Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/11/2024, 04:53
General
-
Target
2024-11-27_77f0344636aaaaad40149411226fa028_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
77f0344636aaaaad40149411226fa028
-
SHA1
4ae78563edafb34ea825d1f09de94793c0dbea61
-
SHA256
18229fa1294fb1c583c70ec0eeb4aeb1bea5e8793a8734e6c87aed99bb4a1e41
-
SHA512
ddf2fc7fa2af323d33c6dbb092df91f506d6a3a1a45514f97bb6b25693eeaa09523bb2b2b8995d4133484b03403715edd875b878483cc89dc722f355ef3645ec
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUj
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-27_77f0344636aaaaad40149411226fa028_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-27_77f0344636aaaaad40149411226fa028_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\DgRWZPs.exeC:\Windows\System\DgRWZPs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ocrDcfR.exeC:\Windows\System\ocrDcfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LFYlXwV.exeC:\Windows\System\LFYlXwV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNyRotW.exeC:\Windows\System\oNyRotW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GsJpIbm.exeC:\Windows\System\GsJpIbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXyVdWx.exeC:\Windows\System\QXyVdWx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KEEfuXA.exeC:\Windows\System\KEEfuXA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bDlCQfk.exeC:\Windows\System\bDlCQfk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZScjtgM.exeC:\Windows\System\ZScjtgM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oeTUBwS.exeC:\Windows\System\oeTUBwS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\evTsjcm.exeC:\Windows\System\evTsjcm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QHXyPWJ.exeC:\Windows\System\QHXyPWJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ouuPowR.exeC:\Windows\System\ouuPowR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lWxtlZz.exeC:\Windows\System\lWxtlZz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WfLAQtK.exeC:\Windows\System\WfLAQtK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ylosskq.exeC:\Windows\System\ylosskq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\thBtJZk.exeC:\Windows\System\thBtJZk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cpTiSkG.exeC:\Windows\System\cpTiSkG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WBstoKF.exeC:\Windows\System\WBstoKF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uNiMnsy.exeC:\Windows\System\uNiMnsy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LEszzIc.exeC:\Windows\System\LEszzIc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD56cf2ab3bfffc28fd06785a288ee2f232
SHA10f2273b7128708cf511d10ff763b1a088897c5f8
SHA256eb5bdf9e341925e5e5b59f3a73536c636567c1a0377e30d6aab2fb71d82b32fb
SHA51261b00841ac3f863533efcd1f3d6ecca8826af528016a9608cc377956eeda7e831a7ddaf3b8e0040d148dfdffdfb0f9cfe4338878a94309eaab36b79ff91f5f98
-
Filesize
5.2MB
MD59594826356085d64bb4c15cddcf947ed
SHA10ae2080b09a15f46fc4d5e89794bbc8363d755fc
SHA256854f625af90445271151ef08a3ca42ffad421d2660bd795dc7722675550aaf92
SHA5128f844f51a3fe41f6c17293499d026f534f5d7af0ccf231e534d649c03e45621e5bdb0efce62023150bd348ca324ddb1300569c381c087e63850186699a57464d
-
Filesize
5.2MB
MD594ea1430a1f4cde5b882f23fd7b53c86
SHA1526c1c3e03f56c52d77cb2e9c663ded658e3d4b8
SHA256b15b6222190ad87f1d8758fc220dbb166e3eea82203980c094d297e62482c3bb
SHA512e77a088eadb2eacf5db5d43581c01a36f4d5814fcf6988e24f7336de32507a49f30bd54da43578aa51b2e7728573a9c1c811efa1483d9f9154fd441a38da375b
-
Filesize
5.2MB
MD522154aa6005ce7584314a94bd5a0fde6
SHA11c14c4d98827c8e9162a8537cec6fb715b2dd2a9
SHA2560337faa04b88b602ea5a64267c688a64fa6f1a8defbf10525d4477eed7bacc4e
SHA512bd2146dcc51658b9e8fe320d4869c03cdade16d38eb05cb301fb94551f1d6974b54ad2a6addcf61dc7c698b7dc67f96f9b26dffd77015f6c2e2f16bedad73e85
-
Filesize
5.2MB
MD50112151a879ffa2a16450f8c4f218b32
SHA1ab044b41439a933ee6701fcdfd65dc0779e22c1b
SHA25623c8bd88e121a63e7e58aaeb5675920a7bbbd8c2ea7fa0f9f8fc968092359b09
SHA5123e0e08ec7f60a485c9e9dbac600ae3889559213e0570fedca0420eaba7b53688fe6462d4a5ce775d368f905e72dc511692dee3023505c8c1b2c1f5d561aa9d02
-
Filesize
5.2MB
MD5b10a06759e4d7708f10fbc30f6bfee80
SHA163d4428c64b45f382030050f4459937c01b90b20
SHA256759df80a0b27b541b22684c4753178d9ec8a4049cf89948cab704ff538055b37
SHA512fb970a6413d820b1f8cdafa3559d35017185e509ff0d906215e97106b6b4afdd9a1f2b251839125e222242b0ff4272b485b0f5cacdab33686acbccfe7950fc1b
-
Filesize
5.2MB
MD5989a8f7e1d887fd6b2d575fb976bee54
SHA164f38d1b2ef237d726114ca68d690f6db7f309a9
SHA2569ea97589489c02ce247df3202cd0ec8e54fb6d0edbdce8e1b74e608075d69ea3
SHA5127d8d8a5a56526c3c30ce7a62bf55626aaf156dba906798ca88f39a61a23e9c6c6d56d455569121b0e024af1f313652a072666aa0d6693c453f48b3781fb34fe0
-
Filesize
5.2MB
MD5fabbcdf61f8517822fe6fe50af0e5ffa
SHA1a6d0ebd1058e82c32aedaa10c5137eb10d5d4510
SHA256fcddb654508471403456b8870f273d8bf2ac354d8dc9ea877f7db045d3b09e9f
SHA5129454b741e64938439e744cfb0d9a18fc437a79c54b49160262a2660deaaea7bc7a63aeaf04a823475f84dbc907805aa849f6ea5438c3d80855fa06ed6103bfcc
-
Filesize
5.2MB
MD5da3d8f8262c84f1759ce9994d1355940
SHA1fbec553be2bee35ef63a263ccf75803f4beb7f50
SHA256dbd7f93bc22df3252be3c1c5f0368d99a2573ab2df24c6084b05678df098e2a2
SHA512d493d66d63cf85b9c699a32f278414797b98e6147b1d1922317ed75812ec678b3533265a19611b9d99aa3d71212e8ebbdc7146ffae181f11f46493aa94c5dc3c
-
Filesize
5.2MB
MD5d68216fb43575815470b010012b74671
SHA1523b20afe60e67e5f8e0dd2714c6960157d775d0
SHA2563af4666bda81da0c439ac36efb21a5ee3f40d59732b3be328cd8db0c37802f39
SHA512b657fcbbb0bb3f19670233798abd984d9b7c607deb9b6d3540a6cfd48361702dfbd26b59a3bff8ce6c3679d07b71f288ac852df23cdcd3f3699a7678349f3828
-
Filesize
5.2MB
MD5e19344ac617bff9e80b8fcc24dbf6e58
SHA160f38fdb2cf3d7633679b633be512a822a0c85ed
SHA25682d2d57aeb0e91834d46ad82dc61fd7bc7872feb487c969403cdbbd06aab5cd5
SHA51205e475f225d145077171917c86d616ecd1587b09a096cd8e7e8cc03a3d109ef87b8d35c8a6916c124928db43681d6a14154b638535b9c709e6d3efd8cb3d9502
-
Filesize
5.2MB
MD5aa19bdc749e0176b2e8515ff94374153
SHA1a00030132316ee9e4b2bbbfd5f3b030056f88777
SHA2562c0110064611f8eec31a5bbc044789a1d92b11a79c6220b2c4c2337a77e08415
SHA5129f841a8a2080da71d1b0538458e84c87e3c3cf893bc32a2d7043bfbb11f26fe6c4fb0bea5a0ed04d9588c5daa69016cafaf3598ab377a97d521c57c917dc6966
-
Filesize
5.2MB
MD5b4e8bf7aba3b577cc50c1d0601a34389
SHA1bd9eebcf62bdd9f862002c64b49678fd0b71ec74
SHA25602c47fd20944ad90e812f09e17acd55d60acd1c8d74a50169003b8ea5e0be8c8
SHA512f086c6ff63edbb6d638928d0203fc62bf1aab7510ec21f6d218b20db7e216dfb8dd1bcd4b6cede3501f984e38d4a89aea6d6de1eb1dc3ee7ccc37e0107de4f7e
-
Filesize
5.2MB
MD541723c4e657a1a6d2be8c8d6596e0d14
SHA12799329371ef8f3c19db8521332526c8b0d89f42
SHA25658fa0b13c10f39ddc4ac0d336eef838258d7f811c12b08eb220affd4ca962bc0
SHA5126f7313bff56ba117fad4c6f82f9c1936c483f3dbf835ac21becca6c1f618fef660778da6ad858f9169815fce6414d1ee3389d24ca9ad8a63ff201841e7e8beff
-
Filesize
5.2MB
MD53df747a9b9e5f5366ce22d4632396a58
SHA19717a96849c8d80fb2c2b50376ec01259281d9af
SHA256bddc02fff8fc32a190278fbbbccdde6a79f75b21e30c0331074b5bf45ef82062
SHA5124791a66010b1de12f30c679cf7a305c5f084d6bc1767d8ae9af7b2cebaff0dbe523b20487e2d96ff07deb275057a9046b1c4d87d6e39730e9809fc30e7777ad4
-
Filesize
5.2MB
MD5de21d20f506d1f9eff3d39ca7aa6a5ed
SHA1debf83126414765315a7a3e21faa4df355fb688c
SHA256d0d3cdcbff88684aa9052a830873b0d08560f7cbdd85d77360fef7fe3224e92e
SHA51224e0fc385ad2bd1a82a53486a659c692615ff91ec3e6c37b9fdb153b44cf216f454df1985199409aa753544d2a8fbff8d354d20c5f0517bfff2b07e34b8fd4c8
-
Filesize
5.2MB
MD51540341a5803923870c40d0e97fffed3
SHA120c2e4d5fddeb069159b00a52bffdaebae1b0cec
SHA256a468f1bda5516695faa61e9204e0512c7577d65935d83e2cdabc7e348e9d38ba
SHA512cc09c0883f5d124afd7b514dcc45756be561e1012985543e34a800ec09415124f540dc981a8116683b27b3a07eb5eed21aee635ec3a3b699ec4ccca99ce5cafa
-
Filesize
5.2MB
MD564a91ae9e31a5a61094f3bc73a5bd55a
SHA104eac7f67be6115fb316153b662c951efb47efe3
SHA256bcd9ba0f7298aba3c5815e4fcdf77bb68c75f5db3402ef13ffae2954044d7154
SHA51222d0563e9eac29fc106a707cfdf73f96fc7ca93558e41cf4c93d3df19b9ba9ee4c15b12973d55a8864d7aef15d5967cc5cc5921196c91c37654f4b0c472c0235
-
Filesize
5.2MB
MD52cffbd8ea1f00966c320df5f44572fed
SHA11a54f2e75886e4465ffea6dd33fbc8a11d69b16f
SHA25656cc3a6ec36a38e516d4ef3dc257a38dc51c08bbf3a86edf47444b61524bacde
SHA512701105117da94ce6903ab624e8101faeca6dc8b27a7686f5ff26e1d97fc6b19cbe906396069ba641df304e23d80030a96494b3bf47488aec72d7f5a62ab9adae
-
Filesize
5.2MB
MD54ea0c39d03b225177ae45075327ae9ec
SHA154b6a3133add42670347a54f6a335193f955829c
SHA256eaaf0693606fbb13e62e9677b115c0f74b50fb26dfdea9aaf0190c1325e93ac1
SHA512119047f703539380a4d11c182c96e2efe24e04379ed5fa7f933a59cc3bf096ad08a9a0e82fd6285191265273c70b4e737cb32101fefc6caaac0521f0904f8d7c
-
Filesize
5.2MB
MD5a07e8bab8969be5011b32c1185825d18
SHA140e6e5032a557ece4addee3e95314c1a424aefa1
SHA2562f98251fa1c06e7365bdc611d6d039199fdb2f1f6e33a24a965f0826ca2ff7c1
SHA512b3f5818d0ee3a9ae8bccfcb9efa1db5177a5df887e23163e12afd16aedbd066ecdcfcd8cc45810dd61a6f6ad9a2a1ce601c5a3629171465fad13a610c79c749b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB