846b97ab8a354c73dc2bdc3eb45f2a4_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_b846b97ab8a354c73dc2bdc3eb45f2a4_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wOqzQoS.exeC:\Windows\System\wOqzQoS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCdjwNV.exeC:\Windows\System\rCdjwNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gTvemxJ.exeC:\Windows\System\gTvemxJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpJuOVb.exeC:\Windows\System\HpJuOVb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vwMtUjK.exeC:\Windows\System\vwMtUjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ThoAHBq.exeC:\Windows\System\ThoAHBq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JGytSsQ.exeC:\Windows\System\JGytSsQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ymIMFUh.exeC:\Windows\System\ymIMFUh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnXoXbs.exeC:\Windows\System\xnXoXbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BpLHyue.exeC:\Windows\System\BpLHyue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vvbFrxY.exeC:\Windows\System\vvbFrxY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hLhmFiu.exeC:\Windows\System\hLhmFiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ElJPCHF.exeC:\Windows\System\ElJPCHF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ifUZOpy.exeC:\Windows\System\ifUZOpy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xuPVESl.exeC:\Windows\System\xuPVESl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KyHqdkG.exeC:\Windows\System\KyHqdkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JvVPfQW.exeC:\Windows\System\JvVPfQW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QQcNlVD.exeC:\Windows\System\QQcNlVD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSfAjmw.exeC:\Windows\System\uSfAjmw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vUXAbRD.exeC:\Windows\System\vUXAbRD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XuuWoEy.exeC:\Windows\System\XuuWoEy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD51968350e9a08d1243934c42c8cbefb15
SHA124f523c40d1d88b72ccbac54c4112317205668db
SHA256b6b47eb525cb933d76da0d79b7136d6e466af4f88f057714317a886a5e81ed07
SHA51289fc69f212cc9bc814eaf07a031b0c6bad00377a26151209a2e45d9b9c6e148c7c2c679d51a8cce660b65fc2cac7a10fa093c3703abd8ac667342c7d9b01dcb1
-
Filesize
5.2MB
MD5c62c13ae375414d29af29543f0104fce
SHA15c9465a4e503289f9685d8e03e56e2ada27a8b38
SHA256ef5908a28b174fa8242a7833b90cae3d977828f1e130c61ddd568f246aa74768
SHA512d4a9f84a336ff6fb2dd601e56d48794757f8e214874acc702c8984aa37d30bbd94849575dc0320f29c999ff69852693e3ef71188772f620e787ce01a3f879225
-
Filesize
5.2MB
MD5960e6a473ab47b59e57b2825dbd92781
SHA1b55f20a94de2468131a6bbf2e4f678ffee480ac5
SHA25665e95841ea0856cbfb8fbf6c0205a524f8bdea1e299debed9ce9f7a3ce24911f
SHA51287dbe4eea34622dee5fdaaca5968070a54e8a6de9184f1fbfff5cd2547fae50e24e9a8b02fb2a2a257736b56e51b3f59dd5147bf54f855e42a56de2e39376ede
-
Filesize
5.2MB
MD56cecdc85405cce650b665c0f4f96f044
SHA12d4428d64e5dcdfce6ba39862318dc635c1c0587
SHA256909e0a34c1b6f90c0eeed0caa55dc69549e2b48436e9d2c6683779fc810481d4
SHA5121e8043d762efda93c5587a1fbc682be6a7ff9d79914dc82ea5bf6fa217ac955ce656ebb5bb4f8fa4dc73481047e70a5be3e28133dcea74f704c52a838cbe68da
-
Filesize
5.2MB
MD57afc58461db64a4e122f519877cbd301
SHA1d527ceae9a97e6fa93c89a7cfe4beef8072a50b5
SHA256eb88df1563ab4604f72c3fca7449a8957e53270b2784ed31afcf781f28513038
SHA512db84a1c6f7e3ab4be8e72592bf74ae6880bfd0c4775bbc08c078b9a9f5589edd68f11be5d11401bc0c141631342defcaa8322f423bff2fbab61a43afe505f192
-
Filesize
5.2MB
MD54e30de7084a3b06afeb88a0676217c06
SHA1f1898e6a45079df62d6049444da65cd56a5b077a
SHA256dc685356dead7f69f522ace7b0d2c47cdad7813d7fca0a7a03b3418a7c706315
SHA512ba2dad0090ff367cf4d689e9a8b4bfc36ed37fb42f95d209306216e0ceb304c86f559a7fa3887cc57aa529601910233d65ebe1144418ff2691612bc3e5216b66
-
Filesize
5.2MB
MD51b639c5f3e1f102136ff222dbc0fa3ed
SHA166301f2201edb57b90f9815a7ea5d16b6e215338
SHA25653f0c6a17661abbc480367c907596a8956bf6aa6b44104b7f5b9ce2752bd2f7e
SHA512dc69838794de78d2ec4b818f9893ddc39b5045aa4bf5036e7bdd4bf8923ba6b7c1a32ab901b6bd60b53192537f913394fbad37fc363e30679f3e41b7e6c25e71
-
Filesize
5.2MB
MD5d5f8964a1b310842b4612a7ca1abc53e
SHA10a6773f50e9710670412a0a6d8eb6dff48e2b2be
SHA256816b5c81efcd95bc7199cdd6224f9da8ae33cee34575753c3857456380b41213
SHA512d7cdfdabc16b3524e11a6f0a2346ad494b39e522217525a51bbf3d90ef8c58c80b2f2a093864bf5bfdd3acc408135ae847f61cc82a1dea3e0aa652959621ae76
-
Filesize
5.2MB
MD5293fb18122b317f31ebb9a8951405e27
SHA179fd9bb46c6f3474eb20111746ff9bff7a35415b
SHA25662f4bb6bc0962cffa0c0af22d54fb369ae109ff4a3f541455006f0abda97ba23
SHA512c203f3528db0a45138e2cf554c5cc0ec96cb9da37353ea091ee9b8778b7b7ed45bba4496d26e01acc0a316e790eef99bc6c601db09632bb6a8730c9b40a44ecd
-
Filesize
5.2MB
MD5992ddaf1edff7009070dbfe834f2cdac
SHA1fce3439114def23f9525e565cce90678d952e981
SHA2560dcce5646f46fb497a49578e2dd6b1c00bddfbd156be726851ca8add91b21ca4
SHA512290db7998ba18f3a89247f6b8d14e6ab83cfd9118612a01b85322f5726ee88b6ea9e762c5b14d12289cc3669833e6a08e69443080f29ead9246490617ff82d98
-
Filesize
5.2MB
MD53e3e2c64d9dd51f89c7050436acb8cc4
SHA1895d2431c3ee9772c9209dd507046ee2196f776c
SHA2561c37d5f9bdc6abc8186cf01eee97b55c7867520374af84d7ddc5b4dd5b6322c0
SHA512eca86d72be3e14376cd8bcf79ec374f9ccfd3a33c57ce5c6ff802b7c2815819c5d6a5cff130e520fecbe04283914865c0c534684f3a8b1358b8f52872032184e
-
Filesize
5.2MB
MD5eaa24ce2e5d09ea94a4a2d1f802755fc
SHA12d6d6478c691a321de35f6704082fe6f40c36edd
SHA256446fa09b04812170972b36a8460099b5767df6639d6ec054d36d089e17b95152
SHA512d373dd62443aa6c9d1125e6a2c1782cfcca9ff4f882d7d63fa69c946b8b1d04dda6b683619b9e861236458c46f89fc3f130fff34f99fbdf0db9483c4dcda20ff
-
Filesize
5.2MB
MD563e9bce487682f88f8ef2818a2d8b368
SHA1fb9d1ce0d6a2c7996436f30f1993afa5c72ea5b7
SHA25615e355d97bc647137e949534419ddd8c611bd064304ab52b6b08cf270a91027d
SHA5123e006ec86035c5caac345f348b9ef6a60f9c38ba0a3f337a31495203cedded052e226a67726ac0479252f4960ff59e33dfeac089e19f9e262990057b2435ee52
-
Filesize
5.2MB
MD572e38464be8be4400e5079b4c5897717
SHA1ecfb0cd6785799fbfd17395a81724be65b89b2a9
SHA25646cbb4d215579f867490ec09c26861f24b4d1b46e5eb4910e5751c97340b5aa3
SHA512ce60be2a379c184a854bdc144cf420c06aa50f87a7ccdf55c0c1a31be476c417d6a76b2169db5a7872016537e66b1f19d3d3973e5476f171a0bbc3f94ab756c1
-
Filesize
5.2MB
MD583a211a92292bb9ed56881b09d0ee527
SHA10c43c61e41f417653d130813ea08ddb0d98970a9
SHA25656d20ebeece1da38ffd52d89647037437685938d7b7f8ad6d7f2f4ebaba7fd44
SHA5126fac951f86ff500b7e9b00491ce45e2919f208d3c0eb9b80eb503679feb3defe153c5f2aa4617d364e37d5aabe42173b0f0ca72f32fab9538a3b9c96afe9d308
-
Filesize
5.2MB
MD59c022621170fa74b015b4d5da513e90f
SHA1e22f3bf79e598b34716d7ae38a6d174eee0a294c
SHA256953726e7018160b96199f329f3f1bb4ea13b280cd754403dcc00879db4384a1d
SHA5121cf05f4fcdee177191ef32cb81503704eefe75c9ed88bed9df40b604f6d2d74a6bd958341dcca38bc65bc1b59abf924339ce5e60203f37f25ed42b67c9a6c263
-
Filesize
5.2MB
MD5ee190bfd1e76effd34bdf0672d9ebb1a
SHA1d44e6fcc9cac2ffdf39184b3cab8d5a011cddfc4
SHA2567bbf247f84780c296c49c85377574fa2b53a61adade7880485a1702fc5d2ee9f
SHA5124f5a0538b495512b2c74dc816176372d5575f15079a5d4f6293cdf74cd841bd36aee9972a95388ef47445b8d92f8bb12e1a153b8ab7220b7f6c4a0df652a50c0
-
Filesize
5.2MB
MD5b5f2d3705282a1fcf4b6c8d3ee316199
SHA15f89234c437768d3d42fa9399d47041f03096721
SHA2563c7545fff6d65f5af4510844d3bcfd9a50c85c15a2ff448c98c91548d9541481
SHA51299fd48323278d9833c0e846a42e129064294888cb8ad7641fe6b29f037f8296af24ca39da9859ac7204a1234e7436a5cd6cc36e8062539294ad7f57fb3a4f4dc
-
Filesize
5.2MB
MD5efe3a3ca6853c396aaef3c8ac6dd2014
SHA1abf6a3d97e2f1e3398506a529706b40b9437d241
SHA256bb365742e2699ba99ca6ddb2c2cd2ec8f60cec3e6cb501104fd2cf113d3cc271
SHA51241fede86cb4ef65c468357fde8a0beeaf1be4812469d240632601d291ab92e0d1969fb51d162836f8bfe927e5d136699d7aac7adcfc45d1713cddb9115386e7b
-
Filesize
5.2MB
MD552dae1479ac9b8a4c25a4cc6413fff2a
SHA1014e507b90c290fa9a6e93ae984ff5ce90531bbb
SHA25665fcc36167da069668345b64e64972b58d0055e61249b4695444a4023574ee75
SHA512c2c49e29d2855d6dedff2e1a76108735b0daf607dbedf11b5b42afdb3c23429516edec399e3605b4707ce4276dec4dbda9f4905e5a7b8dd3f81bdffd5b82bd89
-
Filesize
5.2MB
MD5e6310ed7b28fd09a5e1a286efe4099d3
SHA1360790cc4fb3e22a0bac776cf8427cd4f967bc23
SHA256f986056c0dc574756ecf2b4b5607f4849a022740b4e9a697dca07b77b4792238
SHA5124039f5477bf41e8f37fc2f6eb22db639f1652bbffd165f604f82d4b8bf820dcebeecda3428d0aaa6faf0099662ab33c7ba63a71fa6ac453202f23123dc1501b1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB